Bug 17026 - checkexpiration.pl is vulnerable to XSS attacks
Summary: checkexpiration.pl is vulnerable to XSS attacks
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2016-08-02 14:11 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17026: Fix XSS in serials/checkexpiration.pl (2.06 KB, patch)
2016-08-02 14:30 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17026: Fix XSS in serials/checkexpiration.pl (2.12 KB, patch)
2016-08-03 05:20 UTC, Chris Cormack
Details | Diff | Splinter Review
[PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl (2.18 KB, patch)
2016-08-03 21:42 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-08-02 14:11:04 UTC
Reported by Dionach.
Comment 1 Jonathan Druart 2016-08-02 14:30:21 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2016-08-03 05:20:17 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-08-03 21:42:34 UTC
Created attachment 53978 [details] [review]
[PASSED QA] Bug 17026: Fix XSS in serials/checkexpiration.pl

Test plan:
Hit:
 /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002
 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Brendan Gallagher 2016-08-04 18:14:10 UTC
Pushed to Master - Should be in the November 2016 release. Thanks!
Comment 5 Frédéric Demians 2016-08-05 06:07:56 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 6 Chris Cormack 2016-08-08 07:00:00 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 7 Julian Maurice 2016-08-17 12:39:23 UTC
Patches pushed to 3.22.x, will be in 3.22.10