LP#1446816 HTML-escape notes in XUL patron alert page

Avoid rendering HTML contained in patron messages, etc. in the XUL
patron stop-sign page.

Thanks to Jason Etheridge, ESI for noting this problem and contributing
the original patch fix.

Signed-off-by: Bill Erickson <berickxx@gmail.com>
Signed-off-by: Ben Shum <bshum@biblio.org>

diff --git a/Open-ILS/xul/staff_client/server/patron/display.js b/Open-ILS/xul/staff_client/server/patron/display.js
index 87b50e2..ba8a5b4 100644 (file)
--- a/Open-ILS/xul/staff_client/server/patron/display.js
+++ b/Open-ILS/xul/staff_client/server/patron/display.js
@@ -960,7 +960,7 @@ patron.display.prototype = {
                 obj._already_defaulted_once = true;
                 var msg = ''; obj.stop_checkouts = false;
                 if (patron.alert_message())
-                    msg += $("patronStrings").getFormattedString('staff.patron.display.init.network_request.alert_message', [patron.alert_message()]) + '<br/><br/>';
+                    msg += $("patronStrings").getFormattedString('staff.patron.display.init.network_request.alert_message', [(patron.alert_message()).replace(/</g,'&lt;').replace(/>/g,'&gt;')]) + '<br/><br/>';
                 //alert('obj.barcode = ' + obj.barcode);
                 if (obj.barcode) {
                     if (patron.cards()) for (var i = 0; i < patron.cards().length; i++) {
@@ -1020,9 +1020,9 @@ patron.display.prototype = {
                             dl_flag_opened = true;
                         }
                         msg += '<dt>';
-                        msg += obj.OpenILS.data.hash.aou[ penalties[i].org_unit() ].shortname() + ' : ' + penalties[i].standing_penalty().label() + '<br/>';
+                        msg += (obj.OpenILS.data.hash.aou[ penalties[i].org_unit() ].shortname() + ' : ' + penalties[i].standing_penalty().label()).replace(/</g,'&lt;').replace(/>/g,'&gt;') + '<br/>';
                         msg += '</dt><dd>';
-                        msg += (penalties[i].note())?penalties[i].note():'';
+                        msg += ((penalties[i].note())?penalties[i].note():'').replace(/</g,'&lt;').replace(/>/g,'&gt;');
                         msg += '</dd>';
                     }
                 }