View | Details | Raw Unified | Return to bug 35329
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc (-2 / +2 lines)
Lines 881-889 Link Here
881
            parent_block.find(".info").hide();
881
            parent_block.find(".info").hide();
882
            parent_block.find(".error").hide();
882
            parent_block.find(".error").hide();
883
            if ( add_user(borrowernumber, borrowername) < 0 ) {
883
            if ( add_user(borrowernumber, borrowername) < 0 ) {
884
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername)).show();
884
                parent_block.find(".error").html(_("Patron '%s' is already in the list.").format(borrowername.escapeHtml())).show();
885
            } else {
885
            } else {
886
                parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername)).show();
886
                parent_block.find(".info").html(_("Patron '%s' added.").format(borrowername.escapeHtml())).show();
887
            }
887
            }
888
        }
888
        }
889
        function modal_select_user(borrowernumber, data) {
889
        function modal_select_user(borrowernumber, data) {
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt (-1 / +1 lines)
Lines 1191-1197 Link Here
1191
            if (ids.indexOf(borrowernumber.toString()) < 0) {
1191
            if (ids.indexOf(borrowernumber.toString()) < 0) {
1192
                ids.push(borrowernumber);
1192
                ids.push(borrowernumber);
1193
                $("#users_ids").val(ids.join(':'));
1193
                $("#users_ids").val(ids.join(':'));
1194
                var li = '<li id="user_'+borrowernumber+'">'+borrowername
1194
                var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
1195
                + ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> '
1195
                + ' <a href="#" data-borrowernumber="'+borrowernumber+'" class="del_user"><i class="fa fa-trash-can"></i> '
1196
                    + _("Delete user") + '</a></li>';
1196
                    + _("Delete user") + '</a></li>';
1197
                $("#users_names").prepend(li);
1197
                $("#users_names").prepend(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt (-1 / +1 lines)
Lines 209-215 Link Here
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
209
        if (ids.indexOf(borrowernumber.toString()) < 0) {
210
                ids.push(borrowernumber);
210
                ids.push(borrowernumber);
211
                $("#users_ids").val(ids.join(':'));
211
                $("#users_ids").val(ids.join(':'));
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername
212
                var li = '<li id="user_'+borrowernumber+'">'+borrowername.escapeHtml()
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
213
                    + ' [<a style="cursor:pointer" onclick="del_user('+borrowernumber+');">'
214
                    + _("Delete user") + '</a>]</li>';
214
                    + _("Delete user") + '</a>]</li>';
215
                $("#users_names").append(li);
215
                $("#users_names").append(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt (-1 / +1 lines)
Lines 564-570 Link Here
564
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
564
                if(borrowernumber && ids.indexOf(borrowernumber.toString()) == -1) {
565
                    var li = '<li id="user_' + borrowernumber + '">'
565
                    var li = '<li id="user_' + borrowernumber + '">'
566
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
566
                        + '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber='
567
                        + borrowernumber + '">' + borrowername + '</a> '
567
                        + borrowernumber + '">' + borrowername.escapeHtml() + '</a> '
568
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
568
                        + ' &bull; <a data-borrowernumber="' + borrowernumber + '" class="del_user" href="#"><i class="fa fa-trash-can"></i> '+_("Remove")+'</a> '
569
                        + '</li>';
569
                        + '</li>';
570
                    $("#budget_users").prepend(li);
570
                    $("#budget_users").prepend(li);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt (-4 / +3 lines)
Lines 1282-1288 Link Here
1282
            if (borrowernumber) {
1282
            if (borrowernumber) {
1283
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1283
                var managerlink = '<a href="/cgi-bin/koha/members/moremember.pl'
1284
                    + '?borrowernumber=' + borrowernumber + '">'
1284
                    + '?borrowernumber=' + borrowernumber + '">'
1285
                    + borrowername + '</a>';
1285
                    + borrowername.escapeHtml() + '</a>';
1286
                managedby_name.html(managerlink);
1286
                managedby_name.html(managerlink);
1287
                managedby.val(borrowernumber);
1287
                managedby.val(borrowernumber);
1288
            }
1288
            }
Lines 1313-1321 Link Here
1313
                success: function (data) {
1313
                success: function (data) {
1314
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1314
                    var suggested = '<input type="hidden" id="suggestedby" name="suggestedby" value="' + data.borrowernumber + '" />';
1315
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1315
                    suggested += '<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=' + data.borrowernumber + '">';
1316
                    suggested += data.surname + ', ' + data.firstname + ' (' + data.cardnumber + ')';
1316
                    suggested += data.surname.escapeHtml() + ', ' + data.firstname.escapeHtml() + ' (' + data.cardnumber.escapeHtml() + ')';
1317
                    suggested += '</a> ';
1317
                    suggested += '</a> ';
1318
                    suggested += data._strings.library_id.str + ' (' + data._strings.category_id.str + ')';
1318
                    suggested += data._strings.library_id.str.escapeHtml() + ' (' + data._strings.category_id.str.escapeHtml() + ')';
1319
                    $("#tdsuggestedby").html(suggested);
1319
                    $("#tdsuggestedby").html(suggested);
1320
1320
1321
                },
1321
                },
1322
- 

Return to bug 35329