From e47b4e773ae73dd4f4475b4b9c5332c1243f5e05 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Fri, 24 Apr 2020 11:34:29 -0700
Subject: [PATCH] Bug 11446: Use encodeURIComponent on search terms in
 authority lookup plugin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While adding the data from the existing field to the auth_finder URI,
we're using encodeURI(), which is meant for an entire URI and thus
doesn't escape &. Things that are going into a querystring need
encodeURIComponent() instead.

Test plan:

1. Enable the system preference EnableAdvancedCatalogingEditor
2. Clear your browser cache, even a shift+reload won't get you a fresh
marc-editor.js for the advanced editor
3. Create a Topical Term authority with 150 $aThis & That$xStuff & Junk
4. In the Basic editor, use the authority plugin on the 650 field to
select that authority.
5. Click the authority plugin again, verify that the popup contains This
& That and Stuff & Junk rather than just This and Stuff
6. From the Cataloging home page choose Advanced editor
7. In a new line paste 650 _ _ ‡aThis & That‡xStuff & Junk
8. Type ctrl+shift+L and verify the popup shows both words in both
fields
9. When you remember the plugin exists there too, edit your
Stuff & Junk authority, and in a 550 tag type One & Two in
$a and Three & Four in $x and click the plugin link, verify that
the search window has your search terms not cut off.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
 koha-tmpl/intranet-tmpl/lib/koha/cateditor/marc-editor.js | 2 +-
 koha-tmpl/intranet-tmpl/prog/js/cataloging.js             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/marc-editor.js b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/marc-editor.js
index 5e39a43b75..fb0bac5d98 100644
--- a/koha-tmpl/intranet-tmpl/lib/koha/cateditor/marc-editor.js
+++ b/koha-tmpl/intranet-tmpl/lib/koha/cateditor/marc-editor.js
@@ -188,7 +188,7 @@ define( [ 'marc-record', 'koha-backend', 'preferences', 'text-marc', 'widget' ],
                 if( subfields[i].code == '9' ) continue;
                 mainstring += subfields[i].text+' ';
             }
-            newin=window.open("../authorities/auth_finder.pl?source=biblio&authtypecode="+authtype+"&index="+index+"&value_mainstr="+encodeURI(mainmainstring)+"&value_main="+encodeURI(mainstring), "_blank",'width=700,height=550,toolbar=false,scrollbars=yes');
+            newin=window.open("../authorities/auth_finder.pl?source=biblio&authtypecode="+authtype+"&index="+index+"&value_mainstr="+encodeURIComponent(mainmainstring)+"&value_main="+encodeURIComponent(mainstring), "_blank",'width=700,height=550,toolbar=false,scrollbars=yes');
 
         }
 
diff --git a/koha-tmpl/intranet-tmpl/prog/js/cataloging.js b/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
index a172f5f1c0..c74d953979 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/cataloging.js
@@ -54,7 +54,7 @@ function openAuth(tagsubfieldid,authtype,source) {
         }
     }
     mainstring = mainstring.join(' ');
-    window.open("../authorities/auth_finder.pl?source="+source+"&authtypecode="+authtype+"&index="+tagsubfieldid+"&value_mainstr="+encodeURI(mainmainstring)+"&value_main="+encodeURI(mainstring), "_blank",'width=700,height=550,toolbar=false,scrollbars=yes');
+    window.open("../authorities/auth_finder.pl?source="+source+"&authtypecode="+authtype+"&index="+tagsubfieldid+"&value_mainstr="+encodeURIComponent(mainmainstring)+"&value_main="+encodeURIComponent(mainstring), "_blank",'width=700,height=550,toolbar=false,scrollbars=yes');
 }
 
 function ExpandField(index) {
-- 
2.11.0