@@ -, +, @@
eg Bad stuff as the name
Note the js is executed
Notice the html is not escaped
Notice the html is now escaped
---
.../prog/en/modules/virtualshelves/tables/shelves_results.tt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
@@ -9,7 +9,7 @@
"dt_type":
"[% data.type %]",
"dt_shelfname":
- "[% data.shelfname %]",
+ "[% data.shelfname | html%]",
"dt_count":
"[% data.count %] item(s)",
"dt_owner":
--