Bug 19086: Fix Stored XSS in members/member.pl
[koha-ffzg.git] / koha-tmpl / intranet-tmpl / prog / en / modules / members / member.tt
index aac6657..73598d8 100644 (file)
@@ -5,13 +5,13 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons [% IF ( searching ) %]&rsaquo; Search results[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-<link rel="stylesheet" type="text/css" href="[% themelang %]/css/datatables.css" />
+<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/datatables.css" />
 [% INCLUDE 'datatables.inc' %]
 [% INCLUDE 'columns_settings.inc' %]
 <script type="text/javascript">
 //<![CDATA[
 $(document).ready(function() {
-    $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+    $('#add_to_patron_list_submit').prop('disabled', true);
     $('#new_patron_list').hide();
 
     $('#add_to_patron_list').change(function() {
@@ -22,22 +22,21 @@ $(document).ready(function() {
             $('#new_patron_list').focus();
         } else if ( value ) {
             $('#new_patron_list').hide();
-            $('#add_to_patron_list_submit').removeAttr('disabled');
+            $('#add_to_patron_list_submit').prop('disabled', false);
         } else {
             $('#new_patron_list').hide();
-            $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+            $('#add_to_patron_list_submit').prop('disabled', true);
         }
     });
 
     $('#new_patron_list').on('input', function() {
         if ( $('#new_patron_list').val() ) {
-            $('#add_to_patron_list_submit').removeAttr('disabled');
+            $('#add_to_patron_list_submit').prop('disabled', false);
         } else {
-            $('#add_to_patron_list_submit').attr('disabled', 'disabled');
+            $('#add_to_patron_list_submit').prop('disabled', true);
         }
     });
 
-    $("#patron_list_dialog").hide();
     $("#add_to_patron_list_submit").on('click', function(e){
         if ( $('#add_to_patron_list').val() == 'new' ) {
             if ( $('#new_patron_list').val() ) {
@@ -76,6 +75,16 @@ $(document).ready(function() {
                 $("#patron_list_dialog > span.patrons-length").html(data.patrons_added_to_list);
                 $("#patron_list_dialog > a").attr("href", "/cgi-bin/koha/patron_lists/list.pl?patron_list_id=" + data.patron_list.patron_list_id);
                 $("#patron_list_dialog > a").html(data.patron_list.name);
+                if ( $('#add_to_patron_list').val() == 'new' ) {
+                    var new_patron_list_added = $("<option>", {
+                        value: data.patron_list.patron_list_id,
+                        text: data.patron_list.name
+                    });
+                    $("#add_to_patron_list optgroup").append(new_patron_list_added);
+                    $("#add_to_patron_list").val(data.patron_list.patron_list_id);
+                    $("#new_patron_list").val('');
+                    $('#add_to_patron_list').change();
+                }
             },
             error: function() {
                 alert("an error occurred");
@@ -83,13 +92,30 @@ $(document).ready(function() {
         });
         return true;
     });
+    $(".filterByLetter").on("click",function(e){
+        e.preventDefault();
+        filterByFirstLetterSurname($(this).text());
+    });
+    $("#select_all").on("click",function(e){
+        e.preventDefault();
+        $(".selection").prop("checked", true);
+    });
+    $("#clear_all").on("click",function(e){
+        e.preventDefault();
+        $(".selection").prop("checked", false);
+    });
+    $("#clear_search").on("click",function(e){
+        e.preventDefault();
+        clearFilters(true);
+    });
+    $("#searchform").on("submit", filter);
 });
 
 var dtMemberResults;
 var search = 1;
 $(document).ready(function() {
     [% IF searchmember %]
-        $("#searchmember_filter").val("[% searchmember %]");
+        $("#searchmember_filter").val("[% searchmember | html %]");
     [% END %]
     [% IF searchfieldstype %]
         $("searchfieldstype_filter").val("[% searchfieldstype %]");
@@ -105,8 +131,9 @@ $(document).ready(function() {
     [% END %]
 
     [% IF view != "show_results" %]
-        $("#searchresults").hide();
         search = 0;
+    [% ELSE %]
+        $("#searchresults").show();
     [% END %]
 
