Browse Source

Bug 20891: Escape list's names in JSON

When someone uses \ in the description of a list, the datatable in staff
won't load and keeps processing.

Test plan:
- Create a list named "<script>alert('hola');</script>"
- Create another list named "k\o\h\a"
- Hit /cgi-bin/koha/virtualshelves/shelves.pl

=> Without this patch the lists will not be displayed, JSON is
malformated
=> With this patch everything is ok

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
19.05.x
Jonathan Druart 3 years ago
committed by Nick Clemens
parent
commit
2be0195895
  1. 4
      koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt

4
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt

@ -11,13 +11,13 @@
"dt_type":
"[% data.type | html %]",
"dt_shelfname":
"<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% data.shelfname | html %]</a>",
"<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% To.json(data.shelfname) | html%]</a>",
"dt_count":
"[% data.count | html %] item(s)",
"dt_is_shared":
"[% IF data.type == 2 %]Public[% ELSIF data.is_shared %]Shared[% ELSE %]Private[% END %]",
"dt_owner":
"<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% data.firstname | html %] [% data.surname | html %]</a>",
"<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% To.json(data.firstname) | html %] [% To.json(data.surname) | html %]</a>",
"dt_sortby":
[% IF data.sortby == "author" %]"Author"[% ELSIF data.sortby == "copyrightdate" %]"Year"[% ELSIF data.sortby == "itemcallnumber" %]"Call number"[% ELSIF data.sortby == "dateadded" %]"Date added"[% ELSE %]"Title"[% END %],
"dt_created_on":

Loading…
Cancel
Save