When someone uses \ in the description of a list, the datatable in staff
won't load and keeps processing.
Test plan:
- Create a list named "<script>alert('hola');</script>"
- Create another list named "k\o\h\a"
- Hit /cgi-bin/koha/virtualshelves/shelves.pl
=> Without this patch the lists will not be displayed, JSON is
malformated
=> With this patch everything is ok
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit
2be0195895628ec491ee1f25368e60181c4f1eb2)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
"dt_type":
"[% data.type | html %]",
"dt_shelfname":
- "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% data.shelfname | html %]</a>",
+ "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% To.json(data.shelfname) | html%]</a>",
"dt_count":
"[% data.count | html %] item(s)",
"dt_is_shared":
"[% IF data.type == 2 %]Public[% ELSIF data.is_shared %]Shared[% ELSE %]Private[% END %]",
"dt_owner":
- "<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% data.firstname | html %] [% data.surname | html %]</a>",
+ "<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% To.json(data.firstname) | html %] [% To.json(data.surname) | html %]</a>",
"dt_sortby":
[% IF data.sortby == "author" %]"Author"[% ELSIF data.sortby == "copyrightdate" %]"Year"[% ELSIF data.sortby == "itemcallnumber" %]"Call number"[% ELSIF data.sortby == "dateadded" %]"Date added"[% ELSE %]"Title"[% END %],
"dt_created_on":