Bug 19103

Summary: Stored XSS in itemtypes.pl - patron-attr-types.pl - matching-rules.pl
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, chris, fridolin.somers, jonathan.druart, katrin.fischer, kyle, m.de.rooy, mtj, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19103 - Stored XSS in itemtypes.pl
Bug 19103 - Stored XSS in patron-attr-types.pl
Bug 19103 - Stored XSS in matching-rules.pl
[SIGNED OFF] Bug 19103 - Stored XSS in itemtypes.pl
[SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl
[SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl
Bug 19103 - Stored XSS in itemtypes.pl
Bug 19103 - Stored XSS in patron-attr-types.pl
Bug 19103 - Stored XSS in matching-rules.pl
Bug 19103: (follow-up) Stored XSS in itemtypes.pl

Description Amit Gupta 2017-08-15 03:20:57 UTC
Affected Parameter:description, checkinmsg
Comment 1 Amit Gupta 2017-08-15 03:25:07 UTC
Created attachment 65991 [details] [review]
Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 2 Amit Gupta 2017-08-15 04:40:52 UTC
Created attachment 65995 [details] [review]
Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 3 Amit Gupta 2017-08-15 04:48:20 UTC
Created attachment 65996 [details] [review]
Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Comment 4 Katrin Fischer 2017-08-16 12:00:25 UTC
Created attachment 66086 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Katrin Fischer 2017-08-16 12:00:28 UTC
Created attachment 66087 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2017-08-16 12:00:31 UTC
Created attachment 66088 [details] [review]
[SIGNED OFF] Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Marcel de Rooy 2017-08-25 06:20:15 UTC
Created attachment 66439 [details] [review]
Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Marcel de Rooy 2017-08-25 06:20:20 UTC
Created attachment 66440 [details] [review]
Bug 19103 - Stored XSS in patron-attr-types.pl

To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Marcel de Rooy 2017-08-25 06:20:24 UTC
Created attachment 66441 [details] [review]
Bug 19103 - Stored XSS in matching-rules.pl

To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Jonathan Druart 2017-09-12 13:59:10 UTC
Created attachment 67084 [details] [review]
Bug 19103: (follow-up) Stored XSS in itemtypes.pl
Comment 11 Katrin Fischer 2017-09-19 21:09:45 UTC
These patches have been pushed to 16.11.x and will be in 16.11.12.
Comment 12 Fridolin Somers 2017-09-22 15:05:35 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 13 Jonathan Druart 2017-09-29 15:46:28 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 14 Mason James 2017-11-23 22:03:09 UTC
Pushed to 16.05.x, for 16.05.17 release