]> git.koha-community.org Git - koha.git/commit
Bug 34761: Prevent XSS for searches and saved search filters
authorDavid Cook <dcook@prosentient.com.au>
Wed, 13 Sep 2023 01:33:43 +0000 (01:33 +0000)
committerMatt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Thu, 28 Sep 2023 09:18:29 +0000 (09:18 +0000)
commit4a6a8e1242410d312942c4bb93a60117d0dc2dbf
tree3fe6a54428ca7b11f3031724b7efa91ff35e5f45
parent9b68554979b46c0f46240840d120078cd17430f2
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 4e32b761986f5de28df4f1125b5d16c6c2f24306)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt