Bug 13618: Add html filters to all the variables
authorJonathan Druart <jonathan.druart@biblibre.com>
Fri, 23 Jan 2015 12:18:54 +0000 (13:18 +0100)
committerNick Clemens <nick@bywatersolutions.com>
Fri, 17 Aug 2018 15:55:05 +0000 (15:55 +0000)
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

791 files changed:
koha-tmpl/intranet-tmpl/prog/en/includes/account_offset_type.inc
koha-tmpl/intranet-tmpl/prog/en/includes/accounttype.inc
koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-add-to-basket.inc
koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/acquisitions-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/admin-items-search-field-form.inc
koha-tmpl/intranet-tmpl/prog/en/includes/adv-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/auth-finder-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/authorities-search-results.inc
koha-tmpl/intranet-tmpl/prog/en/includes/authorities-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/authorities-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/authorities.inc
koha-tmpl/intranet-tmpl/prog/en/includes/authorities_js.inc
koha-tmpl/intranet-tmpl/prog/en/includes/av-build-dropbox.inc
koha-tmpl/intranet-tmpl/prog/en/includes/biblio-default-view.inc
koha-tmpl/intranet-tmpl/prog/en/includes/biblio-view-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/blocked-fines.inc
koha-tmpl/intranet-tmpl/prog/en/includes/blocking_errors.inc
koha-tmpl/intranet-tmpl/prog/en/includes/borrower_debarments.inc
koha-tmpl/intranet-tmpl/prog/en/includes/branch-selector.inc
koha-tmpl/intranet-tmpl/prog/en/includes/budgets-active-currency.inc
koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/budgets-admin-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/calendar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cat-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cat-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cataloging-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/catalogue/itemsearch_item.csv.inc
koha-tmpl/intranet-tmpl/prog/en/includes/catalogue/itemsearch_item.json.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-widgets-marc21.inc
koha-tmpl/intranet-tmpl/prog/en/includes/checkin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table-footer.inc
koha-tmpl/intranet-tmpl/prog/en/includes/checkouts-table.inc
koha-tmpl/intranet-tmpl/prog/en/includes/circ-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/circ-nav.inc
koha-tmpl/intranet-tmpl/prog/en/includes/circ-patron-search-results.inc
koha-tmpl/intranet-tmpl/prog/en/includes/circ-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/cities-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/contracts-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/csv_headers/acqui/basket.tt
koha-tmpl/intranet-tmpl/prog/en/includes/csv_headers/acqui/basketgroup.tt
koha-tmpl/intranet-tmpl/prog/en/includes/csv_headers/acqui/lateorders.tt
koha-tmpl/intranet-tmpl/prog/en/includes/csv_headers/reports/cash_register_stats.tt
koha-tmpl/intranet-tmpl/prog/en/includes/csv_headers/reports/orders_by_budget.tt
koha-tmpl/intranet-tmpl/prog/en/includes/currencies-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc
koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close-receipt.inc
koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc
koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-open.inc
koha-tmpl/intranet-tmpl/prog/en/includes/empty_line.inc
koha-tmpl/intranet-tmpl/prog/en/includes/facets.inc
koha-tmpl/intranet-tmpl/prog/en/includes/form-blocks.inc
koha-tmpl/intranet-tmpl/prog/en/includes/greybox.inc
koha-tmpl/intranet-tmpl/prog/en/includes/header.inc
koha-tmpl/intranet-tmpl/prog/en/includes/help-bottom.inc
koha-tmpl/intranet-tmpl/prog/en/includes/help-top.inc
koha-tmpl/intranet-tmpl/prog/en/includes/home-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers.inc
koha-tmpl/intranet-tmpl/prog/en/includes/ill-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc
koha-tmpl/intranet-tmpl/prog/en/includes/installer-strings.inc
koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc
koha-tmpl/intranet-tmpl/prog/en/includes/intranetstylesheet.inc
koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc
koha-tmpl/intranet-tmpl/prog/en/includes/langmenu-staff-top.inc
koha-tmpl/intranet-tmpl/prog/en/includes/letters-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-address-style-de.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-address-style-fr.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-address-style-us.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-contact-style-de.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-contact-style-fr.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-alt-contact-style-us.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-address-style-de.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-address-style-fr.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-address-style-us.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-alt-address-style-de.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-alt-address-style-fr.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-display-alt-address-style-us.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-main-address-style-de.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-main-address-style-fr.inc
koha-tmpl/intranet-tmpl/prog/en/includes/member-main-address-style-us.inc
koha-tmpl/intranet-tmpl/prog/en/includes/members-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/merge-record.inc
koha-tmpl/intranet-tmpl/prog/en/includes/messaging-preference-form.inc
koha-tmpl/intranet-tmpl/prog/en/includes/modals/serials_multi_receiving.inc
koha-tmpl/intranet-tmpl/prog/en/includes/nl-search-form.tt
koha-tmpl/intranet-tmpl/prog/en/includes/onboarding_messages.inc
koha-tmpl/intranet-tmpl/prog/en/includes/page-numbers.inc
koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-article-requests.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-search-box.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-title.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patron-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc
koha-tmpl/intranet-tmpl/prog/en/includes/patrons-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/popup-bottom.inc
koha-tmpl/intranet-tmpl/prog/en/includes/prefs-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/reports-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/rotating-collections-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/select2.inc
koha-tmpl/intranet-tmpl/prog/en/includes/serials-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/serials-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/serials-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/slip-print.inc
koha-tmpl/intranet-tmpl/prog/en/includes/str/members-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/suggestions-add-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/vendor-menu.inc
koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves-toolbar.inc
koha-tmpl/intranet-tmpl/prog/en/includes/virtualshelves/merge/selection.tt
koha-tmpl/intranet-tmpl/prog/en/includes/wysiwyg-systempreferences.inc
koha-tmpl/intranet-tmpl/prog/en/includes/z3950-admin-search.inc
koha-tmpl/intranet-tmpl/prog/en/includes/z3950_search.inc
koha-tmpl/intranet-tmpl/prog/en/modules/about.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorder.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ajax.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/cancelorder.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/csv/basket.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/csv/basketgroup.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/csv/lateorders.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edi_ean.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edifactmsgs.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/modordernotes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderbiblio.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty_duplicate.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersubscription.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ordered.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/showorder.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/spent.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/tables/members_results.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/audio_alerts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/authtypes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/checkmarc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/clone-rules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_ean_accounts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/fieldmapping.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_field.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/items_search_fields.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/printers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/sms_providers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt
koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/auth_finder.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tt
koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt
koha-tmpl/intranet-tmpl/prog/en/modules/basket/basket.tt
koha-tmpl/intranet-tmpl/prog/en/modules/basket/downloadcart.tt
koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasket.tt
koha-tmpl/intranet-tmpl/prog/en/modules/basket/sendbasketform.tt
koha-tmpl/intranet-tmpl/prog/en/modules/batch/print-notices.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/imageviewer.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/issuehistory.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch_json.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt
koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/showmarc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/editor.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/linkitem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/EXAMPLE.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/ajax.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/cn_browser.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/macles.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_006.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_007.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_authorities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_classifications.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader_authorities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/normarc_field_007.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/normarc_field_008.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/normarc_leader.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100_authorities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_105.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_106.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_110.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_116.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_117.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_120.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_122.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123d.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123e.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123f.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123g.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123i_j.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124c.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124d.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124e.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124f.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124g.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_127.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128b.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128c.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_130.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_135a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_140.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_141.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_686a.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_700-4.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/bookcount.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchoverdues.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/offline-mf.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/offline.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/on-site_checkouts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/selectbranchprinter.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/view_holdsqueue.tt
koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/club-enrollments.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs-add-modify.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-clubs-tab.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-enroll.tt
koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt
koha-tmpl/intranet-tmpl/prog/en/modules/common/patron_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt
koha-tmpl/intranet-tmpl/prog/en/modules/errors/errorpage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/about.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/acqui-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/addorderiso2709.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/basket.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/basketgroup.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/basketheader.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/booksellers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/edifactmsgs.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/histsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/invoice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/invoices.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/lateorders.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/neworderbiblio.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/neworderempty.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/newordersubscription.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/newordersuggestion.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/orderreceive.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/parcel.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/parcels.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/supplier.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/uncertainprice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/acqui/z3950_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/admin-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/aqbudgetperiods.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/aqbudgets.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/aqcontract.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/aqplan.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/auth_subfields_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/auth_tag_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/authorised_values.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/authtypes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/biblio_framework.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/branch_transfer_limits.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/branches.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/categorie.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/checkmarc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/cities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/classsources.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/columns_settings.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/currency.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/didyoumean.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/edi_accounts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/edi_ean_accounts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/fieldmapping.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/item_circulation_alerts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/items_search_fields.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/itemtypes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/koha2marclinks.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/marc_subfields_structure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/marctagstructure.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/matching-rules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/oai_set_mappings.