Bug 17024

Summary: viewlog.pl is vulnerable to XSS attacks
Product: Koha Reporter: Jonathan Druart <jonathan.druart>
Component: ToolsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: brendan, chris, f.demians, jonathan.druart, julian.maurice, katrin.fischer, kyle, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 17024: Fix XSS in tools/viewlog.pl
Bug 17024: Fix XSS in tools/viewlog.pl
[PASSED QA] Bug 17024: Fix XSS in tools/viewlog.pl

Description Jonathan Druart 2016-08-02 14:09:18 UTC
Reported by Dionach.
Comment 1 Jonathan Druart 2016-08-02 14:29:41 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2016-08-03 21:05:38 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-08-03 21:24:35 UTC
Created attachment 53973 [details] [review]
[PASSED QA] Bug 17024: Fix XSS in tools/viewlog.pl

Test plan:
    Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Brendan Gallagher 2016-08-04 18:17:21 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks!
Comment 5 Frédéric Demians 2016-08-05 06:08:59 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 6 Chris Cormack 2016-08-08 07:02:17 UTC
Doesn't apply to 3.20.x
Comment 7 Julian Maurice 2016-08-17 12:39:39 UTC
Patches pushed to 3.22.x, will be in 3.22.10