https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39882
--- Comment #37 from David Cook <[email protected]> --- Thanks for adding the escaping on the system preferences folks. That's helpful. I notice adding <script>alert('stuff')</script> into PhoneMaskPattern does yield <script>alert('stuff')</script> when I type into "Other phone". Could probably be validating/massaging the system preference a bit more, although that's something I'd love to fix on the server side at some point... -- Since we only allow a select number of fields in the system preference, we should also be validating "const fields" against a list of allowed values in the front-end too. -- Overall it works though and my main security concerns are handled. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
