From e09fa8299fdc7b47e9c36396e792aea5a38e5b4b Mon Sep 17 00:00:00 2001
From: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Date: Fri, 15 Dec 2023 16:20:58 +0000
Subject: [PATCH] Bug 35570: (QA follow-up): Follow QA script on Standard
 backend

Make QA script green, fix:
- Variables declared in condition
- Use of DateTime->now should certainly be replaced with dt_from_string (bug 24840)
- missing_filter
- forbidden pattern: Do not use line breaks inside template tags (bug 18675)
- Attribute type should not be used for script tags (bug 20053)
- File must have the exec flag
- forbidden pattern: trailing space char
- valid_template: /shared-includes/custom_fields.inc: not found

Signed-off-by: David Nind <david@davidnind.com>
---
 Koha/ILL/Backend/Standard.pm                  |  27 +--
 Koha/ILL/Backend/intra-includes/cancel.inc    |   7 +-
 Koha/ILL/Backend/intra-includes/confirm.inc   |   7 +-
 Koha/ILL/Backend/intra-includes/create.inc    |  24 +--
 Koha/ILL/Backend/intra-includes/edititem.inc  | 162 +++++++++---------
 Koha/ILL/Backend/intra-includes/migrate.inc   |   8 +-
 Koha/ILL/Backend/opac-includes/create.inc     |  12 +-
 .../Backend/shared-includes/custom_fields.inc |   4 +-
 .../Backend/shared-includes/forms/article.inc |  20 +--
 .../Backend/shared-includes/forms/book.inc    |  20 +--
 .../Backend/shared-includes/forms/chapter.inc |  26 +--
 .../shared-includes/forms/conference.inc      |  22 +--
 .../Backend/shared-includes/forms/journal.inc |  12 +-
 .../shared-includes/forms/resource.inc        |  24 +--
 .../Backend/shared-includes/forms/thesis.inc  |  10 +-
 about.pl                                      |   2 +-
 .../data/mysql/atomicupdate/bug_35570.pl      |   1 -
 17 files changed, 195 insertions(+), 193 deletions(-)
 mode change 100644 => 100755 installer/data/mysql/atomicupdate/bug_35570.pl

diff --git a/Koha/ILL/Backend/Standard.pm b/Koha/ILL/Backend/Standard.pm
index 748680ad1a6..95c4eec858b 100644
--- a/Koha/ILL/Backend/Standard.pm
+++ b/Koha/ILL/Backend/Standard.pm
@@ -22,9 +22,10 @@ use DateTime;
 use File::Basename qw( dirname );
 use C4::Installer;
 
+use Koha::DateUtils qw/ dt_from_string /;
 use Koha::ILL::Requests;
 use Koha::ILL::Request::Attribute;
-use C4::Biblio  qw( AddBiblio );
+use C4::Biblio qw( AddBiblio );
 use C4::Charset qw( MarcToUTF8Record );
 
 =head1 NAME
@@ -225,7 +226,7 @@ sub create {
         };
     } elsif ( $stage eq 'form' ) {
 
-        # We may be recieving a submitted form due to an additional
+        # We may be receiving a submitted form due to an additional
         # custom field being added or deleted, or the material type
         # having been changed, so check for these things
         if ( !_can_create_request($other) ) {
@@ -383,7 +384,7 @@ sub edititem {
         };
     } elsif ( $stage eq 'form' ) {
 
-        # We may be recieving a submitted form due to an additional
+        # We may be receiving a submitted form due to an additional
         # custom field being added or deleted, or the material type
         # having been changed, so check for these things
         if (   defined $other->{'add_new_custom'}
@@ -452,7 +453,7 @@ sub edititem {
 
         # ...Update Illrequest
         my $request = $params->{request};
-        $request->updated( DateTime->now );
+        $request->updated( dt_from_string() );
         $request->store;
 
         # ...Populate Illrequestattributes
@@ -638,7 +639,7 @@ sub migrate {
 
     my $core_fields = _get_core_string();
 
-    # We may be recieving a submitted form due to an additional
+    # We may be receiving a submitted form due to an additional
     # custom field being added or deleted, or the material type
     # having been changed, so check for these things
     if (   defined $other->{'add_new_custom'}
@@ -679,7 +680,7 @@ sub migrate {
         };
     }
 
