Bug 16599

Summary: XSS found in opac-shareshelf.pl
Product: Koha Reporter: Kaybee <kb1>
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P3 CC: brendan, chris, jonathan.druart, julian.maurice, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: XSS PoC
Bug 16599: Fix XSS in opac-shareshelf.pl
Bug 16599: Fix other potentials XSS for shelfname
Bug 16599: Fix XSS in opac-shareshelf.pl
Bug 16599: Fix other potentials XSS for shelfname
Bug 16599: Fix XSS in opac-shareshelf.pl
Bug 16599: Fix other potentials XSS for shelfname

Description Kaybee 2016-05-26 10:21:08 UTC
Persistent XSS in Koha 3.2203000, you could save a list in your account with a Script tag for e.g. <script>alert(1)</script>, when you click share the list, the alert window appears.
Comment 1 Kaybee 2016-05-26 10:21:47 UTC
Created attachment 51822 [details]
XSS PoC
Comment 2 Kaybee 2016-05-26 10:23:09 UTC
*** Bug 16598 has been marked as a duplicate of this bug. ***
Comment 3 Jonathan Druart 2016-05-26 11:10:33 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2016-05-26 11:10:36 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2016-05-26 11:26:09 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2016-05-26 11:26:37 UTC Comment hidden (obsolete)
Comment 7 Kaybee 2016-05-26 13:05:54 UTC
Also just to advise the vulnerability appears in the 'download list' as well. Save a list as before and click download list.
Comment 8 Kaybee 2016-05-26 13:07:14 UTC
(In reply to Kaybee from comment #7)
> Also just to advise the vulnerability appears in the 'download list' as
> well. Save a list as before and click download list.

May be you have fixed, but I've added it to ensure it's tested correctly.
Comment 9 Jonathan Druart 2016-05-26 13:45:15 UTC
(In reply to Kaybee from comment #8)
> (In reply to Kaybee from comment #7)
> > Also just to advise the vulnerability appears in the 'download list' as
> > well. Save a list as before and click download list.
> 
> May be you have fixed, but I've added it to ensure it's tested correctly.

Yes thanks, it's not explicitly noted in the test plan, but I fixed this one too.
Comment 10 Kaybee 2016-05-27 07:34:18 UTC
Cheers.
Comment 11 Marcel de Rooy 2016-05-27 09:38:08 UTC
Created attachment 51865 [details] [review]
Bug 16599: Fix XSS in opac-shareshelf.pl

Test plan:
- Create a list with the name "<script>alert(1)</script>"
- On the shelf list, click on share
=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Reported by Kaybee at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 12 Marcel de Rooy 2016-05-27 09:38:12 UTC
Created attachment 51866 [details] [review]
Bug 16599: Fix other potentials XSS for shelfname

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Brendan Gallagher 2016-05-30 11:13:41 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks
Comment 14 Chris Cormack 2016-06-21 20:44:59 UTC
Pushed to 3.20.x will be in 3.20.11

(Is in 3.22.7 already)
Comment 15 Julian Maurice 2016-06-24 10:05:34 UTC
(In reply to Chris Cormack from comment #14)
> (Is in 3.22.7 already)

No, but it will be in 3.22.8