Bug 19125

Summary: XSS - members.pl
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: Architecture, internals, and plumbingAssignee: Katrin Fischer <katrin.fischer>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, amitddng135, fridolin.somers, jonathan.druart, kyle, m.de.rooy, mtj, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14568    
Bug Blocks:    
Attachments: Bug 19125 - XSS - members.pl
Bug 19125 - XSS - members.pl
Bug 19125 - XSS - members.pl

Description Katrin Fischer 2017-08-16 09:44:03 UTC
Found some more while testing 19086.
Comment 1 Katrin Fischer 2017-08-16 10:05:23 UTC
Patch for this coming!
Comment 2 Katrin Fischer 2017-08-16 10:10:19 UTC
Created attachment 66057 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed
Comment 3 Amit Gupta 2017-08-19 09:01:44 UTC
Created attachment 66220 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed
Comment 4 Marcel de Rooy 2017-08-25 06:33:22 UTC
<option value="[% l.branchcode | html %]">[% l.branchname |html %]</option>

<option value="[% b.branchcode %]">[% b.branchname |html %]</option>

Why escape branchcode in the first only ?
Comment 5 Marcel de Rooy 2017-08-25 06:33:47 UTC
Created attachment 66449 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Katrin Fischer 2017-09-19 21:00:40 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.
Comment 7 Fridolin Somers 2017-09-22 15:05:44 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 8 Jonathan Druart 2017-09-29 15:47:38 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 9 Mason James 2017-11-23 22:04:17 UTC
Pushed to 16.05.x, for 16.05.17 release