gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Jonathan Druart a05d1d9be4
Bug 37720: Prevent XSS in label creator 
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.

Test plan:
 1. Without this patch, but with the patch from bug 37654 so you don't get
    alert()s in batch import, download attachment 170675 [details]
 2. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - when the upload finishes Stage for import - when staging
    finishes View batch (get alert()s if you didn't apply bug 37654) - Import
    this batch into the catalog
 3. Once the import finishes, Cataloging - Manage staged records
 4. In the row for your import, in the # Items column, click "(Create label
    batch)"
 5. In the "Label batch #n created" message, click the link to the batch #
 6. Because the batch includes a call number with an open <script>, you'll
    get XSS alert()s and then one about something going wrong while loading
    the table, with only one of the two records showing in the batch editor
 7. Apply patch, restart_all
 8. Cataloging - Label creator - Manage Label batches
 9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
    rather than being interpreted as HTML

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
 		2024-10-18 12:07:51 +02:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 37720: Prevent XSS in label creator 2024-10-18 12:07:51 +02:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 30318: Don't reset messaging preferences when form is empty 2024-04-26 08:52:51 +02:00
Heading Bug 36917: (follow-up) Remove Elasticsearch warnings and tidy 2024-05-24 15:36:42 +02:00
ILSDI Bug 30856: Remove C4::Reserves::CanReserveBeCanceledFromOpac 2024-09-16 13:47:07 +02:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 10762: (QA follow-up) Perltidy 2023-10-25 10:35:31 -03:00
Linker Bug 35125: Respect LinkerConsiderThesaurus in update_cache 2024-07-01 18:55:42 +02:00
Members Bug 29194: Create logical ordering of patron messaging preferences 2024-10-11 11:13:56 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-09-15 11:57:08 -03:00
Reports Bug 37508: (QA follow-up) Use ->check_columns 2024-08-16 16:22:26 +02:00
SIP Bug 23426: Add fine items to patron information response in SIP2 2024-10-11 12:21:30 +02:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils/DataTables Bug 34913: Fix perlcritic for VirtualShelves.pm 2024-01-29 12:24:54 +01:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 36002: Remove unused subroutine GetParcels 2024-04-30 17:09:43 +02:00
Auth.pm Bug 37104: (Follow-up) Checks for unitialized value of 'anonymous_patron' system pref 2024-08-16 16:22:19 +02:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-02-02 17:31:47 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-06-20 17:55:32 +02:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-06-20 17:55:34 +02:00
AuthoritiesMarc.pm Bug 35989: (QA follow-up): Fix QA tests 2024-06-06 15:18:43 +01:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 36474: Don't update records when total issues has not changed 2024-09-19 12:39:14 +01:00
Breeding.pm Bug 28166: (QA follow-up) Fix and tidy tests and code 2023-10-23 11:33:50 -03:00
Budgets.pm Bug 31631: Optionally use tax-exclusive values for calculating fund values 2023-10-18 15:41:35 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-09-18 15:31:50 -03:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 35100: Various fixes 2024-09-19 12:41:50 +01:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 23387: Add caching to C4::ClassSource 2024-08-26 17:39:31 +02:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36367: Set to undef when unsetting 2024-06-14 11:17:18 +01:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 30047: (follow-up) Fix failing tests 2024-05-13 16:24:18 +02:00
HoldsQueue.pm Bug 38126: Skip allocated holds when filling from transport cost matrix 2024-10-16 14:35:57 +02:00
ImportBatch.pm Bug 35438: Remove skip_intermediate_commit parameter 2024-01-16 12:06:08 +01:00
ImportExportFramework.pm Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
InstallAuth.pm Bug 36367: Remove _new_userenv 2024-06-14 11:17:17 +01:00
Installer.pm Bug 27490: More instances of changing language syspref to StaffInterfaceLanguages 2024-09-13 13:54:25 +02:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 35100: Revert change to request_transfer 2024-09-19 12:41:53 +01:00
Koha.pm Bug 36750: Use the same label for Zebra 2024-05-07 17:41:19 +02:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 27490: More instances of changing language syspref to StaffInterfaceLanguages 2024-09-13 13:54:25 +02:00
Letters.pm Bug 37642: Generated letter should use https in header 2024-08-23 18:21:19 +02:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 25159: (QA follow-up) Tidy changes 2024-05-02 16:47:44 +02:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-05-24 11:21:31 -03:00
Members.pm Bug 28924: (QA follow-up) Use $self instead of $patron 2024-07-18 18:25:55 +02:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-03-31 13:13:35 +02:00
Output.pm Bug 34478: Remove check_csrf from pl files 2024-03-01 10:56:01 +01:00
Overdues.pm Bug 36128: Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Overdues.pm 2024-06-27 14:04:46 +02:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 33431: Make C4::Record use C4::Context->yaml_preference 2024-03-18 11:03:38 +01:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 30856: Remove C4::Reserves::CanReserveBeCanceledFromOpac 2024-09-16 13:47:07 +02:00
Ris.pm Bug 33431: Fix remaining cases 2024-03-18 11:03:39 +01:00
RotatingCollections.pm Bug 35100: (follow-up) Tidy 2024-09-19 12:41:58 +01:00
SMS.pm Bug 36051: (QA follow-up): Use yaml_preference 2024-04-12 11:26:12 +02:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-04-22 12:39:20 +02:00
Search.pm Bug 37004: Add branchcode as HTML class to each grouped result in search results 2024-09-02 12:13:42 +02:00
Serials.pm Bug 37480: Make addroutingmember use Koha::Subscription::Routinglists 2024-09-16 10:41:06 +02:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 33833: Add two FIXMEs to SocialData::get_report 2023-09-05 14:35:35 -03:00
Stats.pm Bug 33608: (QA follow-up) Remove ->insert method 2023-10-25 11:07:59 -03:00
Suggestions.pm Bug 35597: Move modification logging to Koha::Suggestion 2024-06-13 14:08:33 +01:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 36785: Typo unreconized and bilbio in tags code 2024-05-17 10:36:35 +02:00
Templates.pm Bug 35070: Tidy 2024-01-04 16:51:45 +01:00
TmplToken.pm
…
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 34185: Capitalized OPAC in OpacItemLocation syspref 2024-09-02 12:13:43 +02:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 33217: Tidy 2023-11-08 17:52:42 -03:00