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/oai_sets.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/patron-attr-types.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/preferences.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/smart-rules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/systempreferences.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/transport-cost-matrix.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/admin/z3950servers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/authorities/authorities-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/authorities/authorities.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/authorities/detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/authorities/merge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/issuehistory.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/itemsearch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/moredetail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/search-history.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/catalogue/search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/addbiblio.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/addbooks.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/additem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/linkitem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/merge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/cataloguing/moveitem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/branchoverdues.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/branchtransfers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/circulation-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/circulation.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/offline.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/on-site_checkouts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/overdue.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/pendingreserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/renew.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/reserveratios.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/returns.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/selectbranchprinter.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/transferstoreceive.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/view_holdsqueue.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/circ/waitingreserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/course_reserves/add_items.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/course_reserves/course-details.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/course_reserves/course-reserves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/course_reserves/course.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/edithelp.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-edit-batch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-edit-layout.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-edit-profile.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-edit-template.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/label-manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/labels/spinelabel-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/mainpage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/boraccount.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/discharge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/files.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/mancredit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/maninvoice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/member-flags.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/member-password.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/member.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/memberentry.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/members-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/members-update.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/moremember.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/notices.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/pay.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/paycollect.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/purchase-suggestions.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/readingrec.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/routing-lists.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/members/statistics.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/nohelp.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/offline_circ/list.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/offline_circ/process_koc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patron_lists/lists.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/edit-batch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/edit-layout.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/edit-profile.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/edit-template.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/image-manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/patroncards/manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/plugins/plugins-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/plugins/plugins-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/acquisitions_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/bor_issues_top.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/borrowers_out.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/borrowers_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/cat_issues_top.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/catalogue_out.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/catalogue_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/dictionary.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/guided_reports.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/issues_avg_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/issues_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/itemslost.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/manager.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/reports-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/reserves_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reports/serials_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reserve/request.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/reviews/reviewswaiting.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/rotating_collections/rotatingCollections.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/checkexpiration.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/claims.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/routing.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/serials-collection.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/serials-edit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/serials-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/subscription-add.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/subscription-detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/subscription-frequencies.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/serials/subscription-numberpatterns.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/suggestion/suggestion.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tags/list.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tags/review.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/batchMod.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/batch_delete_records.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/batch_record_modification.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/cleanborrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/csv-profiles.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/export.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/holidays.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/import_borrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/inventory.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/koha-news.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/letter.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/manage-marc-import.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/marc_modification_templates.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/modborrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/overduerules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/picture-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/quotes-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/quotes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/scheduler.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/stage-marc-import.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/tools-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/upload-cover-image.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/tools/viewlog.tt
koha-tmpl/intranet-tmpl/prog/en/modules/help/virtualshelves/shelves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt
koha-tmpl/intranet-tmpl/prog/en/modules/installer/step1.tt
koha-tmpl/intranet-tmpl/prog/en/modules/installer/step2.tt
koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt
koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-bib-search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/result.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/accountline-details.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/deletemem.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/discharge.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/discharges.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/holdshistory.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/merge-patrons.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-brief.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-receipt.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/nl-search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/routing-lists.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/members_results.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt
koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/enqueue_koc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt
koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt
koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep3.tt
koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep4.tt
koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep5.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/add-modify.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/print.tt
koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/tables/members_results.tt
koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/acquisitions_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/bor_issues_top.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_out.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/cat_issues_top.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_avg_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt
koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/addItems.tt
koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/editCollections.tt
koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/rotatingCollections.tt
koha-tmpl/intranet-tmpl/prog/en/modules/rotating_collections/transferCollection.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/add_fields.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/result.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview-slip.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/showpredictionpattern.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-batchedit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-bib-search.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-history.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/tables/members_results.tt
koha-tmpl/intranet-tmpl/prog/en/modules/serials/viewalerts.tt
koha-tmpl/intranet-tmpl/prog/en/modules/services/itemrecorddisplay.tt
koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/access_files.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/koha-news.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/preview_letter.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/showdiffmarc.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt
koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/downloadshelf.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelf.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt
koha-tmpl/opac-tmpl/bootstrap/en/includes/authorities-search-results.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/av-build-dropbox.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/bodytag.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/calendar.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/datatables.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-open.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/greybox.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/html_helpers.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/item-status.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead-langmenu.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead-sco.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/navigation.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-authorities.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-detail-sidebar.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-facets.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-topissues.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/openlibrary-readapi.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/page-numbers.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-title.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/shelfbrowser.inc
koha-tmpl/opac-tmpl/bootstrap/en/includes/slip-print.inc
koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/errors/errorpage.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/ilsdi.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/maintenance.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ISBDdetail.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account-pay-error.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscribe.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-MARCdetail.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-detail.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authorities-home.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-blocked.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-browser.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-discharge.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadcart.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-full-serial-issues.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-ics.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-issue-note.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry-update-submitted.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-mymessages.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-news-rss.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-opensearch.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-overdrive-search.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-privacy.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-email-sent.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-invalid.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-restrictedpage.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results-grouped.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-retrieve-file.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-routing-lists.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasket.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendbasketform.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelf.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-sendshelfform.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves-rss.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showmarc.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews-rss.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags_subject.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-topissues.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/svc/suggestion.tt
misc/cronjobs/rss/lastAcquired-1.0.tt
misc/cronjobs/rss/lastAcquired-2.0.tt
misc/cronjobs/rss/lastAcquired.tt
misc/cronjobs/rss/longestUnseen.tt
misc/cronjobs/rss/mostReserved.tt

