Bug 17029 - *detail.pl are vulnerable to XSS attacks
Summary: *detail.pl are vulnerable to XSS attacks
Alias: None
Product: Koha
Classification: Unclassified
Component: Searching (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
Depends on:
Blocks: 14568
  Show dependency treegraph
Reported: 2016-08-02 14:41 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:

Bug 17029: Fix XSS in catalogue/*detail.pl (4.32 KB, patch)
2016-08-02 14:48 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17029: Fix XSS in catalogue/*detail.pl (4.38 KB, patch)
2016-08-03 05:27 UTC, Chris Cormack
Details | Diff | Splinter Review
[PASSED QA] Bug 17029: Fix XSS in catalogue/*detail.pl (4.44 KB, patch)
2016-08-07 12:13 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-08-02 14:41:28 UTC
Comment 1 Jonathan Druart 2016-08-02 14:48:31 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2016-08-03 05:27:15 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-08-07 12:13:26 UTC
Created attachment 54122 [details] [review]
[PASSED QA] Bug 17029: Fix XSS in catalogue/*detail.pl

  /cgi-bin/koha/catalogue/detail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
  /cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Kyle M Hall 2016-08-10 13:16:38 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 5 Chris Cormack 2016-08-22 19:45:08 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 6 Frédéric Demians 2016-08-23 09:28:43 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 7 Julian Maurice 2016-08-23 14:20:58 UTC
Pushed to 3.22.x, will be in 3.22.10