Bugzilla – Attachment 89002 Details for
Bug 22478
Cross-site scripting vulnerability in paginations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22478: Prevent XSS vulnerabilities when pagination appears
Bug-22478-Prevent-XSS-vulnerabilities-when-paginat.patch (text/plain), 1.82 KB, created by
Martin Renvoize (ashimema)
on 2019-04-29 09:33:42 UTC
(
hide
)
Description:
Bug 22478: Prevent XSS vulnerabilities when pagination appears
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2019-04-29 09:33:42 UTC
Size:
1.82 KB
patch
obsolete
>From 1c3ca7f80495548d7472baef901eb136555018a7 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 14 Mar 2019 19:42:50 -0300 >Subject: [PATCH] Bug 22478: Prevent XSS vulnerabilities when pagination > appears > >This is a bad one as we thought we were XSS safe since bug 13618. > >The html code generated in C4::Output::pagination_bar must escape the >variables and values correctly. > >This patch needs to be widely tested, everywhere the pagination appears, >to make sure we will not introduce regressions. > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Output.pm | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > >diff --git a/C4/Output.pm b/C4/Output.pm >index 71f82e8a87..e8a86cc5ed 100644 >--- a/C4/Output.pm >+++ b/C4/Output.pm >@@ -29,6 +29,7 @@ use strict; > #use warnings; FIXME - Bug 2505 > > use URI::Escape; >+use Scalar::Util qw( looks_like_number ); > > use C4::Context; > use C4::Templates; >@@ -89,6 +90,9 @@ sub pagination_bar { > my $startfrom_name = (@_) ? shift : 'page'; > my $additional_parameters = shift || {}; > >+ $current_page = looks_like_number($current_page) ? $current_page : undef; >+ $nb_pages = looks_like_number($nb_pages) ? $nb_pages : undef; >+ > # how many pages to show before and after the current page? > my $pages_around = 2; > >@@ -106,7 +110,7 @@ sub pagination_bar { > my $url = $base_url . (($base_url =~ m/$delim/ or $base_url =~ m/\?/) ? '&' : '?' ) . $startfrom_name . '='; > my $url_suffix; > while ( my ( $k, $v ) = each %$additional_parameters ) { >- $url_suffix .= '&' . $k . '=' . $v; >+ $url_suffix .= '&' . URI::Escape::uri_escape_utf8($k) . '=' . URI::Escape::uri_escape_utf8($v); > } > my $pagination_bar = ''; > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22478
:
86636
|
86683
|
87697
|
87698
|
87699
|
87700
|
87701
|
87841
|
87842
|
87843
|
87844
|
88937
|
88954
| 89002 |
89003
|
89004
|
89005
|
89006
|
89009
|
89453