[Koha-bugs] [Bug 38217] TT tags breaking translation script when used to build a JS string

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38217 --- Comment #6 from Jonathan Druart <jonathan.druart@gmail.com> --- (In reply to David Cook from comment #3)

In the quoted version, both "foo" and "bar" are potentially vulnerable to XSS if they contain unsanitized user input.

We should call escape_str on all JS vars, yes. But it's not the point of the bug report. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.