Bug 13041

Summary: Can't add user as manager of basket if name includes a single quote
Product: Koha Reporter: Owen Leonard <oleonard>
Component: AcquisitionsAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: brendan, chris, julian.maurice, katrin.fischer, veron
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 16386    
Bug Blocks: 16450, 16457    
Attachments: Bug 13041 - Can't add user as manager of basket if name includes a single quote
Bug 13041 - Can't add user as manager of basket if name includes a single quote
[PASSED QA] Bug 16386 - Replace the use of "onclick" from patron card creator templates
[PASSED QA] Bug 13041 - Can't add user as manager of basket if name includes a single quote
[3.22.x] Bug 13041: Fix add of basket's manager when name contains a single quote

Description Owen Leonard 2014-10-08 12:37:54 UTC
If you try to add a user as a manager of a basket and the user's name contains a single quote it will trigger a JavaScript error and the operation will fail without any visible error.
Comment 1 Owen Leonard 2016-05-04 14:08:24 UTC Comment hidden (obsolete)
Comment 2 Marc Véron 2016-05-05 14:07:32 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-05-05 21:57:17 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2016-05-05 22:08:14 UTC
Created attachment 51266 [details] [review]
[PASSED QA] Bug 13041 - Can't add user as manager of basket if name includes a single quote

If you are trying to add a user as a manager of a basket in
acquisitions, a JavaScript error will be triggered if that user has a
single quote in their name (e.g. "O'Neil"). This patch corrects the
issue by removing the "onclick" attribute and using the JS change made
in Bug 16386.

Also changed by this patch: Increased the size of the patron search
popup and made a correction to some invalid HTML.

To test you should have a patron whose name contains a single quote who
is also a user with permission to manage acquisitions.

- Apply the patch and go to Acquisitions.
- Locate an open basket and view the details for that basket.
- In the "Managed by" section, click the "Add user" button to trigger
  the patron search popup.
- Search for the patron described above and click the "Add" button.
- In the parent window, the patron you chose should have been added to
  the "Managed by" section.

Tested on top of Bug 16383, behaves as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Brendan Gallagher 2016-05-06 04:24:54 UTC
Pushed to Master - Should be in the May 2016 Release.  Thanks!
Comment 6 Julian Maurice 2016-05-09 09:46:20 UTC
Created attachment 51321 [details] [review]
[3.22.x] Bug 13041: Fix add of basket's manager when name contains a single quote

Patch for 3.22.x
Comment 7 Julian Maurice 2016-05-09 09:46:53 UTC
Patch pushed to 3.22.x, will be in 3.22.7
Comment 8 Chris Cormack 2016-06-19 21:29:06 UTC
Pushed to 3.20.x will be in 3.20.11