Unescape XSS escaped address layout template

openmrs · Dec 21, 2024 · 9f2f2dc · 9f2f2dc
1 parent 9f3ba44
commit 9f2f2dc
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/api/src/main/java/org/openmrs/layout/address/AddressSupport.java b/api/src/main/java/org/openmrs/layout/address/AddressSupport.java
@@ -12,6 +12,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.openmrs.GlobalProperty;
 import org.openmrs.api.GlobalPropertyListener;
 import org.openmrs.api.context.Context;
@@ -56,7 +57,7 @@ private void init() {
 
 			String layoutTemplateXml = Context.getAdministrationService().getGlobalProperty(
 			    OpenmrsConstants.GLOBAL_PROPERTY_ADDRESS_TEMPLATE);
-			setAddressTemplate(layoutTemplateXml);
+			setAddressTemplate(StringEscapeUtils.unescapeXml(layoutTemplateXml));
 
 			List<String> specialTokens = new ArrayList<>();
 			specialTokens.add("address1");