From 850dbe79e79c80eed6bd3dfaef7f5ac12edb266f Mon Sep 17 00:00:00 2001 From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Date: Wed, 29 Nov 2017 15:24:40 -0300 Subject: [PATCH] Bug 19560: Correctly escape branchcode in admin/branches.pl --- .../intranet-tmpl/prog/en/modules/admin/branches.tt | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt index 7cdd46e7cf..88eddc6b4a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt @@ -5,9 +5,9 @@ [% ELSIF op == 'delete_confirm_category' %] › Confirm deletion of group [% category.categorycode %] [% ELSIF op == 'add_form' %] - ›[% IF library %]Modify library[% ELSE %]New library [% library.branchcode %][% END %] + ›[% IF library %]Modify library[% ELSE %]New library [% library.branchcode | html %][% END %] [% ELSIF op == 'delete_confirm' %] - › Confirm deletion of library '[% library.branchcode %]' + › Confirm deletion of library '[% library.branchcode | html %]' [% END %] </title> [% INCLUDE 'doc-head-close.inc' %] @@ -65,9 +65,9 @@ tinyMCE.init({ [% ELSIF op == 'delete_confirm_category' %] › Confirm deletion of group [% category.categorycode %] [% ELSIF op == 'add_form' %] -› [% IF library %]Modify library[% ELSE %]New library [% library.branchcode %][% END %] +› [% IF library %]Modify library[% ELSE %]New library [% library.branchcode | html %][% END %] [% ELSIF op == 'delete_confirm' %] -› Confirm deletion of library '[% library.branchcode %]' +› Confirm deletion of library '[% library.branchcode | html %]' [% END %] </div> @@ -141,7 +141,7 @@ tinyMCE.init({ [% IF library %] <span class="label">Library code: </span> <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" /> - [% library.branchcode %] + [% library.branchcode | html %] [% ELSE %] <label for="branchcode" class="required">Library code: </label> <input type="text" name="branchcode" id="branchcode" size="10" maxlength="10" value="[% library.branchcode |html %]" class="required" required="required" /> @@ -203,7 +203,7 @@ tinyMCE.init({ [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%] <div class="dialog alert"> <form action="/cgi-bin/koha/admin/branches.pl" method="post"> - <h3>Are you sure you want to delete [% library.branchname |html %] ([% library.branchcode %])?</h3> + <h3>Are you sure you want to delete [% library.branchname |html %] ([% library.branchcode | html %])?</h3> <input type="hidden" name="op" value="delete_confirmed" /> <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" /> <input type="hidden" name="branchname" value="[% library.branchname |html %]"> @@ -270,9 +270,9 @@ tinyMCE.init({ <td>[% library.marcorgcode %]</td> <td>[% library.branchip %]</td> <td class="actions"> - <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&branchcode=[% library.branchcode %]"><i class="fa fa-pencil"></i> Edit</a> + <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&branchcode=[% library.branchcode |url %]"><i class="fa fa-pencil"></i> Edit</a> <form action="/cgi-bin/koha/admin/branches.pl" method="post"> - <input type="hidden" name="branchcode" value="[% library.branchcode %]" /> + <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" /> <input type="hidden" name="op" value="delete_confirm" /> <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button> </form> -- 2.11.0