From efd526af31031d037ecde203e9980892ad55568f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 27 Jan 2025 09:56:10 +0100 Subject: [PATCH] Bug 38969: Prevent XSS in tags/review.pl Signed-off-by: Baptiste Wojtkowski Signed-off-by: David Cook --- koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js | 2 +- tags/review.pl | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js index 67b68b7dec..4e729755d2 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js +++ b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js @@ -217,7 +217,7 @@ $(document).ready(function () { { ...review_ajax_params, type: "GET" }, { data: { - tag: $("#test").val(), + tag: escape_str($("#test").val()), op: "test", }, success: success_test_call, // success_reject diff --git a/tags/review.pl b/tags/review.pl index 82b82ace28..05f94f69e3 100755 --- a/tags/review.pl +++ b/tags/review.pl @@ -23,7 +23,7 @@ use Modern::Perl; use POSIX qw( ceil ); use CGI qw ( -utf8 ); use CGI::Cookie; # need to check cookies before having CGI parse the POST request -use URI::Escape qw( uri_escape_utf8 ); +use URI::Escape qw( uri_escape_utf8 uri_unescape ); use C4::Auth qw( check_cookie_auth get_template_and_user ); use C4::Context; use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers ); @@ -60,6 +60,7 @@ if ( is_ajax() ) { my $op = $input->param('op') || q{}; my $tag = $input->param('tag'); if ( $op eq 'test' ) { + $tag = uri_unescape($tag); my $check = is_approved($tag); $js_reply = ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) @@ -109,7 +110,7 @@ if ( $op eq 'cud-approve' ) { $template->param( test_term => $tag, ( - $check >= 1 ? 'verdict_ok' + $check >= 1 ? 'verdict_ok' : $check <= -1 ? 'verdict_rej' : 'verdict_indeterminate' ) => 1, -- 2.39.5