Bug 13609

Summary: Cross Site Scripting problem in authority search
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: OPACAssignee: Katrin Fischer <katrin.fischer>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: chris, fridolin.somers, jonathan.druart, katrin.fischer, tomascohen, ulrich.kleiber
Version: Main   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 13609: Cross Site Scripting problem in authority search result list paging
Bug 13609: Cross Site Scripting problem in authority search result list paging
[SIGNED OFF] Bug 13609: Cross Site Scripting problem in authority search result list paging
Bug 13609: Cross Site Scripting problem in authority search result list paging
Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this)

Description Katrin Fischer 2015-01-22 12:18:41 UTC
One of our libraries asked a company for penetration tests of their web applications. In Koha they identified a problem in the authority search:

To test:
- Use an installation with a number of authorities, so that you can have a search result page that has paging on top
- Activate OpacAuthorities
- 'mouseover' the paging on top or at the bottom of the page, an alert window shows.

.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc%22%20onmouseover%3dprompt%28%27name%27%29%20bad%3d%22&type=opac&value=test

I could reproduce the problem in 3.12.9 and 3.18.2.
Comment 1 Katrin Fischer 2015-01-22 13:08:19 UTC
Without the mouseover:
/cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Comment 2 Katrin Fischer 2015-01-22 13:49:50 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-01-22 14:38:35 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-01-22 14:42:17 UTC
I haven't done more tests yet, but I think for the earlier versions that still include the prog theme we need to fix the file there as well (problem was found in a 3.12). Will try to write one tonight, but happy if someone can provide one earlier.
Comment 5 Tomás Cohen Arazi 2015-01-22 19:27:36 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2015-01-22 19:38:18 UTC
Created attachment 35476 [details] [review]
Bug 13609: Cross Site Scripting problem in authority search result list paging

To test:
- Use an installation a reasonable amount of authorities, so that you can
  have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'

URL:
.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 7 Chris Cormack 2015-01-22 19:44:51 UTC
Created attachment 35477 [details] [review]
Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this)

To Test:

- Use an installation a reasonable amount of authorities, so that you
  can have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'

URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Comment 8 Tomás Cohen Arazi 2015-01-22 19:45:59 UTC
Patch pushed to master.

Thanks Katrina!
Comment 9 Fridolin Somers 2015-01-23 09:29:04 UTC
Pushed to 3.14.x will be in 3.14.13
Comment 10 Chris Cormack 2015-01-23 20:49:42 UTC
Is in 3.18.x and 3.16.x also