View | Details | Raw Unified | Return to bug 35329
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (-2 / +2 lines)
Lines 882-890 Link Here
882
            parent_block.find(".info").hide();
882
            parent_block.find(".info").hide();
883
            parent_block.find(".error").hide();
883
            parent_block.find(".error").hide();
884
            if ( add_user(borrowernumber, borrowername) < 0 ) {
884
            if ( add_user(borrowernumber, borrowername) < 0 ) {
885
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show();
885
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show();
886
            } else {
886
            } else {
887
                parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show();
887
                parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show();
888
            }
888
            }
889
        }
889
        }
890
        function modal_select_user(borrowernumber, data) {
890
        function modal_select_user(borrowernumber, data) {
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-1 / +1 lines)
Lines 1167-1173 Link Here
1167
            if (ids.indexOf(borrowernumber.toString()) < 0) {
1167
            if (ids.indexOf(borrowernumber.toString()) < 0) {
1168
                ids.push(borrowernumber);
1168
                ids.push(borrowernumber);
1169
                $("#users_ids").val(ids.join(':'));
1169
                $("#users_ids").val(ids.join(':'));
1170
                var li = '<li id="user_'+borrowernumber+'">'+borrowername
1170
                var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
1171
                + ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> '
1171
                + ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> '
1172
                    + _("Delete user") + '</a></li>';
1172
                    + _("Delete user") + '</a></li>';
1173
                $("#users_names").prepend(li);
1173
                $("#users_names").prepend(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt (-1 / +1 lines)
Lines 209-215 Link Here
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
210
                ids.push(borrowernumber);
210
                ids.push(borrowernumber);
211
                $("#users_ids").val(ids.join(':'));
211
                $("#users_ids").val(ids.join(':'));
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
214
                    + _("Delete user") + '</a>]</li>';
214
                    + _("Delete user") + '</a>]</li>';
215
                $("#users_names").append(li);
215
                $("#users_names").append(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt (-2 / +2 lines)
Lines 547-553 Link Here
547
                if (borrowernumber) {
547
                if (borrowernumber) {
548
                    var ownerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
548
                    var ownerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
549
                        + '?borrowernumber=' + borrowernumber + '">'
549
                        + '?borrowernumber=' + borrowernumber + '">'
550
                        + borrowername + '</a>';
550
                        + borrowername.escapeHtml() + '</a>';
551
                    $('#budget_owner_name').html(ownerlink);
551
                    $('#budget_owner_name').html(ownerlink);
552
                    $('#budget_owner_id').val(borrowernumber);
552
                    $('#budget_owner_id').val(borrowernumber);
553
                }
553
                }
Lines 563-569 Link Here
563
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
563
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
564
                    var li = '<li id="user_' + borrowernumber + '">'
564
                    var li = '<li id="user_' + borrowernumber + '">'
565
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
565
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
566
                        + borrowernumber + '">' + borrowername + '</a> '
566
                        + borrowernumber + '">' + borrowername.escapeHtml() + '</a> '
567
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
567
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
568
                        + '</li>';
568
                        + '</li>';
569
                    $("#budget_users").prepend(li);
569
                    $("#budget_users").prepend(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-4 / +3 lines)
Lines 1262-1268 Link Here
1262
            if (borrowernumber) {
1262
            if (borrowernumber) {
1263
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1263
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1264
                    + '?borrowernumber=' + borrowernumber + '">'
1264
                    + '?borrowernumber=' + borrowernumber + '">'
1265
                    + borrowername + '</a>';
1265
                    + borrowername.escapeHtml() + '</a>';
1266
                managedby_name.html(managerlink);
1266
                managedby_name.html(managerlink);
1267
                managedby.val(borrowernumber);
1267
                managedby.val(borrowernumber);
1268
            }
1268
            }
Lines 1293-1301 Link Here
1293
                success: function (data) {
1293
                success: function (data) {
1294
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1294
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1295
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1295
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1296
                    suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')';
1296
                    suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')';
1297
                    suggested += '</a> ';
1297
                    suggested += '</a> ';
1298
                    suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')';
1298
                    suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')';
1299
                    $("#tdsuggestedby").html(suggested);
1299
                    $("#tdsuggestedby").html(suggested);
1300
1300
1301
                },
1301
                },
1302
- 

Return to bug 35329