-    # Recieve a new request from another backend and suppliment it with
+    # Receive a new request from another backend and supplement it with
     # anything we require specifically for this backend.
     if ( !$stage || $stage eq 'immigrate' ) {
         my $original_request = Koha::ILL::Requests->find( $other->{illrequest_id} );
@@ -688,8 +689,8 @@ sub migrate {
         $new_request->branchcode( $original_request->branchcode );
         $new_request->status('NEW');
         $new_request->backend( $self->name );
-        $new_request->placed( DateTime->now );
-        $new_request->updated( DateTime->now );
+        $new_request->placed( dt_from_string() );
+        $new_request->updated( dt_from_string() );
         $new_request->store;
 
         my @default_attributes = (qw/title type author year volume isbn issn article_title article_author pages/);
@@ -972,8 +973,8 @@ sub add_request {
     $request->branchcode( $params->{other}->{branchcode} );
     $request->status('NEW');
     $request->backend( $params->{other}->{backend} );
-    $request->placed( DateTime->now );
-    $request->updated( DateTime->now );
+    $request->placed( dt_from_string() );
+    $request->updated( dt_from_string() );
     $request->batch_id(
         $params->{other}->{ill_batch_id} ? $params->{other}->{ill_batch_id} : $params->{other}->{batch_id} )
         if column_exists( 'illrequests', 'batch_id' );
@@ -1151,9 +1152,9 @@ sub _standard_request2biblio {
     return 0 unless $metadata->{type} eq 'book';
 
     # We're going to try and populate author, title & ISBN
-    my $author = $metadata->{author} if $metadata->{author};
-    my $title  = $metadata->{title}  if $metadata->{title};
-    my $isbn   = $metadata->{isbn}   if $metadata->{isbn};
+    my $author = $metadata->{author} // '';
+    my $title  = $metadata->{title}  // '';
+    my $isbn   = $metadata->{isbn}   // '';
 
     # Create the MARC::Record object and populate
     my $record = MARC::Record->new();
diff --git a/Koha/ILL/Backend/intra-includes/cancel.inc b/Koha/ILL/Backend/intra-includes/cancel.inc
index 6c107abb304..99301ffbf4c 100644
--- a/Koha/ILL/Backend/intra-includes/cancel.inc
+++ b/Koha/ILL/Backend/intra-includes/cancel.inc
@@ -9,9 +9,8 @@
 <p>If you can confirm this has been done, please proceed.</p>
 <p>
   [% base_url = "/cgi-bin/koha/ill/ill-requests.pl" %]
-  [% proceed_url = base_url _ "?method=cancel&stage=confirm" _
-                   "&illrequest_id=" _ request.illrequest_id %]
-  <a class="btn btn-sm btn-default" href="[% proceed_url %]">Revert request</a>
-  <a class="btn btn-sm btn-default cancel" href="[% base_url %]">Cancel</a>
+  [% proceed_url = base_url _ "?method=cancel&stage=confirm" _ "&illrequest_id=" _ request.illrequest_id %]
+  <a class="btn btn-sm btn-default" href="[% proceed_url | url %]">Revert request</a>
+  <a class="btn btn-sm btn-default cancel" href="[% base_url | url %]">Cancel</a>
 </p>
 [% END %]
diff --git a/Koha/ILL/Backend/intra-includes/confirm.inc b/Koha/ILL/Backend/intra-includes/confirm.inc
index dcd003752e3..099c5d6a67b 100644
--- a/Koha/ILL/Backend/intra-includes/confirm.inc
+++ b/Koha/ILL/Backend/intra-includes/confirm.inc
@@ -9,10 +9,9 @@
 <p>If you can confirm this has been done, please proceed.</p>
 <p>
   [% base_url = "/cgi-bin/koha/ill/ill-requests.pl" %]
-  [% proceed_url = base_url _ "?method=confirm&stage=confirm" _
-                   "&illrequest_id=" _ request.illrequest_id %]
-  <a class="btn btn-sm btn-default" href="[% proceed_url %]">Confirm request</a>
-  <a class="btn btn-sm btn-default cancel" href="[% base_url %]">Cancel</a>
+  [% proceed_url = base_url _ "?method=confirm&stage=confirm" _ "&illrequest_id=" _ request.illrequest_id %]
+  <a class="btn btn-sm btn-default" href="[% proceed_url | url %]">Confirm request</a>
+  <a class="btn btn-sm btn-default cancel" href="[% base_url | url %]">Cancel</a>
 </p>
 [% ELSE %]
 <p>Unknown stage.  This should not have happened.
diff --git a/Koha/ILL/Backend/intra-includes/create.inc b/Koha/ILL/Backend/intra-includes/create.inc
index 162d88749f9..7655644d508 100644
--- a/Koha/ILL/Backend/intra-includes/create.inc
+++ b/Koha/ILL/Backend/intra-includes/create.inc
@@ -15,7 +15,7 @@
 
