From 4f191acc00b0f152732efe12957e4df9f1c7d871 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Mon, 7 Aug 2017 21:24:44 +0530
Subject: [PATCH] Bug 19051 - XSS Flaws in Batch item deletion page

1. Hit /cgi-bin/koha/tools/batchMod.pl?del=1
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> in the Barcode list (one barcode per line) text area.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on Barcode list (one barcode per line) text area.
6. Notice it is no longer executed.
7. Fixes for both barcode and itemnumber.
---
 .../prog/en/modules/tools/batchMod-del.tt          |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
index d66d15d..fbf8a7b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
@@ -58,7 +58,7 @@ $(document).ready(function(){
 		</thead>
 		<tbody>
 		    [% FOREACH notfoundbarcode IN notfoundbarcodes %]
-			<tr><td>[% notfoundbarcode.barcode %]</td></tr>
+			<tr><td>[% notfoundbarcode.barcode |html %]</td></tr>
 		    [% END %]
 		</tbody>
 	    </table>
-- 
1.7.9.5