From d6da091d631dc67b0eb4a750a971b7d9dba45c56 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 3 May 2018 15:40:11 -0300
Subject: [PATCH] Bug 20685: Escape letter template content in textarea
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Test plan:
enter the following text into the Email template for 'HOLD_SLIP'
in Home › Tools › Notices & Slips › Modify notice

<div style='max-width: 4in;'>
<h3><<borrowers.surname>>, <<borrowers.firstname>></h3><br />
<<borrowers.streetnumber>> <<borrowers.address>><br />
<<borrowers.address2>><br />
<<borrowers.city>>, <<borrowers.state>> <<borrowers.zipcode>><br />
<br />
<br />
<img src="/cgi-bin/koha/svc/barcode?barcode=<<borrowers.cardnumber>>&type=Industrial2of5&notext=1">

Edit it again
Without this patch you will get:
<img src="/cgi-bin/koha/svc/barcode?barcode=<<borrowers.cardnumber>>&type=Industrial2of5¬ext=1">

Signed-off-by: Barton Chittenden <barton@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 305d3c36cb685fabce3ec4357ed769c25b12eb73)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
index 9c757baab6..f56c91860b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
@@ -479,7 +479,7 @@ $(document).ready(function() {
                         <td class="actions">
                             <button type="button" data-containerid="[% letter.message_transport_type %]_[% lang %]" class="btn btn-default btn-sm insert">Insert <i class="fa fa-long-arrow-right"></i></button>
                         </td>
-                      <td><textarea name="content" id="content_[% letter.message_transport_type %]" cols="80" rows="15">[% letter.content %]</textarea></td>
+                      <td><textarea name="content" id="content_[% letter.message_transport_type %]" cols="80" rows="15">[% letter.content | html %]</textarea></td>
                     </tr>
                   </table>
                 </li>
-- 
2.39.5