Bug 11535

Summary: Patron self-registration form does not sanitize its input
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: OPACAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: fridolin.somers, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 11535: sanitize input from patron self-registration form
Bug 11535: sanitize input from patron self-registration form
[PASSED QA] Bug 11535: sanitize input from patron self-registration form

Description Galen Charlton 2014-01-13 21:49:52 UTC
The OPAC patron self-registration form does not sanitize its input, thereby allowing rude folks to inject unwanted JavaScript in the staff interface.  This is annoying.
Comment 1 Galen Charlton 2014-01-13 22:04:03 UTC Comment hidden (obsolete)
Comment 2 Liz Rea 2014-01-13 23:18:03 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-01-14 05:52:03 UTC
Created attachment 24267 [details] [review]
[PASSED QA] Bug 11535: sanitize input from patron self-registration form

This patch adds the use of C4::Scrubber to the processing of input
from the patron self-registration form, thereby closing off one
avenue for Javascript injection.

To test:

[1] Use the OPAC self-registration form to enter a new patron,
    and set its address to something like:

    <span style="color: red;">BAD</span>

[2] In the staff interface, bring up the new patron record.  The
    address will show up in red, indicating a successful HTML
    injection.
[3] Apply the patch and use self-registration to enter a new
    patron with a similar case of unwanted HTML coding.
[4] Bring up the second patron in the staff interface.  This time,
    the undesirable HTML tag should not be present.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tags are not present on testing.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and that the patch fixes it.
Passes all tests and QA script.
Comment 4 Galen Charlton 2014-01-14 16:36:11 UTC
Pushed to master.
Comment 5 Fridolin Somers 2014-01-14 17:03:17 UTC
Patch pushed to 3.14.x, will be in 3.14.2.
Comment 6 Tomás Cohen Arazi 2014-01-15 14:56:55 UTC
This patch has been pushed to 3.12.x, will be in 3.12.9.

Thanks Galen!