From 12118778b792a6ebcde76bc52c34eafbf1b5b5c8 Mon Sep 17 00:00:00 2001
From: tipaul <tipaul>
Date: Thu, 19 Dec 2002 14:21:54 +0000
Subject: [PATCH] bugfix for bug #149 (" and ' escaping)

---
 .../default/en/parameters/branches.tmpl       | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/default/en/parameters/branches.tmpl b/koha-tmpl/intranet-tmpl/default/en/parameters/branches.tmpl
index 99b82e8949..5003402652 100644
--- a/koha-tmpl/intranet-tmpl/default/en/parameters/branches.tmpl
+++ b/koha-tmpl/intranet-tmpl/default/en/parameters/branches.tmpl
@@ -9,18 +9,18 @@
 <form action='<TMPL_VAR name=action>' name=Aform method=post>
 <input type=hidden name=op value='add_validate'>
 <table>
-<tr><td>Branch code</td><td><input type=text name=branchcode size=5 maxlength=5 value='<TMPL_VAR name=branchcode>'</td></tr>
-<tr><td>Name</td><td><input type=text name=branchname size=40 maxlength=80 value='<TMPL_VAR name=branchname>'}'>&nbsp;</td></tr>
+<tr><td>Branch code</td><td><input type=text name=branchcode size=5 maxlength=5 value='<TMPL_VAR name=branchcode escape="HTML">'</td></tr>
+<tr><td>Name</td><td><input type=text name=branchname size=40 maxlength=80 value="<TMPL_VAR name=branchname escape="HTML">">&nbsp;</td></tr>
 <FONT SIZE=6><em><TMPL_VAR name=head></em></FONT><br>
 <tr><td><TMPL_VAR name=categoryname></td>
 <td><INPUT TYPE="checkbox" NAME="<TMPL_VAR name=categorycode>" VALUE="1" ><TMPL_VAR name=codedescription></td></tr>
-<tr><td>Address</td><td><input type=text name=branchaddress1 value='<TMPL_VAR name=branchaddress1>'></td></tr>
-<tr><td>&nbsp;</td><td><input type=text name=branchaddress2 value='<TMPL_VAR name=branchaddress2>'></td></tr>
-<tr><td>&nbsp;</td><td><input type=text name=branchaddress3 value='<TMPL_VAR name=branchaddress3>'></td></tr>
-<tr><td>Phone</td><td><input type=text name=branchphone value='<TMPL_VAR name=branchphone>'></td></tr>
-<tr><td>Fax</td><td><input type=text name=branchfax value='<TMPL_VAR name=branchfax>'></td></tr>
-<tr><td>E-mail</td><td><input type=text name=branchemail value='<TMPL_VAR name=branchemail>'></td></tr>
-<tr><td>&nbsp;</td><td><input type=submit value='Submit'></td></tr> 
+<tr><td>Address</td><td><input type=text name=branchaddress1 value='<TMPL_VAR name=branchaddress1 escape="HTML">'></td></tr>
+<tr><td>&nbsp;</td><td><input type=text name=branchaddress2 value='<TMPL_VAR name=branchaddress2 escape="HTML">'></td></tr>
+<tr><td>&nbsp;</td><td><input type=text name=branchaddress3 value='<TMPL_VAR name=branchaddress3 escape="HTML">'></td></tr>
+<tr><td>Phone</td><td><input type=text name=branchphone value='<TMPL_VAR name=branchphone escape="HTML">'></td></tr>
+<tr><td>Fax</td><td><input type=text name=branchfax value='<TMPL_VAR name=branchfax escape="HTML">'></td></tr>
+<tr><td>E-mail</td><td><input type=text name=branchemail value='<TMPL_VAR name=branchemail escape="HTML">'></td></tr>
+<tr><td>&nbsp;</td><td><input type=submit value='Submit'></td></tr>
 </table>
 </form>
 </TMPL_IF>
@@ -28,7 +28,7 @@
 <TMPL_IF name="delete_confirm">
 Confirm delete:
 <form action='<TMPL_VAR name=action>' method=post><input type='hidden' name='op' value='delete_confirmed'>
-<input type='hidden' name='branchcode' value=<TMPL_VAR name=branchcode>>
+<input type='hidden' name='branchcode' value=<TMPL_VAR name=branchcode escape="HTML">>
 <input type=submit value=YES></form>
 <form action='<TMPL_VAR name=action>' method=post><input type='hidden' name='op' value=''>
 <input type=submit value=NO></form>
@@ -50,18 +50,18 @@ Confirm delete:
 </tr>
 <TMPL_LOOP name="branches">
 <tr bgcolor='<TMPL_VAR name=color>'>
-    <td align='left' valign='top'><TMPL_VAR name=branch_name></td>
-    <td align='left' valign='top'><TMPL_VAR name=branch_code></td>
-    <td align='left' valign='top'><TMPL_VAR name=address></td>
-    <td align='left' valign='top'><TMPL_VAR name=categories></td>
+    <td align='left' valign='top'><TMPL_VAR name=branch_name escape="HTML"></td>
+    <td align='left' valign='top'><TMPL_VAR name=branch_code> escape="HTML"</td>
+    <td align='left' valign='top'><TMPL_VAR name=address escape="HTML"></td>
+    <td align='left' valign='top'><TMPL_VAR name=categories escape="HTML"></td>
     <td align='left' valign='top'> 
 <form action='<TMPL_VAR name=action>' method=post>
 <input type='hidden' name='op' value='edit'>
-<input type='hidden' name='branchcode' value='<TMPL_VAR name=value>'>
+<input type='hidden' name='branchcode' value='<TMPL_VAR name=value escape="HTML">'>
 <input type=submit value=Edit>
 </form>
 <form action='<TMPL_VAR name=action>' method=post>
-<input type='hidden' name='branchcode' value='<TMPL_VAR name=value>'>
+<input type='hidden' name='branchcode' value='<TMPL_VAR name=value escape="HTML">'>
 <input type='hidden' name='op' value='delete'><input type=submit value=Delete>
 </form></td>
 </tr>
-- 
2.39.2