gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42904: Prevent XSS in patron restriction comments 

Test plan

1. Search for a patron and open the patron details page.
2. Under "Patron restrictions", add a manual restriction with the following comment:
   <img src=x onerror="alert(document.domain)">
3. Save the restriction.
4. Navigate to the patron checkouts page:
   /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx
   Verify that the JavaScript payload executes.
5. Edit the patron record:
   /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx
   Verify that the JavaScript payload executes.
6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl
7. Apply the patch.
8. Repeat steps 4, 5 and 6.
9. Verify that:
   1. No JavaScript is executed.
   2. The page loads normally without any alert dialog. Applicable for both the staff and opac.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
Amit Gupta 2026-06-30 20:26:19 +05:30 committed by David Cook
parent 9a63c3983a
commit 21ef112bd7
No known key found for this signature in database
GPG Key ID: 5796AC999998C018
4 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
View File

@ -1,5 +1,6 @@
[% USE raw %]
[% USE Koha %]
[% USE HtmlScrubber %]
[% PROCESS 'restriction-types.inc' %]
[% IF ( patron.restrictions.count == 0 ) %]
@ -23,9 +24,9 @@
<td> [% PROCESS restriction_type_description restriction_type=restriction.type %] </td>
<td>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
<span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]</span>
<span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]</span>
[% ELSE %]
[% restriction.comment | $raw %]
[% restriction.comment | scrub_html type => 'comment' | $raw %]
[% END %]
</td>
<td>

5
koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
View File

@ -1,5 +1,6 @@
[% USE raw %]
[% USE Branches %]
[% USE HtmlScrubber %]
[% USE Categories %]
[% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %]
[% SET return_claims = patron.return_claims %]
@ -108,10 +109,10 @@
[% END %]
</span>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]
[% ELSE %]
[% IF restriction.comment %]
<span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
<span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
[% END %]
[% END %]
<span class="restriction_type">([%- restriction.type.display_text | html -%])</span>

5
koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
View File

@ -3,6 +3,7 @@
[% USE To %]
[% USE Koha %]
[% USE KohaDates %]
[% USE HtmlScrubber %]
[% USE Branches %]
[% PROCESS 'member-main-address-style.inc' %]
[% PROCESS 'member-alt-address-style.inc' %]
@ -1411,9 +1412,9 @@
<td>[% PROCESS restriction_type_description restriction_type=restriction.type %]</td>
<td>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]
[% ELSE %]
[% restriction.comment | $raw %]
[% restriction.comment | scrub_html type => 'comment' | $raw %]
[% END %]
</td>
<td>

5
koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc
View File

@ -1,3 +1,4 @@
[% USE HtmlScrubber %]
<li class="userdebarred blocker">
<strong>Your account has been frozen</strong>
<ul>
@ -11,10 +12,10 @@
[% END %]
</span>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
<span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]</span>
<span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]</span>
[% ELSE %]
[% IF restriction.comment %]
<span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
<span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
[% END %]
[% END %]
</li>