     // Build the aLengthMenu
@@ -135,6 +162,10 @@ $(document).ready(function() {
 
     // Apply DataTables on the results table
     var columns_settings = [% ColumnsSettings.GetColumns( 'members', 'member', 'memberresultst', 'json' ) %];
+    [% UNLESS CAN_user_tools_manage_patron_lists %]
+        [%# Remove the first column if we do not display the checkbox %]
+        columns_settings.splice(0, 1);
+    [% END %]
     dtMemberResults = KohaTable("#memberresultst", {
         'bServerSide': true,
         'sAjaxSource': "/cgi-bin/koha/svc/members/search",
@@ -164,6 +195,9 @@ $(document).ready(function() {
                 'name': 'name_sorton',
                 'value': 'borrowers.surname borrowers.firstname'
             },{
+                'name': 'dateofbirth',
+                'value': 'borrowers.dateofbirth',
+            },{
                 'name': 'category_sorton',
                 'value': 'categories.description',
             },{
@@ -195,13 +229,14 @@ $(document).ready(function() {
             [% END %]
             { 'mDataProp': 'dt_cardnumber' },
             { 'mDataProp': 'dt_name' },
+            { 'mDataProp': 'dt_dateofbirth' },
             { 'mDataProp': 'dt_category' },
             { 'mDataProp': 'dt_branch' },
             { 'mDataProp': 'dt_dateexpiry' },
             { 'mDataProp': 'dt_od_checkouts', 'bSortable': false },
             { 'mDataProp': 'dt_fines', 'bSortable': false },
             { 'mDataProp': 'dt_borrowernotes' },
-            { 'mDataProp': 'dt_action', 'bSortable': false }
+            { 'mDataProp': 'dt_action', 'bSortable': false, 'sClass': 'actions' }
         ],
         'fnRowCallback': function(nRow, aData, iDisplayIndex, iDisplayIndexFull) {
             /* Center text for 6th column */
@@ -212,9 +247,9 @@ $(document).ready(function() {
         'bFilter': false,
         'bAutoWidth': false,
         [% IF CAN_user_tools_manage_patron_lists %]
-            'aaSorting': [[1, 'asc']],
+            'aaSorting': [[2, 'asc']],
         [% ELSE %]
-            'aaSorting': [[0, 'asc']],
+            'aaSorting': [[1, 'asc']],
         [% END %]
         "aLengthMenu": [aLengthMenu, aLengthMenuLabel],
         'sPaginationType': 'full_numbers',
@@ -304,41 +339,32 @@ function filterByFirstLetterSurname(letter) {
           [% END %]
 
           [% INCLUDE 'patron-toolbar.inc' %]
-          [% IF ( no_add ) %]
-            <div class="dialog alert">
-              <h3>Cannot add patron</h3>
-              [% IF ( no_branches ) %]
-                <p>There are <strong>no libraries defined</strong>. [% IF ( CAN_user_parameters ) %]Please <a href="/cgi-bin/koha/admin/branches.pl">add a library</a>.[% ELSE %]An administrator must define at least one library.[% END %]</p>
-              [% END %]
-              [% IF ( no_categories ) %]
-                <p>There are <strong>no patron categories defined</strong>. [% IF ( CAN_user_parameters ) %]Please <a href="/cgi-bin/koha/admin/categorie.pl">add a patron category</a>.[% ELSE %]An administrator must define at least one patron category.[% END %]</p>
-              [% END %]
-            </div>
-          [% END %]
+          [% INCLUDE 'noadd-warnings.inc' %]
+
           <div class="browse">
             Browse by last name:
             [% FOREACH letter IN alphabet.split(' ') %]
-              <a style="cursor:pointer" onclick="filterByFirstLetterSurname('[% letter %]');">[% letter %]</a>
+                <a href="#" class="filterByLetter">[% letter %]</a>
             [% END %]
           </div>
 
           [% IF ( CAN_user_borrowers && pending_borrower_modifications ) %]
             <div class="pending-info" id="patron_updates_pending">
               <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
-              <span class="holdcount"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
+              <span class="number_box"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
             </div>
           [% END %]
 
