Bug 18726

Summary: OPAC XSS - biblionumber
Product: Koha Reporter: huracaniki <huracaniki>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amitddng135, fridolin.somers, jonathan.druart, katrin.fischer, m.de.rooy, mtj, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Who signed the patch off: Text to go in the release notes:
Version(s) released in:
Attachments: Bug 18726: Fix XSS at the OPAC - biblionumber
The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS.
Bug 18726: Fix XSS at the OPAC - biblionumber

Description huracaniki 2017-06-04 17:47:16 UTC
Biblionumber parameter could insert an alert message

/cgi-bin/koha/opac-serial-issues.pl?biblionumber="><script>alert("XSS")</script><!--
Comment 1 Jonathan Druart 2017-08-09 17:10:01 UTC
Created attachment 65772 [details] [review]
Bug 18726: Fix XSS at the OPAC - biblionumber

The biblionumber parameter is sent by the user, we must escape all of
them to avoid XSS.
Comment 2 Amit Gupta 2017-08-10 03:13:25 UTC
Created attachment 65784 [details] [review]
The biblionumber parameter is sent by the user, we must escape all of them to avoid XSS.

Work OK.
Fixes: Cross-site scripting OPAC pages
Comment 3 Marcel de Rooy 2017-08-11 06:02:21 UTC
opac-reserve.pl?biblionumber=23%3Cscript%3Ealert(1)%3C/script%3E
Can't call method "field" on an undefined value at C4/Items.pm line 1211.
Crashes

opac-detail.pl?biblionumber=23<script>alert(1)</script>&query_desc=kw%2Cwrdl%3A perl
Argument "23<script>..." isn't numeric in int at opac/opac-detail.pl line 80.
Warns
Comment 4 Marcel de Rooy 2017-08-11 06:02:59 UTC
Created attachment 65873 [details] [review]
Bug 18726: Fix XSS at the OPAC - biblionumber

The biblionumber parameter is sent by the user, we must escape all of
them to avoid XSS.

Fixes: Cross-site scripting OPAC pages

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Jonathan Druart 2017-08-29 15:07:11 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin SOMERS 2017-09-05 12:46:13 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 7 Katrin Fischer 2017-09-07 06:17:07 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.
Comment 8 Mason James 2017-11-23 21:17:04 UTC
Pushed to 16.05.x, for 16.05.16 release