From 4a414a044d1792baa6a588c275b7c74ad07833e4 Mon Sep 17 00:00:00 2001
From: Aleisha <aleishaamohia@hotmail.com>
Date: Tue, 9 Jun 2015 02:02:55 +0000
Subject: [PATCH] Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index b671860cf2..03d18ba273 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -130,10 +130,10 @@
                               <div class="alert">A record matching barcode <b>[% paramsloo.duplicatebiblio %]</b> has already been added.</div>
                             [% END %]
                             [% IF ( paramsloo.delete_ok ) %]
-                              <div class="alert alert-info">List [% paramsloo.delete_ok %] Deleted.</div>
+                              <div class="alert alert-info">List [% paramsloo.delete_ok |html %] Deleted.</div>
                             [% END %]
                             [% IF ( paramsloo.delete_fail ) %]
-                              <div class="alert alert-info">ERROR: Database error. Delete (list number [% paramsloo.delete_fail %]) failed.</div>
+                              <div class="alert alert-info">ERROR: Database error. Delete (list number [% paramsloo.delete_fail |html %]) failed.</div>
                             [% END %]
                             [% IF ( paramsloo.unrecognized ) %]
                               <div class="alert alert-info">ERROR: List number [% paramsloo.unrecognized %] unrecognized.</div>
-- 
2.39.5