Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt

Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
index 1aff010..6a10d7d 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
@@ -30,11 +30,11 @@
                 [% IF ( clear ) %]
                     var new_line = "";
                 [% ELSE %]
-                    var new_line = "
+                var new_line = "
                     [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]‡
-                        [%- To.json( SUBFIELD_LOO.marc_subfield ) | $raw -%]
+                        [%- To.json( SUBFIELD_LOO.marc_subfield ) | html -%]
                         [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%]
-                            [%- To.json( marc_value ) | $raw -%]
+                            [%- To.json( marc_value ) | html -%]
                         [%- END -%]
                     [%- END -%]‡9[% authid | html %]";
                 [% END %]