Attachment 66065 Details for Bug 19100 – Bug 19100 - XSS Flaws in memberentry.pl

[patch] Bug 19100 - XSS Flaws in memberentry.pl

Bug-19100---XSS-Flaws-in-memberentrypl.patch (text/plain), 1.80 KB, created by Marcel de Rooy on 2017-08-16 11:29:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2017-08-16 11:29:29 UTC

Size: 1.80 KB

patch

obsolete

>From b6a95948c515138059f027466eb680b4d46ec0ba Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Tue, 15 Aug 2017 23:22:32 +0530
>Subject: [PATCH] Bug 19100 - XSS Flaws in memberentry.pl
>Content-Type: text/plain; charset=utf-8
>
>1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
>   xx - is a guarantorid
>2. Notice the java script is executed.
>3. Apply patch.
>4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
>   xx - is a guarantorid.
>5. Notice it is no longer executed.
>
>NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.
>
>Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>index 7f6f734..af75832 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
>@@ -413,7 +413,7 @@ $(document).ready(function() {
>  [% ELSE %]
>  <li id="contact-details" style="display: none">
>  [% END %]
>-     <span class="label">Patron #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid %]</a>[% END %]
>+     <span class="label">Patron #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid |html %]</a>[% END %]
>  </li>
>         [% UNLESS nocontactname %]
>  <li>
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 19100: 65971 | 66033 | 66035 | 66065