]> git.koha-community.org Git - koha.git/commit
Bug 19034: XSS Flaws in Z39.50/SRU servers administration
authorAmit Gupta <amit.gupta@informaticsglobal.com>
Fri, 4 Aug 2017 05:11:49 +0000 (10:41 +0530)
committerFridolin Somers <fridolin.somers@biblibre.com>
Wed, 23 Aug 2017 14:59:13 +0000 (16:59 +0200)
commit12dcd7f2e79dd9b53a0cfc1ed6e3d88fd7446405
tree1e77895d4d6078786441ee314dce71516d24b39f
parent9b7969033f6820e7e9af314018f87ec462cc5b6d
Bug 19034: XSS Flaws in Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit cd0c7ad870f4c2d202e2d6e31c1078bd29da979e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt