From 09f869d4f8ede5138415171980e5c1690d2c88a6 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Wed, 11 Nov 2020 03:11:56 +0000
Subject: [PATCH] Bug 26988: (follow-up) Fix filter and encode api values and
 escape rendered values

This patch makes the QA tools happy and follows correct procedures for passing data to
and rendering data from the api

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 19a30acaece904aeedcc6a3728e3815895d10c56)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc | 2 +-
 koha-tmpl/intranet-tmpl/prog/js/holds.js                 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
index 46420c6c75..2fc24af00d 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
@@ -134,7 +134,7 @@
                             <option selected="selected" value="[% hold.branchcode | html %]">[% Branches.GetName(hold.branchcode) | html %]</option>
                             <option value="" disabled="disabled" class="loading">Loading...</option>
                         </select>
-                        <img class="loading_[% hold.reserve_id %]" src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" style="display:none;"/>
+                        <img class="loading_[% hold.reserve_id | html %]" src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" style="display:none;"/>
                     [% END %]
                 [% END %]
             </td>
diff --git a/koha-tmpl/intranet-tmpl/prog/js/holds.js b/koha-tmpl/intranet-tmpl/prog/js/holds.js
index d720e54dbd..c7e6efd9ec 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/holds.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/holds.js
@@ -301,7 +301,7 @@ $(document).ready(function() {
         var hold_id = $(this).data('hold_id');
         $(".loading_"+hold_id).show();
         var preselected = $(this).data('selected');
-        var api_url = '/api/v1/holds/'+hold_id+'/pickup_locations';
+        var api_url = '/api/v1/holds/' + encodeURIComponent(hold_id) + '/pickup_locations';
         $.ajax({
             method: "GET",
             url: api_url,
@@ -311,7 +311,7 @@ $(document).ready(function() {
                     if( preselected == library.library_id ){
                         selected = ' selected="selected" ';
                     } else { selected = ""; }
-                    dropdown += '<option value="'+library.library_id+'"'+selected+'>'+library.name+'</option>';
+                    dropdown += '<option value="' + library.library_id.escapeHtml() + '"' + selected + '>' + library.name.escapeHtml() + '</option>';
                 });
                 this_dropdown.html(dropdown);
                 this_dropdown.data("loaded",1);
-- 
2.39.5