[Koha-bugs] [Bug 38217] TT tags breaking translation script when used to build a JS string

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38217 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #6)

(In reply to David Cook from comment #3)

...

In the quoted version, both "foo" and "bar" are potentially vulnerable to XSS if they contain unsanitized user input.

We should call escape_str on all JS vars, yes. But it's not the point of the bug report.

I didn't say it was. Just pointing out the robustness of the alternative I suggested. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.