]> git.koha-community.org Git - koha.git/commit
Bug 11535: sanitize input from patron self-registration form
authorGalen Charlton <gmc@esilibrary.com>
Mon, 13 Jan 2014 21:51:56 +0000 (21:51 +0000)
committerTomas Cohen Arazi <tomascohen@gmail.com>
Wed, 15 Jan 2014 14:53:24 +0000 (11:53 -0300)
commitf3bfa402fb4ff5b49ba2a11ccc2f9a27d19dfc53
tree8493b96a833c64ebd5e84d4842e7b5dbd6e6e1a0
parent01a39d6ce0b9fe2153434a9cb2802126ce39b2df
Bug 11535: sanitize input from patron self-registration form

This patch adds the use of C4::Scrubber to the processing of input
from the patron self-registration form, thereby closing off one
avenue for Javascript injection.

To test:

[1] Use the OPAC self-registration form to enter a new patron,
    and set its address to something like:

    <span style="color: red;">BAD</span>

[2] In the staff interface, bring up the new patron record.  The
    address will show up in red, indicating a successful HTML
    injection.
[3] Apply the patch and use self-registration to enter a new
    patron with a similar case of unwanted HTML coding.
[4] Bring up the second patron in the staff interface.  This time,
    the undesirable HTML tag should not be present.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tags are not present on testing.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and that the patch fixes it.
Passes all tests and QA script.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
opac/opac-memberentry.pl