gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt 

To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 11d0a05eb9)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This commit is contained in:
Owen Leonard 2020-08-11 15:05:59 +00:00 committed by Victor Grousset/tuxayo
parent 083ae794cc
commit fb7da5bd15
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
View File

@ -32,5 +32,5 @@
[%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %]
[%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %]
[%~ SET address = address _ Branches.GetName( data.branchcode ) %]
[%~ To.json( address ) | $raw ~%]
[%~ address | html | $To ~%]
[% END %]