From 0ed50b6c1c0bceace6fbd8b3f60262a3bfb2edce Mon Sep 17 00:00:00 2001
From: Owen Leonard <oleonard@myacpl.org>
Date: Thu, 15 Oct 2020 13:33:29 +0000
Subject: [PATCH] Bug 26572: (QA follow-up) Escape strings in autocomplete

This patch updates the construction of the autocomplete dropdown so that
values are escaped.
---
 koha-tmpl/intranet-tmpl/prog/js/viewlog.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
index ff835f5787..0b867b05bc 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/viewlog.js
@@ -159,9 +159,15 @@ $(document).ready(function(){
                 // Display card number in parentheses if it exists
                 cardnumber = " (" + item.cardnumber + ") ";
             }
+            var itemString = "<a href=\"#\">" + (item.surname ? item.surname.escapeHtml() : "") + ", " + (item.firstname ? item.firstname.escapeHtml() : "") + cardnumber.escapeHtml() + " <small>";
+            itemString += (item.address ? item.address.escapeHtml() : "") + " "
+                + (item.city ? item.city.escapeHtml() : "") + " "
+                + (item.zipcode ? item.zipcode.escapeHtml() : "") + " "
+                + (item.country ? item.country.escapeHtml() : "")
+                + "</small></a>";
             return $("<li></li>")
                 .data("ui-autocomplete-item", item)
-                .append("<a href=\"#\">" + item.surname + ", " + item.firstname + cardnumber + " <small>" + item.dateofbirth + " " + item.address + " " + item.city + " " + item.zipcode + " " + item.country + "</small></a>")
+                .append(itemString)
                 .appendTo(ul);
         };
     }
-- 
2.20.1