From 6d86ef68d67d07fa8bce1fcb2542c32d50c5e064 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Kula?=
 <148193449+mkibp@users.noreply.github.com>
Date: Tue, 6 Aug 2024 12:45:09 +0000
Subject: [PATCH] Bug 37573: Fix bad escaping in OPACSearchForTitleIn that
 broke JavaScript in <script> tags in it

The helper Perl function parametrized_url that converted parameters
within {} would actually remove everything between such characters,
regardless of whether they were a correct parameter or any arbitrary
text.

The patch changes it to remove only something that would look like
a parameter, so that it won't break other unrelated things, while
keeping the original intended behavior.
---
 C4/Output.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/C4/Output.pm b/C4/Output.pm
index d8ea0bfb52..84a3789ef7 100644
--- a/C4/Output.pm
+++ b/C4/Output.pm
@@ -408,7 +408,7 @@ sub parametrized_url {
         my $val_url = URI::Escape::uri_escape_utf8( $val // q{} );
         $ret =~ s/\{$key\}/$val_url/g;
     }
-    $ret =~ s/\{[^\{]*\}//g; # remove remaining vars
+    $ret =~ s/\{[A-Z0-9_]+\}//g; # remove remaining vars
     return $ret;
 }
 
-- 
2.39.2