From c7b712361230ce99197a132d6d36e7f7a110dbb3 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 30 Oct 2018 10:54:46 +0000
Subject: [PATCH] Bug 19532: (QA followup) Add missing TT filters

---
 .../prog/en/includes/recalls-reports.inc      | 34 ++++++------
 .../prog/en/includes/recalls.inc              | 14 ++---
 .../prog/en/modules/admin/smart-rules.tt      |  4 +-
 .../prog/en/modules/catalogue/detail.tt       |  2 +-
 .../prog/en/modules/circ/circulation.tt       |  2 +-
 .../en/modules/circ/recall-pickup-slip.tt     | 11 ++--
 .../prog/en/modules/circ/recalls_overdue.tt   | 31 ++++++-----
 .../prog/en/modules/circ/recalls_queue.tt     |  5 +-
 .../prog/en/modules/circ/recalls_waiting.tt   | 55 ++++++++++---------
 .../prog/en/modules/circ/returns.tt           | 44 +++++++--------
 .../prog/en/modules/members/moremember.tt     |  2 +-
 .../prog/en/modules/members/recallshistory.tt |  5 +-
 .../bootstrap/en/includes/item-status.inc     |  2 +-
 .../bootstrap/en/modules/opac-recall.tt       | 10 ++--
 .../bootstrap/en/modules/opac-recalls.tt      | 26 ++++-----
 .../bootstrap/en/modules/opac-user.tt         | 34 ++++++------
 16 files changed, 143 insertions(+), 138 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/recalls-reports.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/recalls-reports.inc
index 7ba692dd51..e939757029 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/recalls-reports.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/recalls-reports.inc
@@ -26,30 +26,30 @@
                 [% END %]
                     <td>
                         [% IF recall.is_requested || recall.is_waiting || recall.is_overdue %]
-                            <input type="checkbox" value="[% recall.recall_id %]" name="recall_ids">
+                            <input type="checkbox" value="[% recall.recall_id | html %]" name="recall_ids">
                         [% ELSE %]
                             &nbsp;
                         [% END %]
                     </td>
                     <td class="recall-borrower">
-                        <a class="recall-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber %]">
-                            [% recall.patron.firstname %] [% recall.patron.surname %] ([% recall.borrowernumber %])
+                        <a class="recall-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber | uri %]">
+                            [% recall.patron.firstname | html %] [% recall.patron.surname | html %] ([% recall.borrowernumber | html %])
                         </a>
                     </td>
                     <td class="recall-title">
-                        <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                            [% recall.biblio.title %]
+                        <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                            [% recall.biblio.title | html %]
                             [% FOREACH s IN recall.biblio.subtitles %]
-                                [% s %]
+                                [% s | html %]
                             [% END %]
-                            [% recall.item.enumchron %]
+                            [% recall.item.enumchron | html %]
                         </a>
-                        [% recall.biblio.author %]
+                        [% recall.biblio.author | html %]
                     </td>
 
                     <td class="recall-barcode">
-                         <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                         [% recall.item.barcode %]
+                         <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                         [% recall.item.barcode | html %]
                          </a>
                     </td>
 
@@ -58,25 +58,25 @@
                     </td>
 
                     <td class="recall-waiting">
-                        [% IF recall.waitingdate %][% recall.waitingdate %][% ELSE %]Not waiting[% END %]
+                        [% IF recall.waitingdate %][% recall.waitingdate | html %][% ELSE %]Not waiting[% END %]
                     </td>
 
                     <td class="recall-expiry">
                         [% IF ( recall.is_waiting ) %]
                             [% IF ( recall.expirationdate ) %]
-                                [% recall.expirationdate  %]
+                                [% recall.expirationdate | html %]
                             [% ELSE %]
                                 Never expires
                             [% END %]
                         [% ELSIF ( recall.has_expired && recall.expirationdate ) %]
-                            [% recall.expirationdate %]
+                            [% recall.expirationdate | html %]
                         [% ELSE %]
                             -
                         [% END %]
                     </td>
 
                     <td class="recall-branch">
-                        [% recall.library.branchname %]
+                        [% recall.library.branchname | html %]
                     </td>
 
                     <td class="recall-status">
@@ -97,9 +97,9 @@
 
                     <td class="recall-due_date">
                         [% IF ( recall.is_requested ) %]
-                            Due to be returned by [% recall.checkout.date_due %]
+                            Due to be returned by [% recall.checkout.date_due | html %]
                         [% ELSIF ( recall.is_waiting && recall.expirationdate ) %]
-                            Pick up by [% recall.expirationdate %]
+                            Pick up by [% recall.expirationdate | html %]
                         [% ELSE %]
                             -
                         [% END %]
@@ -107,7 +107,7 @@
 
