gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42904: Prevent XSS in patron restriction comments 

Test plan

1. Search for a patron and open the patron details page.
2. Under "Patron restrictions", add a manual restriction with the following comment:
   <img src=x onerror="alert(document.domain)">
3. Save the restriction.
4. Navigate to the patron checkouts page:
   /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx
   Verify that the JavaScript payload executes.
5. Edit the patron record:
   /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx
   Verify that the JavaScript payload executes.
6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl
7. Apply the patch.
8. Repeat steps 4, 5 and 6.
9. Verify that:
   1. No JavaScript is executed.
   2. The page loads normally without any alert dialog. Applicable for both the staff and opac.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 2993acb641d2d9fcfeee47918ab70cf29951c720)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Amit Gupta 2026-06-30 20:26:19 +05:30 committed by Fridolin Somers
parent 6c2b2d54a8
commit 665b90f115
No known key found for this signature in database
GPG Key ID: 9A8E73E2A8B96537
5 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc
View File

@ -1,5 +1,6 @@
[% USE raw %]
[% USE Koha %]
[% USE HtmlScrubber %]
[% PROCESS 'restriction-types.inc' %]
[% IF ( patron.restrictions.count == 0 ) %]
@ -25,9 +26,9 @@
</td>
<td>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
<span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]</span>
<span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]</span>
[% ELSE %]
[% restriction.comment | $raw %]
[% restriction.comment | scrub_html type => 'comment' | $raw %]
[% END %]
</td>
<td>

3
koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc
View File

@ -1,5 +1,6 @@
[% USE raw %]
[% USE Branches %]
[% USE HtmlScrubber %]
[% USE Categories %]
[% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %]
[% SET return_claims = patron.return_claims %]
@ -104,7 +105,7 @@
[% END %]
</span>
<span class="restriction_detail">
[%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [%- restriction.comment | html_line_break -%][%- END -%]
[%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [%- restriction.comment | scrub_html type => 'comment' | html_line_break -%][%- END -%]
</span>
</div>
[% END %]

5
koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
View File

@ -3,6 +3,7 @@
[% USE To %]
[% USE Koha %]
[% USE KohaDates %]
[% USE HtmlScrubber %]
[% USE Branches %]
[% PROCESS 'member-main-address-style.inc' %]
[% PROCESS 'member-alt-address-style.inc' %]
@ -1533,9 +1534,9 @@ legend.collapsed i.fa.fa-caret-down::before {
<td>[% PROCESS restriction_type_description restriction_type=restriction.type %]</td>
<td>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]
[% ELSE %]
[% restriction.comment | $raw %]
[% restriction.comment | scrub_html type => 'comment' | $raw %]
[% END %]
</td>
<td>

3
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
View File

@ -2,6 +2,7 @@
[% USE Koha %]
[% USE Branches %]
[% USE KohaDates %]
[% USE HtmlScrubber %]
[% USE Price %]
[% USE ItemTypes %]
[% USE AuthorisedValues %]
@ -59,7 +60,7 @@
[% ELSE %]
[% FOR restriction IN logged_in_user.restrictions %]
<div class="patron_restriction">
[%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: <span class="restriction_comment">[% restriction.comment | html_line_break %]</span>, frozen until:
[%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: <span class="restriction_comment">[% restriction.comment | scrub_html type => 'comment' | html_line_break %]</span>, frozen until:
<span class="restriction_expiration">
[%- IF restriction.expiration -%]
[%- restriction.expiration | $KohaDates -%]

5
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
View File

@ -2,6 +2,7 @@
[% USE Asset %]
[% USE Koha %]
[% USE KohaDates %]
[% USE HtmlScrubber %]
[% USE Branches %]
[% USE I18N %]
[% USE ItemTypes %]
@ -177,10 +178,10 @@
<li class="patron_restriction">
<strong>[%- restriction.type.display_text | html -%]: </strong>
[% IF restriction.comment.search('OVERDUES_PROCESS') %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | html_line_break %]
Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | html_line_break %]
[% ELSE %]
[%- IF restriction.comment -%]
<span class="restriction_comment">[% restriction.comment | html_line_break %]</span>.
<span class="restriction_comment">[% restriction.comment | scrub_html type => 'comment' | html_line_break %]</span>.
[%- END -%]
[% END %]
[%- IF restriction.expiration -%]