Bug 19079

Summary: XSS Flaws in Membership page
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: amitddng135, chris, fridolin.somers, indradg, jonathan.druart, katrin.fischer, m.de.rooy, mtj, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19079 - XSS Flaws in Membership page
Bug 19079 - XSS Flaws in Membership page
Bug 19079 - XSS Flaws in Membership page
Bug 19079 - XSS Flaws in Membership page

Description Amit Gupta 2017-08-10 16:43:47 UTC
/cgi-bin/koha/members/moremember.pl?borrowernumber=19<script>alert('amit')</script>
Comment 1 Amit Gupta 2017-08-10 16:47:00 UTC
Created attachment 65833 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 2 Marcel de Rooy 2017-08-11 05:38:02 UTC
Amit,
There is a difference with your patch. But the alert is still executed. You probably need to address another borrowernumber somewhere in moremember or one of its includes ?
Comment 3 Amit Gupta 2017-08-11 06:19:06 UTC
Thanks Marcel for comments.

I will look again and fix the same.
Comment 4 Amit Gupta 2017-08-11 15:42:51 UTC
Created attachment 65917 [details] [review]
Bug 19079 - XSS Flaws in Membership page

Used HTML::Entities - Encode or decode strings with HTML entities.
*********************************************************

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 5 Chris Cormack 2017-08-11 20:04:06 UTC
Created attachment 65930 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 6 Jonathan Druart 2017-08-15 17:27:27 UTC
Created attachment 66031 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Jonathan Druart 2017-08-29 15:07:37 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Fridolin Somers 2017-09-05 12:44:24 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 9 Katrin Fischer 2017-09-07 06:14:28 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.
Comment 10 Mason James 2017-09-20 02:38:43 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)