                     <td class="recall-cancel">
                         [% IF ( !recall.cancellationdate && ( recall.is_requested || recall.is_overdue ) ) %]
-                            <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id %]"><i class="fa fa-times"></i> Cancel</a>
+                            <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id | html %]"><i class="fa fa-times"></i> Cancel</a>
                         [% END %]
                     </td>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/recalls.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/recalls.inc
index 3215544cb8..383d337fdd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/recalls.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/recalls.inc
@@ -16,14 +16,14 @@
             [% FOREACH recall IN recalls %]
                 <tr>
                     <td class="recall-title">
-                        <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                            [% recall.biblio.title %]
+                        <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                            [% recall.biblio.title | html %]
                             [% FOREACH s IN recall.biblio.subtitles %]
-                                [% s %]
+                                [% s | html %]
                             [% END %]
-                            [% recall.item.enumchron %]
+                            [% recall.item.enumchron | html %]
                         </a>
-                        [% recall.biblio.author %]
+                        [% recall.biblio.author | html %]
                     </td>
 
                     <td class="recall-date">
@@ -45,7 +45,7 @@
                     </td>
 
                     <td class="recall-branch">
-                        [% recall.library.branchname %]
+                        [% recall.library.branchname | html %]
                     </td>
 
                     <td class="recall-status">
@@ -66,7 +66,7 @@
 
                     <td class="recall-cancel">
                         [% IF ( !recall.cancellationdate && ( recall.is_requested || recall.is_overdue ) ) %]
-                            <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id %]"><i class="fa fa-times"></i> Cancel</a>
+                            <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id | html %]"><i class="fa fa-times"></i> Cancel</a>
                         [% END %]
                     </td>
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
index 04343dc255..1c171cd0a2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
@@ -214,9 +214,9 @@
                                                                 <span>Don't allow</span>
                                                             [% END %]
                                                         </td>
-                                                        <td>[% rule.recall_due_date_interval %]</td>
+                                                        <td>[% rule.recall_due_date_interval | html %]</td>
                                                         <td>[% rule.recall_overdue_fine FILTER format("%.2f") %]</td>
-                                                        <td>[% rule.recall_shelf_time %]</td>
+                                                        <td>[% rule.recall_shelf_time | html %]</td>
                                                         <td>
                                                             [% IF rule.article_requests == 'no' %]
                                                                 <span>No</span>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
index 3f97b786ff..7e634dfe5a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
@@ -489,7 +489,7 @@
                             [% END %]
                         [% END %]
                         [% IF ( item.recalled ) %]
-                            Item recalled (placed [% item.recall.recalldate | $KohaDates %]) by <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% item.recall.borrowernumber %]">[% item.recall.patron.firstname %] [% item.recall.patron.surname %] ([% item.recall.patron.cardnumber %])</a>
+                            Item recalled (placed [% item.recall.recalldate | $KohaDates %]) by <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% item.recall.borrowernumber | uri %]">[% item.recall.patron.firstname | html %] [% item.recall.patron.surname | html %] ([% item.recall.patron.cardnumber | html %])</a>
                             [% END %]
                             [% UNLESS ( item.itemnotforloan || item.notforloan_per_itemtype || item.onloan || item.itemlost || item.withdrawn || item.damaged || item.transfertwhen || item.reservedate || item.recalled ) %]
                             Available
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
index 96af5172e5..350d3d56a6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
@@ -828,7 +828,7 @@ No patron matched <span class="ex">[% message | html %]</span>
     </li>
 
     [% IF Koha.Preference('UseRecalls') && recalls.count %]
-        <li><a href="#recalls" id="recalls-tab">[% recalls.count %] Recall(s)</a></li>
+        <li><a href="#recalls" id="recalls-tab">[% recalls.count | html %] Recall(s)</a></li>
     [% END %]
 
     [% IF Koha.Preference('ArticleRequests') %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recall-pickup-slip.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recall-pickup-slip.tt
index a2ba1e7e53..ced3d5e639 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recall-pickup-slip.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recall-pickup-slip.tt
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Recall print receipt</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("css/print.css") %]
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | url %][% ELSE %][% interface | url %]/[% theme | uri %]/img/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("css/print.css") | $raw %]
 [% IF ( Koha.Preference('SlipCSS') ) %]
-<link rel="stylesheet" type="text/css" href="[% Koha.Preference('SlipCSS') %]" />
+<link rel="stylesheet" type="text/css" href="[% Koha.Preference('SlipCSS') | url %]" />
 [% END %]
 
