Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity
Koha/catalogue
History
Jonathan Druart f3a8e5a411 Bug 17029: Fix XSS in catalogue/*detail.pl 
Hit
  /cgi-bin/koha/catalogue/detail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:15:50 +00:00
..
detail.pl Bug 17029: Fix XSS in catalogue/*detail.pl 2016-08-10 13:15:50 +00:00
export.pl Bug 16578: Same fix for the staff interface 2016-06-10 16:49:43 +00:00
getitem-ajax.pl Bug 14449: Add authentication check on retrieving item info when receiving 2015-07-20 10:10:59 -03:00
image.pl Bug 16259: Replace CGI->param with CGI->multi_param in list context - part 2 2016-05-16 17:28:06 +00:00
imageviewer.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
ISBDdetail.pl Bug 17029: Fix XSS in catalogue/*detail.pl 2016-08-10 13:15:50 +00:00
issuehistory.pl Bug 14244: viewing a bib item's circ history requires circulation permissions 2016-02-24 01:03:27 +00:00
itemsearch.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
labeledMARCdetail.pl Bug 17029: Fix XSS in catalogue/*detail.pl 2016-08-10 13:15:50 +00:00
MARCdetail.pl Bug 17029: Fix XSS in catalogue/*detail.pl 2016-08-10 13:15:50 +00:00
moredetail.pl Bug 17029: Fix XSS in catalogue/*detail.pl 2016-08-10 13:15:50 +00:00
search-history.pl Bug 16593: Do not allow patrons to delete search history of others patrons 2016-06-24 11:47:29 +00:00
search.pl Bug 16490 - Add an "add to cart" link for each search results in the staff client 2016-06-24 13:45:41 +00:00
showmarc.pl Bug 6520: Display items for staged record 2015-04-16 13:40:46 -03:00
updateitem.pl Bug 13024 - Nonpublic note not appearing in the staff client 2015-12-04 14:47:57 +00:00