]> git.koha-community.org Git - koha.git/commit
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorit...
authorKyle Hall <kyle@bywatersolutions.com>
Wed, 15 Jun 2022 16:06:55 +0000 (12:06 -0400)
committerLucas Gass <lucas@bywatersolutions.com>
Mon, 25 Jul 2022 14:21:14 +0000 (14:21 +0000)
commite75b17d28d96715813af496ad854558fe77faab9
tree41cc0029334e1509b31fca4e772d0f2f2515a6fd
parent9bb5236be7c29348231004c3479e3543cd54c605
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
C4/Output.pm