From 9a42d3507bd5b9a368307e8b5b808a4ccd11093f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 3 Apr 2026 09:15:12 +0200
Subject: [PATCH] Bug 42252: Prevent XSS when deleting a list at the OPAC

Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
---
 koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
index 0dae4f6a4d..8880ec85f3 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ -998,9 +998,9 @@ $(function() {
         var shelf_number = $(this).data("shelfnumber");
         var is_shared = $(this).data("shared");
         var count = $(this).data("count");
-        var message = "<p><em>" + shelf_name + "</em></p>";
+        var message = "<p><em>" + escape_str(shelf_name) + "</em></p>";
         if( count ){
-            message += "<p>" + _("Items on this list:") + " <strong>" + count + "</strong></p>";
+            message += "<p>" + _("Items on this list:") + " <strong>" + escape_str(count) + "</strong></p>";
         }
         if( is_shared ){
             message += "<p>" + _("This list is shared. Other users will lose access to it.") + "</p>";
@@ -1017,7 +1017,7 @@ $(function() {
         e.preventDefault();
         var shelf_name = $(this).data("shelfname");
         var shelf_number = $(this).data("shelfnumber");
-        confirmModal( shelf_name, _("Are you sure you want to remove sharing? You will no longer have access to the list."), _("Yes, remove sharing"), _("No, do not remove sharing"), function( result ){
+        confirmModal( escape_str(shelf_name), _("Are you sure you want to remove sharing? You will no longer have access to the list."), _("Yes, remove sharing"), _("No, do not remove sharing"), function( result ){
                 if( result ){
                     $("#unshare" + shelf_number ).submit();
                 }