 [% INCLUDE 'slip-print.inc' #printThenClose %]
@@ -17,10 +18,10 @@
 
 [% IF plain %]
 <pre>
-[% IF ( slip ) %][% slip %][% ELSE %]No slip template found[% END %]
+[% IF ( slip ) %][% slip | html %][% ELSE %]No slip template found[% END %]
 </pre>
 [% ELSE %]
-[% IF ( slip ) %][% slip %][% ELSE %]No slip template found[% END %]
+[% IF ( slip ) %][% slip | html %][% ELSE %]No slip template found[% END %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_overdue.tt
index 787018a07c..36e2e64db6 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_overdue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_overdue.tt
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -5,8 +6,8 @@
 <title>Koha &rsaquo; Circulation &rsaquo; Overdue recalls</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css"> p { margin-top: 0; }</style>
-<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
-[% Asset.js("js/recalls.js") %]
+<link rel="stylesheet" type="text/css" href="[% interface | url %]/[% theme | uri %]/css/datatables.css" />
+[% Asset.js("js/recalls.js") | $raw %]
 [% INCLUDE 'datatables.inc' %]
 [% INCLUDE 'columns_settings.inc' %]
 </head>
@@ -55,39 +56,39 @@
                                     [% FOREACH recall IN recalls %]
                                         <tr>
                                             <td>
-                                                <input type="checkbox" value="[% recall.recall_id %]" name="recall_ids">
+                                                <input type="checkbox" value="[% recall.recall_id | html %]" name="recall_ids">
                                             </td>
                                             <td class="recall-borrower">
-                                                <a class="recall-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber %]">
-                                                    [% recall.patron.firstname %] [% recall.patron.surname %] ([% recall.borrowernumber %])
+                                                <a class="recall-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber | uri %]">
+                                                    [% recall.patron.firstname | html %] [% recall.patron.surname | html %] ([% recall.borrowernumber | html %])
                                                 </a>
                                             </td>
                                             <td class="recall-title">
-                                                <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                                                    [% recall.biblio.title %]
+                                                <a class="recall-title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                                                    [% recall.biblio.title | html %]
                                                     [% FOREACH s IN recall.biblio.subtitles %]
-                                                        [% s %]
+                                                        [% s | html %]
                                                     [% END %]
-                                                    [% recall.item.enumchron %]
+                                                    [% recall.item.enumchron | html %]
                                                 </a>
-                                                [% recall.biblio.author %]
+                                                [% recall.biblio.author | html %]
                                             </td>
                                             <td class="recall-date">
                                                 [% recall.recalldate | $KohaDates %]
                                             </td>
                                             <td class="recall-due">
-                                                [% recall.checkout.date_due %]
+                                                [% recall.checkout.date_due | html %]
                                             </td>
                                             <td class="recall-current-borrower">
-                                                <a class="recall-current-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.checkout.borrowernumber %]">
-                                                    [% recall.checkout.patron.firstname %] [% recall.checkout.patron.surname %] ([% recall.checkout.borrowernumber %])
+                                                <a class="recall-current-borrower" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.checkout.borrowernumber | uri %]">
+                                                    [% recall.checkout.patron.firstname | html %] [% recall.checkout.patron.surname | html %] ([% recall.checkout.borrowernumber | html %])
                                                 </a>
                                             </td>
                                             <td class="recall-branch">
-                                                [% recall.library.branchname %]
+                                                [% recall.library.branchname | html %]
                                             </td>
                                             <td class="recall-cancel">
-                                                <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id %]"><i class="fa fa-times"></i> Cancel</a>
+                                                <a class="btn btn-xs btn-default" id="cancel_recall" data-id="[% recall.recall_id | html %]"><i class="fa fa-times"></i> Cancel</a>
                                             </td>
                                         </tr>
                                     [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_queue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_queue.tt
index 3efe280aa2..030017ffa2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_queue.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_queue.tt
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,7 +7,7 @@
 <title>Koha &rsaquo; Circulation &rsaquo; Recalls queue</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css"> p { margin-top: 0; }</style>
-<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
+<link rel="stylesheet" type="text/css" href="[% interface | url %]/[% theme | uri %]/css/datatables.css" />
 </head>
 <body id="circ_recalls_queue" class="circ">
 [% INCLUDE 'header.inc' %]
@@ -59,7 +60,7 @@
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("js/recalls.js") %]
+    [% Asset.js("js/recalls.js") | $raw %]
     <script type="text/javascript">
     $(document).ready(function() {
             $(".old").hide();
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_waiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_waiting.tt
index 32b3d2f652..59d15f4c3c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_waiting.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/recalls_waiting.tt
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -5,8 +6,8 @@
 <title>Koha &rsaquo; Circulation &rsaquo; Recalls awaiting pickup</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css"> p { margin-top: 0; }</style>
-<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
-[% Asset.js("js/recalls.js") %]
+<link rel="stylesheet" type="text/css" href="[% interface | url %]/[% theme | uri %]/css/datatables.css" />
+[% Asset.js("js/recalls.js") | $raw %]
 [% INCLUDE 'datatables.inc' %]
 <script type="text/javascript">
     $(document).ready(function() {
@@ -46,8 +47,8 @@
                 <div id="results" class="toptabs">
 
                     <ul>
-                        <li><a href="#recallswaiting">Recalls waiting: [% recalls.size %]</a></li>
-                        <li><a href="#recallsover">Recalls waiting over [% Koha.Preference('RecallsMaxPickUpDelay') %] days: [% over.size %]</a></li>
+                        <li><a href="#recallswaiting">Recalls waiting: [% recalls.size | html %]</a></li>
+                        <li><a href="#recallsover">Recalls waiting over [% Koha.Preference('RecallsMaxPickUpDelay') | html %] days: [% over.size | html %]</a></li>
                     </ul>
 
