From 362cc1ea2f0e9c77362c8817a4ea00a34252f950 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 28 Aug 2024 12:18:06 +0200
Subject: [PATCH] Bug 37720: Prevent XSS in label creator
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
---
C4/Creators/Lib.pm | 3 +--
.../intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt | 5 ++++-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/C4/Creators/Lib.pm b/C4/Creators/Lib.pm
index d4831ab479..169ba008de 100644
--- a/C4/Creators/Lib.pm
+++ b/C4/Creators/Lib.pm
@@ -345,8 +345,7 @@ sub get_label_summary {
$record->{'title'} =~ s/\W*$//; # strip off ugly trailing chars
# FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code
# should not know that it's part of a web app
- $record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . $record->{'biblionumber'} . '"> ' . $record->{'title'} . '</a>';
- $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A');
+ $label_summary->{'_summary'} = { title => $record->{title}, author => $record->{author}, biblionumber => $record->{biblionumber} };
$label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'};
$label_summary->{'_barcode'} = $record->{'barcode'};
$label_summary->{'_item_number'} = $item->{'item_number'};
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
index aef3a313cc..a8c0741462 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
@@ -176,8 +176,11 @@
<td>
[% IF ( text_field.field_name == '_item_type_tbl' ) %]
[% ItemTypes.GetDescription( text_field.field_value ) | html %]
+ [% ELSIF ( text_field.field_name == '_summary_tbl' ) %]
+ <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% text_field.field_value.biblionumber | uri %]">[% text_field.field_value.title | html %]</a>
+ [% IF text_field.field_value.author %]| [% text_field.field_value.author | html %][% END %]
[% ELSE %]
- [% text_field.field_value | $raw %]
+ [% text_field.field_value | html %]
[% END %]
</td>
[% END %]
--
2.44.0