Bug 20685: Escape letter template content in textarea

Test plan:
enter the following text into the Email template for 'HOLD_SLIP'
in Home › Tools › Notices & Slips › Modify notice

<div style='max-width: 4in;'>
<h3><<borrowers.surname>>, <<borrowers.firstname>></h3><br />
<<borrowers.streetnumber>> <<borrowers.address>><br />
<<borrowers.address2>><br />
<<borrowers.city>>, <<borrowers.state>> <<borrowers.zipcode>><br />
<br />
<br />
<img src="/cgi-bin/koha/svc/barcode?barcode=<<borrowers.cardnumber>>&type=Industrial2of5&notext=1">

Edit it again
Without this patch you will get:
<img src="/cgi-bin/koha/svc/barcode?barcode=<<borrowers.cardnumber>>&type=Industrial2of5¬ext=1">

Signed-off-by: Barton Chittenden <barton@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
index d7cfab2..7149499 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
@@ -360,7 +360,7 @@
                         <td class="actions">
                             <button type="button" data-containerid="[% letter.message_transport_type %]_[% lang %]" class="btn btn-default btn-sm insert">Insert <i class="fa fa-long-arrow-right"></i></button>
                         </td>
-                      <td><textarea name="content" data-lang="[% lang %]" class="content_[% letter.message_transport_type %]" id="content_[% letter.message_transport_type %]_[% lang %]" cols="80" rows="15">[% letter.content %]</textarea></td>
+                      <td><textarea name="content" data-lang="[% lang %]" class="content_[% letter.message_transport_type %]" id="content_[% letter.message_transport_type %]_[% lang %]" cols="80" rows="15">[% letter.content | html %]</textarea></td>
                     </tr>
                   </table>
                 </li>