Bug 16958

Summary: opac-imageviewer.pl is vulnerable to XSS
Product: Koha Reporter: Chris Cormack <chris>
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: arunet, brendan, f.demians, jonathan.druart, julian.maurice, katrin.fischer, kyle, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16691
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 16958: Fix XSS in opac-imageviewer.pl
Bug 16958: Fix XSS in opac-imageviewer.pl
Bug 16958: Fix XSS in opac-imageviewer.pl

Description Chris Cormack 2016-07-22 06:25:15 UTC
/cgi­-bin/koha/opac-­imageviewer.pl?biblionumber=14&imagenumber=7%22%3e%3c%73%43%72%49%70%54%3e%61%6c%65%72%74%28%38%31%38%34%32%29%3c%2f%73%43%72%49%70%54%3e
Comment 1 Chris Cormack 2016-07-22 07:10:19 UTC
Working on this now
Comment 2 Jonathan Druart 2016-07-22 07:17:41 UTC Comment hidden (obsolete)
Comment 3 Chris Cormack 2016-07-22 07:36:37 UTC Comment hidden (obsolete)
Comment 4 Marcel de Rooy 2016-07-22 09:21:40 UTC
Created attachment 53640 [details] [review]
Bug 16958: Fix XSS in opac-imageviewer.pl

Test plan:
Trigger
/opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT>

=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Kyle M Hall 2016-07-22 17:12:07 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 6 Frédéric Demians 2016-08-01 13:44:57 UTC
Pushed in 16.05. Will be in 16.05.02.
Comment 7 Chris Cormack 2016-08-03 20:26:07 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 8 Julian Maurice 2016-08-17 11:46:02 UTC
Patch pushed to 3.22.x, will be in 3.22.10