Bugzilla – Attachment 111075 Details for
Bug 26592
XSS vulnerability when ysearch is used
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26592: Prevent XSS vulnerabilities when circ/ysearch.pl is used
Bug-26592-Prevent-XSS-vulnerabilities-when-circyse.patch (text/plain), 10.05 KB, created by
Martin Renvoize (ashimema)
on 2020-10-02 09:31:10 UTC
(
hide
)
Description:
Bug 26592: Prevent XSS vulnerabilities when circ/ysearch.pl is used
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-10-02 09:31:10 UTC
Size:
10.05 KB
patch
obsolete
>From 20fc9fda60267b2b2469234b8b9316136015f13e Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 1 Oct 2020 11:22:46 +0200 >Subject: [PATCH] Bug 26592: Prevent XSS vulnerabilities when circ/ysearch.pl > is used > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > .../prog/en/includes/js_includes.inc | 24 +++++++++++++++---- > .../prog/en/modules/circ/request-article.tt | 21 ++++++++++++---- > .../prog/en/modules/course_reserves/course.tt | 20 ++++++++++++++-- > .../prog/en/modules/reserve/request.tt | 21 ++++++++++++---- > 4 files changed, 72 insertions(+), 14 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >index 46a5949ccb..2323f83770 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >@@ -101,11 +101,16 @@ > // Display card number in parentheses if it exists > cardnumber = " (" + item.cardnumber + ") "; > } >- var itemString = "<a href=\"" + item.link + "\">" + item.surname + ", " + item.firstname + cardnumber + " <small>"; >+ var itemString = "<a href=\"" + item.link + "\">" + ( item.surname ? item.surname.escapeHtml() : "" ) + ", " + ( item.firstname ? item.firstname.escapeHtml() : "" ) + cardnumber.escapeHtml() + " <small>"; > if( item.dateofbirth ) { >- itemString += item.dateofbirth + "<span class=\"age_years\"> (" + item.age + " " + _("years") + ")</span>, "; >+ itemString += ( item.dateofbirth ? item.dateofbirth.escapeHtml() : "" ) >+ + "<span class=\"age_years\"> (" + ( item.age ? item.age.escapeHtml() : "" ) + " " + _("years") + ")</span>, "; > } >- itemString += item.address + " " + item.city + " " + item.zipcode + " " + item.country + "</small></a>"; >+ itemString += ( item.address ? item.address.escapeHtml() : "" ) + " " >+ + ( item.city ? item.city.escapeHtml() : "" ) + " " >+ + ( item.zipcode ? item.city.escapeHtml() : "" ) + " " >+ + ( item.country ? item.country.escapeHtml() : "" ) >+ + "</small></a>"; > return $( "<li></li>" ) > .data( "ui-autocomplete-item", item ) > .append( itemString ) >@@ -137,7 +142,18 @@ > } > return $( "<li></li>" ) > .data( "ui-autocomplete-item", item ) >- .append( "<a href=\"" + item.link + "\">" + item.surname + ", " + item.firstname + cardnumber + " <small>" + item.dateofbirth + " " + item.address + " " + item.city + " " + item.zipcode + " " + item.country + "</small></a>" ) >+ .append( >+ "<a href=\"" + item.link + "\">" + ( item.surname ? item.surname.escapeHtml() : "" ) + ", " >+ + ( item.firstname ? item.firstname.escapeHtml() : "" ) >+ + cardnumber.escapeHtml() >+ + " <small>" >+ + ( item.dateofbirth ? item.dateofbirth.escapeHtml() : "" ) + " " >+ + ( item.address ? item.address.escapeHtml() : "" ) + " " >+ + ( item.city ? item.city.escapeHtml() : "" ) + " " >+ + ( item.zipcode ? item.zipcode.escapeHtml() : "" ) + " " >+ + ( item.country ? item.country.escapeHtml() : "" ) >+ + "</small>" >+ + "</a>" ) > .appendTo( ul ); > }; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >index e2257fc8e5..c65582918c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >@@ -323,10 +323,23 @@ > .data( "ui-autocomplete" )._renderItem = function( ul, item ) { > return $( "<li></li>" ) > .data( "ui-autocomplete-item", item ) >- .append( "<a>" + item.surname + ", " + item.firstname + >- " (" + item.cardnumber + ") <small>" + item.address + >- " " + item.city + " " + item.zipcode + " " + >- item.country + "</small></a>" ) >+ .append( >+ "<a>" >+ + ( item.surname ? item.surname.escapeHtml() : "" ) >+ + ", " >+ + ( item.firstname ? item.firstname.escapeHtml() : "" ) >+ + " (" + ( item.cardnumber ? item.cardnumber.escapeHtml() : "" ) + ")" >+ + " " >+ + "<small>" >+ + ( item.address ? item.address.escapeHtml() : "" ) >+ + " " >+ + ( item.city ? item.city.escapeHtml() : "" ) >+ + " " >+ + ( item.zipcode ? item.zipcode.escapeHtml() : "" ) >+ + " " >+ + ( item.country ? item.country.escapeHtml() : "" ) >+ + "</small>" >+ + "</a>" ) > .appendTo( ul ); > }; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >index 3a4b0abec1..e9d542d417 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >@@ -169,7 +169,23 @@ > .data( "ui-autocomplete" )._renderItem = function( ul, item ) { > return $( "<li></li>" ) > .data( "ui-autocomplete-item", item ) >- .append( "<a>" + item.surname + ", " + item.firstname + " (" + item.cardnumber + ") <small>" + item.address + " " + item.city + " " + item.zipcode + " " + item.country + "</small></a>" ) >+ .append( >+ "<a>" >+ + ( item.surname ? item.surname.escapeHtml() : "" ) >+ + ", " >+ + ( item.firstname ? item.firstname.escapeHtml() : "" ) >+ + " (" + ( item.cardnumber ? item.cardnumber.escapeHtml() : "" ) + ")" >+ + " " >+ + "<small>" >+ + ( item.address ? item.address.escapeHtml() : "" ) >+ + " " >+ + ( item.city ? item.city.escapeHtml() : "" ) >+ + " " >+ + ( item.zipcode ? item.zipcode.escapeHtml() : "" ) >+ + " " >+ + ( item.country ? item.country.escapeHtml() : "" ) >+ + "</small>" >+ + "</a>" ) > .appendTo( ul ); > }; > >@@ -186,7 +202,7 @@ > }); > > function AddInstructor( name, borrowernumber ) { >- div = "<div class='instructor_line' id='borrower_" + borrowernumber + "'>" + name + " ( <a href='#' class='removeInstructor'><i class='fa fa-trash'></i> " + _("Remove")+ " </a> ) <input type='hidden' name='instructors' value='" + borrowernumber + "' /></div>"; >+ div = "<div class='instructor_line' id='borrower_" + borrowernumber + "'>" + ( name ? name.escapeHtml() : "" ) + " ( <a href='#' class='removeInstructor'><i class='fa fa-trash'></i> " + _("Remove")+ " </a> ) <input type='hidden' name='instructors' value='" + borrowernumber + "' /></div>"; > $('#instructors').append( div ); > > $('#find_instructor').val('').focus(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >index a3d410c22d..04d59582f6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >@@ -1320,10 +1320,23 @@ > .data( "ui-autocomplete" )._renderItem = function( ul, item ) { > return $( "<li></li>" ) > .data( "ui-autocomplete-item", item ) >- .append( "<a>" + item.surname + ", " + item.firstname + >- " (" + item.cardnumber + ") <small>" + item.address + >- " " + item.city + " " + item.zipcode + " " + >- item.country + "</small></a>" ) >+ .append( >+ "<a>" >+ + ( item.surname ? item.surname.escapeHtml() : "" ) >+ + ", " >+ + ( item.firstname ? item.firstname.escapeHtml() : "" ) >+ + " (" + ( item.cardnumber ? item.cardnumber.escapeHtml() : "" ) + ")" >+ + " " >+ + "<small>" >+ + ( item.address ? item.address.escapeHtml() : "" ) >+ + " " >+ + ( item.city ? item.city.escapeHtml() : "" ) >+ + " " >+ + ( item.zipcode ? item.zipcode.escapeHtml() : "" ) >+ + " " >+ + ( item.country ? item.country.escapeHtml() : "" ) >+ + "</small>" >+ + "</a>" ) > .appendTo( ul ); > }; > [% END %] >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26592
:
111026
|
111075
|
111384
|
111385
|
111386
|
111722
|
111737
|
112595