                     <div id="recallswaiting">
@@ -64,25 +65,25 @@
                                     [% FOREACH recall IN recalls %]<tr>
                                         <td>[% recall.waitingdate | $KohaDates %]</td>
                                         <td>
-                                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                                                [% recall.biblio.title %]
+                                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                                                [% recall.biblio.title | html %]
                                                 [% FOREACH s IN recall.biblio.subtitles %]
-                                                    [% s %]
+                                                    [% s | html %]
                                                 [% END %]
-                                                [% recall.item.enumchron %]
+                                                [% recall.item.enumchron | html %]
                                             </a>
-                                            [% recall.biblio.author %]
-                                            <br><i>Barcode: [% recall.item.barcode %]</i>
+                                            [% recall.biblio.author | html %]
+                                            <br><i>Barcode: [% recall.item.barcode | html %]</i>
                                         </td>
                                         <td>
-                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber %]">[% recall.patron.firstname %] [% recall.patron.surname %]</a>
-                                            [% IF ( recall.patron.phone ) %]<br />[% recall.patron.phone %][% END %]
-                                            [% IF ( recall.patron.email ) %]<br /><a href="mailto:[% recall.patron.email %]?subject=Recall waiting: [% recall.biblio.title %]">[% recall.patron.email %]</a>[% END %]
+                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber | uri %]">[% recall.patron.firstname | html %] [% recall.patron.surname | html %]</a>
+                                            [% IF ( recall.patron.phone ) %]<br />[% recall.patron.phone | html %][% END %]
+                                            [% IF ( recall.patron.email ) %]<br /><a href="mailto:[% recall.patron.email | uri %]?subject=Recall waiting: [% recall.biblio.title | uri %]">[% recall.patron.email | html %]</a>[% END %]
                                         </td>
-                                        <td>[% recall.library.branchname %]</td>
+                                        <td>[% recall.library.branchname | html %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/circ/recalls_waiting.pl" method="post">
-                                                <input type="hidden" name="recall_id" value="[% recall.recall_id %]">
+                                                <input type="hidden" name="recall_id" value="[% recall.recall_id | html %]">
                                                 <input type="hidden" name="op" value="expire_recall">
                                                 <fieldset class="action">
                                                     <button type="submit" class="btn btn-default btn-xs" id="expire_recall"><i class="fa fa-times"></i> Expire</button>
@@ -99,7 +100,7 @@
 
                     <div id="recallsover">
                         [% IF ( over.size > 0 ) %]
-                            [% IF ( Koha.Preference('RecallsMaxPickUpDelay') ) %]<p>Recalls listed here have been awaiting pickup for more than [% Koha.Preference('RecallsMaxPickUpDelay') %] days.</p>[% END %]
+                            [% IF ( Koha.Preference('RecallsMaxPickUpDelay') ) %]<p>Recalls listed here have been awaiting pickup for more than [% Koha.Preference('RecallsMaxPickUpDelay') | html %] days.</p>[% END %]
                             <table id="recallsover-table">
                                 <thead><tr>
                                     <th class="title-string">Available since</th>
@@ -112,25 +113,25 @@
                                     [% FOREACH recall IN over %]<tr>
                                         <td>[% recall.waitingdate | $KohaDates %]</td>
                                         <td>
-                                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber %]">
-                                                [% recall.biblio.title %]
+                                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% recall.biblionumber | uri %]">
+                                                [% recall.biblio.title | html %]
                                                 [% FOREACH s IN recall.biblio.subtitles %]
-                                                    [% s %]
+                                                    [% s | html %]
                                                 [% END %]
-                                                [% recall.item.enumchron %]
+                                                [% recall.item.enumchron | html %]
                                             </a>
-                                            [% recall.biblio.author %]
-                                            <br><i>Barcode: [% recall.item.barcode %]</i>
+                                            [% recall.biblio.author | html %]
+                                            <br><i>Barcode: [% recall.item.barcode | html %]</i>
                                         </td>
                                         <td>
-                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber %]">[% recall.patron.firstname %] [% recall.patron.surname %]</a>
-                                            [% IF ( recall.patron.phone ) %]<br />[% recall.patron.phone %][% END %]
-                                            [% IF ( recall.patron.email ) %]<br /><a href="mailto:[% recall.patron.email %]?subject=Recall waiting: [% recall.biblio.title %]">[% recall.patron.email %]</a>[% END %]
+                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% recall.borrowernumber | uri %]">[% recall.patron.firstname | html %] [% recall.patron.surname | html %]</a>
+                                            [% IF ( recall.patron.phone ) %]<br />[% recall.patron.phone | html %][% END %]
+                                            [% IF ( recall.patron.email ) %]<br /><a href="mailto:[% recall.patron.email | uri %]?subject=Recall waiting: [% recall.biblio.title | uri %]">[% recall.patron.email | html %]</a>[% END %]
                                         </td>
-                                        <td>[% recall.library.branchname %]</td>
+                                        <td>[% recall.library.branchname | html %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/circ/recalls_waiting.pl" method="post">
-                                                <input type="hidden" name="recall_id" value="[% recall.recall_id %]">
+                                                <input type="hidden" name="recall_id" value="[% recall.recall_id | html %]">
                                                 <input type="hidden" name="op" value="expire_recall">
                                                 <fieldset class="action">
                                                     <button type="submit" class="btn btn-default btn-xs" id="expire_recall"><i class="fa fa-times"></i> Expire</button>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
index 1727c5f488..fa9b59923e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
@@ -74,7 +74,7 @@
                         [% IF ( transfertodo ) %]
                             [% patron.email | html %]
                         [% ELSE %]
-                            <a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a>
+                            <a id="boremail" href="mailto:[% patron.email | uri %]">[% patron.email | html %]</a>
                         [% END %]
                     </li>
                 [% END %]
@@ -176,15 +176,15 @@
         <!-- WrongTransfer -->
         <h3>Please return item to: [% Branches.GetName( TransferWaitingAt ) | html %]</h3>
             <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | uri %]">[% itembarcode | html %]: [% title | html %]</a></p>
-        <button type="submit" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&amp;&amp;branchcode=[% TransferWaitingAt | html %]&amp;op=slip"><i class="fa fa-print"></i> Print transfer slip</button>
-        <button class="deny" type="submit" onclick="window.location.href='/cgi-bin/koha/circ/returns.pl?itemnumber=[% itemnumber | html %]&amp;canceltransfer=1'"><i class="fa fa-times"></i> Cancel transfer</button>
+        <button type="submit" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&amp;&amp;branchcode=[% TransferWaitingAt | uri %]&amp;op=slip"><i class="fa fa-print"></i> Print transfer slip</button>
+        <button class="deny" type="submit" onclick="window.location.href='/cgi-bin/koha/circ/returns.pl?itemnumber=[% itemnumber | uri %]&amp;canceltransfer=1'"><i class="fa fa-times"></i> Cancel transfer</button>
 [% IF ( patron.cardnumber ) %]<h5>Hold for:</h5>
         <ul>
             <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | uri %]">
             [% patron.surname | html %], [% patron.firstname | html %]</a> ([% patron.cardnumber | html %]) <span class="patron-category"> - [% patron.category.description | html %]</span> </li>
             [% INCLUDE display_holdpatron_address %]
             [% IF ( patron.phone ) %]<li>[% patron.phone | html %]</li>[% END %]
-            [% IF ( patron.email ) %]<li><a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a></li>[% END %]
+            [% IF ( patron.email ) %]<li><a id="boremail" href="mailto:[% patron.email | uri %]">[% patron.email | html %]</a></li>[% END %]
         </ul>
 
