From d0a4c46e09d14362238cdaa3261bd85751b6797a Mon Sep 17 00:00:00 2001 From: Andrew Isherwood Date: Mon, 7 Jan 2019 09:33:48 +0000 Subject: [PATCH] Bug 21460: (follow-up) Filter params in .pl This patch filters the passed parameters in the .pl, rather than doing it in the template. As per comment 16 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21460#c16) --- ill/ill-requests.pl | 16 ++++++++++++---- .../intranet-tmpl/prog/en/modules/ill/ill-requests.tt | 2 +- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/ill/ill-requests.pl b/ill/ill-requests.pl index dc9b54db13..36e718e4f9 100755 --- a/ill/ill-requests.pl +++ b/ill/ill-requests.pl @@ -30,6 +30,7 @@ use Koha::Libraries; use Koha::Token; use Try::Tiny; +use URI::Escape; our $cgi = CGI->new; my $illRequests = Koha::Illrequests->new; @@ -233,15 +234,22 @@ if ( $backends_available ) { # If we receive a pre-filter, make it available to the template my $possible_filters = ['borrowernumber']; - my $active_filters = []; + my $active_filters = {}; foreach my $filter(@{$possible_filters}) { if ($params->{$filter}) { - push @{$active_filters}, "$filter=$params->{$filter}"; + # We shouldn't need to escape $filter here since we're using + # a whitelist, but just to be sure... + $active_filters->{uri_escape_utf8($filter)} = + uri_escape_utf8(scalar $params->{$filter}) } } - if (scalar @{$active_filters} > 0) { + if (keys %{$active_filters}) { + my @tpl_arr; + foreach my $key (keys %{$active_filters}) { + push @tpl_arr, $key . "=" . $active_filters->{$key}; + } $template->param( - prefilters => join(",", @{$active_filters}) + prefilters => join("&", @tpl_arr) ); } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt index 92d1fd4813..f3f88e0413 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt @@ -37,7 +37,7 @@ 'patron' ]; - var prefilters = '[% prefilters | html %]'; + var prefilters = '[% prefilters %]'; // Expanded fields // This is auto populated -- 2.11.0