]> git.koha-community.org Git - koha.git/commit
Bug 20770: ILL loans OPAC form notes field allow arbitrary input
authorAndrew Isherwood <andrew.isherwood@ptfs-europe.com>
Tue, 15 May 2018 15:00:02 +0000 (16:00 +0100)
committerTomas Cohen Arazi <tomascohen@theke.io>
Thu, 2 Aug 2018 13:22:02 +0000 (10:22 -0300)
commit552873f7d466abee6919414b8d2f5e6c99f9a44f
treefb74cbfcbb41ea2192184e95b3d6055f9cc503de
parent10720d2a5c50b82d565cab9ad70c8498164d81b2
Bug 20770: ILL loans OPAC form notes field allow arbitrary input

This patch addresses the lack of sanitization of the "notes" field on
the OPAC "View Interlibrary loan request" page.

To test:

- Apply the patch
- As an OPAC user, create an ILL request
- Navigate to the request's "View Interlibrary loan request" page
- Add the following note:

  Hello
  <h1>TESTING</h1>
  <script>alert('pwned');</script>

- Click "Submit modifications"
- TEST: Observe, when the page reloads, only the following is preserved in the
"Notes" textarea:

    Hello
    TESTING

- As a staff user, naviate to the ILL requests table
- Select "Manage request" for the request you created
- TEST: Observe that the Notes field only contains:

    Hello
    TESTING

- TEST: Observe that no Javascript alert is displayed

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
koha-tmpl/intranet-tmpl/prog/css/staff-global.css
koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt