From 89062078ec1fd6fd4efae2916a3c341d4309f4b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joonas=20Kylm=C3=A4l=C3=A4?= <joonas.kylmala@iki.fi>
Date: Sun, 3 Oct 2021 12:19:30 +0000
Subject: [PATCH] Bug 24698: (QA follow-up) Filter untrusted input to prevent
 XSS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: George Veranis <gveranis@dataly.gr>

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
---
 .../cataloguing/value_builder/unimarc_leader_authorities.tt     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt
index 2e4e1a2b79..3a4962c23d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt
@@ -188,7 +188,7 @@
 //<![CDATA[
 function report() {
     var doc   = opener.document;
-    var field = doc.getElementById("[% index %]");
+    var field = doc.getElementById("[% index | html %]");
 
     field.value ='     '+document.f_pop.f5.value+document.f_pop.f6.value+'  '+document.f_pop.f9.value+'22     '+document.f_pop.f17.value+'  '+'45  ';
 
-- 
2.20.1