From b56f3a9d9dae0e7a89d30d132f629c4195ac6b3e Mon Sep 17 00:00:00 2001
From: Bill Erickson <berick@esilibrary.com>
Date: Mon, 16 Apr 2012 17:04:10 -0400
Subject: [PATCH] kpac : html escape title/author in record rows

Signed-off-by: Bill Erickson <berick@esilibrary.com>
Signed-off-by: Mike Rylander <mrylander@gmail.com>
---
 Open-ILS/src/templates/kpac/parts/record_row.tt2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Open-ILS/src/templates/kpac/parts/record_row.tt2 b/Open-ILS/src/templates/kpac/parts/record_row.tt2
index 274fce8f72..1f8f201839 100644
--- a/Open-ILS/src/templates/kpac/parts/record_row.tt2
+++ b/Open-ILS/src/templates/kpac/parts/record_row.tt2
@@ -11,8 +11,8 @@
             src='[% mkurl(img_src, {}, 1) %]' /></a><br />
     </div>
     <div class="item_detail_info">
-        <div class="item_detail_name"><a href="[% mkurl(ctx.kpac_root _ '/record/' _ rec_id) %]">[% attrs.title %]</a></div>
-        <div class="item_detail_author">[% l('by [_1]', attrs.author) %]</div>
+        <div class="item_detail_name"><a href="[% mkurl(ctx.kpac_root _ '/record/' _ rec_id) %]">[% attrs.title | html %]</a></div>
+        <div class="item_detail_author">[% l('by [_1]', attrs.author) | html %]</div>
         <div class="item_detail_callnumber">[% attrs.holdings.0.label | html %]</div>
         <div class="item_detail_extra_info">
             [% l('[_1], [_2]', attrs.publisher, attrs.pubdate) | html %] <!-- TODO fix commas, etc. -->
-- 
2.11.0