Bug 20770: ILL loans OPAC form notes field allow arbitrary input
authorAndrew Isherwood <andrew.isherwood@ptfs-europe.com>
Tue, 15 May 2018 15:00:02 +0000 (16:00 +0100)
committerMartin Renvoize <martin.renvoize@ptfs-europe.com>
Fri, 3 Aug 2018 14:22:45 +0000 (15:22 +0100)
commitcc81442349cb07afe242607f2c40acb62e4e76fb
tree2b700a990bc23fe31bb035a834162ba8ec615997
parent1c988ed7fb3ca7d018c9c7e7cea5f22415b95836
Bug 20770: ILL loans OPAC form notes field allow arbitrary input

This patch addresses the lack of sanitization of the "notes" field on
the OPAC "View Interlibrary loan request" page.

To test:

- Apply the patch
- As an OPAC user, create an ILL request
- Navigate to the request's "View Interlibrary loan request" page
- Add the following note:

  Hello
  <h1>TESTING</h1>
  <script>alert('pwned');</script>

- Click "Submit modifications"
- TEST: Observe, when the page reloads, only the following is preserved in the
"Notes" textarea:

    Hello
    TESTING

- As a staff user, naviate to the ILL requests table
- Select "Manage request" for the request you created
- TEST: Observe that the Notes field only contains:

    Hello
    TESTING

- TEST: Observe that no Javascript alert is displayed

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 552873f7d466abee6919414b8d2f5e6c99f9a44f)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
koha-tmpl/intranet-tmpl/prog/css/staff-global.css
koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt