From 827da7b676d8cbe42f696613541d1217d3f9370a Mon Sep 17 00:00:00 2001
From: Mark Tompsett <mtompset@hotmail.com>
Date: Fri, 14 Sep 2018 16:06:49 -0700
Subject: [PATCH] Bug 21349: Instructors with special characters in cardnumber
 cannot be removed from course reserves

The cardnumber can contain strange non-javascript-friendly
characters. This patch converts all the internal references
to borrowernumber, but displays the cardnumber when showing
list of matching users.

TEST PLAN
---------
1) Make sure Course Reserves is being used. Check system preferences.
2) Make sure there is a Course entered.
3) Make sure there is a patron with an cardnumber which breaks
   the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!)
4) Go into the course list.
5) Click the course name link
6) In the "Instructor Search" box enter the patron name.
7) Select the patron which has the ugly cardnumber.
8) Click Save
   -- The course listing should have the new teacher listed.
9) Click the course name link again.
10) Click 'Remove' beside the instructor's name.
    -- nothing happens, and inspecting the error console gives
       you the ugly error described in comment #0
11) apply this patch
12) restart_all
13) sudo service apache2 restart
14) refresh the page.
15) click 'Remove' beside the instructor's name.
    -- name is removed.
16) Click Save
    -- the course listing no longer lists the new teacher.
17) Actually confirm that adding and removing others normally
    works as expected.
18) run koha qa test tools.

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

(cherry picked from commit 2ca766f39245e1c3bd9b4acc9ce01a9eeaec8a56)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 course_reserves/mod_course.pl                  |  2 +-
 .../prog/en/modules/course_reserves/course.tt  | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/course_reserves/mod_course.pl b/course_reserves/mod_course.pl
index 16a959b039..cef6988e88 100755
--- a/course_reserves/mod_course.pl
+++ b/course_reserves/mod_course.pl
@@ -62,7 +62,7 @@ if ( $action eq 'del' ) {
     my @instructors = $cgi->multi_param('instructors');
     ModCourseInstructors(
         mode        => 'replace',
-        cardnumbers => \@instructors,
+        borrowernumbers => \@instructors,
         course_id   => $new_course_id
     );
     print $cgi->redirect("/cgi-bin/koha/course_reserves/course-details.pl?course_id=$new_course_id");
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
index a0978c9c7e..7bed332bdb 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
@@ -79,8 +79,8 @@
                             <span class="label">Instructors:</span>
 
                             <fieldset id="course_instructors">
-                                 <div id="instructors">[% FOREACH i IN instructors %]<div id="borrower_[% i.cardnumber %]">[% i.surname %], [% i.firstname %] ( <a href="#" class="removeInstructor"> Remove </a> )
-                                             <input type='hidden' name='instructors' value='[% i.cardnumber %]' /></div>[% END %]</div>
+                                 <div id="instructors">[% FOREACH i IN instructors %]<div id="borrower_[% i.borrowernumber | html %]">[% i.surname | html %], [% i.firstname | html %] ( <a href="#" class="removeInstructor"> Remove </a> )
+                                             <input type='hidden' name='instructors' value='[% i.borrowernumber | html %]' /></div>[% END %]</div>
                             </fieldset>
 
                             <fieldset>
@@ -150,7 +150,7 @@
                     source: "/cgi-bin/koha/circ/ysearch.pl",
                     minLength: 3,
                     select: function( event, ui ) {
-                        AddInstructor( ui.item.surname + ", " + ui.item.firstname, ui.item.cardnumber );
+                        AddInstructor( ui.item.surname + ", " + ui.item.firstname, ui.item.borrowernumber );
                         return false;
                     }
                 })
@@ -168,21 +168,21 @@
                 $("body").on("click",".removeInstructor",function(e){
                     e.preventDefault();
                     var divid = $(this).parent().attr("id");
-                    var cardnumber = divid.replace("borrower_","");
-                    RemoveInstructor(cardnumber);
+                    var borrowernumber = divid.replace("borrower_","");
+                    RemoveInstructor(borrowernumber);
                 });
             });
 
-            function AddInstructor( name, cardnumber ) {
-                div = "<div id='borrower_" + cardnumber + "'>" + name + " ( <a href='#' class='removeInstructor'> " + _("Remove")+ " </a> ) <input type='hidden' name='instructors' value='" + cardnumber + "' /></div>";
+            function AddInstructor( name, borrowernumber ) {
+                div = "<div id='borrower_" + borrowernumber + "'>" + name + " ( <a href='#' class='removeInstructor'> " + _("Remove")+ " </a> ) <input type='hidden' name='instructors' value='" + borrowernumber + "' /></div>";
                 $('#instructors').append( div );
 
                 $('#find_instructor').val('').focus();
                 $('#course_instructors').show();
             }
 
-            function RemoveInstructor( cardnumber ) {
-                $( '#borrower_' + cardnumber ).remove();
+            function RemoveInstructor( borrowernumber ) {
+                $( '#borrower_' + borrowernumber ).remove();
 
                 if ( ! $('#instructors').html() ) {
                     $('#course_instructors').hide( 800 );
-- 
2.20.1