From ef075380458f9cefa85bb3a9fe2720ac56d26f5a Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Tue, 11 Aug 2020 15:26:57 +0000 Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used: suggester_search.tt Test the process of adding a new suggestion and changing the "created by" patron using the "Set to patron" button. The patron search results should be displayed correctly in the pop up window. --- .../intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt index a82f0e8dcb..cbac0393a9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt @@ -32,5 +32,5 @@ [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] [%~ SET address = address _ Branches.GetName( data.branchcode ) %] -[%~ To.json( address ) | $raw ~%] +[%~ address | html | $To ~%] [% END %] -- 2.11.0