17036 – circulation.pl is vulnerable to XSS attacks

Bug 17036 - circulation.pl is vulnerable to XSS attacks

Summary: circulation.pl is vulnerable to XSS attacks

Status:	CLOSED FIXED

Alias:	None

Product:	Koha
Classification:	Unclassified
Component:	Circulation (show other bugs)
Version:	unspecified
Hardware:	All All

Importance:	P5 - low major
Assignee:	Jonathan Druart
QA Contact:	Testopia

URL:
Keywords:

Depends on:
Blocks:	14568
	Show dependency tree / graph

Reported:	2016-08-03 07:48 UTC by Jonathan Druart
Modified:	2019-06-27 09:24 UTC (History)
CC List:	9 users (show)

See Also:
Change sponsored?:	---
Patch complexity:	Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 17036: Fix XSS in circulation.pl (1.05 KB, patch) 2016-08-03 07:50 UTC, Jonathan Druart	Details \| Diff \| Splinter Review
Bug 17036: Fix XSS in circulation.pl (1.10 KB, patch) 2016-08-03 22:25 UTC, Chris Cormack	Details \| Diff \| Splinter Review
[PASSED QA] Bug 17036: Fix XSS in circulation.pl (1.17 KB, patch) 2016-08-07 10:03 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Jonathan Druart 2016-08-03 07:48:54 UTC

Reported by Dionach.

Comment 1 Jonathan Druart 2016-08-03 07:50:15 UTC Comment hidden (obsolete)

Created attachment 53934 [details] [review]
Bug 17036: Fix XSS in circulation.pl

Test plan:
Enter the following in the "Check out" tab:
"><script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Comment 2 Chris Cormack 2016-08-03 22:25:42 UTC Comment hidden (obsolete)

Created attachment 53984 [details] [review]
Bug 17036: Fix XSS in circulation.pl

Test plan:
Enter the following in the "Check out" tab:
"><script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Comment 3 Katrin Fischer 2016-08-07 10:03:05 UTC

Created attachment 54112 [details] [review]
[PASSED QA] Bug 17036: Fix XSS in circulation.pl

Test plan:
Enter the following in the "Check out" tab:
"><script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Comment 4 Kyle M Hall (khall) 2016-08-10 13:20:14 UTC

Pushed to master for 16.11, thanks Jonthan!

Comment 5 Chris Cormack 2016-08-22 19:41:31 UTC

Pushed to 3.20.x will be in 3.20.14

Comment 6 Frédéric Demians 2016-08-23 09:31:36 UTC

Pushed in 16.05. Will be in 16.05.03.

Comment 7 Julian Maurice 2016-08-23 14:23:01 UTC

Pushed to 3.22.x, will be in 3.22.10