gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Jonathan Druart 26adab7f62 Bug 37720: Prevent XSS in label creator 
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.

Test plan:
 1. Without this patch, but with the patch from bug 37654 so you don't get
    alert()s in batch import, download attachment 170675 [details]
 2. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - when the upload finishes Stage for import - when staging
    finishes View batch (get alert()s if you didn't apply bug 37654) - Import
    this batch into the catalog
 3. Once the import finishes, Cataloging - Manage staged records
 4. In the row for your import, in the # Items column, click "(Create label
    batch)"
 5. In the "Label batch #n created" message, click the link to the batch #
 6. Because the batch includes a call number with an open <script>, you'll
    get XSS alert()s and then one about something going wrong while loading
    the table, with only one of the two records showing in the batch editor
 7. Apply patch, restart_all
 8. Cataloging - Label creator - Manage Label batches
 9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
    rather than being interpreted as HTML

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
 		2025-03-31 09:42:13 +00:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 37720: Prevent XSS in label creator 2025-03-31 09:42:13 +00:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Heading Bug 33277: Add comments and missing thesauri 2023-05-15 10:41:29 +00:00
ILSDI Bug 34893: ILS-DI can return the wrong patron for AuthenticatePatron 2024-01-26 09:56:12 +01:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 34532: Silence warns in Patroncard.pm 2023-10-12 15:31:48 +00:00
Reports Bug 37784: [24.05] Do not show forbidden columns in reports dictionary 2025-03-24 15:32:38 +00:00
SIP Bug 37816: (QA follow-up) Avoid repetition, typo and pipe test 2025-02-25 16:35:00 -05:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils Bug 29648: (QA follow-up) Minor POD fix 2022-04-27 11:20:45 -10:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Auth.pm Bug 38826: Make check_api_auth $sessionID consistent 2025-03-31 09:42:12 +00:00
Auth_cas_servers.yaml.sample Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig 2016-08-08 13:16:36 +00:00
Auth_with_cas.pm Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-26 09:57:14 +01:00
Auth_with_ldap.pm Bug 36575: (bug 34893 follow-up) Return patron from LDAP 2024-05-29 07:16:11 +00:00
Auth_with_shibboleth.pm Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call 2024-05-29 07:17:42 +00:00
AuthoritiesMarc.pm Bug 32279: Add GetAuthorizedHeading method export C4::AuthoritiesMarc 2023-04-16 18:08:50 +01:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 34943: (QA follow-up) Use `before_biblio_action` and an `action` param 2024-03-26 15:31:26 +01:00
Breeding.pm Bug 33404: Fix serverhost and init $page 2023-07-18 13:27:56 +00:00
Budgets.pm Bug 27550: "Duplicate budget" does not keep users associated with that budget 2022-09-22 08:18:33 -03:00
Calendar.pm Bug 32048: Added clear cache routine to delete_holiday_range_repeatable 2023-10-12 16:00:20 +00:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 30362: Fix GetSoonestRenewDate to really return soonest renew date 2023-08-31 13:34:28 +00:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 36081: Use multivalue_preference 2025-02-26 12:17:31 -03:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-16 07:32:11 +01:00
HoldsQueue.pm Bug 34678: Allow new entries to overwrite hold_fill_targets 2023-11-13 15:22:14 +00:00
ImportBatch.pm Bug 34822: Process real time holds along with indexing 2023-10-17 16:56:24 +00:00
ImportExportFramework.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 34656: Do not update real Time Holds Queue when moving from cart to shelf 2023-10-12 15:31:50 +00:00
Koha.pm Bug 33341: Address some perlcritic errors in 5.36 2023-04-11 10:54:27 +00:00
Labels.pm Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
Languages.pm Bug 32775: (QA follow-up) Fix tab and indenting issues 2023-06-05 16:51:50 +00:00
Letters.pm Bug 37198: Improve GetPreparedLetter documentation 2024-10-07 19:17:57 +02:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 31203: Add End action to cronjobs and log viewer 2022-10-05 16:12:55 -03:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 26611: Make authority record matching use required match checks 2023-06-08 17:15:33 +00:00
Members.pm Bug 33937: Remove incorrect export in C4::Members 2023-07-12 09:36:02 +00:00
Message.pm Bug 18398: (follow-up) Update POD & Unit tests 2023-05-09 21:34:01 +01:00
Output.pm Bug 30524: Core CSRF checking code 2023-07-28 11:13:55 +00:00
Overdues.pm Bug 34279: Don't enforce overduefinescap unless it is greater than 0 2023-08-18 10:37:11 +00:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 17798: Confirm hold when printing slip from another patron's account 2023-11-14 13:42:15 -01:00
Ris.pm Bug 34174: (bug 33341 follow-up) Fix Ris export 2023-07-18 13:32:49 +00:00
RotatingCollections.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMS.pm Bug 27673: Replace YAML with YAML::XS 2021-02-16 14:54:50 +01:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 19613: Fix test for 22.11 2024-04-24 10:40:09 +00:00
Search.pm Bug 13976: Sort popularity numerically in Zebra 2023-04-16 17:46:38 +01:00
Serials.pm Bug 38829: Sanitize GetLateOrMissingIssues inputs 2025-02-19 14:33:45 +00:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 7021: Terminology - usercode -> categorycode 2022-09-22 09:31:28 -03:00
Suggestions.pm Bug 32027: Fix 'librarian interface' to use 'staff interface' in Pages/HTML customizations/News 2023-02-08 16:32:02 +00:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 31517: (QA follow-up) Fix indentation 2022-11-04 19:30:56 -03:00
Templates.pm Bug 38467: Make uri and url filters rfc3986 when using C4::Template 2025-02-19 14:33:44 +00:00
TmplToken.pm Bug 16011: $VERSION - Remove the $VERSION init 2016-03-24 17:20:28 +00:00
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 30025: Replace AllowManualAuthorityEditing with RequireChoosingExistingAuthority 2022-09-16 16:48:34 -03:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 28375: (follow-up) Use C4::Context->interface 2022-10-20 11:50:53 -03:00