gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19050 - XSS Flaws in Quick spine label creator 

1. Hit /cgi-bin/koha/labels/spinelabel-home.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> barcode text box.
3. Notice the iframe is executed
4. Apply patch
5. Reload page, and enter iframe again on barcode text box.
6. Notice it is no longer executed

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Amit Gupta 2017-08-07 20:49:56 +05:30 committed by Jonathan Druart
parent 861cec5773
commit c57d0b71c7
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
View File

@ -23,7 +23,7 @@
</head>
[% IF ( BarcodeNotFound ) %]
<body id="labels_spinelabel-print" class="tools labels">
<p>The barcode [% Barcode %] was not found.</p>
<p>The barcode [% Barcode |html %] was not found.</p>
<p><a href="spinelabel-home.pl">Return to spine label printer</a></p>
</body>
[% ELSE %]