Bug 6632

Summary: [security] XXS on list name (on admin part)
Product: Koha Reporter: Sébastien Marie <semarie>
Component: TemplatesAssignee: Sébastien Marie <semarie>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: normal    
Priority: P5 - low CC: chris, wizzyrea
Version: 3.4   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 7310    
Attachments: Proposed patch
Bug 6632 [Signed Off] add html filter to prevent XSS

Description Sébastien Marie 2011-07-26 09:28:52 UTC
There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part.

In order to test:
 1. on opac, create a new list named 'a <blink>simple</blink> list'
 2. log as admin on staff part.
 3. go to Lists
 4. select the list named 'a <blink>simple</blink> list' (no XXS here)
 5. the 'simple' word *blink* on 3 places

The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS.
Comment 1 Sébastien Marie 2011-07-27 11:14:33 UTC Comment hidden (obsolete)
Comment 2 Liz Rea 2011-07-27 18:47:16 UTC
Created attachment 4756 [details] [review]
Bug 6632 [Signed Off] add html filter to prevent XSS

The filter 'html' have been added on all occurences of shelvename, which come from user input.
Comment 3 Liz Rea 2011-07-27 18:48:15 UTC
Bug confirmed, fix signed off.
Comment 4 Chris Cormack 2011-07-27 20:43:13 UTC
XSS fix, pushed