gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19034: XSS Flaws in Z39.50/SRU servers administration 

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Mason James <mtj@kohaaloha.com>
This commit is contained in:
Amit Gupta 2017-08-04 10:41:49 +05:30 committed by Mason James
parent 8a14d52338
commit cfd67c694e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
View File

@ -225,7 +225,7 @@
[% IF id %]
You searched for record [% id %]
[% ELSIF searchfield %]
You searched for [% searchfield %]
You searched for [% searchfield |html %]
[% END %]
<table id="serverst">
<thead><tr><th>Target</th><th>Hostname/Port</th><th>Database</th><th>Userid</th><th>Password</th><th>Preselected</th><th>Rank</th><th>Syntax</th><th>Encoding</th><th>Timeout</th><th>Record type</th><th></th>