Created attachment 51818 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach
Created attachment 51819 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach
Created attachment 51820 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach
Created attachment 51858 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 51859 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 51860 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 51869 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 51870 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 51871 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to Master - Should be in the November 2016 release. Thanks
Pushed to 3.20.x will be in 3.20.11, is in 3.22.7
(In reply to Chris Cormack from comment #11) > is in 3.22.7 No, but it will be in 3.22.8