From a94dd70bd8939d625cf04d2c254ba3a01094749f Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 20 Dec 2018 19:23:48 -0300
Subject: [PATCH] DO NOT PUSH - example of building filters for uri parameters

https://bugs.koha-community.org/show_bug.cgi?id=21460
---
 koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt | 11 +++++++++++
 mainpage.pl                                              |  7 +++++++
 2 files changed, 18 insertions(+)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
index ab04abbcd9..446d64d49e 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
@@ -16,6 +16,17 @@
     <div id="container-main" class="container-fluid">
         <div class="row">
             <div class="col-sm-3">
+
+<a href="/cgi-bin/koha/mainpage.pl?[% p_1 | $raw %]">p_1 raw</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_1 | html %]">p_1 html</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_1 | uri %]">p_1 uri</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_1 | url %]">p_1 url</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_2.var | html %]=[% p_2.value | html %]">p_2 html</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_2.var | uri %]=[% p_2.value | uri %]">p_2 uri</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_2.var | url %]=[% p_2.value | url %]">p_2 url</a>
+<a href="/cgi-bin/koha/mainpage.pl?[% p_3.var %]=[% p_3.value %]">p_3 url</a>
+
+
                 [% IF ( koha_news_count ) %]
                     <div id="area-news">
                         <h3><span class="news_title">News</span></h3>
diff --git a/mainpage.pl b/mainpage.pl
index da6aaee924..8e8f73fae4 100755
--- a/mainpage.pl
+++ b/mainpage.pl
@@ -21,6 +21,7 @@
 
 use Modern::Perl;
 use CGI qw ( -utf8 );
+use URI::Escape qw( uri_escape_utf8 );
 use C4::Output;
 use C4::Auth;
 use C4::Koha;
@@ -75,6 +76,9 @@ my $pending_article_requests = Koha::ArticleRequests->search_limited(
     }
 )->count;
 
+warn $query->param('a_var');
+my $var = "a_var";
+my $value = "a<v&al=>";
 $template->param(
     pendingcomments                => $pendingcomments,
     pendingtags                    => $pendingtags,
@@ -82,6 +86,9 @@ $template->param(
     pending_borrower_modifications => $pending_borrower_modifications,
     pending_discharge_requests     => $pending_discharge_requests,
     pending_article_requests       => $pending_article_requests,
+    p_1 => "$var=$value",
+    p_2 => { var => $var, value => $value, },
+    p_3 => { var => uri_escape_utf8($var), value => uri_escape_utf8($value), },
 );
 
 output_html_with_http_headers $query, $cookie, $template->output;
-- 
2.11.0