[Bug 11307] New: Potential XSS attack vector in opac rss feed
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Bug ID: 11307 Summary: Potential XSS attack vector in opac rss feed Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: OPAC Assignee: oleonard@myacpl.org Reporter: chris@bigballofwax.co.nz QA Contact: testopia@bugs.koha-community.org http://demo.mykoha.co.nz/cgi-bin/koha/opac-search.pl?idx=kw&q=a&coun... If you look at the source you will see <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 23164 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23164&action=edit Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 --- Comment #2 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 23167 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23167&action=edit Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #23164|0 |1 is obsolete| | --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 23169 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23169&action=edit Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #23167|0 |1 is obsolete| | --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 23170 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23170&action=edit Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |mtompset@hotmail.com --- Comment #5 from M. Tompsett <mtompset@hotmail.com> --- Tested according to test plan given in comment #1 for prog and bootstrap themes. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #23169|0 |1 is obsolete| | Attachment #23170|0 |1 is obsolete| | --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 23175 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23175&action=edit [PASSED QA] Bug 11307 : Potential XSS attack in rss feed To test: 1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2 2/ look at the source, notice <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> 3/ apply the patch, and reload url 4/ source now contains <opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage> Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 23176 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=23176&action=edit [PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) To test: Same as first patch, but using bootstrap theme Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #8 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- All works as expected, passes QA script. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |gmcharlt@gmail.com --- Comment #9 from Galen Charlton <gmcharlt@gmail.com> --- Pushed to master and 3.14.x. Thanks, Chris! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Fridolin SOMERS <fridolyn.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |fridolyn.somers@biblibre.co | |m --- Comment #10 from Fridolin SOMERS <fridolyn.somers@biblibre.com> --- Patches will be in 3.14.1 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11307 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- This patch has been pushed to 3.12.x, will be in 3.12.8. Thanks Chris! -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org