From 332d705e725a0672eafdeedb88d3848fca4b2a8b Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 13:49:10 +0530 Subject: [PATCH] Bug 19108 - Stored XSS in items_search_fields.pl To Test 1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl 2. Add a text in the field Name and Label that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Fixed for new and edit page Signed-off-by: Katrin Fischer Signed-off-by: Marcel de Rooy Signed-off-by: Jonathan Druart (cherry picked from commit 063fd5e1b9e086c57987fae408b4ce6e51fec2b9) Signed-off-by: Fridolin Somers --- .../prog/en/includes/admin-items-search-field-form.inc | 4 ++-- .../prog/en/modules/admin/items_search_field.tt | 4 ++-- .../prog/en/modules/admin/items_search_fields.tt | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc index a55f6c38ba..4ab91b1836 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc @@ -3,7 +3,7 @@
  • [% IF field %] Name: - [% field.name %] + [% field.name |html %] [% ELSE %] @@ -14,7 +14,7 @@
  • [% IF field %] - + [% ELSE %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt index cd29b2f995..06fcd06ca5 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt @@ -10,14 +10,14 @@ HomeAdministrationItem search fields › - [% field.name %] + [% field.name |html %]
    -

    Item search field: [% field.label %]

    +

    Item search field: [% field.label |html %]

    diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt index eb6774969f..0904553259 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt @@ -27,7 +27,7 @@ [% IF field_added %]
    - Field successfully added: [% field_added.label %] + Field successfully added: [% field_added.label |html %]
    [% ELSIF field_not_added %]
    @@ -71,8 +71,8 @@ [% FOREACH field IN fields %] - [% field.name %] - [% field.label %] + [% field.name |html %] + [% field.label |html %] [% field.tagfield %] [% field.tagsubfield %] [% field.authorised_values_category %] -- 2.39.5