View | Details | Raw Unified | Return to bug 35329
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (+1 lines)
Lines 874-879 Link Here
874
            let parent_block = $("#[% search_results_block_id | html %]");
874
            let parent_block = $("#[% search_results_block_id | html %]");
875
            parent_block.find(".info").hide();
875
            parent_block.find(".info").hide();
876
            parent_block.find(".error").hide();
876
            parent_block.find(".error").hide();
877
            borrowername = borrowername.escapeHtml();
877
            if ( add_user(borrowernumber, borrowername) < 0 ) {
878
            if ( add_user(borrowernumber, borrowername) < 0 ) {
878
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show();
879
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show();
879
            } else {
880
            } else {
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt (-1 / +1 lines)
Lines 209-215 Link Here
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
210
                ids.push(borrowernumber);
210
                ids.push(borrowernumber);
211
                $("#users_ids").val(ids.join(':'));
211
                $("#users_ids").val(ids.join(':'));
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
214
                    + _("Delete user") + '</a>]</li>';
214
                    + _("Delete user") + '</a>]</li>';
215
                $("#users_names").append(li);
215
                $("#users_names").append(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt (-2 / +2 lines)
Lines 547-553 Link Here
547
                if (borrowernumber) {
547
                if (borrowernumber) {
548
                    var ownerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
548
                    var ownerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
549
                        + '?borrowernumber=' + borrowernumber + '">'
549
                        + '?borrowernumber=' + borrowernumber + '">'
550
                        + borrowername + '</a>';
550
                        + borrowername.escapeHtml() + '</a>';
551
                    $('#budget_owner_name').html(ownerlink);
551
                    $('#budget_owner_name').html(ownerlink);
552
                    $('#budget_owner_id').val(borrowernumber);
552
                    $('#budget_owner_id').val(borrowernumber);
553
                }
553
                }
Lines 563-569 Link Here
563
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
563
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
564
                    var li = '<li id="user_' + borrowernumber + '">'
564
                    var li = '<li id="user_' + borrowernumber + '">'
565
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
565
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
566
                        + borrowernumber + '">' + borrowername + '</a> '
566
                        + borrowernumber + '">' + borrowername.escapeHtml() + '</a> '
567
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
567
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
568
                        + '</li>';
568
                        + '</li>';
569
                    $("#budget_users").prepend(li);
569
                    $("#budget_users").prepend(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-4 / +3 lines)
Lines 1262-1268 Link Here
1262
            if (borrowernumber) {
1262
            if (borrowernumber) {
1263
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1263
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1264
                    + '?borrowernumber=' + borrowernumber + '">'
1264
                    + '?borrowernumber=' + borrowernumber + '">'
1265
                    + borrowername + '</a>';
1265
                    + borrowername.escapeHtml() + '</a>';
1266
                managedby_name.html(managerlink);
1266
                managedby_name.html(managerlink);
1267
                managedby.val(borrowernumber);
1267
                managedby.val(borrowernumber);
1268
            }
1268
            }
Lines 1293-1301 Link Here
1293
                success: function (data) {
1293
                success: function (data) {
1294
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1294
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1295
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1295
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1296
                    suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')';
1296
                    suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')';
1297
                    suggested += '</a> ';
1297
                    suggested += '</a> ';
1298
                    suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')';
1298
                    suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')';
1299
                    $("#tdsuggestedby").html(suggested);
1299
                    $("#tdsuggestedby").html(suggested);
1300
1300
1301
                },
1301
                },
1302
- 

Return to bug 35329