https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30144 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Failed QA --- Comment #39 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Stored XSS in neworderempty.tt. To reproduce: 1. Go to ktd's only vendor: <staff_url>/cgi-bin/koha/acquisition/vendors/1 2. Click "New" -> "Basket", give it a name, and save. 3. On the basket page, click "Add to basket" -> "From a new (empty) record". 4. Fill in the minimum required fields (title, quantity, fund/budget, price). Don't forget to click 'Add item'. 5. In the "Servicing instructions" section, add a group with an LVT (free-text) instruction. Enter the following: test' + alert(1) + ' 6. Save the order line. 7. Back on the basket page, click "Modify" on that order line to reopen the edit form. 8. Note that the JavaScript alert fires on page load. 9. Entering plain text with an apostrophe is enough to break the page also, e.g. "Don't break". Check the browser console for a JS syntax error. Bonus: 10. Repeat steps 1-4, but for the LVT free-text instruction enter: <script>alert(1)</script> (or <img src=x onerror=alert(1)> if script tags get stripped/ignored by the browser in that context) 11. Save the order line: no need to click Modify, the alert fires right there on the basket page itself. -- You are receiving this mail because: You are watching all bug changes.