From a2a92356b81bc791c2951f13d48960941ed355e1 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Tue, 7 Apr 2026 04:09:11 +0000
Subject: [PATCH] Bug 42253: (QA follow-up) prevent XSS injection in data-
 attribute

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
index a08116528c..628fb80163 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
@@ -878,7 +878,8 @@
             $.ajax(options)
                 .then(function(result) {
                         $.each(result,function( undef, macro ){
-                            var $li = $( '<li data-name="' + escape_str(macro.name) + '" data-id="' + macro.macro_id + '"><a href="#">' + escape_str(macro.name) + '</a><ol class="macro-info"></ol></li>' );
+                            var $li = $( '<li data-id="' + macro.macro_id + '"><a href="#">' + escape_str(macro.name) + '</a><ol class="macro-info"></ol></li>' );
+                            $li.get(0).setAttribute('data-name',macro.name);
                             if ( macro.macro_id == macroEditor.activeMacroId ) $li.addClass( 'active' );
                             $li.click( function() {
                                 loadMacro(macro.name, macro.macro_id, macro.shared);