[Bug 37861] New: Fix XSS vulnerability in barcode append function
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Bug ID: 37861 Summary: Fix XSS vulnerability in barcode append function Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P4 Component: Circulation Assignee: artur.norrby@gmail.com Reporter: artur.norrby@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 --- Comment #1 from Artur <artur.norrby@gmail.com> --- Created attachment 171164 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171164&action=edit Fix XSS vulnerability by sanitizing user input in barcode append function. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Artur <artur.norrby@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Artur <artur.norrby@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171164|application/mbox |text/plain mime type| | Attachment #171164|0 |1 is patch| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Artur <artur.norrby@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #171164|0 |1 is obsolete| | Attachment #171164|1 |0 is patch| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 --- Comment #2 from Artur <artur.norrby@gmail.com> --- Created attachment 171165 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=171165&action=edit Fix XSS vulnerability by sanitizing user input in barcode append function. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Group|Koha security | QA Contact| |testopia@bugs.koha-communit | |y.org Version|unspecified |Main Component|Koha |Architecture, internals, | |and plumbing Product|Koha security |Koha Version(s)| |24.11.00,24.05.05,23.11.10, released in| |23.05.16,22.11.22 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to oldoldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED CC| |david@davidnind.com Resolution|--- |FIXED --- Comment #21 from David Nind <david@davidnind.com> --- Bug fix, not covered in the manual - no update required. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37861 Abdivasiyev Sunnatillo <abdivasiyevsunnatillo2008@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abdivasiyevsunnatillo2008@g | |mail.com -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org