Attachment #164334 for bug #33568

View | Details | Raw Unified | Return to bug 33568
Collapse All | Expand All




                            let image_location = item_type_image_locations[row.item_type_id];
                            let item_type_description = row._strings.item_type_id.str;
                            node += image_location
                                ? '<img src="%s" alt="%s" title="%s" /> '.format(escape_str(image_location), escape_str(item_type_description), escape_str(item_type_description))
                                : '';
                        [% END %]
                        node += '<span class="itypedesc itypetext">%s</span>'.format(escape_str(item_type_description));
                        return node;
                    }
                },

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row._strings.holding_library_id.str);
                    }
                },
                {

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        let nodes = '<span class="homebranchdesc">%s</span>'.format(escape_str(row._strings.home_library_id.str));
                        nodes += '<span class="shelvingloc">'
                        [%# If permanent location is defined, show description or code and             %]
                        [%# display current location in parentheses. If not, display current location. %]

                        let loc_str = row._strings.location.str;
                        if ( row.permanent_location && row.permanent_location != row.location ) {
                            let permanent_loc_str = av_loc[row.permanent_location];
                            nodes += '%s (%s)'.format(escape_str(permanent_loc_str), escape_str(loc_str));
                        } else {
                            nodes += escape_str(loc_str);
                        }
                        nodes += '</span>';
                        return nodes;

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row._strings.collection_code.str);
                    }
                },
                [% IF Koha.Preference('EnableItemGroups') %]

                    orderable: true,
                    render: function (data, type, row, meta) {
                        if ( row.item_group_item ) {
                            return escape_str(row.item_group_item.item_group.description);
                        } else {
                            return "";
                        }

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row.callnumber);
                    }

                },

                        [%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]
                        let serial = row.serialitem ? row.serialitem.serial : null;
                        if ( row.serial_issue_number && serial && serial.serialseq ) {
                            nodes += '<span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
                            if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {
                                nodes += ' <span class="sep"> -- </span>'
                                nodes += ' <span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
                            }
                        } else if ( row.serial_issue_number ) {
                            nodes += ' <span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
                        } else if ( serial && serial.serialseq ) {
                            nodes += '<span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
                        }
                        if ( serial && serial.publisheddate ) {
                            nodes += ' <span class="pubdate">(%s)</span>'.format($date(serial.publisheddate));

                            nodes += "</span>"
                        } else if ( row.transfer ) {
                            if ( row.transfer.datesent ) {
                                nodes += '<span class="intransit">%s</span>'.format(_("In transit from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
                            } else {
                                nodes += '<span class="transitrequested">%s</span>'.format(_("Transit pending from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.daterequested))); [%# FIXME See above %]
                            }
                        }

                        if ( row.lost_status ) {
                            let lost_lib = av_lost.get(row.lost_status.toString()) || _("Unavailable (lost or missing");
                            nodes += '<span class="lost">%s</span>'.format(escape_str(lost_lib));
                        }

                        if ( row.withdrawn ) {
                            let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) || _("Withdrawn");
                            nodes += '<span class="wdn">%s</span>'.format(escape_str(withdrawn_lib));
                        }

                        if ( row.damaged ) {
                            let damaged_lib = av_damaged.get(row.damaged.toString()) || _("Damaged");
                            nodes += '<span class="dmg">%s</span>'.format(escape_str(damaged_lib));
                        }

                        if ( row.not_for_loan_status || row.item_type.notforloan ) {
                            let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());
                            nodes += '<span class="notforloan">%s'.format(_("Not for loan")) + ( not_for_loan_lib ? '<span class="reason"> (%s)</span>'.format(escape_str(not_for_loan_lib)) : '' ) + '</span>';
                        }

                        if ( row.first_hold ) {

                        [% IF Koha.Preference('UseRecalls') %]
                            if ( row.recall ) {
                                if ( row.recall.waiting_date ) {
                                    nodes += '<span>%s</span>'.format(_("Waiting at %s since %s").format(escape_str(row.recall.pickup_library_id), $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
                                } else {
                                    let patron_to_html = $patron_to_html(row.recall.patron);
                                    nodes += '<span>%s</span>'.format(_("recalled by %s on %s").format(patron_to_html, $date(row.recall.created_date)))
                                }
                            }
                        [% END %]

                        }

                        if ( row.restricted_status ) {
                            nodes += '<span class="restricted">(%s)</span>'.format(escape_str(av_restricted.get(row.restricted_status.toString())));
                        }

