Bug 16597 - Reflected XSS in [opac-]shelves and [opac-]shareshelf
Summary: Reflected XSS in [opac-]shelves and [opac-]shareshelf
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Owen Leonard
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-26 10:03 UTC by Jonathan Druart
Modified: 2017-12-07 22:16 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 16597: Fix XSS in opac-shelves.pl (1.54 KB, patch)
2016-05-26 10:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16597: Fix XSS in opac-shareshelf (1.43 KB, patch)
2016-05-26 10:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16597: Fix XSS in shelves.pl (1.15 KB, patch)
2016-05-26 10:09 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16597: Fix XSS in opac-shelves.pl (1.60 KB, patch)
2016-05-27 08:31 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16597: Fix XSS in opac-shareshelf (1.49 KB, patch)
2016-05-27 08:31 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16597: Fix XSS in shelves.pl (1.21 KB, patch)
2016-05-27 08:32 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16597: Fix XSS in opac-shelves.pl (1.70 KB, patch)
2016-05-27 10:14 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 16597: Fix XSS in opac-shareshelf (1.59 KB, patch)
2016-05-27 10:14 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 16597: Fix XSS in shelves.pl (1.31 KB, patch)
2016-05-27 10:14 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-05-26 10:03:17 UTC

    
Comment 1 Jonathan Druart 2016-05-26 10:05:40 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-05-26 10:05:44 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2016-05-26 10:09:00 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2016-05-27 08:31:25 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2016-05-27 08:31:41 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2016-05-27 08:32:00 UTC Comment hidden (obsolete)
Comment 7 Marcel de Rooy 2016-05-27 10:14:40 UTC
Created attachment 51869 [details] [review]
Bug 16597: Fix XSS in opac-shelves.pl

To test
1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT>
2/ Notice JS is executed
3/ Apply patch
4/ Notice it's fixed

This bug reported by

Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 8 Marcel de Rooy 2016-05-27 10:14:44 UTC
Created attachment 51870 [details] [review]
Bug 16597: Fix XSS in opac-shareshelf

To test
1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5
2/ Notice you see a js alert
3/ Apply patch
4/ It is gone

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Marcel de Rooy 2016-05-27 10:14:48 UTC
Created attachment 51871 [details] [review]
Bug 16597: Fix XSS in shelves.pl

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Brendan Gallagher 2016-05-30 11:14:53 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks
Comment 11 Chris Cormack 2016-06-21 20:52:41 UTC
Pushed to 3.20.x will be in 3.20.11, is in 3.22.7
Comment 12 Julian Maurice 2016-06-24 10:05:53 UTC
(In reply to Chris Cormack from comment #11)
> is in 3.22.7
No, but it will be in 3.22.8