Koha/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt
Jonathan Druart 3a3057545c Bug 22781: Escape cardnumber, category's description, library's name and dateexpiry
This will fix the previous failure. Note that other fields like
borrowernumber, Price escaped values, integers, etc. could be escaped
the same way but will be useless (save polar bears).

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2019-05-15 12:10:53 +00:00

49 lines
3.1 KiB
Text

[% USE raw %]
[% USE To %]
[% USE AuthorisedValues %]
[% USE KohaDates %]
[% USE Price %]
{
"sEcho": [% sEcho | html %],
"iTotalRecords": [% iTotalRecords | html %],
"iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
"aaData": [
[% FOREACH data IN aaData %]
{
[% IF CAN_user_borrowers_edit_borrowers || CAN_user_tools_manage_patron_lists %]
"dt_borrowernumber":
"<input type='checkbox' class='selection' name='borrowernumber' value='[% data.borrowernumber | html %]' />",
[% END %]
"dt_cardnumber":
"[% data.cardnumber | html | $To %]",
"dt_name":
"<a href=\"/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]\" class=\"patron_preview\" data-borrowernumber=\"[% data.borrowernumber | html %]\" style='white-space:nowrap'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) invert_name = 1 %]</a><br />[% INCLUDE escape_address data = data %][% IF data.email %]<br/>Email: <a href='mailto:[% data.email | html %]'>[% data.email | html %]</a>[% END %]",
"dt_dateofbirth":
"[% data.dateofbirth | $KohaDates %]",
"dt_category":
"[% data.category_description | html | $To %] ([% data.category_type | html | $To %])",
"dt_branch":
"[% data.branchname | html | $To %]",
"dt_dateexpiry":
"[% data.dateexpiry | html | $To %]",
"dt_od_checkouts":
"[% IF data.overdues %]<span class='overdue'><strong>[% data.overdues | html %]</strong></span>[% ELSE %][% data.overdues | html %][% END %] / [% data.issues | html %]",
"dt_fines":
"<span style='text-align: right; display: block;'>[% IF data.fines < 0 %]<span class='credit'>[% data.fines | $Price %]</span> [% ELSIF data.fines > 0 %] <span class='debit'><strong>[% data.fines | $Price %]</strong></span> [% ELSE %] [% data.fines | $Price %] [% END %]</span>",
"dt_borrowernotes":
"[% data.borrowernotes | html_line_break | collapse | $To %]",
"dt_action":
"<a href='/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% data.borrowernumber | html %]' class='btn btn-default btn-xs'><i class='fa fa-pencil'></i> Edit</a>",
"borrowernumber":
"[% data.borrowernumber | html %]"
}[% UNLESS loop.last %],[% END %]
[% END %]
]
}
[% BLOCK escape_address %]
[%~ SET address = data.streetnumber _ ' ' %]
[%~ IF data.streettype %][% address = address _ AuthorisedValues.GetByCode( 'ROADTYPE', data.streettype ) _ ' ' | html %][% END %]
[%~ IF data.address %][% address = address _ data.address _ ' ' | html %][% END %]
[%~ IF data.address2 %][% address = address _ data.address2 _ ' ' | html %][% END %]
[%~ To.json( address ) | $raw ~%]
[% END %]