                        if ( row.in_bundle ) {

                        let nodes = '';
                        if ( row.uri.split(' \| ').length > 1 ) {
                            row.uri.split(' \| ').forEach((uri, i) => {
                                nodes += '<a href="%s">%s</a><br/>'.format(escape_str(uri), escape_str(uri));
                            });
                        } else {
                            nodes += '<a href="%s">%s</a><br/>'.format(escape_str(row.uri), escape_str(url_link_text));
                        }
                        return nodes;
                    }

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row._strings.copy_number ? row._strings.copy_number.str : row.copy_number);
                    }
                },
                {

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row.inventory_number);
                    }
                },
                {

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row.materials_notes);
                    }
                },
                {

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return row.public_notes ? escape_str(row.public_notes).replaceAll('\n', '<br />') : '';
                    }
                },
                {

                    searchable: true,
                    orderable: true,
                    render: function (data, type, row, meta) {
                        return escape_str(row.internal_notes);
                    }
                },
                [% IF ( hostrecords ) %]

                            if ( c.enabled != 'yes' ) return;
                            nodes += '<p>';
                            nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);
                            nodes += escape_str(c.course_name);
                            if ( c.section ) {
                                nodes += ' ' + escape_str(c.section);
                            }
                            if ( c.term ) {
                                nodes += ' ' + av_courses_term.get(c.term.toString());

                    searchable: false,
                    orderable: false,
                    render: function (data, type, row, meta) {
                        return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"><i class="fa fa-print"></i> Print label</a>'.format(escape_str(row.external_id));
                    }
                },
                [% END %]

                        }
                        [% IF bundlesEnabled %]
                            // FIXME How do we handle that correctly?
                            //nodes += '<button class="btn btn-default btn-xs details-control"><i class="fa fa-folder"></i> Manage bundle (%s|%s)</button>'.format(escape_str(row.bundled), escape_str(row.bundled_lost));
                        [% END %]

