View | Details | Raw Unified | Return to bug 33568
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt (-34 / +33 lines)
Lines 2253-2262 Link Here
2253
                            let image_location = item_type_image_locations[row.item_type_id];
2253
                            let image_location = item_type_image_locations[row.item_type_id];
2254
                            let item_type_description = row._strings.item_type_id.str;
2254
                            let item_type_description = row._strings.item_type_id.str;
2255
                            node += image_location
2255
                            node += image_location
2256
                                ? '<img src="%s" alt="%s" title="%s" /> '.format(image_location, item_type_description, item_type_description)
2256
                                ? '<img src="%s" alt="%s" title="%s" /> '.format(escape_str(image_location), escape_str(item_type_description), escape_str(item_type_description))
2257
                                : '';
2257
                                : '';
2258
                        [% END %]
2258
                        [% END %]
2259
                        node += '<span class="itypedesc itypetext">%s</span>'.format(item_type_description);
2259
                        node += '<span class="itypedesc itypetext">%s</span>'.format(escape_str(item_type_description));
2260
                        return node;
2260
                        return node;
2261
                    }
2261
                    }
2262
                },
2262
                },
Lines 2267-2273 Link Here
2267
                    searchable: true,
2267
                    searchable: true,
2268
                    orderable: true,
2268
                    orderable: true,
2269
                    render: function (data, type, row, meta) {
2269
                    render: function (data, type, row, meta) {
2270
                        return row._strings.holding_library_id.str;
2270
                        return escape_str(row._strings.holding_library_id.str);
2271
                    }
2271
                    }
2272
                },
2272
                },
2273
                {
2273
                {
Lines 2276-2282 Link Here
2276
                    searchable: true,
2276
                    searchable: true,
2277
                    orderable: true,
2277
                    orderable: true,
2278
                    render: function (data, type, row, meta) {
2278
                    render: function (data, type, row, meta) {
2279
                        let nodes = '<span class="homebranchdesc">%s</span>'.format(row._strings.home_library_id.str);
2279
                        let nodes = '<span class="homebranchdesc">%s</span>'.format(escape_str(row._strings.home_library_id.str));
2280
                        nodes += '<span class="shelvingloc">'
2280
                        nodes += '<span class="shelvingloc">'
2281
                        [%# If permanent location is defined, show description or code and             %]
2281
                        [%# If permanent location is defined, show description or code and             %]
2282
                        [%# display current location in parentheses. If not, display current location. %]
2282
                        [%# display current location in parentheses. If not, display current location. %]
Lines 2284-2292 Link Here
2284
                        let loc_str = row._strings.location.str;
2284
                        let loc_str = row._strings.location.str;
2285
                        if ( row.permanent_location && row.permanent_location != row.location ) {
2285
                        if ( row.permanent_location && row.permanent_location != row.location ) {
2286
                            let permanent_loc_str = av_loc[row.permanent_location];
2286
                            let permanent_loc_str = av_loc[row.permanent_location];
2287
                            nodes += '%s (%s)'.format(permanent_loc_str, loc_str);
2287
                            nodes += '%s (%s)'.format(escape_str(permanent_loc_str), escape_str(loc_str));
2288
                        } else {
2288
                        } else {
2289
                            nodes += loc_str;
2289
                            nodes += escape_str(loc_str);
2290
                        }
2290
                        }
2291
                        nodes += '</span>';
2291
                        nodes += '</span>';
2292
                        return nodes;
2292
                        return nodes;
Lines 2297-2303 Link Here
2297
                    searchable: true,
2297
                    searchable: true,
2298
                    orderable: true,
2298
                    orderable: true,
2299
                    render: function (data, type, row, meta) {
2299
                    render: function (data, type, row, meta) {
2300
                        return row._strings.collection_code.str;
2300
                        return escape_str(row._strings.collection_code.str);
2301
                    }
2301
                    }
2302
                },
2302
                },
2303
                [% IF Koha.Preference('EnableItemGroups') %]
2303
                [% IF Koha.Preference('EnableItemGroups') %]
Lines 2308-2314 Link Here
2308
                    orderable: true,
2308
                    orderable: true,
2309
                    render: function (data, type, row, meta) {
2309
                    render: function (data, type, row, meta) {
2310
                        if ( row.item_group_item ) {
2310
                        if ( row.item_group_item ) {
2311
                            return row.item_group_item.item_group.description;
2311
                            return escape_str(row.item_group_item.item_group.description);
2312
                        } else {
2312
                        } else {
2313
