From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 6 May 2020 13:34:09 +0000 (-0300)
Subject: Bug 25279: URI-escape city_id in links
X-Git-Tag: v20.05.00~148
X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=commitdiff_plain;h=e3aa4ddf6106b4e0ed3f4b441681c3a911c36d1a;hp=15c0e11a2ce1abbe6d244f7e23b18f4d91e410d7;p=koha-ffzg.git

Bug 25279: URI-escape city_id in links

This patch escapes city_id uses in URLs, and also removes redundant dom
entry as this is inherited from the global datatables configuration
anyway.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
index f25a6e8fd0..c5287fd9b7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
@@ -181,7 +181,6 @@
                 "ajax": {
                     "url": cities_table_url
                 },
-                'dom': 'C<"top pager"ilpfB><"#filter_c">tr<"bottom pager"ip>',
                 "order": [[ 1, "asc" ]],
                 "columnDefs": [ {
                     "targets": [0,1,2,3,4],
@@ -221,8 +220,8 @@
                     {
                         "data": function( row, type, val, meta ) {
 
-                            var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid='+ row.city_id +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
-                            result += '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid='+ row.city_id +'"><i class="fa fa-trash" aria-hidden="true"></i> '+_("Delete")+'</a>';
+                            var result = '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid='+ encodeURIComponent(row.city_id) +'"><i class="fa fa-pencil" aria-hidden="true"></i> '+_("Edit")+'</a>'+"\n";
+                            result += '<a class="btn btn-default btn-xs" role="button" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid='+ encodeURIComponent(row.city_id) +'"><i class="fa fa-trash" aria-hidden="true"></i> '+_("Delete")+'</a>';
                             return result;
 
                         },