From d3720442016c5a56365a00c6ce5118ea2503f10f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@biblibre.com>
Date: Fri, 23 Jan 2015 13:18:54 +0100
Subject: [PATCH] Bug 13618: Use Template::Stash::AutoEscaping to use the html
 filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test plan:
0/ sudo cpanm Template::Stash::AutoEscaping
1/ Verify don't reproduce the XSS issue described on bug 13609 and other
xss related bugs.
2/ Try to find some encoding issues (detail page, search results,
facets, etc.)

Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
 C4/Installer/PerlDependencies.pm                                    | 5 +++++
 C4/Templates.pm                                                     | 2 ++
 .../bootstrap/en/modules/opac-authoritiessearchresultlist.tt        | 6 +++---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/C4/Installer/PerlDependencies.pm b/C4/Installer/PerlDependencies.pm
index d621f33..be84077 100644
--- a/C4/Installer/PerlDependencies.pm
+++ b/C4/Installer/PerlDependencies.pm
@@ -822,6 +822,11 @@ our $PERL_DEPS = {
         'required' => '0',
         'min_ver'  => '0.03',
     },
+    'Template::Stash::AutoEscaping' => {
+        'usage'    => 'Code',
+        'required' => '1',
+        'min_ver'  => '0.0303',
+    },
 };
 
 1;
diff --git a/C4/Templates.pm b/C4/Templates.pm
index 4f23dc7..0528217 100644
--- a/C4/Templates.pm
+++ b/C4/Templates.pm
@@ -5,6 +5,7 @@ use warnings;
 use Carp;
 use CGI qw ( -utf8 );
 use List::MoreUtils qw/ any uniq /;
+use Template::Stash::AutoEscaping;
 
 # Copyright 2009 Chris Cormack and The Koha Dev Team
 #
@@ -69,6 +70,7 @@ sub new {
             COMPILE_DIR => $use_template_cache ? C4::Context->config('template_cache_dir') : '',
             INCLUDE_PATH => \@includes,
             FILTERS => {},
+            STASH => Template::Stash::AutoEscaping->new,
             ENCODING => 'UTF-8',
         }
     ) or die Template->error();
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
index 4ebaac6..6ded40c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
@@ -1,7 +1,7 @@
 [% USE Koha %]
 [% PROCESS 'opac-authorities.inc' %]
 [% PROCESS 'authorities-search-results.inc' %]
-[% pagination = BLOCK %]
+[% BLOCK pagination %]
     <div class="pagination">
         <ul>
             [% IF ( displayprev ) %]
@@ -56,7 +56,7 @@
                     <div id="userauthsearchresults" class="maincontent">
                         <h1>Authority search results</h1>
 
-                        [% pagination %]
+                        [% PROCESS pagination %]
 
                         <div id="results">
                             [% IF ( total ) %]
@@ -102,7 +102,7 @@
                                 </table>
                             </div> <!-- / .searchresults -->
 
-                            [% pagination %]
+                            [% PROCESS pagination %]
 
                         [% END # / IF total %]
                     </div> <!-- / #userauthsearchresults -->
-- 
2.1.0