| Summary: | checkexpiration.pl is vulnerable to XSS attacks | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | Serials | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | brendan, chris, colin.campbell, f.demians, julian.maurice, kyle, m.de.rooy |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 14568 | ||
| Attachments: |
Bug 17026: Fix XSS in serials/checkexpiration.pl
Bug 17026: Fix XSS in serials/checkexpiration.pl [PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl |
||
|
Description
Jonathan Druart
2016-08-02 14:11:04 UTC
Created attachment 53912 [details] [review] Bug 17026: Fix XSS in serials/checkexpiration.pl Test plan: Hit: /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002 => Without this patch you will see the alert => With this patch, no more alert Created attachment 53931 [details] [review] Bug 17026: Fix XSS in serials/checkexpiration.pl Test plan: Hit: /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002 => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Created attachment 53978 [details] [review] [PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl Test plan: Hit: /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002 => Without this patch you will see the alert => With this patch, no more alert Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to Master - Should be in the November 2016 release. Thanks! Pushed in 16.05. Will be in 16.05.03. Pushed to 3.20.x will be in 3.20.14 Patches pushed to 3.22.x, will be in 3.22.10 |