3199cff639
1. Hit /cgi-bin/koha/acqui/booksellers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> vendor search box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on vendor search box.
6. Notice it is no longer executed.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
|
||
|---|---|---|
| .. | ||
| csv | ||
| tables | ||
| acqui-home.tt | ||
| addorder.tt | ||
| addorderiso2709.tt | ||
| ajax.tt | ||
| basket.tt | ||
| basketgroup.tt | ||
| basketheader.tt | ||
| booksellers.tt | ||
| cancelorder.tt | ||
| edi_ean.tt | ||
| edifactmsgs.tt | ||
| edimsg.tt | ||
| histsearch.tt | ||
| invoice-files.tt | ||
| invoice.tt | ||
| invoices.tt | ||
| lateorders.tt | ||
| modordernotes.tt | ||
| neworderbiblio.tt | ||
| neworderempty.tt | ||
| neworderempty_duplicate.tt | ||
| newordersubscription.tt | ||
| newordersuggestion.tt | ||
| ordered.tt | ||
| orderreceive.tt | ||
| parcel.tt | ||
| parcels.tt | ||
| spent.tt | ||
| supplier.tt | ||
| transferorder.tt | ||
| uncertainprice.tt | ||
| z3950_search.tt | ||