https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39882 --- Comment #37 from David Cook <dcook@prosentient.com.au> --- Thanks for adding the escaping on the system preferences folks. That's helpful. I notice adding <script>alert('stuff')</script> into PhoneMaskPattern does yield <script>alert('stuff')</script> when I type into "Other phone". Could probably be validating/massaging the system preference a bit more, although that's something I'd love to fix on the server side at some point... -- Since we only allow a select number of fields in the system preference, we should also be validating "const fields" against a list of allowed values in the front-end too. -- Overall it works though and my main security concerns are handled. -- You are receiving this mail because: You are watching all bug changes.