Attachment 113236 Details for Bug 24412 – Bug 24412: (follow-up) prevent js injection

[patch] Bug 24412: (follow-up) prevent js injection

Bug-24412-follow-up-prevent-js-injection.patch (text/plain), 2.15 KB, created by Jonathan Druart on 2020-11-06 10:59:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-11-06 10:59:45 UTC

Size: 2.15 KB

patch

obsolete

>From 297cf432288fdbb7677868deeb52c6422ba87105 Mon Sep 17 00:00:00 2001
>From: Nicolas Legrand <nicolas.legrand@bulac.fr>
>Date: Thu, 5 Nov 2020 14:52:02 +0100
>Subject: [PATCH] Bug 24412: (follow-up) prevent js injection
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Some js variables are not properly escaped and can be executed if
>containing javascript.
>
>1. have some waiting reserve attached to a desk
>2. change this desk name to : <script>alert("â¤");</script>
>3. go to user's checkout page (circulation.pl) and click on the
>Hold(s) tab
>4. you should see some popup with a â¤ in it.
>5. apply patch and refresh page
>6. now you should see the desk name printed properly in the page:
><script>alert("â¤");</script>
>---
> koha-tmpl/intranet-tmpl/prog/js/holds.js | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js
>index be94430d88..29a048914a 100644
>--- a/koha-tmpl/intranet-tmpl/prog/js/holds.js
>+++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js
>@@ -162,13 +162,13 @@ $(document).ready(function() {
>                                     if ( oObj.waiting_here ) {
>                                         data += __("Item is <strong>waiting here</strong>");
>                                         if (oObj.desk_name) {
>-                                            data += ", " + __("at %s").format(oObj.desk_name);
>+                                            data += ", " + __("at %s").format(oObj.desk_name.escapeHtml());
>                                         }
>                                     } else {
>                                         data += __("Item is <strong>waiting</strong>");
>                                         data += " " + __("at %s").format(oObj.waiting_at);
>                                         if (oObj.desk_name) {
>-                                            data += ", " + __("at %s").format(oObj.desk_name);
>+                                            data += ", " + __("at %s").format(oObj.desk_name.escapeHtml());
>                                         }
> 
>                                     }
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 24412: 97328 | 97329 | 97330 | 101625 | 101626 | 101627 | 101628 | 101629 | 101630 | 101721 | 101722 | 101723 | 101825 | 101884 | 101885 | 101886 | 101898 | 101899 | 101900 | 101955 | 101956 | 101957 | 106586 | 106648 | 110067 | 110068 | 110069 | 110070 | 110450 | 110451 | 110452 | 110453 | 110454 | 110455 | 110582 | 110583 | 110584 | 110585 | 110586 | 112046 | 112047 | 112048 | 112049 | 112050 | 112092 | 112099 | 112165 | 112166 | 112167 | 112168 | 112169 | 112170 | 112171 | 112172 | 112201 | 112202 | 112203 | 112204 | 112205 | 112206 | 112207 | 112208 | 112209 | 112210 | 112211 | 112212 | 112213 | 112214 | 112215 | 112216 | 112217 | 112218 | 112219 | 112264 | 112265 | 112266 | 112267 | 112268 | 112269 | 112270 | 112271 | 112272 | 112292 | 112293 | 113108 | 113109 | 113116 | 113228 | 113229 | 113230 | 113231 | 113232 | 113233 | 113234 | 113235 | 113236