https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43137 --- Comment #31 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Comment on attachment 202440 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202440 Bug 43137: Add health status boxes to System information tab Review of attachment 202440: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=43137&attachment=202440) ----------------------------------------------------------------- ::: koha-tmpl/intranet-tmpl/prog/en/modules/about.tt @@ +157,5 @@
+ var plugin = data.plugins[pluginClass]; + if (plugin.checks && plugin.checks.length) { + html += "<h3>"; + if (plugin.url) { + html += '<a href="' + plugin.url + '">' + escapeHtml(plugin.name) + "</a>";
We introduce a xss vector here, we need to properly escape plugin.url in the href concatenation @@ +254,5 @@
+ }; + var template = messages[alert.code] || alert.code; + if (alert.params) { + if (alert.params.unassigned_shards !== undefined) { + template = template.format(alert.params.unassigned_shards);
I think we also need to add escaping here? -- You are receiving this mail because: You are watching all bug changes.