Bugzilla – Attachment 170517 Details for
Bug 37654
XSS in batch record import for the citation column
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37654: XSS in Batch record import for Citation column
Bug-37654-XSS-in-Batch-record-import-for-Citation-.patch (text/plain), 2.79 KB, created by
David Cook
on 2024-08-21 05:24:10 UTC
(
hide
)
Description:
Bug 37654: XSS in Batch record import for Citation column
Filename:
MIME Type:
Creator:
David Cook
Created:
2024-08-21 05:24:10 UTC
Size:
2.79 KB
patch
obsolete
>From 35cea107e0e0fee60caab1fa8a30bcdc72ffa154 Mon Sep 17 00:00:00 2001 >From: Phil Ringnalda <phil@chetcolibrary.org> >Date: Thu, 15 Aug 2024 19:57:42 -0700 >Subject: [PATCH] Bug 37654: XSS in Batch record import for Citation column > >Viewing a staged MARC record batch loads a DataTable from >/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the >DataTable just trust the author/title/isbn/issn to be free of HTML. They >shouldn't. > >Test plan: >1. Without this patch applied, download attachment 170418, then Cataloging > - Stage records for import - Select the downloaded file - Upload file - > Stage for import >2. When the background job completes, View batch - you'll get three alert()s > from the title, author, and ISSN, and the author and ISSN displayed huge >3. Apply patch, restart_all >4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero > alerts and no <h2> display > >Sponsored-by: Chetco Community Public Library >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > .../prog/en/modules/tools/manage-marc-import.tt | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >index f07f35a220..d250ca59a2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >@@ -498,19 +498,19 @@ > > var additional_details = ""; > if( aData['author'] ){ >- additional_details += " " + aData['author'] + " "; >+ additional_details += " " + escape_str(aData['author']) + " "; > } > > if( aData['isbn'] ){ >- additional_details += " (" + aData['isbn'] + ") "; >+ additional_details += " (" + escape_str(aData['isbn']) + ") "; > } > > if( aData['issn'] ){ >- additional_details += " (" + aData['issn'] + ") "; >+ additional_details += " (" + escape_str(aData['issn']) + ") "; > } > > $('td:eq(1)', nRow).html( >- '<a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=' + aData['import_record_id'] + '&viewas=html" class="previewMARC">' + aData['citation'] + '</a> ' + additional_details >+ '<a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=' + aData['import_record_id'] + '&viewas=html" class="previewMARC">' + escape_str(aData['citation']) + '</a> ' + additional_details > ); > > $('td:eq(2)', nRow).html( >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37654
:
170412
|
170418
|
170419
|
170457
|
170517
|
170524