Test plan:
Enter the following in the "Check out" tab:
"><script>alert('XSS')</script>
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
[% IF ( message ) %]
[% INCLUDE 'patron-toolbar.inc' %]
<h4>
-No patron matched <span class="ex">[% message %]</span>
+No patron matched <span class="ex">[% message | html %]</span>
</h4>
[% END %]