                            return "";
2313
                            return "";
2314
                        }
2314
                        }
Lines 2321-2327 Link Here
2321
                    searchable: true,
2321
                    searchable: true,
2322
                    orderable: true,
2322
                    orderable: true,
2323
                    render: function (data, type, row, meta) {
2323
                    render: function (data, type, row, meta) {
2324
                        return row.callnumber;
2324
                        return escape_str(row.callnumber);
2325
                    }
2325
                    }
2326
2326
2327
                },
2327
                },
Lines 2335-2349 Link Here
2335
                        [%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]
2335
                        [%# FIXME Previously we displayed the column if at least one item of the biblio had an enumchron/serial_issue_number. Now it's only if one item of the ones displayed on the current page, how is that bad? How can it be fixed in an elegant way? Should we display the column only if biblio.serial? %]
2336
                        let serial = row.serialitem ? row.serialitem.serial : null;
2336
                        let serial = row.serialitem ? row.serialitem.serial : null;
2337
                        if ( row.serial_issue_number && serial && serial.serialseq ) {
2337
                        if ( row.serial_issue_number && serial && serial.serialseq ) {
2338
                            nodes += '<span class="enum">%s</span>'.format(row.serial_issue_number);
2338
                            nodes += '<span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
2339
                            if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {
2339
                            if ( serial.serialseq && row.serial_issue_number != serial.serialseq ) {
2340
                                nodes += ' <span class="sep"> -- </span>'
2340
                                nodes += ' <span class="sep"> -- </span>'
2341
                                nodes += ' <span class="serialseq">%s</span>'.format(serial.serialseq);
2341
                                nodes += ' <span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
2342
                            }
2342
                            }
2343
                        } else if ( row.serial_issue_number ) {
2343
                        } else if ( row.serial_issue_number ) {
2344
                            nodes += ' <span class="enum">%s</span>'.format(row.serial_issue_number);
2344
                            nodes += ' <span class="enum">%s</span>'.format(escape_str(row.serial_issue_number));
2345
                        } else if ( serial && serial.serialseq ) {
2345
                        } else if ( serial && serial.serialseq ) {
2346
                            nodes += '<span class="serialseq">%s</span>'.format(serial.serialseq);
2346
                            nodes += '<span class="serialseq">%s</span>'.format(escape_str(serial.serialseq));
2347
                        }
2347
                        }
2348
                        if ( serial && serial.publisheddate ) {
2348
                        if ( serial && serial.publisheddate ) {
2349
                            nodes += ' <span class="pubdate">(%s)</span>'.format($date(serial.publisheddate));
2349
                            nodes += ' <span class="pubdate">(%s)</span>'.format($date(serial.publisheddate));
Lines 2373-2402 Link Here
2373
                            nodes += "</span>"
2373
                            nodes += "</span>"
2374
                        } else if ( row.transfer ) {
2374
                        } else if ( row.transfer ) {
2375
                            if ( row.transfer.datesent ) {
2375
                            if ( row.transfer.datesent ) {
2376
                                nodes += '<span class="intransit">%s</span>'.format(_("In transit from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
2376
                                nodes += '<span class="intransit">%s</span>'.format(_("In transit from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.datesent))); [%# FIXME display library names, not codes, do we use _strings here? %]
2377
                            } else {
2377
                            } else {
2378
                                nodes += '<span class="transitrequested">%s</span>'.format(_("Transit pending from %s to %s since %s").format(row.transfer.frombranch, row.transfer.tobranch, $date(row.transfer.daterequested))); [%# FIXME See above %]
2378
                                nodes += '<span class="transitrequested">%s</span>'.format(_("Transit pending from %s to %s since %s").format(escape_str(row.transfer.frombranch), escape_str(row.transfer.tobranch), $date(row.transfer.daterequested))); [%# FIXME See above %]
2379
                            }
2379
                            }
2380
                        }
2380
                        }
2381
2381
2382
                        if ( row.lost_status ) {
2382
                        if ( row.lost_status ) {
2383
                            let lost_lib = av_lost.get(row.lost_status.toString()) || _("Unavailable (lost or missing");
2383
                            let lost_lib = av_lost.get(row.lost_status.toString()) || _("Unavailable (lost or missing");
2384
                            nodes += '<span class="lost">%s</span>'.format(lost_lib);
2384
                            nodes += '<span class="lost">%s</span>'.format(escape_str(lost_lib));
2385
                        }
2385
                        }
2386
2386
2387
                        if ( row.withdrawn ) {
2387
                        if ( row.withdrawn ) {
2388
                            let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) || _("Withdrawn");
2388