index 5fa02aa..aecb415 100644 (file)
@@ -6,5 +6,5 @@
     [% CASE 'Lost Item Return' %]Lost item returned
     [% CASE 'Writeoff' %]Writeoff
     [% CASE 'Void Payment' %]Void payment
-    [% CASE %][% account_offset.type %]
+    [% CASE %][% account_offset.type | html %]
 [%- END -%]
index 66ddd18..0d30f65 100644 (file)
@@ -20,5 +20,5 @@
     [% CASE 'WO' %]Writeoff
     [% CASE 'C' %]Credit
     [% CASE 'CR' %]Credit
-    [% CASE %][% account.accounttype %]
+    [% CASE %][% account.accounttype | html %]
 [%- END -%]
index 8e2961b..3588005 100644 (file)
@@ -7,17 +7,17 @@
             <label>From an existing record:
                 <input type="text"  size="25" name="q" />
             </label>
-            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-            <input type="hidden" name="basketno" value="[% basketno %]" />
+            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+            <input type="hidden" name="basketno" value="[% basketno | html %]" />
             <input type="submit" class="submit" value="Search" />
           </form>
         </li>
-        <li><a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">From a suggestion</a></li>
-        <li><a href="/cgi-bin/koha/acqui/newordersubscription.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">From a subscription</a></li>
-        <li><a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">From a new (empty) record</a></li>
-        <li><a href="/cgi-bin/koha/acqui/z3950_search.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">From an external source</a></li>
-        <li><a href="/cgi-bin/koha/acqui/addorderiso2709.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]"> From a staged file</a></li>
-        [% IF ( CAN_user_circulate ) %]<li><a href="/cgi-bin/koha/circ/reserveratios.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">From titles with highest hold ratios</a></li>[% END %]
+        <li><a href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">From a suggestion</a></li>
+        <li><a href="/cgi-bin/koha/acqui/newordersubscription.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">From a subscription</a></li>
+        <li><a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">From a new (empty) record</a></li>
+        <li><a href="/cgi-bin/koha/acqui/z3950_search.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">From an external source</a></li>
+        <li><a href="/cgi-bin/koha/acqui/addorderiso2709.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]"> From a staged file</a></li>
+        [% IF ( CAN_user_circulate ) %]<li><a href="/cgi-bin/koha/circ/reserveratios.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">From titles with highest hold ratios</a></li>[% END %]
       </ul>
     [% ELSE %]
         <div class="dialog alert">
index 26ab7f1..94421d2 100644 (file)
@@ -1,5 +1,5 @@
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Acquisitions Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Acquisitions Resident Search Box -->
 <div id="header_search">
 <div id="supplier_search" class="residentsearch">
        <p class="tip">Search vendors:</p>
@@ -11,8 +11,8 @@
        <p class="tip">Search orders:</p>
        
