Attachment 48646 Details for Bug 15111 – Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks

[patch] Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks

Bug-15111---Koha-is-vulnerable-to-Cross-Frame-Scri.patch (text/plain), 4.33 KB, created by Chris Cormack on 2016-03-03 19:20:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2016-03-03 19:20:14 UTC

Size: 4.33 KB

patch

obsolete

>From 36f5d1f62d6ced42f3da2a3ad090f63b5f5c53ff Mon Sep 17 00:00:00 2001
>From: Kyle M Hall <kyle@bywatersolutions.com>
>Date: Mon, 2 Nov 2015 12:11:17 -0500
>Subject: [PATCH] Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS)
> attacks
>
>Web pages that can be embedded in frames are vulnerable to cross-frame
>scripting attacks. Cross-frame scripting is a type of phishing attack
>that involves instructions to an unsuspecting user to follow a specific
>link to update confidential information in an online application.
>Because the link leads to a legitimate page from the online application
>that is embedded in a frame hosted by the attackers' server, the
>attackers can capture all the information that the user enters.
>
>https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>---
> C4/Output.pm                                                 | 11 ++++++-----
> koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc  | 12 ++++++++++++
> koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc | 12 ++++++++++++
> 3 files changed, 30 insertions(+), 5 deletions(-)
>
>diff --git a/C4/Output.pm b/C4/Output.pm
>index 3ae4c6c..0527d654 100644
>--- a/C4/Output.pm
>+++ b/C4/Output.pm
>@@ -264,11 +264,12 @@ sub output_with_http_headers {
>     my $cache_policy = 'no-cache';
>     $cache_policy .= ', no-store, max-age=0' if $extra_options->{force_no_caching};
>     my $options = {
>-        type    => $content_type_map{$content_type},
>-        status  => $status,
>-        charset => 'UTF-8',
>-        Pragma          => 'no-cache',
>-        'Cache-Control' => $cache_policy,
>+        type              => $content_type_map{$content_type},
>+        status            => $status,
>+        charset           => 'UTF-8',
>+        Pragma            => 'no-cache',
>+        'Cache-Control'   => $cache_policy,
>+        'X-Frame-Options' => 'DENY',
>     };
>     $options->{expires} = 'now' if $extra_options->{force_no_caching};
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>index b47e9dd..1c19892 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
>@@ -2,6 +2,18 @@
> [% USE AudioAlerts %]
> [% USE String %]
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
>+
>+[%# Prevent XFS attacks -%]
>+<style id="antiClickjack">body{display:none !important;}</style>
>+<script type="text/javascript">
>+   if (self === top) {
>+       var antiClickjack = document.getElementById("antiClickjack");
>+       antiClickjack.parentNode.removeChild(antiClickjack);
>+   } else {
>+       top.location = self.location;
>+   }
>+</script>
>+
> <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
> 
> <link rel="stylesheet" type="text/css" href="[% interface %]/lib/jquery/jquery-ui.css" />
>diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>index e346689..0fa238b 100644
>--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
>@@ -1,6 +1,18 @@
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
> <meta name="generator" content="Koha [% Version %]" /> 
> <meta name="viewport" content="width=device-width, initial-scale=1" />
>+
>+[%# Prevent XFS attacks -%]
>+<style id="antiClickjack">body{display:none !important;}</style>
>+<script type="text/javascript">
>+   if (self === top) {
>+       var antiClickjack = document.getElementById("antiClickjack");
>+       antiClickjack.parentNode.removeChild(antiClickjack);
>+   } else {
>+       top.location = self.location;
>+   }
>+</script>
>+
> <link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
> [% IF ( bidi ) %]
>     <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/lib/bootstrap/css/bootstrap-rtl.min.css" />
>-- 
>2.7.0

Actions: View | Diff | Splinter Review

Attachments on bug 15111: 44289 | 44339 | 44622 | 44828 | 45444 | 48265 | 48440 | 48441 | 48442 | 48646 | 48647 | 48648