From 3773f1233d7b3725e94ef73c53532027b90b81b5 Mon Sep 17 00:00:00 2001 From: Andrew Isherwood Date: Mon, 17 Dec 2018 16:03:40 +0000 Subject: [PATCH] Bug 21460: (follow-up) $raw -> html filter We're filtering a string that is derived from client supplied paramters via a URL, we should be escaping these if appropriate. --- koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt index 438ef215a8..4aa364d376 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt @@ -37,7 +37,7 @@ 'patron' ]; - var prefilters = '[% prefilters | $raw %]'; + var prefilters = '[% prefilters | html %]'; // Expanded fields // This is auto populated -- 2.11.0