Bugzilla – Attachment 121258 Details for
Bug 20982
opac-shelves.pl vulnerable to Cross-site scripting attacks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
Bug-20982-Sanitize-category-to-prevent-XSS-on-opac.patch (text/plain), 1.82 KB, created by
Victor Grousset/tuxayo
on 2021-05-20 19:17:49 UTC
(
hide
)
Description:
Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
Filename:
MIME Type:
Creator:
Victor Grousset/tuxayo
Created:
2021-05-20 19:17:49 UTC
Size:
1.82 KB
patch
obsolete
>From 704fd5ac8209219a38d2041d23a7a179d0b05a6d Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 20 May 2021 08:34:48 +0200 >Subject: [PATCH] Bug 20982: Sanitize category to prevent XSS on > opac-shelves.pl > >== Test plan == >1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() >2. Note that you are redirected to another website >3. Apply the patch & restart services >4. Repeat the above and you are not redirected > >Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> >--- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 2 +- > opac/opac-shelves.pl | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >index 3bdb18b641..55f13358e3 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >@@ -1096,7 +1096,7 @@ function AdjustRemark() { > if( $("#category").length > 0 ) { > category = $("#category").val(); > } else { >- category = [% category | html %]; >+ category = "[% category | html %]"; > } > var perms = $("#allow_changes_from").val(); > >diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl >index b94b4126ea..483876188e 100755 >--- a/opac/opac-shelves.pl >+++ b/opac/opac-shelves.pl >@@ -434,7 +434,7 @@ $template->param( > referer => $referer, > shelf => $shelf, > messages => \@messages, >- category => $category, >+ category => ($category == 1 || $category == 2) ? $category : "", > print => scalar $query->param('print') || 0, > listsview => 1, > ); >-- >2.31.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 20982
:
121209
|
121258
|
121264
|
121266