|
Description
Amit Gupta
2017-08-07 15:35:03 UTC
Created attachment 65580 [details] [review] Bug 19051 - XSS Flaws in - Batch record deletion page 1. Hit /cgi-bin/koha/tools/batch_delete_records.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Record number list (one per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Record number list (one per line) text area. 6. Notice it is no longer executed. 7. Fixes for both biblio and authority records. Created attachment 65584 [details] [review] Bug 19051 - XSS Flaws in Batch item deletion page 1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Created attachment 65585 [details] [review] Bug 19051 - XSS Flaws in - Batch item modification page 1. Hit /cgi-bin/koha/tools/batchMod.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Created attachment 65597 [details] [review] Bug 19051 - XSS Flaws in - Batch record deletion page 1. Hit /cgi-bin/koha/tools/batch_delete_records.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Record number list (one per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Record number list (one per line) text area. 6. Notice it is no longer executed. 7. Fixes for both biblio and authority records. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 65598 [details] [review] Bug 19051 - XSS Flaws in Batch item deletion page 1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 65599 [details] [review] Bug 19051 - XSS Flaws in - Batch item modification page 1. Hit /cgi-bin/koha/tools/batchMod.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 65888 [details] [review] Bug 19051 - XSS Flaws in - Batch record deletion page 1. Hit /cgi-bin/koha/tools/batch_delete_records.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Record number list (one per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Record number list (one per line) text area. 6. Notice it is no longer executed. 7. Fixes for both biblio and authority records. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 65889 [details] [review] Bug 19051 - XSS Flaws in Batch item deletion page 1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 65890 [details] [review] Bug 19051 - XSS Flaws in - Batch item modification page 1. Hit /cgi-bin/koha/tools/batchMod.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area. 6. Notice it is no longer executed. 7. Fixes for both barcode and itemnumber. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, is in 17.05.03 These patches have been pushed to 16.11.x and are in 16.11.11. Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0) |