Bugzilla – Attachment 40370 Details for
Bug 14416
Stored XSS flaw affects OPAC and Staff interface
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 14416 : Stored XSS vulnerability
PASSED-QA-Bug-14416--Stored-XSS-vulnerability.patch (text/plain), 2.18 KB, created by
Katrin Fischer
on 2015-06-19 13:27:26 UTC
(
hide
)
Description:
[PASSED QA] Bug 14416 : Stored XSS vulnerability
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2015-06-19 13:27:26 UTC
Size:
2.18 KB
patch
obsolete
>From e41e8f8872a39781bb2fd1bcf2cd96a6faa7be00 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Fri, 19 Jun 2015 10:54:40 +1200 >Subject: [PATCH] [PASSED QA] Bug 14416 : Stored XSS vulnerability > >The affected page in the OPAC client is: >http://testbox:9001/cgi-bin/koha/opac-shelves.pl >the vulnerable parameter: addshelf > >The affected page in the STAFF client is: >http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl > >To test: >1/ Create a shelf in the opac that contains some malicious js > eg Bad stuff <script>alert('oh noes');</script> as the name >2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client > Note the js is executed >3/ View >http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 > Notice the html is not escaped >4/ Apply patch >5/ View >http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 > Notice the html is now escaped >6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit > >Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> >Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> >--- > .../prog/en/modules/virtualshelves/tables/shelves_results.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >index e6909d6..65a7459 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt >@@ -9,7 +9,7 @@ > "dt_type": > "[% data.type %]", > "dt_shelfname": >- "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?viewshelf=[% data.shelfnumber %]'>[% data.shelfname %]</a>", >+ "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?viewshelf=[% data.shelfnumber %]'>[% data.shelfname | html%]</a>", > "dt_count": > "[% data.count %] item(s)", > "dt_owner": >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14416
:
40333
|
40340
|
40341
|
40353
|
40354
|
40355
|
40356
| 40370 |
40371
|
40372
|
40373