From 1383f2798206ab323513221d0930949a63e18c25 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@koha-community.org>
Date: Fri, 19 Jun 2015 11:21:56 +0200
Subject: [PATCH] Bug 14416: Stored XSS vulnerability - add biblio to shelf
 (intranet)

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Mason James <mtj@kohaaloha.com>
---
 .../prog/en/modules/virtualshelves/addbybiblionumber.tt   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
index 03b6005f95..8dae4bff24 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
@@ -17,9 +17,9 @@
 <div id="custom-doc" class="yui-t7">
    <div id="bd">
                 [% IF ( multiple ) %]
-		    <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname %]</em>: [% ELSE %]a list:[% END %]</h1>
+		    <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html%]</em>: [% ELSE %]a list:[% END %]</h1>
                 [% ELSE %]
-                        <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname %]</em>[% ELSE %]a list:[% END %]</h1>
+                        <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>[% ELSE %]a list:[% END %]</h1>
                 [% END %]
 		<ul>
 		    [% FOREACH biblio IN biblios %]
@@ -46,14 +46,14 @@
 		[% IF ( privatevirtualshelves ) %]
         <optgroup label="Private lists">
 		[% FOREACH privatevirtualshelve IN privatevirtualshelves %]
-		<option value="[% privatevirtualshelve.shelfnumber %]">[% privatevirtualshelve.shelfname %]</option>
+		<option value="[% privatevirtualshelve.shelfnumber %]">[% privatevirtualshelve.shelfname | html%]</option>
 		[% END %]
 		</optgroup>
 		[% END %]
 		[% IF ( publicvirtualshelves ) %]
         <optgroup label="Public lists">
 		[% FOREACH publicvirtualshelve IN publicvirtualshelves %]
-		<option value="[% publicvirtualshelve.shelfnumber %]">[% publicvirtualshelve.shelfname %]</option>
+		<option value="[% publicvirtualshelve.shelfnumber %]">[% publicvirtualshelve.shelfname | html%]</option>
 		[% END %]
 		</optgroup>
 		[% END %]
-- 
2.39.5