                <form action="/cgi-bin/koha/acqui/histsearch.pl" method="post">
-        <label for="title">Title: </label> <input type="text" id="title" name="title" size="15" value="[% title %]" />
-        <label for="searchsupplier">Vendor:</label> <input type="text" id="searchsupplier" name="name" size="15" value="[% name|html %]" />
+        <label for="title">Title: </label> <input type="text" id="title" name="title" size="15" value="[% title | html %]" />
+        <label for="searchsupplier">Vendor:</label> <input type="text" id="searchsupplier" name="name" size="15" value="[% name | html %]" />
         <input type="hidden" id="do_search" name="do_search" value="do" />
         <span class="filteraction" id="filteraction_off" style="display:none"> <a href="#" class="toggle_element" data-element="#filters,.filteraction">[-]</a></span>
         <span class="filteraction" id="filteraction_on"> <a href="#" class="toggle_element" data-element="#filters,.filteraction">[+]</a></span>
index 198c6cb..5ad1a08 100644 (file)
@@ -3,7 +3,7 @@
 //<![CDATA[
 function confirm_deletion() {
     if (confirm(_("Are you sure you want to delete this vendor?"))) {
-        window.location="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]&op=delete";
+        window.location="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]&op=delete";
     }
 }
 //]]>
@@ -16,10 +16,10 @@ function confirm_deletion() {
         </a>
         <ul class="dropdown-menu">
             [% IF CAN_user_acquisition_order_manage && active %]
-                <li><a href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% booksellerid %]&amp;op=add_form">Basket</a></li>
+                <li><a href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% booksellerid | html %]&amp;op=add_form">Basket</a></li>
             [% END %]
             [% IF CAN_user_acquisition_contracts_manage && active %]
-                <li><a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;booksellerid=[% booksellerid %]">Contract</a></li>
+                <li><a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;booksellerid=[% booksellerid | html %]">Contract</a></li>
             [% END %]
             [% IF ( CAN_user_acquisition_vendors_manage ) %]
                 <li><a href="/cgi-bin/koha/acqui/supplier.pl?op=enter">Vendor</a></li>
@@ -27,13 +27,13 @@ function confirm_deletion() {
         </ul>
         </div>
             [% IF ( CAN_user_acquisition_vendors_manage ) %]
-                <div class="btn-group"><a class="btn btn-default btn-sm" id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]&amp;op=enter"><i class="fa fa-pencil"></i> Edit vendor</a></div>
+                <div class="btn-group"><a class="btn btn-default btn-sm" id="editsupplier" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]&amp;op=enter"><i class="fa fa-pencil"></i> Edit vendor</a></div>
                 [% UNLESS ( basketcount OR subscriptioncount ) %]
                     <div class="btn-group"><a class="btn btn-default btn-sm" id="deletesupplier" href="javascript:confirm_deletion()"><i class="fa fa-trash"></i> Delete vendor</a></div>
                 [% END %]
             [% END %]
             [% IF CAN_user_acquisition_order_receive && basketcount %]
-                <div class="btn-group"><a class="btn btn-default btn-sm" id="receive" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid %]"><i class="fa fa-inbox"></i> Receive shipments</a></div>
+                <div class="btn-group"><a class="btn btn-default btn-sm" id="receive" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid | html %]"><i class="fa fa-inbox"></i> Receive shipments</a></div>
             [% END %]
         [% ELSE %]
             <div class="btn-group"><a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/supplier.pl?op=enter"><i class="fa fa-plus"></i> New vendor</a></div>
index 4ab91b1..963be58 100644 (file)
@@ -3,8 +3,8 @@
   <li>
       [% IF field %]
           <span class="label">Name: </span>
-          [% field.name |html %]
-          <input type="hidden" name="name" value="[% field.name %]">
+          [% field.name | html %]
+          <input type="hidden" name="name" value="[% field.name | html %]">
       [% ELSE %]
           <label class="required" for="name">Name: </label>
           <input type="text" name="name" id="name" class="required" required="required" />
@@ -14,7 +14,7 @@
   <li>
     <label class="required" for="label">Label: </label>
     [% IF field %]
-        <input type="text" name="label" id="label" value="[% field.label |html %]" class="required" required="required" />
+        <input type="text" name="label" id="label" value="[% field.label | html %]" class="required" required="required" />
     [% ELSE %]
         <input type="text" name="label" id="label" class="required" required="required" />
     [% END %]
@@ -25,9 +25,9 @@
     <select id="tagfield" name="tagfield" class="required" required="required">
       [% FOREACH tagfield IN ['001'..'999'] %]
         [% IF field && field.tagfield == tagfield %]
-          <option value="[% tagfield %]" selected="selected">[% tagfield %]</option>
+          <option value="[% tagfield | html %]" selected="selected">[% tagfield | html %]</option>
         [% ELSE %]
-          <option value="[% tagfield %]">[% tagfield %]</option>
+          <option value="[% tagfield | html %]">[% tagfield | html %]</option>
         [% END %]
       [% END %]
     </select>
   <li>
     <label for="tagsubfield">MARC subfield: </label>
     <select id="tagsubfield" name="tagsubfield">
-      [% codes = [''] %]
-      [% codes = codes.merge([0..9], ['a'..'z']) %]
+      [% codes = [''] | html %]
+      [% codes = codes.merge([0..9], ['a'..'z']) | html %]
       [% FOREACH tagsubfield IN codes %]
         [% IF field && field.tagsubfield == tagsubfield %]
-          <option value="[% tagsubfield %]" selected="selected">[% tagsubfield %]</option>
+          <option value="[% tagsubfield | html %]" selected="selected">[% tagsubfield | html %]</option>
         [% ELSE %]
-          <option value="[% tagsubfield %]">[% tagsubfield %]</option>
+          <option value="[% tagsubfield | html %]">[% tagsubfield | html %]</option>
         [% END %]
       [% END %]
     </select>
index cc1abab..62bff05 100644 (file)
@@ -1,5 +1,5 @@
 <div class="gradient">
-    <h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1>
+    <h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1>
 
     <!-- Begin main page resident search box -->
     <div id="header_search">
index 78746cb..449a078 100644 (file)
@@ -5,15 +5,15 @@
     <div class="btn-group"><a href="#" id="createnew" class="btn btn-default btn-sm"><i class="fa fa-plus"></i> Create new authority</a></div>
 </div>
 <form name="f" method="get" action="auth_finder.pl">
-            <input type="hidden" name="source" value="[% source %]" />
+            <input type="hidden" name="source" value="[% source | html %]" />
             <input type="hidden" name="op" value="do_search" />
             <input type="hidden" name="type" value="intranet" />
-            <input type="hidden" name="index" value="[% index %]" />
+            <input type="hidden" name="index" value="[% index | html %]" />
                 <fieldset class="rows"><legend>Search options</legend>
                 <ol><li>
                     <span class="label">Authority type: </span>
-                    [% authtypecode %]
-                    <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
+                    [% authtypecode | html %]
+                    <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
                 </li>
                 <li>
                     <label for="mainmainentry">Search main heading ($a only): </label>
@@ -37,7 +37,7 @@
                         <option value="is">is exactly</option>
                         [% END %]
                     </select>
-                    <input id="value_mainstr" style="width:400px;" type="text" name="value_mainstr" value="[% value_mainstr |html %]" />
+                    <input id="value_mainstr" style="width:400px;" type="text" name="value_mainstr" value="[% value_mainstr | html %]" />
                     <div id="yvaluecontainermainmainentry"></div>
                 </li>
 
