From 3b407e3ecdcfe9ac79ffdc3f160735240d8eb427 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 29 Sep 2016 08:46:49 +0100 Subject: [PATCH] Bug 17365: Fix XSS in moremember.pl and memberentry.pl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There are certainly hundred of places where they are not escaped... Test plan: Create a patron with "Arun " in some of the fields. Signed-off-by: Chris Cormack Signed-off-by: Katrin Fischer Signed-off-by: Brendan Gallagher (cherry picked from commit 1d0d5f1398687ead3a17cd40f74f879e8ddf9a9d) Signed-off-by: Frédéric Demians (cherry picked from commit a61c072f1acb77906843a5be319412f959374bda) Signed-off-by: Julian Maurice --- .../prog/en/includes/circ-menu.inc | 14 ++--- .../prog/en/includes/patron-title.inc | 16 +++--- .../prog/en/modules/members/memberentrygen.tt | 46 ++++++++-------- .../prog/en/modules/members/moremember.tt | 54 +++++++++---------- 4 files changed, 65 insertions(+), 65 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc index a42735aad4..857ec400b3 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc @@ -8,9 +8,9 @@
    [% IF ( patronimages ) %] [% IF ( picture ) %] -
  • [% firstname %] [% surname %] ([% cardnumber %])
    • +
  • [% firstname | html %] [% surname | html %] ([% cardnumber | html %])
    • [% ELSE %] -
  • [% firstname %] [% surname %] ([% cardnumber %])
    • +
  • [% firstname | html %] [% surname | html %] ([% cardnumber | html %])
    • [% END %] [% END %] [% IF Koha.Preference( 'AddressFormat' ) %] @@ -20,21 +20,21 @@ [% END %] [% IF ( phone ) %]
  • - [% phone %] + [% phone | html %] [% ELSE %] [% IF ( mobile ) %] - [% mobile %] + [% mobile | html %] [% ELSE %] [% IF ( phonepro ) %] - [% phonepro %] + [% phonepro | html %] [% END %] [% END %]
    • [% END %] [% IF ( email ) %] - + [% ELSE %] [% IF ( emailpro ) %] - + [% END %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-title.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-title.inc index dbcab25ef1..caf45d6a15 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-title.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-title.inc @@ -1,27 +1,27 @@ [%- IF ( borrower.borrowernumber ) %] [%- IF borrower.category_type == 'I' %] - [%- borrower.surname %] [% IF borrower.othernames %] ([% borrower.othernames %]) [% END %] + [%- borrower.surname | html %] [% IF borrower.othernames %] ([% borrower.othernames | html %]) [% END %] [%- ELSE %] [%- IF invert_name %] - [%- borrower.surname %], [% borrower.firstname %] [% IF borrower.othernames %] ([% borrower.othernames %]) [% END %] + [%- borrower.surname | html %], [% borrower.firstname | html %] [% IF borrower.othernames %] ([% borrower.othernames | html %]) [% END %] [%- ELSE %] - [%- borrower.firstname %] [% IF borrower.othernames %] ([% borrower.othernames %]) [% END %] [% borrower.surname %] + [%- borrower.firstname | html %] [% IF borrower.othernames %] ([% borrower.othernames | html %]) [% END %] [% borrower.surname | html %] [%- END -%] [%- END -%] [%- IF ( borrower.cardnumber ) -%] - ([% borrower.cardnumber %]) + ([% borrower.cardnumber | html %]) [%- END %] [%- ELSIF ( borrowernumber ) %] [%- IF category_type == 'I' %] - [%- surname %] [% IF othernames %] ([% othernames %]) [% END %] + [%- surname | html %] [% IF othernames %] ([% othernames | html %]) [% END %] [%- ELSE %] [%- IF invert_name %] - [%- surname %], [% firstname %] [% IF othernames %] ([% othernames %]) [% END %] + [%- surname | html %], [% firstname | html %] [% IF othernames %] ([% othernames | html %]) [% END %] [%- ELSE %] - [%- firstname %] [% IF othernames %] ([% othernames %]) [% END %] [% surname %] + [%- firstname | html %] [% IF othernames %] ([% othernames | html %]) [% END %] [% surname | html %] [%- END %] [%- END -%] [%- IF ( cardnumber ) -%] - ([% cardnumber %]) + ([% cardnumber | html %]) [%- END %] [%- END -%] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index 16317ccdbe..4156edd908 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -190,8 +190,8 @@ [% IF ( no_categories ) %]

    There are no patron categories defined. [% IF ( CAN_user_parameters ) %]Please add a patron category.[% ELSE %]An administrator must define at least one patron category.

