Bug 19086: Fix Stored XSS in members/member.pl
[koha-ffzg.git] / koha-tmpl / intranet-tmpl / prog / en / modules / members / member.tt
index 074555b..73598d8 100644 (file)
@@ -5,13 +5,13 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons [% IF ( searching ) %]&rsaquo; Search results[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-<link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
+<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
 [% INCLUDE 'datatables.inc' %]
 [% INCLUDE 'columns_settings.inc' %]
 <script type="text/javascript">
 //<![CDATA[
 $(document).ready(function() {
-    $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+    $('#add_to_patron_list_submit').prop('disabled', true);
     $('#new_patron_list').hide();
 
     $('#add_to_patron_list').change(function() {
@@ -22,22 +22,21 @@ $(document).ready(function() {
             $('#new_patron_list').focus();
         } else if ( value ) {
             $('#new_patron_list').hide();
-            $('#add_to_patron_list_submit').removeAttr('disabled');
+            $('#add_to_patron_list_submit').prop('disabled', false);
         } else {
             $('#new_patron_list').hide();
-            $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+            $('#add_to_patron_list_submit').prop('disabled', true);
         }
     });
 
     $('#new_patron_list').on('input', function() {
         if ( $('#new_patron_list').val() ) {
-            $('#add_to_patron_list_submit').removeAttr('disabled');
+            $('#add_to_patron_list_submit').prop('disabled', false);
         } else {
-            $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+            $('#add_to_patron_list_submit').prop('disabled', true);
         }
     });
 
-    $("#patron_list_dialog").hide();
     $("#add_to_patron_list_submit").on('click', function(e){
         if ( $('#add_to_patron_list').val() == 'new' ) {
             if ( $('#new_patron_list').val() ) {
@@ -93,13 +92,30 @@ $(document).ready(function() {
         });
         return true;
     });
+    $(".filterByLetter").on("click",function(e){
+        e.preventDefault();
+        filterByFirstLetterSurname($(this).text());
+    });
+    $("#select_all").on("click",function(e){
+        e.preventDefault();
+        $(".selection").prop("checked", true);
+    });
+    $("#clear_all").on("click",function(e){
+        e.preventDefault();
+        $(".selection").prop("checked", false);
+    });
+    $("#clear_search").on("click",function(e){
+        e.preventDefault();
+        clearFilters(true);
+    });
+    $("#searchform").on("submit", filter);
 });
 
 var dtMemberResults;
 var search = 1;
 $(document).ready(function() {
     [% IF searchmember %]
-        $("#searchmember_filter").val("[% searchmember %]");
+        $("#searchmember_filter").val("[% searchmember | html %]");
     [% END %]
     [% IF searchfieldstype %]
         $("searchfieldstype_filter").val("[% searchfieldstype %]");
@@ -115,8 +131,9 @@ $(document).ready(function() {
     [% END %]
 
     [% IF view != "show_results" %]
-        $("#searchresults").hide();
         search = 0;
+    [% ELSE %]
+        $("#searchresults").show();
     [% END %]
 
     // Build the aLengthMenu
@@ -145,6 +162,10 @@ $(document).ready(function() {
 
     // Apply DataTables on the results table
     var columns_settings = [% ColumnsSettings.GetColumns( 'members', 'member', 'memberresultst', 'json' ) %];
+    [% UNLESS CAN_user_tools_manage_patron_lists %]
+        [%# Remove the first column if we do not display the checkbox %]
+        columns_settings.splice(0, 1);
+    [% END %]
     dtMemberResults = KohaTable("#memberresultst", {
         'bServerSide': true,
         'sAjaxSource': "/cgi-bin/koha/svc/members/search",
@@ -215,7 +236,7 @@ $(document).ready(function() {
             { 'mDataProp': 'dt_od_checkouts', 'bSortable': false },
             { 'mDataProp': 'dt_fines', 'bSortable': false },
             { 'mDataProp': 'dt_borrowernotes' },
-            { 'mDataProp': 'dt_action', 'bSortable': false }
+            { 'mDataProp': 'dt_action', 'bSortable': false, 'sClass': 'actions' }
         ],
         'fnRowCallback': function(nRow, aData, iDisplayIndex, iDisplayIndexFull) {
             /* Center text for 6th column */
@@ -318,41 +339,32 @@ function filterByFirstLetterSurname(letter) {
           [% END %]
 
           [% INCLUDE 'patron-toolbar.inc' %]
-          [% IF ( no_add ) %]
-            <div class="dialog alert">
-              <h3>Cannot add patron</h3>
-              [% IF ( no_branches ) %]
-                <p>There are <strong>no libraries defined</strong>. [% IF ( CAN_user_parameters ) %]Please <a href="/cgi-bin/koha/admin/branches.pl">add a library</a>.[% ELSE %]An administrator must define at least one library.[% END %]</p>
-              [% END %]
-              [% IF ( no_categories ) %]
-                <p>There are <strong>no patron categories defined</strong>. [% IF ( CAN_user_parameters ) %]Please <a href="/cgi-bin/koha/admin/categories.pl">add a patron category</a>.[% ELSE %]An administrator must define at least one patron category.[% END %]</p>
-              [% END %]
-            </div>
-          [% END %]
+          [% INCLUDE 'noadd-warnings.inc' %]
+
           <div class="browse">
             Browse by last name:
             [% FOREACH letter IN alphabet.split(' ') %]
-              <a style="cursor:pointer" onclick="filterByFirstLetterSurname('[% letter %]');">[% letter %]</a>
+                <a href="#" class="filterByLetter">[% letter %]</a>
             [% END %]
           </div>
 
