Bug 19035 - Stored XSS in lists.pl

To Test
1. Hit the page /cgi-bin/koha/patron_lists/lists.pl
2. Click on new patron list
3. Add a text in the field Name that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Fixed in both the pages list.pl and list.pl?patron_list_id=xx
xx is patronlist id

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt

@@ -69,13 +69,13 @@ $(document).ready(function() {
 <body id="patlist_list" class="pat patlist">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name %]</a> &rsaquo; Add patrons</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name |html %]</a> &rsaquo; Add patrons</div>
 
 <div id="doc3" class="yui-t2">
    <div id="bd">
     <div id="yui-main">
         <div class="yui-b">
-        <h1>[% list.name %]</h1>
+        <h1>[% list.name |html %]</h1>
 
         <form action="list.pl" id="add_patrons" method="post">
             <fieldset>

koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt

@@ -87,7 +87,7 @@
             <tbody>
                 [% FOREACH l IN lists %]
                     <tr>
-                        <td>[% l.name %]</td>
+                        <td>[% l.name |html %]</td>
                         <td>[% l.patron_list_patrons_rs.count || 0 %]</td>
                         <td>
                             <div class="dropdown">