From 174f1eda3ba2186f75fccf246cb299256c2d28c9 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 15 Aug 2017 10:07:45 +0530 Subject: [PATCH] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer Signed-off-by: Marcel de Rooy Signed-off-by: Mason James --- .../intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt index 8b0c880779..72562c4c34 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt @@ -265,7 +265,7 @@ $(document).ready(function() { [% FOREACH item IN attribute.items %] [% item.code |html %] - [% item.description %] + [% item.description |html %] [% IF ( item.branches && item.branches.size > 0 ) %] [% branches_str = "" %] -- 2.39.5