Bug 26102 - Javascript injection in intranet search
Summary: Javascript injection in intranet search
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 30044
  Show dependency treegraph
 
Reported: 2020-07-30 09:25 UTC by Joonas Kylmälä
Modified: 2022-08-03 17:29 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.02,21.05.09,20.11.14,19.11.25


Attachments
Bug 26102: Prevent XSS when To.json is used (15.35 KB, patch)
2020-07-30 12:00 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt (1.21 KB, patch)
2020-08-11 15:49 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt (1.25 KB, patch)
2020-08-11 15:49 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (1.46 KB, patch)
2020-08-11 15:49 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt (1.10 KB, patch)
2020-08-11 15:49 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt (1.20 KB, patch)
2020-08-11 15:49 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt (1.42 KB, patch)
2020-08-11 15:50 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: suggester_search.tt (1.24 KB, patch)
2020-08-11 15:50 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt (5.45 KB, patch)
2020-08-11 17:29 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt (1.19 KB, patch)
2021-04-15 15:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt (1.25 KB, patch)
2021-04-15 15:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (1.61 KB, patch)
2021-04-15 15:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt (1.10 KB, patch)
2021-04-15 15:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt (1.20 KB, patch)
2021-04-15 15:39 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt (1.42 KB, patch)
2021-04-15 15:39 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt (5.45 KB, patch)
2021-04-15 15:39 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt (1.24 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt (1.30 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (1.65 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt (1.15 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt (1.24 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt (1.47 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt (5.49 KB, patch)
2021-11-15 18:44 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt (1.30 KB, patch)
2021-12-19 13:54 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt (1.36 KB, patch)
2021-12-19 13:54 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (1.72 KB, patch)
2021-12-19 13:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt (1.21 KB, patch)
2021-12-19 13:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt (1.31 KB, patch)
2021-12-19 13:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt (1.53 KB, patch)
2021-12-19 13:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt (5.56 KB, patch)
2021-12-19 13:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt (1.38 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt (1.65 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (2.15 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt (1.39 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt (1.20 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt (6.81 KB, patch)
2022-02-21 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt (1.44 KB, patch)
2022-02-22 00:36 UTC, wainuiwitikapark
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt (1.72 KB, patch)
2022-02-22 00:41 UTC, wainuiwitikapark
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt (2.23 KB, patch)
2022-02-22 00:50 UTC, wainuiwitikapark
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt (1.46 KB, patch)
2022-02-22 00:50 UTC, wainuiwitikapark
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt (1.27 KB, patch)
2022-02-22 00:51 UTC, wainuiwitikapark
Details | Diff | Splinter Review
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt (6.88 KB, patch)
2022-02-22 00:51 UTC, wainuiwitikapark
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Joonas Kylmälä 2020-07-30 09:25:33 UTC
If I click in intranet "search the catalog" and type the following string

"<script>alert(1);</script><script>alert(1);</script>"

(with the quotes included) and then press enter I get the alert meaning javascript is executed from user input. This is bad because a library might receive a book with malicious barcode and those barcodes are automatically scanned and entered with a barcode reader directly to the search box.
Comment 1 Jonathan Druart 2020-07-30 12:00:15 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2020-07-30 12:03:10 UTC
This patch should fixed the issue you reported, but then I found other occurrences.
It can be tricky to test them all (which I did not do), and hard to make sure it won't introduce regressions.

For each of the occurrences, git history must be examined to confirm we won't reintroduce an issue we fixed earlier.

Leaving the patch here for now, but it's ready to test if anyone is willing to give it a try.

Basically we want to test: <script>, quotes and correct utf8 encoding
Comment 3 Owen Leonard 2020-08-11 15:49:44 UTC Comment hidden (obsolete)
Comment 4 Owen Leonard 2020-08-11 15:49:47 UTC Comment hidden (obsolete)
Comment 5 Owen Leonard 2020-08-11 15:49:50 UTC Comment hidden (obsolete)
Comment 6 Owen Leonard 2020-08-11 15:49:54 UTC Comment hidden (obsolete)
Comment 7 Owen Leonard 2020-08-11 15:49:57 UTC Comment hidden (obsolete)
Comment 8 Owen Leonard 2020-08-11 15:50:00 UTC Comment hidden (obsolete)
Comment 9 Owen Leonard 2020-08-11 15:50:03 UTC Comment hidden (obsolete)
Comment 10 Owen Leonard 2020-08-11 16:02:08 UTC
A couple of files in the original patch will break if they're updated and should be safe if left alone:

koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt

The data being processed by To.json is coming from Koha data like branch codes, authorized values, etc.

