]> git.koha-community.org Git - koha.git/commit
projects / koha.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 34c0bd2) | patch
Bug 38961: XSS in vendor search
authorPhil Ringnalda <phil@chetcolibrary.org>
Fri, 24 Jan 2025 02:01:12 +0000 (18:01 -0800)
committerJohn Doe <you@example.com>
Wed, 5 Feb 2025 02:14:57 +0000 (02:14 +0000)
commita5afd9c9c8bd3901597a45998bf42b257cf91690
tree9550745b41c29dd7237ff0990b841a1c88bc2443tree | snapshot
parent34c0bd2c51698507e8c5c1feed1f10120e5d2ba1commit | diff
Bug 38961: XSS in vendor search

acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt diff | blob | history
koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt diff | blob | history
Main Koha release repository