     <form method="post" action="returns.pl" class="confirm">
@@ -235,7 +235,7 @@
                     [% END %]
 
                     [% IF ( patron.email ) %]
-                        <li><a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a></li>
+                        <li><a id="boremail" href="mailto:[% patron.email | uri %]">[% patron.email | html %]</a></li>
                     [% END %]
 
                     [% IF ( patron.debarred ) %]
@@ -515,30 +515,30 @@
             <div class="modal-content">
             <form method="post" action="/cgi-bin/koha/circ/returns.pl" class="confirm">
                 <div class="modal-header">
-                    <h3>Recall found  [% IF transfer_recall %] needing transfer to [% Branches.GetName( recall.branchcode ) %][% END %]: <br/>
-                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %] </a>
+                    <h3>Recall found  [% IF transfer_recall %] needing transfer to [% Branches.GetName( recall.branchcode ) | html %][% END %]: <br/>
+                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | uri %]">[% itembarcode |html %]: [% title |html %] </a>
                     </h3>
                 </div>
 
                 <div class="modal-body">
                     [% IF ( recallnotes ) %]
-                        <h4>Notes: [% recall.recallnotes %]</h4>
+                        <h4>Notes: [% recall.recallnotes | html %]</h4>
                     [% END %]
                     <h5>This item has been recalled by:</h5>
                     <li>
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.surname %], [% patron.firstname %]</a>
-                        ([% patron.cardnumber %])
-                        <span class="patron-category"> - [% patron.category.description %]</span>
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | uri %]">[% patron.surname | html %], [% patron.firstname | html %]</a>
+                        ([% patron.cardnumber | html %])
+                        <span class="patron-category"> - [% patron.category.description | html %]</span>
                     </li>
 
                     [% INCLUDE display_holdpatron_address %]
 
                     [% IF ( patron.phone ) %]
-                        <li>[% patron.phone %]</li>
+                        <li>[% patron.phone | html %]</li>
                     [% END %]
 
                     [% IF ( patron.email ) %]
-                        <li><a id="boremail" href="mailto:[% patron.email %]">[% patron.email %]</a></li>
+                        <li><a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a></li>
                     [% END %]
 
                     [% IF ( patron.debarred ) %]
@@ -550,16 +550,16 @@
                     [% END %]
 
                     <h4>
-                    [% IF transfer_recall %]Transfer to [% Branches.GetName( recall.branchcode ) %]
-                    [% ELSIF recall.status == 'W' %]Hold for pickup (already waiting) at [% recall.library.branchname %]
-                    [% ELSE %]Hold for pickup at [% recall.library.branchname %][% END %]
+                    [% IF transfer_recall %]Transfer to [% Branches.GetName( recall.branchcode ) | html %]
+                    [% ELSIF recall.status == 'W' %]Hold for pickup (already waiting) at [% recall.library.branchname | html %]
+                    [% ELSE %]Hold for pickup at [% recall.library.branchname | html %][% END %]
                     </h4>
 
-                    <input type="hidden" name="itemnumber" value="[% recall.itemnumber %]" />
-                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-                    <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
-                    <input type="hidden" name="recall_id" value="[% recall.recall_id %]" />
-                    <input type="hidden" name="diffBranch" value="[% recall.branchcode %]" />
+                    <input type="hidden" name="itemnumber" value="[% recall.itemnumber | html %]" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                    <input type="hidden" name="biblionumber" value="[% itembiblionumber | html %]" />
+                    <input type="hidden" name="recall_id" value="[% recall.recall_id | html %]" />
+                    <input type="hidden" name="diffBranch" value="[% recall.branchcode | html %]" />
                     <input type="hidden" name="print_recall_slip" value="0" />
                 </div>
 
