Koha/koha-tmpl/intranet-tmpl/prog/en/includes/member-display-address-style-us.inc
Amit Gupta e0e063a85b Bug 19612: Fix XSS in members/memberentry.pl
To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 16:01:50 -03:00

16 lines
751 B
HTML

[% IF ( address or address2 ) %]
[% IF ( address ) %]
[% SET roadtype_desc = '' %]
[% IF streettype %]
[% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', streettype) %]
[% END %]
<li class="patronaddress1">[% if (streetnumber) %][% streetnumber |html %][% end %] [% address |html %] [% IF roadtype_desc %][% roadtype_desc |html %] [% END %][% end %]</li>
[% END %]
[% IF ( address2 ) %]
<li class="patronaddress2">[% address2 |html %]</li>
[% END %]
[% END %]
[% IF ( city ) %]<li class="patroncity">
[% city |html %][% IF ( state ) %], [% state |html %][% END %]
[% zipcode |html %][% IF ( country ) %], [% country |html %][% END %]</li>
[% END %]