| Summary: | Fix XSS in /cgi-bin/koha/members/memberentry.pl | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Amit Gupta <amitddng135> |
| Component: | Architecture, internals, and plumbing | Assignee: | Amit Gupta <amitddng135> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | alex.arnaud, amit.gupta, chris, fridolin.somers, jonathan.druart, josef.moravec, julian.maurice, kyle, m.de.rooy, nick, tomascohen |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19737 | ||
| Change sponsored?: | Sponsored | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 14568 | ||
| Attachments: |
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl Bug 19612: Fix XSS in members/memberentry.pl |
||
|
Description
Amit Gupta
2017-11-12 16:52:13 UTC
Created attachment 69103 [details] [review] Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl To Test 1. Hit the page /cgi-bin/koha/members/memberentry.pl 2. Add a text in the field address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Created attachment 69108 [details] [review] Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl To Test 1. Hit the page /cgi-bin/koha/members/memberentry.pl 2. Add a text in the field address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Awaiting QA This patch is ok, but fixes only the AddressFormat = US include files. I have filed bug 19737 to also fix the include files used for French and German address styles. Created attachment 69469 [details] [review] Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl To Test 1. Hit the page /cgi-bin/koha/members/memberentry.pl 2. Add a text in the field address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 69660 [details] [review] Bug 19612: Fix XSS in members/memberentry.pl To Test 1. Hit the page /cgi-bin/koha/members/memberentry.pl 2. Add a text in the field address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to 16.11.x will be in 16.11.15 Pushed to stable for 17.11.01 Pushed to 17.05.x for 17.05.07 Pushed to master for 18.05, thanks to everybody involved! |