Koha/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
Jonathan Druart bdf0d85c1d Bug 20891: Escape html then JSON
To my understanding we need to escape first html chars then to JSON.

If this patch works we will need to rethink the 'To' TT plugin.
It was originally designed to have several escape methods, but with
these changes it will not make sense to name it 'To' if used only to
escape JSON

IIRC we should keep the 2 different ways to use it:
 * [% To.json( string ) %]
 * [% string | $To %]
otherwise it will be hard to use it when called in argument of
patron-title.inc (`git grep To.json`)

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2019-04-25 10:27:27 +00:00

62 lines
3.6 KiB
Text

[% USE raw %]
[% USE KohaDates %]
[% USE To %]
{
"sEcho": [% sEcho | html %],
"iTotalRecords": [% iTotalRecords | html %],
"iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
"aaData": [
[% FOREACH data IN aaData %]
{
"dt_type":
"[% data.type | html %]",
"dt_shelfname":
"<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% data.shelfname | html | $To %]</a>",
"dt_count":
"[% data.count | html %] item(s)",
"dt_is_shared":
"[% IF data.type == 2 %]Public[% ELSIF data.is_shared %]Shared[% ELSE %]Private[% END %]",
"dt_owner":
"<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% data.firstname | html | $To %] [% data.surname | html | $To %]</a>",
"dt_sortby":
[% IF data.sortby == "author" %]"Author"[% ELSIF data.sortby == "copyrightdate" %]"Year"[% ELSIF data.sortby == "itemcallnumber" %]"Call number"[% ELSIF data.sortby == "dateadded" %]"Date added"[% ELSE %]"Title"[% END %],
"dt_created_on":
"[% data.created_on | $KohaDates %]",
"dt_modification_time":
"[% data.modification_time | $KohaDates %]",
"dt_action":
"[% PROCESS action_form shelfnumber=data.shelfnumber can_manage_shelf=data.can_manage_shelf can_delete_shelf=data.can_delete_shelf type=data.type %]"
}[% UNLESS loop.last %],[% END %]
[% END %]
]
}
[% BLOCK action_form -%]
[%~ SET action_block = '' ~%]
[%~ IF can_manage_shelf OR can_delete_shelf ~%]
[%~ shelfnumber = shelfnumber | html ~%]
[%~ type = type | html ~%]
[%~ IF can_manage_shelf ~%]
[%~ action_block = '<form action="shelves.pl" method="get">' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' ~%]
[%~ action_block = action_block _ '<button class="editshelf btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</button>' ~%]
[%~ action_block = action_block _ '</form> ' ~%]
[%~ END ~%]
[%~ IF can_manage_shelf OR can_delete_shelf ~%]
[%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber _ '" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' ~%]
[%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' ~%]
[%~ action_block = action_block _ '<button type="submit" class="deleteshelf btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button>' ~%]
[%~ action_block = action_block _ '</form>' ~%]
[%~ END ~%]
[%~ ELSE ~%]
[%~ SET action_block = 'None' ~%]
[%~ END ~%]
[%~ To.json(action_block) | $raw ~%]
[%~ END ~%]