                        return nodes;
- 

Return to bug 33568

Lines 2253-2262 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt (-34 / +33 lines)
2253	let image_location = item_type_image_locations[row.item_type_id];	2253	let image_location = item_type_image_locations[row.item_type_id];
2254	let item_type_description = row._strings.item_type_id.str;	2254	let item_type_description = row._strings.item_type_id.str;
2255	node += image_location	2255	node += image_location
2256	? '<img src="%s" alt="%s" title="%s" /> '.format(image_location, item_type_description, item_type_description)	2256	? '<img src="%s" alt="%s" title="%s" /> '.format(escape_str(image_location), escape_str(item_type_description), escape_str(item_type_description))
2257	: '';	2257	: '';
2258	[% END %]	2258	[% END %]
2259	node += '<span class="itypedesc itypetext">%s</span>'.format(item_type_description);	2259	node += '<span class="itypedesc itypetext">%s</span>'.format(escape_str(item_type_description));
2260	return node;	2260	return node;
2261	}	2261	}
2262	},	2262	},
Lines 2267-2273 Link Here
2267	searchable: true,	2267	searchable: true,
2268	orderable: true,	2268	orderable: true,
2269	render: function (data, type, row, meta) {	2269	render: function (data, type, row, meta) {
2270	return row._strings.holding_library_id.str;	2270	return escape_str(row._strings.holding_library_id.str);
2271	}	2271	}
2272	},	2272	},
2273	{	2273	{
Lines 2276-2282 Link Here
2276	searchable: true,	2276	searchable: true,
2277	orderable: true,	2277	orderable: true,
2278	render: function (data, type, row, meta) {	2278	render: function (data, type, row, meta) {
2279	let nodes = '<span class="homebranchdesc">%s</span>'.format(row._strings.home_library_id.str);	2279	let nodes = '<span class="homebranchdesc">%s</span>'.format(escape_str(row._strings.home_library_id.str));
2280	nodes += '<span class="shelvingloc">'	2280	nodes += '<span class="shelvingloc">'
2281	[%# If permanent location is defined, show description or code and %]	2281	[%# If permanent location is defined, show description or code and %]
2282	[%# display current location in parentheses. If not, display current location. %]	2282	[%# display current location in parentheses. If not, display current location. %]
Lines 2284-2292 Link Here
2284	let loc_str = row._strings.location.str;	2284	let loc_str = row._strings.location.str;
2285	if ( row.permanent_location && row.permanent_location != row.location ) {	2285	if ( row.permanent_location && row.permanent_location != row.location ) {
2286	let permanent_loc_str = av_loc[row.permanent_location];	2286	let permanent_loc_str = av_loc[row.permanent_location];
2287	nodes += '%s (%s)'.format(permanent_loc_str, loc_str);	2287	nodes += '%s (%s)'.format(escape_str(permanent_loc_str), escape_str(loc_str));
2288	} else {	2288	} else {
2289	nodes += loc_str;	2289	nodes += escape_str(loc_str);
2290	}	2290	}
2291	nodes += '</span>';	2291	nodes += '</span>';
2292	return nodes;	2292	return nodes;
Lines 2297-2303 Link Here
2297	searchable: true,	2297	searchable: true,
2298	orderable: true,	2298	orderable: true,
2299	render: function (data, type, row, meta) {	2299	render: function (data, type, row, meta) {
2300	return row._strings.collection_code.str;	2300	return escape_str(row._strings.collection_code.str);
2301	}	2301	}
2302	},	2302	},
2303	[% IF Koha.Preference('EnableItemGroups') %]	2303	[% IF Koha.Preference('EnableItemGroups') %]
Lines 2308-2314 Link Here
2308	orderable: true,	2308	orderable: true,
2309	render: function (data, type, row, meta) {	2309	render: function (data, type, row, meta) {
2310	if ( row.item_group_item ) {	2310	if ( row.item_group_item ) {
2311	return row.item_group_item.item_group.description;	2311	return escape_str(row.item_group_item.item_group.description);
2312	} else {	2312	} else {
2313	return "";	2313	return "";
2314	}	2314	}
Lines 2321-2327 Link Here
2321	searchable: true,	2321	searchable: true,
2322	orderable: true,	2322	orderable: true,
2323	render: function (data, type, row, meta) {	2323	render: function (data, type, row, meta) {
2324	return row.callnumber;	2324	return escape_str(row.callnumber);
2325	}	2325	}
2326		2326
2327	},	2327	},
Lines 2335-2349 Link Here
2335	[%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]	2335	[%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]
2336	let serial = row.serialitem ? row.serialitem.serial : null;	2336	let serial = row.serialitem ? row.serialitem.serial : null;
2337	if ( row.serial_issue_number && serial && serial.serialseq ) {	2337	if ( row.serial_issue_number && serial && serial.serialseq ) {
2338	nodes += '<span class="enum">%s</span>'.format(row.serial_issue_number);	2338	nodes += '<span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
2339	if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {	2339	if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {
2340	nodes += ' <span class="sep"> -- </span>'	2340	nodes += ' <span class="sep"> -- </span>'
2341	nodes += ' <span class="serialseq">%s</span>'.format(serial.serialseq);	2341	nodes += ' <span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
2342	}	2342	}
2343	} else if ( row.serial_issue_number ) {	2343	} else if ( row.serial_issue_number ) {
2344	nodes += ' <span class="enum">%s</span>'.format(row.serial_issue_number);	2344	nodes += ' <span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
2345	} else if ( serial && serial.serialseq ) {	2345	} else if ( serial && serial.serialseq ) {
2346	nodes += '<span class="serialseq">%s</span>'.format(serial.serialseq);	2346	nodes += '<span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
2347	}	2347	}
2348	if ( serial && serial.publisheddate ) {	2348	if ( serial && serial.publisheddate ) {
2349	nodes += ' <span class="pubdate">(%s)</span>'.format($date(serial.publisheddate));	2349	nodes += ' <span class="pubdate">(%s)</span>'.format($date(serial.publisheddate));
Lines 2373-2402 Link Here
2373	nodes += "</span>"	2373	nodes += "</span>"
2374	} else if ( row.transfer ) {	2374	} else if ( row.transfer ) {
2375	if ( row.transfer.datesent ) {	2375	if ( row.transfer.datesent ) {
2376	nodes += '<span class="intransit">%s</span>'.format(_("In transit from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]	2376	nodes += '<span class="intransit">%s</span>'.format(_("In transit from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
2377	} else {	2377	} else {
2378	nodes += '<span class="transitrequested">%s</span>'.format(_("Transit pending from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.daterequested))); [%# FIXME See above %]	2378	nodes += '<span class="transitrequested">%s</span>'.format(_("Transit pending from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.daterequested))); [%# FIXME See above %]
2379	}	2379	}
2380	}	2380	}
2381		2381
2382	if ( row.lost_status ) {	2382	if ( row.lost_status ) {
2383	let lost_lib = av_lost.get(row.lost_status.toString()) \|\| _("Unavailable (lost or missing");	2383	let lost_lib = av_lost.get(row.lost_status.toString()) \|\| _("Unavailable (lost or missing");
2384	nodes += '<span class="lost">%s</span>'.format(lost_lib);	2384	nodes += '<span class="lost">%s</span>'.format(escape_str(lost_lib));
2385	}	2385	}
2386		2386
2387	if ( row.withdrawn ) {	2387	if ( row.withdrawn ) {
2388	let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) \|\| _("Withdrawn");	2388	let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) \|\| _("Withdrawn");
2389	nodes += '<span class="wdn">%s</span>'.format(withdrawn_lib);	2389	nodes += '<span class="wdn">%s</span>'.format(escape_str(withdrawn_lib));
2390	}	2390	}
2391		2391
2392	if ( row.damaged ) {	2392	if ( row.damaged ) {
2393	let damaged_lib = av_damaged.get(row.damaged.toString()) \|\| _("Damaged");	2393	let damaged_lib = av_damaged.get(row.damaged.toString()) \|\| _("Damaged");
2394	nodes += '<span class="dmg">%s</span>'.format(damaged_lib);	2394	nodes += '<span class="dmg">%s</span>'.format(escape_str(damaged_lib));
2395	}	2395	}
2396		2396
2397	if ( row.not_for_loan_status \|\| row.item_type.notforloan ) {	2397	if ( row.not_for_loan_status \|\| row.item_type.notforloan ) {
2398	let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());	2398	let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());
2399	nodes += '<span class="notforloan">%s'.format(_("Not for loan")) + ( not_for_loan_lib ? '<span class="reason"> (%s)</span>'.format(not_for_loan_lib) : '' ) + '</span>';	2399	nodes += '<span class="notforloan">%s'.format(_("Not for loan")) + ( not_for_loan_lib ? '<span class="reason"> (%s)</span>'.format(escape_str(not_for_loan_lib)) : '' ) + '</span>';
2400	}	2400	}
2401		2401
2402	if ( row.first_hold ) {	2402	if ( row.first_hold ) {
Lines 2418-2427 Link Here
2418	[% IF Koha.Preference('UseRecalls') %]	2418	[% IF Koha.Preference('UseRecalls') %]
2419	if ( row.recall ) {	2419	if ( row.recall ) {
2420	if ( row.recall.waiting_date ) {	2420	if ( row.recall.waiting_date ) {
2421	nodes += '<span>%s</span>'.format(_("Waiting at %s since %s").format(row.recall.pickup_library_id, $date(row.recall.waiting_date))); # FIXME Display library names instead of codes	2421	nodes += '<span>%s</span>'.format(_("Waiting at %s since %s").format(escape_str(row.recall.pickup_library_id), $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
2422	} else {	2422	} else {
2423	let patron_to_html = $patron_to_html(row.recall.patron);	2423	let patron_to_html = $patron_to_html(row.recall.patron);
2424	nodes += '<span>%s</span>'.format(_("recalled by %s on %s").format(patron_to_html, row.recall.created_date))	2424	nodes += '<span>%s</span>'.format(_("recalled by %s on %s").format(patron_to_html, $date(row.recall.created_date)))
2425	}	2425	}
2426	}	2426	}
2427	[% END %]	2427	[% END %]
