Bugzilla – Attachment 66045 Details for
Bug 19121
Prevent XSS in the Staff Client and the OPAC - bis
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 19121: [PoC] Prevent XSS - Escape variables when sent to scripts
Bug-19121-PoC-Prevent-XSS---Escape-variables-when-.patch (text/plain), 1.81 KB, created by
Jonathan Druart
on 2017-08-15 19:24:31 UTC
(
hide
)
Description:
Bug 19121: [PoC] Prevent XSS - Escape variables when sent to scripts
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2017-08-15 19:24:31 UTC
Size:
1.81 KB
patch
obsolete
>From bd06f263fcd9ba178ad0cf866dbf4b27884e868f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Tue, 15 Aug 2017 16:21:48 -0300 >Subject: [PATCH] Bug 19121: [PoC] Prevent XSS - Escape variables when sent to > scripts > >We will need to adapt Koha::CGI->param to work in list context (even >if it is considered bad), and explicitely call ->param_raw when we do >not want the escape to be done. >--- > Koha/CGI.pm | 31 +++++++++++++++++++++++++++++++ > members/moremember.pl | 3 ++- > 2 files changed, 33 insertions(+), 1 deletion(-) > create mode 100644 Koha/CGI.pm > >diff --git a/Koha/CGI.pm b/Koha/CGI.pm >new file mode 100644 >index 0000000000..327331f426 >--- /dev/null >+++ b/Koha/CGI.pm >@@ -0,0 +1,31 @@ >+package Koha::CGI; >+ >+use Modern::Perl; >+use base qw( CGI ); >+ >+sub param { >+ my ( $self, $params ) = @_; >+ my $value = $self->SUPER::param($params); >+ return unless $value; >+ return $self->_escape($value); >+} >+ >+sub param_raw { >+ my ( $self, $params ) = @_; >+ return $self->SUPER::param($params); >+} >+ >+# Picked from Template::Stash::AutoEscaping::Escaped::HTML >+sub _escape { >+ my ( $self, $text ) = @_; >+ for ($text) { >+ s/&/&/g; >+ s/</</g; >+ s/>/>/g; >+ s/"/"/g; >+ s/'/'/g; >+ } >+ return $text; >+} >+ >+1; >diff --git a/members/moremember.pl b/members/moremember.pl >index b70a068150..972cc52b70 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -36,6 +36,7 @@ > use strict; > #use warnings; FIXME - Bug 2505 > use CGI qw ( -utf8 ); >+use Koha::CGI; > use C4::Context; > use C4::Auth; > use C4::Output; >@@ -75,7 +76,7 @@ BEGIN { > > my $dbh = C4::Context->dbh; > >-my $input = CGI->new; >+my $input = Koha::CGI->new; > $debug or $debug = $input->param('debug') || 0; > my $print = $input->param('print'); > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 19121
:
66045