From bugzilla-daemon@bugs.koha-community.org Mon Feb 4 14:59:40 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] New: Data displayed in request list datatable is not sanitized Date: Mon, 04 Feb 2019 13:59:10 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6328291199117946813==" --===============6328291199117946813== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D22268 Bug ID: 22268 Summary: Data displayed in request list datatable is not sanitized Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs@lists.koha-community.org Reporter: andrew.isherwood@ptfs-europe.com Target Milestone: --- Request data displayed in the "Request view" or similar views is sanitized by the html filter in the template. However, the main request list table is generated via Datatables and is not sanitized. This can be demonstrated by entering a malicious string, such as: Into the request notes field, then displaying the requests table. I've not yet investigated if column data that is generated via render functio= ns is affected, or whether it's just the columns that are passed through by Datatables. Investigate how this has been addressed elsewhere in Koha. Also, possible mitigations can be seen here: https://datatables.net/manual/security --=20 You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============6328291199117946813==-- From bugzilla-daemon@bugs.koha-community.org Mon Feb 4 15:01:12 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Mon, 04 Feb 2019 14:01:02 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3491070717773586558==" --===============3491070717773586558== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Andrew Isherwood changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20600 Depends on| |20640 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20600 [Bug 20600] Provide the ability for users to filter ILL requests https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20640 [Bug 20640] Allow migrating a request between backends -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============3491070717773586558==-- From bugzilla-daemon@bugs.koha-community.org Mon Feb 4 15:02:38 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Mon, 04 Feb 2019 14:02:27 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8103432319751848685==" --===============8103432319751848685== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Andrew Isherwood changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |normal -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============8103432319751848685==-- From bugzilla-daemon@bugs.koha-community.org Mon Feb 4 18:54:53 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Mon, 04 Feb 2019 17:54:48 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7363517134462777079==" --===============7363517134462777079== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Katrin Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #1 from Katrin Fischer --- Wondering about this one - it currently blocks any progress on the ILL graph. Is it in the right spot of the graph? Should it be in Koha security? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============7363517134462777079==-- From bugzilla-daemon@bugs.koha-community.org Tue Feb 5 12:26:09 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Tue, 05 Feb 2019 11:25:49 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7003538120761481263==" --===============7003538120761481263== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Andrew Isherwood changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|20640 |18589 Blocks|20600 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18589 [Bug 18589] Show ILLs as part of patron profile https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20600 [Bug 20600] Provide the ability for users to filter ILL requests https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20640 [Bug 20640] Allow migrating a request between backends -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============7003538120761481263==-- From bugzilla-daemon@bugs.koha-community.org Tue Feb 5 18:10:11 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Tue, 05 Feb 2019 17:10:08 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1989874051149464837==" --===============1989874051149464837== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 --- Comment #2 from Andrew Isherwood --- Hi Katrin - I've now moved it to the top of the dependency tree, I'm going to try and get a fix out in the next day or two. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============1989874051149464837==-- From bugzilla-daemon@bugs.koha-community.org Fri Feb 8 12:17:40 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Fri, 08 Feb 2019 11:17:35 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8278717946123229401==" --===============8278717946123229401== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Andrew Isherwood changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |DUPLICATE Status|NEW |RESOLVED --- Comment #3 from Andrew Isherwood --- This has been now fixed in bug 21063, which is the bug that introduced as a problem. I am therefore marking this as a duplicate. *** This bug has been marked as a duplicate of bug 21063 *** -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============8278717946123229401==-- From bugzilla-daemon@bugs.koha-community.org Mon Apr 1 12:39:23 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Mon, 01 Apr 2019 10:39:02 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1317138977299753815==" --===============1317138977299753815== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Bug 22268 depends on bug 18589, which changed state. Bug 18589 Summary: Show ILLs as part of patron profile https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18589 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============1317138977299753815==-- From bugzilla-daemon@bugs.koha-community.org Wed May 1 12:19:03 2019 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 22268] Data displayed in request list datatable is not sanitized Date: Wed, 01 May 2019 10:18:55 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5171490985562707557==" --===============5171490985562707557== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22268 Andrew Isherwood changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|18589 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18589 [Bug 18589] Show ILLs as part of patron profile -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============5171490985562707557==--