From c55599974dfda80e3aac7d0201b737b7532c89f2 Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Mon, 10 Mar 2008 13:32:47 -0500
Subject: [PATCH] Adding "ESCAPE=HTML" to hidden input template variables in
 order to address bug 1919, "Form contents not escaped on login page"

Signed-off-by: Joshua Ferraro <jmf@liblime.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl
index b895f1b152..802a849fab 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tmpl
@@ -38,7 +38,7 @@
 <!-- login prompt time-->
 <form action="<!-- TMPL_VAR NAME="url" -->" method="post" name="loginform" id="loginform">
 <!-- TMPL_LOOP NAME="INPUTS" -->
-    <input type="hidden" name="<!-- TMPL_VAR NAME="name" -->" value="<!-- TMPL_VAR NAME="value" -->" />
+    <input type="hidden" name="<!-- TMPL_VAR NAME="name" -->" value="<!-- TMPL_VAR NAME="value" ESCAPE="html" -->" />
 <!-- /TMPL_LOOP -->
 <p><label>Username:<br />
 <input type="text" name="userid" id="userid" class="input focus" value="<!-- TMPL_VAR NAME="userid" -->" size="20" tabindex="1" /></label>
-- 
2.39.5