Bug 6632

Summary:	[security] XXS on list name (on admin part)
Product:	Koha	Reporter:	Sébastien Marie <semarie>
Component:	Templates	Assignee:	Sébastien Marie <semarie>
Status:	CLOSED FIXED	QA Contact:	Bugs List <koha-bugs>
Severity:	normal
Priority:	P5 - low	CC:	chris, wizzyrea
Version:	3.4
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Bug Depends on:
Bug Blocks:	7310
Attachments:	Proposed patch Bug 6632 [Signed Off] add html filter to prevent XSS

Description Sébastien Marie 2011-07-26 09:28:52 UTC

There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part.

In order to test:
 1. on opac, create a new list named 'a <blink>simple</blink> list'
 2. log as admin on staff part.
 3. go to Lists
 4. select the list named 'a <blink>simple</blink> list' (no XXS here)
 5. the 'simple' word *blink* on 3 places

The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS.

Comment 1 Sébastien Marie 2011-07-27 11:14:33 UTC Comment hidden (obsolete)

Created attachment 4752 [details] [review]
Proposed patch

Here a patch for TT page in admin. 'html' filter was added to each 'shelvename'.

Comment 2 Liz Rea 2011-07-27 18:47:16 UTC

Created attachment 4756 [details] [review]
Bug 6632 [Signed Off] add html filter to prevent XSS

The filter 'html' have been added on all occurences of shelvename, which come from user input.

Comment 3 Liz Rea 2011-07-27 18:48:15 UTC

Bug confirmed, fix signed off.

Comment 4 Chris Cormack 2011-07-27 20:43:13 UTC

XSS fix, pushed