Chris Cormack
c176b8ceef
To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped
Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
|
||
|---|---|---|
| .. | ||
| tables | ||
| boraccount.tt | ||
| deletemem.tt | ||
| discharge.tt | ||
| discharges.tt | ||
| files.tt | ||
| housebound.tt | ||
| mancredit.tt | ||
| maninvoice.tt | ||
| member-flags.tt | ||
| member-password.tt | ||
| member.tt | ||
| memberentrygen.tt | ||
| members-update.tt | ||
| moremember-brief.tt | ||
| moremember-print.tt | ||
| moremember-receipt.tt | ||
| moremember.tt | ||
| nl-search.tt | ||
| notices.tt | ||
| pay.tt | ||
| paycollect.tt | ||
| printfeercpt.tt | ||
| printinvoice.tt | ||
| purchase-suggestions.tt | ||
| readingrec.tt | ||
| routing-lists.tt | ||
| statistics.tt | ||
| update-child.tt | ||