From 0a24e721dda54e67759c7c10d956ee63da6b8ec5 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <phil@chetcolibrary.org>
Date: Tue, 28 Apr 2020 17:16:51 -0700
Subject: [PATCH] Bug 25308: Escape querystring for Z39.50 popup from
 cataloging

Test plan:

1. For bonus fun, Administration -> MARC Frameworks -> New framework,
with the code A&B and description Ants & Bees
2. In the A&B Actions menu, choose MARC structure since Import won't
work
3. Accept the offer to copy in structure from default
4. Cataloging -> New record -> Ants & Bees
5. Type This & That in the 245$a (and for extra credit, in 020$a, and
create an author authority with an & in it so you can put it in the
100/110)
6. Click Z39.50/SRU search, make sure everything you typed is prefilled
including the parts after &
7. Search for anything that will retrieve a record (the ISBN This &
That probably won't), choose Import
8. Check that the record came back, and verify in the Settings menu that
it's still in the Ants & Bees framework.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 .../intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
index bd7cc15165..66d253e363 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
@@ -442,7 +442,7 @@
      */
     function GetZ3950Terms(){
         var frameworkcode = document.getElementById("frameworkcode").value;
-        var strQuery = "&frameworkcode=" + frameworkcode;
+        var strQuery = "&frameworkcode=" + encodeURIComponent(frameworkcode);
         var mandatories = new Array();
         var mandatories_label = new Array();
         [% FOREACH BIG_LOO IN BIG_LOOP %]
@@ -459,7 +459,7 @@
         for(var i=0,len=mandatories.length; i<len ; i++){
             var field_value = document.getElementById(mandatories[i]).value;
             if( field_value ){
-                strQuery += "&"+mandatories_label[i]+"="+field_value;
+                strQuery += "&"+encodeURIComponent(mandatories_label[i])+"="+encodeURIComponent(field_value);
             }
         }
         return strQuery;
-- 
2.39.5