View | Details | Raw Unified | Return to bug 20212
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt (-7 / +6 lines)
Lines 560-566 Link Here
560
                      "orderable": true,
560
                      "orderable": true,
561
                      "render": function(data, type, row, meta) {
561
                      "render": function(data, type, row, meta) {
562
                        if (type != 'display') return data;
562
                        if (type != 'display') return data;
563
                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + row.basket.basket_id + "\">" + data + " (" + row.basket.basket_id + ")</a>";
563
                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + data.escapeHtml() + " (" + row.basket.basket_id.escapeHtml() + ")</a>";
564
                      }
564
                      }
565
                    },
565
                    },
566
                    { "data": "basket.basket_group.name",
566
                    { "data": "basket.basket_group.name",
Lines 579-587 Link Here
579
                        }
579
                        }
580
                        else {
580
                        else {
581
                            return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
581
                            return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
582
                                    + row.basket.vendor_id + "&amp;basketgroupid="
582
                                    + encodeURIComponent(row.basket.vendor_id) + "&amp;basketgroupid="
583
                                    + row.basket.basket_group_id + "\">"
583
                                    + encodeURIComponent(row.basket.basket_group_id) + "\">"
584
                                    + row.basket.basket_group.name + " (" + row.basket.basket_group_id + ")</a>";
584
                                    + row.basket.basket_group.name.escapeHtml() + " (" + row.basket.basket_group_id.escapeHtml() + ")</a>";
585
                        }
585
                        }
586
                      }
586
                      }
587
                    },
587
                    },
Lines 589-595 Link Here
589
                        "data": "order_id",
589
                        "data": "order_id",
590
                        "render": function(data, type, row, meta) {
590
                        "render": function(data, type, row, meta) {
591
                            if (type != 'display') return data;
591
                            if (type != 'display') return data;
592
                            return "<a href=\"neworderempty.pl?ordernumber="+data+"&amp;booksellerid="+row.basket.vendor_id+"\">"+data+"</a>";
592
                            return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+data.escapeHtml()+"</a>";
593
                        }
593
                        }
594
                    },
594
                    },
595
                    {
595
                    {
Lines 646-652 Link Here
646
                                                            + encodeURIComponent(suggestion.suggestionid)
646
                                                            + encodeURIComponent(suggestion.suggestionid)
647
                                                            + '&amp;op=show">'
647
                                                            + '&amp;op=show">'
648
                                                            + suggested_by.join(", ")
648
                                                            + suggested_by.join(", ")
649
                                                            + " (#" + suggestions[0].suggestionid + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
649
                                                            + " (#" + suggestions[0].suggestionid.escapeHtml() + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
650
                                    }
650
                                    }
651
                                }
651
                                }
652
                                result += '</p>';
652
                                result += '</p>';
653
- 

Return to bug 20212