gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38961: XSS in vendor search 

acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Phil Ringnalda 2025-01-23 18:01:12 -08:00 committed by Katrin Fischer
parent 5e7b3167fd
commit b439003fba
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt
View File

@ -32,7 +32,7 @@
<a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>
[% END %]
[% WRAPPER breadcrumb_item bc_active= 1 %]
<span>Search for vendor [% supplier | $HtmlTags tag='em' %]</span>
<span>Search for vendor [% supplier | html | $HtmlTags tag='em' %]</span>
[% END %]
[% END #/ WRAPPER breadcrumbs %]
[% END #/ WRAPPER sub-header.inc %]

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
View File

@ -172,7 +172,7 @@
[% IF op =='delete_confirm' %]
[% IF nb_of_orders or nb_of_vendors %]
<div class="alert alert-warning">
<h1>Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1>
<h1>Cannot delete currency [% currency.currency | html | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1>
<p>
[% IF nb_of_orders %]
<span>This currency is used by [% nb_of_orders | html %] orders.</span>