@@ -63,7 +63,7 @@
                         <option value="is">is exactly</option>
                         [% END %]
                     </select>
-                    <input id="value_main" style="width:400px;" type="text" name="value_main" value="[% value_main |html %]" />
+                    <input id="value_main" style="width:400px;" type="text" name="value_main" value="[% value_main | html %]" />
                     <div id="yvaluecontainermainentry"></div>
                 </li>
                 <li>
@@ -88,7 +88,7 @@
                         <option value="is">is exactly</option>
                         [% END %]
                     </select>
-                    <input type="text" name="value_match" value="[% value_match |html %]" />
+                    <input type="text" name="value_match" value="[% value_match | html %]" />
                 </li>
                 <li>
                     <label for="marclistanywhere">Search entire record: </label>
                         <option value="is">is exactly</option>
                         [% END %]
                     </select>
-                    <input id="value_any" style="width:400px;" type="text" name="value_any" value="[% value_any |html %]" />
+                    <input id="value_any" style="width:400px;" type="text" name="value_any" value="[% value_any | html %]" />
                     <div id="yvaluecontainermarclist"></div>
                 </li>
         <li>
             <li>
                 <label for="relationship">Special relationship: </label>
                 <select name="relationship" id="relationship">
-                    [% selected=relationship %]
+                    [% selected=relationship | html %]
                     [% PROCESS selectoptionopen value='' %]None specified</option>
                     [% PROCESS selectoptionopen value='a' %]a - Earlier heading</option>
                     [% PROCESS selectoptionopen value='b' %]b - Later heading</option>
index 1b4efda..7deec64 100644 (file)
@@ -51,7 +51,7 @@
     [% IF ( summary.label ) %][% summary.label | html %]:[% END %]
     [% IF summary.summary %]
       <div class="authority-summary">
-        [% summary.summary %]
+        [% summary.summary | html %]
       </div>
     [% END %]
     [% UNLESS ( summary.summaryonly ) %]
@@ -89,7 +89,7 @@
               <div class="authres_otherscript">
               [% FOREACH other IN summary.otherscript %]
                 [% PROCESS language lang=other.lang | trim %]:
-                [% other.term %]
+                [% other.term | html %]
                 [% IF ! loop.last %] ; [% END %]
               [% END %]
               </div>
    [% CASE ['ara'] %]Arabic
    [% CASE ['gre'] %]Greek (modern)
    [% CASE ['grc'] %]Greek (to 1453)
-   [% CASE %][% lang %]
+   [% CASE %][% lang | html %]
   [% END %]
 [% END %]
index 1f4bab7..3fa669a 100644 (file)
@@ -1,5 +1,5 @@
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1>
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1>
 <!-- Begin Authorities Resident Search Box -->
 <div id="header_search" class="residentsearch">
     <div id="mainmain_heading" class="residentsearch">
@@ -11,9 +11,9 @@
         [% IF (marcflavour == 'UNIMARC' ) %]<option value="">All authority types</option>[% END %]
         [% FOREACH authority_type IN authority_types %]
             [% IF authority_type.authtypecode == authtypecode %]
-            <option value="[% authority_type.authtypecode%]" selected="selected">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
             [% ELSE %]
-            <option value="[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
             [% END %]
         [% END %]
         </select>
@@ -37,7 +37,7 @@
             <option value="is">is exactly</option>
             [% END %]
         </select>
-        <input id="value_mainentry" type="text" name="value" value="[% value | html%]" class="head-searchbox" />
+        <input id="value_mainentry" type="text" name="value" value="[% value | html %]" class="head-searchbox" />
         <select name="orderby">
             [% IF ( orderby == 'HeadingAsc' ) %]
             <option value="HeadingAsc" selected="selected">Heading A-Z</option>
@@ -67,9 +67,9 @@
         [% IF (marcflavour == 'UNIMARC' ) %]<option value="">All authority types</option>[% END %]
         [% FOREACH authority_type IN authority_types %]
             [% IF authority_type.authtypecode == authtypecode %]
-            <option value="[% authority_type.authtypecode %]" selected="selected">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
             [% ELSE %]
-            <option value="[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
             [% END %]
         [% END %]
         </select>
@@ -93,7 +93,7 @@
             <option value="is">is exactly</option>
             [% END %]
         </select>
-        <input id="value_mainentry" type="text" name="value" value="[% value | html%]" class="head-searchbox" />
+        <input id="value_mainentry" type="text" name="value" value="[% value | html %]" class="head-searchbox" />
         <select name="orderby">
             [% IF ( orderby == 'HeadingAsc' ) %]
             <option value="HeadingAsc" selected="selected">Heading A-Z</option>
         [% IF (marcflavour == 'UNIMARC' ) %]<option value="">All authority types</option>[% END %]
         [% FOREACH authority_type IN authority_types %]
             [% IF authority_type.authtypecode == authtypecode %]
-            <option value="[% authority_type.authtypecode %]" selected="selected">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
             [% ELSE %]
-            <option value="[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
