From 1ce5b0ff1199e412ab82363df6bb64df48eef629 Mon Sep 17 00:00:00 2001
From: Julian Maurice <julian.maurice@biblibre.com>
Date: Mon, 4 Nov 2013 15:19:13 +0100
Subject: [PATCH] Bug 10857: Encode 'limit' parameter values

to allow facets with '&' character.

Signed-off-by: sonia bouis <sonia.bouis@univ-lyon3.fr>
---
 C4/Search.pm                                       |    4 ++--
 catalogue/search.pl                                |    4 +++-
 .../intranet-tmpl/prog/en/includes/facets.inc      |    5 +++--
 .../opac-tmpl/prog/en/includes/opac-facets.inc     |    5 +++--
 opac/opac-search.pl                                |    2 +-
 5 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/C4/Search.pm b/C4/Search.pm
index 18a0f5f..393011d 100644
--- a/C4/Search.pm
+++ b/C4/Search.pm
@@ -1549,7 +1549,7 @@ sub buildQuery {
             $group_OR_limits{$k} .= " or " if $group_OR_limits{$k};
             $limit_desc      .= " or " if $group_OR_limits{$k};
             $group_OR_limits{$k} .= "$this_limit";
-            $limit_cgi       .= "&limit=$this_limit";
+            $limit_cgi       .= "&limit=" . uri_escape($this_limit);
             $limit_desc      .= " $this_limit";
         }
 
@@ -1557,7 +1557,7 @@ sub buildQuery {
         else {
             $limit .= " and " if $limit || $query;
             $limit      .= "$this_limit";
-            $limit_cgi  .= "&limit=$this_limit";
+            $limit_cgi  .= "&limit=" . uri_escape($this_limit);
             if ($this_limit =~ /^branch:(.+)/) {
                 my $branchcode = $1;
                 my $branchname = GetBranchName($branchcode);
diff --git a/catalogue/search.pl b/catalogue/search.pl
index 2bb7600..ae543c3 100755
--- a/catalogue/search.pl
+++ b/catalogue/search.pl
@@ -153,6 +153,8 @@ use POSIX qw(ceil floor);
 use String::Random;
 use C4::Branch; # GetBranches
 
+use URI::Escape;
+
 my $DisplayMultiPlaceHold = C4::Context->preference("DisplayMultiPlaceHold");
 # create a new CGI object
 # FIXME: no_undef_params needs to be tested
@@ -512,7 +514,7 @@ for my $this_cgi ( split('&',$limit_cgi) ) {
     my $input_name = $1;
     my $input_value = $2;
     $input_name =~ s/=$//;
-    push @limit_inputs, { input_name => $input_name, input_value => $input_value };
+    push @limit_inputs, { input_name => $input_name, input_value => uri_unescape($input_value) };
 }
 $template->param ( LIMIT_INPUTS => \@limit_inputs );
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
index 7cfa267..defb4ba 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
@@ -28,13 +28,14 @@
       [% IF ( sort_by ) %]
         [% SET url = url _ "&amp;sort_by=" _ sort_by %]
       [% END %]
+      [% facet.facet_link_value = BLOCK %][% facet.facet_link_value | uri %][% END %]
       [% IF facet.active %]
         [% SET url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
         [% facet.facet_label_value %]
-        [<a href="[% url |url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
+        [<a href="[% url %]" title="Remove facet [% facet.facet_title_value | html %]">x</a>]
       [% ELSE %]
         [% SET url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-        <a href="[% url | url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a>
+        <a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a>
         [% IF ( displayFacetCount ) %]
           ([% facet.facet_count %])
         [% END %]
diff --git a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc
index 84183c5..88b245c 100644
--- a/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc
+++ b/koha-tmpl/opac-tmpl/prog/en/includes/opac-facets.inc
@@ -29,13 +29,14 @@
       [% IF ( sort_by ) %]
         [% SET url = url _ "&amp;sort_by=" _ sort_by |html %]
       [% END %]
+      [% facet.facet_link_value = BLOCK %][% facet.facet_link_value | uri %][% END %]
       [% IF facet.active %]
         [% SET url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
         [% facet.facet_label_value %]
-        [<a href="[% url |url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
+        [<a href="[% url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
       [% ELSE %]
         [% SET url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-        <a href="[% url | url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a>
+        <a href="[% url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a>
         [% IF ( displayFacetCount ) %]
           ([% facet.facet_count %])
         [% END %]
diff --git a/opac/opac-search.pl b/opac/opac-search.pl
index b9a83c9..13d3210 100755
--- a/opac/opac-search.pl
+++ b/opac/opac-search.pl
@@ -456,7 +456,7 @@ sub _input_cgi_parse {
     for my $this_cgi ( split('&',shift) ) {
         next unless $this_cgi;
         $this_cgi =~ /(.*?)=(.*)/;
-        push @elements, { input_name => $1, input_value => $2 };
+        push @elements, { input_name => $1, input_value => uri_unescape($2) };
     }
     return @elements;
 }
-- 
1.7.2.5