Summary: | Subscription detail page vulnerable to reflected XSS | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Serials | Assignee: | David Cook <dcook> |
Status: | RESOLVED FIXED | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, julian.maurice, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
25.05.00,24.11.01,24.05.06,23.11.11,22.11.23
|
|
Circulation function: | |||
Attachments: |
Bug 38470: Add missing double quotes to some Javascript
Bug 38470: Add missing double quotes to some Javascript Bug 38470: Add missing double quotes to some Javascript |
Description
David Cook
2024-11-18 05:07:07 UTC
Created attachment 174658 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Created attachment 175058 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> It works! :) Created attachment 176117 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Pushed for 25.05! Well done everyone, thank you! These patches have been included in all maintained versions, see "Version(s) released in". |