             [% END %]
         [% END %]
         </select>
         [% IF (marcflavour == 'UNIMARC' ) %]<option value="">All authority types</option>[% END %]
         [% FOREACH authority_type IN authority_types %]
             [% IF authority_type.authtypecode == authtypecode %]
-            <option value="[% authority_type.authtypecode %]" selected="selected">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
             [% ELSE %]
-            <option value="[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</option>
+            <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
             [% END %]
         [% END %]
         </select>
index 243f275..893df07 100644 (file)
@@ -14,7 +14,7 @@
                         <li role="separator" class="divider"></li>
                     [% END %]
                     [% FOREACH authority_type IN authority_types %]
-                        <li><a href="/cgi-bin/koha/authorities/authorities.pl?authtypecode=[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</a></li>
+                        <li><a href="/cgi-bin/koha/authorities/authorities.pl?authtypecode=[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</a></li>
                     [% END %]
                 </ul>
             </div>
@@ -27,8 +27,8 @@
                         <i class="fa fa-pencil"></i> Edit <span class="caret"></span>
                     </button>
                     <ul class="dropdown-menu">
-                        <li><a id="editAuth" href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid %]">Edit record</a></li>
-                        <li><a id="dupAuth" href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid %]&amp;op=duplicate">Edit as new (duplicate)</a></li>
+                        <li><a id="editAuth" href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid | html %]">Edit record</a></li>
+                        <li><a id="dupAuth" href="/cgi-bin/koha/authorities/authorities.pl?authid=[% authid | html %]&amp;op=duplicate">Edit as new (duplicate)</a></li>
                         [% IF servers.count > 0 %]
                             <li><a id="z3950_replace" href="#">Replace record via Z39.50/SRU</a></li>
                         [% END %]
                 <span class="caret"></span>
                 </a>
                 <ul class="dropdown-menu">
-                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=mads&amp;op=export&amp;authid=[% authid %]">MADS (XML)</a></li>
-                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=marcxml&amp;op=export&amp;authid=[% authid %]">MARCXML</a></li>
-                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=marc8&amp;op=export&amp;authid=[% authid %]">MARC (non-Unicode/MARC-8)</a></li>
-                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=utf8&amp;op=export&amp;authid=[% authid %]">MARC (Unicode/UTF-8)</a></li>
+                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=mads&amp;op=export&amp;authid=[% authid | html %]">MADS (XML)</a></li>
+                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=marcxml&amp;op=export&amp;authid=[% authid | html %]">MARCXML</a></li>
+                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=marc8&amp;op=export&amp;authid=[% authid | html %]">MARC (non-Unicode/MARC-8)</a></li>
+                    <li><a href="/cgi-bin/koha/authorities/export.pl?format=utf8&amp;op=export&amp;authid=[% authid | html %]">MARC (Unicode/UTF-8)</a></li>
                 </ul>
             </div>
         [% END %]
index 9e173c9..45225f8 100644 (file)
@@ -6,11 +6,11 @@
 [% BLOCK showtree %]
     <ul class="hierarchy">
         [% FOREACH node IN tree %]
-            <li id="hier[% node.authid %]" class="[% node.class %] authnode">
+            <li id="hier[% node.authid | html %]" class="[% node.class | html %] authnode">
             [% IF ( node.current_value ) %]
                 <span class='currentauth'>[% node.value | html %]</span>
             [% ELSE %]
-                <a href="detail.pl?authid=[% node.authid %]" title="Term">[% node.value | html %]</a>
+                <a href="detail.pl?authid=[% node.authid | html %]" title="Term">[% node.value | html %]</a>
             [% END %]
             [% IF ( node.children && node.children.size > 0 ) %]
                 [% PROCESS showtree tree = node.children %]
index 7584c9f..7109dc9 100644 (file)
@@ -34,22 +34,22 @@ function showMergingInProgress() {
 function confirm_deletion(id) {
     var is_confirmed = confirm(_("Are you sure you want to delete this authority?"));
     if( !id ){
-        id = "[% authid %]";
+        id = "[% authid | html %]";
     }
     if (is_confirmed) {
       window.location="authorities-home.pl?op=delete"
           + "&authid=" + id
           + "&type=intranet"
-          + "&authtypecode=[% authtypecode %]"
-          + "&marclist=[% marclist %]"
-          + "&and_or=[% and_or %]"
-          + "&excluding=[% excluding %]"
-          + "&operator=[% operator %]"
-          + "&orderby=[% orderby %]"
+          + "&authtypecode=[% authtypecode | html %]"
+          + "&marclist=[% marclist | html %]"
+          + "&and_or=[% and_or | html %]"
+          + "&excluding=[% excluding | html %]"
+          + "&operator=[% operator | html %]"
+          + "&orderby=[% orderby | html %]"
           + "&value=[% value |url %]"
-          + "&startfrom=[% startfrom %]"
-          + "&resultsperpage=[% resultsperpage %]"
-          + "&csrf_token=[% csrf_token %]";
+          + "&startfrom=[% startfrom | html %]"
+          + "&resultsperpage=[% resultsperpage | html %]"
+          + "&csrf_token=[% csrf_token | html %]";
     }
 }
 
