Attachment 65892 Details for Bug 19052 – Bug 19052 - XSS Flaws in - Invoice search page

[patch] Bug 19052 - XSS Flaws in - Invoice search page

Bug-19052---XSS-Flaws-in---Invoice-search-page.patch (text/plain), 4.56 KB, created by Marcel de Rooy on 2017-08-11 09:28:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-11 09:28:51 UTC

Size: 4.56 KB

patch

obsolete

>From 7f0efc87b7385ac0c6a34b7f9e92e367cb6ed819 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 7 Aug 2017 22:17:14 +0530
>Subject: [PATCH] Bug 19052 - XSS Flaws in - Invoice search page
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/acqui/invoices.pl
>2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> Invoiceno,
>   ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box.
>3. Notice the iframe is executed.
>4. Apply patch.
>5. Reload page, and enter iframe again on Invoiceno,
>   ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box.
>6. Notice it is no longer executed.
>
>Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> .../prog/en/modules/acqui/invoices.tt              | 24 +++++++++++-----------
> 1 file changed, 12 insertions(+), 12 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>index c296e9e..de03894 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
>@@ -210,7 +210,7 @@ $(document).ready(function() {
>           <p>Search was:
>             <ul>
>               [% IF ( invoicenumber ) %]
>-                <li>Invoice no.: [% invoicenumber %]</li>
>+                <li>Invoice no.: [% invoicenumber |html %]</li>
>               [% END %]
>               [% IF booksellerid %]
>                 <li>Vendor: [% suppliername %]</li>
>@@ -248,19 +248,19 @@ $(document).ready(function() {
>                 [% END %]
>               [% END %]
>               [% IF ( isbneanissn ) %]
>-                <li>ISBN/EAN/ISSN: [% isbneanissn %]</li>
>+                <li>ISBN/EAN/ISSN: [% isbneanissn |html %]</li>
>               [% END %]
>               [% IF ( title ) %]
>-                <li>Title: [% title %]</li>
>+                <li>Title: [% title |html %]</li>
>               [% END %]
>               [% IF ( author ) %]
>-                <li>Author: [% author %]</li>
>+                <li>Author: [% author |html %]</li>
>               [% END %]
>               [% IF ( publisher ) %]
>-                <li>Publisher: [% publisher %]</li>
>+                <li>Publisher: [% publisher |html %]</li>
>               [% END %]
>               [% IF ( publicationyear ) %]
>-                <li>Publication year: [% publicationyear %]</li>
>+                <li>Publication year: [% publicationyear |html %]</li>
>               [% END %]
>               [% IF ( branch ) %]
>                 <li>Library: [% Branches.GetName( branch ) %]</li>
>@@ -280,7 +280,7 @@ $(document).ready(function() {
>         <ol>
>           <li>
>             <label for="invoicenumber">Invoice no:</label>
>-            <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber %]" class="focus" />
>+            <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber |html %]" class="focus" />
>           </li>
>           <li>
>             <label for="supplier">Vendor:</label>
>@@ -327,23 +327,23 @@ $(document).ready(function() {
>           </li>
>           <li>
>             <label for="isbneanissn">ISBN / EAN / ISSN:</label>
>-            <input type="text" id="isbneanissn" name="isbneanissn" value="[% isbneanissn %]" />
>+            <input type="text" id="isbneanissn" name="isbneanissn" value="[% isbneanissn |html %]" />
>           </li>
>           <li>
>             <label for="title">Title:</label>
>-            <input type="text" id="title" name="title" value="[% title %]" />
>+            <input type="text" id="title" name="title" value="[% title |html %]" />
>           </li>
>           <li>
>             <label for="author">Author:</label>
>-            <input type="text" id="author" name="author" value="[% author %]" />
>+            <input type="text" id="author" name="author" value="[% author |html %]" />
>           </li>
>           <li>
>             <label for="publisher">Publisher:</label>
>-            <input type="text" id="publisher" name="publisher" value="[% publisher %]" />
>+            <input type="text" id="publisher" name="publisher" value="[% publisher |html %]" />
>           </li>
>           <li>
>             <label for="publicationyear">Publication year:</label>
>-            <input type="text" id="publicationyear" name="publicationyear" value="[% publicationyear %]" />
>+            <input type="text" id="publicationyear" name="publicationyear" value="[% publicationyear |html %]" />
>           </li>
>           <li>
>             <label for="branch">Library:</label>
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19052: 65586 | 65587 | 65601 | 65602 | 65891 | 65892