From f9ce068b23905728daba2baaa7cf2cf9c7471983 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Mon, 14 Aug 2017 23:00:22 +0530
Subject: [PATCH] Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.
---
 members/memberentry.pl |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/members/memberentry.pl b/members/memberentry.pl
index 0501534..92836f2 100755
--- a/members/memberentry.pl
+++ b/members/memberentry.pl
@@ -25,7 +25,7 @@ use warnings;
 # external modules
 use CGI qw ( -utf8 );
 use List::MoreUtils qw/uniq/;
-
+use HTML::Entities;
 # internal modules
 use C4::Auth;
 use C4::Context;
@@ -81,6 +81,7 @@ if ( C4::Context->preference('SMSSendDriver') eq 'Email' ) {
 }
 
 my $guarantorid    = $input->param('guarantorid');
+$guarantorid       = HTML::Entities::encode($guarantorid);
 my $borrowernumber = $input->param('borrowernumber');
 my $actionType     = $input->param('actionType') || '';
 my $modify         = $input->param('modify');
-- 
1.7.9.5