Summary: | OPAC XSS - biblionumber | ||
---|---|---|---|
Product: | Koha | Reporter: | huracaniki <huracaniki> |
Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P5 - low | CC: | amitddng135, fridolin.somers, jonathan.druart, katrin.fischer, m.de.rooy, mtj, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: |
Bug 18726: Fix XSS at the OPAC - biblionumber
The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Bug 18726: Fix XSS at the OPAC - biblionumber |
Description
huracaniki
2017-06-04 17:47:16 UTC
Created attachment 65772 [details] [review] Bug 18726: Fix XSS at the OPAC - biblionumber The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Created attachment 65784 [details] [review] The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Work OK. Fixes: Cross-site scripting OPAC pages opac-reserve.pl?biblionumber=23%3Cscript%3Ealert(1)%3C/script%3E Can't call method "field" on an undefined value at C4/Items.pm line 1211. Crashes opac-detail.pl?biblionumber=23<script>alert(1)</script>&query_desc=kw%2Cwrdl%3A perl Argument "23<script>..." isn't numeric in int at opac/opac-detail.pl line 80. Warns Created attachment 65873 [details] [review] Bug 18726: Fix XSS at the OPAC - biblionumber The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS. Fixes: Cross-site scripting OPAC pages Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, is in 17.05.03 This patch has been pushed to 16.11.x and is in 16.11.11. Pushed to 16.05.x, for 16.05.16 release |