Bug 19128

Summary: XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: Architecture, internals, and plumbingAssignee: Katrin Fischer <katrin.fischer>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, amitddng135, fridolin.somers, jonathan.druart, kyle, m.de.rooy, mtj, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14568    
Bug Blocks: 19391    
Attachments: Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Bug 19128: XSS - admin/authorised_values.tt

Description Katrin Fischer 2017-08-16 12:33:52 UTC

    
Comment 1 Katrin Fischer 2017-08-16 12:37:14 UTC
Created attachment 66090 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.
Comment 2 Amit Gupta 2017-08-17 08:33:53 UTC
Created attachment 66136 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.
********************************************
Works fine.
Comment 3 Marcel de Rooy 2017-08-25 06:43:41 UTC
Created attachment 66451 [details] [review]
Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-09-12 13:36:25 UTC
Created attachment 67083 [details] [review]
Bug 19128: XSS - admin/authorised_values.tt
Comment 5 Katrin Fischer 2017-09-19 21:08:22 UTC
These patches have been pushed to 16.11.x and will be in 16.11.12.
Comment 6 Fridolin Somers 2017-09-22 15:07:28 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 7 Jonathan Druart 2017-09-29 15:48:12 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Mason James 2017-11-23 22:05:00 UTC
Pushed to 16.05.x, for 16.05.17 release