In opac (and intranet), in search results, two parameters need escaping in title (html element): - query_desc - limit_desc Impacted templates: koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt koha-tmpl/opac-tmpl/prog/en/modules/opac-results.tt This is a security issue, as it could be used to perform XSS (I have tested).
Created attachment 6565 [details] [review] Missing escaping in search results
Created attachment 6583 [details] [review] Signed-off patch
patch pushed, please test
Included in the 3.6 branch prior to 3.6.4.