gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38961: XSS in vendor search 

acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This commit is contained in:
Phil Ringnalda 2025-01-23 18:01:12 -08:00 committed by John Doe
parent 34c0bd2c51
commit a5afd9c9c8
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt
View File

@ -29,7 +29,7 @@
<a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>
[% END %]
[% WRAPPER breadcrumb_item bc_active= 1 %]
<span>Search for vendor [% supplier | $HtmlTags tag='em' %]</span>
<span>Search for vendor [% supplier | html | $HtmlTags tag='em' %]</span>
[% END %]
[% END #/ WRAPPER breadcrumbs %]
[% END #/ WRAPPER sub-header.inc %]

2
koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
View File

@ -171,7 +171,7 @@
[% IF op =='delete_confirm' %]
[% IF nb_of_orders or nb_of_vendors %]
<div class="dialog alert">
<h1>Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1>
<h1>Cannot delete currency [% currency.currency | html | $HtmlTags tag='span' attributes=>'class="ex"' %]</h1>
<p>
[% IF nb_of_orders %]
<span>This currency is used by [% nb_of_orders | html %] orders.</span>