Lines 2431-2437 Link Here
2431	}	2431	}
2432		2432
2433	if ( row.restricted_status ) {	2433	if ( row.restricted_status ) {
2434	nodes += '<span class="restricted">(%s)</span>'.format(av_restricted.get(row.restricted_status.toString()));	2434	nodes += '<span class="restricted">(%s)</span>'.format(escape_str(av_restricted.get(row.restricted_status.toString())));
2435	}	2435	}
2436		2436
2437	if ( row.in_bundle ) {	2437	if ( row.in_bundle ) {
Lines 2505-2514 Link Here
2505	let nodes = '';	2505	let nodes = '';
2506	if ( row.uri.split(' \\| ').length > 1 ) {	2506	if ( row.uri.split(' \\| ').length > 1 ) {
2507	row.uri.split(' \\| ').forEach((uri, i) => {	2507	row.uri.split(' \\| ').forEach((uri, i) => {
2508	nodes += '<a href="%s">%s</a><br/>'.format(uri, uri);	2508	nodes += '<a href="%s">%s</a><br/>'.format(escape_str(uri), escape_str(uri));
2509	});	2509	});
2510	} else {	2510	} else {
2511	nodes += '<a href="%s">%s</a><br/>'.format(row.uri, url_link_text);	2511	nodes += '<a href="%s">%s</a><br/>'.format(escape_str(row.uri), escape_str(url_link_text));
2512	}	2512	}
2513	return nodes;	2513	return nodes;
2514	}	2514	}
Lines 2519-2525 Link Here
2519	searchable: true,	2519	searchable: true,
2520	orderable: true,	2520	orderable: true,
2521	render: function (data, type, row, meta) {	2521	render: function (data, type, row, meta) {
2522	return row._strings.copy_number ? row._strings.copy_number.str : row.copy_number;	2522	return escape_str(row._strings.copy_number ? row._strings.copy_number.str : row.copy_number);
2523	}	2523	}
2524	},	2524	},
2525	{	2525	{
Lines 2528-2534 Link Here
2528	searchable: true,	2528	searchable: true,
2529	orderable: true,	2529	orderable: true,
2530	render: function (data, type, row, meta) {	2530	render: function (data, type, row, meta) {
2531	return row.inventory_number;	2531	return escape_str(row.inventory_number);
2532	}	2532	}
2533	},	2533	},
2534	{	2534	{
Lines 2537-2543 Link Here
2537	searchable: true,	2537	searchable: true,
2538	orderable: true,	2538	orderable: true,
2539	render: function (data, type, row, meta) {	2539	render: function (data, type, row, meta) {
2540	return row.materials_notes;	2540	return escape_str(row.materials_notes);
2541	}	2541	}
2542	},	2542	},
2543	{	2543	{
Lines 2546-2552 Link Here
2546	searchable: true,	2546	searchable: true,
2547	orderable: true,	2547	orderable: true,
2548	render: function (data, type, row, meta) {	2548	render: function (data, type, row, meta) {
2549	return row.public_notes ? row.public_notes.replaceAll('\n', '<br />') : '';	2549	return row.public_notes ? escape_str(row.public_notes).replaceAll('\n', '<br />') : '';
2550	}	2550	}
2551	},	2551	},
2552	{	2552	{
Lines 2555-2561 Link Here
2555	searchable: true,	2555	searchable: true,
2556	orderable: true,	2556	orderable: true,
2557	render: function (data, type, row, meta) {	2557	render: function (data, type, row, meta) {
2558	return row.internal_notes;	2558	return escape_str(row.internal_notes);
2559	}	2559	}
2560	},	2560	},
2561	[% IF ( hostrecords ) %]	2561	[% IF ( hostrecords ) %]
Lines 2592-2600 Link Here
2592	if ( c.enabled != 'yes' ) return;	2592	if ( c.enabled != 'yes' ) return;
2593	nodes += '<p>';	2593	nodes += '<p>';
2594	nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);	2594	nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);
2595	nodes += c.course_name;	2595	nodes += escape_str(c.course_name);
2596	if ( c.section ) {	2596	if ( c.section ) {
2597	nodes += ' ' + c.section;	2597	nodes += ' ' + escape_str(c.section);
2598	}	2598	}
2599	if ( c.term ) {	2599	if ( c.term ) {
2600	nodes += ' ' + av_courses_term.get(c.term.toString());	2600	nodes += ' ' + av_courses_term.get(c.term.toString());
Lines 2611-2617 Link Here
2611	searchable: false,	2611	searchable: false,
2612	orderable: false,	2612	orderable: false,
2613	render: function (data, type, row, meta) {	2613	render: function (data, type, row, meta) {
2614	return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"><i class="fa fa-print"></i> Print label</a>'.format(row.external_id);	2614	return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"><i class="fa fa-print"></i> Print label</a>'.format(escape_str(row.external_id));
2615	}	2615	}
2616	},	2616	},
2617	[% END %]	2617	[% END %]
Lines 2633-2639 Link Here
2633	}	2633	}
2634	[% IF bundlesEnabled %]	2634	[% IF bundlesEnabled %]
2635	// FIXME How do we handle that correctly?	2635	// FIXME How do we handle that correctly?
2636	//nodes += '<button class="btn btn-default btn-xs details-control"><i class="fa fa-folder"></i> Manage bundle (%s\|%s)</button>'.format(row.bundled, row.bundled_lost);	2636	//nodes += '<button class="btn btn-default btn-xs details-control"><i class="fa fa-folder"></i> Manage bundle (%s\|%s)</button>'.format(escape_str(row.bundled), escape_str(row.bundled_lost));
2637	[% END %]	2637	[% END %]
2638		2638
2639	return nodes;	2639	return nodes;
2640	-