From 2e40d1b7bcf0222e813da5ccdc29b3592e7bb4ab Mon Sep 17 00:00:00 2001
From: Bill Erickson <berickxx@gmail.com>
Date: Mon, 3 Jul 2017 11:22:16 -0400
Subject: [PATCH] JBAS-1768 X-port XSS login form repairs

Cross-porting 472bd5ae1486fc0349581b02e666d0e8b8d5c143 to our custom
login form.

Signed-off-by: Bill Erickson <berickxx@gmail.com>
---
 KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2 b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
index 6bf2c6da11..761c1b7393 100644
--- a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
+++ b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
@@ -132,7 +132,7 @@
                                         END;
                                         redirect = redirect  | replace('^http:', 'https:');
                                     %]
-                                    <input type='hidden' name='redirect_to' value='[% redirect %]'/>
+                                    <input type='hidden' name='redirect_to' value='[% redirect | html %]'/>
                                     <input type="checkbox" name="persist" id="login_persist" /><label for="login_persist"> [% l('Stay logged in?') %]</label>
                                 </div>
                                 <div style="padding-top:14px;">
-- 
2.11.0