From c2869ae136afc0b82cf957445339d0dda1484ebd Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 10 Mar 2026 05:21:49 +0000 Subject: [PATCH] Bug 42048: Build patron search description more carefully This patch builds the patron search description more carefully to avoid XSS Test plan: 0. Apply the patch 1. Log into Koha and click on "Patrons" 2. Change the "Category" and "Library" to any option but "Any" and click "Search" 3. Type "test" into the data table "Search:" box 4. Note some text should appear on the screen similar to this content and format: Patrons found for: Anywhere: test Library=Centerville, Category=Board Signed-off-by: Owen Leonard Signed-off-by: Jonathan Druart Signed-off-by: Jonathan Druart Signed-off-by: Jacob O'Mara --- koha-tmpl/intranet-tmpl/prog/js/datatables.js | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/datatables.js b/koha-tmpl/intranet-tmpl/prog/js/datatables.js index 7b6dde8a7c..f2dad39685 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/datatables.js +++ b/koha-tmpl/intranet-tmpl/prog/js/datatables.js @@ -1362,7 +1362,7 @@ function update_search_description( column_searches.push( "%s=%s".format( - table_dt.column(i).header().innerHTML, + table_dt.column(i).header().textContent, search ) ); @@ -1374,10 +1374,18 @@ function update_search_description( if (description.length) { let display = description.length ? "block" : "none"; - let description_str = $(description_node) - .data("prefix") - .format(description.join("
")); - $(description_node).html(description_str).show(); + const search_desc_node = $(description_node); + search_desc_node.empty(); //Removing existing child nodes + const prefix = search_desc_node.data("prefix").format(""); + search_desc_node.append(prefix); + const last_index = description.length - 1; + description.forEach((item, index) => { + search_desc_node.append(document.createTextNode(item)); + if (index !== last_index) { + search_desc_node.append(document.createElement("br")); + } + }); + $(description_node).show(); } else { $(description_node).html("").hide(); }