           [% IF ( CAN_user_borrowers && pending_borrower_modifications ) %]
             <div class="pending-info" id="patron_updates_pending">
               <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
-              <span class="holdcount"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
+              <span class="number_box"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
             </div>
           [% END %]
 
           <div id="searchresults">
             <div id="searchheader">
-              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember %]'[% END %]</span></h3>
+              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember | html %]'[% END %]</span></h3>
             </div>
             [% IF CAN_user_tools_manage_patron_lists %]
               <div id="searchheader">
                   <div>
-                      <a href="javascript:void(0)" onclick="$('.selection').prop('checked', true)">Select all</a>
+                      <a href="#" id="select_all"><i class="fa fa-check"></i> Select all</a>
                       |
-                      <a href="javascript:void(0)" onclick="$('.selection').prop('checked', false)">Clear all</a>
+                      <a href="#" id="clear_all"><i class="fa fa-remove"></i> Clear all</a>
                       |
                       <span>
                           <label for="add_to_patron_list">Add selected patrons to:</label>
@@ -385,7 +397,7 @@ function filterByFirstLetterSurname(letter) {
                 [% END %]
                   <th>Card</th>
                   <th>Name</th>
-                  <th>Date of birth</>
+                  <th>Date of birth</th>
                   <th>Category</th>
                   <th>Library</th>
                   <th>Expires on</th>
@@ -402,7 +414,7 @@ function filterByFirstLetterSurname(letter) {
       </div>
     </div>
     <div class="yui-b">
-      <form onsubmit="return filter();" id="searchform">
+      <form method="get" id="searchform">
         <input type="hidden" id="firstletter_filter" value="" />
         <fieldset class="brief">
           <h3>Filters</h3>
@@ -419,6 +431,11 @@ function filterByFirstLetterSurname(letter) {
                 [% ELSE %]
                   <option value='standard'>Standard</option>
                 [% END %]
+                [% IF searchfieldstype == "surname" %]
+                  <option selected="selected" value='surname'>Surname</option>
+                [% ELSE %]
+                  <option value='surname'>Surname</option>
+                [% END %]
                 [% IF searchfieldstype == "email" %]
                   <option selected="selected" value='email'>Email</option>
                 [% ELSE %]
@@ -464,21 +481,22 @@ function filterByFirstLetterSurname(letter) {
             <li>
               <label for="searchtype_filter">Search type:</label>
               <select name="searchtype" id="searchtype_filter">
-                <option value='start_with'>Starts with</option>
-                [% IF searchtype == "contain" %]
-                  <option value="contain" selected="selected">Contains</option>
+                [% IF searchtype == "start_with" %]
+                  <option value='start_with' selected="selected">Starts with</option>
+                  <option value="contain">Contains</option>
                 [% ELSE %]
+                  <option value='start_with'>Starts with</option>
                   <option value="contain" selected="selected">Contains</option>
                 [% END %]
               </select>
             </li>
             <li>
               <label for="categorycode_filter">Category:</label>
-              [% SET categories = Categories.all( selected => categorycode_filter ) %]
+              [% SET categories = Categories.all() %]
               <select id="categorycode_filter">
                 <option value="">Any</option>
                 [% FOREACH cat IN categories %]
-                  [% IF cat.selected %]
+                  [% IF cat.categorycode == categorycode_filter %]
                     <option selected="selected" value="[% cat.categorycode %]">[% cat.description %]</option>
                   [% ELSE %]
                     <option value="[% cat.categorycode %]">[% cat.description %]</option>
@@ -493,19 +511,13 @@ function filterByFirstLetterSurname(letter) {
                 [% IF branches.size != 1 %]
                   <option value="">Any</option>
                 [% END %]
-                [% FOREACH b IN branches %]
-                  [% IF b.selected %]
-                    <option selected="selected" value="[% b.branchcode %]">[% b.branchname %]</option>
-                  [% ELSE %]
-                    <option value="[% b.branchcode %]">[% b.branchname %]</option>
-                  [% END %]
-                [% END %]
+                [% PROCESS options_for_libraries libraries => branches %]
               </select>
             </li>
           </ol>
           <fieldset class="action">
             <input type="submit" value="Search" />
-            <input type="button" value="Clear" onclick="clearFilters(true);" />
+            <input type="button" value="Clear" id="clear_search" />
           </fieldset>
         </fieldset>
       </form>