I noticed the subscription detail page is vulnerable to reflected XSS in certain conditions.
Created attachment 174658 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report
Created attachment 175058 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
It works! :)
Created attachment 176117 [details] [review] Bug 38470: Add missing double quotes to some Javascript This change adds some double quotes where quotes were missing, and replaces single quotes with double quotes, which prevents XSS. Test plan: 0. Apply the patch 1. Create a subscription 2. Using the ID from the subscription, go to this page: http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl? print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID> 3. Note that you're able to generate a print slip (You may need to allow popups) 4. To check the security vulnerability is fixed, try the proof-of-concepts attached to the bug report Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Pushed for 25.05! Well done everyone, thank you!
These patches have been included in all maintained versions, see "Version(s) released in".