Bug 19738 - XSS in serials module
Summary: XSS in serials module
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Josef Moravec
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 19611
Blocks:
  Show dependency treegraph
 
Reported: 2017-12-03 22:16 UTC by Josef Moravec
Modified: 2019-10-14 19:56 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19738: Fix XSS on vendor name in serials module (2.80 KB, patch)
2017-12-03 22:30 UTC, Josef Moravec
Details | Diff | Splinter Review
Bug 19738: Fix XSS on vendor name in serials module (2.79 KB, patch)
2017-12-26 20:59 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19738: Fix XSS on vendor name in serials module (2.89 KB, patch)
2018-01-08 08:11 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Josef Moravec 2017-12-03 22:16:30 UTC

    
Comment 1 Josef Moravec 2017-12-03 22:30:57 UTC
Created attachment 69473 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped
Comment 2 Katrin Fischer 2017-12-26 20:59:22 UTC
Created attachment 70165 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Marcel de Rooy 2018-01-05 16:53:37 UTC
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>

LOL
How many vendors are supposed to have javascript in their name ??
Comment 4 Josef Moravec 2018-01-08 07:30:59 UTC
(In reply to Marcel de Rooy from comment #3)
> 2) Have at least one vendor which name does contain javascript, for
> example: <i>Vendor 1</i><script>alert('Hi');</script>
> 
> LOL
> How many vendors are supposed to have javascript in their name ??

Not many ;) but we want to be on the safe side... and if the vendor name does contain html code for examnple, we do not want to the name to be uncontrollably formatted...
Comment 5 Marcel de Rooy 2018-01-08 08:11:32 UTC
Created attachment 70321 [details] [review]
Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Jonathan Druart 2018-02-15 19:07:47 UTC
Patch pushed to
* master for 18.05
* 17.11.x for v17.11.02
* 17.05.x for v17.05.08