From edbd9dbcb738f3f38b7f946f27c55445140580ca Mon Sep 17 00:00:00 2001
From: Chris Cormack <chrisc@catalyst.net.nz>
Date: Fri, 17 Jun 2011 11:04:23 +1200
Subject: [PATCH] Bug 6518 : XSS errors

---
 .../prog/en/modules/opac-addbybiblionumber.tmpl    |    2 +-
 .../prog/en/modules/opac-downloadcart.tmpl         |    2 +-
 .../prog/en/modules/opac-downloadshelf.tmpl        |    2 +-
 .../opac-tmpl/prog/en/modules/opac-review.tmpl     |    6 +++---
 .../prog/en/modules/opac-serial-issues.tmpl        |    4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-addbybiblionumber.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-addbybiblionumber.tmpl
index 510b12d..982dbeb 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-addbybiblionumber.tmpl
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-addbybiblionumber.tmpl
@@ -66,7 +66,7 @@
 		<option value="1">Private</option>
 		<option value="2">Public</option>
 		</select></li></ol></fieldset>
-		<!-- TMPL_LOOP NAME="biblios" --> <input type="hidden" name="biblionumber" value="<!-- TMPL_VAR NAME="biblionumber" -->" /><!-- /TMPL_LOOP -->
+		<!-- TMPL_LOOP NAME="biblios" --> <input type="hidden"name="biblionumber" value="<!-- TMPL_VAR NAME="biblionumber" ESCAPE="HTML"-->" /><!-- /TMPL_LOOP -->
 		<fieldset class="action"><input type="submit" value="Save" class="submit" /> <a class="close cancel" href="#">Cancel</a></fieldset>
 		</form>
 	<!-- /TMPL_UNLESS -->
diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadcart.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadcart.tmpl
index 75adf24..3b65f37 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadcart.tmpl
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadcart.tmpl
@@ -19,7 +19,7 @@
 	</select></li></ol>
 </fieldset>
 <fieldset class="action">
-	<input type="hidden" name="bib_list" value="<!-- TMPL_VAR NAME="bib_list" -->" />
+	<input type="hidden" name="bib_list" value="<!-- TMPL_VAR NAME="bib_list" ESCAPE="HTML"-->" />
 	<input type="submit" name="save" value="Go" />
 </fieldset>
     </form>
diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadshelf.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadshelf.tmpl
index 1398cd0..3e78e74 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadshelf.tmpl
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-downloadshelf.tmpl
@@ -24,7 +24,7 @@
 
 	</select></li></ol>
 </fieldset>
-<fieldset class="action">	<input type="hidden" name="shelfid" value="<!-- TMPL_VAR NAME="shelfid" -->" />
+<fieldset class="action">	<input type="hidden" name="shelfid" value="<!-- TMPL_VAR NAME="shelfid" ESCAPE="HTML"-->" />
 	<input type="submit" name="save" value="Go" /></fieldset>
     </form>
 
diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl
index 573295e..07d7081 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-review.tmpl
@@ -11,7 +11,7 @@
 			<!-- TMPL_IF NAME="cgi_debug" -->alert("injecting OLD comment: " +comment);<!-- /TMPL_IF -->
 			parent.opener.$('#c<!-- TMPL_VAR NAME="reviewid" --> p').prev("small").prev("h5").html("Your Edited Comment (preview, pending approval)");
 			parent.opener.$('#c<!-- TMPL_VAR NAME="reviewid" --> p').html(comment);
-			parent.opener.$('#c<!-- TMPL_VAR NAME="reviewid" --> p').append(" <a href=\"#comment\" onclick=\"Dopop(\'/cgi-bin/koha/opac-review.pl?biblionumber=<!-- TMPL_VAR NAME="biblionumber"-->&amp;reviewid=<!-- TMPL_VAR NAME="reviewid" -->\');\">Edit<\/a>");
+			parent.opener.$('#c<!-- TMPL_VAR NAME="reviewid" --> p').append(" <a href=\"#comment\" onclick=\"Dopop(\'/cgi-bin/koha/opac-review.pl?biblionumber=<!-- TMPL_VAR NAME="biblionumber" ESCAPE="URI" -->&amp;reviewid=<!-- TMPL_VAR NAME="reviewid" ESCAPE="URI"-->\');\">Edit<\/a>");
 			<!-- /TMPL_IF -->
 			return 1;
 		};
@@ -21,7 +21,7 @@
 			parent.opener.$('#newcomment').html(
 				"<h5>Your Comment (preview, pending approval)<\/h5>" +
 				"<p>"+comment+"<\/p>" +
-				"<a href=\"#comment\" onclick=\"Dopop(\'/cgi-bin/koha/opac-review.pl?biblionumber=<!-- TMPL_VAR NAME="biblionumber"-->\');\">Edit<\/a><\/p>"
+				"<a href=\"#comment\" onclick=\"Dopop(\'/cgi-bin/koha/opac-review.pl?biblionumber=<!-- TMPL_VAR NAME="biblionumber" ESCAPE="HTML"-->\');\">Edit<\/a><\/p>"
 			);
 			parent.opener.$("#addcomment").prev("p").remove();
 			parent.opener.$("#addcomment").remove();
@@ -66,7 +66,7 @@
 	</div>
 <!-- /TMPL_IF -->
 <form id="reviewf" action="/cgi-bin/koha/opac-review.pl<!-- TMPL_IF NAME="cgi_debug" -->?debug=1<!-- /TMPL_IF -->" method="post">
-    <input type="hidden" name="biblionumber" value="<!-- TMPL_VAR NAME="biblionumber" -->" />
+    <input type="hidden" name="biblionumber" value="<!-- TMPL_VAR NAME="biblionumber" ESCAPE="HTML" -->" />
 	<fieldset class="brief">
 	<legend>Comments on <i><!--TMPL_VAR NAME="title" ESCAPE="html" --> <!-- TMPL_VAR NAME="subtitle" --></i><!-- TMPL_IF NAME="author" -->by <!-- TMPL_VAR NAME="author" --><!-- /TMPL_IF --></legend>
             <ol><li><textarea id="review" name="review" cols="60" rows="8"><!--TMPL_VAR NAME="review"--></textarea></li></ol>
diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-serial-issues.tmpl b/koha-tmpl/opac-tmpl/prog/en/modules/opac-serial-issues.tmpl
index 13a3487..aa62bdc 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-serial-issues.tmpl
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-serial-issues.tmpl
@@ -12,9 +12,9 @@
 <div class="container">
 <h2>Issues for a subscription</h2>
 <div id="views">
-	<span class="view"><a id="Normalview" href="opac-detail.pl?biblionumber=<!-- TMPL_VAR name="biblionumber" -->" class="button">Normal View</a></span>
+	<span class="view"><a id="Normalview" href="opac-detail.pl?biblionumber=<!-- TMPL_VAR name="biblionumber" ESCAPE="HTML" -->" class="button">Normal View</a></span>
 		<span class="view"><span id="Briefhistory">Brief history</span></span>
-	<span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=<!-- TMPL_VAR name="biblionumber" -->" class="button">Full History</a></span>
+	<span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=<!-- TMPL_VAR name="biblionumber" ESCAPE="HTML" -->" class="button">Full History</a></span>
 </div>
 <form method="post" name="f">
 <!-- TMPL_LOOP name="subscription_LOOP" -->
-- 
1.7.4.1