View | Details | Raw Unified | Return to bug 27719
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt (-23 / +22 lines)
Lines 402-408 Link Here
402
                      "orderable": true,
402
                      "orderable": true,
403
                      "render": function(data, type, row, meta) {
403
                      "render": function(data, type, row, meta) {
404
                        if (type != 'display') return _escape_str(data);
404
                        if (type != 'display') return _escape_str(data);
405
                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + data.escapeHtml() + " (" + row.basket.basket_id.escapeHtml() + ")</a>";
405
                        return "<a href=\"/cgi-bin/koha/acqui/basket.pl?basketno=" + encodeURIComponent(row.basket.basket_id) + "\">" + _escape_str(data) + " (" + _escape_str(row.basket.basket_id) + ")</a>";
406
                      }
406
                      }
407
                    },
407
                    },
408
                    { "data": "basket.basket_group.name",
408
                    { "data": "basket.basket_group.name",
Lines 418-424 Link Here
418
                            return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
418
                            return "<a href=\"/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid="
419
                                    + encodeURIComponent(row.basket.vendor_id) + "&amp;basketgroupid="
419
                                    + encodeURIComponent(row.basket.vendor_id) + "&amp;basketgroupid="
420
                                    + encodeURIComponent(row.basket.basket_group_id) + "\">"
420
                                    + encodeURIComponent(row.basket.basket_group_id) + "\">"
421
                                    + row.basket.basket_group.name.escapeHtml() + " (" + row.basket.basket_group_id.escapeHtml() + ")</a>";
421
                                    + _escape_str(row.basket.basket_group.name) + " (" + _escape_str(row.basket.basket_group_id) + ")</a>";
422
                        }
422
                        }
423
                      }
423
                      }
424
                    },
424
                    },
Lines 426-432 Link Here
426
                        "data": "order_id",
426
                        "data": "order_id",
427
                        "render": function(data, type, row, meta) {
427
                        "render": function(data, type, row, meta) {
428
                            if (type != 'display') return _escape_str(data);
428
                            if (type != 'display') return _escape_str(data);
429
                            return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+data.escapeHtml()+"</a>";
429
                            return "<a href=\"neworderempty.pl?ordernumber="+encodeURIComponent(data)+"&amp;booksellerid="+encodeURIComponent(row.basket.vendor_id)+"\">"+_escape_str(data)+"</a>";
430
                        }
430
                        }
431
                    },
431
                    },
432
                    {
432
                    {
Lines 436-457 Link Here
436
                        "render": function(data, type, row, meta) {
436
                        "render": function(data, type, row, meta) {
437
                            var result = '';
437
                            var result = '';
438
                            if ( row && row.biblio_id != null ) {
438
                            if ( row && row.biblio_id != null ) {
439
                                result = "<p><a href=\"/cgi-bin/koha/catalogue/detail.pl?biblionumber="+encodeURIComponent(row.biblio_id)+"\">"+row.biblio.title.escapeHtml()+"</a>";
439
                                result = "<p><a href=\"/cgi-bin/koha/catalogue/detail.pl?biblionumber="+encodeURIComponent(row.biblio_id)+"\">"+_escape_str(row.biblio.title)+"</a>";
440
                                if ( row.biblio.author != null )
440
                                if ( row.biblio.author != null )
441
                                    result += _(" by ") + row.biblio.author.escapeHtml();
441
                                    result += _(" by ") + _escape_str(row.biblio.author);
442
                                if ( row.biblio.isbn != null )
442
                                if ( row.biblio.isbn != null )
443
                                    result += " &ndash; " + row.biblio.isbn.escapeHtml();
443
                                    result += " &ndash; " + _escape_str(row.biblio.isbn);
444
                                [% IF Koha.Preference('marcflavour')=='UNIMARC' %]
444
                                [% IF Koha.Preference('marcflavour')=='UNIMARC' %]
445
                                    if ( row.biblio.ean != null )
445
                                    if ( row.biblio.ean != null )
446
                                        result += " &ndash; EAN:" + row.biblio.ean.escapeHtml();
446
                                        result += " &ndash; EAN:" + _escape_str(row.biblio.ean);
447
                                [% END %]
447
                                [% END %]
448
                                if ( row.biblio.publisher != null ) {
448
                                if ( row.biblio.publisher != null ) {
449
                                    result += "<br/>" + _("Publisher: ") + row.biblio.publisher.escapeHtml();
449
                                    result += "<br/>" + _("Publisher: ") + _escape_str(row.biblio.publisher);
450