@@ -846,7 +846,7 @@
                 Dopop('hold-transfer-slip.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;biblionumber=[% biblionumber | html %]');
             });
             [% IF print_recall_slip %]
-                Dopop('recall-pickup-slip.pl?borrowernumber=[% borrowernumber %]&amp;biblionumber=[% biblionumber %]&amp;recall_id=[% recall_id %]')    ;
+                Dopop('recall-pickup-slip.pl?borrowernumber=[% borrowernumber | html %]&amp;biblionumber=[% biblionumber | html %]&amp;recall_id=[% recall_id | html %]')    ;
             [% END %]
 
             [% IF print_slip %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
index cc7eb776c2..9aea7d845b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
@@ -662,7 +662,7 @@
                                 </li>
                             [% END %]
                             [% IF Koha.Preference('UseRecalls') && recalls.count %]
-                                <li><a href="#recalls" id="recalls-tab">[% recalls.count %] Recall(s)</a></li>
+                                <li><a href="#recalls" id="recalls-tab">[% recalls.count | html %] Recall(s)</a></li>
                             [% END %]
                             [% IF Koha.Preference('ArticleRequests') %]
                                 <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/recallshistory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/recallshistory.tt
index 990023e6bf..c2e89bec89 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/recallshistory.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/recallshistory.tt
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Recalls history for [% INCLUDE 'patron-title.inc' %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
+<link rel="stylesheet" type="text/css" href="[% interface | url %]/[% theme | uri %]/css/datatables.css" />
 [% INCLUDE 'datatables.inc' %]
-[% Asset.js("js/recalls.js") %]
+[% Asset.js("js/recalls.js") | $raw %]
 </head>
 <body id="recalls_history" class="pat">
 [% INCLUDE 'header.inc' %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/item-status.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/item-status.inc
index 2d153ec26c..1234350aa4 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/item-status.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/item-status.inc
@@ -38,7 +38,7 @@
             <span class="item-status checkedout">Checked out</span>
         [% END %]
     [% END %]
-    [% IF item.avail_for_recall %]<a href="/cgi-bin/koha/opac-recall.pl?itemnumber=[% item.itemnumber %]" class="btn btn-default btn-xs">Recall</a>[% END %]
+    [% IF item.avail_for_recall %]<a href="/cgi-bin/koha/opac-recall.pl?itemnumber=[% item.itemnumber | uri %]" class="btn btn-default btn-xs">Recall</a>[% END %]
 [% END %]
 
 [% IF NOT ( item.isa('Koha::Item') ) AND item.transfertwhen %] [%# transfertwhen is set in C4::Search, do not have it for course reserves %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
index bf026016ad..9c57e0452d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt
@@ -1,7 +1,7 @@
 [% USE Koha %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Recall</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Recall</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -11,8 +11,8 @@
 <div class="main">
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-        <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber %]">Details for: [% biblio.title %]</a> <span class="divider">&rsaquo;</span></li>
-        <li><a href="/cgi-bin/koha/opac-recall.pl?itemnumber=[% itemnumber %]">Recall item</a></li>
+        <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber | uri %]">Details for: [% biblio.title | html %]</a> <span class="divider">&rsaquo;</span></li>
+        <li><a href="/cgi-bin/koha/opac-recall.pl?itemnumber=[% itemnumber | uri %]">Recall item</a></li>
     </ul>
 
     <div class="container-fluid">
@@ -43,14 +43,14 @@
                     [% END %]
 
