]> git.koha-community.org Git - koha.git/commit
Bug 19086: Fix Stored XSS in circulation.pl
authorChris Cormack <chris@bigballofwax.co.nz>
Fri, 11 Aug 2017 19:54:34 +0000 (19:54 +0000)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 29 Sep 2017 15:20:44 +0000 (12:20 -0300)
commit50dcae4b504a4a54a830ae87848ba3fa5161ad57
tree231fa30529fc214f461031a77428d89808275c33
parentc176b8ceefc8a4b964b8671c4d3198af053b59c8
Bug 19086: Fix Stored XSS in circulation.pl

1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt