From 20b4c81c1a1e1c93ecdc5ebeeddb870a802a7d4a Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Tue, 15 Aug 2017 13:33:57 +0530
Subject: [PATCH] Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 10d3a8c212f8a45e40cd2644f94d555566a10018)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../prog/en/modules/admin/oai_set_mappings.tt          |  2 +-
 .../intranet-tmpl/prog/en/modules/admin/oai_sets.tt    | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
index f3f35b7706..338a53f74f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
@@ -56,7 +56,7 @@ function hideDialogBox() {
           <p><a href="/cgi-bin/koha/admin/oai_sets.pl">Return to sets management</a></p>
         </div>
       [% END %]
-      <h1>Mappings for set '[% setName %]' ([% setSpec %])</h1>
+      <h1>Mappings for set '[% setName |html %]' ([% setSpec |html %])</h1>
       [% UNLESS ( mappings ) %]
         <div class="dialog alert"><p><strong>Warning:</strong> No mappings have been defined for this set</p></div>
       [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
index 0576739a39..3475442070 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
@@ -45,7 +45,7 @@ $(document).ready(function() {
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'prefs-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec %]'[% ELSE %] OAI sets configuration[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec |html %]'[% ELSE %] OAI sets configuration[% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
@@ -58,7 +58,7 @@ $(document).ready(function() {
                 <h2>Add a new OAI set</h2>
                 <input type="hidden" name="op" value="savenew" />
             [% ELSIF ( op_mod ) %]
-                <h2>Edit OAI set '[% spec %]'</h2>
+                <h2>Edit OAI set '[% spec |html %]'</h2>
                     <input type="hidden" name="op" value="savemod" />
                     <input type="hidden" name="id" value="[% id %]" />
             [% END %]
@@ -109,13 +109,13 @@ $(document).ready(function() {
                 <tbody>
                     [% FOREACH set IN sets_loop %]
                         <tr>
-                            <td>[% set.spec %]</td>
-                            <td>[% set.name %]</td>
+                            <td>[% set.spec |html %]</td>
+                            <td>[% set.name |html %]</td>
                             <td>
                                 [% IF set.descriptions %]
                                     <ul>
                                         [% FOREACH desc IN set.descriptions %]
-                                            <li>[% desc.description %]</li>
+                                            <li>[% desc.description |html %]</li>
                                         [% END %]
                                     </ul>
                                 [% ELSE %]
-- 
2.39.5