gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37654: XSS in Batch record import for Citation column 

Viewing a staged MARC record batch loads a DataTable from
/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the
DataTable just trust the author/title/isbn/issn to be free of HTML. They
shouldn't.

Test plan:
1. Without this patch applied, download attachment 170418, then Cataloging
   - Stage records for import - Select the downloaded file - Upload file -
   Stage for import
2. When the background job completes, View batch - you'll get three alert()s
   from the title, author, and ISSN, and the author and ISSN displayed huge
3. Apply patch, restart_all
4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero
   alerts and no <h2> display

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Phil Ringnalda 2024-08-15 19:57:42 -07:00 committed by Lucas Gass
parent e94a7e34f3
commit 25672f82f0
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
View File

@ -498,19 +498,19 @@
var additional_details = "";
if( aData['author'] ){
additional_details += " " + aData['author'] + " ";
additional_details += " " + escape_str(aData['author']) + " ";
}
if( aData['isbn'] ){
additional_details += " (" + aData['isbn'] + ") ";
additional_details += " (" + escape_str(aData['isbn']) + ") ";
}
if( aData['issn'] ){
additional_details += " (" + aData['issn'] + ") ";
additional_details += " (" + escape_str(aData['issn']) + ") ";
}
$('td:eq(1)', nRow).html(
'<a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=' + aData['import_record_id'] + '&viewas=html" class="previewMARC">' + aData['citation'] + '</a> ' + additional_details
'<a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=' + aData['import_record_id'] + '&viewas=html" class="previewMARC">' + escape_str(aData['citation']) + '</a> ' + additional_details
);
$('td:eq(2)', nRow).html(