Bug 17029 - *detail.pl are vulnerable to XSS attacks
Summary: *detail.pl are vulnerable to XSS attacks
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Searching (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency tree / graph
 
Reported: 2016-08-02 14:41 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 17029: Fix XSS in catalogue/*detail.pl (4.32 KB, patch)
2016-08-02 14:48 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 17029: Fix XSS in catalogue/*detail.pl (4.38 KB, patch)
2016-08-03 05:27 UTC, Chris Cormack 		Details | Diff | Splinter Review
[PASSED QA] Bug 17029: Fix XSS in catalogue/*detail.pl (4.44 KB, patch)
2016-08-07 12:13 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-08-02 14:41:28 UTC 
catalogue/ISBDdetail.pl
catalogue/MARCdetail.pl
catalogue/detail.pl
catalogue/labeledMARCdetail.pl
catalogue/moredetail.pl
Comment 1 Jonathan Druart 2016-08-02 14:48:31 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2016-08-03 05:27:15 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-08-07 12:13:26 UTC 
Created attachment 54122 [details] [review]
[PASSED QA] Bug 17029: Fix XSS in catalogue/*detail.pl

Hit
  /cgi-bin/koha/catalogue/detail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Kyle M Hall (khall) 2016-08-10 13:16:38 UTC 
Pushed to master for 16.11, thanks Jonathan!
Comment 5 Chris Cormack 2016-08-22 19:45:08 UTC 
Pushed to 3.20.x will be in 3.20.14
Comment 6 Frédéric Demians 2016-08-23 09:28:43 UTC 
Pushed in 16.05. Will be in 16.05.03.
Comment 7 Julian Maurice 2016-08-23 14:20:58 UTC 
Pushed to 3.22.x, will be in 3.22.10