b0def4443d
Test plan 1. Search for a patron and open the patron details page. 2. Under "Patron restrictions", add a manual restriction with the following comment: <img src=x onerror="alert(document.domain)"> 3. Save the restriction. 4. Navigate to the patron checkouts page: /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx Verify that the JavaScript payload executes. 5. Edit the patron record: /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx Verify that the JavaScript payload executes. 6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl 7. Apply the patch. 8. Repeat steps 4, 5 and 6. 9. Verify that: 1. No JavaScript is executed. 2. The page loads normally without any alert dialog. Applicable for both the staff and opac. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> |
||
|---|---|---|
| .. | ||
| intranet-tmpl | ||
| opac-tmpl | ||