Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 19035 - Stored XSS in lists.pl

Browse source 
To Test
1. Hit the page /cgi-bin/koha/patron_lists/lists.pl
2. Click on new patron list
3. Add a text in the field Name that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Fixed in both the pages list.pl and list.pl?patron_list_id=xx
xx is patronlist id

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Amit Gupta 2017-08-15 08:33:41 +05:30 committed by Jonathan Druart
parent 8534ca2780
commit 36ba8be88a
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
View file

@ -69,13 +69,13 @@ $(document).ready(function() {
<body id="patlist_list" class="pat patlist">
[% INCLUDE 'header.inc' %]
[% INCLUDE 'cat-search.inc' %]
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name %]</a> &rsaquo; Add patrons</div>
<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name |html %]</a> &rsaquo; Add patrons</div>
<div id="doc3" class="yui-t2">
<div id="bd">
<div id="yui-main">
<div class="yui-b">
<h1>[% list.name %]</h1>
<h1>[% list.name |html %]</h1>
<form action="list.pl" id="add_patrons" method="post">
<fieldset>

2
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt
View file

@ -87,7 +87,7 @@
<tbody>
[% FOREACH l IN lists %]
<tr>
<td>[% l.name %]</td>
<td>[% l.name |html %]</td>
<td>[% l.patron_list_patrons_rs.count || 0 %]</td>
<td>
<div class="dropdown">