Bug 16958 - opac-imageviewer.pl is vulnerable to XSS
Summary: opac-imageviewer.pl is vulnerable to XSS
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-22 06:25 UTC by Chris Cormack
Modified: 2019-06-27 09:24 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 16958: Fix XSS in opac-imageviewer.pl (2.62 KB, patch)
2016-07-22 07:17 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16958: Fix XSS in opac-imageviewer.pl (2.67 KB, patch)
2016-07-22 07:36 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16958: Fix XSS in opac-imageviewer.pl (2.77 KB, patch)
2016-07-22 09:21 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2016-07-22 06:25:15 UTC
/cgi­-bin/koha/opac-­imageviewer.pl?biblionumber=14&imagenumber=7%22%3e%3c%73%43%72%49%70%54%3e%61%6c%65%72%74%28%38%31%38%34%32%29%3c%2f%73%43%72%49%70%54%3e
Comment 1 Chris Cormack 2016-07-22 07:10:19 UTC
Working on this now
Comment 2 Jonathan Druart 2016-07-22 07:17:41 UTC Comment hidden (obsolete)
Comment 3 Chris Cormack 2016-07-22 07:36:37 UTC Comment hidden (obsolete)
Comment 4 Marcel de Rooy 2016-07-22 09:21:40 UTC
Created attachment 53640 [details] [review]
Bug 16958: Fix XSS in opac-imageviewer.pl

Test plan:
Trigger
/opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT>

=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Kyle M Hall 2016-07-22 17:12:07 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 6 Frédéric Demians 2016-08-01 13:44:57 UTC
Pushed in 16.05. Will be in 16.05.02.
Comment 7 Chris Cormack 2016-08-03 20:26:07 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 8 Julian Maurice 2016-08-17 11:46:02 UTC
Patch pushed to 3.22.x, will be in 3.22.10