 [% IF whole.stage == "form" %]
 <h2>Create a manual ILL request</h2>
-<form id="create_form" method="POST" action=[% here %]>
+<form id="create_form" method="POST" action="">
   <fieldset class="rows">
     <legend>General details</legend>
     <ol id="general-standard-fields">
@@ -93,8 +93,8 @@
         <select id="branchcode" name="branchcode">
           <option value="" />
           [% FOREACH branch IN branches %]
-            <option value="[% branch.branchcode %]">
-              [% branch.branchname %]
+            <option value="[% branch.branchcode | html %]">
+              [% branch.branchname | html %]
             </option>
           [% END %]
         </select>
@@ -110,7 +110,7 @@
   <input type="hidden" name="backend" value="Standard" />
 </form>
 [% BLOCK backend_jsinclude %]
-<script type="text/javascript">
+<script>
     // <![CDATA[]
     [% INCLUDE "${cwd}/shared-includes/shared.js" %]
     // Require a username and branch selection
@@ -157,22 +157,22 @@
 [% ELSIF whole.stage == "borrowers" %]
 <!-- We need to clarify the borrower that has been requested. -->
 <h2>Borrower selection</h2>
-<form method="POST" action=[% here %]>
+<form method="POST" action="">
   [% FOREACH prop IN whole.value.other.keys %]
     [% IF prop != 'custom_key' &&  prop != 'custom_value' && prop != 'cardnumber' %]
-    <input type="hidden" name="[% prop %]" value="[% whole.value.other.$prop %]">
+    <input type="hidden" name="[% prop | html %]" value="[% whole.value.other.$prop | html %]">
     [% END %]
   [% END %]
   [% keys = whole.value.other.custom_key.split('\0') %]
   [% values = whole.value.other.custom_value.split('\0') %]
   [% i = 0 %]
   [% FOREACH key IN keys %]
-    <input type="hidden" name="custom_key" value="[% key %]">
-    <input type="hidden" name="custom_value" value="[% values.$i %]">
+    <input type="hidden" name="custom_key" value="[% key | html %]">
+    <input type="hidden" name="custom_value" value="[% values.$i | html %]">
   [% i = i + 1 %]
   [% END %]
   <fieldset class="rows">
-    <legend>Available borrowers for surname [% surname %]</legend>
+    <legend>Available borrowers for surname [% surname | html %]</legend>
     [% FOREACH opt IN whole.value %]
     [% IF opt.key == "brw" %]
     <ol>
@@ -181,8 +181,8 @@
         <select name="cardnumber" id="cardnumber">
           <option value=""></option>
           [% FOREACH brw IN opt.value %]
-          <option value="[% brw.cardnumber %]">
-            [% brw.firstname %] [% brw.surname %] ([% brw.cardnumber %])
+          <option value="[% brw.cardnumber | html %]">
+            [% brw.firstname | html %] [% brw.surname | html %] ([% brw.cardnumber | html %])
           </option>
           [% END %]
         </select>
@@ -193,7 +193,7 @@
   </fieldset>
   <fieldset class="action">
     <input type="submit" value="Select"/>
-    <a class="cancel" href=[% parent %]>Cancel</a>
+    <a class="cancel" href=[% parent | url %]>Cancel</a>
   </fieldset>
 </form>
 
diff --git a/Koha/ILL/Backend/intra-includes/edititem.inc b/Koha/ILL/Backend/intra-includes/edititem.inc
index bb34ce293af..58dfb4bcaed 100644
--- a/Koha/ILL/Backend/intra-includes/edititem.inc
+++ b/Koha/ILL/Backend/intra-includes/edititem.inc
@@ -6,83 +6,87 @@
 [% END %]
 [% END %]
 
