Summary: | opac-imageviewer.pl is vulnerable to XSS | ||
---|---|---|---|
Product: | Koha | Reporter: | Chris Cormack <chris> |
Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P5 - low | CC: | arunet, brendan, f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16691 | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 16958: Fix XSS in opac-imageviewer.pl
Bug 16958: Fix XSS in opac-imageviewer.pl Bug 16958: Fix XSS in opac-imageviewer.pl |
Description
Chris Cormack
2016-07-22 06:25:15 UTC
Working on this now Created attachment 53622 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it Created attachment 53633 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 53640 [details] [review] Bug 16958: Fix XSS in opac-imageviewer.pl Test plan: Trigger /opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT> => Without this patch you will see the JS alert => With this patch applied you won't see it Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 16.11, thanks Jonathan! Pushed in 16.05. Will be in 16.05.02. Pushed to 3.20.x will be in 3.20.14 Patch pushed to 3.22.x, will be in 3.22.10 |