From d6579c70190935801870cfe56a1a09a8d04c2b0e Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 12 Sep 2017 11:21:27 -0300
Subject: [PATCH] Bug 19127: (follow-up) Stored XSS in csv-profiles.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 52b41dfdf0ec03c24dd970b80e4f153f64702e30)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../intranet-tmpl/prog/en/modules/tools/csv-profiles.tt     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
index 62aebcce8a..0b2cb315e5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
@@ -118,7 +118,7 @@ function reloadPage(p) {
                 [% END %]
                 <li>
                     <label for="profile" class="required">Profile name: </label>
-                    <input type="text" name="profile" id="profile" value="[% csv_profile.profile %]" class="required">
+                    <input type="text" name="profile" id="profile" value="[% csv_profile.profile | html %]" class="required">
                     <span class="required">Required</span>
                 </li>
                 <li>
@@ -136,7 +136,7 @@ function reloadPage(p) {
                 </li>
                 <li>
                     <label for="description">Profile description: </label>
-                    <textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description %]</textarea>
+                    <textarea cols="50" rows="2" name="description" id="description">[% csv_profile.description | html %]</textarea>
                 </li>
                 <li>
                     <label for="csv_separator">CSV separator: </label>
@@ -199,7 +199,7 @@ function reloadPage(p) {
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
         [% IF csv_profile %]
-            <h3>Delete CSV Profile "[% csv_profile.profile %]?"</h3>
+            <h3>Delete CSV Profile "[% csv_profile.profile | html %]?"</h3>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" />
-- 
2.39.5