Bug 18726 - OPAC XSS - biblionumber
Summary: OPAC XSS - biblionumber
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-04 17:47 UTC by huracaniki
Modified: 2019-10-14 19:56 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 18726: Fix XSS at the OPAC - biblionumber (24.73 KB, patch)
2017-08-09 17:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. (24.80 KB, patch)
2017-08-10 03:13 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 18726: Fix XSS at the OPAC - biblionumber (24.88 KB, patch)
2017-08-11 06:02 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description huracaniki 2017-06-04 17:47:16 UTC
Biblionumber parameter could insert an alert message

/cgi-bin/koha/opac-serial-issues.pl?biblionumber="><script>alert("XSS")</script><!--
Comment 1 Jonathan Druart 2017-08-09 17:10:01 UTC
Created attachment 65772 [details] [review]
Bug 18726: Fix XSS at the OPAC - biblionumber

The biblionumber parameter is sent by the user, we must escape all of
them to avoid XSS.
Comment 2 Amit Gupta 2017-08-10 03:13:25 UTC
Created attachment 65784 [details] [review]
The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS.

Work OK.
Fixes: Cross-site scripting OPAC pages
Comment 3 Marcel de Rooy 2017-08-11 06:02:21 UTC
opac-reserve.pl?biblionumber=23%3Cscript%3Ealert(1)%3C/script%3E
Can't call method "field" on an undefined value at C4/Items.pm line 1211.
Crashes

opac-detail.pl?biblionumber=23<script>alert(1)</script>&query_desc=kw%2Cwrdl%3A perl
Argument "23<script>..." isn't numeric in int at opac/opac-detail.pl line 80.
Warns
Comment 4 Marcel de Rooy 2017-08-11 06:02:59 UTC
Created attachment 65873 [details] [review]
Bug 18726: Fix XSS at the OPAC - biblionumber

The biblionumber parameter is sent by the user, we must escape all of
them to avoid XSS.

Fixes: Cross-site scripting OPAC pages

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Jonathan Druart 2017-08-29 15:07:11 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin Somers 2017-09-05 12:46:13 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 7 Katrin Fischer 2017-09-07 06:17:07 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.
Comment 8 Mason James 2017-11-23 21:17:04 UTC
Pushed to 16.05.x, for 16.05.16 release