From 974d1d0c1544a7b72eb407656d8f1844456b97a6 Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Thu, 10 Aug 2017 22:14:11 +0530 Subject: [PATCH] Bug 19079 - XSS Flaws in Membership page 1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx. xx - is a borrowernumber 2. Notice the java script is executed. 4. Apply patch. 5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx. xx - is a borrowernumber. 6. Notice it is no longer executed. --- .../prog/en/includes/members-toolbar.inc | 20 ++++++++++---------- .../prog/en/modules/members/moremember.tt | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc index 5b467ac..af878d0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -60,7 +60,7 @@ $(document).ready(function(){ return false; }); $("#print_overdues").click(function(){ - window.open("/cgi-bin/koha/members/print_overdues.pl?borrowernumber=[% borrowernumber %]", "printwindow"); + window.open("/cgi-bin/koha/members/print_overdues.pl?borrowernumber=[% borrowernumber | url%]", "printwindow"); $(".btn-group").removeClass("open"); return false; }); @@ -75,32 +75,32 @@ $(document).ready(function(){ function confirm_local_deletion() { var is_confirmed = window.confirm(_("Are you sure you want to delete this patron from the local database? This cannot be undone.")); if (is_confirmed) { - window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=true&deleteremote=false'; + window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber | url%]&deletelocal=true&deleteremote=false'; } } function confirm_remote_deletion() { var is_confirmed = window.confirm(_("Are you sure you want to delete this patron from the Norwegian national patron database? This cannot be undone.")); if (is_confirmed) { - window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=false&deleteremote=true'; + window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber |url%]&deletelocal=false&deleteremote=true'; } } function confirm_both_deletion() { var is_confirmed = window.confirm(_("Are you sure you want to delete this patron both from the local database and from the Norwegian national patron database? This cannot be undone.")); if (is_confirmed) { - window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=true&deleteremote=true'; + window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber | url%]&deletelocal=true&deleteremote=true'; } } [% IF ( is_child ) %]function confirm_updatechild() { var is_confirmed = window.confirm(_("Are you sure you want to update this child to an Adult category? This cannot be undone.")); if (is_confirmed) { - window.location='/cgi-bin/koha/members/update-child.pl?op=update&borrowernumber=[% borrowernumber %]&catcode=[% catcode %]&catcode_multi=[% CATCODE_MULTI %]'; + window.location='/cgi-bin/koha/members/update-child.pl?op=update&borrowernumber=[% borrowernumber | url%]&catcode=[% catcode %]&catcode_multi=[% CATCODE_MULTI %]'; } } function update_child() { [% IF ( CATCODE_MULTI ) %] - window.open('/cgi-bin/koha/members/update-child.pl?op=multi&borrowernumber=[% borrowernumber %]','UpdateChild','width=400,height=300,toolbar=no,scrollbars=yes,resizable=yes'); + window.open('/cgi-bin/koha/members/update-child.pl?op=multi&borrowernumber=[% borrowernumber | url%]','UpdateChild','width=400,height=300,toolbar=no,scrollbars=yes,resizable=yes'); [% ELSE %] confirm_updatechild(); [% END %] @@ -110,22 +110,22 @@ function update_child() { function confirm_reregistration() { var is_confirmed = window.confirm(_("Are you sure you want to renew this patron's registration?")); if (is_confirmed) { - window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber %]&destination=[% destination %]&reregistration=y'; + window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber | url%]&destination=[% destination %]&reregistration=y'; } } function export_barcodes() { - window.open('/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber %]&op=export_barcodes'); + window.open('/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber | url%]&op=export_barcodes'); } var slip_re = /slip/; function printx_window(print_type) { var handler = print_type.match(slip_re) ? "printslip" : "summary-print"; - window.open("/cgi-bin/koha/members/" + handler + ".pl?borrowernumber=[% borrowernumber %]&print=" + print_type, "printwindow"); + window.open("/cgi-bin/koha/members/" + handler + ".pl?borrowernumber=[% borrowernumber | url%]&print=" + print_type, "printwindow"); return false; } function searchToHold(){ var date = new Date(); date.setTime(date.getTime() + (10 * 60 * 1000)); - $.cookie("holdfor", "[% borrowernumber %]", { path: "/", expires: date }); + $.cookie("holdfor", "[% borrowernumber | url%]", { path: "/", expires: date }); location.href="/cgi-bin/koha/catalogue/search.pl"; } //]]> diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt index 6e5308f..c6f2686 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ -29,7 +29,7 @@ /* Set some variable needed in circulation.js */ var interface = "[% interface %]"; var theme = "[% theme %]"; -var borrowernumber = "[% borrowernumber %]"; +var borrowernumber = "[% borrowernumber |html %]"; var branchcode = "[% Branches.GetLoggedInBranchcode() %]"; var exports_enabled = "[% Koha.Preference('ExportCircHistory') %]"; var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 %] @@ -48,7 +48,7 @@ $(document).ready(function() { if ( $('#clubs-tab').length ) { $('#clubs-tab-link').on('click', function() { $('#clubs-tab').text(_("Loading...")); - $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]'); + $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | url%]'); }); } -- 1.7.9.5