From e2fd8bcd02d2dc021595ece6ef2a15111323703f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 27 Jan 2025 09:56:10 +0100 Subject: [PATCH] [22.11] Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC Signed-off-by: Baptiste Wojtkowski Signed-off-by: David Cook Signed-off-by: wainuiwitikapark --- koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js | 2 +- opac/opac-tags.pl | 7 ++++--- tags/review.pl | 3 ++- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js index d1588f6a86..360ae292b2 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js +++ b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js @@ -148,7 +148,7 @@ $(document).ready(function() { $(event.target).text( __("Testing...") ).prop('disabled', true); $.ajax(Object.assign({}, review_ajax_params, { data: { - test: $('#test').val() + test: escape_str($("#test").val()) }, success: success_test_call // success_reject })); diff --git a/opac/opac-tags.pl b/opac/opac-tags.pl index 43f156d31b..5a1f462e0b 100755 --- a/opac/opac-tags.pl +++ b/opac/opac-tags.pl @@ -196,7 +196,8 @@ if ($is_ajax) { my $i = 1; foreach (@errors) { my $key = (keys %$_)[0]; - $err_string .= "\n\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")'; + ( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g; + $err_string .= sprintf qq{\n\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped; if($i < scalar @errors){ $err_string .= ","; } $i++; } @@ -213,7 +214,8 @@ if ($is_ajax) { foreach (@{$bibResult->{errors}}) { $js_bibres .= "," if ($i); my $key = (keys %$_)[0]; - $js_bibres .= "\n\t\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")'; + ( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g; + $js_bibres .= sprintf qq{\n\t\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped; $i++; } $js_bibres .= "\n\t\t]\n\t}"; @@ -374,4 +376,3 @@ response = { }; =cut - diff --git a/tags/review.pl b/tags/review.pl index c2c97c8117..043b132888 100755 --- a/tags/review.pl +++ b/tags/review.pl @@ -23,7 +23,7 @@ use Modern::Perl; use POSIX qw( ceil ); use CGI qw ( -utf8 ); use CGI::Cookie; # need to check cookies before having CGI parse the POST request -use URI::Escape qw( uri_escape_utf8 ); +use URI::Escape qw( uri_escape_utf8 uri_unescape ); use C4::Auth qw( check_cookie_auth get_template_and_user ); use C4::Context; use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers ); @@ -58,6 +58,7 @@ if (is_ajax()) { my $operator = C4::Context->userenv->{'number'}; # must occur AFTER auth my ($tag, $js_reply); if ($tag = $input->param('test')) { + $tag = uri_unescape($tag); my $check = is_approved($tag); $js_reply = ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) . "_test('".uri_escape_utf8($tag)."');\n"; } -- 2.49.0