@@ -72,10 +72,10 @@ $(document).ready(function () {
 
     $("#z3950_replace").click(function(e){
         e.preventDefault();
-        window.open("/cgi-bin/koha/cataloguing/z3950_auth_search.pl?authid=[% authid %]","z3950search",'width=800,height=500,location=yes,toolbar=no,scrollbars=yes,resize=yes');
+        window.open("/cgi-bin/koha/cataloguing/z3950_auth_search.pl?authid=[% authid | html %]","z3950search",'width=800,height=500,location=yes,toolbar=no,scrollbars=yes,resize=yes');
     });
 
-    var searchType = '[% marclist %]';
+    var searchType = '[% marclist | html %]';
     if (searchType) {
         if ('mainentry' == searchType) {
             $("#header_search").tabs( "option", "selected", 0 );
@@ -88,4 +88,4 @@ $(document).ready(function () {
 
 });
 
-</script>
\ No newline at end of file
+</script>
index e2270b8..4385125 100644 (file)
 [% DEFAULT class = '' size = 20 %]
 
 [% IF avs %]
-  <select id="[% name %]" name="[% name %]" class="[% class %]" >
+  <select id="[% name | html %]" name="[% name | html %]" class="[% class | html %]" >
   [% IF all %]<option value="">All</option>[% END %]
   [% FOR av IN avs %]
     [% IF av.authorised_value == default %]
-      <option value="[% av.authorised_value %]" selected="selected">[% av.lib | html_entity %]</option>
+      <option value="[% av.authorised_value | html %]" selected="selected">[% av.lib | html_entity %]</option>
     [% ELSE %]
-      <option value="[% av.authorised_value %]">[% av.lib | html_entity %]</option>
+      <option value="[% av.authorised_value | html %]">[% av.lib | html_entity %]</option>
     [% END %]
   [% END %]
   </select>
 [% ELSE %]
-  <input type="text" id="[% name %]" name="[% name %]" size="[% size %]" value="[% default | html_entity %]" class="[% class %]" />
+  <input type="text" id="[% name | html %]" name="[% name | html %]" size="[% size | html %]" value="[% default | html_entity %]" class="[% class | html %]" />
 [% END %]
index db85cdd..a79fab3 100644 (file)
@@ -1 +1 @@
-[% IF ( BiblioDefaultViewmarc ) %]<a class="title" href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSIF ( BiblioDefaultViewlabeled_marc ) %]<a class="title" href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSIF ( BiblioDefaultViewisbd ) %]<a class="title" href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSE %]<a class="title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber |url %]">[% END %]
\ No newline at end of file
+[% IF ( BiblioDefaultViewmarc ) %]<a class="title" href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSIF ( BiblioDefaultViewlabeled_marc ) %]<a class="title" href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSIF ( BiblioDefaultViewisbd ) %]<a class="title" href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblionumber |url %]">[% ELSE %]<a class="title" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber |url %]">[% END %]
index f0b2a8f..9f5c0cb 100644 (file)
     [% IF ( moredetailview ) %]<li class="active">[% ELSE %]<li>[% END %]
     <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio_object_id | url  %]">Items</a></li>
     [% IF ( CAN_user_reserveforothers ) %]
-    [% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id | url  %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) %])</a></li>
+    [% IF ( holdsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio_object_id | url  %]">Holds ([% Biblio.HoldsCount( biblio_object_id ) | html %])</a></li>
     [% END %]
     [% IF ( EasyAnalyticalRecords ) %][% IF ( analyze ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio_object_id | url  %]&amp;analyze=1">Analytics</a></li>[% END %]
 
     [% IF Koha.Preference('ArticleRequests') %]
         [% IF ( article_requests_view ) %]<li class="active">[% ELSE %]<li>[% END %]
-        <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% IF ( object ) %][% object %][% ELSE %][% biblionumber %][% END %]">Article requests ([% Biblio.ArticleRequestsActiveCount( biblio_object_id ) %])</a></li>
+        <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% IF ( object ) %][% object | html %][% ELSE %][% biblionumber | html %][% END %]">Article requests ([% Biblio.ArticleRequestsActiveCount( biblio_object_id ) | html %])</a></li>
     [% END %]
 
     [% IF ( subscriptionsnumber ) %]<li><a href="/cgi-bin/koha/serials/serials-search.pl?searched=1&amp;biblionumber=[% biblio_object_id | url  %]">Subscription(s)</a></li>[% END %]
@@ -42,4 +42,3 @@
 [% IF ( CAN_user_tools_view_system_logs ) %][% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=CATALOGUING&amp;action=MODIFY&amp;object=[% biblio_object_id | url  %]">Modification log</a> </li>[% END %]
 </ul>
 </div>
-
index 1cbe84f..0da49d0 100644 (file)
@@ -3,11 +3,11 @@
 [% IF fines and fines > 0 %]
     <li>
         <span class="circ-hlt">Fees &amp; Charges:</span>
-        Patron has outstanding fees &amp; charges of [% fines | $Price %].
+        Patron has outstanding fees &amp; charges of [% fines | $Price | html %].
         [% IF !Koha.Preference('AllowFineOverride') && NoIssuesCharge && fines > NoIssuesCharge %]
            <span class="circ-hlt">Checkouts are BLOCKED because fine balance is OVER THE LIMIT.</span>
         [% END %]
-        <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% borrowernumber %]" class="btn btn-default btn-xs" >Make payment</a>
-        <a href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% borrowernumber %]" class="btn btn-default btn-xs" >Pay all fines</a></li>
+        <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% borrowernumber | html %]" class="btn btn-default btn-xs" >Make payment</a>
+        <a href="/cgi-bin/koha/members/paycollect.pl?borrowernumber=[% borrowernumber | html %]" class="btn btn-default btn-xs" >Pay all fines</a></li>
     </li>
 [% END %]
index 0ab6738..410ce1e 100644 (file)
@@ -7,9 +7,9 @@
         <div class="dialog message">This bibliographic record does not exist.</div>
     [% CASE 'unknown_item' %]
         <div class="dialog message">This item does not exist.</div>
-    [% CASE %][% blocking_error %]
+    [% CASE %][% blocking_error | html %]
     [% END %]
 
     [% INCLUDE 'intranet-bottom.inc' %]
-    [% STOP %] [%# Will stop gracefully without processing any more of the template document.%]
+    [% STOP | html %] [%# Will stop gracefully without processing any more of the template document.%]
 [% END %]
index 92dda54..b49fd5d 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 <div id="reldebarments">
     [% IF ( not debarments.defined || debarments.size < 1 ) %]
         <p>Patron is currently unrestricted.</p>
                         </td>
                         <td>
                            [% IF d.comment.search('OVERDUES_PROCESS') %]
-                               Restriction added by overdues process [% d.comment.remove('OVERDUES_PROCESS ') %]
+                               Restriction added by overdues process [% d.comment.remove('OVERDUES_PROCESS ') | $raw %]
                            [% ELSE %]
-                               [% d.comment %]
+                [% d.comment | $raw %]
                            [% END %]
                        </td>
                         <td>[% IF d.expiration %] [% d.expiration | $KohaDates %] [% ELSE %] <i>Indefinite</i> [% END %]</td>
                         <td>[% d.created | $KohaDates %]</td>
                         [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                             <td>
-                                <a class="remove_restriction btn btn-default btn-xs" href="/cgi-bin/koha/members/mod_debarment.pl?borrowernumber=[% patron.borrowernumber %]&amp;borrower_debarment_id=[% d.borrower_debarment_id %]&amp;action=del">
+                                <a class="remove_restriction btn btn-default btn-xs" href="/cgi-bin/koha/members/mod_debarment.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;borrower_debarment_id=[% d.borrower_debarment_id | html %]&amp;action=del">
                                     <i class="fa fa-trash"></i> Remove
                                 </a>
                             </td>
@@ -53,7 +54,7 @@
     [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
         <p><a href="#" id="add_manual_restriction"><i class="fa fa-plus"></i> Add manual restriction</a></p>
         <form method="post" action="/cgi-bin/koha/members/mod_debarment.pl" class="clearfix">
-            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
             <input type="hidden" name="action" value="add" />
             <fieldset class="rows" id="manual_restriction_form">
                 <legend>Add manual restriction</legend>
index b91ecc2..6aea85b 100644 (file)
@@ -1,8 +1,8 @@
 [%# First check to see if we have anything selected, otherwise we select all %]
-[% selectall = 1 %]
+[% selectall = 1 | html %]
 [% FOREACH branch IN branches %]
     [% IF branch.selected %]
-        [% selectall = 0 %]
+        [% selectall = 0 | html %]
     [% END %]
 [% END %]
 <div class="branchselector">
     [% FOREACH branch IN branches %]
         <div class="branchgriditem">
             [% IF branch.selected || (selectall == 1) %]
-                <input id="branch_[% branch.branchcode %]" class="branch_select" type="checkbox" name="branch" value="[% branch.branchcode %]" checked="checked" />
+                <input id="branch_[% branch.branchcode | html %]" class="branch_select" type="checkbox" name="branch" value="[% branch.branchcode | html %]" checked="checked" />
             [% ELSE %]
-                <input id="branch_[% branch.branchcode %]" class="branch-select" type="checkbox" name="branch" value="[% branch.branchcode %]" />
+                <input id="branch_[% branch.branchcode | html %]" class="branch-select" type="checkbox" name="branch" value="[% branch.branchcode | html %]" />
             [% END %]
 
