gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42800: Fix XSS in shelf list in the ERM module 

const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %];

If you have a script tag in a list name the UI will be broken, and there
is potentially a XSS vulnerability

Test plan:
Create a new list with name="<script>alert("booh!");</script>"
Go to /cgi-bin/koha/erm/eholdings/local/titles/import
or any ERM views
=> Without this patch the UI is broken
=> With this patch applied it's not and the table is correctly populated
with the lists

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
Jonathan Druart 2026-06-09 11:19:35 +02:00 committed by Baptiste Wojtkowski
parent 269c735a8c
commit e36fc8948c
No known key found for this signature in database
GPG Key ID: 47A8A13E10BC0D40
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt
View File

@ -40,7 +40,15 @@
const max_allowed_packet = [% To.json(max_allowed_packet) | $raw %];
const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %];
let logged_in_user_lists = [];
[% FOR shelf IN logged_in_user.virtualshelves %]
logged_in_user_lists.push(
{
id: "[% shelf.shelfnumber | html %]",
name: "[% shelf.shelfname | html %]",
}
);
[% END %]
const logged_in_user = [% To.json(logged_in_user.unblessed) | $raw %];
</script>

8
koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/EHoldingsLocalTitlesFormImport.vue
View File

@ -68,14 +68,12 @@ export default {
columns: [
{
title: $__("Name"),
data: "shelfname",
data: "name",
searchable: true,
orderable: true,
width: "100%",
render: function (data, type, row, meta) {
return (
row.shelfname + " (#" + row.shelfnumber + ")"
);
return row.name + " (#" + row.id + ")";
},
},
{
@ -93,7 +91,7 @@ export default {
$.each($(this).find("td .actions"), function (index, e) {
let tr = $(this).parent().parent();
let list_id = api.row(tr).data().shelfnumber;
let list_id = api.row(tr).data().id;
let importButton = createVNode(
"a",
{