           <div id="searchresults">
             <div id="searchheader">
-              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember %]'[% END %]</span></h3>
+              <h3>Patrons found for: <span id="searchpattern">[% IF searchmember %] for '[% searchmember | html %]'[% END %]</span></h3>
             </div>
             [% IF CAN_user_tools_manage_patron_lists %]
               <div id="searchheader">
                   <div>
-                      <a href="javascript:void(0)" onclick="$('.selection').prop('checked', true)">Select all</a>
+                      <a href="#" id="select_all"><i class="fa fa-check"></i> Select all</a>
                       |
-                      <a href="javascript:void(0)" onclick="$('.selection').prop('checked', false)">Clear all</a>
+                      <a href="#" id="clear_all"><i class="fa fa-remove"></i> Clear all</a>
                       |
                       <span>
                           <label for="add_to_patron_list">Add selected patrons to:</label>
@@ -371,6 +397,7 @@ function filterByFirstLetterSurname(letter) {
                 [% END %]
                   <th>Card</th>
                   <th>Name</th>
+                  <th>Date of birth</th>
                   <th>Category</th>
                   <th>Library</th>
                   <th>Expires on</th>
@@ -387,7 +414,7 @@ function filterByFirstLetterSurname(letter) {
       </div>
     </div>
     <div class="yui-b">
-      <form onsubmit="return filter();" id="searchform">
+      <form method="get" id="searchform">
         <input type="hidden" id="firstletter_filter" value="" />
         <fieldset class="brief">
           <h3>Filters</h3>
@@ -404,6 +431,11 @@ function filterByFirstLetterSurname(letter) {
                 [% ELSE %]
                   <option value='standard'>Standard</option>
                 [% END %]
+                [% IF searchfieldstype == "surname" %]
+                  <option selected="selected" value='surname'>Surname</option>
+                [% ELSE %]
+                  <option value='surname'>Surname</option>
+                [% END %]
                 [% IF searchfieldstype == "email" %]
                   <option selected="selected" value='email'>Email</option>
                 [% ELSE %]
@@ -414,6 +446,11 @@ function filterByFirstLetterSurname(letter) {
                 [% ELSE %]
                   <option value='borrowernumber'>Borrower number</option>
                 [% END %]
+                [% IF searchfieldstype == "userid" %]
+                  <option selected="selected" value='userid'>Username</option>
+                [% ELSE %]
+                  <option value='userid'>Username</option>
+                [% END %]
                 [% IF searchfieldstype == "phone" %]
                   <option selected="selected" value='phone'>Phone number</option>
                 [% ELSE %]
@@ -444,21 +481,22 @@ function filterByFirstLetterSurname(letter) {
             <li>
               <label for="searchtype_filter">Search type:</label>
               <select name="searchtype" id="searchtype_filter">
-                <option value='start_with'>Starts with</option>
-                [% IF searchtype == "contain" %]
-                  <option value="contain" selected="selected">Contains</option>
+                [% IF searchtype == "start_with" %]
+                  <option value='start_with' selected="selected">Starts with</option>
+                  <option value="contain">Contains</option>
                 [% ELSE %]
+                  <option value='start_with'>Starts with</option>
                   <option value="contain" selected="selected">Contains</option>
                 [% END %]
               </select>
             </li>
             <li>
               <label for="categorycode_filter">Category:</label>
-              [% SET categories = Categories.all( selected => categorycode_filter ) %]
+              [% SET categories = Categories.all() %]
               <select id="categorycode_filter">
                 <option value="">Any</option>
                 [% FOREACH cat IN categories %]
-                  [% IF cat.selected %]
+                  [% IF cat.categorycode == categorycode_filter %]
                     <option selected="selected" value="[% cat.categorycode %]">[% cat.description %]</option>
                   [% ELSE %]
                     <option value="[% cat.categorycode %]">[% cat.description %]</option>
@@ -473,19 +511,13 @@ function filterByFirstLetterSurname(letter) {
                 [% IF branches.size != 1 %]
                   <option value="">Any</option>
                 [% END %]
-                [% FOREACH b IN branches %]
-                  [% IF b.selected %]
-                    <option selected="selected" value="[% b.branchcode %]">[% b.branchname %]</option>
-                  [% ELSE %]
-                    <option value="[% b.branchcode %]">[% b.branchname %]</option>
-                  [% END %]
-                [% END %]
+                [% PROCESS options_for_libraries libraries => branches %]
               </select>
             </li>
           </ol>
           <fieldset class="action">
             <input type="submit" value="Search" />
-            <input type="button" value="Clear" onclick="clearFilters(true);" />
+            <input type="button" value="Clear" id="clear_search" />
           </fieldset>
         </fieldset>
       </form>