Bug 17026 XSS in checkexpiration.pl

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
index 95bfcb8..852ce63 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
@@ -47,10 +47,10 @@
     
          <ol>
         <li><label for="title">Title:</label>
-        <input id="title" type="text" name="title" size="15" value="[% title %]" /></li>
+        <input id="title" type="text" name="title" size="15" value="[% title | html %]" /></li>
 
         <li><label for="issn">ISSN:</label>
-        <input id="issn" type="text" name="issn" size="15" value="[% issn %]" /></li>
+        <input id="issn" type="text" name="issn" size="15" value="[% issn | html %]" /></li>
 
         <li><label for="date" class="required" title="Required field">Expiring before:</label>
         <input id="date" type="text" name="date" size="10" value="[% date %]" class="focus datepicker" />
@@ -66,11 +66,11 @@
 <p>
     <b>[% numsubscription %]</b> subscription(s)
         [% IF ( title ) %]
-        with title matching <span class="title">[% title %]</class>
+        with title matching <span class="title">[% title | html %]</class>
         [% IF ( issn ) %]and [% END %]
     [% END %]
     [% IF ( issn ) %]
-        with ISSN matching <b>[% issn %]</b>
+        with ISSN matching <b>[% issn | html %]</b>
     [% END %]
         will expire before <b>[% date %]</b>
 </p>