There are 3 XXS on the lists detail page, for the shelve name parameter, on the staff part.
In order to test:
1. on opac, create a new list named 'a <blink>simple</blink> list'
2. log as admin on staff part.
3. go to Lists
4. select the list named 'a <blink>simple</blink> list' (no XXS here)
5. the 'simple' word *blink* on 3 places
The issue is mitigated by the fact that the list of Shelve display the code, and the admin should see it before trigger the XSS.
Created attachment 4752 [details] [review]
Here a patch for TT page in admin. 'html' filter was added to each 'shelvename'.
Created attachment 4756 [details] [review]
Bug 6632 [Signed Off] add html filter to prevent XSS
The filter 'html' have been added on all occurences of shelvename, which come from user input.
Bug confirmed, fix signed off.
XSS fix, pushed