Bugzilla – Attachment 170691 Details for
Bug 37720
XSS (and bustage) in label creator
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 37720: XSS (and bustage) in label creator
Bug-37720-XSS-and-bustage-in-label-creator.patch (text/plain), 4.95 KB, created by
David Cook
on 2024-08-26 02:14:07 UTC
(
hide
)
Description:
Bug 37720: XSS (and bustage) in label creator
Filename:
MIME Type:
Creator:
David Cook
Created:
2024-08-26 02:14:07 UTC
Size:
4.95 KB
patch
obsolete
>From e6ec17203020c8e794e6852c633f61dce3ade0a7 Mon Sep 17 00:00:00 2001 >From: Phil Ringnalda <phil@chetcolibrary.org> >Date: Fri, 23 Aug 2024 12:31:00 -0700 >Subject: [PATCH] Bug 37720: XSS (and bustage) in label creator > >Because labels/label-edit-batch.pl fills a DataTable with things that include >a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter, >so HTML in author/title/callnumber is executed in the label batch editor. >While we wait for a fix that moves the link creation into the template and >out of C4, encoding HTML in Lib.pm for the bits going into the link, and >switching from $raw to the html filter for the rest of the things, will at >least get rid of the XSS. > >Test plan: > 1. Without this patch, but with the patch from bug 37654 so you don't get > alert()s in batch import, download attachment 170675 > 2. Cataloging - Stage records for import - browse to the downloaded file - > Upload file - when the upload finishes Stage for import - when staging > finishes View batch (get alert()s if you didn't apply bug 37654) - Import > this batch into the catalog > 3. Once the import finishes, Cataloging - Manage staged records > 4. In the row for your import, in the # Items column, click "(Create label > batch)" > 5. In the "Label batch #n created" message, click the link to the batch # > 6. Because the batch includes a call number with an open <script>, you'll > get XSS alert()s and then one about something going wrong while loading > the table, with only one of the two records showing in the batch editor > 7. Apply patch, restart_all > 8. Cataloging - Label creator - Manage Label batches > 9. In the row for your batch, click Edit >10. You will see both labels, with their attempts at XSS visible as text > rather than being interpreted as HTML > >Sponsored-by: Chetco Community Public Library >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > C4/Creators/Lib.pm | 6 +++--- > .../prog/en/modules/labels/label-edit-batch.tt | 4 +++- > 2 files changed, 6 insertions(+), 4 deletions(-) > >diff --git a/C4/Creators/Lib.pm b/C4/Creators/Lib.pm >index d4831ab479..82d4921cbb 100644 >--- a/C4/Creators/Lib.pm >+++ b/C4/Creators/Lib.pm >@@ -19,7 +19,7 @@ package C4::Creators::Lib; > > use Modern::Perl; > use Storable qw( dclone ); >- >+use HTML::Entities; > use autouse 'Data::Dumper' => qw(Dumper); > > use C4::Context; >@@ -345,8 +345,8 @@ sub get_label_summary { > $record->{'title'} =~ s/\W*$//; # strip off ugly trailing chars > # FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code > # should not know that it's part of a web app >- $record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . $record->{'biblionumber'} . '"> ' . $record->{'title'} . '</a>'; >- $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A'); >+ $record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . HTML::Entities::encode($record->{'biblionumber'}) . '"> ' . HTML::Entities::encode($record->{'title'}) . '</a>'; >+ $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? HTML::Entities::encode($record->{'author'}) : 'N/A'); > $label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'}; > $label_summary->{'_barcode'} = $record->{'barcode'}; > $label_summary->{'_item_number'} = $item->{'item_number'}; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >index 15acdb833e..89e08fe287 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >@@ -176,8 +176,10 @@ > <td> > [% IF ( text_field.field_name == '_item_type_tbl' ) %] > [% ItemTypes.GetDescription( text_field.field_value ) | html %] >- [% ELSE %] >+ [% ELSIF ( text_field.field_name == '_summary_tbl' ) %] > [% text_field.field_value | $raw %] >+ [% ELSE %] >+ [% text_field.field_value | html %] > [% END %] > </td> > [% END %] >-- >2.39.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 37720
:
170675
|
170676
|
170691
|
170801
|
170851
|
170852
|
171565
|
172239