From f54968628736ee7fa05a478ba5020a85375157ee Mon Sep 17 00:00:00 2001
From: Chris Cormack <chris@bigballofwax.co.nz>
Date: Mon, 8 Aug 2016 18:59:23 +1200
Subject: [PATCH] Bug 17026 XSS in checkexpiration.pl

---
 .../prog/en/modules/serials/checkexpiration.tt            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
index 95bfcb89fd..852ce63af6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
@@ -47,10 +47,10 @@
     
          <ol>
         <li><label for="title">Title:</label>
-        <input id="title" type="text" name="title" size="15" value="[% title %]" /></li>
+        <input id="title" type="text" name="title" size="15" value="[% title | html %]" /></li>
 
         <li><label for="issn">ISSN:</label>
-        <input id="issn" type="text" name="issn" size="15" value="[% issn %]" /></li>
+        <input id="issn" type="text" name="issn" size="15" value="[% issn | html %]" /></li>
 
         <li><label for="date" class="required" title="Required field">Expiring before:</label>
         <input id="date" type="text" name="date" size="10" value="[% date %]" class="focus datepicker" />
@@ -66,11 +66,11 @@
 <p>
     <b>[% numsubscription %]</b> subscription(s)
         [% IF ( title ) %]
-        with title matching <span class="title">[% title %]</class>
+        with title matching <span class="title">[% title | html %]</class>
         [% IF ( issn ) %]and [% END %]
     [% END %]
     [% IF ( issn ) %]
-        with ISSN matching <b>[% issn %]</b>
+        with ISSN matching <b>[% issn | html %]</b>
     [% END %]
         will expire before <b>[% date %]</b>
 </p>
-- 
2.39.5