Bug 19469: (RM follow-up) Add filters and fix variable name

https://bugs.koha-community.org/show_bug.cgi?id=19469

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
index 4c31ed1..2c7dd67 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc
@@ -13,7 +13,7 @@
         <th>Pickup library</th>
         <th>Details</th>
         [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
-            <th><img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Toggle set to lowest priority" /></th>
+            <th><img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Toggle set to lowest priority" /></th>
         [% END %]
         <th>&nbsp;</th>
         [% IF SuspendHoldsIntranet %]<th>&nbsp;</th><!-- Suspend Holds Column Header -->[% END %]
@@ -22,9 +22,9 @@
     [% FOREACH hold IN holds %]
         <tr>
             <td>
-                <input type="hidden" name="reserve_id" value="[% hold.reserve_id %]" />
-                <input type="hidden" name="borrowernumber" value="[% hold.borrowernumber %]" />
-                <input type="hidden" name="biblionumber" value="[% hold.biblionumber %]" />
+                <input type="hidden" name="reserve_id" value="[% hold.reserve_id | html %]" />
+                <input type="hidden" name="borrowernumber" value="[% hold.borrowernumber | html %]" />
+                <input type="hidden" name="biblionumber" value="[% hold.biblionumber | html %]" />
                 <select name="rank-request">
                     [% IF ( hold.found ) %]
                         [% IF ( hold.intransit ) %]
@@ -38,22 +38,22 @@
                         [% IF Koha.Preference('HoldsSplitQueueNumbering') == 'actual' %]
                             [% FOREACH optionloo IN hold.optionloop %]
                                 [% IF ( optionloo.selected ) %]
-                                    <option value="[% optionloo.num %]" selected="selected">[% optionloo.num %]</option>
+                                    <option value="[% optionloo.num | html %]" selected="selected">[% optionloo.num | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% optionloo.num %]">[% optionloo.num %]</option>
+                                    <option value="[% optionloo.num | html %]">[% optionloo.num | html %]</option>
                                 [% END %]
                             [% END %]
                         [% ELSE %]
                             [% FOREACH h IN holds %]
                                 [% IF ( h.priority == hold.priority ) %]
-                                    <option value="[% h.priority %]" selected="selected">[% loop.index + 1 %]</option>
+                                    <option value="[% h.priority | html %]" selected="selected">[% loop.index + 1 | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% h.priority %]">[% loop.index + 1 %]</option>
+                                    <option value="[% h.priority | html %]">[% loop.index + 1 | html %]</option>
                                 [% END %]
                             [% END %]
                         [% END %]
                     [% ELSIF !hold.found %]
-                        <option value="[% hold.priority %]" selected="selected">[% hold.priority %]</option>
+                        <option value="[% hold.priority | html %]" selected="selected">[% hold.priority | html %]</option>
                     [% END %]
 
                     <option value="del">del</option>
@@ -65,23 +65,23 @@
                 [% SET last_priority  = holds.last.priority %]
                 [% SET prev_priority  = loop.prev.priority %]
                 [% SET next_priority  = loop.next.priority %]
-                [% holds.index %]
+                [% holds.index | html %]
 
                 <td style="white-space:nowrap;">
-                    <a title="Move hold up" href="request.pl?action=move&amp;where=up&amp;first_priority=[% first_priority %]&amp;last_priority=[% last_priority %]&amp;prev_priority=[% prev_priority %]&amp;next_priority=[% next_priority %]&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
-                        <img src="[% interface %]/[% theme %]/img/go-up.png" alt="Go up" />
+                    <a title="Move hold up" href="request.pl?action=move&amp;where=up&amp;first_priority=[% first_priority | html %]&amp;last_priority=[% last_priority | html %]&amp;prev_priority=[% prev_priority | html %]&amp;next_priority=[% next_priority | html %]&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-up.png" alt="Go up" />
                     </a>
 
-                    <a title="Move hold to top" href="request.pl?action=move&amp;where=top&amp;first_priority=[% first_priority %]&amp;last_priority=[% last_priority %]&amp;prev_priority=[% prev_priority %]&amp;next_priority=[% next_priority %]&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
-                        <img src="[% interface %]/[% theme %]/img/go-top.png" alt="Go top" />
+                    <a title="Move hold to top" href="request.pl?action=move&amp;where=top&amp;first_priority=[% first_priority | html %]&amp;last_priority=[% last_priority | html %]&amp;prev_priority=[% prev_priority | html %]&amp;next_priority=[% next_priority | html %]&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-top.png" alt="Go top" />
                     </a>
 
