gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38969: Prevent XSS in tags/review.pl and Prevent JS error when adding tags with quote at the OPAC 

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jonathan Druart 2025-01-27 09:56:10 +01:00 committed by Wainui Witika-Park
parent 6ef34a6e3e
commit 6e267dc90f
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js
View File

@ -151,7 +151,7 @@ $(document).ready(function() {
$(event.target).text( __("Testing...") ).prop('disabled', true);
$.ajax(Object.assign({}, {...review_ajax_params, type: "GET"}, {
data: {
tag: $('#test').val(),
tag: escape_str($("#test").val()),
op: 'test',
},
success: success_test_call // success_reject

7
opac/opac-tags.pl
View File

@ -200,7 +200,8 @@ if ($is_ajax) {
my $i = 1;
foreach (@errors) {
my $key = (keys %$_)[0];
$err_string .= "\n\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")';
( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g;
$err_string .= sprintf qq{\n\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped;
if($i < scalar @errors){ $err_string .= ","; }
$i++;
}
@ -217,7 +218,8 @@ if ($is_ajax) {
foreach (@{$bibResult->{errors}}) {
$js_bibres .= "," if ($i);
my $key = (keys %$_)[0];
$js_bibres .= "\n\t\t\t KOHA.Tags.tag_message.$key(\"" . $_->{$key} . '")';
( my $quote_escaped = $_->{$key} ) =~ s|"|\\"|g;
$js_bibres .= sprintf qq{\n\t\t\t KOHA.Tags.tag_message.%s("%s")}, $key, $quote_escaped;
$i++;
}
$js_bibres .= "\n\t\t]\n\t}";
@ -377,4 +379,3 @@ response = {
};
=cut

3
tags/review.pl
View File

@ -23,7 +23,7 @@ use Modern::Perl;
use POSIX qw( ceil );
use CGI qw ( -utf8 );
use CGI::Cookie; # need to check cookies before having CGI parse the POST request
use URI::Escape qw( uri_escape_utf8 );
use URI::Escape qw( uri_escape_utf8 uri_unescape );
use C4::Auth qw( check_cookie_auth get_template_and_user );
use C4::Context;
use C4::Output qw( output_with_http_headers is_ajax pagination_bar output_html_with_http_headers );
@ -60,6 +60,7 @@ if (is_ajax()) {
my $op = $input->param('op') || q{};
my $tag = $input->param('tag');
if ($op eq 'test') {
$tag = uri_unescape($tag);
my $check = is_approved($tag);
$js_reply = ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) . "_test('".uri_escape_utf8($tag)."');\n";
}