From f4a9e942424524da9251f4d55dd01fd08e05846f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 28 Jul 2016 13:01:43 +0100
Subject: [PATCH] Bug 17021: Fix XSS in circ/returns.pl
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Test plan:
Enter the following in the barcode input:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 12b4c83f5a5c11af635cae83e6837ff80dc02da7)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 4f5121a99e063fc05fb19caac89e5a56b1ff0afb)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index 38c5887069..db51f183de 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -249,7 +249,7 @@ $(document).ready(function () {
                 <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
                 <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
                 <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
-                <input type="hidden" name="resbarcode" value="[% barcode %]" />
+                <input type="hidden" name="resbarcode" value="[% barcode | html %]" />
                 <input type="hidden" name="diffBranch" value="[% destbranch %]" />
                 <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
                 <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
@@ -411,7 +411,7 @@ $(document).ready(function () {
             <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
             <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
             <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
-            <input type="hidden" name="resbarcode" value="[% barcode %]" />
+            <input type="hidden" name="resbarcode" value="[% barcode | html %]" />
             <input type="hidden" name="diffBranch" value="[% destbranch %]" />
             <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
             <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
@@ -448,7 +448,7 @@ $(document).ready(function () {
                         </p>
                     [% END %]
                     [% IF ( errmsgloo.badbarcode ) %]
-                        <p class="problem">No item with barcode: [% errmsgloo.msg %]</p>
+                        <p class="problem">No item with barcode: [% errmsgloo.msg | html %]</p>
                     [% END %]
                     [% IF ( errmsgloo.ispermanent ) %]
                         <p class="problem">Please return item to: [% errmsgloo.msg %]</p>
-- 
2.39.5