-                    <a title="Move hold to bottom" href="request.pl?action=move&amp;where=bottom&amp;first_priority=[% first_priority %]&amp;last_priority=[% last_priority %]&amp;prev_priority=[% prev_priority %]&amp;next_priority=[% next_priority %]&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
-                        <img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Go bottom" />
+                    <a title="Move hold to bottom" href="request.pl?action=move&amp;where=bottom&amp;first_priority=[% first_priority | html %]&amp;last_priority=[% last_priority | html %]&amp;prev_priority=[% prev_priority | html %]&amp;next_priority=[% next_priority | html %]&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Go bottom" />
                     </a>
 
-                    <a title="Move hold down" href="request.pl?action=move&amp;where=down&amp;first_priority=[% first_priority %]&amp;last_priority=[% last_priority %]&amp;prev_priority=[% prev_priority %]&amp;next_priority=[% next_priority %]&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
-                        <img src="[% interface %]/[% theme %]/img/go-down.png" alt="Go down" />
+                    <a title="Move hold down" href="request.pl?action=move&amp;where=down&amp;first_priority=[% first_priority | html %]&amp;last_priority=[% last_priority | html %]&amp;prev_priority=[% prev_priority | html %]&amp;next_priority=[% next_priority | html %]&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-down.png" alt="Go down" />
                     </a>
                 </td>
             [% END %]
@@ -90,24 +90,24 @@
                 [% INCLUDE 'patron-title.inc' patron=hold.patron hide_patron_infos_if_needed=1 %]
             </td>
 
-            <td>[% hold.notes %]</td>
-            <td>[% hold.date %]</td>
-            <td>[% hold.expirationdate %]</td>
+            <td>[% hold.notes | html %]</td>
+            <td>[% hold.date | html %]</td>
+            <td>[% hold.expirationdate | html %]</td>
 
             <td>
                 [% IF ( hold.found ) %]
                     [% IF ( hold.atdestination ) %]
                         [% IF ( hold.found ) %]
-                            Item waiting at <b> [% hold.wbrname %]</b> <input type="hidden" name="pickup" value="[% hold.wbrcode %]" /> since [% hold.waiting_date | $KohaDates %]
+                            Item waiting at <b> [% hold.wbrname | html %]</b> <input type="hidden" name="pickup" value="[% hold.wbrcode | html %]" /> since [% hold.waiting_date | $KohaDates %]
                         [% ELSE %]
-                            Waiting to be pulled <input type="hidden" name="pickup" value="[% hold.wbrcode %]" />
+                            Waiting to be pulled <input type="hidden" name="pickup" value="[% hold.wbrcode | html %]" />
                         [% END %]
                     [% ELSE %]
-                        Item being transferred to <b> [% hold.wbrname %]</b> <input type="hidden" name="pickup" value="[% hold.wbrcode %]" />
+                        Item being transferred to <b> [% hold.wbrname | html %]</b> <input type="hidden" name="pickup" value="[% hold.wbrcode | html %]" />
                     [% END %]
                 [% ELSE %]
                     [% IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 %]
-                        [% Branches.GetName(hold.branchcode) %] <input type="hidden" name="pickup" value="[% hold.branchcode %]" />
+                        [% Branches.GetName(hold.branchcode) | html %] <input type="hidden" name="pickup" value="[% hold.branchcode | html %]" />
                     [% ELSE %]
                         <select name="pickup">
                             [% PROCESS options_for_libraries libraries => Branches.all( selected => hold.branchcode ) %]
@@ -118,10 +118,10 @@
 
             <td>
                 [% IF ( hold.found ) %]
-                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblionumber %]">
+                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblionumber | html %]">
                         [% IF ( hold.barcodenumber ) %]
-                            [% hold.barcodenumber %]
-                            <input type="hidden" name="itemnumber" value="[% hold.itemnumber %]" />
+                            [% hold.barcodenumber | html %]
+                            <input type="hidden" name="itemnumber" value="[% hold.itemnumber | html %]" />
                         [% ELSE %]
                             No barcode
                         [% END %]
@@ -130,10 +130,10 @@
                     [% IF ( hold.item_level_hold ) %]
                         <i>
                             Only item
-                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblionumber %]">
+                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblionumber | html %]">
                                 [% IF ( hold.barcodenumber ) %]
-                                    [% hold.barcodenumber %]
-                                    <input type="hidden" name="itemnumber" value="[% hold.itemnumber %]" />
+                                    [% hold.barcodenumber | html %]
+                                    <input type="hidden" name="itemnumber" value="[% hold.itemnumber | html %]" />
                                 [% ELSE %]
                                     No barcode
                                 [% END %]
@@ -141,7 +141,7 @@
                         </i>
                     [% ELSE %]
                         [% IF hold.itemtype %]
-                            <i>Next available [% ItemTypes.GetDescription( hold.itemtype ) %] item</i>
+                            <i>Next available [% ItemTypes.GetDescription( hold.itemtype ) | html %] item</i>
                         [% ELSE %]
                             <i>Next available</i>
                         [% END %]
@@ -153,33 +153,33 @@
 
