From c80ddfab7ac20fecff64a14eef40777e9baadeb1 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Tue, 5 May 2026 01:56:49 +0000
Subject: [PATCH] Bug 42471: [25.05] (follow-up) prevent XSS in suggestion
 reason

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../intranet-tmpl/prog/en/modules/suggestion/suggestion.tt  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
index ab157f7424..2488a9e4fe 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
@@ -1500,7 +1500,11 @@
                                             else if (row._strings.status.str) node += '<span class="status ' + escape_str(row.status) + '">%s</span>'.format(escape_str(row._strings.status.str));
                                             else node += '<span class="status unknown">%s</span>'.format(escape_str(_("Status unknown")));
                                             if (row.reason) {
-                                                node += '<div class="reason" data-reason="' + escape_str(row.reason) + '">(' + escape_str(row.reason) + ")</div>";
+                                                const reason_el = document.createElement("div");
+                                                reason_el.classList.add("reason");
+                                                reason_el.dataset.reason = row.reason;
+                                                reason_el.textContent = "(" + row.reason + ")";
+                                                node += reason_el.outerHTML;
                                             }
                                             return node;
                                         },