From 09b02e092ef5d9883f5fec20d6d09b661f7df7e3 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 20 May 2021 08:34:48 +0200 Subject: [PATCH] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 2 +- opac/opac-shelves.pl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt index 3bdb18b6416..55f13358e3a 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt @@ -1096,7 +1096,7 @@ function AdjustRemark() { if( $("#category").length > 0 ) { category = $("#category").val(); } else { - category = [% category | html %]; + category = "[% category | html %]"; } var perms = $("#allow_changes_from").val(); diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl index b94b4126ea5..483876188e9 100755 --- a/opac/opac-shelves.pl +++ b/opac/opac-shelves.pl @@ -434,7 +434,7 @@ $template->param( referer => $referer, shelf => $shelf, messages => \@messages, - category => $category, + category => ($category == 1 || $category == 2) ? $category : "", print => scalar $query->param('print') || 0, listsview => 1, ); -- 2.20.1