Bug 19157 - XSS Stored in letter.pl
Summary: XSS Stored in letter.pl
Status: RESOLVED DUPLICATE of bug 13618
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Amit Gupta
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-20 15:32 UTC by Amit Gupta
Modified: 2024-03-15 14:47 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19157 - XSS Stored in letter.pl (1.85 KB, patch)
2017-08-20 15:45 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19157 - XSS Stored in letter.pl (2.04 KB, patch)
2017-08-22 06:01 UTC, Alex Buckley
Details | Diff | Splinter Review
Bug 19157 - XSS Stored in letter.pl (2.13 KB, patch)
2017-08-25 06:45 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-20 15:32:18 UTC
XSS Stored in letter.pl
Comment 1 Amit Gupta 2017-08-20 15:45:09 UTC
Created attachment 66244 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.
Comment 2 Alex Buckley 2017-08-22 06:01:39 UTC
Created attachment 66305 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.

Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described

Also passes QA test tool

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Comment 3 Marcel de Rooy 2017-08-25 06:45:53 UTC
Created attachment 66452 [details] [review]
Bug 19157 - XSS Stored in letter.pl

To Test

1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form
2. Add a text in the field Name that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed for Delete notice also.

Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described

Also passes QA test tool

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2017-09-12 14:13:26 UTC
Filters are missing.
Create a new template, add "<script>alert("hello")</script>" into code, name, subject of the message and the message.
Comment 5 Katrin Fischer 2017-11-19 21:34:33 UTC
Hi Jonathan,

I have tried that, but can't get the alert to display. Code is too short to contain JavaScript (gets cut off).
Comment 6 Katrin Fischer 2017-12-03 12:56:40 UTC
Jonathan, could you take another look?
Comment 7 Jonathan Druart 2017-12-04 18:09:02 UTC
Add it in name and subject.
Comment 8 Jonathan Druart 2024-03-15 14:47:19 UTC
Fixed.

*** This bug has been marked as a duplicate of bug 13618 ***