-<h2>Edit a manual ILL request</h2>
-<form id="standard_edit_form" method="POST" action=[% here %]>
-  <fieldset class="rows">
-    <legend>General details</legend>
-    <ol id="general-standard-fields">
-      <li>
-        <label class="required" for="type">Type:</label>
-        <select name="type" id="type">
-          <option value=""/>
-          [% IF whole.value.other.type.lower == "book" %]
-          <option value="book" selected="selected">Book</option>
-          [% ELSE %]
-          <option value="book">Book</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "chapter" %]
-          <option value="chapter" selected="selected">Chapter</option>
-          [% ELSE %]
-          <option value="chapter">Chapter</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "journal" %]
-          <option value="journal" selected="selected">Journal</option>
-          [% ELSE %]
-          <option value="journal">Journal</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "article" %]
-          <option value="article" selected="selected">Journal article</option>
-          [% ELSE %]
-          <option value="article">Journal article</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "thesis" %]
-          <option value="thesis" selected="selected">Thesis</option>
-          [% ELSE %]
-          <option value="thesis">Thesis</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "conference" %]
-          <option value="conference" selected="selected">Conference</option>
-          [% ELSE %]
-          <option value="conference">Conference</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "dvd" %]
-          <option value="dvd" selected="selected">DVD</option>
-          [% ELSE %]
-          <option value="dvd">DVD</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "other" %]
-          <option value="other" selected="selected">Other</option>
-          [% ELSE %]
-          <option value="other">Other</option>
-          [% END %]
-          [% IF whole.value.other.type.lower == "resource" %]
-          <option value="resource" selected="selected">Generic resource</option>
-          [% ELSE %]
-          <option value="resource">Generic resource</option>
-          [% END %]
-        </select>
-      </li>
-    </ol>
-  </fieldset>
-  [% cwd = whole.cwd %]
-  [% type = whole.value.other.type %]
-  [% IF type %]
-      [% INCLUDE "${cwd}/shared-includes/forms/${type}.inc" %]
+[% IF whole.stage == "form" %]
+  <h2>Edit a manual ILL request</h2>
+  <form id="standard_edit_form" method="POST" action="">
+    <fieldset class="rows">
+      <legend>General details</legend>
+      <ol id="general-standard-fields">
+        <li>
+          <label class="required" for="type">Type:</label>
+          <select name="type" id="type">
+            <option value=""/>
+            [% IF whole.value.other.type.lower == "book" %]
+            <option value="book" selected="selected">Book</option>
+            [% ELSE %]
+            <option value="book">Book</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "chapter" %]
+            <option value="chapter" selected="selected">Chapter</option>
+            [% ELSE %]
+            <option value="chapter">Chapter</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "journal" %]
+            <option value="journal" selected="selected">Journal</option>
+            [% ELSE %]
+            <option value="journal">Journal</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "article" %]
+            <option value="article" selected="selected">Journal article</option>
+            [% ELSE %]
+            <option value="article">Journal article</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "thesis" %]
+            <option value="thesis" selected="selected">Thesis</option>
+            [% ELSE %]
+            <option value="thesis">Thesis</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "conference" %]
+            <option value="conference" selected="selected">Conference</option>
+            [% ELSE %]
+            <option value="conference">Conference</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "dvd" %]
+            <option value="dvd" selected="selected">DVD</option>
+            [% ELSE %]
+            <option value="dvd">DVD</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "other" %]
+            <option value="other" selected="selected">Other</option>
+            [% ELSE %]
+            <option value="other">Other</option>
+            [% END %]
+            [% IF whole.value.other.type.lower == "resource" %]
+            <option value="resource" selected="selected">Generic resource</option>
+            [% ELSE %]
+            <option value="resource">Generic resource</option>
+            [% END %]
+          </select>
+        </li>
+      </ol>
+    </fieldset>
+    [% cwd = whole.cwd %]
+    [% type = whole.value.other.type %]
+    [% IF type %]
+        [% INCLUDE "${cwd}/shared-includes/forms/${type}.inc" %]
+    [% END %]
+    [% INCLUDE "${cwd}/shared-includes/custom_fields.inc" %]
+    <fieldset class="action">
+      <input id="ill-submit" type="submit" value="Update"/>
+      <a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl">Cancel</a>
+    </fieldset>
+    <input type="hidden" name="illrequest_id" value="[% whole.value.other.illrequest_id | html %]" />
+    <input type="hidden" name="method" value="edititem" />
+    <input type="hidden" name="stage" value="form" />
+    <input type="hidden" name="backend" value="Standard" />
+  </form>
+  [% BLOCK backend_jsinclude %]
+  <script>
+      // <![CDATA[]
+      [% INCLUDE "${cwd}/shared-includes/shared.js" %]
+      // ]]>
+  </script>
   [% END %]
-  [% INCLUDE "${cwd}/shared-includes/custom_fields.inc" %]
-  <fieldset class="action">
-    <input id="ill-submit" type="submit" value="Update"/>
-    <a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl">Cancel</a>
-  </fieldset>
-  <input type="hidden" name="illrequest_id" value="[% whole.value.other.illrequest_id %]" />
-  <input type="hidden" name="method" value="edititem" />
-  <input type="hidden" name="stage" value="form" />
-  <input type="hidden" name="backend" value="Standard" />
-</form>
-[% BLOCK backend_jsinclude %]
-<script type="text/javascript">
-    // <![CDATA[]
-    [% INCLUDE "${cwd}/shared-includes/shared.js" %]
-    // ]]>
-</script>
-[% END %]
+[% ELSE %]
+  <p>Unknown stage.  This should not have happened.
+[% END %]
\ No newline at end of file
diff --git a/Koha/ILL/Backend/intra-includes/migrate.inc b/Koha/ILL/Backend/intra-includes/migrate.inc
index dfef8bd390c..ea85d7e1e8c 100644
--- a/Koha/ILL/Backend/intra-includes/migrate.inc
+++ b/Koha/ILL/Backend/intra-includes/migrate.inc
@@ -14,7 +14,7 @@
 
