gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38969: Prevent XSS in tags/review.pl 

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is contained in:
Jonathan Druart 2025-01-27 09:56:10 +01:00 committed by Katrin Fischer
parent b16582b963
commit ba58e5f0d4
No known key found for this signature in database
GPG Key ID: 0EF6E2C03357A834
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js
View File

@ -213,7 +213,7 @@ $(document).ready(function () {
{ ...review_ajax_params, type: "GET" },
{
data: {
tag: $("#test").val(),
tag: escape_str($("#test").val()),
op: "test",
},
success: success_test_call, // success_reject

5
tags/review.pl
View File

@ -23,7 +23,7 @@ use Modern::Perl;
use POSIX qw( ceil );
use CGI qw ( -utf8 );
use CGI::Cookie; # need to check cookies before having CGI parse the POST request
use URI::Escape qw( uri_escape_utf8 );
use URI::Escape qw( uri_escape_utf8 uri_unescape );
use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Context;
use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers );
@ -60,6 +60,7 @@ if ( is_ajax() ) {
my $op = $input->param('op') || q{};
my $tag = $input->param('tag');
if ( $op eq 'test' ) {
$tag = uri_unescape($tag);
my $check = is_approved($tag);
$js_reply =
( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' )
@ -109,7 +110,7 @@ if ( $op eq 'cud-approve' ) {
$template->param(
test_term => $tag,
(
$check >= 1 ? 'verdict_ok'
$check >= 1 ? 'verdict_ok'
: $check <= -1 ? 'verdict_rej'
: 'verdict_indeterminate'
) => 1,