From bugzilla-daemon@bugs.koha-community.org Mon Mar 6 04:11:16 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] New: Authority lookup in advanced editor overencodes HTML Date: Mon, 06 Mar 2023 03:11:15 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0048196048636641562==" --===============0048196048636641562== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D33144 Bug ID: 33144 Summary: Authority lookup in advanced editor overencodes HTML Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: jonathan.druart+koha@gmail.com, m.de.rooy@rijksmuseum.nl Depends on: 26102 Bug 26102 prevented XSS via malicious authority records (which would have been fun to exploit), but it did it by creating an HTML entity-encoded string and then handing it to a function which expected to get text, not HTML. As a result, if you look up the authority record for Simon & Schuster Audio (Firm) from the advanced editor, you wind up putting Simon & Schuster Audio (Fir= m) in your bib record. Steps to reproduce: 1. Set EnableAdvancedCatalogingEditor to Enable 2. Edit any Topical Term authority record, and at the end of 150 subfield a a= dd (without the newlines, just offsetting it for easy copying) & Stuff 3. Cataloging - Advanced Editor 4. Hit return in the editor to get a new line, type 650 and press tab three times, then Ctrl+Shift+L 5. Search for the authority you edited, click Choose Expected result: The editor should show 650 _ 4 =E2=80=A1aAbduction & Stuff =E2=80=A1vDrama. since that's the text of the authority y= ou selected Actual result: The editor shows 650 _ 4 =E2=80=A1aAbduction & Stuff </script> <script>alert('boo =E2=9D=A4');</script>=E2=80=A1vDrama. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D26102 [Bug 26102] Javascript injection in intranet search --=20 You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============0048196048636641562==-- From bugzilla-daemon@bugs.koha-community.org Mon Mar 6 06:47:46 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Mon, 06 Mar 2023 05:47:44 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4623832349208594758==" --===============4623832349208594758== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Phil Ringnalda changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============4623832349208594758==-- From bugzilla-daemon@bugs.koha-community.org Mon Mar 6 06:47:56 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Mon, 06 Mar 2023 05:47:47 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3907465245366414615==" --===============3907465245366414615== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 --- Comment #1 from Phil Ringnalda --- Created attachment 147776 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=147776&action=edit Bug 33144: Unescape text from authority lookup for advanced editor While the basic editor is happy with an array of subfields it can stuff into separate fields, the advanced editor needs to get a JS string back from the authority lookup plugin, because it is going to just add the whole thing as text. The string has to be HTML entity encoded, both to not allow XSS and just to not break the window, but it needs to then be unencoded before being inserted into the editor. Test plan: 1. Set the system preference EnableAdvancedCatalogingEditor to Enable 2. Edit any Topical Term authority, and at the end of tag 150 subfield a, add & 3. Cataloging - Advanced editor 4. Press return in the editor to get a new blank line, type 650 and press tab three times, then type Ctrl-Shift-L 5. Search for your modified authority, and click Choose 6. Verify that the tiny popup opened by the search window finished its job and closed itself 7. Verify that your 650 now shows as "‡aAbduction & ‡vDrama" rather than "‡aAbduction & </script>‡vDrama." -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============3907465245366414615==-- From bugzilla-daemon@bugs.koha-community.org Mon Mar 6 06:48:35 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Mon, 06 Mar 2023 05:48:34 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5336682650956920785==" --===============5336682650956920785== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D33144 --- Comment #2 from Phil Ringnalda --- I'm no expert in assessing the XSS risks of code copy-pasted from Stack Overflow, but I've been reading Wladimir's writing on security and running his code for years, so I'd trust https://stackoverflow.com/questions/1912501/unescape-html-entities-in-javascr= ipt/34064434#34064434 and in fact we already do that same thing in https://git.koha-community.org/Koha-community/Koha/src/commit/fe872b792037ee2= f8cce0d25f95c1e4f739ffe49/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-resul= ts.tt#L820 --=20 You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug. --===============5336682650956920785==-- From bugzilla-daemon@bugs.koha-community.org Mon Mar 6 06:49:26 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Mon, 06 Mar 2023 05:49:26 