]> git.koha-community.org Git - koha.git/commit
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorit...
authorKyle Hall <kyle@bywatersolutions.com>
Wed, 15 Jun 2022 16:06:55 +0000 (12:06 -0400)
committerTomas Cohen Arazi <tomascohen@theke.io>
Mon, 25 Jul 2022 14:18:11 +0000 (11:18 -0300)
commit866d10d416fd23129895c2e9282489de6b9cebff
tree97f166a355bb2a58e7cb1eff4ac28f9764816823
parent64176acbc903f049c7d1508745961b72c0cc1c52
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
C4/Output.pm