From e36fc8948cfd40c4b2072d3d324df73704ca72c7 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 9 Jun 2026 11:19:35 +0200
Subject: [PATCH] Bug 42800: Fix XSS in shelf list in the ERM module

const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %];

If you have a script tag in a list name the UI will be broken, and there
is potentially a XSS vulnerability

Test plan:
Create a new list with name="<script>alert("booh!");</script>"
Go to /cgi-bin/koha/erm/eholdings/local/titles/import
or any ERM views
=> Without this patch the UI is broken
=> With this patch applied it's not and the table is correctly populated
with the lists

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt     | 10 +++++++++-
 .../components/ERM/EHoldingsLocalTitlesFormImport.vue  |  8 +++-----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt
index 85f48a27bb..e9b749e73a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt
@@ -40,7 +40,15 @@
 
         const max_allowed_packet = [% To.json(max_allowed_packet) | $raw %];
 
-        const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %];
+        let logged_in_user_lists = [];
+        [% FOR shelf IN logged_in_user.virtualshelves %]
+            logged_in_user_lists.push(
+                {
+                    id: "[% shelf.shelfnumber | html %]",
+                    name: "[% shelf.shelfname | html %]",
+                }
+            );
+        [% END %]
 
         const logged_in_user = [% To.json(logged_in_user.unblessed) | $raw %];
     </script>
diff --git a/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/EHoldingsLocalTitlesFormImport.vue b/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/EHoldingsLocalTitlesFormImport.vue
index b8f5c79433..c78a75aa99 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/EHoldingsLocalTitlesFormImport.vue
+++ b/koha-tmpl/intranet-tmpl/prog/js/vue/components/ERM/EHoldingsLocalTitlesFormImport.vue
@@ -68,14 +68,12 @@ export default {
                 columns: [
                     {
                         title: $__("Name"),
-                        data: "shelfname",
+                        data: "name",
                         searchable: true,
                         orderable: true,
                         width: "100%",
                         render: function (data, type, row, meta) {
-                            return (
-                                row.shelfname + " (#" + row.shelfnumber + ")"
-                            );
+                            return row.name + " (#" + row.id + ")";
                         },
                     },
                     {
@@ -93,7 +91,7 @@ export default {
 
                     $.each($(this).find("td .actions"), function (index, e) {
                         let tr = $(this).parent().parent();
-                        let list_id = api.row(tr).data().shelfnumber;
+                        let list_id = api.row(tr).data().id;
                         let importButton = createVNode(
                             "a",
                             {