gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19034: XSS Flaws in Patron categories pages 

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 28b9a1246781fb45427a593703542a99600f6d1f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Amit Gupta 2017-08-04 10:34:19 +05:30 committed by Fridolin Somers
parent 77a8be98a4
commit bc0a636c18
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
View File

@ -335,7 +335,7 @@
<h2>Patron categories</h2>
[% IF searchfield %]
You Searched for [% searchfield %]</span>
You Searched for [% searchfield |html %]</span>
[% END %]
[% IF categories%]
<table id="table_categorie">