Bug 19078

Summary: XSS Flaws in System preferences
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amitddng135, chris, fridolin.somers, indradg, jonathan.druart+koha, katrin.fischer, m.de.rooy, mtj, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19078 - XSS Flaws in System preferences
Bug 19078 - XSS Flaws in System preferences
Bug 19078 - XSS Flaws in System preferences

Description Amit Gupta 2017-08-10 16:18:57 UTC
/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=<script>alert('amit')</script>
Comment 1 Amit Gupta 2017-08-10 16:24:47 UTC
Created attachment 65832 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.
Comment 2 Chris Cormack 2017-08-10 20:53:30 UTC
Created attachment 65862 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Marcel de Rooy 2017-08-11 05:43:54 UTC
Created attachment 65872 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-08-29 15:07:34 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 5 Fridolin Somers 2017-09-05 12:45:58 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 6 Katrin Fischer 2017-09-07 06:16:52 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.
Comment 7 Mason James 2017-09-20 02:32:50 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)