[Bug 37655] New: Basic editor needs to HTML-escape the bib record title used as a heading
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Bug ID: 37655 Summary: Basic editor needs to HTML-escape the bib record title used as a heading Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P3 Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: phil@chetcolibrary.org QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl When you edit an existing record, the basic editor has an <h1> at the top of the page saying "Editing {bib title} (Record nnn)", which fails to HTML-escape the title. That gives you unpleasant results if the title is something like "<h2> is a second-level heading" making the entire editor an <h2>, or it gives you alarming results if someone has stuck a <script> in the title. Steps to reproduce: 1. Edit any bib record, stick <script>alert('boo ❤')</script><h2> at the end of the title in field 245 subfield a 2. Save, then edit the bib record again. 3. Oops, that alert() could have been more serious. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 --- Comment #1 from Phil Ringnalda <phil@chetcolibrary.org> --- Created attachment 170414 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170414&action=edit Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading We stick the title of a bib record you are editing in the basic editor into an <h1> without escaping any HTML it might contain. We should instead escape it. Test plan: 1. Without the patch, search for any record in the catalog and click Edit record (if you are in the advanced editor, switch to the basic one) 2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2> at the end of the subfield 3. Save, then from the record detail page select Edit - Edit record 4. You will have gotten an alert(), and the entire form will be the size of an <h2>. That's ugly, so go back to the detail page. 5. Apply patch, restart_all 6. Edit - Edit record 7. Now you should not get an alert, the whole title inluding the <script> should display in italics, and the "(Record number nnn)" after it should not be italicized. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Koha |Cataloging Group|Koha security | Product|Koha security |Koha Version(s)|24.05.04 |24.05.04,23.11.09 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.04,23.11.09 |24.11.00,24.05.04,23.11.09 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.11! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00,24.05.04,23.11.09 |24.11.00,24.05.04,23.11.09, released in| |23.11.15 Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00,24.05.04,23.11.09, |24.11.00,24.05.04,23.11.09, released in|23.11.15 |23.05.15 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Phil Ringnalda <phil@chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_22_11_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Jesse Maseto <jesse@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Pushed to oldoldoldstable CC| |jesse@bywatersolutions.com --- Comment #10 from Jesse Maseto <jesse@bywatersolutions.com> --- Pushed to 22.11.x. Will be in next point release. 22.11.25 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37655 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.11.00,24.05.04,23.11.09, |24.11.00,24.05.04,23.11.09, released in|23.05.15 |23.05.15,22.11.25 Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org