From ef9053aae249f2fc2248ef4db0359d567e3918e0 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Mon, 18 Nov 2024 04:14:37 +0000
Subject: [PATCH] Bug 38468: Add double quotes to some template strings

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
   On the left of the page. Just bellow the breadcrumb and
   left of the record title.
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc | 4 ++--
 koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
index 6ea79d927a..510c2baf35 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
@@ -2,7 +2,7 @@
 <!-- catalog-strings.inc -->
 <script>
     /* Some required variables from the template */
-    var biblionumber = [% biblionumber | html %];
+    var biblionumber = "[% biblionumber | html %]";
     var count = [% count || 0 | html %];
     var holdcount = [% holdcount || 0 | html %];
     [% SET orders = biblio.orders %]
@@ -11,7 +11,7 @@
     var countorders = [% current.count || 0 | html %];
     var countdeletedorders = [% cancelled.count || 0 | html %];
     var subscriptionscount = [% biblio.subscriptions.count || 0 | html %];
-    var searchid = '[% searchid | html %]';
+    var searchid = "[% searchid | html %]";
 
     /* provide Z3950 search points */
     function GetZ3950Terms(){
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
index 999258932b..6a1b4c404b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
@@ -1667,7 +1667,7 @@
     [% Asset.js("js/modals/place_booking.js") | $raw %]
     <script>
         var browser;
-        browser = KOHA.browser('[% searchid | html %]', parseInt(biblionumber, 10));
+        browser = KOHA.browser("[% searchid | html %]", parseInt(biblionumber, 10));
         browser.show();
 
         [% IF bundlesEnabled %]