    [% END %][% END %][% END %] [% UNLESS ( no_add ) %] -

    [% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron [% IF (firstname) %][% firstname %] [% END %][% IF (surname) %][% surname %] [% END %]([%IF ( categoryname ) %][% categoryname %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])

    - +

    [% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron [% IF (firstname) %][% firstname | html %] [% END %][% IF (surname) %][% surname | html %] [% END %]([%IF ( categoryname ) %][% categoryname %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])

    + [% IF ( check_member ) %]

    Duplicate patron record?

    @@ -330,7 +330,7 @@ - + [% IF ( mandatoryfirstname ) %]Required[% END %] [% END %] @@ -362,7 +362,7 @@ - + [% IF ( mandatoryinitials ) %]Required[% END %] [% END %] @@ -375,7 +375,7 @@ - + [% IF ( mandatoryothernames ) %]Required[% END %] [% IF ( I ) %][% END %] @@ -433,9 +433,9 @@ [% IF ( guarantorid ) %] [% contactname %] - + [% ELSE %] - + [% END %] [% ELSE %] @@ -452,9 +452,9 @@ [% IF ( guarantorid ) %] [% contactname %] - + [% ELSE %] - + [% END %] [% END %] @@ -463,9 +463,9 @@ [% IF ( guarantorid ) %] [% contactfirstname %] - + [% ELSE %] - + [% END %] [% END %] @@ -517,7 +517,7 @@ - + [% IF ( mandatoryphone ) %]Required[% END %]
    Shows on transit slips
    @@ -530,7 +530,7 @@ - + [% IF ( mandatoryphonepro ) %]Required[% END %] [% END %] @@ -542,7 +542,7 @@ - + [% IF ( mandatorymobile ) %]Required[% END %] [% END %] @@ -554,7 +554,7 @@ - + [% IF ( mandatoryemail ) %]Required[% END %]
    Shows on transit slips
    @@ -567,7 +567,7 @@ - + [% IF ( mandatoryemailpro ) %]Required[% END %] [% END %] @@ -579,7 +579,7 @@ - + [% IF ( mandatoryfax ) %]Required[% END %] [% END %] @@ -622,19 +622,19 @@ [% END %] Card number: [% IF minlength_cardnumber == maxlength_cardnumber %] - + [% IF ( mandatorycardnumber ) %]Required[% END %]
    Card number must be exactly [% minlength_cardnumber %] characters.
    [% ELSIF minlength_cardnumber && maxlength_cardnumber %] - + [% IF ( mandatorycardnumber ) %]Required[% END %]
    Card number must be between [% minlength_cardnumber %] and [% maxlength_cardnumber %] characters.
    [% ELSIF maxlength_cardnumber %] - + [% IF ( mandatorycardnumber ) %]Required[% END %]
    Card number can be up to [% maxlength_cardnumber %] characters.
    [% ELSE %] - + [% IF ( mandatorycardnumber ) %]Required[% END %]
    There is no minimum or maximum character length.
    [% END %] @@ -776,7 +776,7 @@ - +
    This message appears on this patron's user page in the OPAC
    [% IF ( mandatoryopacnote ) %]Required[% END %] @@ -789,7 +789,7 @@ - +
    This message displays when checking out to this patron
    [% IF ( mandatoryborrowernotes ) %]Required[% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt index 7a5d0978e4..2a67c71877 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt @@ -201,11 +201,11 @@ function validate1(date) { [% END %]

    [% UNLESS ( I ) %] - [% title %] [% firstname %] [% END %] [% surname %] ([% cardnumber %])