             [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
                 <td>
-                    <a title="Toggle lowest priority" href="request.pl?action=setLowestPriority&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
+                    <a title="Toggle lowest priority" href="request.pl?action=setLowestPriority&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
                         [% IF ( hold.lowestPriority ) %]
-                            <img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Unset lowest priority" />
+                            <img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Unset lowest priority" />
                         [% ELSE %]
-                            <img src="[% interface %]/[% theme %]/img/go-down.png" alt="Set to lowest priority" />
+                            <img src="[% interface | html %]/[% theme | html %]/img/go-down.png" alt="Set to lowest priority" />
                         [% END %]
                     </a>
                 </td>
             [% END %]
 
             <td>
-                <a class="cancel-hold" title="Cancel hold" href="request.pl?action=cancel&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;reserve_id=[% hold.reserve_id %]&amp;date=[% hold.date %]">
-                    <img src="[% interface %]/[% theme %]/img/x.png" alt="Cancel" />
+                <a class="cancel-hold" title="Cancel hold" href="request.pl?action=cancel&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;reserve_id=[% hold.reserve_id | html %]&amp;date=[% hold.date | html %]">
+                    <img src="[% interface | html %]/[% theme | html %]/img/x.png" alt="Cancel" />
                 </a>
             </td>
 
             [% IF SuspendHoldsIntranet %]
                 <td>
                     [% UNLESS ( hold.found ) %]
-                        <input type="button" value="[% IF ( hold.suspend ) %]Unsuspend[% ELSE %]Suspend[% END %]" onclick="window.location.href='request.pl?action=toggleSuspend&amp;reserve_id=[% hold.reserve_id %]&amp;borrowernumber=[% hold.borrowernumber %]&amp;biblionumber=[% hold.biblionumber %]&amp;date=[% hold.date %]&amp;suspend_until=' + $('#suspend_until_[% hold.reserve_id %]').val()" />
+                        <input type="button" value="[% IF ( hold.suspend ) %]Unsuspend[% ELSE %]Suspend[% END %]" onclick="window.location.href='request.pl?action=toggleSuspend&amp;reserve_id=[% hold.reserve_id | html %]&amp;borrowernumber=[% hold.borrowernumber | html %]&amp;biblionumber=[% hold.biblionumber | html %]&amp;date=[% hold.date | html %]&amp;suspend_until=' + $('#suspend_until_[% hold.reserve_id | html %]').val()" />
 
                         [% IF AutoResumeSuspendedHolds %]
-                            <label for="suspend_until_[% hold.reserve_id %]">[% IF ( hold.suspend ) %] on [% ELSE %] until [% END %]</label>
-                            <input name="suspend_until" id="suspend_until_[% hold.reserve_id %]" size="10" value="[% hold.suspend_until | $KohaDates %]" class="datepicker suspend_until_datepicker" />
-                            <a href='#' onclick="document.getElementById('suspend_until_[% hold.reserve_id %]').value='';">Clear date</a>
+                            <label for="suspend_until_[% hold.reserve_id | html %]">[% IF ( hold.suspend ) %] on [% ELSE %] until [% END %]</label>
+                            <input name="suspend_until" id="suspend_until_[% hold.reserve_id | html %]" size="10" value="[% hold.suspend_until | $KohaDates %]" class="datepicker suspend_until_datepicker" />
+                            <a href='#' onclick="document.getElementById('suspend_until_[% hold.reserve_id | html %]').value='';">Clear date</a>
                         [% ELSE %]
-                            <input type="hidden" name="suspend_until" id="suspend_until_[% hold.reserve_id %]" value=""/>
+                            <input type="hidden" name="suspend_until" id="suspend_until_[% hold.reserve_id | html %]" value=""/>
                         [% END %]
 
                     [% ELSE %]

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index de06a44..bf6220d 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -508,10 +508,10 @@
 
 [% UNLESS ( patron ) %]
     [% IF ( reserveloop ) %]
-        <form name="T[% time %]" action="modrequest.pl" method="post">
+        <form name="T[% time | html %]" action="modrequest.pl" method="post">
             [% IF ( multi_hold ) %]
                 <input type = "hidden" name="multi_hold" value="1"/>
-                <input type = "hidden" name="biblionumbers" value="[% biblionumbers %]"/>
+                <input type = "hidden" name="biblionumbers" value="[% biblionumbers | html %]"/>
             [% END %]
 
