https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42383 --- Comment #64 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 209615 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209615&action=edit Bug 42383: (QA follow-up) Escape the item type check-in message The check-in page renders its alert boxes with v-html. Every value interpolated into them is escaped, except the item type check-in message (itemtypes.checkinmsg) used for the item_type_checkinmsg message, which was rendered as raw HTML. The legacy page displayed it with the html_line_break filter, which escapes the text and turns line breaks into <br>. This patch (QA comment point 2) escapes the message and converts its line breaks into <br>, matching the legacy rendering. The other alert boxes already escape the API provided data they interpolate. Test plan: 1. Go to Administration > Item types and edit the type of an item. Set 'Checkin message' to: <b>Bold</b><img src=x onerror=alert('XSS')> Second line 2. Check the item out, then check it in on the check-in page => FAIL: 'Bold' is rendered bold and a JS alert pops up 3. Apply this patch and rebuild: $ ktd --shell k$ yarn js:build k$ restart_all 4. Repeat step 2 => SUCCESS: The message is displayed literally, with the HTML tags visible, no alert pops up and 'Second line' is on its own line 5. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes.