Summary: | Potential XSS attack vector in opac rss feed | ||
---|---|---|---|
Product: | Koha | Reporter: | Chris Cormack <chris> |
Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P5 - low | CC: | arunet, fridolin.somers, gmcharlt, martin.renvoize, mtompset, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 11307 : Potential XSS attack in rss feed
Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) Bug 11307 : Potential XSS attack in rss feed Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) [PASSED QA] Bug 11307 : Potential XSS attack in rss feed [PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) |
Description
Chris Cormack
2013-11-26 16:37:20 UTC
Created attachment 23164 [details] [review] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Created attachment 23167 [details] [review] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Created attachment 23169 [details] [review] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Created attachment 23170 [details] [review] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Tested according to test plan given in comment #1 for prog and bootstrap themes. Created attachment 23175 [details] [review] [PASSED QA] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 23176 [details] [review] [PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> All works as expected, passes QA script. Pushed to master and 3.14.x. Thanks, Chris! Patches will be in 3.14.1 This patch has been pushed to 3.12.x, will be in 3.12.8. Thanks Chris! |