gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38470: Add missing double quotes to some Javascript 

This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.

Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>

3. Note that you're able to generate a print slip
(You may need to allow popups)

4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
David Cook 2024-11-18 05:15:26 +00:00 committed by wainuiwitikapark
parent 6456c0b98d
commit e4295598a2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
View File

@ -445,7 +445,7 @@
$(document).ready(function() {
$("#renewsub").click(function(){
popup([% subscriptionid | html %]);
popup("[% subscriptionid | html %]");
return false;
})
@ -490,7 +490,7 @@
$("#show_all_orders").click();
[% IF print_routing_list_issue %]
var myurl = '/cgi-bin/koha/serials/routing-preview.pl?op=print&subscriptionid=[% subscriptionid | uri %]&issue=[% print_routing_list_issue | uri %]';
var myurl = "/cgi-bin/koha/serials/routing-preview.pl?op=print&subscriptionid=[% subscriptionid | uri %]&issue=[% print_routing_list_issue | uri %]";
window.open(myurl,'PrintSlip','width=500,height=500,toolbar=no,scrollbars=yes');
[% END %]