gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42253: (QA follow-up) prevent XSS injection in data- attribute 

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2026-04-07 04:09:11 +00:00 committed by Lucas Gass
parent 13dd809d82
commit 09da6e9237
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
View File

@ -878,7 +878,8 @@
$.ajax(options)
.then(function(result) {
$.each(result,function( undef, macro ){
var $li = $( '<li data-name="' + escape_str(macro.name) + '" data-id="' + macro.macro_id + '"><a href="#">' + escape_str(macro.name) + '</a><ol class="macro-info"></ol></li>' );
var $li = $( '<li data-id="' + macro.macro_id + '"><a href="#">' + escape_str(macro.name) + '</a><ol class="macro-info"></ol></li>' );
$li.get(0).setAttribute('data-name',macro.name);
if ( macro.macro_id == macroEditor.activeMacroId ) $li.addClass( 'active' );
$li.click( function() {
loadMacro(macro.name, macro.macro_id, macro.shared);