Bug 16597: Fix XSS in shelves.pl

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
index b408039..6b4856b 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
@@ -529,7 +529,7 @@ function placeHold () {
             <legend>Edit list <i>[% shelf.shelfname | html %]</i></legend>
             <input type="hidden" name="op" value="edit" />
         [% END %]
-        <input type="hidden" name="referer" value="[% referer %]" />
+        <input type="hidden" name="referer" value="[% referer | html %]" />
         <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber %]" />
         <ol>
             <li>