| Summary: | Reflected XSS in set-library.pl | ||
|---|---|---|---|
| Product: | Koha | Reporter: | oos3c |
| Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | Needs documenting --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, wainuiwitikapark |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37828 | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
25.11.00,25.05.04,24.11.09,24.05.12,22.11.31
|
|
| Circulation function: | |||
| Attachments: |
Reflected XSS within oldrefer paramater
Bug 40766: Prevent XSS on set-library Bug 40766: Prevent XSS on set-library Bug 40766: Prevent XSS on set-library Bug 40766: (QA follow-up) Operator precedence, quoting Bug 40766: [24.05.x] Prevent XSS on set-library |
||
|
Description
oos3c
2025-09-08 09:30:30 UTC
Created attachment 186260 [details] [review] Bug 40766: Prevent XSS on set-library Created attachment 186306 [details] [review] Bug 40766: Prevent XSS on set-library Signed-off-by: David Cook <dcook@prosentient.com.au> I believe the fix proposed is sufficient. Thanks. Looking here Created attachment 186599 [details] [review] Bug 40766: Prevent XSS on set-library Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 186600 [details] [review] Bug 40766: (QA follow-up) Operator precedence, quoting Adding parentheses since I was not sure about precedence here. The filter should be applied to the whole expression. Adjusted double to single quotes in the second change. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to 24.11.x-security for 24.11.09 Pushed to 22.11.x for 22.11.31 Created attachment 186925 [details] [review] Bug 40766: [24.05.x] Prevent XSS on set-library |