Updating the filter on members/memberentrygen.tt makes the page break. Having the filter as "$raw" leaves the possibility of an XSS attack but it's convoluted:

 1. Put the XSS <script> tag in to a field of an existing patron.
 2. Create a new patron.
 3. Fill in details for the patron which will trigger a "duplicate
    patron" warning.
 4. Add as a guarantor on that record the patron from step 1.
 5. Save the new patron record.
 6. When the patron entry form is re-displayed with the duplicate
    patron warning message the <script> from step 1 will run.

These files which were changed in the original patch need to be addressed in a follow-up:

/prog/en/includes/js_includes.inc
/value_builder/unimarc_field_4XX.tt
/bootstrap/en/modules/sco/sco-main.tt
Comment 11 Owen Leonard 2020-08-11 16:48:16 UTC
I think the change to js_includes.inc and sco-main.tt are also unnecessary. The data being processed by the filter is coming directly from the Audio Alerts system preference:

[{\"selector\":\".audio-alert-action\",\"id\":1}]

You could insert a <script> tag into the "selector" field but you'd have to be a Koha admin to do it.
Comment 12 Owen Leonard 2020-08-11 17:29:35 UTC Comment hidden (obsolete)
Comment 13 Fridolin Somers 2020-09-29 08:30:59 UTC
Just to understand, in koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
  -[%~ To.json( address ) | $raw ~%]
  +[%~ address | html | $To ~%]

Why not :
  -[%~ To.json( address ) | $raw ~%]
  +[%~ To.json( address ) | html ~%]
Comment 14 Jonathan Druart 2020-10-01 07:54:41 UTC Comment hidden (obsolete)
Comment 15 Jonathan Druart 2020-10-01 07:55:02 UTC
Because it must be html escaped first.

Please try:
<script>alert('booh! ❤');</script>

Note that: <script>alert("booh! ❤");</script>
still does not work.
Comment 16 Fridolin Somers 2020-10-07 06:47:54 UTC
(In reply to Jonathan Druart from comment #15)
> Because it must be html escaped first.
> 
> Please try:
> <script>alert('booh! ❤');</script>
> 
> Note that: <script>alert("booh! ❤");</script>
> still does not work.

Ah indeed i understand now, koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt generates a JSON.

Thanks ;)
Comment 17 Fridolin Somers 2020-10-07 06:56:21 UTC
Ah but in other places, (In reply to Jonathan Druart from comment #15)
> Because it must be html escaped first.
Sorry but why not always in this order, why only for tables ?
Comment 18 Jonathan Druart 2020-10-12 08:36:13 UTC
Please try the different filter combinations to understand it :)
Comment 19 Owen Leonard 2021-04-15 15:38:46 UTC
Created attachment 119643 [details] [review]
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt

Test that preference search term highlighting works correctly.
Comment 20 Owen Leonard 2021-04-15 15:38:50 UTC
Created attachment 119644 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt

Check that mandatory tags and subfields are correctly required when
editing an authority record.
Comment 21 Owen Leonard 2021-04-15 15:38:54 UTC
Created attachment 119645 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.
Comment 22 Owen Leonard 2021-04-15 15:38:59 UTC
Created attachment 119646 [details] [review]
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt

To test, perform a search in the catalogue and verify that search term
highlighting works correctly.
Comment 23 Owen Leonard 2021-04-15 15:39:03 UTC
Created attachment 119647 [details] [review]
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.
Comment 24 Owen Leonard 2021-04-15 15:39:07 UTC
Created attachment 119648 [details] [review]
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt

Test the process of adding a subscription, entering both a valid vendor
ID and a non-existent vendor ID. The non-existent vendor ID should
trigger a validation alert.
Comment 25 Owen Leonard 2021-04-15 15:39:11 UTC
Created attachment 119649 [details] [review]
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt

To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.
Comment 26 Owen Leonard 2021-11-04 10:45:05 UTC
Amazingly, these patches still apply!
Comment 27 Nick Clemens 2021-11-15 18:44:08 UTC
Created attachment 127669 [details] [review]
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt

Test that preference search term highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 28 Nick Clemens 2021-11-15 18:44:12 UTC
Created attachment 127670 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt

Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 29 Nick Clemens 2021-11-15 18:44:15 UTC
Created attachment 127671 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 30 Nick Clemens 2021-11-15 18:44:19 UTC
Created attachment 127672 [details] [review]
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt

To test, perform a search in the catalogue and verify that search term
highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 31 Nick Clemens 2021-11-15 18:44:23 UTC
Created attachment 127673 [details] [review]
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 32 Nick Clemens 2021-11-15 18:44:26 UTC
Created attachment 127674 [details] [review]
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt

