Attachment 116965 Details for Bug 27719 – Bug 27719: Apply _escape_str and _escape_price where needed

[patch] Bug 27719: Apply _escape_str and _escape_price where needed

Bug-27719-Apply-escapestr-and-escapeprice-where-ne.patch (text/plain), 12.60 KB, created by Katrin Fischer on 2021-02-17 19:47:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2021-02-17 19:47:25 UTC

Size: 12.60 KB

patch

obsolete

>From 06a44a4688dfa0473c8ecde3ab32b6733db1eea4 Mon Sep 17 00:00:00 2001
>From: Agustin Moyano <agustinmoyano@theke.io>
>Date: Wed, 17 Feb 2021 12:49:32 -0300
>Subject: [PATCH] Bug 27719: Apply _escape_str and _escape_price where needed
>
>This bug replaces calls for .escapeHtml and format_price for there null
>checking counterparts
>
>To test:
>
>1: have a fresh Koha Testing Docker
>2: have a basket set to create item records on ordering
>3: populate basket from a marc file, only setting price and fund for the items
>4: close basket
>5: click to Receive, create invoice
>6: on parcel.pl, "Processing" alert never resolves
>CHECK => The console shows:
>parcel.pl?invoiceid=1:810 Uncaught TypeError: Cannot read property 'format_price' of null
> at render (parcel.pl?invoiceid=1:810)
> at datatables.min_20.1200012.js:57
> at Object.b.fnGetData (datatables.min_20.1200012.js:51)
> at B (datatables.min_20.1200012.js:56)
> at Ha (datatables.min_20.1200012.js:64)
> at P (datatables.min_20.1200012.js:68)
> at vb (datatables.min_20.1200012.js:79)
> at datatables.min_20.1200012.js:76
> at i (datatables.min_20.1200012.js:74)
> at Object.success (datatables.min_20.1200012.js:75)
>
>And that error points toward:
> "data": "replacement_price",
> "render": function(data, type, row, meta) {
> return (row.replacement_price).format_price();
> },
> },
>7: apply patch
>8: redo steps 5 and 6
>SUCCESS => "Processing" alert doesn't hangs, and prices with null values
>are empty.
>
>Sponsored-by: Virginia Polytechnic Institute and State University
>
>Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>---
> .../intranet-tmpl/prog/en/modules/acqui/parcel.tt | 44 +++++++++++-----------
> 1 file changed, 22 insertions(+), 22 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>index 855b044d50..c9253973f0 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
>@@ -402,7 +402,7 @@
> "orderable": true,
> "render": function(data, type, row, meta) {
> if (type != 'display') return _escape_str(data);
>- return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + data.escapeHtml() + " (" + row.basket.basket_id.escapeHtml() + ")</a>";
>+ return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + _escape_str(data) + " (" + _escape_str(row.basket.basket_id) + ")</a>";
> }
> },
> { "data": "basket.basket_group.name",
>@@ -418,7 +418,7 @@
> return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
> + encodeURIComponent(row.basket.vendor_id) + "&amp;basketgroupid="
> + encodeURIComponent(row.basket.basket_group_id) + "\">"
>- + row.basket.basket_group.name.escapeHtml() + " (" + row.basket.basket_group_id.escapeHtml() + ")</a>";
>+ + _escape_str(row.basket.basket_group.name) + " (" + _escape_str(row.basket.basket_group_id) + ")</a>";
> }
> }
> },
>@@ -426,7 +426,7 @@
> "data": "order_id",
> "render": function(data, type, row, meta) {
> if (type != 'display') return _escape_str(data);
>- return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+data.escapeHtml()+"</a>";
>+ return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+_escape_str(data)+"</a>";
> }
> },
> {
>@@ -436,22 +436,22 @@
> "render": function(data, type, row, meta) {
> var result = '';
> if ( row && row.biblio_id != null ) {
>- result = "<a href=\"/cgi-bin/koha/catalogue/detail.pl?biblionumber="+encodeURIComponent(row.biblio_id)+"\">"+row.biblio.title.escapeHtml()+"</a>";
>+ result = "<a href=\"/cgi-bin/koha/catalogue/detail.pl?biblionumber="+encodeURIComponent(row.biblio_id)+"\">"+_escape_str(row.biblio.title)+"</a>";
> if ( row.biblio.author != null )
>- result += _(" by ") + row.biblio.author.escapeHtml();
>+ result += _(" by ") + _escape_str(row.biblio.author);
> if ( row.biblio.isbn != null )
>- result += " &ndash; " + row.biblio.isbn.escapeHtml();
