From 05f1d5f226c8b66fa9b39888a38dfdcd0ec5bd44 Mon Sep 17 00:00:00 2001
From: Jeff Davis <jdavis@sitka.bclibraries.ca>
Date: Mon, 1 Apr 2019 10:00:59 -0700
Subject: [PATCH] LP#1822630: sanitize user input before display on browse
 results

Signed-off-by: Jeff Davis <jdavis@sitka.bclibraries.ca>
Signed-off-by: Chris Sharp <csharp@georgialibraries.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
(cherry picked from commit 4402695e80dbcee5187a35de46e5e314bab1231a)
---
 Open-ILS/src/templates/opac/browse.tt2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Open-ILS/src/templates/opac/browse.tt2 b/Open-ILS/src/templates/opac/browse.tt2
index ea27b7d71e..7d917de405 100644
--- a/Open-ILS/src/templates/opac/browse.tt2
+++ b/Open-ILS/src/templates/opac/browse.tt2
@@ -45,7 +45,7 @@
                 <div id="browse-controls" class='searchbar'>
                     <form method="get" onsubmit="$('browse-submit-spinner').className = ''; return true">
                         <input type="hidden" name="blimit"
-                            value="[% blimit %]" />
+                            value="[% blimit | html %]" />
 
                         [% control_qtype = INCLUDE "opac/parts/qtype_selector.tt2"
                             id="browse-search-class" browse_only=1 plural=1 %]
-- 
2.11.0