Bugzilla – Attachment 107579 Details for
Bug 26102
Javascript injection in intranet search
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26102: Prevent XSS when To.json is used
Bug-26102-Prevent-XSS-when-Tojson-is-used.patch (text/plain), 15.35 KB, created by
Jonathan Druart
on 2020-07-30 12:00:15 UTC
(
hide
)
Description:
Bug 26102: Prevent XSS when To.json is used
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2020-07-30 12:00:15 UTC
Size:
15.35 KB
patch
obsolete
>From d102bb78ffdfb4b17b7e152871d09cb4fdc4412a Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 30 Jul 2020 13:59:46 +0200 >Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used > >--- > .../prog/en/includes/js_includes.inc | 2 +- > .../prog/en/modules/admin/preferences.tt | 2 +- > .../en/modules/authorities/authorities.tt | 2 +- > .../authorities/blinddetail-biblio-search.tt | 4 +-- > .../prog/en/modules/catalogue/itemsearch.tt | 2 +- > .../prog/en/modules/catalogue/results.tt | 2 +- > .../value_builder/unimarc_field_4XX.tt | 34 +++++++++---------- > .../prog/en/modules/members/memberentrygen.tt | 2 +- > .../members/tables/guarantor_search.tt | 2 +- > .../prog/en/modules/reserve/request.tt | 4 +-- > .../en/modules/serials/subscription-add.tt | 2 +- > .../suggestion/tables/suggester_search.tt | 2 +- > .../bootstrap/en/modules/sco/sco-main.tt | 2 +- > 13 files changed, 31 insertions(+), 31 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >index f56faebea8..687e84a47b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >@@ -66,7 +66,7 @@ > <script> > // AudioAlerts > var AUDIO_ALERT_PATH = '[% interface | html %]/[% theme | html %]/sound/'; >- var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); >+ var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" ); > > $( document ).ready(function() { > if ( AUDIO_ALERTS ) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >index 4ec818f470..8723c709be 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >@@ -249,7 +249,7 @@ > }); > }); > // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw >- var to_highlight = "[% To.json( searchfield ) | $raw %]"; >+ var to_highlight = "[% To.json( searchfield ) | html %]"; > var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %]; > var MSG_NOTHING_TO_SAVE = _("Nothing to save"); > var MSG_SAVING = _("Saving..."); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >index 026f48560f..82a0dc42a1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >@@ -70,7 +70,7 @@ function AreMandatoriesNotOk(){ > [% FOREACH subfield_loo IN innerloo.subfield_loop %] > [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]"); > tab.push("[% BIG_LOO.number | html %]"); >- label.push("[% To.json(subfield_loo.marc_lib) | $raw %]"); >+ label.push("[% To.json(subfield_loo.marc_lib) | html %]"); > [% END %] > [% END %] > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >index 083eda7c18..776883c340 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >@@ -32,9 +32,9 @@ > [% ELSE %] > var new_line = " > [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]â¡ >- [%- To.json( SUBFIELD_LOO.marc_subfield ) | $raw -%] >+ [%- To.json( SUBFIELD_LOO.marc_subfield ) | html -%] > [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%] >- [%- To.json( marc_value ) | $raw -%] >+ [%- To.json( marc_value ) | html -%] > [%- END -%] > [%- END -%]â¡9[% authid | html %]"; > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >index b1fa37e812..1ce4e9ddee 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >@@ -108,7 +108,7 @@ > [%- label = BLOCK %][% e.label | html %][% END -%] > [%- escaped.push({ 'value' => value, 'label' => label }) -%] > [%- END -%] >- [%- To.json(escaped) | $raw -%] >+ [%- To.json(escaped) | html -%] > [%- END -%] > > [% notforloans = AuthorisedValues.GetDescriptionsByKohaField({ kohafield = 'items.notforloan' }) %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >index 220d7de5ea..92ae625dff 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >@@ -736,7 +736,7 @@ > [%- END -%] > > var search_result = { >- query_desc: "[% To.json( query_desc ) | $raw %]", >+ query_desc: "[% To.json( query_desc ) | html %]", > query_cgi: "[% query_cgi | html %]", > limit_cgi: "[% limit_cgi | html %]", > sort_cgi: "[% sort_cgi | html %]", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >index 35bad25966..4edfbace20 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >@@ -169,55 +169,55 @@ > var subfield = subfields[i+1]; > > if(code.value == '9'){ >- subfield.value = "[% To.json( subfield_value_9 ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_9 ) | html %]"; > } > if(code.value == '0'){ >- subfield.value = "[% To.json( subfield_value_0 ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_0 ) | html %]"; > } > if(code.value == 'a'){ >- subfield.value = "[% To.json( subfield_value_a ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_a ) | html %]"; > } > if(code.value == 'c'){ >- subfield.value = "[% To.json( subfield_value_c ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_c ) | html %]"; > } > if(code.value == 'd'){ >- subfield.value = "[% To.json( subfield_value_d ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_d ) | html %]"; > } > if(code.value == 'e'){ >- subfield.value = "[% To.json( subfield_value_e ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_e ) | html %]"; > } > if(code.value == 'h'){ >- subfield.value = "[% To.json( subfield_value_h ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_h ) | html %]"; > } > if(code.value == 'i'){ >- subfield.value = "[% To.json( subfield_value_i ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_i ) | html %]"; > } > if(code.value == 'l'){ >- subfield.value = "[% To.json( subfield_value_l ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_l ) | html %]"; > } > if(code.value == 'n'){ >- subfield.value = "[% To.json( subfield_value_n ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_n ) | html %]"; > } > if(code.value == 'o'){ >- subfield.value = "[% To.json( subfield_value_o ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_o ) | html %]"; > } > if(code.value == 'p'){ >- subfield.value = "[% To.json( subfield_value_p ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_p ) | html %]"; > } > if(code.value == 't'){ >- subfield.value = "[% To.json( subfield_value_t ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_t ) | html %]"; > } > if(code.value == 'u'){ >- subfield.value = "[% To.json( subfield_value_u ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_u ) | html %]"; > } > if(code.value == 'v'){ >- subfield.value = "[% To.json( subfield_value_v ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_v ) | html %]"; > } > if(code.value == 'x'){ >- subfield.value = "[% To.json( subfield_value_x ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_x ) | html %]"; > } > if(code.value == 'y'){ >- subfield.value = "[% To.json( subfield_value_y ) | $raw %]"; >+ subfield.value = "[% To.json( subfield_value_y ) | html %]"; > } > } > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >index 0014a0f612..c094bf5ade 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >@@ -1592,7 +1592,7 @@ legend:hover { > > [% IF new_guarantors %] > [% FOREACH g IN new_guarantors %] >- select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | $raw %], '[% g.relationship | html %]' ); >+ select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | html %], '[% g.relationship | html %]' ); > [% END %] > [% END %] > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt >index 38ec5aa9e0..fd55506c11 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt >@@ -32,5 +32,5 @@ > [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] > [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] > [%~ SET address = address _ Branches.GetName( data.branchcode ) %] >-[%~ To.json( address ) | $raw ~%] >+[%~ address | html | $To ~%] > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >index e15d468fcc..dcf16a92af 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >@@ -939,10 +939,10 @@ > var biblionumber = "[% biblionumber | $raw %]"; > var borrowernumber = "[% patron.borrowernumber | $raw %]"; > var MSG_CONFIRM_DELETE_HOLD = _("Are you sure you want to cancel this hold?"); >- var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | $raw %]"; >+ var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | html %]"; > var override_items = {[% FOREACH bibitemloo IN bibitemloop %][% FOREACH itemloo IN bibitemloo.itemloop %][% IF ( itemloo.override ) %] > [% itemloo.itemnumber | html %]: { >- homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | $raw %]"; >+ homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | html %]"; > holdallowed: [% itemloo.holdallowed | html %] > }, > [% END %][% END %][% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >index 1075e14d19..8623f43a88 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >@@ -556,7 +556,7 @@ fieldset.rows table { clear: none; margin: 0; } > var MSG_MANA_NO_SUBSCRIPTION_FOUND = _("No subscription found on Mana Knowledge Base"); > var MSG_MANA_SHARE_PATTERN = _("Please feel free to share your pattern with all others librarians once you are done"); > >- var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | $raw %]; >+ var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | html %]; > </script> > [% Asset.js("js/subscription-add.js") | $raw %] > [% Asset.js("js/showpredictionpattern.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt >index a82f0e8dcb..cbac0393a9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt >@@ -32,5 +32,5 @@ > [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] > [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] > [%~ SET address = address _ Branches.GetName( data.branchcode ) %] >-[%~ To.json( address ) | $raw ~%] >+[%~ address | html | $To ~%] > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >index c428886a4d..6d8622fd0c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >@@ -440,7 +440,7 @@ > return true; > } > [% IF Koha.Preference('AudioAlerts') %] >- var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); >+ var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" ); > $( document ).ready(function() { > if ( AUDIO_ALERTS ) { > for ( var k in AUDIO_ALERTS ) { >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26102
:
107579
|
108083
|
108084
|
108085
|
108086
|
108087
|
108088
|
108089
|
108090
|
119643
|
119644
|
119645
|
119646
|
119647
|
119648
|
119649
|
127669
|
127670
|
127671
|
127672
|
127673
|
127674
|
127675
|
128716
|
128717
|
128718
|
128719
|
128720
|
128721
|
128722
|
130931
|
130932
|
130933
|
130934
|
130935
|
130936
|
130999
|
131000
|
131001
|
131002
|
131003
|
131004