From 4653a5209acf51cdc5977ff082d9b658f9959350 Mon Sep 17 00:00:00 2001
From: Amit Gupta <amit.gupta@informaticsglobal.com>
Date: Tue, 15 Aug 2017 08:52:40 +0530
Subject: [PATCH] Bug 19103 - Stored XSS in itemtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 18b5d4f1ababf560ff02a258de389f8c34cff9e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
index 0d0718748e..66b345ffea 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
@@ -376,7 +376,7 @@ Item types administration
                         <br/>
                     [% END %]
                 [% ELSE %]
-                    [% itemtype.description %]
+                    [% itemtype.description |html %]
                 [% END %]
             </td>
             <td>[% itemtype.searchcategory %]</td>
@@ -387,7 +387,7 @@ Item types administration
               [% itemtype.rentalcharge | $Price %]
             [% END %]
             </td>
-            <td>[% itemtype.checkinmsg | html_line_break %]</td>
+            <td>[% itemtype.checkinmsg | html_line_break |html %]</td>
             <td class="actions">
               <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
               <a href="/cgi-bin/koha/admin/itemtypes.pl?op=delete_confirm&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
-- 
2.11.4.GIT