 [% IF whole.stage == "form" %]
 <h2>Migrating an ILL request</h2>
-<form id="standard_migrate_form" method="POST" action=[% here %]>
+<form id="standard_migrate_form" method="POST" action="">
   <fieldset class="rows">
     <legend>General details</legend>
     <ol id="general-standard-fields">
@@ -92,8 +92,8 @@
         <select id="branchcode" name="branchcode">
           <option value="" />
           [% FOREACH branch IN branches %]
-            <option value="[% branch.branchcode %]">
-              [% branch.branchname %]
+            <option value="[% branch.branchcode | html %]">
+              [% branch.branchname | html %]
             </option>
           [% END %]
         </select>
@@ -106,7 +106,7 @@
   </fieldset>
 </form>
 [% BLOCK backend_jsinclude %]
-<script type="text/javascript">
+<script>
     // <![CDATA[]
     [% INCLUDE "${cwd}/shared-includes/shared.js" %]
     // ]]>
diff --git a/Koha/ILL/Backend/opac-includes/create.inc b/Koha/ILL/Backend/opac-includes/create.inc
index 9affaf30868..df076e248ee 100644
--- a/Koha/ILL/Backend/opac-includes/create.inc
+++ b/Koha/ILL/Backend/opac-includes/create.inc
@@ -14,7 +14,7 @@
 
 [% IF whole.stage == "form" %]
 <h2>Create a manual ILL request</h2>
-<form id="create_form" method="POST" action=[% here %]>
+<form id="create_form" method="POST" action="">
   <fieldset class="rows">
     <legend>General details</legend>
     <ol id="general-standard-fields">
@@ -86,12 +86,12 @@
           <option value="" />
           [% FOREACH branch IN branches %]
             [% IF whole.value.other.branchcode && branch.branchcode == whole.value.other.branchcode %]
-            <option value="[% branch.branchcode %]" selected>
-              [% branch.branchname %]
+            <option value="[% branch.branchcode | html %]" selected>
+              [% branch.branchname | html %]
             </option>
             [% ELSE %]
-            <option value="[% branch.branchcode %]">
-              [% branch.branchname %]
+            <option value="[% branch.branchcode | html %]">
+              [% branch.branchname | html %]
             </option>
             [% END %]
           [% END %]
@@ -114,7 +114,7 @@
 
