@@ -, +, @@ --- koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc | 1 + .../intranet-tmpl/prog/en/modules/acqui/neworderempty.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt | 4 ++-- .../intranet-tmpl/prog/en/modules/suggestion/suggestion.tt | 6 +++--- 4 files changed, 7 insertions(+), 6 deletions(-) --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc @@ -874,6 +874,7 @@ let parent_block = $("#[% search_results_block_id | html %]"); parent_block.find(".info").hide(); parent_block.find(".error").hide(); + borrowername = borrowername.escapeHtml(); if ( add_user(borrowernumber, borrowername) < 0 ) { parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show(); } else { --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt @@ -209,7 +209,7 @@ if (ids.indexOf(borrowernumber.toString()) < 0) { ids.push(borrowernumber); $("#users_ids").val(ids.join(':')); - var li = '
  • '+borrowername + var li = '
  • '+borrowername.escapeHtml() + ' [' + _("Delete user") + ']
  • '; $("#users_names").append(li); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt @@ -547,7 +547,7 @@ if (borrowernumber) { var ownerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; $('#budget_owner_name').html(ownerlink); $('#budget_owner_id').val(borrowernumber); } @@ -563,7 +563,7 @@ if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) { var li = '
  • ' + '' + borrowername + ' ' + + borrowernumber + '">' + borrowername.escapeHtml() + ' ' + ' • '+_("Remove")+' ' + '
  • '; $("#budget_users").prepend(li); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt @@ -1262,7 +1262,7 @@ if (borrowernumber) { var managerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; managedby_name.html(managerlink); managedby.val(borrowernumber); } @@ -1293,9 +1293,9 @@ success: function (data) { var suggested = ''; suggested += ''; - suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')'; + suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')'; suggested += ' '; - suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')'; + suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')'; $("#tdsuggestedby").html(suggested); }, --