Got injection point in some query like : opac-authorities-home.pl?op=do_search&resultsperpage=1"><script>alert(document.cookie)</script> But another funny is to create a list with a js code in the name and it will be readen on delet like : <script>alert(document.cookie);</script> I didn't try all the $ for injection point but i think you should bullet proof it with an sqlmap on all of them. And to test some scan with kali's tool or ask for someone who can use them to bullet proof it. Regards. Vincent.
Vincent helped me out on IRC with a link that makes the first problem visible on Bywater's demo installation (3.19...): http://catalog.bywatersolutions.com/cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
For the second issue: 1) Create a list in the OPAC, name it: <script>alert('Hello');</script> 2) Delete the list 3) Confirm deletion 4) See the alert say 'Hello' Tested on current master.
Created attachment 39981 [details] [review] Bug 14360: Unescaped variable causes alert Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert. To test: 1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 2) Notice pop-up box with alert 3) Apply patch, refresh page 4) Notice alert is gone
Created attachment 40009 [details] [review] Bug 14360: Unescaped variable causes alert pop-up To test: 1) Create a list in the OPAC, name it: <script>alert('Hello');</script> 2) Delete the list 3) Confirm deletion 4) See the alert say 'Hello' 5) Apply patch 6) Recreate list with same name 7) Delete list 8) Confirm deletion and alert no longer pops up
Created attachment 40045 [details] [review] [SIGNED OFF] Bug 14360: Unescaped variable causes alert Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert. To test: 1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 2) Notice pop-up box with alert 3) Apply patch, refresh page 4) Notice alert is gone Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Created attachment 40046 [details] [review] [SIGNED OFF] Bug 14360: Unescaped variable causes alert pop-up To test: 1) Create a list in the OPAC, name it: <script>alert('Hello');</script> 2) Delete the list 3) Confirm deletion 4) See the alert say 'Hello' 5) Apply patch 6) Recreate list with same name 7) Delete list 8) Confirm deletion and alert no longer pops up Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Can we get some QA on this next please? :)
Created attachment 40066 [details] [review] [PASSED QA] Bug 14360: Unescaped variable causes alert Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert. To test: 1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 2) Notice pop-up box with alert 3) Apply patch, refresh page 4) Notice alert is gone Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 40067 [details] [review] [PASSED QA] Bug 14360: Unescaped variable causes alert pop-up To test: 1) Create a list in the OPAC, name it: <script>alert('Hello');</script> 2) Delete the list 3) Confirm deletion 4) See the alert say 'Hello' 5) Apply patch 6) Recreate list with same name 7) Delete list 8) Confirm deletion and alert no longer pops up Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Patches pushed to master. Thanks Aleisha!
Pushed to 3.20.x will be in 3.20.1
Mason and liz you might want to take a look at this one
I have this in my branch for 3.18. I still can't seem to get my keys to work for git.koha-community.org.
Pushed to 3.18.x will be in 3.18.08
Pushed to 3.14.x, will be in 3.14.16