From d4c55e92128c384e5c015b5b989c63773b6ea47a Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Fri, 4 Aug 2017 10:38:12 +0530
Subject: [PATCH 1/2] Bug 19034 - XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.
---
 .../intranet-tmpl/prog/en/modules/admin/cities.tt  |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index 7acb4d6..a440cf1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -143,7 +143,7 @@
 
     <h2>Cities</h2>
     [% IF searchfield %]
-        Searching: [% searchfield %]
+        Searching: [% searchfield |html %]
     [% END %]
 
     [% IF cities.count %]
-- 
1.7.9.5