@@ -, +, @@ --- .../intranet-tmpl/prog/en/modules/tools/quotes-upload.tt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt @@ -157,6 +157,8 @@ // then default to comma. strDelimiter = (strDelimiter || ","); + strData = escape_str(strData); + // Create a regular expression to parse the CSV values. var objPattern = new RegExp( ( @@ -280,6 +282,7 @@ "fnDrawCallback": function(oSettings) { /* Apply the jEditable handlers to the table on all fields w/o the no_edit id */ $('#quotes_editor tbody td[id!="no_edit"]').editable( function(value, settings) { + value = escape_str(value); var cellPosition = oTable.fnGetPosition( this ); oTable.fnUpdate(value, cellPosition[0], cellPosition[1], false, false); return(value); @@ -346,7 +349,9 @@ function fnGetData(element) { var lines = oTable.fnGetData(); $(lines).each(function(line){ - var data = {source: this[1], text: this[2]}; + var s = this[1].replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>'); + var t = this[2].replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>'); + var data = {source: s, text: t}; var success = 0; var error = 0; $.ajax({ url : "/api/v1/quotes", --