gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 35329: Prevent XSS 

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2024-01-10 13:56:15 +01:00
parent fadb37d3e1
commit afd014710f
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
5 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc
View File

@ -881,9 +881,9 @@
parent_block.find(".info").hide();
parent_block.find(".error").hide();
if ( add_user(borrowernumber, borrowername) < 0 ) {
parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show();
parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show();
} else {
parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show();
parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show();
}
}
function modal_select_user(borrowernumber, data) {

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
View File

@ -1189,7 +1189,7 @@
if (ids.indexOf(borrowernumber.toString()) < 0) {
ids.push(borrowernumber);
$("#users_ids").val(ids.join(':'));
var li = '<li id="user_'+borrowernumber+'">'+borrowername
var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
+ ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> '
+ _("Delete user") + '</a></li>';
$("#users_names").prepend(li);

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
View File

@ -209,7 +209,7 @@
if (ids.indexOf(borrowernumber.toString()) < 0) {
ids.push(borrowernumber);
$("#users_ids").val(ids.join(':'));
var li = '<li id="user_'+borrowernumber+'">'+borrowername
var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
+ ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
+ _("Delete user") + '</a>]</li>';
$("#users_names").append(li);

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
View File

@ -564,7 +564,7 @@
if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
var li = '<li id="user_' + borrowernumber + '">'
+ '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
+ borrowernumber + '">' + borrowername + '</a> '
+ borrowernumber + '">' + borrowername.escapeHtml() + '</a> '
+ ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
+ '</li>';
$("#budget_users").prepend(li);

6
koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
View File

@ -1282,7 +1282,7 @@
if (borrowernumber) {
var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
+ '?borrowernumber=' + borrowernumber + '">'
+ borrowername + '</a>';
+ borrowername.escapeHtml() + '</a>';
managedby_name.html(managerlink);
managedby.val(borrowernumber);
}
@ -1313,9 +1313,9 @@
success: function (data) {
var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')';
suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')';
suggested += '</a> ';
suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')';
suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')';
$("#tdsuggestedby").html(suggested);
},