From 362cc1ea2f0e9c77362c8817a4ea00a34252f950 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 28 Aug 2024 12:18:06 +0200 Subject: [PATCH] Bug 37720: Prevent XSS in label creator Signed-off-by: David Cook Signed-off-by: Phil Ringnalda --- C4/Creators/Lib.pm | 3 +-- .../intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt | 5 ++++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/C4/Creators/Lib.pm b/C4/Creators/Lib.pm index d4831ab479..169ba008de 100644 --- a/C4/Creators/Lib.pm +++ b/C4/Creators/Lib.pm @@ -345,8 +345,7 @@ sub get_label_summary { $record->{'title'} =~ s/\W*$//; # strip off ugly trailing chars # FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code # should not know that it's part of a web app - $record->{'title'} = ' ' . $record->{'title'} . ''; - $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A'); + $label_summary->{'_summary'} = { title => $record->{title}, author => $record->{author}, biblionumber => $record->{biblionumber} }; $label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'}; $label_summary->{'_barcode'} = $record->{'barcode'}; $label_summary->{'_item_number'} = $item->{'item_number'}; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt index aef3a313cc..a8c0741462 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt @@ -176,8 +176,11 @@ [% IF ( text_field.field_name == '_item_type_tbl' ) %] [% ItemTypes.GetDescription( text_field.field_value ) | html %] + [% ELSIF ( text_field.field_name == '_summary_tbl' ) %] + [% text_field.field_value.title | html %] + [% IF text_field.field_value.author %]| [% text_field.field_value.author | html %][% END %] [% ELSE %] - [% text_field.field_value | $raw %] + [% text_field.field_value | html %] [% END %] [% END %] -- 2.44.0