Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Summary: XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Katrin Fischer
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 14568
Blocks: 19391
  Show dependency treegraph
 
Reported: 2017-08-16 12:33 UTC by Katrin Fischer
Modified: 2019-10-14 19:55 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt (7.95 KB, patch)
2017-08-16 12:37 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt (8.00 KB, patch)
2017-08-17 08:33 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt (8.11 KB, patch)
2017-08-25 06:43 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19128: XSS - admin/authorised_values.tt (3.19 KB, patch)
2017-09-12 13:36 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2017-08-16 12:33:52 UTC

    
Comment 1 Katrin Fischer 2017-08-16 12:37:14 UTC
Created attachment 66090 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.
Comment 2 Amit Gupta 2017-08-17 08:33:53 UTC
Created attachment 66136 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.
********************************************
Works fine.
Comment 3 Marcel de Rooy 2017-08-25 06:43:41 UTC
Created attachment 66451 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-09-12 13:36:25 UTC
Created attachment 67083 [details] [review]
Bug 19128: XSS - admin/authorised_values.tt
Comment 5 Katrin Fischer 2017-09-19 21:08:22 UTC
These patches have been pushed to 16.11.x and will be in 16.11.12.
Comment 6 Fridolin Somers 2017-09-22 15:07:28 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 7 Jonathan Druart 2017-09-29 15:48:12 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Mason James 2017-11-23 22:05:00 UTC
Pushed to 16.05.x, for 16.05.17 release