gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 14423 : Multiple XSS vulnerabilities in serials-search 

To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Mason James <mtj@kohaaloha.com>
This commit is contained in:
Chris 2015-06-21 09:20:51 +00:00 committed by Mason James
parent fce867ca00
commit f59fbdbef1
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
View File

@ -69,29 +69,29 @@
<ol>
<li>
<label for="issn">ISSN:</label>
<input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
<input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
</li>
<li>
<label for="title">Title:</label>
<input type="text" id="title" name="title_filter" value="[% title_filter %]" />
<input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
</li>
[% IF ( marcflavour == "UNIMARC" ) %]
<li>
<label for="ean">EAN:</label>
<input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
<input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
</li>
[% END %]
<li>
<label for="callnumber">Call number:</label>
<input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
<input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
</li>
<li>
<label for="publisher">Publisher:</label>
<input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
<input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
</li>
<li>
<label for="bookseller">Vendor:</label>
<input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
<input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
</li>
<li>
<label for="branch">Library:</label>
@ -289,7 +289,7 @@
</td>
<td>
[% UNLESS subscription.cannotedit %]
<a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter %]&amp;ISSN_filter=[% ISSN_filter %]&amp;EAN_filter=[% EAN_filter %]&amp;published_filter=[% publisher_filter %]&amp;bookseller_filter=[% bookseller_filter %]&amp;branch_filter=[% branch_filter %]" id="reopensub">Reopen</a>
<a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter | uri %]&amp;ISSN_filter=[% ISSN_filter | uri %]&amp;EAN_filter=[% EAN_filter | uri %]&amp;published_filter=[% publisher_filter | uri %]&amp;bookseller_filter=[% bookseller_filter | uri %]&amp;branch_filter=[% branch_filter | uri %]" id="reopensub"> <i class="icon-repeat"></i> Reopen</a>
[% ELSE %]
Cannot edit
[% END %]
@ -328,29 +328,29 @@
<ol>
<li>
<label for="issn">ISSN:</label>
<input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter %]" />
<input type="text" id="issn" name="ISSN_filter" value="[% ISSN_filter | html %]" />
</li>
<li>
<label for="title">Title:</label>
<input type="text" id="title" name="title_filter" value="[% title_filter %]" />
<input type="text" id="title" name="title_filter" value="[% title_filter | html %]" />
</li>
[% IF ( marcflavour == "UNIMARC" ) %]
<li>
<label for="ean">EAN:</label>
<input type="text" id="ean" name="EAN_filter" value="[% EAN_filter %]" />
<input type="text" id="ean" name="EAN_filter" value="[% EAN_filter | html %]" />
</li>
[% END %]
<li>
<label for="callnumber">Call number:</label>
<input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter %]" />
<input type="text" id="callnumber" name="callnumber_filter" value="[% callnumber_filter | html %]" />
</li>
<li>
<label for="publisher">Publisher:</label>
<input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter %]" />
<input type="text" id="publisher" name="publisher_filter" value="[% publisher_filter | html %]" />
</li>
<li>
<label for="bookseller">Vendor:</label>
<input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter %]" />
<input type="text" id="bookseller" name="bookseller_filter" value="[% bookseller_filter | html %]" />
</li>
<li>
<label for="branch">Library:</label>