Koha/koha-tmpl/intranet-tmpl/prog/en/modules/serials
Josef Moravec b59988f78d Bug 19738: Fix XSS on vendor name in serials module
Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-15 16:04:40 -03:00
..
tables
acqui-search-result.tt Bug 19738: Fix XSS on vendor name in serials module 2018-02-15 16:04:40 -03:00
acqui-search.tt
add_fields.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
checkexpiration.tt
claims.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
result.tt
routing-preview-slip.tt Bug 19950: Update popup window templates to use Bootstrap grid: Serials 2018-02-15 13:30:23 -03:00
routing-preview.tt Bug 19761: Move template JavaScript to the footer: Serials, part 2 2017-12-14 16:58:13 -03:00
routing.tt Bug 19761: Move template JavaScript to the footer: Serials, part 2 2017-12-14 16:58:13 -03:00
serials-collection.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
serials-edit.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
serials-home.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
serials-search.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
showpredictionpattern.tt Bug 19778: Move template JavaScript to the footer: Serials, part 4 2017-12-14 16:58:13 -03:00
subscription-add.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
subscription-bib-search.tt
subscription-detail.tt Bug 19738: Fix XSS on vendor name in serials module 2018-02-15 16:04:40 -03:00
subscription-frequencies.tt Bug 19778: Move template JavaScript to the footer: Serials, part 4 2017-12-14 16:58:13 -03:00
subscription-history.tt Bug 19778: Move template JavaScript to the footer: Serials, part 4 2017-12-14 16:58:13 -03:00
subscription-numberpatterns.tt Bug 12904: Force browser to load new javascript files after upgrade 2018-02-08 14:53:24 -03:00
subscription-renew.tt Bug 19950: Update popup window templates to use Bootstrap grid: Serials 2018-02-15 13:30:23 -03:00
viewalerts.tt