Bug 16597

Summary: Reflected XSS in [opac-]shelves and [opac-]shareshelf
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P5 - low CC: brendan, f.demians, fridolin.somers, julian.maurice, jweaver, katrin.fischer, kyle, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16587
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 16597: Fix XSS in opac-shelves.pl
Bug 16597: Fix XSS in opac-shareshelf
Bug 16597: Fix XSS in shelves.pl
Bug 16597: Fix XSS in opac-shelves.pl
Bug 16597: Fix XSS in opac-shareshelf
Bug 16597: Fix XSS in shelves.pl
Bug 16597: Fix XSS in opac-shelves.pl
Bug 16597: Fix XSS in opac-shareshelf
Bug 16597: Fix XSS in shelves.pl

Description Jonathan Druart 2016-05-26 10:03:17 UTC

    
Comment 1 Jonathan Druart 2016-05-26 10:05:40 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-05-26 10:05:44 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2016-05-26 10:09:00 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2016-05-27 08:31:25 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2016-05-27 08:31:41 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2016-05-27 08:32:00 UTC Comment hidden (obsolete)
Comment 7 Marcel de Rooy 2016-05-27 10:14:40 UTC
Created attachment 51869 [details] [review]
Bug 16597: Fix XSS in opac-shelves.pl

To test
1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT>
2/ Notice JS is executed
3/ Apply patch
4/ Notice it's fixed

This bug reported by

Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Marcel de Rooy 2016-05-27 10:14:44 UTC
Created attachment 51870 [details] [review]
Bug 16597: Fix XSS in opac-shareshelf

To test
1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5
2/ Notice you see a js alert
3/ Apply patch
4/ It is gone

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Marcel de Rooy 2016-05-27 10:14:48 UTC
Created attachment 51871 [details] [review]
Bug 16597: Fix XSS in shelves.pl

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Brendan Gallagher 2016-05-30 11:14:53 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks
Comment 11 Chris Cormack 2016-06-21 20:52:41 UTC
Pushed to 3.20.x will be in 3.20.11, is in 3.22.7
Comment 12 Julian Maurice 2016-06-24 10:05:53 UTC
(In reply to Chris Cormack from comment #11)
> is in 3.22.7
No, but it will be in 3.22.8