{"push_id":1129326869,"size":3,"distinct_size":3,"ref":"refs/heads/master","head":"120967a6a9e777d0f99300fdbb6552943ce6e9af","before":"97028f4b8904387df267fa3a43f7b1bc852a0bf3","commits":[{"sha":"05a014b7668e0c4fa662821f7774ac733fd0cc7f","author":{"email":"711c73f64afdce07b7e38039a96d2224209e9a6c@bigballofwax.co.nz","name":"Chris Cormack"},"message":"Bug 16587 - opac-sendbasket.pl is open to XSS\n\nTo test\n1/ Hit a url like\nhttp://localhost:8080/cgi-bin/koha/opac-sendbasket.pl?email_add=%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3Ezz%40zz&comment=tes&bib_list=3\n\nWhere bib_list is a valid basket number\n2/ Notice you get a javascript alert showing\n3/ Apply patch\n4/ Notice the text is now escaped\n\nSigned-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>\n\nSigned-off-by: Kyle M Hall <kyle@bywatersolutions.com>\n\nSigned-off-by: Brendan Gallagher <brendan@bywatersolutions.com>","distinct":true,"url":"https://api.github.com/repos/Koha-Community/Koha/commits/05a014b7668e0c4fa662821f7774ac733fd0cc7f"},{"sha":"4e817ee04c2b5fbc2353ff382c6630322e57d8ae","author":{"email":"711c73f64afdce07b7e38039a96d2224209e9a6c@bigballofwax.co.nz","name":"Chris Cormack"},"message":"Bug 16587 opac-sendshelf.pl is vulnerable to XSS\n\nTo test\n1/ Hit a url like\nhttp://localhost:8080/cgi-bin/koha/opac-sendshelf.pl?email=%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3Ezz%40zz&comment=tes&shelfid=4\n2/ Notice you get a js alert\n3/ Apply patch\n4/ Notice the js is now escaped\n\nSigned-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>\n\nSigned-off-by: Kyle M Hall <kyle@bywatersolutions.com>\n\nSigned-off-by: Brendan Gallagher <brendan@bywatersolutions.com>","distinct":true,"url":"https://api.github.com/repos/Koha-Community/Koha/commits/4e817ee04c2b5fbc2353ff382c6630322e57d8ae"},{"sha":"120967a6a9e777d0f99300fdbb6552943ce6e9af","author":{"email":"90effa772b5c8a7a3420e6b7ea56e265888c5743@bugs.koha-community.org","name":"Jonathan Druart"},"message":"Bug 16587: Same fixes for the staff interface\n\nSigned-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>\n\nSigned-off-by: Kyle M Hall <kyle@bywatersolutions.com>\n\nSigned-off-by: Brendan Gallagher <brendan@bywatersolutions.com>","distinct":true,"url":"https://api.github.com/repos/Koha-Community/Koha/commits/120967a6a9e777d0f99300fdbb6552943ce6e9af"}]}
{"actor":{"display_login":"gmcharlt"}}