From 0c4cb8ce02bde2e313c480c7112a6dd07c2acca4 Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 10 Mar 2026 05:21:49 +0000 Subject: [PATCH] Bug 42048: Build patron search description more carefully This patch builds the patron search description more carefully to avoid XSS Test plan: 0. Apply the patch 1. Log into Koha and click on "Patrons" 2. Change the "Category" and "Library" to any option but "Any" and click "Search" 3. Type "test" into the data table "Search:" box 4. Note some text should appear on the screen similar to this content and format: Patrons found for: Anywhere: test Library=Centerville, Category=Board Signed-off-by: Owen Leonard Signed-off-by: Jonathan Druart Signed-off-by: Jonathan Druart Signed-off-by: Lucas Gass --- koha-tmpl/intranet-tmpl/prog/js/datatables.js | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/datatables.js b/koha-tmpl/intranet-tmpl/prog/js/datatables.js index b3cd2441d0..1d2ced2ff0 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/datatables.js +++ b/koha-tmpl/intranet-tmpl/prog/js/datatables.js @@ -1362,7 +1362,7 @@ function update_search_description( column_searches.push( "%s=%s".format( - table_dt.column(i).header().innerHTML, + table_dt.column(i).header().textContent, search ) ); @@ -1374,10 +1374,18 @@ function update_search_description( if (description.length) { let display = description.length ? "block" : "none"; - let description_str = $(description_node) - .data("prefix") - .format(description.join("
")); - $(description_node).html(description_str).show(); + const search_desc_node = $(description_node); + search_desc_node.empty(); //Removing existing child nodes + const prefix = search_desc_node.data("prefix").format(""); + search_desc_node.append(prefix); + const last_index = description.length - 1; + description.forEach((item, index) => { + search_desc_node.append(document.createTextNode(item)); + if (index !== last_index) { + search_desc_node.append(document.createElement("br")); + } + }); + $(description_node).show(); } else { $(description_node).html("").hide(); }