Bug 22781: Escape cardnumber, category's description, library's name and dateexpiry

This will fix the previous failure. Note that other fields like
borrowernumber, Price escaped values, integers, etc. could be escaped
the same way but will be useless (save polar bears).

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt
index 662f78b..4b4129e 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt
@@ -15,17 +15,17 @@
                     "<input type='checkbox' class='selection' name='borrowernumber' value='[% data.borrowernumber | html %]' />",
                 [% END %]
                 "dt_cardnumber":
-                    "[% data.cardnumber | html %]",
+                    "[% data.cardnumber | html | $To %]",
                 "dt_name":
                     "<a href=\"/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]\" class=\"patron_preview\" data-borrowernumber=\"[% data.borrowernumber | html %]\" style='white-space:nowrap'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) invert_name = 1 %]</a><br />[% INCLUDE escape_address data = data %][% IF data.email %]<br/>Email: <a href='mailto:[% data.email | html %]'>[% data.email | html %]</a>[% END %]",
     "dt_dateofbirth":
         "[% data.dateofbirth | $KohaDates %]",
                 "dt_category":
-                    "[% data.category_description | html %] ([% data.category_type | html %])",
+                    "[% data.category_description | html | $To %] ([% data.category_type | html | $To %])",
                 "dt_branch":
-                    "[% data.branchname | html %]",
+                    "[% data.branchname | html | $To %]",
                 "dt_dateexpiry":
-                    "[% data.dateexpiry | html %]",
+                    "[% data.dateexpiry | html | $To %]",
                 "dt_od_checkouts":
                     "[% IF data.overdues %]<span class='overdue'><strong>[% data.overdues | html %]</strong></span>[% ELSE %][% data.overdues | html %][% END %] / [% data.issues | html %]",
                 "dt_fines":