[Bug 6632] New: [security] XXS on list name (on admin part)
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Bug #: 6632 Summary: [security] XXS on list name (on admin part) Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_4 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P5 Component: Templates AssignedTo: oleonard@myacpl.org ReportedBy: semarie-koha@latrappe.fr QAContact: koha-bugs@lists.koha-community.org There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part. In order to test: 1. on opac, create a new list named 'a <blink>simple</blink> list' 2. log as admin on staff part. 3. go to Lists 4. select the list named 'a <blink>simple</blink> list' (no XXS here) 5. the 'simple' word *blink* on 3 places The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 --- Comment #1 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2011-07-27 11:14:33 UTC --- Created attachment 4752 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4752 Proposed patch Here a patch for TT page in admin. 'html' filter was added to each 'shelvename'. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Frère Sébastien Marie <semarie-koha@latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Frère Sébastien Marie <semarie-koha@latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 --- Comment #2 from Liz Rea <wizzyrea@gmail.com> 2011-07-27 18:47:16 UTC --- Created attachment 4756 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4756 Bug 6632 [Signed Off] add html filter to prevent XSS The filter 'html' have been added on all occurences of shelvename, which come from user input. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4752|0 |1 is obsolete| | -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED CC| |wizzyrea@gmail.com Patch Status|Needs Signoff |Signed Off --- Comment #3 from Liz Rea <wizzyrea@gmail.com> 2011-07-27 18:48:15 UTC --- Bug confirmed, fix signed off. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz Patch Status|Signed Off |Patch Pushed --- Comment #4 from Chris Cormack <chris@bigballofwax.co.nz> 2011-07-27 20:43:13 UTC --- XSS fix, pushed -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Ian Walls <ian.walls@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |7310 -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6632 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|PATCH-Sent (DO NOT USE) |P5 - low Status|Pushed to Master |RESOLVED Resolution|--- |FIXED Assignee|oleonard@myacpl.org |semarie-koha@latrappe.fr -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org