]> git.koha-community.org Git - koha.git/commit
Bug 19033: XSS Flaws in Currencies and exchange page
authorAmit Gupta <amit.gupta@informaticsglobal.com>
Fri, 4 Aug 2017 04:14:52 +0000 (09:44 +0530)
committerFridolin Somers <fridolin.somers@biblibre.com>
Wed, 23 Aug 2017 14:59:37 +0000 (16:59 +0200)
commit933f139b77cc3f75946317103848f957ebf057cc
tree7d37c7cd6edbed788d79c0761aa3e3d57e2fcbaa
parentb4d95e2b08415e8041edec0c012411177decc413
Bug 19033: XSS Flaws in Currencies and exchange page

1. Hit /cgi-bin/koha/admin/currency.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search currencies box.
3. Notice the iframe is executed
4. Apply patch
5. Reload page, and enter iframe again on search currencies box.
6. Notice it is no longer executed

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Fixes the issue, follows common practice on the codebase.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 08fe6c3c3a8b3370ea212b049573a8618cf1e9e3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt