From 944f8df47bc85d3a6e0df950be839cea5f7ae407 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 8 Sep 2025 16:05:59 +0200
Subject: [PATCH] Bug 40766: Prevent XSS on set-library

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
index 7662fd5e14..8b15a3853b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt
@@ -124,13 +124,13 @@ Updated:<ul>
 
 <fieldset class="action">
     <input type="submit" class="btn btn-primary" value="Submit" />
-    <a class="cancel" id="cancel_set_library" href="[% referer or '/cgi-bin/koha/circ/circulation.pl' %]">Cancel</a>
+    <a class="cancel" id="cancel_set_library" href="[% referer or '/cgi-bin/koha/circ/circulation.pl' | url %]">Cancel</a>
 </fieldset>
 <div class="noshow">
     [% FOREACH recycle_loo IN recycle_loop %]
     <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
     [% END %]
-    <input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]" />
+    <input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/circ/circulation.pl" | url %]" />
 </div>
 </form>
 <!-- /updated -->