From feeab2b3a0f78a600560395326b4538104e25ff1 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Mon, 13 Nov 2017 09:27:44 +0530 Subject: [PATCH] Bug 19614: Fix XSS in members/pay.pl To Test 1. Hit the page /cgi-bin/koha/members/memberentry.pl 2. Add a text in the field firstname, surname that contains js 3. Save the page. 4. click on fine tab 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Chris Cormack Signed-off-by: Katrin Fischer Signed-off-by: Jonathan Druart Signed-off-by: Jonathan Druart --- koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt index f59a4cf450..c9a5a30320 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt @@ -3,7 +3,7 @@ [% USE Branches %] [% USE Price %] [% INCLUDE 'doc-head-open.inc' %] -Koha › Patrons › Pay Fines for [% borrower.firstname %] [% borrower.surname %] +Koha › Patrons › Pay Fines for [% borrower.firstname |html %] [% borrower.surname |html %] [% INCLUDE 'doc-head-close.inc' %]