]> git.koha-community.org Git - koha.git/commit
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorit...
authorKyle Hall <kyle@bywatersolutions.com>
Wed, 15 Jun 2022 16:06:55 +0000 (12:06 -0400)
committerVictor Grousset/tuxayo <victor@tuxayo.net>
Mon, 25 Jul 2022 19:12:24 +0000 (21:12 +0200)
commitf8aea440fd6c381b9439350dd924b4fe2b5548ff
tree03a49fd2349e6cec87ff7290621de033baba24bc
parentdc7a1a72641ea812e7811e8d0a3eeb6bde7d2880
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
C4/Output.pm