From b59988f78d0db6ae953949aca9dd60bd88601596 Mon Sep 17 00:00:00 2001
From: Josef Moravec <josef.moravec@gmail.com>
Date: Sun, 3 Dec 2017 22:21:57 +0000
Subject: [PATCH] Bug 19738: Fix XSS on vendor name in serials module

Test plan:

1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 .../prog/en/modules/serials/acqui-search-result.tt              | 2 +-
 .../prog/en/modules/serials/subscription-detail.tt              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt
index 3ee8266476..e1dacd33fc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt
@@ -27,7 +27,7 @@
 	</tr>
 	[% FOREACH loop_supplier IN loop_suppliers %]
         <tr>
-			<td>[% loop_supplier.name %]</td>
+            <td>[% loop_supplier.name |html %]</td>
             <td><a class="btn btn-default btn-xs select_vendor" href="#" data-vendorid="[% loop_supplier.aqbooksellerid %]" data-vendorname="[% loop_supplier.name |html%]">Choose</a></td>
 		</tr>
 	[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
index f759d14ec6..f487738b52 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
@@ -64,7 +64,7 @@
 		<ol>
 		<li><span class="label">Subscription ID: </span>[% subscriptionid %]</li>
         <li><span class="label">Librarian identity:</span> [% librarian %]</li>
-        <li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid %]">[% aqbooksellername %]</a></li>
+        <li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid %]">[% aqbooksellername |html %]</a></li>
         <li><span class="label">Biblio:</span>  <a href="/cgi-bin/koha/catalogue/[% default_bib_view %].pl?biblionumber=[% bibnum %]">[% bibliotitle %]</a> <i>([% bibnum %])</i></li>
         [% IF ( OPACBaseURL ) %]
             <li>
-- 
2.39.5