Browse Source

Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl

== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Apply the patch & restart services
4. Repeat the above and you are not redirected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
tags/v21.05.00
Jonathan Druart 3 weeks ago
parent
commit
abf1b6596c
2 changed files with 2 additions and 2 deletions
  1. +1
    -1
      koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
  2. +1
    -1
      opac/opac-shelves.pl

+ 1
- 1
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt View File

@@ -1096,7 +1096,7 @@ function AdjustRemark() {
if( $("#category").length > 0 ) {
category = $("#category").val();
} else {
category = [% category | html %];
category = "[% category | html %]";
}
var perms = $("#allow_changes_from").val();



+ 1
- 1
opac/opac-shelves.pl View File

@@ -434,7 +434,7 @@ $template->param(
referer => $referer,
shelf => $shelf,
messages => \@messages,
category => $category,
category => ($category == 1 || $category == 2) ? $category : "",
print => scalar $query->param('print') || 0,
listsview => 1,
);


Loading…
Cancel
Save