From 362cc1ea2f0e9c77362c8817a4ea00a34252f950 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 28 Aug 2024 12:18:06 +0200
Subject: [PATCH] Bug 37720: Prevent XSS in label creator

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
---
 C4/Creators/Lib.pm                                           | 3 +--
 .../intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt | 5 ++++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/C4/Creators/Lib.pm b/C4/Creators/Lib.pm
index d4831ab479..169ba008de 100644
--- a/C4/Creators/Lib.pm
+++ b/C4/Creators/Lib.pm
@@ -345,8 +345,7 @@ sub get_label_summary {
         $record->{'title'} =~ s/\W*$//;  # strip off ugly trailing chars
         # FIXME contructing staff interface URLs should be done *much* higher up the stack - for the most part, C4 module code
         # should not know that it's part of a web app
-        $record->{'title'} = '<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=' . $record->{'biblionumber'} . '"> ' . $record->{'title'} . '</a>';
-        $label_summary->{'_summary'} = $record->{'title'} . " | " . ($record->{'author'} ? $record->{'author'} : 'N/A');
+        $label_summary->{'_summary'} = { title => $record->{title}, author => $record->{author}, biblionumber => $record->{biblionumber} };
         $label_summary->{'_item_type'} = C4::Context->preference("item-level_itypes") ? $record->{'itype'} : $record->{'itemtype'};
         $label_summary->{'_barcode'} = $record->{'barcode'};
         $label_summary->{'_item_number'} = $item->{'item_number'};
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
index aef3a313cc..a8c0741462 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
@@ -176,8 +176,11 @@
                                                                     <td>
                                                                         [% IF ( text_field.field_name == '_item_type_tbl' ) %]
                                                                             [% ItemTypes.GetDescription( text_field.field_value ) | html %]
+                                                                        [% ELSIF ( text_field.field_name == '_summary_tbl' ) %]
+                                                                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% text_field.field_value.biblionumber | uri %]">[% text_field.field_value.title | html %]</a>
+                                                                            [% IF text_field.field_value.author %]| [% text_field.field_value.author | html %][% END %]
                                                                         [% ELSE %]
-                                                                            [% text_field.field_value | $raw %]
+                                                                            [% text_field.field_value | html %]
                                                                         [% END %]
                                                                     </td>
                                                                 [% END %]
-- 
2.44.0