From 850dbe79e79c80eed6bd3dfaef7f5ac12edb266f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 29 Nov 2017 15:24:40 -0300
Subject: [PATCH] Bug 19560: Correctly escape branchcode in admin/branches.pl

---
 .../intranet-tmpl/prog/en/modules/admin/branches.tt      | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
index 7cdd46e7cf..88eddc6b4a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
@@ -5,9 +5,9 @@
 [% ELSIF op == 'delete_confirm_category' %]
     &rsaquo; Confirm deletion of group [% category.categorycode %]
 [% ELSIF op == 'add_form' %]
-    &rsaquo;[% IF library %]Modify library[% ELSE %]New library [% library.branchcode %][% END %]
+    &rsaquo;[% IF library %]Modify library[% ELSE %]New library [% library.branchcode | html %][% END %]
 [% ELSIF op == 'delete_confirm' %]
-    &rsaquo; Confirm deletion of library '[% library.branchcode %]'
+    &rsaquo; Confirm deletion of library '[% library.branchcode | html %]'
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -65,9 +65,9 @@ tinyMCE.init({
 [% ELSIF op == 'delete_confirm_category' %]
 &rsaquo; Confirm deletion of group [% category.categorycode %]
 [% ELSIF op == 'add_form'  %]
-&rsaquo; [% IF library %]Modify library[% ELSE %]New library [% library.branchcode %][% END %]
+&rsaquo; [% IF library %]Modify library[% ELSE %]New library [% library.branchcode | html %][% END %]
 [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Confirm deletion of library '[% library.branchcode %]'
+&rsaquo; Confirm deletion of library '[% library.branchcode | html %]'
 [% END %]
 </div>
 
@@ -141,7 +141,7 @@ tinyMCE.init({
                     [% IF library %]
                         <span class="label">Library code: </span>
                         <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
-                        [% library.branchcode %]
+                        [% library.branchcode | html %]
                     [% ELSE %]
                         <label for="branchcode" class="required">Library code: </label>
                         <input type="text" name="branchcode" id="branchcode" size="10" maxlength="10" value="[% library.branchcode |html %]" class="required" required="required" />
@@ -203,7 +203,7 @@ tinyMCE.init({
 [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
-            <h3>Are you sure you want to delete [% library.branchname |html %] ([% library.branchcode %])?</h3>
+            <h3>Are you sure you want to delete [% library.branchname |html %] ([% library.branchcode | html %])?</h3>
             <input type="hidden" name="op" value="delete_confirmed" />
             <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
             <input type="hidden" name="branchname" value="[% library.branchname |html %]">
@@ -270,9 +270,9 @@ tinyMCE.init({
                         <td>[% library.marcorgcode %]</td>
                         <td>[% library.branchip %]</td>
                         <td class="actions">
-                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode=[% library.branchcode %]"><i class="fa fa-pencil"></i> Edit</a>
+                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode=[% library.branchcode |url %]"><i class="fa fa-pencil"></i> Edit</a>
                             <form action="/cgi-bin/koha/admin/branches.pl" method="post">
-                                <input type="hidden" name="branchcode" value="[% library.branchcode %]" />
+                                <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
                                 <input type="hidden" name="op" value="delete_confirm" />
                                 <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button>
                             </form>
-- 
2.11.0