From 665b90f1155ccf0876265ffbb640ea8aef5cffab Mon Sep 17 00:00:00 2001 From: Amit Gupta Date: Tue, 30 Jun 2026 20:26:19 +0530 Subject: [PATCH] Bug 42904: Prevent XSS in patron restriction comments Test plan 1. Search for a patron and open the patron details page. 2. Under "Patron restrictions", add a manual restriction with the following comment: 3. Save the restriction. 4. Navigate to the patron checkouts page: /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx Verify that the JavaScript payload executes. 5. Edit the patron record: /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx Verify that the JavaScript payload executes. 6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl 7. Apply the patch. 8. Repeat steps 4, 5 and 6. 9. Verify that: 1. No JavaScript is executed. 2. The page loads normally without any alert dialog. Applicable for both the staff and opac. Signed-off-by: David Cook Signed-off-by: Martin Renvoize (cherry picked from commit 2993acb641d2d9fcfeee47918ab70cf29951c720) Signed-off-by: Fridolin Somers --- .../prog/en/includes/patron-restrictions-tab.inc | 5 +++-- koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc | 3 ++- .../intranet-tmpl/prog/en/modules/members/memberentrygen.tt | 5 +++-- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt | 3 ++- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt | 5 +++-- 5 files changed, 13 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc index d1a4a64ccd..d4cc2f2492 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc @@ -1,5 +1,6 @@ [% USE raw %] [% USE Koha %] +[% USE HtmlScrubber %] [% PROCESS 'restriction-types.inc' %] [% IF ( patron.restrictions.count == 0 ) %] @@ -25,9 +26,9 @@ [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %] [% ELSE %] - [% restriction.comment | $raw %] + [% restriction.comment | scrub_html type => 'comment' | $raw %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc index fc310d0fa2..8b1a1a90b9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc @@ -1,5 +1,6 @@ [% USE raw %] [% USE Branches %] +[% USE HtmlScrubber %] [% USE Categories %] [% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %] [% SET return_claims = patron.return_claims %] @@ -104,7 +105,7 @@ [% END %] - [%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [%- restriction.comment | html_line_break -%][%- END -%] + [%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [%- restriction.comment | scrub_html type => 'comment' | html_line_break -%][%- END -%] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index 5531fc7227..91c36c099e 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -3,6 +3,7 @@ [% USE To %] [% USE Koha %] [% USE KohaDates %] +[% USE HtmlScrubber %] [% USE Branches %] [% PROCESS 'member-main-address-style.inc' %] [% PROCESS 'member-alt-address-style.inc' %] @@ -1533,9 +1534,9 @@ legend.collapsed i.fa.fa-caret-down::before { [% PROCESS restriction_type_description restriction_type=restriction.type %] [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %] [% ELSE %] - [% restriction.comment | $raw %] + [% restriction.comment | scrub_html type => 'comment' | $raw %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt index 500273e90f..697736ccd2 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt @@ -2,6 +2,7 @@ [% USE Koha %] [% USE Branches %] [% USE KohaDates %] +[% USE HtmlScrubber %] [% USE Price %] [% USE ItemTypes %] [% USE AuthorisedValues %] @@ -59,7 +60,7 @@ [% ELSE %] [% FOR restriction IN logged_in_user.restrictions %]
- [%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [% restriction.comment | html_line_break %], frozen until: + [%- restriction.type.display_text | html -%][%- IF restriction.comment -%]: [% restriction.comment | scrub_html type => 'comment' | html_line_break %], frozen until: [%- IF restriction.expiration -%] [%- restriction.expiration | $KohaDates -%] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt index f6b12e9202..60cac1d678 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt @@ -2,6 +2,7 @@ [% USE Asset %] [% USE Koha %] [% USE KohaDates %] +[% USE HtmlScrubber %] [% USE Branches %] [% USE I18N %] [% USE ItemTypes %] @@ -177,10 +178,10 @@
  • [%- restriction.type.display_text | html -%]: [% IF restriction.comment.search('OVERDUES_PROCESS') %] - Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | html_line_break %] + Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | html_line_break %] [% ELSE %] [%- IF restriction.comment -%] - [% restriction.comment | html_line_break %]. + [% restriction.comment | scrub_html type => 'comment' | html_line_break %]. [%- END -%] [% END %] [%- IF restriction.expiration -%]