Test the process of adding a subscription, entering both a valid vendor
ID and a non-existent vendor ID. The non-existent vendor ID should
trigger a validation alert.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 33 Nick Clemens 2021-11-15 18:44:29 UTC
Created attachment 127675 [details] [review]
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt

To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 34 Katrin Fischer 2021-12-19 13:54:50 UTC
Created attachment 128716 [details] [review]
Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt

Test that preference search term highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 35 Katrin Fischer 2021-12-19 13:54:55 UTC
Created attachment 128717 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt

Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 36 Katrin Fischer 2021-12-19 13:55:00 UTC
Created attachment 128718 [details] [review]
Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 37 Katrin Fischer 2021-12-19 13:55:04 UTC
Created attachment 128719 [details] [review]
Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt

To test, perform a search in the catalogue and verify that search term
highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 38 Katrin Fischer 2021-12-19 13:55:09 UTC
Created attachment 128720 [details] [review]
Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 39 Katrin Fischer 2021-12-19 13:55:14 UTC
Created attachment 128721 [details] [review]
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt

Test the process of adding a subscription, entering both a valid vendor
ID and a non-existent vendor ID. The non-existent vendor ID should
trigger a validation alert.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 40 Katrin Fischer 2021-12-19 13:55:19 UTC
Created attachment 128722 [details] [review]
Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt

To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 41 Victor Grousset/tuxayo 2022-01-21 01:44:57 UTC
Backported: Pushed to 20.11.x-security branch for 20.11.14

I checked that the attack doesn't work anymore on intranet search. And on the address of the guarantor search result.

And was able to check that basic usage still works using what was written in the commit messages.
Note: a unimarc env was used for «Prevent XSS when To.json is used: unimarc_field_4XX.tt» and 410$a is already setup to use the plugin. IMHO other RMaints not need to worry about checking this one if they don't have a straightforward way to have an unimarc env.
Comment 42 wainuiwitikapark 2022-01-25 02:28:07 UTC
Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release.
Comment 43 Andrew Fuerste-Henry 2022-01-26 20:09:50 UTC
Pushed to security/21.05.x for 21.05.09
Comment 44 wainuiwitikapark 2022-02-21 05:01:25 UTC
Reverted commits on 19.11.x
Comment 45 Katrin Fischer 2022-02-21 08:12:41 UTC
(In reply to wainuiwitikapark from comment #44)
> Reverted commits on 19.11.x

We have a problem reported with this patch set on bug 30044 - so we probably need a follow-up or adjusted set of patches.
Comment 46 Jonathan Druart 2022-02-21 09:23:04 UTC
Created attachment 130931 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt

Test that preference search term highlighting works correctly.
Comment 47 Jonathan Druart 2022-02-21 09:23:09 UTC
Created attachment 130932 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt

Check that mandatory tags and subfields are correctly required when
editing an authority record.
Comment 48 Jonathan Druart 2022-02-21 09:23:14 UTC
Created attachment 130933 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.
Comment 49 Jonathan Druart 2022-02-21 09:23:20 UTC
Created attachment 130934 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt

To test, perform a search in the catalogue and verify that search term
highlighting works correctly.
Comment 50 Jonathan Druart 2022-02-21 09:23:26 UTC
Created attachment 130935 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.
Comment 51 Jonathan Druart 2022-02-21 09:23:33 UTC
Created attachment 130936 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt

To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.
Comment 52 Jonathan Druart 2022-02-21 09:24:07 UTC
Patches adjusted for 19.11.

The following patch is not relevant for this branch:
Bug 26102: Prevent XSS when To.json is used: subscription-add.tt
Comment 53 wainuiwitikapark 2022-02-22 00:36:33 UTC
Created attachment 130999 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt

Test that preference search term highlighting works correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 54 wainuiwitikapark 2022-02-22 00:41:41 UTC
Created attachment 131000 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt

Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 55 wainuiwitikapark 2022-02-22 00:50:10 UTC
Created attachment 131001 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 56 wainuiwitikapark 2022-02-22 00:50:47 UTC
Created attachment 131002 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt

To test, perform a search in the catalogue and verify that search term
highlighting works correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 57 wainuiwitikapark 2022-02-22 00:51:22 UTC
Created attachment 131003 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 58 wainuiwitikapark 2022-02-22 00:51:47 UTC
Created attachment 131004 [details] [review]
Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt

To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Comment 59 wainuiwitikapark 2022-02-22 00:52:46 UTC
Applied 19.11 patches to 19.11.x branch