Bug 19102 - XSS Flaws in circulation.pl - routing-lists.pl - readingrec.pl - notices.pl - maninvoice.pl - boraccount.pl - mancredit.pl
Summary: XSS Flaws in circulation.pl - routing-lists.pl - readingrec.pl - notices.pl -...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Amit Gupta
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-14 19:28 UTC by Amit Gupta
Modified: 2020-01-06 20:14 UTC (History)
7 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 19102 - XSS Flaws in circulation.pl (1.33 KB, patch)
2017-08-14 19:44 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19086 Fix XSS in routing-lists.pl (1.24 KB, patch)
2017-08-14 19:51 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19086 Fix XSS in readingrec.pl (1.39 KB, patch)
2017-08-14 19:53 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in routing-lists.pl (1.24 KB, patch)
2017-08-14 19:57 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in readingrec.pl (1.39 KB, patch)
2017-08-14 19:59 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in notices.pl (1.16 KB, patch)
2017-08-14 20:00 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in maninvoice.pl (1.19 KB, patch)
2017-08-14 20:03 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in boraccount.pl (1.18 KB, patch)
2017-08-14 20:06 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19102 Fix XSS in mancredit.pl (1.20 KB, patch)
2017-08-14 20:08 UTC, Amit Gupta
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 - XSS Flaws in circulation.pl (1.39 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in routing-lists.pl (1.30 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in readingrec.pl (1.45 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in notices.pl (1.23 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in maninvoice.pl (1.25 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in boraccount.pl (1.24 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19102 Fix XSS in mancredit.pl (1.26 KB, patch)
2017-08-16 11:36 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-14 19:28:52 UTC
XSS Flaws in circulation.pl - routing-lists.pl - readingrec.pl - notices.pl - maninvoice.pl - boraccount.pl - mancredit.pl
Comment 1 Amit Gupta 2017-08-14 19:44:59 UTC
Created attachment 65975 [details] [review]
Bug 19102 - XSS Flaws in circulation.pl

1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-14 19:51:12 UTC
Created attachment 65976 [details] [review]
Bug 19086 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 3 Amit Gupta 2017-08-14 19:53:20 UTC
Created attachment 65977 [details] [review]
Bug 19086 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 4 Amit Gupta 2017-08-14 19:57:36 UTC
Created attachment 65978 [details] [review]
Bug 19102 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 5 Amit Gupta 2017-08-14 19:59:01 UTC
Created attachment 65979 [details] [review]
Bug 19102 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 6 Amit Gupta 2017-08-14 20:00:58 UTC
Created attachment 65980 [details] [review]
Bug 19102 Fix XSS in notices.pl

1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 7 Amit Gupta 2017-08-14 20:03:57 UTC
Created attachment 65981 [details] [review]
Bug 19102 Fix XSS in maninvoice.pl

1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 8 Amit Gupta 2017-08-14 20:06:36 UTC
Created attachment 65982 [details] [review]
Bug 19102 Fix XSS in boraccount.pl

1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amity')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 9 Amit Gupta 2017-08-14 20:08:58 UTC
Created attachment 65983 [details] [review]
Bug 19102 Fix XSS in mancredit.pl

1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 10 Katrin Fischer 2017-08-16 11:36:07 UTC
Created attachment 66069 [details] [review]
[SIGNED OFF] Bug 19102 - XSS Flaws in circulation.pl

1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Katrin Fischer 2017-08-16 11:36:10 UTC
Created attachment 66070 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 12 Katrin Fischer 2017-08-16 11:36:13 UTC
Created attachment 66071 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Katrin Fischer 2017-08-16 11:36:17 UTC
Created attachment 66072 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in notices.pl

1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 14 Katrin Fischer 2017-08-16 11:36:20 UTC
Created attachment 66073 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in maninvoice.pl

1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 15 Katrin Fischer 2017-08-16 11:36:23 UTC
Created attachment 66074 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in boraccount.pl

1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amity')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 16 Katrin Fischer 2017-08-16 11:36:26 UTC
Created attachment 66075 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in mancredit.pl

1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 17 Marcel de Rooy 2017-08-25 06:18:04 UTC
Why are we doing it here with HTML::Entities and are we editing templates on the other reports ?

Needs feedback
Comment 18 Jonathan Druart 2019-03-15 22:59:37 UTC
This has been solved by or prior bug 13618.