gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38469: Replace single quotes with double quotes to prevent XSS 

This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)

3. To test the XSS is patched, try the proof-of-concept from the
bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 89c6e32ee7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
David Cook 2024-11-18 04:46:31 +00:00 committed by Fridolin Somers
parent e0841daec0
commit 6956f4543c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
View File

@ -1488,10 +1488,10 @@
[% IF reserve_id %]
$(".print-slip").on('click', function(e) {
e.preventDefault();
Dopop('hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]');
Dopop("hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]");
});
[% IF print_slip %]
Dopop('hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]');
Dopop("hold-transfer-slip.pl?reserve_id=[% reserve_id | uri %]");
[% END %]
[% END %]
var table_settings = [% TablesSettings.GetTableSettings( 'circ', 'returns', 'checkedintable', 'json' ) | $raw %]