                                    if ( row.biblio.publication_year != null ) {
450
                                    if ( row.biblio.publication_year != null ) {
451
                                        result += ", " + row.biblio.publication_year.escapeHtml();
451
                                        result += ", " + _escape_str(row.biblio.publication_year);
452
                                    }
452
                                    }
453
                                    else if ( row.biblio.copyright_date != null ) {
453
                                    else if ( row.biblio.copyright_date != null ) {
454
                                        result += row.biblio.copyright_date.escapeHtml();
454
                                        result += _escape_str(row.biblio.copyright_date);
455
                                    }
455
                                    }
456
                                }
456
                                }
457
                                var suggestions = row.biblio.suggestions;
457
                                var suggestions = row.biblio.suggestions;
Lines 461-470 Link Here
461
                                        var suggester = suggestion.suggester;
461
                                        var suggester = suggestion.suggester;
462
                                        var suggested_by = [];
462
                                        var suggested_by = [];
463
                                        if ( suggester.surname != null ) {
463
                                        if ( suggester.surname != null ) {
464
                                            suggested_by.push(suggester.surname.escapeHtml());
464
                                            suggested_by.push(_escape_str(suggester.surname));
465
                                        }
465
                                        }
466
                                        if ( suggester.firstname != null ) {
466
                                        if ( suggester.firstname != null ) {
467
                                            suggested_by.push(suggester.firstname.escapeHtml());
467
                                            suggested_by.push(_escape_str(suggester.firstname));
468
                                        }
468
                                        }
469
469
470
                                            result += "<br/>" + _("Suggested by: ") +
470
                                            result += "<br/>" + _("Suggested by: ") +
Lines 472-478 Link Here
472
                                                            + encodeURIComponent(suggestion.suggestionid)
472
                                                            + encodeURIComponent(suggestion.suggestionid)
473
                                                            + '&amp;op=show">'
473
                                                            + '&amp;op=show">'
474
                                                            + suggested_by.join(", ")
474
                                                            + suggested_by.join(", ")
475
                                                            + " (#" + suggestions[0].suggestionid.escapeHtml() + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
475
                                                            + " (#" + _escape_str(suggestions[0].suggestionid) + ")</a>"; // FIXME: could be changed if we allow matching multiple suggestions
476
                                    }
476
                                    }
477
                                }
477
                                }
478
                                result += '</p>';
478
                                result += '</p>';
Lines 482-488 Link Here
482
                            if ( internal_note != null && internal_note != '' ) {
482
                            if ( internal_note != null && internal_note != '' ) {
483
                                result += '<p class="ordernote"><strong>'
483
                                result += '<p class="ordernote"><strong>'
484
                                            + _("Internal note: ")
484
                                            + _("Internal note: ")
485
                                            + '</strong>' + internal_note.escapeHtml()
485
                                            + '</strong>' + _escape_str(internal_note)
486
                                            + ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
486
                                            + ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
487
                                            + encodeURIComponent(row.order_id) + '&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]'
487
                                            + encodeURIComponent(row.order_id) + '&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | uri %]'
488
                                            + '&type=internal">' + _("Change internal note") + '</a>]</p>';
488
                                            + '&type=internal">' + _("Change internal note") + '</a>]</p>';
Lines 497-503 Link Here
497
                            if ( vendor_note != null && vendor_note != '' ) {
497
                            if ( vendor_note != null && vendor_note != '' ) {
498
                                result += '<p class="ordernote"><strong>'
498
                                result += '<p class="ordernote"><strong>'
499
                                            + _("Vendor note: ")
