46b0b0a75b
1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
|
||
|---|---|---|
| .. | ||
| preferences | ||
| searchengine/elasticsearch | ||
| admin-home.tt | ||
| aqbudgetperiods.tt | ||
| aqbudgets.tt | ||
| aqcontract.tt | ||
| aqplan.tt | ||
| audio_alerts.tt | ||
| auth_subfields_structure.tt | ||
| auth_tag_structure.tt | ||
| authorised_values.tt | ||
| authtypes.tt | ||
| biblio_framework.tt | ||
| branch_transfer_limits.tt | ||
| branches.tt | ||
| categories.tt | ||
| checkmarc.tt | ||
| cities.tt | ||
| classsources.tt | ||
| clone-rules.tt | ||
| columns_settings.tt | ||
| currency.tt | ||
| didyoumean.tt | ||
| edi_accounts.tt | ||
| edi_ean_accounts.tt | ||
| fieldmapping.tt | ||
| item_circulation_alerts.tt | ||
| items_search_field.tt | ||
| items_search_fields.tt | ||
| itemtypes.tt | ||
| koha2marclinks.tt | ||
| localization.tt | ||
| marc_subfields_structure.tt | ||
| marctagstructure.tt | ||
| matching-rules.tt | ||
| oai_set_mappings.tt | ||
| oai_sets.tt | ||
| patron-attr-types.tt | ||
| preferences.tt | ||
| printers.tt | ||
| smart-rules.tt | ||
| sms_providers.tt | ||
| sru_modmapping.tt | ||
| systempreferences.tt | ||
| transport-cost-matrix.tt | ||
| usage_statistics.tt | ||
| z3950servers.tt | ||