]> git.koha-community.org Git - koha.git/commit
Bug 27942: Prevent XSS vulnerabilities in quote-upload
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 17 Mar 2021 10:38:47 +0000 (11:38 +0100)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 26 May 2021 07:26:56 +0000 (09:26 +0200)
commit146f7314cf983ae20c35b2606acce7408e42e00e
treef2e62c163903ad0fd3f59eb7cc3235c94ec44d83
parentabf1b6596c39b55b8a929c9c0329d113ea1f72df
Bug 27942: Prevent XSS vulnerabilities in quote-upload

When uploading new quotes the JS variables are not escaped correctly.

Test plan:
Create a new file with the following content (remove the first and last lines containing """):
"""
":this is a source","this is a text"
"this is another ❤one","and another text❤"
"this <script>alert('foo');</script>","and <script>alert('❤');</script>"
"""

Go to Home › Tools › Quote editor
Click Import quote
Select the file
Edit the third line, hit enter
Import quotes

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt