[freeside-commits] branch FREESIDE_4_BRANCH updated. aa6d96694296a1e9ac29d7d9885dada99dd0b384

[Ivan]

The branch, FREESIDE_4_BRANCH has been updated
       via  aa6d96694296a1e9ac29d7d9885dada99dd0b384 (commit)
      from  a45c6d9e1a9f0b17a3b0821fe854115eacaa1eec (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit aa6d96694296a1e9ac29d7d9885dada99dd0b384
Author: Ivan Kohler <ivan at freeside.biz>
Date:   Mon Apr 25 11:02:37 2016 -0700

    xss

diff --git a/httemplate/view/cust_main.cgi b/httemplate/view/cust_main.cgi
index 3cd7d2b..fac126f 100755
--- a/httemplate/view/cust_main.cgi
+++ b/httemplate/view/cust_main.cgi
@@ -225,16 +225,19 @@ my $cust_main = qsearchs( {
 });
 die "Customer not found!" unless $cust_main;
 
-my $title = mt("Customer").' #'. $cust_main->display_custnum. ': '.
-            encode_entities($cust_main->name);
+my $title = mt("Customer").' #'. $cust_main->display_custnum. ': ';
+my $title_noescape = $title. encode_entities($cust_main->name);
+$title .= $cust_main->name;
 
 if ( $curuser->num_agents ) {
-  $title = encode_entities($cust_main->agent->agent). " $title";
+  $title_noescape =
+    encode_entities($cust_main->agent->agent). " $title_noescape";
+  $title = $cust_main->agent->agent. " $title";
 }
 
 my $status = $cust_main->status_label;
 $status .= ' (Cancelled)' if $cust_main->is_status_delay_cancel;
-my $title_noescape = $title. ' (<B><FONT COLOR="#'. $cust_main->statuscolor. '">'. $status.  '</FONT></B>)';
+$title_noescape .= ' (<B><FONT COLOR="#'. $cust_main->statuscolor. '">'. $status.  '</FONT></B>)';
 $title .= " ($status)";
 
 #false laziness w/pref/pref.html and Conf.pm (cust_main-default_view)

-----------------------------------------------------------------------

Summary of changes:
 httemplate/view/cust_main.cgi |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)