Empt64

[Parth59]

@isears

Changes I made:
Added input-validation to the backend variables. Steps to reproduce can be found here.
https://docs.google.com/document/d/1GJNMRlGTRV45St6WSjnD_FjW84aoNxY9HzGbpwoBrro/edit?usp=sharing

Link to ticket:
https://issues.openmrs.org/browse/RA-1865

[HerbertYiga]

thanks @Parth59 for working on this, you can checkout https://wiki.openmrs.org/display/docs/Pull+Request+Tips to make better pull requests

[isears]

@Parth59 what do you think of inspecting the Provider object in the DWR provider search service and applying HTML-encoding server-side?

The relevant server-side code for the provider search function is here:

openmrs-module-legacyui/omod/src/main/java/org/openmrs/web/dwr/DWRProviderService.java

Line 59 in 4dde8a9

providerListItem.add(new ProviderListItem(p));

Looks like something similar was done to patch another XSS issue a few years back (#77), so you will already have access to encoding functions