Bug 11341 - XSS attack vector in facets in OPAC - prog theme
Summary: XSS attack vector in facets in OPAC - prog theme
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Target Milestone: Oldversions
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-04 21:12 UTC by Chris Cormack
Modified: 2018-12-16 19:34 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 11341 : XSS in opac-search.pl (facets) (2.13 KB, patch)
2013-12-04 21:24 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 11341 : XSS in opac-search.pl (facets) (2.19 KB, patch)
2013-12-04 21:30 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
[PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets) (2.26 KB, patch)
2013-12-04 21:57 UTC, Brendan Gallagher
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2013-12-04 21:12:58 UTC
If you craft some html in the offset variable, you can create an xss attack in the show more link in the facets.

Patch to follow
Comment 1 Chris Cormack 2013-12-04 21:24:26 UTC Comment hidden (obsolete)
Comment 2 Tomás Cohen Arazi 2013-12-04 21:30:33 UTC Comment hidden (obsolete)
Comment 3 Brendan Gallagher 2013-12-04 21:57:12 UTC
Created attachment 23313 [details] [review]
[PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets)

prog theme, bootstrap theme is safe

To test
1/ Craft a url like
 cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d"
 (the search must return enough results to have a show more link in the facets)

2/ Check the source, or mouseover the Show more links in the facets
   Notice the code is executable

3/ Apply patch - notice it is no longer executable

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 4 Galen Charlton 2013-12-04 22:02:12 UTC
Pushed to master.  Thanks, Chris!
Comment 5 Fridolin SOMERS 2013-12-13 15:35:11 UTC
This patch has been pushed to 3.14.x, will be in 3.14.1
Comment 6 Tomás Cohen Arazi 2013-12-23 15:30:44 UTC
This patch has been pushed to 3.12.x, will be in 3.12.8.

Thanks Chris!