projects / koha.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f1803c7) | patch
Bug 35960: Use .val() instead of string concat to prevent potential XSS
authorJulian Maurice <julian.maurice@biblibre.com>
Thu, 1 Feb 2024 08:15:23 +0000 (09:15 +0100)
committerLucas Gass <lucas@bywatersolutions.com>
Tue, 26 Mar 2024 15:20:16 +0000 (15:20 +0000)
commit69e34243683d1436dd8261b99dfce7b0df124ab6
tree6928ae92d044ea152b9ffc9efb85f8df598239b4tree | snapshot
parentf1803c71460c8e5668366c319d52e683d274605bcommit | diff
Bug 35960: Use .val() instead of string concat to prevent potential XSS

Test plan:
1. Log out
2. Go to /cgi-bin/koha/mainpage.pl#somestring"with<html>char
3. Open the brower's inspector and find "auth_forwarded_hash" input
4. Make sure the value attribute is there and corresponds to the URL's
   fragment. It should be URI-encoded.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt diff | blob | history
Main Koha release repository