Summary: | Staff interface detail page vulnerable to reflected XSS | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Staff interface | Assignee: | David Cook <dcook> |
Status: | RESOLVED FIXED | QA Contact: | Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski> |
Severity: | normal | ||
Priority: | P5 - low | CC: | baptiste.wojtkowski, dcook, didier.gautheron, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28559 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
25.05.00,24.11.01,24.05.06,23.11.11,22.11.23
|
|
Circulation function: | |||
Attachments: |
Bug 38468: Add double quotes to some template strings
Bug 38468: Add double quotes to some template strings Bug 38468: Add double quotes to some template strings |
Description
David Cook
2024-11-18 02:37:57 UTC
Created attachment 174656 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the shelf browser to go to the next result 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid Created attachment 175034 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the search result navigation box to go to the next result On the left of the page. Just bellow the breadcrumb and left of the record title. 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> It works! :)
> 3. Use the shelf browser to go to the next result
It seems to be about the navigation box on the left of the page. Just bellow the breadcrumb and left of the record title.
(<div> with class="browse-controls")
Test plan was amended to reflect this. Feel free to amend again to clarify more. Like with the proper name for the "search result navigation box".
Created attachment 176055 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the search result navigation box to go to the next result On the left of the page. Just bellow the breadcrumb and left of the record title. 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com> Tested on all provided example, working. QA tool happy, passing QA (In reply to Baptiste Wojtkowski (bwoj) from comment #9) > Tested on all provided example, working. QA tool happy, passing QA Do we still need this one? See bug 38467. (In reply to Marcel de Rooy from comment #10) > (In reply to Baptiste Wojtkowski (bwoj) from comment #9) > > Tested on all provided example, working. QA tool happy, passing QA > > Do we still need this one? See bug 38467. Yep, bug 38467 only affects the "url" and "uri" filters - not the "html" filter. I don't want to be auto-banned by Bugzilla, so I won't add the links here, but you can see the template::Manual::Filters documentation or the Template::Filters::html_filter() function for more info. Pushed for 25.05! Well done everyone, thank you! These patches have been included in all maintained versions, see "Version(s) released in". |