Bug 19103 - Stored XSS in itemtypes.pl - patron-attr-types.pl - matching-rules.pl
Summary: Stored XSS in itemtypes.pl - patron-attr-types.pl - matching-rules.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Amit Gupta
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-15 03:20 UTC by Amit Gupta
Modified: 2019-10-14 19:56 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19103 - Stored XSS in itemtypes.pl (1.83 KB, patch)
2017-08-15 03:25 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19103 - Stored XSS in patron-attr-types.pl (1.28 KB, patch)
2017-08-15 04:40 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19103 - Stored XSS in matching-rules.pl (1.60 KB, patch)
2017-08-15 04:48 UTC, Amit Gupta
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19103 - Stored XSS in itemtypes.pl (1.90 KB, patch)
2017-08-16 12:00 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl (1.36 KB, patch)
2017-08-16 12:00 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl (1.67 KB, patch)
2017-08-16 12:00 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19103 - Stored XSS in itemtypes.pl (1.99 KB, patch)
2017-08-25 06:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19103 - Stored XSS in patron-attr-types.pl (1.44 KB, patch)
2017-08-25 06:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19103 - Stored XSS in matching-rules.pl (1.76 KB, patch)
2017-08-25 06:20 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19103: (follow-up) Stored XSS in itemtypes.pl (1.33 KB, patch)
2017-09-12 13:59 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-15 03:20:57 UTC
Affected Parameter:description, checkinmsg
Comment 1 Amit Gupta 2017-08-15 03:25:07 UTC
Created attachment 65991 [details] [review]
Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 2 Amit Gupta 2017-08-15 04:40:52 UTC
Created attachment 65995 [details] [review]
Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 3 Amit Gupta 2017-08-15 04:48:20 UTC
Created attachment 65996 [details] [review]
Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Comment 4 Katrin Fischer 2017-08-16 12:00:25 UTC
Created attachment 66086 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Katrin Fischer 2017-08-16 12:00:28 UTC
Created attachment 66087 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2017-08-16 12:00:31 UTC
Created attachment 66088 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Marcel de Rooy 2017-08-25 06:20:15 UTC
Created attachment 66439 [details] [review]
Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Marcel de Rooy 2017-08-25 06:20:20 UTC
Created attachment 66440 [details] [review]
Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Marcel de Rooy 2017-08-25 06:20:24 UTC
Created attachment 66441 [details] [review]
Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Jonathan Druart 2017-09-12 13:59:10 UTC
Created attachment 67084 [details] [review]
Bug 19103: (follow-up) Stored XSS in itemtypes.pl
Comment 11 Katrin Fischer 2017-09-19 21:09:45 UTC
These patches have been pushed to 16.11.x and will be in 16.11.12.
Comment 12 Fridolin Somers 2017-09-22 15:05:35 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 13 Jonathan Druart 2017-09-29 15:46:28 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 14 Mason James 2017-11-23 22:03:09 UTC
Pushed to 16.05.x, for 16.05.17 release