             <fieldset class="rows left">
@@ -521,7 +521,7 @@
                     [% IF ( biblioloo.reserveloop ) %]
                         [% IF ( multi_hold ) %]
                             <h3>
-                                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber %]">
+                                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber | html %]">
                                     [% biblioloo.title | html %]
                                 </a>
                             </h3>
@@ -531,7 +531,7 @@
                             [% SET branchcodes = [] %]
 
                             [% FOREACH h IN biblioloo.reserveloop %]
-                                [% branchcodes.push( h.branchcode ) %]
+                                [% branchcodes.push( h.branchcode ) | $raw %]
                             [% END %]
                             [% branchcodes = branchcodes.unique %]
 
@@ -539,11 +539,11 @@
                                 [% SET holds_by_branch = [] %]
                                 [% FOREACH h IN biblioloo.reserveloop %]
                                     [% IF h.branchcode == b %]
-                                        [% holds_by_branch.push( h ) %]
+                                        [% holds_by_branch.push( h ) | $raw %]
                                     [% END %]
                                 [% END %]
                                 <fieldset>
-                                    <legend>[% Branches.GetName( b ) %]</legend>
+                                    <legend>[% Branches.GetName( b ) | html %]</legend>
                                     [% INCLUDE holds_table.inc holds=holds_by_branch %]
                                 </fieldset>
                             [% END %]
@@ -552,7 +552,7 @@
 
                             [% FOREACH h IN biblioloo.reserveloop %]
                                 [% SET hold_itemtype = h.object.item.effective_itemtype || h.itemtype %]
-                                [% itemtypes_all.push( hold_itemtype ) %]
+                                [% itemtypes.push( hold_itemtype ) | $raw %]
                             [% END %]
                             [% itemtypes = itemtypes.unique %]
 
@@ -561,13 +561,13 @@
                                 [% FOREACH h IN biblioloo.reserveloop %]
                                     [% SET hold_itemtype = h.object.item.effective_itemtype || h.itemtype %]
                                     [% IF hold_itemtype == i %]
-                                        [% holds_by_itemtype.push( h ) %]
+                                        [% holds_by_itemtype.push( h ) | $raw %]
                                     [% END %]
                                 [% END %]
 
                                 <fieldset>
                                     [% IF i %]
-                                        <legend>[% ItemTypes.GetDescription( i ) %]</legend>
+                                        <legend>[% ItemTypes.GetDescription( i ) | html %]</legend>
                                     [% ELSE %]
                                         <legend>Any item type</legend>
                                     [% END %]
@@ -578,31 +578,31 @@
                             [% SET branchcodes = [] %]
 
                             [% FOREACH h IN biblioloo.reserveloop %]
-                                [% branchcodes.push( h.branchcode ) %]
+                                [% branchcodes.push( h.branchcode ) | $raw %]
                             [% END %]
                             [% branchcodes = branchcodes.unique %]
 
                             [% FOREACH b IN branchcodes.sort %]
                                 <fieldset class="contrast">
-                                    <legend>[% Branches.GetName( b ) %]</legend>
+                                    <legend>[% Branches.GetName( b ) | html %]</legend>
                                     [% SET holds_by_branch = [] %]
                                     [% FOREACH h IN biblioloo.reserveloop %]
                                         [% IF h.branchcode == b %]
-                                            [% holds_by_branch.push( h ) %]
+                                            [% holds_by_branch.push( h ) | $raw %]
                                         [% END %]
                                     [% END %]
 
                                     [% SET itemtypes = [] %]
                                     [% FOREACH h IN holds_by_branch %]
                                         [% SET hold_itemtype = h.object.item.effective_itemtype || h.itemtype %]
-                                        [% itemtypes.push( hold_itemtype ) %]
+                                        [% itemtypes.push( hold_itemtype ) | $raw %]
                                     [% END %]
                                     [% itemtypes = itemtypes.unique %]
 
                                     [% FOREACH i IN itemtypes.sort %]
                                         <fieldset class="standard">
                                             [% IF i %]
-                                                <legend>[% ItemTypes.GetDescription( i ) %]</legend>
+                                                <legend>[% ItemTypes.GetDescription( i ) | html %]</legend>
                                             [% ELSE %]
                                                 <legend>Any item type</legend>
                                             [% END %]
@@ -611,7 +611,7 @@
                                             [% FOREACH h IN holds_by_branch %]
                                                 [% SET hold_itemtype = h.object.item.effective_itemtype || h.itemtype %]
                                                 [% IF hold_itemtype == i %]
-                                                    [% holds_by_itemtype.push( h ) %]
+                                                    [% holds_by_itemtype.push( h ) | $raw %]
                                                 [% END %]
                                             [% END %]
                                             [% INCLUDE holds_table.inc holds=holds_by_itemtype %]