gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 14423 : XSS bug in lateorders 

1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom
2/ Not you get an alert box
3/ Apply patch notice it is fixed
4/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(cherry picked from commit 66dc4a9e7d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Chris 2015-06-21 08:18:20 +00:00 committed by Fridolin Somers
parent 1c82ddcaad
commit ebc7b2a033
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
View File

@ -93,7 +93,7 @@ $(document).ready(function() {
[% IF ( lateorders ) %]
<form action="lateorders.pl" name="claim" method="post">
<input type="hidden" name="op" value="send_alert" />
<input type="hidden" name="delay" value="[% delay %]" />
<input type="hidden" name="delay" value="[% delay | html%]" />
<input type="hidden" name="booksellerid" value="[% booksellerid %]" />
[% IF ( letters ) %]
<p><label for="letter_code">Claim using notice: </label><select name="letter_code" id="letter_code">
@ -195,10 +195,10 @@ $(document).ready(function() {
<fieldset class="brief">
<h4>Filter results:</h4>
[% FOREACH ERROR_LOO IN ERROR_LOOP %]
[% IF ( ERROR_LOO.delay_digits ) %]<p class="error">The number of days ([% ERROR_LOO.bad_delay %]) must be a number between 0 and 999.</p>[% END %]
[% IF ( ERROR_LOO.delay_digits ) %]<p class="error">The number of days ([% ERROR_LOO.bad_delay | html %]) must be a number between 0 and 999.</p>[% END %]
[% END %]
<ol>
<li><label for="delay">Order date:</label><input size="3" maxlength="3" id="delay" type="text" name="delay" value="[% delay %]" /> days ago</li>
<li><label for="delay">Order date:</label><input size="3" maxlength="3" id="delay" type="text" name="delay" value="[% delay | html%]" /> days ago</li>
<li><label for="from">Estimated delivery date from: </label>
<input type="text" size="10" id="from" name="estimateddeliverydatefrom" value="[% estimateddeliverydatefrom %]" class="datepickerfrom" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>