From 4f5121a99e063fc05fb19caac89e5a56b1ff0afb Mon Sep 17 00:00:00 2001
From: Jonathan Druart
Date: Thu, 28 Jul 2016 13:01:43 +0100
Subject: [PATCH] Bug 17021: Fix XSS in circ/returns.pl
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit
Test plan:
Enter the following in the barcode input:
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack
Signed-off-by: Katrin Fischer
Signed-off-by: Kyle M Hall
(cherry picked from commit 12b4c83f5a5c11af635cae83e6837ff80dc02da7)
Signed-off-by: Frédéric Demians
---
koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index 96756d9b11..cbe1b5f9e0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -266,7 +266,7 @@ $(document).ready(function () {
-
+
@@ -428,7 +428,7 @@ $(document).ready(function () {
-
+
@@ -465,7 +465,7 @@ $(document).ready(function () {
[% END %]
[% IF ( errmsgloo.badbarcode ) %]
- No item with barcode: [% errmsgloo.msg %]
+ No item with barcode: [% errmsgloo.msg | html %]
[% END %]
[% IF ( errmsgloo.ispermanent ) %]
Please return item to: [% errmsgloo.msg %]
--
2.39.5