Bugzilla – Attachment 138234 Details for
Bug 31219
Patron attribute types not cleaned/checked
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31219: Prevent JS injection in patron extended attributes
Bug-31219-Prevent-JS-injection-in-patron-extended-.patch (text/plain), 1.64 KB, created by
Katrin Fischer
on 2022-07-28 21:38:21 UTC
(
hide
)
Description:
Bug 31219: Prevent JS injection in patron extended attributes
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2022-07-28 21:38:21 UTC
Size:
1.64 KB
patch
obsolete
>From 288a28deb7df50dcd77d7fe6eb150faffcaede70 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 25 Jul 2022 09:23:25 +0200 >Subject: [PATCH] Bug 31219: Prevent JS injection in patron extended attributes > >We are sanitizing other attributes but "extended patron attributes". > >Test plan: >Make a patron attribute editable at the OPAC >Edit an existing patron, or register a new one >Use a script tag in the new value ("<script>alert("booh!")</script>" for >instance) >With this patch the value is remove if containing an HTML tag that is >not br b i em big small strong (see C4::Scrubber) > >Signed-off-by: Mark Hofstetter <koha@trust-box.at> >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > opac/opac-memberentry.pl | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl >index f456362c3a..e1a86e65b3 100755 >--- a/opac/opac-memberentry.pl >+++ b/opac/opac-memberentry.pl >@@ -739,6 +739,7 @@ sub ParsePatronAttributes { > > my $delete_candidates = {}; > >+ my $scrubber = C4::Scrubber->new(); > while ( my ( $code, $value ) = $ea->() ) { > if ( any { $_ eq $code } @editable_attribute_types ) { > # It is an editable attribute >@@ -748,7 +749,7 @@ sub ParsePatronAttributes { > } > else { > # we've got a value >- push @attributes, { code => $code, attribute => $value }; >+ push @attributes, { code => $code, attribute => $scrubber->scrub( $value ) }; > > # 'code' is no longer a delete candidate > delete $delete_candidates->{$code} >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31219
:
138072
| 138234