Affected Parameter:description, checkinmsg
Created attachment 65991 [details] [review] Bug 19103 - Stored XSS in itemtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/itemtypes.pl 2. Add a text in the field Description, Checkin message that contains js 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped
Created attachment 65995 [details] [review] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped
Created attachment 65996 [details] [review] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped
Created attachment 66086 [details] [review] [SIGNED OFF] Bug 19103 - Stored XSS in itemtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/itemtypes.pl 2. Add a text in the field Description, Checkin message that contains js 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66087 [details] [review] [SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66088 [details] [review] [SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66439 [details] [review] Bug 19103 - Stored XSS in itemtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/itemtypes.pl 2. Add a text in the field Description, Checkin message that contains js 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66440 [details] [review] Bug 19103 - Stored XSS in patron-attr-types.pl To Test 1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl 2. Click on new patron attribute type 2. Add a text in the field Description that contain js. 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66441 [details] [review] Bug 19103 - Stored XSS in matching-rules.pl To Test 1. Hit the page /cgi-bin/koha/admin/matching-rules.pl 2. Click on new record matching rule 3. Add a text in the field Description that contain js. 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 67084 [details] [review] Bug 19103: (follow-up) Stored XSS in itemtypes.pl
These patches have been pushed to 16.11.x and will be in 16.11.12.
These patches have been pushed to 17.05.x and are in 17.05.04.
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 16.05.x, for 16.05.17 release