There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1
Created attachment 136096 [details] [review] Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability!
Created attachment 136289 [details] [review] Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Fixes the bug as described.. signing off
Created attachment 136290 [details] [review] Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Howdi, May we have a QA on this please :) Thanking you, Liz
Created attachment 136662 [details] [review] Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
(In reply to Chris Cormack from comment #6) > Created attachment 136662 [details] [review] [review] > Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( > opac-authorities-home.pl ) > > There appears to be a cross site scripting attack vulnerability in > opac-authorities-home.pl, but may be accessible from any page using > C4::Output::pagination_bar. > > https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home. > pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ > ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&opera > tor=contains&orderby=HeadingAsc&type=opac&value=1 > > Test Plan: > 1) Use the URL above to show the XSS vulnerability exists > 2) Apply this patch > 3) Restart all the things! > 4) Reload the page, no XSS vulnerability! > > Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> > Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> This one missed the 22.05.01 merge. Sorry for that.
Backported: Pushed to 21.05.x-security branch for 21.05.17
pushed to 21.11.x for 21.11.10, thx!
Backported to 22.05.x for 22.05.03