Bug 6632 - [security] XXS on list name (on admin part)
Summary: [security] XXS on list name (on admin part)
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: 3.4
Hardware: All All
: P5 - low normal (vote)
Assignee: Sébastien Marie
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks: 7310
  Show dependency treegraph
 
Reported: 2011-07-26 09:28 UTC by Sébastien Marie
Modified: 2013-12-05 20:01 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Proposed patch (4.00 KB, patch)
2011-07-27 11:14 UTC, Sébastien Marie
Details | Diff | Splinter Review
Bug 6632 [Signed Off] add html filter to prevent XSS (4.10 KB, patch)
2011-07-27 18:47 UTC, Liz Rea
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Sébastien Marie 2011-07-26 09:28:52 UTC
There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part.

In order to test:
 1. on opac, create a new list named 'a <blink>simple</blink> list'
 2. log as admin on staff part.
 3. go to Lists
 4. select the list named 'a <blink>simple</blink> list' (no XXS here)
 5. the 'simple' word *blink* on 3 places

The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS.
Comment 1 Sébastien Marie 2011-07-27 11:14:33 UTC Comment hidden (obsolete)
Comment 2 Liz Rea 2011-07-27 18:47:16 UTC
Created attachment 4756 [details] [review]
Bug 6632 [Signed Off] add html filter to prevent XSS

The filter 'html' have been added on all occurences of shelvename, which come from user input.
Comment 3 Liz Rea 2011-07-27 18:48:15 UTC
Bug confirmed, fix signed off.
Comment 4 Chris Cormack 2011-07-27 20:43:13 UTC
XSS fix, pushed