| Summary: | XSS Flaws in System preferences | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Amit Gupta <amitddng135> |
| Component: | Architecture, internals, and plumbing | Assignee: | Amit Gupta <amitddng135> |
| Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | amitddng135, chris, fridolin.somers, indradg, jonathan.druart, m.de.rooy, mtj, tomascohen |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 14568 | ||
| Attachments: |
Bug 19078 - XSS Flaws in System preferences
Bug 19078 - XSS Flaws in System preferences Bug 19078 - XSS Flaws in System preferences |
||
Created attachment 65832 [details] [review] Bug 19078 - XSS Flaws in System preferences 1. Hit /cgi-bin/koha/admin/preferences.pl 2. Enter <script>alert('amit')</script> in search system preferences box. 3. Notice the java script is executed. 4. Apply patch. 5. Reload page, and enter <script>alert('amit')</script> in search system preferences box. 6. Notice it is no longer executed. Created attachment 65862 [details] [review] Bug 19078 - XSS Flaws in System preferences 1. Hit /cgi-bin/koha/admin/preferences.pl 2. Enter <script>alert('amit')</script> in search system preferences box. 3. Notice the java script is executed. 4. Apply patch. 5. Reload page, and enter <script>alert('amit')</script> in search system preferences box. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 65872 [details] [review] Bug 19078 - XSS Flaws in System preferences 1. Hit /cgi-bin/koha/admin/preferences.pl 2. Enter <script>alert('amit')</script> in search system preferences box. 3. Notice the java script is executed. 4. Apply patch. 5. Reload page, and enter <script>alert('amit')</script> in search system preferences box. 6. Notice it is no longer executed. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, is in 17.05.03 This patch has been pushed to 16.11.x and is in 16.11.11. Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0) |
/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=<script>alert('amit')</script>