One of our libraries asked a company for penetration tests of their web applications. In Koha they identified a problem in the authority search: To test: - Use an installation with a number of authorities, so that you can have a search result page that has paging on top - Activate OpacAuthorities - 'mouseover' the paging on top or at the bottom of the page, an alert window shows. .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc%22%20onmouseover%3dprompt%28%27name%27%29%20bad%3d%22&type=opac&value=test I could reproduce the problem in 3.12.9 and 3.18.2.
Without the mouseover: /cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Created attachment 35464 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Created attachment 35469 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
I haven't done more tests yet, but I think for the earlier versions that still include the prog theme we need to fix the file there as well (problem was found in a 3.12). Will try to write one tonight, but happy if someone can provide one earlier.
Created attachment 35474 [details] [review] [SIGNED OFF] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Created attachment 35476 [details] [review] Bug 13609: Cross Site Scripting problem in authority search result list paging To test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 35477 [details] [review] Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this) To Test: - Use an installation a reasonable amount of authorities, so that you can have a search result list with more than one page - Activate OpacAuthorities - Create an OPAC link like shown below, verify that an alert is shown - Apply patch - Refresh the page and no alert should appear - Verify the paging still works correctly for 'numbers' and 'arrows' URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Patch pushed to master. Thanks Katrina!
Pushed to 3.14.x will be in 3.14.13
Is in 3.18.x and 3.16.x also