 [% END %]
 [% BLOCK backend_jsinclude %]
-<script type="text/javascript">
+<script>
     // <![CDATA[]
     [% INCLUDE "${cwd}/shared-includes/shared.js" %]
     // ]]>
diff --git a/Koha/ILL/Backend/shared-includes/custom_fields.inc b/Koha/ILL/Backend/shared-includes/custom_fields.inc
index e91b694a321..cfd3fec65b0 100644
--- a/Koha/ILL/Backend/shared-includes/custom_fields.inc
+++ b/Koha/ILL/Backend/shared-includes/custom_fields.inc
@@ -6,8 +6,8 @@
         [% i = 0 %]
         [% FOREACH key IN keys %]
             <li class="form-horizontal">
-                <input type="text" class="custom-name" name="custom_key" value="[% key %]"><input type="text" name="custom_value" id="custom-value" value="[% values.$i %]">
-                <button value="[% i %]" name="custom_delete" type="submit" class="btn btn-danger btn-sm delete-new-field">
+                <input type="text" class="custom-name" name="custom_key" value="[% key | html %]"><input type="text" name="custom_value" id="custom-value" value="[% values.$i | html %]">
+                <button value="[% i | html %]" name="custom_delete" type="submit" class="btn btn-danger btn-sm delete-new-field">
                     <span class="fa fa-delete"></span>Delete
                 </button></li>
             </li>
diff --git a/Koha/ILL/Backend/shared-includes/forms/article.inc b/Koha/ILL/Backend/shared-includes/forms/article.inc
index 598b1191f51..ad4b4c693e8 100644
--- a/Koha/ILL/Backend/shared-includes/forms/article.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/article.inc
@@ -3,23 +3,23 @@
     <ol id="journal-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="issue">Issue number:</label>
-            <input type="text" name="issue" id="issue" value="[% whole.value.other.issue %]" />
+            <input type="text" name="issue" id="issue" value="[% whole.value.other.issue | html %]" />
         </li>
         <li>
             <label for="year">Year:</label>
-            <input type="text" name="year" id="year" value="[% whole.value.other.year %]" />
+            <input type="text" name="year" id="year" value="[% whole.value.other.year | html %]" />
         </li>
         <li>
             <label for="issn">ISSN:</label>
-            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn %]" />
+            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn | html %]" />
         </li>
     </ol>
 </fieldset>
@@ -28,23 +28,23 @@
     <ol id="article-standard-fields">
         <li>
             <label for="article_title">Article title:</label>
-            <input type="text" name="article_title" id="article_title" value="[% whole.value.other.article_title %]" />
+            <input type="text" name="article_title" id="article_title" value="[% whole.value.other.article_title | html %]" />
         </li>
         <li>
             <label for="article_author">Article author:</label>
-            <input type="text" name="article_author" id="article_author" value="[% whole.value.other.article_author %]" />
+            <input type="text" name="article_author" id="article_author" value="[% whole.value.other.article_author | html %]" />
         </li>
         <li>
             <label for="published_date">Publication date:</label>
-            <input type="text" name="published_date" id="published_date" value="[% whole.value.other.published_date %]" />
+            <input type="text" name="published_date" id="published_date" value="[% whole.value.other.published_date | html %]" />
         </li>
         <li>
             <label for="pages">Pages:</label>
-            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages %]" />
+            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/book.inc b/Koha/ILL/Backend/shared-includes/forms/book.inc
index 3ce9613ae2c..397477d18f9 100644
--- a/Koha/ILL/Backend/shared-includes/forms/book.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/book.inc
@@ -3,43 +3,43 @@
     <ol id="publication-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="author">Author:</label>
-            <input type="text" name="author" id="author" value="[% whole.value.other.author %]" />
+            <input type="text" name="author" id="author" value="[% whole.value.other.author | html %]" />
         </li>
         <li>
             <label for="editor">Editor:</label>
-            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor %]" />
+            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor | html %]" />
         </li>
         <li>
             <label for="publisher">Publisher:</label>
-            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher %]" />
+            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher | html %]" />
         </li>
         <li>
             <label for="published_place">Place of publication:</label>
-            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place %]" />
+            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place | html %]" />
         </li>
         <li>
             <label for="year">Year:</label>
-            <input type="text" name="year" id="year" value="[% whole.value.other.year %]" />
+            <input type="text" name="year" id="year" value="[% whole.value.other.year | html %]" />
         </li>
         <li>
             <label for="part_edition">Part / Edition:</label>
-            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition %]" />
+            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="isbn">ISBN:</label>
-            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn %]" />
+            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/chapter.inc b/Koha/ILL/Backend/shared-includes/forms/chapter.inc
index 8bf9ce003b2..aafec86f15e 100644
--- a/Koha/ILL/Backend/shared-includes/forms/chapter.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/chapter.inc
@@ -3,43 +3,43 @@
     <ol id="publication-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="author">Author:</label>
-            <input type="text" name="author" id="author" value="[% whole.value.other.author %]" />
