File: koha-18.11.08/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc $("#ulactioncontainer > ul > li > a.addtoshelf").on("click",function(){ Dopop('opac-addbybiblionumber.pl?biblionumber=[% biblionumber | html %]'); return false; }); Vulnerable parameter: biblionumber||bib PoC: http://example/cgi-bin/koha/opac-imageviewer.pl?bib=x%27)})%3balert(1)%3b%20$(%27x%27).on(%27x%27,function(){x(%27 Note: Images have to be enabled for the catalog, otherwise bib||biblionumber wont be included in the page source code.
Confirmed on master.
Created attachment 92196 [details] [review] Bug 23451: Prevent XSS vulnerabilities in opac-imageviewer.pl And certainly in other sripts as it is in opac-bottom.inc
Created attachment 92197 [details] [review] Bug 23451: Fix other similar wrong filterings
Created attachment 93219 [details] [review] Bug 23451: Prevent XSS vulnerabilities in opac-imageviewer.pl And certainly in other sripts as it is in opac-bottom.inc Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Created attachment 93220 [details] [review] Bug 23451: Fix other similar wrong filterings Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Created attachment 93232 [details] [review] Bug 23451: Prevent XSS vulnerabilities in opac-imageviewer.pl And certainly in other sripts as it is in opac-bottom.inc Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 93233 [details] [review] Bug 23451: Fix other similar wrong filterings Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
I have applied this to 18.05.x, resolved some conflicts (mostly just putting the filters on what we were using on 18.05) and can release this at any time.
cannot rebase this one for 18.11.x, can anyone help me out?
Created attachment 94414 [details] [review] Bug 23451: [18.11.x] Prevent XSS vulnerabilities in opac-imageviewer.pl And certainly in other sripts as it is in opac-bottom.inc Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 94415 [details] [review] Bug 23451: [18.11.x] Fix other similar wrong filterings Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment on attachment 93233 [details] [review] Bug 23451: Fix other similar wrong filterings Review of attachment 93233 [details] [review]: ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt @@ +560,4 @@ > [% END # if TagsInputEnabled %] > > [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername && ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %] > + <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | uri %]'); return false;">Save to lists</a></span> There's still a case of a html filter in a uri here.. was that deliberate?
Nope, must be uri as well!
Corrected the above on pushing to 19.05.x after a quick double check with Jonathan.
Nice work! Pushed to master for 19.11.00
Great job!