Summary: | XSS attack vector in facets in OPAC - prog theme | ||
---|---|---|---|
Product: | Koha | Reporter: | Chris Cormack <chris> |
Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P5 - low | CC: | fridolin.somers, gmcharlt, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 11341 : XSS in opac-search.pl (facets)
Bug 11341 : XSS in opac-search.pl (facets) [PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets) |
Description
Chris Cormack
2013-12-04 21:12:58 UTC
Created attachment 23311 [details] [review] Bug 11341 : XSS in opac-search.pl (facets) prog theme, bootstrap theme is safe To test 1/ Craft a url like cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d" (the search must return enough results to have a show more link in the facets) 2/ Check the source, or mouseover the Show more links in the facets Notice the code is executable 3/ Apply patch - notice it is no longer executable Created attachment 23312 [details] [review] Bug 11341 : XSS in opac-search.pl (facets) prog theme, bootstrap theme is safe To test 1/ Craft a url like cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d" (the search must return enough results to have a show more link in the facets) 2/ Check the source, or mouseover the Show more links in the facets Notice the code is executable 3/ Apply patch - notice it is no longer executable Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Created attachment 23313 [details] [review] [PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets) prog theme, bootstrap theme is safe To test 1/ Craft a url like cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d" (the search must return enough results to have a show more link in the facets) 2/ Check the source, or mouseover the Show more links in the facets Notice the code is executable 3/ Apply patch - notice it is no longer executable Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> Pushed to master. Thanks, Chris! This patch has been pushed to 3.14.x, will be in 3.14.1 This patch has been pushed to 3.12.x, will be in 3.12.8. Thanks Chris! |