From c63d0b311b5e7ba882d19b9b8a71838256de98cf Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 2 Aug 2016 14:00:02 +0100
Subject: [PATCH] Bug 17022: Fix XSS in circ/branchtransfers.pl

Test plan:
Enter the following in the barcode input:
    <script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
---
 .../intranet-tmpl/prog/en/modules/circ/branchtransfers.tt   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
index e2916d9176..7f0ac14cdb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
@@ -40,7 +40,7 @@
                     <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
                     <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
                     [% IF ( waiting ) %]
-                        <input type="hidden" name="barcode" value="[% barcode %]" />
+                        <input type="hidden" name="barcode" value="[% barcode | html %]" />
                         <input type="hidden" name="request" value="KillWaiting" />
                         <input type="submit" value="Cancel" />
                     [% END %]
@@ -64,7 +64,7 @@
                             <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
                             <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
                             <input type="hidden" name="tobranchcd" value="[% tobranchcd %]" />
-                            <input type="hidden" name="barcode" value="[% barcode %]" />
+                            <input type="hidden" name="barcode" value="[% barcode | html %]" />
                             <input type="hidden" name="request" value="KillReserved" />
                             <input type="submit" value="Cancel" />
                         </form>
@@ -107,7 +107,7 @@
                             <ul>
                              [% FOREACH errmsgloo IN errmsgloop %]
                               [% IF ( errmsgloo.errbadcode ) %]
-                                  <li>No Item with barcode: [% errmsgloo.msg %]</li>
+                                  <li>No Item with barcode: [% errmsgloo.msg | html %]</li>
                               [% END %]
                               [% IF ( errmsgloo.errispermanent ) %]
                                   <li>Please return item to home library: [% errmsgloo.msg %]</li>
-- 
2.39.5