From 47371bb2aa9cd29d97638902653b04e2f8f436a8 Mon Sep 17 00:00:00 2001
From: Aina Sitraka <35221835+aynsix@users.noreply.github.com>
Date: Wed, 23 Oct 2024 20:57:10 +0300
Subject: [PATCH] fix (#4555)

---
 .../Phrasea/Core/Configuration/DisplaySettingService.php      | 4 ++++
 templates/web/prod/index.html.twig                            | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/Alchemy/Phrasea/Core/Configuration/DisplaySettingService.php b/lib/Alchemy/Phrasea/Core/Configuration/DisplaySettingService.php
index 11987a9d5c..99c4ff90cd 100644
--- a/lib/Alchemy/Phrasea/Core/Configuration/DisplaySettingService.php
+++ b/lib/Alchemy/Phrasea/Core/Configuration/DisplaySettingService.php
@@ -98,6 +98,10 @@ public function getUserSetting(User $user, $name, $default = null)
             return array_key_exists($name, $this->usersSettings) ? $this->usersSettings[$name] : $default;
         }
 
+        if ($name == 'start_page_query') {
+            return htmlentities($user->getSettings()->get($name)->getValue());
+        }
+
         return $user->getSettings()->get($name)->getValue();
     }
 
diff --git a/templates/web/prod/index.html.twig b/templates/web/prod/index.html.twig
index 519c46f298..5a39d59250 100644
--- a/templates/web/prod/index.html.twig
+++ b/templates/web/prod/index.html.twig
@@ -986,7 +986,7 @@
                                     {{ 'Aide' | trans }}
                                 </option>
                             </select>
-                            <input type="text" class="span4" name="start_page_value" value="{{ app['settings'].getUserSetting(app.getAuthenticatedUser(), 'start_page_query')}}" style="display:{% if start_page_pref == 'QUERY' %}inline{% else %}none{% endif %}" />
+                            <input type="text" class="span4" name="start_page_value" value="{{ app['settings'].getUserSetting(app.getAuthenticatedUser(), 'start_page_query') | raw }}" style="display:{% if start_page_pref == 'QUERY' %}inline{% else %}none{% endif %}" />
                             <input type="button" class="btn btn-inverse preferences-options-submit" value="{{'boutton::valider'  | trans }}" />
                         </form>
                     </div>