Biblionumber parameter could insert an alert message /cgi-bin/koha/opac-serial-issues.pl?biblionumber="><script>alert("XSS")</script><!--
Created attachment 65772 [details] [review] Bug 18726: Fix XSS at the OPAC - biblionumber The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS.
Created attachment 65784 [details] [review] The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Work OK. Fixes: Cross-site scripting OPAC pages
opac-reserve.pl?biblionumber=23%3Cscript%3Ealert(1)%3C/script%3E Can't call method "field" on an undefined value at C4/Items.pm line 1211. Crashes opac-detail.pl?biblionumber=23<script>alert(1)</script>&query_desc=kw%2Cwrdl%3A perl Argument "23<script>..." isn't numeric in int at opac/opac-detail.pl line 80. Warns
Created attachment 65873 [details] [review] Bug 18726: Fix XSS at the OPAC - biblionumber The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Fixes: Cross-site scripting OPAC pages Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 17.05.x, is in 17.05.03
This patch has been pushed to 16.11.x and is in 16.11.11.
Pushed to 16.05.x, for 16.05.16 release