499
                                            + _("Vendor note: ")
500
                                            + '</strong>' + vendor_note.escapeHtml() + '</p>';
500
                                            + '</strong>' + _escape_str(vendor_note) + '</p>';
501
                            }
501
                            }
502
                            else {
502
                            else {
503
                                result += ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
503
                                result += ' [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber='
Lines 523-529 Link Here
523
                    {
523
                    {
524
                        "data": "replacement_price",
524
                        "data": "replacement_price",
525
                        "render": function(data, type, row, meta) {
525
                        "render": function(data, type, row, meta) {
526
                            return (row.replacement_price).format_price();
526
                            return _escape_price(row.replacement_price);
527
                        },
527
                        },
528
                    },
528
                    },
529
                    {
529
                    {
Lines 533-545 Link Here
533
                    {
533
                    {
534
                        "data": "ecost",
534
                        "data": "ecost",
535
                        "render": function(data, type, row, meta) {
535
                        "render": function(data, type, row, meta) {
536
                            return (row.ecost).format_price();
536
                            return _escape_price(row.ecost);
537
                        },
537
                        },
538
                    },
538
                    },
539
                    {
539
                    {
540
                        "data": "",
540
                        "data": "",
541
                        "render": function(data, type, row, meta) {
541
                        "render": function(data, type, row, meta) {
542
                            return (row.quantity * row.ecost).format_price();
542
                            return _escape_price(row.quantity * row.ecost);
543
                        },
543
                        },
544
                        "orderable": false, // FIXME: How can we do it in DBIC?
544
                        "orderable": false, // FIXME: How can we do it in DBIC?
545
                        "searchable": false
545
                        "searchable": false
Lines 547-554 Link Here
547
                    {
547
                    {
548
                        "data": "fund.name",
548
                        "data": "fund.name",
549
                        "render": function(data, type, row, meta) {
549
                        "render": function(data, type, row, meta) {
550
                            if (type != 'display') return data.escapeHtml();
550
                            if (type != 'display') return _escape_str(data);
551
                            return row.fund.name.escapeHtml();
551
                            return _escape_str(row.fund.name);
552
                        }
552
                        }
553
                    },
553
                    },
554
                    {
554
                    {
Lines 557-563 Link Here
557
                            return '<a href="orderreceive.pl?ordernumber='
557
                            return '<a href="orderreceive.pl?ordernumber='
558
                                    + encodeURIComponent(row.order_id) + '&amp;invoiceid=[% invoiceid | uri %]' + '">'
558
                                    + encodeURIComponent(row.order_id) + '&amp;invoiceid=[% invoiceid | uri %]' + '">'
559
                                    + _("Receive") + '</a><br/>'
559
                                    + _("Receive") + '</a><br/>'
560
                                    + '<a href="#" onclick="transfer_order_popup(' + row.order_id.escapeHtml() + '); return false;">'
560
                                    + '<a href="#" onclick="transfer_order_popup(' + _escape_str(row.order_id) + '); return false;">'
561
                                    + _("Transfer") + '</a>';
561
                                    + _("Transfer") + '</a>';
562
                        },
562
                        },
563
                        "orderable": false,
563
                        "orderable": false,
Lines 570-576 Link Here
570
570
571
                            if ( row.current_holds_count > 0 ) {
571
                            if ( row.current_holds_count > 0 ) {
572
                                result += '<span class="button" title="'
572
                                result += '<span class="button" title="'
573
                                        + _("Can't cancel order, (%s) holds are linked with this order. Cancel holds first").format( row.holds_count.escapeHtml() ) + '">'
573
                                        + _("Can't cancel order, (%s) holds are linked with this order. Cancel holds first").format( _escape_str(row.holds_count) ) + '">'
574
                                        + _("Can't cancel order") + '</span><br/>';
574
                                        + _("Can't cancel order") + '</span><br/>';
575
                            }
575
                            }
576
                            else {
576
                            else {
577
- 

Return to bug 27719