+            <input type="text" name="author" id="author" value="[% whole.value.other.author | html %]" />
         </li>
         <li>
             <label for="editor">Editor:</label>
-            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor %]" />
+            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor | html %]" />
         </li>
         <li>
             <label for="publisher">Publisher:</label>
-            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher %]" />
+            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher | html %]" />
         </li>
         <li>
             <label for="published_place">Place of publication:</label>
-            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place %]" />
+            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place | html %]" />
         </li>
         <li>
             <label for="year">Year:</label>
-            <input type="text" name="year" id="year" value="[% whole.value.other.year %]" />
+            <input type="text" name="year" id="year" value="[% whole.value.other.year | html %]" />
         </li>
         <li>
             <label for="part_edition">Part / Edition:</label>
-            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition %]" />
+            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="isbn">ISBN:</label>
-            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn %]" />
+            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
@@ -48,15 +48,15 @@
     <ol id="chapter-standard-fields">
         <li>
             <label for="chapter_author">Author:</label>
-            <input type="text" name="chapter_author" id="chapter_author" value="[% whole.value.other.chapter_author %]" />
+            <input type="text" name="chapter_author" id="chapter_author" value="[% whole.value.other.chapter_author | html %]" />
         </li>
         <li>
             <label for="chapter">Chapter:</label>
-            <input type="text" name="chapter" id="chapter" value="[% whole.value.other.chapter %]" />
+            <input type="text" name="chapter" id="chapter" value="[% whole.value.other.chapter | html %]" />
         </li>
         <li>
             <label for="pages">Pages:</label>
-            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages %]" />
+            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/conference.inc b/Koha/ILL/Backend/shared-includes/forms/conference.inc
index facda38ee45..ca95d5ce6ca 100644
--- a/Koha/ILL/Backend/shared-includes/forms/conference.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/conference.inc
@@ -3,47 +3,47 @@
     <ol id="conference-standard-fields">
         <li>
             <label for="title">Conference title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="publication">Publication:</label>
-            <input type="text" name="publication" id="publication" value="[% whole.value.other.publication %]" />
+            <input type="text" name="publication" id="publication" value="[% whole.value.other.publication | html %]" />
         </li>
         <li>
             <label for="conference_date">Conference date:</label>
-            <input type="text" name="conference_date" id="conference_date" value="[% whole.value.other.conference_date %]" />
+            <input type="text" name="conference_date" id="conference_date" value="[% whole.value.other.conference_date | html %]" />
         </li>
         <li>
             <label for="venue">Venue:</label>
-            <input type="text" name="venue" id="venue" value="[% whole.value.other.venue %]" />
+            <input type="text" name="venue" id="venue" value="[% whole.value.other.venue | html %]" />
         </li>
         <li>
             <label for="sponsor">Sponsor:</label>
-            <input type="text" name="sponsor" id="sponsor" value="[% whole.value.other.sponsor %]" />
+            <input type="text" name="sponsor" id="sponsor" value="[% whole.value.other.sponsor | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="isbn">ISBN:</label>
-            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn %]" />
+            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn | html %]" />
         </li>
         <li>
             <label for="issn">ISSN:</label>
-            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn %]" />
+            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn | html %]" />
         </li>
         <li>
             <label for="part_edition">Part:</label>
-            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition %]" />
+            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition | html %]" />
         </li>
         <li>
             <label for="paper_title">Paper title:</label>
-            <input type="text" name="paper_title" id="paper_title" value="[% whole.value.other.paper_title %]" />
+            <input type="text" name="paper_title" id="paper_title" value="[% whole.value.other.paper_title | html %]" />
         </li>
         <li>
             <label for="paper_author">Paper author:</label>
-            <input type="text" name="paper_author" id="paper_author" value="[% whole.value.other.paper_author %]" />
+            <input type="text" name="paper_author" id="paper_author" value="[% whole.value.other.paper_author | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/journal.inc b/Koha/ILL/Backend/shared-includes/forms/journal.inc
index 3f92e91382c..5b94b93a3f9 100644
--- a/Koha/ILL/Backend/shared-includes/forms/journal.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/journal.inc
@@ -3,27 +3,27 @@
     <ol id="journal-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="issue">Issue number:</label>
-            <input type="text" name="issue" id="issue" value="[% whole.value.other.issue %]" />
+            <input type="text" name="issue" id="issue" value="[% whole.value.other.issue | html %]" />
         </li>
         <li>
             <label for="year">Year:</label>
-            <input type="text" name="year" id="year" value="[% whole.value.other.year %]" />
