Attachment 112984 Details for Bug 26572 – Bug 26572: (QA follow-up) Escape strings in autocomplete

[patch] Bug 26572: (QA follow-up) Escape strings in autocomplete

Bug-26572-QA-follow-up-Escape-strings-in-autocompl.patch (text/plain), 1.75 KB, created by Jonathan Druart on 2020-11-04 11:12:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-11-04 11:12:39 UTC

Size: 1.75 KB

patch

obsolete

>From 0ed50b6c1c0bceace6fbd8b3f60262a3bfb2edce Mon Sep 17 00:00:00 2001
>From: Owen Leonard <oleonard@myacpl.org>
>Date: Thu, 15 Oct 2020 13:33:29 +0000
>Subject: [PATCH] Bug 26572: (QA follow-up) Escape strings in autocomplete
>
>This patch updates the construction of the autocomplete dropdown so that
>values are escaped.
>---
> koha-tmpl/intranet-tmpl/prog/js/viewlog.js | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
>index ff835f5787..0b867b05bc 100644
>--- a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
>+++ b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
>@@ -159,9 +159,15 @@ $(document).ready(function(){
>                 // Display card number in parentheses if it exists
>                 cardnumber = " (" + item.cardnumber + ") ";
>             }
>+            var itemString = "<a href=\"#\">" + (item.surname ? item.surname.escapeHtml() : "") + ", " + (item.firstname ? item.firstname.escapeHtml() : "") + cardnumber.escapeHtml() + " <small>";
>+            itemString += (item.address ? item.address.escapeHtml() : "") + " "
>+                + (item.city ? item.city.escapeHtml() : "") + " "
>+                + (item.zipcode ? item.zipcode.escapeHtml() : "") + " "
>+                + (item.country ? item.country.escapeHtml() : "")
>+                + "</small></a>";
>             return $("<li></li>")
>                 .data("ui-autocomplete-item", item)
>-                .append("<a href=\"#\">" + item.surname + ", " + item.firstname + cardnumber + " <small>" + item.dateofbirth + " " + item.address + " " + item.city + " " + item.zipcode + " " + item.country + "</small></a>")
>+                .append(itemString)
>                 .appendTo(ul);
>         };
>     }
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 26572: 110938 | 110977 | 111637 | 111664 | 111736 | 112984