Bug 19611 - XSS Flaws in supplier.pl
Summary: XSS Flaws in supplier.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Amit Gupta
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568 19738
  Show dependency treegraph
 
Reported: 2017-11-12 13:31 UTC by Amit Gupta
Modified: 2019-10-14 19:57 UTC (History)
13 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19611 - XSS Flaws in supplier.pl (2.80 KB, patch)
2017-11-12 15:47 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19611 - XSS Flaws in supplier.pl (2.87 KB, patch)
2017-11-19 21:08 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19611 - XSS Flaws in supplier.pl (2.91 KB, patch)
2017-12-03 22:14 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 19611: Fix XSS Flaws in supplier.pl (3.00 KB, patch)
2017-12-08 18:04 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-11-12 13:31:03 UTC
XSS Flaws in supplier.pl
Comment 1 Amit Gupta 2017-11-12 15:47:16 UTC
Created attachment 69099 [details] [review]
Bug 19611 - XSS Flaws in supplier.pl

Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped
Comment 2 Katrin Fischer 2017-11-19 21:08:38 UTC
Created attachment 69216 [details] [review]
Bug 19611 - XSS Flaws in supplier.pl

Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Katrin Fischer 2017-12-03 13:21:56 UTC
Awaits QA.
Comment 4 Josef Moravec 2017-12-03 22:14:35 UTC
Created attachment 69472 [details] [review]
Bug 19611 - XSS Flaws in supplier.pl

Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Comment 5 Jonathan Druart 2017-12-08 18:04:36 UTC
Created attachment 69659 [details] [review]
Bug 19611: Fix XSS Flaws in supplier.pl

Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 6 Chris Cormack 2017-12-21 00:01:45 UTC
Pushed to 16.11.x will be in 16.11.15
Comment 7 Nick Clemens 2017-12-22 10:58:04 UTC
Pushed to stable for 17.11.01
Comment 8 Fridolin Somers 2018-01-04 09:14:31 UTC
Pushed to 17.05.x for 17.05.07
Comment 9 Jonathan Druart 2018-01-09 20:31:11 UTC
Pushed to master for 18.05, thanks to everybody involved!