+            <input type="text" name="year" id="year" value="[% whole.value.other.year | html %]" />
         </li>
         <li>
             <label for="issn">ISSN:</label>
-            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn %]" />
+            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/resource.inc b/Koha/ILL/Backend/shared-includes/forms/resource.inc
index a8f9b8419f4..a475634fe67 100644
--- a/Koha/ILL/Backend/shared-includes/forms/resource.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/resource.inc
@@ -3,51 +3,51 @@
     <ol id="resource-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="author">Author:</label>
-            <input type="text" name="author" id="author" value="[% whole.value.other.author %]" />
+            <input type="text" name="author" id="author" value="[% whole.value.other.author | html %]" />
         </li>
         <li>
             <label for="editor">Editor:</label>
-            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor %]" />
+            <input type="text" name="editor" id="editor" value="[% whole.value.other.editor | html %]" />
         </li>
         <li>
             <label for="publisher">Publisher:</label>
-            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher %]" />
+            <input type="text" name="publisher" id="publisher" value="[% whole.value.other.publisher | html %]" />
         </li>
         <li>
             <label for="published_place">Place of publication:</label>
-            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place %]" />
+            <input type="text" name="published_place" id="published_place" value="[% whole.value.other.published_place | html %]" />
         </li>
         <li>
             <label for="year">Year:</label>
-            <input type="text" name="year" id="year" value="[% whole.value.other.year %]" />
+            <input type="text" name="year" id="year" value="[% whole.value.other.year | html %]" />
         </li>
         <li>
             <label for="part_edition">Part / Edition:</label>
-            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition %]" />
+            <input type="text" name="part_edition" id="part_edition" value="[% whole.value.other.part_edition | html %]" />
         </li>
         <li>
             <label for="volume">Volume:</label>
-            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume %]" />
+            <input type="text" name="volume" id="volume" value="[% whole.value.other.volume | html %]" />
         </li>
         <li>
             <label for="pages">Pages:</label>
-            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages %]" />
+            <input type="text" name="pages" id="pages" value="[% whole.value.other.pages | html %]" />
         </li>
         <li>
             <label for="isbn">ISBN:</label>
-            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn %]" />
+            <input type="text" name="isbn" id="isbn" value="[% whole.value.other.isbn | html %]" />
         </li>
         <li>
             <label for "issn">ISSN:</label>
-            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn %]" />
+            <input type="text" name="issn" id="issn" value="[% whole.value.other.issn | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/Koha/ILL/Backend/shared-includes/forms/thesis.inc b/Koha/ILL/Backend/shared-includes/forms/thesis.inc
index 142cdcdc1e1..a170d665561 100644
--- a/Koha/ILL/Backend/shared-includes/forms/thesis.inc
+++ b/Koha/ILL/Backend/shared-includes/forms/thesis.inc
@@ -3,23 +3,23 @@
     <ol id="thesis-standard-fields">
         <li>
             <label for="title">Title:</label>
-            <input type="text" name="title" id="title" value="[% whole.value.other.title %]" />
+            <input type="text" name="title" id="title" value="[% whole.value.other.title | html %]" />
         </li>
         <li>
             <label for="author">Author:</label>
-            <input type="text" name="author" id="author" value="[% whole.value.other.author %]" />
+            <input type="text" name="author" id="author" value="[% whole.value.other.author | html %]" />
         </li>
         <li>
             <label for="institution">Institution:</label>
-            <input type="text" name="institution" id="institution" value="[% whole.value.other.institution %]" />
+            <input type="text" name="institution" id="institution" value="[% whole.value.other.institution | html %]" />
         </li>
         <li>
             <label for="published_date">Publication date:</label>
-            <input type="text" name="published_date" id="published_date" value="[% whole.value.other.published_date %]" />
+            <input type="text" name="published_date" id="published_date" value="[% whole.value.other.published_date | html %]" />
         </li>
         <li>
             <label for="doi">DOI:</label>
-            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi %]" />
+            <input type="text" name="doi" id="doi" value="[% whole.value.other.doi | html %]" />
         </li>
     </ol>
 </fieldset>
diff --git a/about.pl b/about.pl
index f78d7acb359..e162196cb8d 100755
--- a/about.pl
+++ b/about.pl
@@ -322,7 +322,7 @@ if ( C4::Context->preference('ILLModule') ) {
 
     # Check if deprecated 'FreeForm' backend is installed
     my $available_backends = Koha::ILL::Request::Config->new->available_backends;
-    if(grep(/FreeForm/, @{$available_backends} )){
+    if ( grep( /FreeForm/, @{$available_backends} ) ) {
         $template->param( ill_deprecated_backend_freeform_is_installed => 1 );
         $warnILLConfiguration = 1;
     }
diff --git a/installer/data/mysql/atomicupdate/bug_35570.pl b/installer/data/mysql/atomicupdate/bug_35570.pl
old mode 100644
new mode 100755
index 07101efa0e6..3fc574775e0
--- a/installer/data/mysql/atomicupdate/bug_35570.pl
+++ b/installer/data/mysql/atomicupdate/bug_35570.pl
@@ -66,6 +66,5 @@ return {
             say $out "Bug 35570: Finished database update.";
         }
 
-
     },
 };
-- 
2.30.2