From e3aa4ddf6106b4e0ed3f4b441681c3a911c36d1a Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 6 May 2020 10:34:09 -0300
Subject: [PATCH] Bug 25279: URI-escape city_id in links

This patch escapes city_id uses in URLs, and also removes redundant dom
entry as this is inherited from the global datatables configuration
anyway.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index f25a6e8fd0..c5287fd9b7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -181,7 +181,6 @@
                 "ajax": {
                     "url": cities_table_url
                 },
-                'dom': 'C<"top pager"ilpfB><"#filter_c">tr<"bottom pager"ip>',
                 "order": [[ 1, "asc" ]],
                 "columnDefs": [ {
                     "targets": [0,1,2,3,4],
@@ -221,8 +220,8 @@
                     {
                         "data": function( row, type, val, meta ) {
 
-                            var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid='+ row.city_id +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
-                            result += '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid='+ row.city_id +'"><i class="fa fa-trash" aria-hidden="true"></i> '+_("Delete")+'</a>';
+                            var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid='+ encodeURIComponent(row.city_id) +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
+                            result += '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid='+ encodeURIComponent(row.city_id) +'"><i class="fa fa-trash" aria-hidden="true"></i> '+_("Delete")+'</a>';
                             return result;
 
                         },
-- 
2.39.5