gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Michał Górny b552f4b469 Bug 34023: Prevent HTML injection in "back to results" link from search page 
It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.

I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 863d8fed15)
Signed-off-by: danyonsewell <danyonsewell@catalyst.net.nz>
 		2023-08-04 00:59:11 +00:00
..
clubs Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
errors Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
external/overdrive Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
sci Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
sco Bug 19188: Use the Price template plugin with_symbol => 1 2023-02-17 13:08:30 +01:00
svc Bug 30426: Add missing C4::Auth and C4::Output imports 2022-04-15 07:26:26 -04:00
ilsdi.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
maintenance.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
oai.pl
…
opac-ISBDdetail.pl Bug 29180: Rename syspref RequestOnOpac with OPACHoldRequests 2021-11-05 12:13:25 +01:00
opac-MARCdetail.pl Bug 29180: Rename syspref RequestOnOpac with OPACHoldRequests 2021-11-05 12:13:25 +01:00
opac-account-pay-return.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-account-pay.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-account.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-addbybiblionumber.pl Bug 28959: (follow-up) Adjust all places in which 'category' was used 2021-10-28 17:47:38 +02:00
opac-alert-subscribe.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-article-request-cancel.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-authorities-home.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-authoritiesdetail.pl Bug 29435: include missing subroutine from C4::AuthoritiesMarc 2021-11-15 12:38:39 +01:00
opac-basket.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-blocked.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-browse.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-browser.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
opac-course-details.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-course-reserves.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-detail.pl Bug 30918: Allow passing filtered record to get_marc_notes 2022-08-11 17:05:40 +02:00
opac-discharge.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-downloadcart.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-downloadshelf.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-export.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-holdshistory.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-ics.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-idref.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-illrequests.pl Bug 33702: (QA follow-up) Do not crash on borrowernumber 2023-05-23 20:43:33 +02:00
opac-image.pl Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
opac-imageviewer.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-issue-note.pl Bug 29544: (QA follow-up) Simplify code 2022-01-25 14:44:22 -05:00
opac-library.pl Bug 27360: Prevent crash if branchcode does not exist 2021-11-03 15:40:52 +01:00
opac-main.pl Bug 28955: Impact News as well 2022-06-20 16:34:00 +02:00
opac-memberentry.pl Bug 31531: Remove unnecessary use directives on opac-memberentry.pl 2022-11-14 17:16:12 +01:00
opac-messaging.pl Bug 20439: Sort SMS providers in alphabetical order by DB field 2022-08-26 14:57:15 +02:00
opac-modrequest-suspend.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-modrequest.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-mymessages.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-news-rss.pl Bug 24387: Rename "News" with "Additional contents" 2021-08-16 11:55:55 +02:00
opac-overdrive-search.pl Bug 29318: Tidy the code 2021-10-26 16:46:03 +02:00
opac-passwd.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-password-recovery.pl Bug 29646: (RM follow-up) Add space before colon 2022-02-07 06:50:54 -05:00
opac-patron-consent.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-patron-image.pl Bug 29931: (follow-up) Similar thing in opac-patron-image.pl 2022-02-11 06:09:10 -05:00
opac-privacy.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-ratings-ajax.pl Bug 28785: Adjust check_cookie_auth calls 2021-10-18 11:28:41 +02:00
opac-ratings.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-readingrecord.pl Bug 28768: (QA follow-up) Remove unused variable 2021-11-05 12:17:08 +01:00
opac-recordedbooks-search.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-registration-verify.pl Bug 30214: (QA follow-up) Clarify code comment 2022-03-25 09:34:30 -04:00
opac-renew.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-reportproblem.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-request-article.pl Bug 29093: Interface changes 2021-10-15 11:34:26 +02:00
opac-reserve.pl Bug 19540: Tell the patron why a hold cannot be placed on items 2022-10-12 16:38:10 +02:00
opac-restrictedpage.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-retrieve-file.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-review.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-routing-lists.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-search-history.pl Bug 30377: Fix two CGI::param called in list context-warnings 2022-04-08 10:40:16 -04:00
opac-search.pl Bug 34023: Prevent HTML injection in "back to results" link from search page 2023-08-04 00:59:11 +00:00
opac-sendbasket.pl Bug 30532: (bug 29957 follow-up) Fix '$cookie->value' 2022-04-22 14:29:10 -04:00
opac-sendshelf.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-serial-issues.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-shareshelf.pl Bug 28959: Fix other cases 2021-10-28 17:47:38 +02:00
opac-shelves.pl Bug 28959: Add virtualshelves.public as a boolean 2021-10-28 17:47:38 +02:00
opac-showmarc.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-showreviews.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-suggestions.pl Bug 29311: (QA follow-up) Fix an existing spelling typo 2023-05-23 20:43:30 +02:00
opac-tags.pl Bug 29669: fix uninitialized value warnings when XSLTParse4Display is called 2021-12-17 09:56:00 -05:00
opac-tags_subject.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-topissues.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
opac-user.pl Bug 28417: Don't require C4::Auth_with_cas from opac-user if not needed 2021-11-03 15:40:52 +01:00
tracklinks.pl Bug 30262: Trim whitespace off tracklinks.pl URLs 2022-11-14 11:55:12 +01:00
unapi Bug 17600: Fix opac/unapi 2021-11-22 11:04:51 +01:00