From a2e811dafc006db60bcd4223dd7dc7c66f0308e4 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 12 Sep 2017 10:58:24 -0300
Subject: [PATCH] Bug 19103: (follow-up) Stored XSS in itemtypes.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c221bc40a330a25d59097e94e962a4afcea011af)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit e3e035c3ef1f89c416922f6a81fdc2b4596f900e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
index ff8de637b7..57690f7451 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
@@ -387,7 +387,7 @@ Item types administration
               [% itemtype.rentalcharge | $Price %]
             [% END %]
             </td>
-            <td>[% itemtype.checkinmsg | html_line_break |html %]</td>
+            <td>[% itemtype.checkinmsg | html | html_line_break %]</td>
             <td class="actions">
               <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-mini"><i class="fa fa-pencil"></i> Edit</a>
               <a href="/cgi-bin/koha/admin/itemtypes.pl?op=delete_confirm&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-mini"><i class="fa fa-trash"></i> Delete</a>
-- 
2.20.1