Bugzilla – Attachment 181464 Details for
Bug 38969
Reflected XSS vulnerability in tags
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[22.11] Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC
2211-Bug-38969-Prevent-XSS-in-tagsreviewpl-and-Pre.patch (text/plain), 3.38 KB, created by
Paul Derscheid
on 2025-04-24 15:10:20 UTC
(
hide
)
Description:
[22.11] Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC
Filename:
MIME Type:
Creator:
Paul Derscheid
Created:
2025-04-24 15:10:20 UTC
Size:
3.38 KB
patch
obsolete
>From e2fd8bcd02d2dc021595ece6ef2a15111323703f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 27 Jan 2025 09:56:10 +0100 >Subject: [PATCH] [22.11] Bug 38969: Prevent XSS in tags/review.pl and Prevent > JS error when adding tags with quote at the OPAC > >Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> >Signed-off-by: David Cook <dcook@prosentient.com.au> >Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz> >--- > koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js | 2 +- > opac/opac-tags.pl | 7 ++++--- > tags/review.pl | 3 ++- > 3 files changed, 7 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >index d1588f6a86..360ae292b2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >@@ -148,7 +148,7 @@ $(document).ready(function() { > $(event.target).text( __("Testing...") ).prop('disabled', true); > $.ajax(Object.assign({}, review_ajax_params, { > data: { >- test: $('#test').val() >+ test: escape_str($("#test").val()) > }, > success: success_test_call // success_reject > })); >diff --git a/opac/opac-tags.pl b/opac/opac-tags.pl >index 43f156d31b..5a1f462e0b 100755 >--- a/opac/opac-tags.pl >+++ b/opac/opac-tags.pl >@@ -196,7 +196,8 @@ if ($is_ajax) { > my $i = 1; > foreach (@errors) { > my $key = (keys %$_)[0]; >- $err_string .= "\n\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")'; >+ ( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g; >+ $err_string .= sprintf qq{\n\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped; > if($i < scalar @errors){ $err_string .= ","; } > $i++; > } >@@ -213,7 +214,8 @@ if ($is_ajax) { > foreach (@{$bibResult->{errors}}) { > $js_bibres .= "," if ($i); > my $key = (keys %$_)[0]; >- $js_bibres .= "\n\t\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")'; >+ ( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g; >+ $js_bibres .= sprintf qq{\n\t\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped; > $i++; > } > $js_bibres .= "\n\t\t]\n\t}"; >@@ -374,4 +376,3 @@ response = { > }; > > =cut >- >diff --git a/tags/review.pl b/tags/review.pl >index c2c97c8117..043b132888 100755 >--- a/tags/review.pl >+++ b/tags/review.pl >@@ -23,7 +23,7 @@ use Modern::Perl; > use POSIX qw( ceil ); > use CGI qw ( -utf8 ); > use CGI::Cookie; # need to check cookies before having CGI parse the POST request >-use URI::Escape qw( uri_escape_utf8 ); >+use URI::Escape qw( uri_escape_utf8 uri_unescape ); > use C4::Auth qw( check_cookie_auth get_template_and_user ); > use C4::Context; > use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers ); >@@ -58,6 +58,7 @@ if (is_ajax()) { > my $operator = C4::Context->userenv->{'number'}; # must occur AFTER auth > my ($tag, $js_reply); > if ($tag = $input->param('test')) { >+ $tag = uri_unescape($tag); > my $check = is_approved($tag); > $js_reply = ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) . "_test('".uri_escape_utf8($tag)."');\n"; > } >-- >2.49.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38969
:
177148
|
177159
|
177160
|
179553
|
179554
|
179676
|
179708
|
179709
|
179710
|
181329
|
181330
|
181331
|
181332
| 181464