Attachment 34496 Details for Bug 13425 – Bug 13425 - XSS in intranet facets - Patch for 3.18 and master

[patch] Bug 13425 - XSS in intranet facets - Patch for 3.18 and master

Bug-13425---XSS-in-intranet-facets---Patch-for-318.patch (text/plain), 1.83 KB, created by Chris Cormack on 2014-12-17 20:08:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2014-12-17 20:08:37 UTC

Size: 1.83 KB

patch

obsolete

>From df1c57211e5d8c71f8fdda07072746c32bd51fa0 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Wed, 10 Dec 2014 12:47:30 +1300
>Subject: [PATCH] Bug 13425 - XSS in intranet facets - Patch for 3.18 and
> master
>
>To Test
>1/ Craft a url like /cgi-bin/koha/catalogue/search.pl?q=smith&sort_by='"><script>prompt('Happy_Holidays')</script>
>
>It is important it must return results and facets
>
>2/ Notice the js is executed
>3/ Apply the patch test again
>
>Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
>---
> koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>index 97891eb..4ad36aa 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>@@ -33,10 +33,10 @@
>       [% IF facet.active %]
>         [% SET url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
>         <span class="facet-label">[% facet.facet_label_value %]</span>
>-        [<a href="[% url %]" title="Remove facet [% facet.facet_title_value | html %]">x</a>]
>+        [<a href="[% url |url%]" title="Remove facet [% facet.facet_title_value | html %]">x</a>]
>       [% ELSE %]
>         [% SET url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
>-        <span class="facet-label"><a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
>+        <span class="facet-label"><a href="[% url |url%]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
>         [% IF ( displayFacetCount ) %]
>           <span class="facet-count"> ([% facet.facet_count %])</span>
>         [% END %]
>-- 
>2.1.3

Actions: View | Diff | Splinter Review

Attachments on bug 13425: 34255 | 34256 | 34257 | 34258 | 34259 | 34260 | 34261 | 34262 | 34264 | 34265 | 34267 | 34273 | 34389 | 34496 | 34507 | 34603 | 34617 | 34618 | 34619 | 34636