From: Bill Erickson <berickxx@gmail.com>
Date: Mon, 3 Jul 2017 15:22:16 +0000 (-0400)
Subject: JBAS-1768 X-port XSS login form repairs
X-Git-Url: https://old-git.evergreen-ils.org/?a=commitdiff_plain;h=2e40d1b7bcf0222e813da5ccdc29b3592e7bb4ab;p=working%2FEvergreen.git

JBAS-1768 X-port XSS login form repairs

Cross-porting 472bd5ae1486fc0349581b02e666d0e8b8d5c143 to our custom
login form.

Signed-off-by: Bill Erickson <berickxx@gmail.com>
---

diff --git a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2 b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
index 6bf2c6da11..761c1b7393 100644
--- a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
+++ b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
@@ -132,7 +132,7 @@
                                         END;
                                         redirect = redirect  | replace('^http:', 'https:');
                                     %]
-                                    <input type='hidden' name='redirect_to' value='[% redirect %]'/>
+                                    <input type='hidden' name='redirect_to' value='[% redirect | html %]'/>
                                     <input type="checkbox" name="persist" id="login_persist" /><label for="login_persist"> [% l('Stay logged in?') %]</label>
                                 </div>
                                 <div style="padding-top:14px;">