Summary: | XSS in serials module | ||
---|---|---|---|
Product: | Koha | Reporter: | Josef Moravec <josef.moravec> |
Component: | Architecture, internals, and plumbing | Assignee: | Josef Moravec <josef.moravec> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | minor | ||
Priority: | P5 - low | CC: | jonathan.druart, m.de.rooy |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 19611 | ||
Bug Blocks: | |||
Attachments: |
Bug 19738: Fix XSS on vendor name in serials module
Bug 19738: Fix XSS on vendor name in serials module Bug 19738: Fix XSS on vendor name in serials module |
Description
Josef Moravec
2017-12-03 22:16:30 UTC
Created attachment 69473 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Created attachment 70165 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> LOL How many vendors are supposed to have javascript in their name ?? (In reply to Marcel de Rooy from comment #3) > 2) Have at least one vendor which name does contain javascript, for > example: <i>Vendor 1</i><script>alert('Hi');</script> > > LOL > How many vendors are supposed to have javascript in their name ?? Not many ;) but we want to be on the safe side... and if the vendor name does contain html code for examnple, we do not want to the name to be uncontrollably formatted... Created attachment 70321 [details] [review] Bug 19738: Fix XSS on vendor name in serials module Test plan: 1) do not apply this patch 2) Have at least one vendor which name does contain javascript, for example: <i>Vendor 1</i><script>alert('Hi');</script> 3) go to serial module and create new subscription 4) use "Search for vendor" 5) Search for your vendor, when search results table is presented, the javascript is executed 6) go through subscription creation and save the new subscription 7) On subscription detail page, the javascript is executed as well 8) apply this patch 9) Repeat 3-7, the script is not executed, the input is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Patch pushed to * master for 18.05 * 17.11.x for v17.11.02 * 17.05.x for v17.05.08 |