Bug 22268 - Data displayed in request list datatable is not sanitized
Summary: Data displayed in request list datatable is not sanitized
Status: RESOLVED DUPLICATE of bug 21063
Alias: None
Product: Koha
Classification: Unclassified
Component: ILL (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-02-04 13:59 UTC by Andrew Isherwood
Modified: 2019-05-01 10:18 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Isherwood 2019-02-04 13:59:10 UTC
Request data displayed in the "Request view" or similar views is sanitized by the html filter in the template. However, the main request list table is generated via Datatables and is not sanitized. This can be demonstrated by entering a malicious string, such as:

<script>alert('pwned');</script>

Into the request notes field, then displaying the requests table.

I've not yet investigated if column data that is generated via render functions is affected, or whether it's just the columns that are passed through by Datatables.

Investigate how this has been addressed elsewhere in Koha. Also, possible mitigations can be seen here: https://datatables.net/manual/security
Comment 1 Katrin Fischer 2019-02-04 17:54:48 UTC
Wondering about this one - it currently blocks any progress on the ILL graph. 
Is it in the right spot of the graph?
Should it be in Koha security?
Comment 2 Andrew Isherwood 2019-02-05 17:10:08 UTC
Hi Katrin - I've now moved it to the top of the dependency tree, I'm going to try and get a fix out in the next day or two.
Comment 3 Andrew Isherwood 2019-02-08 11:17:35 UTC
This has been now fixed in bug 21063, which is the bug that introduced as a problem. I am therefore marking this as a duplicate.

*** This bug has been marked as a duplicate of bug 21063 ***