Bug 11535 - Patron self-registration form does not sanitize its input
Summary: Patron self-registration form does not sanitize its input
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-13 21:49 UTC by Galen Charlton
Modified: 2015-06-04 23:23 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 11535: sanitize input from patron self-registration form (1.80 KB, patch)
2014-01-13 22:04 UTC, Galen Charlton
Details | Diff | Splinter Review
Bug 11535: sanitize input from patron self-registration form (1.88 KB, patch)
2014-01-13 23:18 UTC, Liz Rea
Details | Diff | Splinter Review
[PASSED QA] Bug 11535: sanitize input from patron self-registration form (2.02 KB, patch)
2014-01-14 05:52 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2014-01-13 21:49:52 UTC
The OPAC patron self-registration form does not sanitize its input, thereby allowing rude folks to inject unwanted JavaScript in the staff interface.  This is annoying.
Comment 1 Galen Charlton 2014-01-13 22:04:03 UTC Comment hidden (obsolete)
Comment 2 Liz Rea 2014-01-13 23:18:03 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-01-14 05:52:03 UTC
Created attachment 24267 [details] [review]
[PASSED QA] Bug 11535: sanitize input from patron self-registration form

This patch adds the use of C4::Scrubber to the processing of input
from the patron self-registration form, thereby closing off one
avenue for Javascript injection.

To test:

[1] Use the OPAC self-registration form to enter a new patron,
    and set its address to something like:

    <span style="color: red;">BAD</span>

[2] In the staff interface, bring up the new patron record.  The
    address will show up in red, indicating a successful HTML
    injection.
[3] Apply the patch and use self-registration to enter a new
    patron with a similar case of unwanted HTML coding.
[4] Bring up the second patron in the staff interface.  This time,
    the undesirable HTML tag should not be present.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tags are not present on testing.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and that the patch fixes it.
Passes all tests and QA script.
Comment 4 Galen Charlton 2014-01-14 16:36:11 UTC
Pushed to master.
Comment 5 Fridolin Somers 2014-01-14 17:03:17 UTC
Patch pushed to 3.14.x, will be in 3.14.2.
Comment 6 Tomás Cohen Arazi 2014-01-15 14:56:55 UTC
This patch has been pushed to 3.12.x, will be in 3.12.9.

Thanks Galen!