Summary: | Reflected XSS in [opac-]shelves and [opac-]shareshelf | ||
---|---|---|---|
Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | normal | ||
Priority: | P5 - low | CC: | brendan, f.demians, fridolin.somers, julian.maurice, jweaver, katrin.fischer, kyle, m.de.rooy |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16587 | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: |
Bug 16597: Fix XSS in opac-shelves.pl
Bug 16597: Fix XSS in opac-shareshelf Bug 16597: Fix XSS in shelves.pl Bug 16597: Fix XSS in opac-shelves.pl Bug 16597: Fix XSS in opac-shareshelf Bug 16597: Fix XSS in shelves.pl Bug 16597: Fix XSS in opac-shelves.pl Bug 16597: Fix XSS in opac-shareshelf Bug 16597: Fix XSS in shelves.pl |
Description
Jonathan Druart
2016-05-26 10:03:17 UTC
Created attachment 51818 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach Created attachment 51819 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Created attachment 51820 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach Created attachment 51858 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 51859 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 51860 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 51869 [details] [review] Bug 16597: Fix XSS in opac-shelves.pl To test 1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT> 2/ Notice JS is executed 3/ Apply patch 4/ Notice it's fixed This bug reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 51870 [details] [review] Bug 16597: Fix XSS in opac-shareshelf To test 1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5 2/ Notice you see a js alert 3/ Apply patch 4/ It is gone Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 51871 [details] [review] Bug 16597: Fix XSS in shelves.pl Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to Master - Should be in the November 2016 release. Thanks Pushed to 3.20.x will be in 3.20.11, is in 3.22.7 (In reply to Chris Cormack from comment #11) > is in 3.22.7 No, but it will be in 3.22.8 |