From cb15a95bd405901959f3305a492248a5ee40fea5 Mon Sep 17 00:00:00 2001 From: Nick Clemens Date: Thu, 14 Jun 2018 14:20:44 +0000 Subject: [PATCH] Bug 20945: Escape SQL parameters when constructing download links TO test: 1 - Create a report that takes a parameter 2 - Enter a parameter containing '%' 3 - Attempt to download report, note link is misconstructed 4 - Apply patch 5 - Reload 6 - Note URL is now correct --- koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc index 99ce946..b773c9b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc @@ -49,7 +49,7 @@ [% IF ( execute ) %] [% BLOCK params %] - [%- FOREACH param IN sql_params %]&sql_params=[% param %][% END %] + [%- FOREACH param IN sql_params %]&sql_params=[% param | uri %][% END %] [%- FOREACH param_name IN param_names %]&param_name=[% param_name %][% END %] [%- END %] -- 2.1.4