Bug 19612

Summary: Fix XSS in /cgi-bin/koha/members/memberentry.pl
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: alex.arnaud, amit.gupta, chris, fridolin.somers, jonathan.druart, josef.moravec, julian.maurice, katrin.fischer, kyle, m.de.rooy, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19737
Change sponsored?: Sponsored Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl
Bug 19612: Fix XSS in members/memberentry.pl

Description Amit Gupta 2017-11-12 16:52:13 UTC
Field -- address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode
Comment 1 Amit Gupta 2017-11-13 03:40:21 UTC
Created attachment 69103 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 2 Chris Cormack 2017-11-13 05:49:55 UTC
Created attachment 69108 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 3 Katrin Fischer 2017-12-03 13:22:34 UTC
Awaiting QA
Comment 4 Katrin Fischer 2017-12-03 14:39:29 UTC
This patch is ok, but fixes only the AddressFormat = US include files. I have filed bug 19737 to also fix the include files used for French and German address styles.
Comment 5 Katrin Fischer 2017-12-03 14:40:36 UTC
Created attachment 69469 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Jonathan Druart 2017-12-08 18:05:04 UTC
Created attachment 69660 [details] [review]
Bug 19612: Fix XSS in members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Chris Cormack 2017-12-21 00:01:32 UTC
Pushed to 16.11.x will be in 16.11.15
Comment 8 Nick Clemens 2017-12-22 10:58:21 UTC
Pushed to stable for 17.11.01
Comment 9 Fridolin Somers 2018-01-04 09:14:00 UTC
Pushed to 17.05.x for 17.05.07
Comment 10 Jonathan Druart 2018-01-09 20:31:14 UTC
Pushed to master for 18.05, thanks to everybody involved!