From 45d19c6c77031c2ca62234ad190066fed3fa48f0 Mon Sep 17 00:00:00 2001
From: Lari Taskula <lari.taskula@hypernova.fi>
Date: Fri, 16 Sep 2022 14:05:15 +0000
Subject: [PATCH] Bug 31565: Escape datatables MySQL special characters only in
 LIKE queries

Escaping \ yields no results when performing exact search in datatables.
This patch adds MySQL special character escaping only to LIKE searches.

To test:
1. Add following categorycode 'TEST\CAT' by SQL
insert into categories (categorycode,description) values ('TEST\\CAT', 'TEST\\CAT');
2. Add a patron into TEST\CAT category
3. Go to patron search
4. Limit search by category TEST\CAT
5. Observe no results
6. Apply patch
7. Refresh patron search page
8. Limit search by category TEST\CAT
9. Observe Koha redirecting you to patron you chose in step 2

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 koha-tmpl/intranet-tmpl/prog/js/datatables.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/js/datatables.js b/koha-tmpl/intranet-tmpl/prog/js/datatables.js
index 197c2e09fd..a22d5dd4d5 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/datatables.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/datatables.js
@@ -578,9 +578,6 @@ jQuery.fn.dataTable.ext.errMode = function(settings, note, message) {
 
                                 function build_query(col, value){
 
-                                    // escape SQL special character \
-                                    value = value.replace(/(\\)/g, "\\$1" );
-
                                     var parts = [];
                                     var attributes = col.data.split(':');
                                     for (var i=0;i<attributes.length;i++){
@@ -592,7 +589,7 @@ jQuery.fn.dataTable.ext.errMode = function(settings, note, message) {
                                             criteria = "exact";
                                         } else {
                                            // escape SQL LIKE special characters % and _
-                                           value = value.replace(/(\%|\_)/g, "\\$1");
+                                           value = value.replace(/(\%|\_|\\)/g, "\\$1");
                                         }
                                         part[!attr.includes('.')?'me.'+attr:attr] = criteria === 'exact'
                                             ? value
-- 
2.39.5