gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42471: [25.05] (follow-up) prevent XSS in suggestion reason 

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
David Cook 2026-05-05 01:56:49 +00:00 committed by Wainui Witika-Park
parent c0ce4d57cd
commit c80ddfab7a
No known key found for this signature in database
GPG Key ID: 2D0A6AB5DAF1B78D
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
View File

@ -1500,7 +1500,11 @@
else if (row._strings.status.str) node += '<span class="status ' + escape_str(row.status) + '">%s</span>'.format(escape_str(row._strings.status.str));
else node += '<span class="status unknown">%s</span>'.format(escape_str(_("Status unknown")));
if (row.reason) {
node += '<div class="reason" data-reason="' + escape_str(row.reason) + '">(' + escape_str(row.reason) + ")</div>";
const reason_el = document.createElement("div");
reason_el.classList.add("reason");
reason_el.dataset.reason = row.reason;
reason_el.textContent = "(" + row.reason + ")";
node += reason_el.outerHTML;
}
return node;
},