http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=11944 Assignee|gmcharlt@gmail.com |dpavlin@rot13.org -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 --- Comment #1 from Dobrica Pavlinusic <dpavlin@rot13.org> --- Created attachment 36445 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=36445&action=edit Bug 13789 - facets with accented utf-8 characters generate double encoded links Bug 13425 tried to fix XSS in OPAC, but as result it double encoded strings in facets and made links with accented characters (which where encoded by url filter) broken. This is just a test commit to see wheater removing url filter fixes this (it does), but it also re-introduces XSS bug so it's not ready for signoff. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #36445|0 |1 is obsolete| | --- Comment #2 from Dobrica Pavlinusic <dpavlin@rot13.org> --- Created attachment 36477 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=36477&action=edit Bug 13789 - facets with accented utf-8 characters generate double encoded links Bug 13425 tried to fix XSS in OPAC, by using url filter in template toolkit on whole generated url. This doesn't work and create double encoded strings in facets because we are creating url variable by concatenating query_cgi (which did pass through uri_escape_utf8 on perl side) and other parameters which have to be escaped in template. Also, code like [% SET limit_cgi_f = limit_cgi | url %] doesn't do anything (at least doesn't apply url filter) so it's not needed. Test scenario: 1. find results in your opac which contain accented characters 2. click on them and verify that results are missing 3. apply this patch 4. re-run search and click on facets link verifying that there are now results 5. verify that facets are still safe from injection by constructing url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123 and verifying that you DON'T see prompt window in your browser -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |In Discussion -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #36501|0 |1 is obsolete| | --- Comment #5 from Dobrica Pavlinusic <dpavlin@rot13.org> --- Created attachment 36540 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=36540&action=edit Bug 13789 - facets with accented utf-8 characters generate double encoded links Bug 13425 tried to fix XSS in OPAC, by using url filter in template toolkit on whole generated url. This doesn't work and create double encoded strings in facets because we are creating url variable by concatenating query_cgi (which did pass through uri_escape_utf8 on perl side) and other parameters which have to be escaped in template. Also, code like [% SET limit_cgi_f = limit_cgi | url %] doesn't do anything (at least doesn't apply url filter) so it's not needed. This patch also fixes encoding of hidden fields used in sort by form. And lastly, it tries to make facet changes for opac and intranet as same as possible to simplify future maintencence of this code. Test scenario: 1. find results in your opac which contain accented characters 2. click on them and verify that results are missing 3. apply this patch 4. re-run search and click on facets link verifying that there are now results 5. test sort by form and verify that results are ok 6. verify that facets are still safe from injection by constructing url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123 and verifying that you DON'T see prompt window in your browser -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #36540|0 |1 is obsolete| | --- Comment #7 from Dobrica Pavlinusic <dpavlin@rot13.org> --- Created attachment 36611 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=36611&action=edit Bug 13789 - facets with accented utf-8 characters generate double encoded links Bug 13425 tried to fix XSS in OPAC, by using url filter in template toolkit on whole generated url. This doesn't work and create double encoded strings in facets because we are creating url variable by concatenating query_cgi (which did pass through uri_escape_utf8 on perl side) and other parameters which have to be escaped in template. Also, code like [% SET limit_cgi_f = limit_cgi | url %] doesn't do anything (at least doesn't apply url filter) so it's not needed. This patch also fixes encoding of hidden fields used in sort by form. And lastly, it tries to make facet changes for opac and intranet as same as possible to simplify future maintencence of this code. Test scenario: 1. find results in your opac which contain accented characters 2. click on them and verify that results are missing 3. apply this patch 4. re-run search and click on facets link verifying that there are now results 5. test sort by form and verify that results are ok 6. verify that facets are still safe from injection by constructing url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123 and verifying that you DON'T see prompt window in your browser -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |major --- Comment #9 from Jonathan Druart <jonathan.druart@biblibre.com> --- Bumping the severity since it's a regression. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #36616|0 |1 is obsolete| | --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 36638 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=36638&action=edit [PASSED QA] Bug 13789 - facets with accented utf-8 characters generate double encoded links Bug 13425 tried to fix XSS in OPAC, by using url filter in template toolkit on whole generated url. This doesn't work and create double encoded strings in facets because we are creating url variable by concatenating query_cgi (which did pass through uri_escape_utf8 on perl side) and other parameters which have to be escaped in template. Also, code like [% SET limit_cgi_f = limit_cgi | url %] doesn't do anything (at least doesn't apply url filter) so it's not needed. This patch also fixes encoding of hidden fields used in sort by form. And lastly, it tries to make facet changes for opac and intranet as same as possible to simplify future maintencence of this code. Test scenario: 1. find results in your opac which contain accented characters 2. click on them and verify that results are missing 3. apply this patch 4. re-run search and click on facets link verifying that there are now results 5. test sort by form and verify that results are ok 6. verify that facets are still safe from injection by constructing url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123 and verifying that you DON'T see prompt window in your browser Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable CC| |chris@bigballofwax.co.nz --- Comment #12 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.18.x will be in 3.18.5 -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13789 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |Pushed to Master --- Comment #14 from Chris Cormack <chris@bigballofwax.co.nz> --- Good catch, reverted -- You are receiving this mail because: You are watching all bug changes.