@@ -, +, @@ --- koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc | 4 ++-- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt | 2 +- .../intranet-tmpl/prog/en/modules/acqui/neworderempty.tt | 2 +- koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt | 4 ++-- .../intranet-tmpl/prog/en/modules/suggestion/suggestion.tt | 6 +++--- 5 files changed, 9 insertions(+), 9 deletions(-) --- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc @@ -882,9 +882,9 @@ parent_block.find(".info").hide(); parent_block.find(".error").hide(); if ( add_user(borrowernumber, borrowername) < 0 ) { - parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show(); + parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show(); } else { - parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show(); + parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show(); } } function modal_select_user(borrowernumber, data) { --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt @@ -1167,7 +1167,7 @@ if (ids.indexOf(borrowernumber.toString()) < 0) { ids.push(borrowernumber); $("#users_ids").val(ids.join(':')); - var li = '
  • '+borrowername + var li = '
  • '+borrowername.escapeHtml() + ' ' + _("Delete user") + '
  • '; $("#users_names").prepend(li); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt @@ -209,7 +209,7 @@ if (ids.indexOf(borrowernumber.toString()) < 0) { ids.push(borrowernumber); $("#users_ids").val(ids.join(':')); - var li = '
  • '+borrowername + var li = '
  • '+borrowername.escapeHtml() + ' [' + _("Delete user") + ']
  • '; $("#users_names").append(li); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt @@ -547,7 +547,7 @@ if (borrowernumber) { var ownerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; $('#budget_owner_name').html(ownerlink); $('#budget_owner_id').val(borrowernumber); } @@ -563,7 +563,7 @@ if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) { var li = '
  • ' + '' + borrowername + ' ' + + borrowernumber + '">' + borrowername.escapeHtml() + ' ' + ' • '+_("Remove")+' ' + '
  • '; $("#budget_users").prepend(li); --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt @@ -1262,7 +1262,7 @@ if (borrowernumber) { var managerlink = '' - + borrowername + ''; + + borrowername.escapeHtml() + ''; managedby_name.html(managerlink); managedby.val(borrowernumber); } @@ -1293,9 +1293,9 @@ success: function (data) { var suggested = ''; suggested += ''; - suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')'; + suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')'; suggested += ' '; - suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')'; + suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')'; $("#tdsuggestedby").html(suggested); }, --