From dbcbd5001ccf8840b64956873af1a06ee205a46f Mon Sep 17 00:00:00 2001 From: Owen Leonard Date: Tue, 11 Aug 2020 12:31:26 +0000 Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt Test that preference search term highlighting works correctly. --- koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt index b79d5d5359..8da5a7dc5c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt @@ -266,7 +266,7 @@ }); }); // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw - var to_highlight = "[% To.json( searchfield ) | $raw %]"; + var to_highlight = "[% To.json( searchfield ) | html %]"; var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %]; [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] -- 2.11.0