Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 19127: (follow-up) Fix Stored XSS in csv-profiles.pl

Browse source 
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Jonathan Druart 2017-09-12 11:21:27 -03:00
parent b90662073f
commit 357d51c8c4
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
View file

@ -133,7 +133,7 @@ function reloadPage(p) {
[% END %] [% END %]
<li> <li>
<label for="profile" class="required">Profile name: </label> <label for="profile" class="required">Profile name: </label>
<input type="text" name="profile" id="profile" value="[% csv_profile.profile %]" class="required"> <input type="text" name="profile" id="profile" value="[% csv_profile.profile | html %]" class="required">
<span class="required">Required</span> <span class="required">Required</span>
</li> </li>
<li> <li>
@ -175,7 +175,7 @@ function reloadPage(p) {
</li> </li>
<li> <li>
<label for="description">Profile description: </label> <label for="description">Profile description: </label>
<textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description %]</textarea> <textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description | html %]</textarea>
</li> </li>
<li> <li>
<label for="csv_separator">CSV separator: </label> <label for="csv_separator">CSV separator: </label>
@ -240,7 +240,7 @@ function reloadPage(p) {
[% IF op == 'delete_confirm' %] [% IF op == 'delete_confirm' %]
<div class="dialog alert"> <div class="dialog alert">
[% IF csv_profile %] [% IF csv_profile %]
<h3>Delete CSV Profile "[% csv_profile.profile %]?"</h3> <h3>Delete CSV Profile "[% csv_profile.profile | html %]?"</h3>
<form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post"> <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
<input type="hidden" name="op" value="delete_confirmed" /> <input type="hidden" name="op" value="delete_confirmed" />
<input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" /> <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" />