From 21ef112bd7bdc9a33601f904d1323fd51af512ec Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 30 Jun 2026 20:26:19 +0530 Subject: [PATCH] Bug 42904: Prevent XSS in patron restriction comments Test plan 1. Search for a patron and open the patron details page. 2. Under "Patron restrictions", add a manual restriction with the following comment: 3. Save the restriction. 4. Navigate to the patron checkouts page: /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx Verify that the JavaScript payload executes. 5. Edit the patron record: /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx Verify that the JavaScript payload executes. 6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl 7. Apply the patch. 8. Repeat steps 4, 5 and 6. 9. Verify that: 1. No JavaScript is executed. 2. The page loads normally without any alert dialog. Applicable for both the staff and opac. Signed-off-by: David Cook Signed-off-by: Martin Renvoize --- .../prog/en/includes/patron-restrictions-tab.inc | 5 +++-- koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc | 5 +++-- .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 5 +++-- .../opac-tmpl/bootstrap/en/includes/patron-restrictions.inc | 5 +++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc index 1cca1bad70..4e5e652f92 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc @@ -1,5 +1,6 @@ [% USE raw %] [% USE Koha %] +[% USE HtmlScrubber %] [% PROCESS 'restriction-types.inc' %] [% IF ( patron.restrictions.count == 0 ) %] @@ -23,9 +24,9 @@ [% PROCESS restriction_type_description restriction_type=restriction.type %] [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %] [% ELSE %] - [% restriction.comment | $raw %] + [% restriction.comment | scrub_html type => 'comment' | $raw %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc index b93f9f5b39..acf6155d82 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc @@ -1,5 +1,6 @@ [% USE raw %] [% USE Branches %] +[% USE HtmlScrubber %] [% USE Categories %] [% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %] [% SET return_claims = patron.return_claims %] @@ -108,10 +109,10 @@ [% END %] [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %] [% ELSE %] [% IF restriction.comment %] - [%- restriction.comment | html_line_break -%] + [%- restriction.comment | scrub_html type => 'comment' | html_line_break -%] [% END %] [% END %] ([%- restriction.type.display_text | html -%]) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index e6c055a81d..ab2996ee44 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -3,6 +3,7 @@ [% USE To %] [% USE Koha %] [% USE KohaDates %] +[% USE HtmlScrubber %] [% USE Branches %] [% PROCESS 'member-main-address-style.inc' %] [% PROCESS 'member-alt-address-style.inc' %] @@ -1411,9 +1412,9 @@ [% PROCESS restriction_type_description restriction_type=restriction.type %] [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %] [% ELSE %] - [% restriction.comment | $raw %] + [% restriction.comment | scrub_html type => 'comment' | $raw %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc index 5ca6ea5909..9cc970889c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc @@ -1,3 +1,4 @@ +[% USE HtmlScrubber %]
  • Your account has been frozen
      @@ -11,10 +12,10 @@ [% END %] [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %] [% ELSE %] [% IF restriction.comment %] - [%- restriction.comment | html_line_break -%] + [%- restriction.comment | scrub_html type => 'comment' | html_line_break -%] [% END %] [% END %]