]> git.koha-community.org Git - koha.git/commit
Bug 20770: ILL loans OPAC form notes field allow arbitrary input
authorAndrew Isherwood <andrew.isherwood@ptfs-europe.com>
Tue, 15 May 2018 15:00:02 +0000 (16:00 +0100)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 30 Aug 2018 07:18:10 +0000 (09:18 +0200)
commitcdcfce4c6c1c6ad9018e620f6e8f6450c93d1900
treee1a330b14b68adbb1654f362f42f1b0bae8e6ba6
parenta641c83caba3ec75c7cccc299d3b560404f84c56
Bug 20770: ILL loans OPAC form notes field allow arbitrary input

This patch addresses the lack of sanitization of the "notes" field on
the OPAC "View Interlibrary loan request" page.

To test:

- Apply the patch
- As an OPAC user, create an ILL request
- Navigate to the request's "View Interlibrary loan request" page
- Add the following note:

  Hello
  <h1>TESTING</h1>
  <script>alert('pwned');</script>

- Click "Submit modifications"
- TEST: Observe, when the page reloads, only the following is preserved in the
"Notes" textarea:

    Hello
    TESTING

- As a staff user, naviate to the ILL requests table
- Select "Manage request" for the request you created
- TEST: Observe that the Notes field only contains:

    Hello
    TESTING

- TEST: Observe that no Javascript alert is displayed

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 552873f7d466abee6919414b8d2f5e6c99f9a44f)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit cc81442349cb07afe242607f2c40acb62e4e76fb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
koha-tmpl/intranet-tmpl/prog/css/staff-global.css
koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt