From e8d566c372468648dea487080c7d47aa6a63ef29 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 18 Sep 2017 14:53:41 -0300 Subject: [PATCH] Bug 19333: Fix XSS in opac-shelves Content-Type: text/plain; charset=utf-8 category is send back to the template, it must be escaped Signed-off-by: Marcel de Rooy --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt index 0791bb6..e6e81ab 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt @@ -171,7 +171,7 @@
- +
@@ -179,7 +179,7 @@
- +
@@ -190,7 +190,7 @@
- +
@@ -692,7 +692,7 @@
- +
@@ -704,7 +704,7 @@
- +
@@ -957,7 +957,7 @@ function AdjustRemark() { if( $("#category").length > 0 ) { category = $("#category").val(); } else { - category = [% category %]; + category = [% category | html %]; } var perms = $("#allow_changes_from").val(); -- 2.1.4