8c3da35130
1. Hit /cgi-bin/koha/admin/currency.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search currencies box.
3. Notice the iframe is executed
4. Apply patch
5. Reload page, and enter iframe again on search currencies box.
6. Notice it is no longer executed
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Fixes the issue, follows common practice on the codebase.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
|
||
|---|---|---|
| .. | ||
| preferences | ||
| searchengine/elasticsearch | ||
| admin-home.tt | ||
| aqbudgetperiods.tt | ||
| aqbudgets.tt | ||
| aqcontract.tt | ||
| aqplan.tt | ||
| audio_alerts.tt | ||
| auth_subfields_structure.tt | ||
| auth_tag_structure.tt | ||
| authorised_values.tt | ||
| authtypes.tt | ||
| biblio_framework.tt | ||
| branch_transfer_limits.tt | ||
| branches.tt | ||
| categories.tt | ||
| checkmarc.tt | ||
| cities.tt | ||
| classsources.tt | ||
| clone-rules.tt | ||
| columns_settings.tt | ||
| currency.tt | ||
| didyoumean.tt | ||
| edi_accounts.tt | ||
| edi_ean_accounts.tt | ||
| fieldmapping.tt | ||
| item_circulation_alerts.tt | ||
| items_search_field.tt | ||
| items_search_fields.tt | ||
| itemtypes.tt | ||
| koha2marclinks.tt | ||
| localization.tt | ||
| marc_subfields_structure.tt | ||
| marctagstructure.tt | ||
| matching-rules.tt | ||
| oai_set_mappings.tt | ||
| oai_sets.tt | ||
| patron-attr-types.tt | ||
| preferences.tt | ||
| printers.tt | ||
| smart-rules.tt | ||
| sms_providers.tt | ||
| sru_modmapping.tt | ||
| systempreferences.tt | ||
| transport-cost-matrix.tt | ||
| usage_statistics.tt | ||
| z3950servers.tt | ||