Bug 19738

Summary: XSS in serials module
Product: Koha Reporter: Josef Moravec <josef.moravec>
Component: Architecture, internals, and plumbingAssignee: Josef Moravec <josef.moravec>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: minor    
Priority: P5 - low CC: jonathan.druart, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 19611    
Bug Blocks:    
Attachments: Bug 19738: Fix XSS on vendor name in serials module
Bug 19738: Fix XSS on vendor name in serials module
Bug 19738: Fix XSS on vendor name in serials module

Description Josef Moravec 2017-12-03 22:16:30 UTC

    
Comment 1 Josef Moravec 2017-12-03 22:30:57 UTC
Created attachment 69473 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped
Comment 2 Katrin Fischer 2017-12-26 20:59:22 UTC
Created attachment 70165 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Marcel de Rooy 2018-01-05 16:53:37 UTC
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>

LOL
How many vendors are supposed to have javascript in their name ??
Comment 4 Josef Moravec 2018-01-08 07:30:59 UTC
(In reply to Marcel de Rooy from comment #3)
> 2) Have at least one vendor which name does contain javascript, for
> example: <i>Vendor 1</i><script>alert('Hi');</script>
> 
> LOL
> How many vendors are supposed to have javascript in their name ??

Not many ;) but we want to be on the safe side... and if the vendor name does contain html code for examnple, we do not want to the name to be uncontrollably formatted...
Comment 5 Marcel de Rooy 2018-01-08 08:11:32 UTC
Created attachment 70321 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Jonathan Druart 2018-02-15 19:07:47 UTC
Patch pushed to
* master for 18.05
* 17.11.x for v17.11.02
* 17.05.x for v17.05.08