                     [% IF success %]
-                        <p>Your recall has been placed. The user the item is currently checked out to has been asked to return the item within [% due_interval %] [% due_unit %], on [% due_date | $KohaDates %].</p>
+                        <p>Your recall has been placed. The user the item is currently checked out to has been asked to return the item within [% due_interval | html %] [% due_unit | html %], on [% due_date | $KohaDates %].</p>
                         <p>You will be notified when your item is waiting to be picked up at the library.</p>
                     [% ELSIF not error %]
                         <p>All borrowable material is subject to recall if checked out and needed by someone else. We will ask the person who has checked out this item to return it so you may use it.</p>
 <hr>
                         [% IF loggedinusername %]
                             <div class="dialog">
-                            <p>Place a recall on [% biblio.title %] ([% biblio.author %])?</p> <a href="/cgi-bin/koha/opac-recall.pl?op=request&itemnumber=[% itemnumber %]" class="btn btn-default btn-sm">Confirm</a> &nbsp; <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber %]">Cancel</a>
+                            <p>Place a recall on [% biblio.title | html %] ([% biblio.author | html %])?</p> <a href="/cgi-bin/koha/opac-recall.pl?op=request&itemnumber=[% itemnumber | uri %]" class="btn btn-default btn-sm">Confirm</a> &nbsp; <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber | uri %]">Cancel</a>
                             </div>
                         [% ELSE %]
                             <div class="dialog alert">You must be logged in to place a recall.</div>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
index 653eef9bf7..b5e9109859 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt
@@ -2,7 +2,7 @@
 [% USE KohaDates %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your recalls history</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your recalls history</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -46,17 +46,17 @@
                                     [% FOREACH RECALL IN RECALLS %]
                                         <tr>
                                             <td class="title">
-                                                <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RECALL.biblionumber %]">
-                                                    [% RECALL.biblio.title %]
+                                                <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RECALL.biblionumber | uri %]">
+                                                    [% RECALL.biblio.title | html %]
                                                     [% FOREACH s IN RECALL.biblio.subtitles %]
-                                                        [% s %]
+                                                        [% s | html %]
                                                     [% END %]
-                                                    [% RECALL.item.enumchron %]
+                                                    [% RECALL.item.enumchron | html %]
                                                 </a>
-                                                [% RECALL.biblio.author %]
+                                                [% RECALL.biblio.author | html %]
                                             </td>
                                             <td class="recalldate">
-                                                <span title="[% RECALL.recalldate %]">
+                                                <span title="[% RECALL.recalldate | html %]">
                                                     <span class="tdlabel">Recall date:</span>
                                                     [% RECALL.recalldate | $KohaDates %]
                                                 </span>
@@ -64,7 +64,7 @@
                                             <td class="expirationdate">
                                                 [% IF ( RECALL.is_waiting ) %]
                                                     [% IF ( RECALL.expirationdate ) %]
-                                                        <span title="[% RECALL.expirationdate %]">
+                                                        <span title="[% RECALL.expirationdate | html %]">
                                                             <span class="tdlabel">Expiration:</span>
                                                             [% RECALL.expirationdate | $KohaDates %]
                                                         </span>
@@ -75,7 +75,7 @@
                                                         </span>
                                                     [% END %]
                                                 [% ELSIF ( RECALL.expirationdate ) %]
-                                                    <span title="[% RECALL.expirationdate %]" class="overdue">
+                                                    <span title="[% RECALL.expirationdate | html %]" class="overdue">
                                                         <span class="tdlabel">Expiration:</span>
                                                         [% RECALL.expirationdate | $KohaDates %]
                                                     </span>
@@ -85,7 +85,7 @@
                                             </td>
                                             <td class="branch">
                                                 <span class="tdlabel">Pick up location:</span>
-                                                [% RECALL.library.branchname %]
+                                                [% RECALL.library.branchname | html %]
                                             </td>
                                             <td class="status">
                                                 <span class="tdlabel">Status:</span>
@@ -116,9 +116,9 @@
                                                 [% IF ( !RECALL.cancellationdate && ( RECALL.is_requested || RECALL.is_overdue ) ) %]
                                                     <form action="/cgi-bin/koha/opac-recall.pl" method="post">
                                                         <input type="hidden" name="op" value="cancel">
-                                                        <input type="hidden" name="recall_id" value="[% RECALL.recall_id %]">
-                                                        <input type="hidden" name="itemnumber" value="[% RECALL.itemnumber %]">
-                                                        <button type="submit" name="submit" class="btn btn-xs btn-danger" id="cancel_recall_[% RECALL.recall_id %]"><i class="icon-remove icon-white"></i> Cancel</button>
+                                                        <input type="hidden" name="recall_id" value="[% RECALL.recall_id | html %]">
+                                                        <input type="hidden" name="itemnumber" value="[% RECALL.itemnumber | html %]">
+                                                        <button type="submit" name="submit" class="btn btn-xs btn-danger" id="cancel_recall_[% RECALL.recall_id | html %]"><i class="icon-remove icon-white"></i> Cancel</button>
                                                     </form>
                                                 [% END %]
                                             </td>
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
index f7b252a9c9..b3b5b2fb9d 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
@@ -214,7 +214,7 @@
 
                                                     [% IF ( OPACAmazonCoverImages ) %]
                                                         [% IF ( ISSUE.normalized_isbn ) %]
-                                                            <a href="http://www.amazon.com/gp/reader/[% ISSUE.normalized_isbn | uri %][% AmazonAssocTag | uri %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% ISSUE.normalized_isbn | html %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail"/></a>
+                                                            <a href="http://www.amazon.com/gp/reader/[% ISSUE.normalized_isbn | uri %][% AmazonAssocTag | uri %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% ISSUE.normalized_isbn | uri %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail"/></a>
                                                         [% ELSE %]
                                                             <a href="#"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
@@ -224,7 +224,7 @@
                                                         [% IF ( ISSUE.normalized_isbn ) %]
                                                             <div style="display:block;" title="Click to view in Google Books" class="[% ISSUE.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                                         [% ELSE %]
-                                                            <a href="http://books.google.com/books?q=[% ISSUE.title |url %]"><span class="no-image">No cover image available</span></a>
+                                                            <a href="http://books.google.com/books?q=[% ISSUE.title | uri %]"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
                                                     [% END %]
 
@@ -244,8 +244,8 @@
                                                 </td>[% END # / IF JacketImages %]
 