                            let withdrawn_lib = av_withdrawn.get(row.withdrawn.toString()) || _("Withdrawn");
2389
                            nodes += '<span class="wdn">%s</span>'.format(withdrawn_lib);
2389
                            nodes += '<span class="wdn">%s</span>'.format(escape_str(withdrawn_lib));
2390
                        }
2390
                        }
2391
2391
2392
                        if ( row.damaged ) {
2392
                        if ( row.damaged ) {
2393
                            let damaged_lib = av_damaged.get(row.damaged.toString()) || _("Damaged");
2393
                            let damaged_lib = av_damaged.get(row.damaged.toString()) || _("Damaged");
2394
                            nodes += '<span class="dmg">%s</span>'.format(damaged_lib);
2394
                            nodes += '<span class="dmg">%s</span>'.format(escape_str(damaged_lib));
2395
                        }
2395
                        }
2396
2396
2397
                        if ( row.not_for_loan_status || row.item_type.notforloan ) {
2397
                        if ( row.not_for_loan_status || row.item_type.notforloan ) {
2398
                            let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());
2398
                            let not_for_loan_lib = av_not_for_loan.get(row.not_for_loan_status.toString());
2399
                            nodes += '<span class="notforloan">%s'.format(_("Not for loan")) + ( not_for_loan_lib ? '<span class="reason"> (%s)</span>'.format(not_for_loan_lib) : '' ) + '</span>';
2399
                            nodes += '<span class="notforloan">%s'.format(_("Not for loan")) + ( not_for_loan_lib ? '<span class="reason"> (%s)</span>'.format(escape_str(not_for_loan_lib)) : '' ) + '</span>';
2400
                        }
2400
                        }
2401
2401
2402
                        if ( row.first_hold ) {
2402
                        if ( row.first_hold ) {
Lines 2418-2427 Link Here
2418
                        [% IF Koha.Preference('UseRecalls') %]
2418
                        [% IF Koha.Preference('UseRecalls') %]
2419
                            if ( row.recall ) {
2419
                            if ( row.recall ) {
2420
                                if ( row.recall.waiting_date ) {
2420
                                if ( row.recall.waiting_date ) {
2421
                                    nodes += '<span>%s</span>'.format(_("Waiting at %s since %s").format(row.recall.pickup_library_id, $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
2421
                                    nodes += '<span>%s</span>'.format(_("Waiting at %s since %s").format(escape_str(row.recall.pickup_library_id), $date(row.recall.waiting_date))); # FIXME Display library names instead of codes
2422
                                } else {
2422
                                } else {
2423
                                    let patron_to_html = $patron_to_html(row.recall.patron);
2423
                                    let patron_to_html = $patron_to_html(row.recall.patron);
2424
                                    nodes += '<span>%s</span>'.format(_("recalled by %s on %s").format(patron_to_html, row.recall.created_date))
2424
                                    nodes += '<span>%s</span>'.format(_("recalled by %s on %s").format(patron_to_html, $date(row.recall.created_date)))
2425
                                }
2425
                                }
2426
                            }
2426
                            }
2427
                        [% END %]
2427
                        [% END %]
Lines 2431-2437 Link Here
2431
                        }
2431
                        }
2432
2432
2433
                        if ( row.restricted_status ) {
2433
                        if ( row.restricted_status ) {
2434
                            nodes += '<span class="restricted">(%s)</span>'.format(av_restricted.get(row.restricted_status.toString()));
2434
                            nodes += '<span class="restricted">(%s)</span>'.format(escape_str(av_restricted.get(row.restricted_status.toString())));
2435
                        }
2435
                        }
2436
2436
2437
                        if ( row.in_bundle ) {
2437
                        if ( row.in_bundle ) {
Lines 2505-2514 Link Here
2505
                        let nodes = '';
2505
                        let nodes = '';
2506
                        if ( row.uri.split(' \| ').length > 1 ) {
2506
                        if ( row.uri.split(' \| ').length > 1 ) {
2507
                            row.uri.split(' \| ').forEach((uri, i) => {
2507
                            row.uri.split(' \| ').forEach((uri, i) => {
2508
                                nodes += '<a href="%s">%s</a><br/>'.format(uri, uri);
2508
                                nodes += '<a href="%s">%s</a><br/>'.format(escape_str(uri), escape_str(uri));
2509
                            });
2509
                            });
2510
                        } else {
2510
                        } else {
2511
                            nodes += '<a href="%s">%s</a><br/>'.format(row.uri, url_link_text);
2511
                            nodes += '<a href="%s">%s</a><br/>'.format(escape_str(row.uri), escape_str(url_link_text));
2512
                        }
2512
                        }
2513
                        return nodes;
2513
                        return nodes;
2514
                    }
2514
                    }
Lines 2519-2525 Link Here
2519
                    searchable: true,
2519
                    searchable: true,
2520
                    orderable: true,
2520
                    orderable: true,
2521
                    render: function (data, type, row, meta) {
2521
                    render: function (data, type, row, meta) {
2522
                        return row._strings.copy_number ? row._strings.copy_number.str : row.copy_number;
