Bug 19157

Summary: XSS Stored in letter.pl
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: RESOLVED DUPLICATE QA Contact: Marcel de Rooy <m.de.rooy>
Severity: enhancement    
Priority: P5 - low CC: alexbuckley, amit.gupta, chris, jonathan.druart, katrin.fischer, kyle, m.de.rooy, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 19157 - XSS Stored in letter.pl
Bug 19157 - XSS Stored in letter.pl
Bug 19157 - XSS Stored in letter.pl

Description Amit Gupta 2017-08-20 15:32:18 UTC
XSS Stored in letter.pl
Comment 1 Amit Gupta 2017-08-20 15:45:09 UTC
Created attachment 66244 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.
Comment 2 Alex Buckley 2017-08-22 06:01:39 UTC
Created attachment 66305 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.

Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described

Also passes QA test tool

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 3 Marcel de Rooy 2017-08-25 06:45:53 UTC
Created attachment 66452 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.

Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described

Also passes QA test tool

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-09-12 14:13:26 UTC
Filters are missing.
Create a new template, add "<script>alert("hello")</script>" into code, name, subject of the message and the message.
Comment 5 Katrin Fischer 2017-11-19 21:34:33 UTC
Hi Jonathan,

I have tried that, but can't get the alert to display. Code is too short to contain JavaScript (gets cut off).
Comment 6 Katrin Fischer 2017-12-03 12:56:40 UTC
Jonathan, could you take another look?
Comment 7 Jonathan Druart 2017-12-04 18:09:02 UTC
Add it in name and subject.
Comment 8 Jonathan Druart 2024-03-15 14:47:19 UTC
Fixed.

*** This bug has been marked as a duplicate of bug 13618 ***