From: Jeff Davis <jdavis@sitka.bclibraries.ca>
Date: Mon, 1 Apr 2019 17:00:59 +0000 (-0700)
Subject: LP#1822630: sanitize user input before display on browse results
X-Git-Url: https://old-git.evergreen-ils.org/?a=commitdiff_plain;h=05f1d5f226c8b66fa9b39888a38dfdcd0ec5bd44;p=Evergreen.git

LP#1822630: sanitize user input before display on browse results

Signed-off-by: Jeff Davis <jdavis@sitka.bclibraries.ca>
Signed-off-by: Chris Sharp <csharp@georgialibraries.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
(cherry picked from commit 4402695e80dbcee5187a35de46e5e314bab1231a)
---

diff --git a/Open-ILS/src/templates/opac/browse.tt2 b/Open-ILS/src/templates/opac/browse.tt2
index ea27b7d71e..7d917de405 100644
--- a/Open-ILS/src/templates/opac/browse.tt2
+++ b/Open-ILS/src/templates/opac/browse.tt2
@@ -45,7 +45,7 @@
                 <div id="browse-controls" class='searchbar'>
                     <form method="get" onsubmit="$('browse-submit-spinner').className = ''; return true">
                         <input type="hidden" name="blimit"
-                            value="[% blimit %]" />
+                            value="[% blimit | html %]" />
 
                         [% control_qtype = INCLUDE "opac/parts/qtype_selector.tt2"
                             id="browse-search-class" browse_only=1 plural=1 %]