Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl
Summary: Fix XSS in /cgi-bin/koha/members/memberentry.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Amit Gupta
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-11-12 16:52 UTC by Amit Gupta
Modified: 2019-10-14 19:57 UTC (History)
12 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl (7.96 KB, patch)
2017-11-13 03:40 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl (8.04 KB, patch)
2017-11-13 05:49 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl (8.08 KB, patch)
2017-12-03 14:40 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19612: Fix XSS in members/memberentry.pl (8.15 KB, patch)
2017-12-08 18:05 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-11-12 16:52:13 UTC
Field -- address, address2, city, state, country, zipcode, B_streetnumber, B_city, B_country, B_zipcode
Comment 1 Amit Gupta 2017-11-13 03:40:21 UTC
Created attachment 69103 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 2 Chris Cormack 2017-11-13 05:49:55 UTC
Created attachment 69108 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 3 Katrin Fischer 2017-12-03 13:22:34 UTC
Awaiting QA
Comment 4 Katrin Fischer 2017-12-03 14:39:29 UTC
This patch is ok, but fixes only the AddressFormat = US include files. I have filed bug 19737 to also fix the include files used for French and German address styles.
Comment 5 Katrin Fischer 2017-12-03 14:40:36 UTC
Created attachment 69469 [details] [review]
Bug 19612 - Fix XSS in /cgi-bin/koha/members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Jonathan Druart 2017-12-08 18:05:04 UTC
Created attachment 69660 [details] [review]
Bug 19612: Fix XSS in members/memberentry.pl

To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
   zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Chris Cormack 2017-12-21 00:01:32 UTC
Pushed to 16.11.x will be in 16.11.15
Comment 8 Nick Clemens 2017-12-22 10:58:21 UTC
Pushed to stable for 17.11.01
Comment 9 Fridolin Somers 2018-01-04 09:14:00 UTC
Pushed to 17.05.x for 17.05.07
Comment 10 Jonathan Druart 2018-01-09 20:31:14 UTC
Pushed to master for 18.05, thanks to everybody involved!