While investigating other issues, I noticed that http://localhost:8081/cgi-bin/koha/catalogue/detail.pl is vulnerable to reflected XSS.
Created attachment 174656 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the shelf browser to go to the next result 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid
Created attachment 175034 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the search result navigation box to go to the next result On the left of the page. Just bellow the breadcrumb and left of the record title. 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
It works! :) > 3. Use the shelf browser to go to the next result It seems to be about the navigation box on the left of the page. Just bellow the breadcrumb and left of the record title. (<div> with class="browse-controls") Test plan was amended to reflect this. Feel free to amend again to clarify more. Like with the proper name for the "search result navigation box".
Created attachment 176055 [details] [review] Bug 38468: Add double quotes to some template strings This change adds double quotes to some template strings where quotes are missing all together or single quotes are used incorrectly. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test 2. Click on "Gairm" 3. Use the search result navigation box to go to the next result On the left of the page. Just bellow the breadcrumb and left of the record title. 4. Note that everything loads correctly 5. To test that the security hole has been fixed, try some of the proof-of-concept attacks provided for biblionumber and searchid Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Tested on all provided example, working. QA tool happy, passing QA
(In reply to Baptiste Wojtkowski (bwoj) from comment #9) > Tested on all provided example, working. QA tool happy, passing QA Do we still need this one? See bug 38467.
(In reply to Marcel de Rooy from comment #10) > (In reply to Baptiste Wojtkowski (bwoj) from comment #9) > > Tested on all provided example, working. QA tool happy, passing QA > > Do we still need this one? See bug 38467. Yep, bug 38467 only affects the "url" and "uri" filters - not the "html" filter. I don't want to be auto-banned by Bugzilla, so I won't add the links here, but you can see the template::Manual::Filters documentation or the Template::Filters::html_filter() function for more info.
Pushed for 25.05! Well done everyone, thank you!
These patches have been included in all maintained versions, see "Version(s) released in".