>+ result += " &ndash; " + _escape_str(row.biblio.isbn);
> [% IF Koha.Preference('marcflavour')=='UNIMARC' %]
> if ( row.biblio.ean != null )
>- result += " &ndash; EAN:" + row.biblio.ean.escapeHtml();
>+ result += " &ndash; EAN:" + _escape_str(row.biblio.ean);
> [% END %]
> if ( row.biblio.publisher != null ) {
>- result += " " + _("Publisher: ") + row.biblio.publisher.escapeHtml();
>+ result += " " + _("Publisher: ") + _escape_str(row.biblio.publisher);
> if ( row.biblio.publication_year != null ) {
>- result += ", " + row.biblio.publication_year.escapeHtml();
>+ result += ", " + _escape_str(row.biblio.publication_year);
> }
> else if ( row.biblio.copyright_date != null ) {
>- result += row.biblio.copyright_date.escapeHtml();
>+ result += _escape_str(row.biblio.copyright_date);
> }
> }
> var suggestions = row.biblio.suggestions;
>@@ -461,10 +461,10 @@
> var suggester = suggestion.suggester;
> var suggested_by = [];
> if ( suggester.surname != null ) {
>- suggested_by.push(suggester.surname.escapeHtml());
>+ suggested_by.push(_escape_str(suggester.surname));
> }
> if ( suggester.firstname != null ) {
>- suggested_by.push(suggester.firstname.escapeHtml());
>+ suggested_by.push(_escape_str(suggester.firstname));
> }
> 
> result += " " + _("Suggested by: ") +
>@@ -472,7 +472,7 @@
> + encodeURIComponent(suggestion.suggestionid)
> + '&amp;op=show">'
> + suggested_by.join(", ")
>- + " (#" + suggestions[0].suggestionid.escapeHtml() + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
>+ + " (#" + _escape_str(suggestions[0].suggestionid) + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
> }
> }
> result += '';
>@@ -482,7 +482,7 @@
> if ( internal_note != null && internal_note != '' ) {
> result += ''
> + _("Internal note: ")
>- + '' + internal_note.escapeHtml()
>+ + '' + _escape_str(internal_note)
> + ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
> + encodeURIComponent(row.order_id) + '&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]'
> + '&type=internal">' + _("Change internal note") + '</a>]';
>@@ -497,7 +497,7 @@
> if ( vendor_note != null && vendor_note != '' ) {
> result += ''
> + _("Vendor note: ")
>- + '' + vendor_note.escapeHtml() + '';
>+ + '' + _escape_str(vendor_note) + '';
> }
> else {
> result += ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
>@@ -523,7 +523,7 @@
> {
> "data": "replacement_price",
> "render": function(data, type, row, meta) {
>- return (row.replacement_price).format_price();
>+ return _escape_price(row.replacement_price);
> },
> },
> {
>@@ -533,13 +533,13 @@
> {
> "data": "ecost",
> "render": function(data, type, row, meta) {
>- return (row.ecost).format_price();
>+ return _escape_price(row.ecost);
> },
> },
> {
> "data": "",
> "render": function(data, type, row, meta) {
>- return (row.quantity * row.ecost).format_price();
>+ return _escape_price(row.quantity * row.ecost);
> },
> "orderable": false, // FIXME: How can we do it in DBIC?
> "searchable": false
>@@ -547,8 +547,8 @@
> {
> "data": "fund.name",
> "render": function(data, type, row, meta) {
>- if (type != 'display') return data.escapeHtml();
>- return row.fund.name.escapeHtml();
>+ if (type != 'display') return _escape_str(data);
>+ return _escape_str(row.fund.name);
> }
> },
> {
>@@ -557,7 +557,7 @@
> return '<a href="orderreceive.pl?ordernumber='
> + encodeURIComponent(row.order_id) + '&amp;invoiceid=[% invoiceid | uri %]' + '">'
> + _("Receive") + '</a> '
>- + '<a href="#" onclick="transfer_order_popup(' + row.order_id.escapeHtml() + '); return false;">'
>+ + '<a href="#" onclick="transfer_order_popup(' + _escape_str(row.order_id) + '); return false;">'
> + _("Transfer") + '</a>';
> },
> "orderable": false,
>@@ -570,7 +570,7 @@
> 
> if ( row.current_holds_count > 0 ) {
> result += '- + _("Can't cancel order, (%s) holds are linked with this order. Cancel holds first").format( row.holds_count.escapeHtml() ) + '">'
>+ + _("Can't cancel order, (%s) holds are linked with this order. Cancel holds first").format( _escape_str(row.holds_count) ) + '">'
> + _("Can't cancel order") + ' ';
> }
> else {
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 27719: 116946 | 116947 | 116965