Bug 16599 - XSS found in opac-shareshelf.pl
Summary: XSS found in opac-shareshelf.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P3 normal (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
: 16598 (view as bug list)
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2016-05-26 10:21 UTC by Kaybee
Modified: 2017-12-07 22:16 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
XSS PoC (85.43 KB, image/png)
2016-05-26 10:21 UTC, Kaybee
Details
Bug 16599: Fix XSS in opac-shareshelf.pl (1.88 KB, patch)
2016-05-26 11:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16599: Fix other potentials XSS for shelfname (5.03 KB, patch)
2016-05-26 11:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16599: Fix XSS in opac-shareshelf.pl (1.94 KB, patch)
2016-05-26 11:26 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16599: Fix other potentials XSS for shelfname (5.08 KB, patch)
2016-05-26 11:26 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16599: Fix XSS in opac-shareshelf.pl (2.04 KB, patch)
2016-05-27 09:38 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 16599: Fix other potentials XSS for shelfname (5.19 KB, patch)
2016-05-27 09:38 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kaybee 2016-05-26 10:21:08 UTC
Persistent XSS in Koha 3.2203000, you could save a list in your account with a Script tag for e.g. <script>alert(1)</script>, when you click share the list, the alert window appears.
Comment 1 Kaybee 2016-05-26 10:21:47 UTC
Created attachment 51822 [details]
XSS PoC
Comment 2 Kaybee 2016-05-26 10:23:09 UTC
*** Bug 16598 has been marked as a duplicate of this bug. ***
Comment 3 Jonathan Druart 2016-05-26 11:10:33 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2016-05-26 11:10:36 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2016-05-26 11:26:09 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2016-05-26 11:26:37 UTC Comment hidden (obsolete)
Comment 7 Kaybee 2016-05-26 13:05:54 UTC
Also just to advise the vulnerability appears in the 'download list' as well. Save a list as before and click download list.
Comment 8 Kaybee 2016-05-26 13:07:14 UTC
(In reply to Kaybee from comment #7)
> Also just to advise the vulnerability appears in the 'download list' as
> well. Save a list as before and click download list.

May be you have fixed, but I've added it to ensure it's tested correctly.
Comment 9 Jonathan Druart 2016-05-26 13:45:15 UTC
(In reply to Kaybee from comment #8)
> (In reply to Kaybee from comment #7)
> > Also just to advise the vulnerability appears in the 'download list' as
> > well. Save a list as before and click download list.
> 
> May be you have fixed, but I've added it to ensure it's tested correctly.

Yes thanks, it's not explicitly noted in the test plan, but I fixed this one too.
Comment 10 Kaybee 2016-05-27 07:34:18 UTC
Cheers.
Comment 11 Marcel de Rooy 2016-05-27 09:38:08 UTC
Created attachment 51865 [details] [review]
Bug 16599: Fix XSS in opac-shareshelf.pl

Test plan:
- Create a list with the name "<script>alert(1)</script>"
- On the shelf list, click on share
=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Reported by Kaybee at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 12 Marcel de Rooy 2016-05-27 09:38:12 UTC
Created attachment 51866 [details] [review]
Bug 16599: Fix other potentials XSS for shelfname

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 13 Brendan Gallagher 2016-05-30 11:13:41 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks
Comment 14 Chris Cormack 2016-06-21 20:44:59 UTC
Pushed to 3.20.x will be in 3.20.11

(Is in 3.22.7 already)
Comment 15 Julian Maurice 2016-06-24 10:05:34 UTC
(In reply to Chris Cormack from comment #14)
> (Is in 3.22.7 already)

No, but it will be in 3.22.8