Summary: | XSS Stored in letter.pl | ||
---|---|---|---|
Product: | Koha | Reporter: | Amit Gupta <amitddng135> |
Component: | Architecture, internals, and plumbing | Assignee: | Amit Gupta <amitddng135> |
Status: | RESOLVED DUPLICATE | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | alexbuckley, amit.gupta, chris, jonathan.druart, katrin.fischer, kyle, m.de.rooy, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Attachments: |
Bug 19157 - XSS Stored in letter.pl
Bug 19157 - XSS Stored in letter.pl Bug 19157 - XSS Stored in letter.pl |
Description
Amit Gupta
2017-08-20 15:32:18 UTC
Created attachment 66244 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also. Created attachment 66305 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also. Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described Also passes QA test tool Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz> Created attachment 66452 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also. Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described Also passes QA test tool Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Filters are missing. Create a new template, add "<script>alert("hello")</script>" into code, name, subject of the message and the message. Hi Jonathan, I have tried that, but can't get the alert to display. Code is too short to contain JavaScript (gets cut off). Jonathan, could you take another look? Add it in name and subject. |