From 4cf2de42fa996d8cd20708501cad10cd58c15bcc Mon Sep 17 00:00:00 2001
From: Chris Cormack <chris@bigballofwax.co.nz>
Date: Fri, 11 Aug 2017 19:36:43 +0000
Subject: [PATCH] Bug 19086 XSS in members/member.pl

To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
---
 .../prog/en/modules/members/member.tt              |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
index f8f2471..73598d8 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
@@ -115,7 +115,7 @@ var dtMemberResults;
 var search = 1;
 $(document).ready(function() {
     [% IF searchmember %]
-        $("#searchmember_filter").val("[% searchmember %]");
+        $("#searchmember_filter").val("[% searchmember | html %]");
     [% END %]
     [% IF searchfieldstype %]
         $("searchfieldstype_filter").val("[% searchfieldstype %]");
@@ -357,7 +357,7 @@ function filterByFirstLetterSurname(letter) {
 
           <div id="searchresults">
             <div id="searchheader">
-              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember %]'[% END %]</span></h3>
+              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember | html %]'[% END %]</span></h3>
             </div>
             [% IF CAN_user_tools_manage_patron_lists %]
               <div id="searchheader">
-- 
1.7.9.5