    + [% title | html %] [% firstname | html %] [% END %] [% surname | html %] ([% cardnumber | html %])
    - [% UNLESS ( I ) %][% IF ( othernames ) %]“[% othernames %]”[% END %] + [% UNLESS ( I ) %][% IF ( othernames ) %]“[% othernames | html %]”[% END %]
    [% IF Koha.Preference( 'AddressFormat' ) %] @@ -218,22 +218,22 @@ function validate1(date) {
      [% IF ( I ) %] - [% IF ( phonepro ) %]
    1. Organization phone: [% phonepro %]
      2. [% END %] - [% IF ( emailpro ) %]
    2. Organization email: [% emailpro %]
      3. [% END %] + [% IF ( phonepro ) %]
    3. Organization phone: [% phonepro | html %]
      4. [% END %] + [% IF ( emailpro ) %]
    4. Organization email: [% emailpro | html %]
      5. [% END %] [% ELSE %] - [% IF ( phone ) %]
    5. Primary phone: [% phone %]
      6. [% END %] - [% IF ( phonepro ) %]
    6. Secondary phone: [% phonepro %]
      7. [% END %] - [% IF ( mobile ) %]
    7. Other phone: [% mobile %]
      8. [% END %] + [% IF ( phone ) %]
    8. Primary phone: [% phone | html %]
      9. [% END %] + [% IF ( phonepro ) %]
    9. Secondary phone: [% phonepro | html %]
      10. [% END %] + [% IF ( mobile ) %]
    10. Other phone: [% mobile | html %]
      11. [% END %] [% END %] [% IF ( P ) %] - [% IF ( phone ) %]
    11. Primary phone: [% phone %]
      12. [% END %] - [% IF ( mobile ) %]
    12. Other phone: [% mobile %]
      13. [% END %] + [% IF ( phone ) %]
    13. Primary phone: [% phone | html %]
      14. [% END %] + [% IF ( mobile ) %]
    14. Other phone: [% mobile | html %]
      15. [% END %] [% END %] - [% IF ( fax ) %]
    15. Fax: [% fax %]
      16. [% END %] + [% IF ( fax ) %]
    16. Fax: [% fax | html %]
      17. [% END %] [% UNLESS ( I ) %] - [% IF ( email ) %]
    17. Primary email:[% email %]
      18. [% END %] - [% IF ( emailpro ) %]
    18. Secondary email: [% emailpro %]
      19. [% END %] + [% IF ( email ) %]
    19. Primary email:[% email | html %]
      20. [% END %] + [% IF ( emailpro ) %]
    20. Secondary email: [% emailpro | html %]
      21. [% END %] [% END %] [% IF ( initials ) %]
    21. Initials: [% initials %]
      22. [% END %] [% IF ( dateofbirth ) %]
    22. Date of birth:[% dateofbirth | $KohaDates %]
      23. [% END %] @@ -242,13 +242,13 @@ function validate1(date) { [% END %][% END %] [% IF ( isguarantee ) %] [% IF ( guaranteeloop ) %] -
    23. Guarantees:
      24. +
    24. Guarantees:
      25. [% END %] [% ELSE %] [% IF ( guarantorborrowernumber ) %] -
    25. Guarantor:[% guarantorsurname %][%IF ( guarantorfirstname ) %], [% guarantorfirstname %] [% END %]
      26. +
    26. Guarantor:[% guarantorsurname | html %][%IF ( guarantorfirstname ) %], [% guarantorfirstname | html %] [% END %]
      27. [% ELSIF (guarantorsurname || guarantorfirstname) %] -
    27. Guarantor:[% guarantorsurname %][%IF ( guarantorfirstname ) %], [% guarantorfirstname %][% END %]
      28. +
    28. Guarantor:[% guarantorsurname | html %][%IF ( guarantorfirstname ) %], [% guarantorfirstname | html %][% END %]
      29. [% END %] [% END %]
    @@ -271,15 +271,15 @@ function validate1(date) {
    [% IF ( picture ) %] Manage patron image -
    To update the image for [% title %] [% surname %], select a new image file and click 'Upload.'
    Click the 'Delete' button to remove the current image. +
    To update the image for [% title | html %] [% surname | html %], select a new image file and click 'Upload.'
    Click the 'Delete' button to remove the current image. [% ELSE %] Upload patron image -
    [% title %] [% firstname %] [% surname %] does not currently have an image available. To import an image for [% title %] [% surname %], enter the name of an image file to upload. +
    [% title %] [% firstname | html %] [% surname | html %] does not currently have an image available. To import an image for [% title %] [% surname | html %], enter the name of an image file to upload. [% END %]
    Only PNG, GIF, JPEG, XPM formats are supported.
    - +
    1. @@ -413,15 +413,15 @@ function validate1(date) {

      Alternative contact

      -
      1. Surname: [% altcontactsurname %]
        2. -
      2. First name: [% altcontactfirstname %]
        3. -
      3. Address: [% altcontactaddress1 %]
        4. -
      4. Address 2: [% altcontactaddress2 %]
        5. -
      5. City: [% altcontactaddress3 %]
        6. - [% IF ( altcontactstate ) %]
      6. State: [% altcontactstate %]
        7. [% END %] -
      7. ZIP/Postal code: [% altcontactzipcode %]
        8. - [% IF ( altcontactcountry ) %]
      8. Country: [% altcontactcountry %]
        9. [% END %] - [% IF ( altcontactphone ) %]
      9. Phone: [% altcontactphone %]
        10. [% END %] +
        1. Surname: [% altcontactsurname | html %]
          2. +
        2. First name: [% altcontactfirstname | html %]
          3. +
        3. Address: [% altcontactaddress1 | html %]
          4. +
        4. Address 2: [% altcontactaddress2 | html %]
          5. +
        5. City: [% altcontactaddress3 | html %]
          6. + [% IF ( altcontactstate ) %]
        6. State: [% altcontactstate | html %]
          7. [% END %] +
        7. ZIP/Postal code: [% altcontactzipcode | html %]
          8. + [% IF ( altcontactcountry ) %]
        8. Country: [% altcontactcountry | html %]
          9. [% END %] + [% IF ( altcontactphone ) %]
        9. Phone: [% altcontactphone | html %]
          10. [% END %]
      Edit