From a0a94695338f22d94b33f682c1cf1caca7f722de Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 11 Mar 2021 13:55:00 +0000
Subject: [PATCH] Bug 26273: (QA follow-up) Use _escape_str/price for escaping

This patch moves the _escape_str and _escape_price functions into the
staff-global js include and then uses them in the register page
---
 .../intranet-tmpl/prog/en/modules/acqui/parcel.tt   |  7 -------
 .../intranet-tmpl/prog/en/modules/pos/register.tt   | 13 ++-----------
 koha-tmpl/intranet-tmpl/prog/js/staff-global.js     |  6 ++++++
 3 files changed, 8 insertions(+), 18 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
index 40fa162bdb..a435fd297c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
@@ -333,13 +333,6 @@
         dt_overwrite_html_sorting_localeCompare();
         var columns_filter = {};
 
-        function _escape_str(s){
-            return s != null ? s.escapeHtml() : "";
-        }
-        function _escape_price(p){
-            return p != null ? p.escapeHtml().format_price() : "";
-        }
-
         $(document).ready(function(){
 
             if ( $("#receivedt").length ) {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
index 3b06a6eb4b..97e11198cd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt
@@ -414,15 +414,6 @@
                "manager"
             ],
             "order": [[ 0, "asc" ]],
-            "columnDefs": [ {
-                "targets": [0,1,2],
-                "render": function (data, type, row, meta) {
-                    if ( type == 'display' ) {
-                        return data.escapeHtml();
-                    }
-                    return data;
-                }
-            } ],
             "columns": [
                 {
                     "data": "timestamp",
@@ -444,7 +435,7 @@
                         else {
                             fullname = row.manager.firstname + " " + row.manager.surname;
                         }
-                        return fullname;
+                        return _escape_str(fullname);
                     }
                 },
                 {
@@ -453,7 +444,7 @@
                     "orderable": true,
                     "render": function(data, type, row, meta) {
                         var amt = row.amount * -1;
-                        return (amt).format_price();
+                        return _escape_price(amt);
                     }
                 },
                 {
diff --git a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js
index 4f06af9465..060e77e0dc 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/staff-global.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/staff-global.js
@@ -26,6 +26,9 @@ String.prototype.escapeHtml = function() {
         return HtmlCharsToEscape[c] || c;
     });
 };
+function _escape_str(s){
+    return s != null ? s.escapeHtml() : "";
+}
 
 /*
  * Void method for numbers, for consistency
@@ -33,6 +36,9 @@ String.prototype.escapeHtml = function() {
 Number.prototype.escapeHtml = function() {
     return this;
 };
+function _escape_price(p){
+    return p != null ? p.escapeHtml().format_price() : "";
+}
 
 // http://stackoverflow.com/questions/14859281/select-tab-by-name-in-jquery-ui-1-10-0/16550804#16550804
 $.fn.tabIndex = function () {
-- 
2.20.1