Bug 19079 - XSS Flaws in Membership page
Summary: XSS Flaws in Membership page
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Amit Gupta
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-10 16:43 UTC by Amit Gupta
Modified: 2017-09-07 06:14 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 19079 - XSS Flaws in Membership page (6.75 KB, patch)
2017-08-10 16:47 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19079 - XSS Flaws in Membership page (1.24 KB, patch)
2017-08-11 15:42 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19079 - XSS Flaws in Membership page (1.29 KB, patch)
2017-08-11 20:04 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 19079 - XSS Flaws in Membership page (1.37 KB, patch)
2017-08-15 17:27 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-10 16:43:47 UTC
/cgi-bin/koha/members/moremember.pl?borrowernumber=19<script>alert('amit')</script>
Comment 1 Amit Gupta 2017-08-10 16:47:00 UTC
Created attachment 65833 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 2 Marcel de Rooy 2017-08-11 05:38:02 UTC
Amit,
There is a difference with your patch. But the alert is still executed. You probably need to address another borrowernumber somewhere in moremember or one of its includes ?
Comment 3 Amit Gupta 2017-08-11 06:19:06 UTC
Thanks Marcel for comments.

I will look again and fix the same.
Comment 4 Amit Gupta 2017-08-11 15:42:51 UTC
Created attachment 65917 [details] [review]
Bug 19079 - XSS Flaws in Membership page

Used HTML::Entities - Encode or decode strings with HTML entities.
*********************************************************

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 5 Chris Cormack 2017-08-11 20:04:06 UTC
Created attachment 65930 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 6 Jonathan Druart 2017-08-15 17:27:27 UTC
Created attachment 66031 [details] [review]
Bug 19079 - XSS Flaws in Membership page

1. Hit /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/members/moremember.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Jonathan Druart 2017-08-29 15:07:37 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Fridolin SOMERS 2017-09-05 12:44:24 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 9 Katrin Fischer 2017-09-07 06:14:28 UTC
This patch has been pushed to 16.11.x and is in 16.11.11.