gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 19112 - Stored XSS in basketheader.pl page 

To Test

1. Hit the page /cgi-bin/koha/acqui/basketheader.pl?booksellerid=1&op=add_form
2. Add a text in the field Basket name, Internal note, Vendor note that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed XSS on pages basket.pl/basketheader.pl/bookseller.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This commit is contained in:
Amit Gupta 2017-08-15 19:51:48 +05:30 committed by Katrin Fischer
parent a2c6cd77d2
commit fabd0f82c1
3 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
View File

@ -323,8 +323,8 @@
<div class="rows">
<div class="yui-u first">
<ol>
[% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote %]</li>[% END %]
[% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote %]</li>[% END %]
[% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote |html %]</li>[% END %]
[% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote |html %]</li>[% END %]
[% IF ( basketcontractno ) %]
<li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno %]&amp;booksellerid=[% booksellerid %]">[% basketcontractname %]</a></li>
[% END %]

8
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
View File

@ -19,7 +19,7 @@
<a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a> &rsaquo;
[% IF ( add_form ) %]
[% IF ( basketno ) %]Edit basket '[% basketname %]'
[% IF ( basketno ) %]Edit basket '[% basketname |html %]'
[% ELSE %]Add a basket to [% booksellername %]
[% END %]
[% END %]
@ -32,7 +32,7 @@
[% IF ( add_form ) %]
[% IF ( basketno ) %]
<h1>Edit basket [% basketname %]</h1>
<h1>Edit basket [% basketname |html %]</h1>
[% ELSE %]<h1>Add a basket to [% booksellername %]</h1>
[% END %]
<form name="Aform" action="[% script_name %]" method="post" class="validated">
@ -78,11 +78,11 @@
</li>
<li>
<label for="basketnote">Internal note: </label> &nbsp;
<textarea name="basketnote" id="basketnote" rows="5" cols="40">[% basketnote %]</textarea>
<textarea name="basketnote" id="basketnote" rows="5" cols="40">[% basketnote |html %]</textarea>
</li>
<li>
<label for="basketbooksellernote">Vendor note: </label> &nbsp;
<textarea name="basketbooksellernote" id="basketbooksellernote" rows="5" cols="40">[% basketbooksellernote %]</textarea>
<textarea name="basketbooksellernote" id="basketbooksellernote" rows="5" cols="40">[% basketbooksellernote |html %]</textarea>
</li>
[% IF ( contractloop ) %]
<li><label for="basketcontractnumber">Contract: </label>

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt
View File

@ -122,7 +122,7 @@ $(document).ready(function() {
<tr>
[% END %]
<td>[% basket.basketno %]</td>
<td>[% basket.basketname %]</td>
<td>[% basket.basketname |html %]</td>
<td>
<span title="[% basket.total_items %]">[% basket.total_items %]
[% IF basket.total_items_cancelled %]