https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39882 --- Comment #27 from David Cook <dcook@prosentient.com.au> --- Comment on attachment 204565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204565 Bug 39882: Add ability to mask phone numbers on memberentry.pl Review of attachment 204565: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=39882&attachment=204565) ----------------------------------------------------------------- ::: koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ +1648,5 @@
+ const pattern = "[% Koha.Preference('PhoneMaskPattern') | $raw %]"; + const fields = "[% Koha.Preference('PhoneMaskFields') | $raw %]"; + + if (pattern && fields) { + const mask = [[% Koha.Preference('PhoneMaskPattern') | $raw %]];
All these "[% Koha.Preference('PhoneMaskFields') | $raw %]" and "[% Koha.Preference('PhoneMaskPattern') | $raw %]"lines are XSS vulnerabilities that could lead to account takeover. Even if you were using CSP, the Javascript being generated is "trusted", so a malicious payload would still execute. While technically this code is meeting the JS19 coding guideline ( https://wiki.koha-community.org/wiki/Coding_Guidelines#JS19:_Avoid_Template:... ), that guideline is currently incomplete, and changes will be coming in the future. I'll have to take a look at the proposed patterns to see what would be the appropriate filter instead of $raw... -- You are receiving this mail because: You are watching all bug changes.