2522
                        return escape_str(row._strings.copy_number ? row._strings.copy_number.str : row.copy_number);
2523
                    }
2523
                    }
2524
                },
2524
                },
2525
                {
2525
                {
Lines 2528-2534 Link Here
2528
                    searchable: true,
2528
                    searchable: true,
2529
                    orderable: true,
2529
                    orderable: true,
2530
                    render: function (data, type, row, meta) {
2530
                    render: function (data, type, row, meta) {
2531
                        return row.inventory_number;
2531
                        return escape_str(row.inventory_number);
2532
                    }
2532
                    }
2533
                },
2533
                },
2534
                {
2534
                {
Lines 2537-2543 Link Here
2537
                    searchable: true,
2537
                    searchable: true,
2538
                    orderable: true,
2538
                    orderable: true,
2539
                    render: function (data, type, row, meta) {
2539
                    render: function (data, type, row, meta) {
2540
                        return row.materials_notes;
2540
                        return escape_str(row.materials_notes);
2541
                    }
2541
                    }
2542
                },
2542
                },
2543
                {
2543
                {
Lines 2546-2552 Link Here
2546
                    searchable: true,
2546
                    searchable: true,
2547
                    orderable: true,
2547
                    orderable: true,
2548
                    render: function (data, type, row, meta) {
2548
                    render: function (data, type, row, meta) {
2549
                        return row.public_notes ? row.public_notes.replaceAll('\n', '<br />') : '';
2549
                        return row.public_notes ? escape_str(row.public_notes).replaceAll('\n', '<br />') : '';
2550
                    }
2550
                    }
2551
                },
2551
                },
2552
                {
2552
                {
Lines 2555-2561 Link Here
2555
                    searchable: true,
2555
                    searchable: true,
2556
                    orderable: true,
2556
                    orderable: true,
2557
                    render: function (data, type, row, meta) {
2557
                    render: function (data, type, row, meta) {
2558
                        return row.internal_notes;
2558
                        return escape_str(row.internal_notes);
2559
                    }
2559
                    }
2560
                },
2560
                },
2561
                [% IF ( hostrecords ) %]
2561
                [% IF ( hostrecords ) %]
Lines 2592-2600 Link Here
2592
                            if ( c.enabled != 'yes' ) return;
2592
                            if ( c.enabled != 'yes' ) return;
2593
                            nodes += '<p>';
2593
                            nodes += '<p>';
2594
                            nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);
2594
                            nodes += '<a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=%s">'.format(c.course_id);
2595
                            nodes += c.course_name;
2595
                            nodes += escape_str(c.course_name);
2596
                            if ( c.section ) {
2596
                            if ( c.section ) {
2597
                                nodes += ' ' + c.section;
2597
                                nodes += ' ' + escape_str(c.section);
2598
                            }
2598
                            }
2599
                            if ( c.term ) {
2599
                            if ( c.term ) {
2600
                                nodes += ' ' + av_courses_term.get(c.term.toString());
2600
                                nodes += ' ' + av_courses_term.get(c.term.toString());
Lines 2611-2617 Link Here
2611
                    searchable: false,
2611
                    searchable: false,
2612
                    orderable: false,
2612
                    orderable: false,
2613
                    render: function (data, type, row, meta) {
2613
                    render: function (data, type, row, meta) {
2614
                        return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"><i class="fa fa-print"></i> Print label</a>'.format(row.external_id);
2614
                        return '<a class="btn btn-default btn-xs print-label" href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=%s"><i class="fa fa-print"></i> Print label</a>'.format(escape_str(row.external_id));
2615
                    }
2615
                    }
2616
                },
2616
                },
2617
                [% END %]
2617
                [% END %]
Lines 2633-2639 Link Here
2633
                        }
2633
                        }
2634
                        [% IF bundlesEnabled %]
2634
                        [% IF bundlesEnabled %]
2635
                            // FIXME How do we handle that correctly?
2635
                            // FIXME How do we handle that correctly?
2636
                            //nodes += '<button class="btn btn-default btn-xs details-control"><i class="fa fa-folder"></i> Manage bundle (%s|%s)</button>'.format(row.bundled, row.bundled_lost);
2636
                            //nodes += '<button class="btn btn-default btn-xs details-control"><i class="fa fa-folder"></i> Manage bundle (%s|%s)</button>'.format(escape_str(row.bundled), escape_str(row.bundled_lost));
2637
                        [% END %]
2637
                        [% END %]
2638
2638
2639
                        return nodes;
2639
                        return nodes;
2640
- 

Return to bug 33568