Summary: | search.pl is vulnerable to XSS attacks | ||
---|---|---|---|
Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
Component: | Searching | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | brendan, chris, f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | |||
Bug Blocks: | 14568 | ||
Attachments: |
Bug 17038: Fix XSS in catalogue/search.pl
Bug 17038: Fix XSS in catalogue/search.pl [PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl |
Description
Jonathan Druart
2016-08-03 13:27:21 UTC
Created attachment 53944 [details] [review] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op Created attachment 53985 [details] [review] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 54111 [details] [review] [PASSED QA] Bug 17038: Fix XSS in catalogue/search.pl Test plan: Search for something like: \";alert(1)//135 => Without this patch you will see the alert => With this patch, no more alert Note that this fix the parameters idx, q and op Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 16.11, thanks Jonathan! Pushed to 3.20.x will be in 3.20.14, leaving as pushed to master for the other rmaints Pushed in 16.05. Will be in 16.05.03. Pushed to 3.22.x, will be in 3.22.10 |