Attachment 34618 Details for Bug 13425 – Bug 13425 - XSS in intranet facets - Patch for 3.18 and master

[patch] Bug 13425 - XSS in intranet facets - Patch for 3.18 and master

Bug-13425---XSS-in-intranet-facets---Patch-for-318.patch (text/plain), 5.99 KB, created by Chris Cormack on 2014-12-21 20:50:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2014-12-21 20:50:40 UTC

Size: 5.99 KB

patch

obsolete

>From 3dc31846170b9cc2af4934a7ef39d9cc6c0d5c46 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chrisc@catalyst.net.nz>
>Date: Wed, 10 Dec 2014 12:47:30 +1300
>Subject: [PATCH] Bug 13425 - XSS in intranet facets - Patch for 3.18 and
> master
>
>To Test
>1/ Craft a url like /cgi-bin/koha/catalogue/search.pl?q=smith&sort_by='"><script>prompt('Happy_Holidays')</script>
>
>It is important it must return results and facets
>
>2/ Notice the js is executed
>3/ Apply the patch test again
>---
> koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc       | 8 ++++----
> koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc | 6 +++---
> 2 files changed, 7 insertions(+), 7 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>index 97891eb..6a6ba05 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
>@@ -3,7 +3,7 @@
> <div id="search-facets">
> <h4>Refine your search</h4>
> <ul>
>-    <li id="availability_facet">Availability<ul><li>[% IF ( available ) %]Showing only <strong>available</strong> items. <a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi_not_availablity %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %]">Show all items</a>[% ELSE %]Limit to <a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %]&amp;limit=available">currently available items.</a>[% END %]</li></ul>
>+    <li id="availability_facet">Availability<ul><li>[% IF ( available ) %]Showing only <strong>available</strong> items. <a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi_not_availablity %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Show all items</a>[% ELSE %]Limit to <a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]&amp;limit=available">currently available items.</a>[% END %]</li></ul>
> 	[% IF ( related ) %] <li>(related searches: [% FOREACH relate IN related %][% relate.related_search %][% END %])</li>[% END %]
> 	</li>
> 
>@@ -33,10 +33,10 @@
>       [% IF facet.active %]
>         [% SET url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
>         <span class="facet-label">[% facet.facet_label_value %]</span>
>-        [<a href="[% url %]" title="Remove facet [% facet.facet_title_value | html %]">x</a>]
>+        [<a href="[% url |url%]" title="Remove facet [% facet.facet_title_value | html %]">x</a>]
>       [% ELSE %]
>         [% SET url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
>-        <span class="facet-label"><a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
>+        <span class="facet-label"><a href="[% url |url%]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
>         [% IF ( displayFacetCount ) %]
>           <span class="facet-count"> ([% facet.facet_count %])</span>
>         [% END %]
>@@ -44,7 +44,7 @@
>     </li>
>   [% END %]
>   [% IF ( facets_loo.expandable ) %]
>-    <li class="showmore"><a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %][% IF ( offset ) %]&amp;offset=[% offset %][% END %]&amp;expand=[% facets_loo.expand %]#[% facets_loo.type_id %]">Show more</a></li>
>+    <li class="showmore"><a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url%][% END %][% IF ( offset ) %]&amp;offset=[% offset %][% END %]&amp;expand=[% facets_loo.expand %]#[% facets_loo.type_id %]">Show more</a></li>
>   [% END %]
> </ul></li>
> [% END %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc
>index a0f6abb..2992164 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc
>@@ -1,7 +1,7 @@
> [% IF ( PAGE_NUMBERS ) %]<div class="pages">
>     
>-        [% IF ( previous_page_offset.defined ) %]<a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %]">&lt;&lt; Previous</a>[% END %]
>-    [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %]<span class="current">[% PAGE_NUMBER.pg %]</span>[% ELSE %]        <a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %]">[% PAGE_NUMBER.pg %]</a>[% END %]
>+        [% IF ( previous_page_offset.defined ) %]<a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">&lt;&lt; Previous</a>[% END %]
>+    [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %][% IF ( PAGE_NUMBER.highlight ) %]<span class="current">[% PAGE_NUMBER.pg %]</span>[% ELSE %]        <a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">[% PAGE_NUMBER.pg %]</a>[% END %]
>     [% END %]
>-        [% IF ( next_page_offset ) %]<a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by %][% END %]">Next &gt;&gt;</a>[% END %]
>+        [% IF ( next_page_offset ) %]<a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Next &gt;&gt;</a>[% END %]
> </div>[% END %]
>-- 
>2.1.3

Actions: View | Diff | Splinter Review

Attachments on bug 13425: 34255 | 34256 | 34257 | 34258 | 34259 | 34260 | 34261 | 34262 | 34264 | 34265 | 34267 | 34273 | 34389 | 34496 | 34507 | 34603 | 34617 | 34618 | 34619 | 34636