Bug 22369

Summary: Guarantor search broken by double quotes in address
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: gmcharlt, jonathan.druart, kyle.m.hall
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Fridolin Somers 2019-02-19 12:51:04 UTC
Guarantor search uses Ajax to build patrons search results table.
This uses a complex multi escape layers :
intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt : 
"<a href=\"#\" class=\"btn btn-default btn-xs select_user\" data-borrowernumber=\"[% data.borrowernumber | html %]\">Select</a><input type=\"hidden\" id=\"borrower_data[% data.borrowernumber | html %]\" name=\"borrower_data[% data.borrowernumber | html %]\" value=\"[% To.json(data) | html %]\" />"

This is broken if the found guarantor address contains a double quote.
I think because it is JSON converted to \" and then html converted to \&quot; which is a non valid JSON.
Comment 1 Jonathan Druart 2019-02-19 13:26:25 UTC
Marked as dup of bug 22316 (not exactly the same issue, but must be fixed together)

*** This bug has been marked as a duplicate of bug 22316 ***