From 950fc8e101886821879066b33e389a47fb0a9782 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Thu, 14 Sep 2017 11:52:08 -0400 Subject: [PATCH] Bug 19319: Reflected XSS Vulnerability in opac-MARCdetail.pl Try going to this URL on your site: /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"> Test Plan: 1) Go to /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"> 2) Note is embedded all over the html 3) Apply this patch 4) Refresh the page, note the injection is gone! 5) run koha qa test tools Signed-off-by: Mark Tompsett Signed-off-by: Marcel de Rooy Signed-off-by: Jonathan Druart Signed-off-by: Jonathan Druart --- .../en/includes/opac-detail-sidebar.inc | 14 ++++---- .../bootstrap/en/modules/opac-ISBDdetail.tt | 2 +- .../bootstrap/en/modules/opac-MARCdetail.tt | 12 +++---- .../bootstrap/en/modules/opac-detail.tt | 34 +++++++++---------- opac/opac-ISBDdetail.pl | 6 ++-- opac/opac-MARCdetail.pl | 2 +- opac/opac-detail.pl | 4 +-- 7 files changed, 38 insertions(+), 36 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc index 5e96b0f6bf..7ceaa9590e 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc @@ -4,7 +4,7 @@ [% IF Koha.Preference( 'opacuserlogin' ) == 1 %] [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %] [% IF ( AllowOnShelfHolds OR ItemsIssued ) %] -
  • Place hold
    • +
  • Place hold
    • [% END %] [% END %] [% END %] @@ -14,21 +14,21 @@ [% IF Koha.Preference( 'opacuserlogin' ) == 1 %] [% IF Koha.Preference('ArticleRequests') %] -
  • Request article
    • +
  • Request article
    • [% END %] [% END %] [% IF Koha.Preference( 'virtualshelves' ) == 1 %] [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername ) %] -
  • Save to your lists
    • +
  • Save to your lists
    • [% END %] [% END %] [% IF Koha.Preference( 'opacbookbag' ) == 1 %] [% IF ( incart ) %] -
  • In your cart (remove)
    • +
  • In your cart (remove)
    • [% ELSE %] -
  • Add to your cart
    • +
  • Add to your cart
    • [% END %] [% END %] @@ -51,7 +51,7 @@
  • Dublin Core
    • [% ELSE %]
  • - + [% SWITCH option %] [% CASE 'bibtex' %]BIBTEX [% CASE 'endnote' %]EndNote @@ -107,7 +107,7 @@
    - +
    diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt index 42d5f79dc0..8371680631 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt @@ -19,7 +19,7 @@
    [% ISBD %]
    diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt index 7b0f9849a5..f230639963 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt @@ -1,6 +1,6 @@ [% USE Koha %] [% INCLUDE 'doc-head-open.inc' %] -[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › MARC details for record no. [% biblionumber | html %] +[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog › MARC details for record no. [% biblio.biblionumber %] [% INCLUDE 'doc-head-close.inc' %] [% BLOCK cssinclude %][% END %] @@ -20,14 +20,14 @@
    - Normal view + Normal view MARC view - [% IF ( ISBD ) %]ISBD view[% END %] + [% IF ( ISBD ) %]ISBD view[% END %]
    -

    [% bibliotitle %] (Record no. [% biblionumber | html %])

    +

    [% bibliotitle %] (Record no. [% biblio.biblionumber %])

    [% IF ( OPACXSLTDetailsDisplay ) %] - +
    [% END %] @@ -194,7 +194,7 @@ $(document).ready(function(){ $(this).text(_("view labeled")); $("#labeledmarc").hide(); if(!loaded){ - $("#plainmarc").show().html("
    "+_("Loading")+"...
    ").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblionumber | html %]&viewas=html"); + $("#plainmarc").show().html("
    "+_("Loading")+"...
    ").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblio.biblionumber %]&viewas=html"); loaded = 1; } else { $("#plainmarc").show(); diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index 14bc426a87..6f381ca925 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@ -57,7 +57,7 @@
    [% IF ( OPACLocalCoverImages ) %] -
    +
    [% END %] [% IF ( OPACAmazonCoverImages ) %] [% IF ( OPACURLOpenInNewWindow ) %] @@ -105,15 +105,15 @@ [% END %]
    - + [% IF ( ocoins ) # COinS / Openurl %] [% END %]
    Normal view - MARC view - [% IF ( ISBD ) %]ISBD view[% END %] + MARC view + [% IF ( ISBD ) %]ISBD view[% END %]
    [% IF ( OPACXSLTDetailsDisplay ) %] [% XSLTBloc %] @@ -409,16 +409,16 @@ [% END %] [% IF ( TagsInputEnabled ) %] [% IF ( loggedinusername ) %] - -