17026 – checkexpiration.pl is vulnerable to XSS attacks

Bug 17026 - checkexpiration.pl is vulnerable to XSS attacks

Summary: checkexpiration.pl is vulnerable to XSS attacks

Status:	CLOSED FIXED

Alias:	None

Product:	Koha
Classification:	Unclassified
Component:	Serials (show other bugs)
Version:	unspecified
Hardware:	All All

Importance:	P5 - low major
Assignee:	Jonathan Druart
QA Contact:	Testopia

URL:
Keywords:

Depends on:
Blocks:	14568
	Show dependency tree / graph

Reported:	2016-08-02 14:11 UTC by Jonathan Druart
Modified:	2019-06-27 09:24 UTC (History)
CC List:	7 users (show)

See Also:
Change sponsored?:	---
Patch complexity:	Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 17026: Fix XSS in serials/checkexpiration.pl (2.06 KB, patch) 2016-08-02 14:30 UTC, Jonathan Druart	Details \| Diff \| Splinter Review
Bug 17026: Fix XSS in serials/checkexpiration.pl (2.12 KB, patch) 2016-08-03 05:20 UTC, Chris Cormack	Details \| Diff \| Splinter Review
[PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl (2.18 KB, patch) 2016-08-03 21:42 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Jonathan Druart 2016-08-02 14:11:04 UTC

Reported by Dionach.

Comment 1 Jonathan Druart 2016-08-02 14:30:21 UTC Comment hidden (obsolete)

Created attachment 53912 [details] [review]
Bug 17026: Fix XSS in serials/checkexpiration.pl

Test plan:
Hit:
 /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002
 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002

=> Without this patch you will see the alert
=> With this patch, no more alert

Comment 2 Chris Cormack 2016-08-03 05:20:17 UTC Comment hidden (obsolete)

Created attachment 53931 [details] [review]
Bug 17026: Fix XSS in serials/checkexpiration.pl

Test plan:
Hit:
 /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002
 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Comment 3 Katrin Fischer 2016-08-03 21:42:34 UTC

Created attachment 53978 [details] [review]
[PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl

Test plan:
Hit:
 /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002
 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Comment 4 Brendan Gallagher 2016-08-04 18:14:10 UTC

Pushed to Master - Should be in the November 2016 release. Thanks!

Comment 5 Frédéric Demians 2016-08-05 06:07:56 UTC

Pushed in 16.05. Will be in 16.05.03.

Comment 6 Chris Cormack 2016-08-08 07:00:00 UTC

Pushed to 3.20.x will be in 3.20.14

Comment 7 Julian Maurice 2016-08-17 12:39:23 UTC

Patches pushed to 3.22.x, will be in 3.22.10