Bug 17024: Fix XSS in tools/viewlog.pl

Test plan:
    Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc
index 4258aa3..76c52f8 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc
@@ -3,36 +3,36 @@
 <div id="menu">
 <ul>
     [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]
-    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id %]">Normal</a></li>
+    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id | url  %]">Normal</a></li>
 
 [% IF ( can_view_MARC ) %]
 [% IF ( marcview ) %]<li class="active">[% ELSE %]<li>[% END %]
-<a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblio_object_id %]">MARC</a></li>
+<a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblio_object_id | url  %]">MARC</a></li>
 [% END %]
 
 [% IF ( can_view_labeledMARC ) %]
     [% IF ( labeledmarcview ) %]<li class="active">[% ELSE %]<li>[% END %]
-       <a href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblio_object_id %]">Labeled MARC</a></li>
+    <a href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblio_object_id | url  %]">Labeled MARC</a></li>
 [% END %]
 
 [% IF ( can_view_ISBD ) %]
     [% IF ( isbdview ) %]<li class="active">[% ELSE %]<li>[% END %]
-    <a href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblio_object_id %]">ISBD</a></li>
+    <a href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblio_object_id | url  %]">ISBD</a></li>
 [% END %]
 
     [% IF ( moredetailview ) %]<li class="active">[% ELSE %]<li>[% END %]
-    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio_object_id %]">Items</a></li>
+    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio_object_id | url  %]">Items</a></li>
     [% IF ( CAN_user_reserveforothers ) %]
-    [% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) %])</a></li>
+    [% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id | url  %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) %])</a></li>
     [% END %]
-    [% IF ( EasyAnalyticalRecords ) %][% IF ( analyze ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id %]&amp;analyze=1">Analytics</a></li>[% END %]
+    [% IF ( EasyAnalyticalRecords ) %][% IF ( analyze ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id | url  %]&amp;analyze=1">Analytics</a></li>[% END %]
 
-    [% IF ( subscriptionsnumber ) %]<li><a href="/cgi-bin/koha/serials/serials-search.pl?searched=1&amp;biblionumber=[% biblio_object_id %]">Subscription(s)</a></li>[% END %]
+    [% IF ( subscriptionsnumber ) %]<li><a href="/cgi-bin/koha/serials/serials-search.pl?searched=1&amp;biblionumber=[% biblio_object_id | url  %]">Subscription(s)</a></li>[% END %]
 </ul>
 <ul>
 [% IF ( issuehistoryview ) %]<li class="active">[% ELSE %]<li>[% END %]
-<a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio_object_id %]" >Checkout history</a></li>
-[% IF ( CAN_user_tools_view_system_logs ) %][% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=CATALOGUING&amp;action=MODIFY&amp;object=[% biblio_object_id %]">Modification log</a> </li>[% END %]
+<a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio_object_id | url  %]" >Checkout history</a></li>
+[% IF ( CAN_user_tools_view_system_logs ) %][% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=CATALOGUING&amp;action=MODIFY&amp;object=[% biblio_object_id | url  %]">Modification log</a> </li>[% END %]
 </ul>
 </div>
 

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
index d5f616b..472d87c 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
@@ -69,12 +69,12 @@
                                        [% IF ( do_it ) %]
                                                <input type="hidden" name="do_it" value="[% do_it %]" />
                                        [% END %]
-                                       <input type="hidden" name="src" value="[% src %]" />
+                    <input type="hidden" name="src" value="[% src | html %]" />
                                        <fieldset class="rows">
                                                <ol>
                                                        <li>
                                                                <label for="user">Librarian:</label>
-                                                               <input type="text" name="user" id="user" value="[% user %]" />
+                                <input type="text" name="user" id="user" value="[% user | html %]" />
                                                        </li>
                         <li>
                                 <label for="modules">Modules:</label>
@@ -113,18 +113,18 @@
                             </li>
                                                        <li>
                                                                <label for="object">Object: </label>
-                                                               <input type="text" id="object" name="object" value="[% object %]" />
+                                <input type="text" id="object" name="object" value="[% object | html %]" />
                                                        </li>
                                                        <li>
                                                                <label for="info">Info:</label>
-                                                               <input type="text" id="info" name="info" value="[% info %]" />
+                                <input type="text" id="info" name="info" value="[% info | html %]" />
                                                        </li>
                                                        <li>
-                                <label for="from"> Display from: </label> <input type="text" size="10" id="from" name="from" value="[% datefrom %]" class="datepickerfrom" />
+                                <label for="from"> Display from: </label> <input type="text" size="10" id="from" name="from" value="[% datefrom | html %]" class="datepickerfrom" />
                                <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
                                                        </li>
                                                        <li>
-                                <label for="to">Display to: </label> <input size="10" id="to" name="to" type="text" value="[% dateto %]" class="datepickerto" />
+                                <label for="to">Display to: </label> <input size="10" id="to" name="to" type="text" value="[% dateto | html %]" class="datepickerto" />
                                <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
                                                        </li>
                                                </ol>
@@ -218,10 +218,10 @@
                         <div class="dialog alert">
                             No log found
                             [% IF ( CATALOGUING ) %]
-                                for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% object %]">Bibliographic record [% object %]</a>
+                                for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% object | url %]">Bibliographic record [% object | html %]</a>
                             [% END %]
                             [% IF ( MEMBERS ) %]
-                                for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% object %]">[% INCLUDE 'patron-title.inc' %]</a>
+                                for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% object | url %]">[% INCLUDE 'patron-title.inc' %]</a>
                             [% END %]
                             .
                         </div>