]> git.koha-community.org Git - koha.git/commit
Bug 38470: Add missing double quotes to some Javascript
authorDavid Cook <dcook@prosentient.com.au>
Mon, 18 Nov 2024 05:15:26 +0000 (05:15 +0000)
committerwainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Mon, 6 Jan 2025 01:13:58 +0000 (01:13 +0000)
commite4295598a2b07f5e102b0fec4c206c0b4f394525
tree6bcb4e57c54ede686b6911979dc210506805a3bb
parent6456c0b98d5f1767c8e4d9b389a5ca11264effdc
Bug 38470: Add missing double quotes to some Javascript

This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.

Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>

3. Note that you're able to generate a print slip
(You may need to allow popups)

4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt