gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 27942: [20.11] Prevent XSS vulnerabilities in quote-upload 

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2021-05-04 11:48:03 +02:00 committed by Andrew Fuerste-Henry
parent cd66aa48de
commit d810cd6310
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt
View File

@ -148,6 +148,8 @@
// then default to comma.
strDelimiter = (strDelimiter || ",");
strData = escape_str(strData);
// Create a regular expression to parse the CSV values.
var objPattern = new RegExp(
(
@ -274,6 +276,7 @@
"fnDrawCallback": function(oSettings) {
/* Apply the jEditable handlers to the table on all fields w/o the no_edit id */
$('#quotes_editor tbody td[id!="no_edit"]').editable( function(value, settings) {
value = escape_str(value);
var cellPosition = oTable.fnGetPosition( this );
oTable.fnUpdate(value, cellPosition[0], cellPosition[1], false, false);
return(value);

14
koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
View File

@ -86,8 +86,18 @@
"sAjaxSource" : "/cgi-bin/koha/tools/quotes/quotes_ajax.pl",
"aoColumns" : [
{ "sWidth": "3%" },
{ "sWidth": "11%" },
{ "sWidth": "75%" },
{
"sWidth": "11%",
"render": function(data, type, row, meta){
return escape_str(data);
}
},
{
"sWidth": "75%",
"render": function(data, type, row, meta){
return escape_str(data);
}
},
{ "sWidth": "11%" },
],
"oLanguage": dataTablesDefaults.oLanguage,