Bugzilla – Attachment 40340 Details for
Bug 14416
Stored XSS flaw affects OPAC and Staff interface
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14416 : Stored XSS vulnerability
Bug-14416--Stored-XSS-vulnerability.patch (text/plain), 2.05 KB, created by
Chris Cormack
on 2015-06-18 23:03:55 UTC
(
hide
)
Description:
Bug 14416 : Stored XSS vulnerability
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2015-06-18 23:03:55 UTC
Size:
2.05 KB
patch
obsolete
>From 57e7d098c87c08adc93cfa8f98825ed224e75d8f Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Fri, 19 Jun 2015 10:54:40 +1200 >Subject: [PATCH] Bug 14416 : Stored XSS vulnerability > >The affected page in the OPAC client is: >http://testbox:9001/cgi-bin/koha/opac-shelves.pl >the vulnerable parameter: addshelf > >The affected page in the STAFF client is: >http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl > >To test: >1/ Create a shelf in the opac that contains some malicious js > eg Bad stuff <script>alert('oh noes');</script> as the name >2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client > Note the js is executed >3/ View >http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 > Notice the html is not escaped >4/ Apply patch >5/ View >http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 > Notice the html is now escaped >6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit >--- > .../prog/en/modules/virtualshelves/tables/shelves_results.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >index e6909d6..65a7459 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >@@ -9,7 +9,7 @@ > "dt_type": > "[% data.type %]", > "dt_shelfname": >- "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?viewshelf=[% data.shelfnumber %]'>[% data.shelfname %]</a>", >+ "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?viewshelf=[% data.shelfnumber %]'>[% data.shelfname | html%]</a>", > "dt_count": > "[% data.count %] item(s)", > "dt_owner": >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14416
:
40333
|
40340
|
40341
|
40353
|
40354
|
40355
|
40356
|
40370
|
40371
|
40372
|
40373