Bugzilla – Attachment 161712 Details for
Bug 35960
XSS in staff login form
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 35960: Use .val() instead of string concat to prevent potential XSS
Bug-35960-Use-val-instead-of-string-concat-to-prev.patch (text/plain), 1.41 KB, created by
Julian Maurice
on 2024-02-01 08:22:18 UTC
(
hide
)
Description:
Bug 35960: Use .val() instead of string concat to prevent potential XSS
Filename:
MIME Type:
Creator:
Julian Maurice
Created:
2024-02-01 08:22:18 UTC
Size:
1.41 KB
patch
obsolete
>From a84532ad1f4dd21be8134dd55413d6b2046bd862 Mon Sep 17 00:00:00 2001 >From: Julian Maurice <julian.maurice@biblibre.com> >Date: Thu, 1 Feb 2024 09:15:23 +0100 >Subject: [PATCH] Bug 35960: Use .val() instead of string concat to prevent > potential XSS > >Test plan: >1. Log out >2. Go to /cgi-bin/koha/mainpage.pl#somestring"with<html>char >3. Open the brower's inspector and find "auth_forwarded_hash" input >4. Make sure the value attribute is there and corresponds to the URL's > fragment. It should be URI-encoded. >--- > koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 14e30e5e6e5..67e58dea885 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -247,7 +247,9 @@ > <script> > $(document).ready( function() { > if ( document.location.hash ) { >- $( '#loginform' ).append( '<input name="auth_forwarded_hash" type="hidden" value="' + document.location.hash + '"/>' ); >+ const input = $('<input name="auth_forwarded_hash" type="hidden">') >+ input.val(document.location.hash); >+ $( '#loginform' ).append( input ); > } > // Clear last borrowers, rememberd sql reports, carts, etc. > logOut(); >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 35960
:
161712
|
162149
|
162526