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6579062874446264030==" --===============6579062874446264030== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Phil Ringnalda changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |phil@chetcolibrary.org |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. --===============6579062874446264030==-- From bugzilla-daemon@bugs.koha-community.org Tue Mar 7 10:31:37 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Tue, 07 Mar 2023 09:31:36 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8212232656680700483==" --===============8212232656680700483== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Jonathan Druart changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes. --===============8212232656680700483==-- From bugzilla-daemon@bugs.koha-community.org Tue Mar 7 10:31:47 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Tue, 07 Mar 2023 09:31:39 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6149413798649114463==" --===============6149413798649114463== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Jonathan Druart changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #147776|0 |1 is obsolete| | --- Comment #3 from Jonathan Druart --- Created attachment 147817 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=147817&action=edit Bug 33144: Unescape text from authority lookup for advanced editor While the basic editor is happy with an array of subfields it can stuff into separate fields, the advanced editor needs to get a JS string back from the authority lookup plugin, because it is going to just add the whole thing as text. The string has to be HTML entity encoded, both to not allow XSS and just to not break the window, but it needs to then be unencoded before being inserted into the editor. Test plan: 1. Set the system preference EnableAdvancedCatalogingEditor to Enable 2. Edit any Topical Term authority, and at the end of tag 150 subfield a, add & 3. Cataloging - Advanced editor 4. Press return in the editor to get a new blank line, type 650 and press tab three times, then type Ctrl-Shift-L 5. Search for your modified authority, and click Choose 6. Verify that the tiny popup opened by the search window finished its job and closed itself 7. Verify that your 650 now shows as "‡aAbduction & ‡vDrama" rather than "‡aAbduction & </script>‡vDrama." Signed-off-by: Jonathan Druart -- You are receiving this mail because: You are watching all bug changes. --===============6149413798649114463==-- From bugzilla-daemon@bugs.koha-community.org Thu Mar 9 23:09:31 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 09 Mar 2023 22:09:30 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2932420669229672631==" --===============2932420669229672631== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Katrin Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |katrin.fischer@bsz-bw.de |y.org | -- You are receiving this mail because: You are watching all bug changes. --===============2932420669229672631==-- From bugzilla-daemon@bugs.koha-community.org Thu Mar 9 23:16:44 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 09 Mar 2023 22:16:43 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7736159049282429576==" --===============7736159049282429576== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Katrin Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA Patch complexity|--- |Small patch -- You are receiving this mail because: You are watching all bug changes. --===============7736159049282429576==-- From bugzilla-daemon@bugs.koha-community.org Thu Mar 9 23:16:54 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 09 Mar 2023 22:16:46 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0773422799104624331==" --===============0773422799104624331== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Katrin Fischer changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #147817|0 |1 is obsolete| | --- Comment #4 from Katrin Fischer --- Created attachment 148038 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=148038&action=edit Bug 33144: Unescape text from authority lookup for advanced editor While the basic editor is happy with an array of subfields it can stuff into separate fields, the advanced editor needs to get a JS string back from the authority lookup plugin, because it is going to just add the whole thing as text. The string has to be HTML entity encoded, both to not allow XSS and just to not break the window, but it needs to then be unencoded before being inserted into the editor. Test plan: 1. Set the system preference EnableAdvancedCatalogingEditor to Enable 2. Edit any Topical Term authority, and at the end of tag 150 subfield a, add & 3. Cataloging - Advanced editor 4. Press return in the editor to get a new blank line, type 650 and press tab three times, then type Ctrl-Shift-L 5. Search for your modified authority, and click Choose 6. Verify that the tiny popup opened by the search window finished its job and closed itself 7. Verify that your 650 now shows as "‡aAbduction & ‡vDrama" rather than "‡aAbduction & </script>‡vDrama." Signed-off-by: Jonathan Druart Signed-off-by: Katrin Fischer -- You are receiving this mail because: You are watching all bug changes. --===============0773422799104624331==-- From bugzilla-daemon@bugs.koha-community.org Tue Mar 14 13:12:03 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Tue, 14 Mar 2023 12:10:40 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3731150187589073815==" --===============3731150187589073815== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Tomás Cohen Arazi changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |23.