Bug 19125: Fix Stored XSS in members.pl
authorKatrin Fischer <katrin.fischer.83@web.de>
Wed, 16 Aug 2017 10:05:50 +0000 (12:05 +0200)
committerJonathan Druart <jonathan.druart@bugs.koha-community.org>
Fri, 29 Sep 2017 15:20:45 +0000 (12:20 -0300)
commit2d308456010745b90bcd99f40d56db0fcd9cad65
treebb6a0f39576d90947e38f45e4d04d7b5a1013d12
parent0bbe968fe57316b8bb28ad02df87c0b97c249904
Bug 19125: Fix Stored XSS in members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt