From d39b574acf4cf73f52aad9c63d7475be9f608ff1 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Tue, 3 Dec 2013 12:01:23 +1300 Subject: [PATCH] Bug 11322 : XSS - Scrub bad data before storing suggestions in the db 1/ In the public interface, add a suggestion containing html 2/ Save, notice the html is rendered (or if you have the other patches is displayed) 3/ Apply this paget 4/ Add another suggestion 5/ Notice the html is stripped Signed-off-by: David Cook Works as described. --- opac/opac-suggestions.pl | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/opac/opac-suggestions.pl b/opac/opac-suggestions.pl index 32b5c3d..72383eb 100755 --- a/opac/opac-suggestions.pl +++ b/opac/opac-suggestions.pl @@ -27,6 +27,7 @@ use C4::Output; use C4::Suggestions; use C4::Koha; use C4::Dates; +use C4::Scrubber; my $input = new CGI; my $allsuggestions = $input->param('showall'); @@ -77,8 +78,13 @@ if ( $op eq "add_confirm" ) { #some suggestion are answering the request Donot Add } else { + my $scrubber = C4::Scrubber->new(); + foreach my $suggest (keys %$suggestion){ + $suggestion->{$suggest} = $scrubber->scrub($suggestion->{$suggest}); + } $$suggestion{'suggesteddate'}=C4::Dates->today; $$suggestion{'branchcode'}= $input->param('branch') || C4::Context->userenv->{"branch"}; + &NewSuggestion($suggestion); # empty fields, to avoid filter in "SearchSuggestion" $$suggestion{$_}='' foreach qw; -- 1.7.7.4