XSS Stored in letter.pl
Created attachment 66244 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also.
Created attachment 66305 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also. Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described Also passes QA test tool Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Created attachment 66452 [details] [review] Bug 19157 - XSS Stored in letter.pl To Test 1. Hit the page /cgi-bin/koha/tools/letter.pl?searchfield=&branchcode=*&op=add_form 2. Add a text in the field Name that contains java script 3. Save the page 4. Notice js is execute 5. Apply patch, reload, js is escaped. Fixed for Delete notice also. Followed test plan entering <script>alert("hello")</script> into the name field and behaviour works as described Also passes QA test tool Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Filters are missing. Create a new template, add "<script>alert("hello")</script>" into code, name, subject of the message and the message.
Hi Jonathan, I have tried that, but can't get the alert to display. Code is too short to contain JavaScript (gets cut off).
Jonathan, could you take another look?
Add it in name and subject.
Fixed. *** This bug has been marked as a duplicate of bug 13618 ***