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes. --===============3731150187589073815==-- From bugzilla-daemon@bugs.koha-community.org Tue Mar 14 13:12:13 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Tue, 14 Mar 2023 12:10:41 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9184859563285463306==" --===============9184859563285463306== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 --- Comment #5 from Tomás Cohen Arazi --- Pushed to master for 23.05. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes. --===============9184859563285463306==-- From bugzilla-daemon@bugs.koha-community.org Thu Mar 16 20:50:55 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 16 Mar 2023 19:49:16 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2064887033814755461==" --===============2064887033814755461== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Jacob O'Mara changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|23.05.00 |23.05.00,22.11.04 released in| | Status|Pushed to master |Pushed to stable -- You are receiving this mail because: You are watching all bug changes. --===============2064887033814755461==-- From bugzilla-daemon@bugs.koha-community.org Thu Mar 16 20:51:05 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 16 Mar 2023 19:49:17 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8140238293008118833==" --===============8140238293008118833== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 --- Comment #6 from Jacob O'Mara --- Nice work, thanks everyone! Pushed to 22.11.x for the next release. -- You are receiving this mail because: You are watching all bug changes. --===============8140238293008118833==-- From bugzilla-daemon@bugs.koha-community.org Fri Apr 14 20:12:37 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Fri, 14 Apr 2023 18:12:36 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3585609527808544716==" --===============3585609527808544716== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Lucas Gass changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable Version(s)|23.05.00,22.11.04 |23.05.00,22.11.04,22.05.12 released in| | CC| |lucas@bywatersolutions.com --- Comment #7 from Lucas Gass --- Backported to 22.05.x for upcoming 22.05.12 -- You are receiving this mail because: You are watching all bug changes. --===============3585609527808544716==-- From bugzilla-daemon@bugs.koha-community.org Thu Apr 20 11:16:14 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 20 Apr 2023 09:16:13 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6726364386542076033==" --===============6726364386542076033== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Arthur Suzuki changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com Version(s)|23.05.00,22.11.04,22.05.12 |23.05.00,22.11.04,22.05.12, released in| |21.11.20 Status|Pushed to oldstable |Pushed to oldoldstable --- Comment #8 from Arthur Suzuki --- applied to 21.11.x for 21.11.20 -- You are receiving this mail because: You are watching all bug changes. --===============6726364386542076033==-- From bugzilla-daemon@bugs.koha-community.org Thu Apr 27 07:58:56 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Thu, 27 Apr 2023 05:58:55 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4623326278747735717==" --===============4623326278747735717== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 wainuiwitikapark@catalyst.net.nz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #9 from wainuiwitikapark@catalyst.net.nz --- Not backported to 21.05.x -- You are receiving this mail because: You are watching all bug changes. --===============4623326278747735717==-- From bugzilla-daemon@bugs.koha-community.org Wed Nov 1 01:04:21 2023 From: bugzilla-daemon@bugs.koha-community.org To: koha-bugs@lists.koha-community.org Subject: [Koha-bugs] [Bug 33144] Authority lookup in advanced editor overencodes HTML Date: Wed, 01 Nov 2023 00:04:20 +0000 Message-ID: In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8169189166808148123==" --===============8169189166808148123== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33144 Phil Ringnalda changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldoldstable |RESOLVED -- You are receiving this mail because: You are watching all bug changes. --===============8169189166808148123==--