                                                 <td class="title">
-                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ISSUE.biblionumber | html %]">[% ISSUE.title | html %] [% FOREACH subtitl IN ISSUE.subtitle %] [% subtitl.subfield | html %][% END %]</a>
-                                                    [% IF ( ISSUE.enumchron ) %] [% ISSUE.enumchron %][% END %]
+                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ISSUE.biblionumber | uri %]">[% ISSUE.title | html %] [% FOREACH subtitl IN ISSUE.subtitle %] [% subtitl.subfield | html %][% END %]</a>
+                                                    [% IF ( ISSUE.enumchron ) %] [% ISSUE.enumchron | html %][% END %]
                                                     [% IF ( ISSUE.recalled ) %]<br /><i>This item has been recalled. Please return by the new due date.</i>[% END %]
                                                 </td>
 
@@ -336,7 +336,7 @@
                                                     <td class="note">
                                                         <input type="text" name="note" data-issue_id="[% ISSUE.issue_id | html %]" data-origvalue="[% ISSUE.note | html %]" value="[% ISSUE.note | html %]" readonly>
                                                         <a class="btn" name="js_submitnote" id="save_[% ISSUE.issue_id | html %]" style="display:none;">Submit note</a>
-                                                        <a class="btn" name="nonjs_submitnote" href="/cgi-bin/koha/opac-issue-note.pl?issue_id=[% ISSUE.issue_id | url %]">Edit / Create note</a>
+                                                        <a class="btn" name="nonjs_submitnote" href="/cgi-bin/koha/opac-issue-note.pl?issue_id=[% ISSUE.issue_id | uri %]">Edit / Create note</a>
                                                     </td>
                                                 [% END %]
                                             </tr>
@@ -791,7 +791,7 @@
                         [% IF Koha.Preference('UseRecalls') && RECALLS.count %]
                             <div id="opac-user-recalls">
                                 <table id="recalls-table" class="table table-bordered table-striped">
-                                    <caption>Recalls <span class="count">([% RECALLS.count %])</span></caption>
+                                    <caption>Recalls <span class="count">([% RECALLS.count | html %])</span></caption>
                                     <thead>
                                         <tr>
                                             <th class="anti-the">Title</th>
@@ -806,17 +806,17 @@
                                         [% FOREACH RECALL IN RECALLS %]
                                             <tr>
                                                 <td class="title">
-                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RECALL.biblionumber %]">
-                                                        [% RECALL.biblio.title %]
+                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RECALL.biblionumber | html %]">
+                                                        [% RECALL.biblio.title | html %]
                                                         [% FOREACH s IN RECALL.biblio.subtitles %]
-                                                            [% s %]
+                                                            [% s | html %]
                                                         [% END %]
-                                                        [% RECALL.item.enumchron %]
+                                                        [% RECALL.item.enumchron | html %]
                                                     </a>
-                                                    [% RECALL.biblio.author %]
+                                                    [% RECALL.biblio.author | html %]
                                                 </td>
                                                 <td class="recalldate">
-                                                    <span title="[% RECALL.recalldate %]">
+                                                    <span title="[% RECALL.recalldate | html %]">
                                                         <span class="tdlabel">Recall date:</span>
                                                         [% RECALL.recalldate | $KohaDates %]
                                                     </span>
@@ -824,7 +824,7 @@
                                                 <td class="expirationdate">
                                                     [% IF ( RECALL.is_waiting ) %]
                                                         [% IF ( RECALL.expirationdate ) %]
-                                                            <span title="[% RECALL.expirationdate %]">
+                                                            <span title="[% RECALL.expirationdate | html %]">
                                                                 <span class="tdlabel">Expiration:</span>
                                                                     [% RECALL.expirationdate | $KohaDates %]
                                                             </span>
@@ -835,7 +835,7 @@
                                                             </span>
                                                         [% END %]
                                                     [% ELSIF ( RECALL.has_expired && RECALL.expirationdate ) %]
-                                                        <span title="[% RECALL.expirationdate %]" class="overdue">
+                                                        <span title="[% RECALL.expirationdate | html %]" class="overdue">
                                                             <span class="tdlabel">Expiration:</span>
                                                             [% RECALL.expirationdate | $KohaDates %]
                                                         </span>
@@ -845,7 +845,7 @@
                                                 </td>
                                                 <td class="branch">
                                                     <span class="tdlabel">Pick up location:</span>
-                                                    [% RECALL.library.branchname %]
+                                                    [% RECALL.library.branchname | html %]
                                                 </td>
                                                 <td class="status">
                                                     <span class="tdlabel">Status:</span>
@@ -861,8 +861,8 @@
                                                     [% IF ( !RECALL.cancellationdate && ( RECALL.is_requested || RECALL.is_overdue || RECALL.status == 'T' ) ) %]
                                                         <form action="/cgi-bin/koha/opac-recall.pl" method="post">
                                                             <input type="hidden" name="op" value="cancel">
-                                                            <input type="hidden" name="recall_id" value="[% RECALL.recall_id %]">
-                                                            <input type="hidden" name="itemnumber" value="[% RECALL.itemnumber %]">
+                                                            <input type="hidden" name="recall_id" value="[% RECALL.recall_id | html %]">
+                                                            <input type="hidden" name="itemnumber" value="[% RECALL.itemnumber | html %]">
                                                             <button type="submit" name="submit" class="btn btn-sm btn-danger" id="cancel_recall"><i class="icon-remove icon-white"></i> Cancel</button>
                                                         </form>
                                                     [% END %]
-- 
2.19.1