| Summary: | Patron self-registration form does not sanitize its input | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Galen Charlton <gmcharlt> |
| Component: | OPAC | Assignee: | Galen Charlton <gmcharlt> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | fridolin.somers, tomascohen |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 11535: sanitize input from patron self-registration form
Bug 11535: sanitize input from patron self-registration form [PASSED QA] Bug 11535: sanitize input from patron self-registration form |
||
|
Description
Galen Charlton
2014-01-13 21:49:52 UTC
Created attachment 24242 [details] [review] Bug 11535: sanitize input from patron self-registration form This patch adds the use of C4::Scrubber to the processing of input from the patron self-registration form, thereby closing off one avenue for Javascript injection. To test: [1] Use the OPAC self-registration form to enter a new patron, and set its address to something like: <span style="color: red;">BAD</span> [2] In the staff interface, bring up the new patron record. The address will show up in red, indicating a successful HTML injection. [3] Apply the patch and use self-registration to enter a new patron with a similar case of unwanted HTML coding. [4] Bring up the second patron in the staff interface. This time, the undesirable HTML tag should not be present. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Created attachment 24247 [details] [review] Bug 11535: sanitize input from patron self-registration form This patch adds the use of C4::Scrubber to the processing of input from the patron self-registration form, thereby closing off one avenue for Javascript injection. To test: [1] Use the OPAC self-registration form to enter a new patron, and set its address to something like: <span style="color: red;">BAD</span> [2] In the staff interface, bring up the new patron record. The address will show up in red, indicating a successful HTML injection. [3] Apply the patch and use self-registration to enter a new patron with a similar case of unwanted HTML coding. [4] Bring up the second patron in the staff interface. This time, the undesirable HTML tag should not be present. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Liz Rea <liz@catalyst.net.nz> Tags are not present on testing. Created attachment 24267 [details] [review] [PASSED QA] Bug 11535: sanitize input from patron self-registration form This patch adds the use of C4::Scrubber to the processing of input from the patron self-registration form, thereby closing off one avenue for Javascript injection. To test: [1] Use the OPAC self-registration form to enter a new patron, and set its address to something like: <span style="color: red;">BAD</span> [2] In the staff interface, bring up the new patron record. The address will show up in red, indicating a successful HTML injection. [3] Apply the patch and use self-registration to enter a new patron with a similar case of unwanted HTML coding. [4] Bring up the second patron in the staff interface. This time, the undesirable HTML tag should not be present. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Liz Rea <liz@catalyst.net.nz> Tags are not present on testing. Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Confirmed bug and that the patch fixes it. Passes all tests and QA script. Pushed to master. Patch pushed to 3.14.x, will be in 3.14.2. This patch has been pushed to 3.12.x, will be in 3.12.9. Thanks Galen! |