From d68d8f4f3672256fbd233310d1d4aa5857c28a8c Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Sat, 29 Sep 2018 13:10:19 -0300
Subject: [PATCH] Bug 21454: Do not require html filter on Price

Test plan:
- Apply first patch
- Confirm that tests is failing (t/template_filters.t)
- Apply second patch
- Confirm that tests return green
- Apply last patch
- Confirm that prices are displayed correctly

QA step:
Edit a template and add the following 2 lines:
[% SET p = '<script>alert("foo");</script>' %]
[% x | $Price %]
=> Display '0.00'

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
---
 t/lib/QA/TemplateFilters.pm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/t/lib/QA/TemplateFilters.pm b/t/lib/QA/TemplateFilters.pm
index 4b4a3d2835..2aa94b7dfb 100644
--- a/t/lib/QA/TemplateFilters.pm
+++ b/t/lib/QA/TemplateFilters.pm
@@ -65,7 +65,8 @@ sub missing_filters {
                 next if grep { $tt_block =~ $_ } @tt_directives;
 
                 next
-                  if $tt_block =~ m{\s?\|\s?\$KohaDates\s?$}
+                  if   $tt_block =~ m{\s?\|\s?\$KohaDates\s?$}
+                    or $tt_block =~ m{\s?\|\s?\$Price\s?$}
                   ;    # We could escape it but should be safe
                 next if $tt_block =~ m{^\#};    # Is a comment, skip it
 
-- 
2.39.5