From 80b64a701d493e1a9b7465258a4f7b4eb29a7e2c Mon Sep 17 00:00:00 2001
From: Katrin Fischer <katrin.fischer.83@web.de>
Date: Wed, 16 Aug 2017 14:34:17 +0200
Subject: [PATCH] Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt
 and categories.tt
Content-Type: text/plain; charset=utf-8

Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
---
 .../prog/en/modules/admin/authorised_values.tt         | 18 +++++++++---------
 .../intranet-tmpl/prog/en/modules/admin/categories.tt  |  4 ++--
 .../prog/en/modules/admin/patron-attr-types.tt         | 10 +++++-----
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
index 5aee840..83983bf 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
@@ -109,9 +109,9 @@ $(document).ready(function() {
                 <option value="">All libraries</option>
                 [% FOREACH branch IN branches_loop %]
                   [% IF ( branch.selected ) %]
-                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                   [% ELSE %]
-                    <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                    <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                   [% END %]
                 [% END %]
             </select>
@@ -164,7 +164,7 @@ $(document).ready(function() {
 [% IF op == 'list' %]
 
 <div id="toolbar" class="btn-toolbar">
-    <a id="addauth" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;category=[% category %]"><i class="fa fa-plus"> </i> New authorized value for [% category %]</a>
+    <a id="addauth" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;category=[% category %]"><i class="fa fa-plus"> </i> New authorized value for [% category |html %]</a>
     <a id="addcat" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form"><i class="fa fa-plus"> </i> New category</a>
 </div>
 
@@ -207,9 +207,9 @@ $(document).ready(function() {
   <select name="searchfield" id="searchfield" size="1">
   [% FOR c IN categories %]
     [% IF c == searchfield %]
-      <option value="[% c %]" selected="selected">[% c %]</option>
+      <option value="[% c %]" selected="selected">[% c |html %]</option>
     [% ELSE %]
-      <option value="[% c %]">[% c %]</option>
+      <option value="[% c %]">[% c |html %]</option>
     [% END %]
   [% END %]
   <input type="submit" value="Submit" />
@@ -250,7 +250,7 @@ $(document).ready(function() {
  [% IF ( category == 'NOT_LOAN' ) %]
     <p>Statuses to describe why an item is not for loan</p>
  [% END %]
-<h3>Authorized values for category [% category %]:</h3>
+<h3>Authorized values for category [% category |html %]:</h3>
 
 [% IF ( loop ) %]<div id="pagertable_authorized_values">
 </div>[% END %]
@@ -272,8 +272,8 @@ $(document).ready(function() {
 <tr>
 [% END %]
 	<td>[% loo.authorised_value %]</td>
-	<td>[% loo.lib %]</td>
-	<td>[% loo.lib_opac %]</td>
+    <td>[% loo.lib |html %]</td>
+    <td>[% loo.lib_opac |html %]</td>
 	<td>[% IF ( loo.imageurl ) %]<img src="[% loo.imageurl %]" alt=""/>[% ELSE %]&nbsp;[% END %]</td>
     <td>
         [% IF loo.branches.size > 0 %]
@@ -296,7 +296,7 @@ $(document).ready(function() {
 </tr>
 [% END %]
 </tbody></table>[% ELSE %]
-<div class="dialog message">There are no authorized values defined for [% category %]</div>
+<div class="dialog message">There are no authorized values defined for [% category |html %]</div>
 [% END %]
 
 [% IF ( isprevpage ) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
index e33b36f..f6f5423 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
@@ -156,9 +156,9 @@
                         <option value="">All branches</option>
                         [% FOREACH branch IN branches_loop %]
                           [% IF branch.selected %]
-                            <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                            <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                           [% ELSE %]
-                            <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                            <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                           [% END %]
                         [% END %]
                     </select>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
index b0c49bf..8bdba69 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
@@ -170,9 +170,9 @@ $(document).ready(function() {
                 <option value="">All branches</option>
                 [% FOREACH branch IN branches_loop %]
                   [% IF ( branch.selected ) %]
-                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                   [% ELSE %]
-                    <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                    <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
                   [% END %]
                 [% END %]
             </select>
@@ -184,7 +184,7 @@ $(document).ready(function() {
             <select name="category_code" id="category">
                 <option value=""></option>
                 [% FOREACH cat IN categories %]
-                    [% IF ( cat.categorycode == category_code ) %]<option value="[% cat.categorycode %]" selected="selected">[% cat.description %]</option>[% ELSE %]<option value="[% cat.categorycode %]">[% cat.description %]</option>[% END %]
+                    [% IF ( cat.categorycode == category_code ) %]<option value="[% cat.categorycode %]" selected="selected">[% cat.description |html %]</option>[% ELSE %]<option value="[% cat.categorycode %]">[% cat.description |html %]</option>[% END %]
                 [% END %]
             </select>
             <span>Choose one to limit this attribute to one patron type. Please leave blank if you want these attributes to be available for all types of patrons.</span>
@@ -196,11 +196,11 @@ $(document).ready(function() {
                 [% FOREACH class IN classes_val_loop %]
                     [% IF class.authorised_value == category_class %]
                         <option value="[% class.authorised_value %]" selected="selected">
-                            [% class.lib %]
+                            [% class.lib |html %]
                         </option>
                     [% ELSE %]
                         <option value="[% class.authorised_value %]" >
-                            [% class.lib %]
+                            [% class.lib |html %]
                         </option>
                     [% END %]
                 [% END %]
-- 
2.1.4