Bug 19078 - XSS Flaws in System preferences
Summary: XSS Flaws in System preferences
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Amit Gupta
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-10 16:18 UTC by Amit Gupta
Modified: 2019-10-14 19:57 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19078 - XSS Flaws in System preferences (1.52 KB, patch)
2017-08-10 16:24 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19078 - XSS Flaws in System preferences (1.58 KB, patch)
2017-08-10 20:53 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 19078 - XSS Flaws in System preferences (1.67 KB, patch)
2017-08-11 05:43 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-10 16:18:57 UTC
/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=<script>alert('amit')</script>
Comment 1 Amit Gupta 2017-08-10 16:24:47 UTC
Created attachment 65832 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.
Comment 2 Chris Cormack 2017-08-10 20:53:30 UTC
Created attachment 65862 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Marcel de Rooy 2017-08-11 05:43:54 UTC
Created attachment 65872 [details] [review]
Bug 19078 - XSS Flaws in System preferences

1. Hit /cgi-bin/koha/admin/preferences.pl
2. Enter <script>alert('amit')</script> in search system preferences box.
3. Notice the java script is executed.
4. Apply patch.
5. Reload page, and enter <script>alert('amit')</script> in search system preferences box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-08-29 15:07:34 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 5 Fridolin Somers 2017-09-05 12:45:58 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 6 Katrin Fischer 2017-09-07 06:16:52 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.
Comment 7 Mason James 2017-09-20 02:32:50 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)