From 86a4c60ed93ed41815fc6d1f0d0709d85a7a4189 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 20 Aug 2020 10:51:20 +0200
Subject: [PATCH] Bug 22343: having fun with uri components
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test with name=<script>alert("❤");</script>
---
 .../intranet-tmpl/prog/en/modules/admin/smtp_servers.tt     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
index 1012c31831..ee1faab2e2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt
@@ -373,7 +373,7 @@
                     {
                         "data": function( row, type, val, meta ) {
                             var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/smtp_servers.pl?op=edit_form&amp;smtp_server_id='+ encodeURIComponent(row.smtp_server_id) +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
-                            result += '<a class="btn btn-default btn-xs delete_server" role="button" href="#" data-toggle="modal" data-target="#delete_confirm_modal" data-smtp-server-id="'+ encodeURIComponent(row.smtp_server_id) +'" data-smtp-server-name="'+ encodeURIComponent(row.name) +'"><i class="fa fa-trash" aria-hidden="true"></i>'+_("Delete")+'</a>';
+                            result += '<a class="btn btn-default btn-xs delete_server" role="button" href="#" data-toggle="modal" data-target="#delete_confirm_modal" data-smtp-server-id="'+ encodeURIComponent(row.smtp_server_id) +'" data-smtp-server-name="'+ encodeURIComponent(row.name.escapeHtml()) +'"><i class="fa fa-trash" aria-hidden="true"></i>'+_("Delete")+'</a>';
                             return result;
                         },
                         "searchable": false,
@@ -387,9 +387,9 @@
                 var smtp_server_name = $(this).data('smtp-server-name');
 
                 $("#delete_confirm_dialog").html(
-                    _("You are about to delete the \"%s\" SMTP server.").format(smtp_server_name)
+                    _("You are about to delete the \"%s\" SMTP server.").format(decodeURIComponent(smtp_server_name))
                 );
-                $("#delete_confirm_modal_button").attr("href", "/cgi-bin/koha/admin/smtp_servers.pl?op=delete&amp;smtp_server_id=" + encodeURIComponent(smtp_server_id));
+                $("#delete_confirm_modal_button").attr("href", "/cgi-bin/koha/admin/smtp_servers.pl?op=delete&amp;smtp_server_id=" + decodeURIComponent(smtp_server_id));
             });
         });
     </script>
-- 
2.20.1