Bugzilla – Attachment 65833 Details for
Bug 19079
XSS Flaws in Membership page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19079 - XSS Flaws in Membership page
0001-Bug-19079-XSS-Flaws-in-Membership-page.patch (text/plain), 6.75 KB, created by
Amit Gupta
on 2017-08-10 16:47:00 UTC
(
hide
)
Description:
Bug 19079 - XSS Flaws in Membership page
Filename:
MIME Type:
Creator:
Amit Gupta
Created:
2017-08-10 16:47:00 UTC
Size:
6.75 KB
patch
obsolete
>From 974d1d0c1544a7b72eb407656d8f1844456b97a6 Mon Sep 17 00:00:00 2001 >From: Amit Gupta <amit.gupta@informaticsglobal.com> >Date: Thu, 10 Aug 2017 22:14:11 +0530 >Subject: [PATCH] Bug 19079 - XSS Flaws in Membership page > >1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>. > xx - is a borrowernumber >2. Notice the java script is executed. >4. Apply patch. >5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>. > xx - is a borrowernumber. >6. Notice it is no longer executed. >--- > .../prog/en/includes/members-toolbar.inc | 20 ++++++++++---------- > .../prog/en/modules/members/moremember.tt | 4 ++-- > 2 files changed, 12 insertions(+), 12 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >index 5b467ac..af878d0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc >@@ -60,7 +60,7 @@ $(document).ready(function(){ > return false; > }); > $("#print_overdues").click(function(){ >- window.open("/cgi-bin/koha/members/print_overdues.pl?borrowernumber=[% borrowernumber %]", "printwindow"); >+ window.open("/cgi-bin/koha/members/print_overdues.pl?borrowernumber=[% borrowernumber | url%]", "printwindow"); > $(".btn-group").removeClass("open"); > return false; > }); >@@ -75,32 +75,32 @@ $(document).ready(function(){ > function confirm_local_deletion() { > var is_confirmed = window.confirm(_("Are you sure you want to delete this patron from the local database? This cannot be undone.")); > if (is_confirmed) { >- window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=true&deleteremote=false'; >+ window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber | url%]&deletelocal=true&deleteremote=false'; > } > } > function confirm_remote_deletion() { > var is_confirmed = window.confirm(_("Are you sure you want to delete this patron from the Norwegian national patron database? This cannot be undone.")); > if (is_confirmed) { >- window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=false&deleteremote=true'; >+ window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber |url%]&deletelocal=false&deleteremote=true'; > } > } > function confirm_both_deletion() { > var is_confirmed = window.confirm(_("Are you sure you want to delete this patron both from the local database and from the Norwegian national patron database? This cannot be undone.")); > if (is_confirmed) { >- window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber %]&deletelocal=true&deleteremote=true'; >+ window.location='/cgi-bin/koha/members/deletemem.pl?member=[% borrowernumber | url%]&deletelocal=true&deleteremote=true'; > } > } > > [% IF ( is_child ) %]function confirm_updatechild() { > var is_confirmed = window.confirm(_("Are you sure you want to update this child to an Adult category? This cannot be undone.")); > if (is_confirmed) { >- window.location='/cgi-bin/koha/members/update-child.pl?op=update&borrowernumber=[% borrowernumber %]&catcode=[% catcode %]&catcode_multi=[% CATCODE_MULTI %]'; >+ window.location='/cgi-bin/koha/members/update-child.pl?op=update&borrowernumber=[% borrowernumber | url%]&catcode=[% catcode %]&catcode_multi=[% CATCODE_MULTI %]'; > } > } > > function update_child() { > [% IF ( CATCODE_MULTI ) %] >- window.open('/cgi-bin/koha/members/update-child.pl?op=multi&borrowernumber=[% borrowernumber %]','UpdateChild','width=400,height=300,toolbar=no,scrollbars=yes,resizable=yes'); >+ window.open('/cgi-bin/koha/members/update-child.pl?op=multi&borrowernumber=[% borrowernumber | url%]','UpdateChild','width=400,height=300,toolbar=no,scrollbars=yes,resizable=yes'); > [% ELSE %] > confirm_updatechild(); > [% END %] >@@ -110,22 +110,22 @@ function update_child() { > function confirm_reregistration() { > var is_confirmed = window.confirm(_("Are you sure you want to renew this patron's registration?")); > if (is_confirmed) { >- window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber %]&destination=[% destination %]&reregistration=y'; >+ window.location = '/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% borrowernumber | url%]&destination=[% destination %]&reregistration=y'; > } > } > function export_barcodes() { >- window.open('/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber %]&op=export_barcodes'); >+ window.open('/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber | url%]&op=export_barcodes'); > } > var slip_re = /slip/; > function printx_window(print_type) { > var handler = print_type.match(slip_re) ? "printslip" : "summary-print"; >- window.open("/cgi-bin/koha/members/" + handler + ".pl?borrowernumber=[% borrowernumber %]&print=" + print_type, "printwindow"); >+ window.open("/cgi-bin/koha/members/" + handler + ".pl?borrowernumber=[% borrowernumber | url%]&print=" + print_type, "printwindow"); > return false; > } > function searchToHold(){ > var date = new Date(); > date.setTime(date.getTime() + (10 * 60 * 1000)); >- $.cookie("holdfor", "[% borrowernumber %]", { path: "/", expires: date }); >+ $.cookie("holdfor", "[% borrowernumber | url%]", { path: "/", expires: date }); > location.href="/cgi-bin/koha/catalogue/search.pl"; > } > //]]> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >index 6e5308f..c6f2686 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >@@ -29,7 +29,7 @@ > /* Set some variable needed in circulation.js */ > var interface = "[% interface %]"; > var theme = "[% theme %]"; >-var borrowernumber = "[% borrowernumber %]"; >+var borrowernumber = "[% borrowernumber |html %]"; > var branchcode = "[% Branches.GetLoggedInBranchcode() %]"; > var exports_enabled = "[% Koha.Preference('ExportCircHistory') %]"; > var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 %] >@@ -48,7 +48,7 @@ $(document).ready(function() { > if ( $('#clubs-tab').length ) { > $('#clubs-tab-link').on('click', function() { > $('#clubs-tab').text(_("Loading...")); >- $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]'); >+ $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | url%]'); > }); > } > >-- >1.7.9.5 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19079
:
65833
|
65917
|
65930
|
66031