-            <label for="branch_[% branch.branchcode %]">[% branch.branchname %]</label>
+            <label for="branch_[% branch.branchcode | html %]">[% branch.branchname | html %]</label>
         </div>
         [% IF loop.count() % 4 == 0 && !loop.last() %]
             </div>
index 8754cc0..ca14976 100644 (file)
@@ -1,6 +1,6 @@
 [% IF ( currency ) %]
     [% IF ( not hide ) %]
-        <p><b>Currency = [% currency %]</b></p>
+        <p><b>Currency = [% currency | html %]</b></p>
     [% END %]
 [% ELSE %]
     <div class="dialog alert">
index 3399ce9..812f226 100644 (file)
@@ -1,25 +1,25 @@
 [% USE Koha %]
 [% USE Branches %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Fund Admin Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Fund Admin Resident Search Box -->
 
 <div id="header_search">
     <div id="budgets_search" class="residentsearch">
         <p class="tip">Search funds:</p>
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
-            <label for="filter_budgetname">Fund code: </label><input class="query" type="text" name="filter_budgetname" id="filter_budgetname" size="20" value="[% filter_budgetname %]" />
+            <label for="filter_budgetname">Fund code: </label><input class="query" type="text" name="filter_budgetname" id="filter_budgetname" size="20" value="[% filter_budgetname | html %]" />
             <label for="filter_budgetbranch">Library: </label>
             <select name="filter_budgetbranch" id="filter_budgetbranch" style="width:10em;">
                 <option value=""></option>
                     [% FOREACH branchloo IN Branches.all( selected => selected_branchcode ) %]
                         [% IF branchloo.selected %]
-                        <option value="[% branchloo.branchcode %]" selected="selected">[% branchloo.branchname %]</option>
+                        <option value="[% branchloo.branchcode | html %]" selected="selected">[% branchloo.branchname | html %]</option>
                         [% ELSE %]
-                        <option value="[% branchloo.branchcode %]" >[% branchloo.branchname %]</option>
+                        <option value="[% branchloo.branchcode | html %]" >[% branchloo.branchname | html %]</option>
                         [% END %]
                     [% END %]
             </select>
-          <input type="hidden"  name="budget_period_id" value="[% budget_period_id %]" />
+          <input type="hidden"  name="budget_period_id" value="[% budget_period_id | html %]" />
           <input type="submit" class="submit" name="filter" value="Submit" />
         </form>
     </div>
index 813ee8c..f76b787 100644 (file)
                     [% ELSE %]
                         <li>
                     [% END %]
-                    <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_period_id=[% budget_period_id %]">New fund for [% budget_period_description %]</a></li>
+                    <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_period_id=[% budget_period_id | html %]">New fund for [% budget_period_description | html %]</a></li>
                 </ul>
         </div>
 
         <div class="btn-group">
             <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-pencil"></i> Edit <span class="caret"></span></button>
                 <ul class="dropdown-menu">
-                    <li><a href="/cgi-bin/koha/admin/aqbudgetperiods.pl?op=add_form&amp;budget_period_id=[% budget_period_id %]">Edit budget [% budget_period_description %]</a></li>
-                    <li><a href="/cgi-bin/koha/admin/aqbudgetperiods.pl?op=duplicate_form&amp;budget_period_id=[% budget_period_id %]">Duplicate budget [% budget_period_description %]</a></li>
+                    <li><a href="/cgi-bin/koha/admin/aqbudgetperiods.pl?op=add_form&amp;budget_period_id=[% budget_period_id | html %]">Edit budget [% budget_period_description | html %]</a></li>
+                    <li><a href="/cgi-bin/koha/admin/aqbudgetperiods.pl?op=duplicate_form&amp;budget_period_id=[% budget_period_id | html %]">Duplicate budget [% budget_period_description | html %]</a></li>
                 </ul>
         </div>
 
                     [% ELSE %]
                     <li class="disabled">
                     [% END %]
-                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id %]&amp;authcat=MONTHS">Plan by months</a></li>
+                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id | html %]&amp;authcat=MONTHS">Plan by months</a></li>
                     [% IF ( CAN_user_acquisition_planning_manage ) %]
                     <li>
                     [% ELSE %]
                     <li class="disabled">
                     [% END %]
-                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id %]&amp;authcat=BRANCHES">Plan by libraries</a></li>
+                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id | html %]&amp;authcat=BRANCHES">Plan by libraries</a></li>
                     [% IF ( CAN_user_acquisition_planning_manage ) %]
                     <li>
                     [% ELSE %]
                     <li class="disabled">
                     [% END %]
-                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id %]&amp;authcat=ITEMTYPES">Plan by item types</a></li>
+                    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id | html %]&amp;authcat=ITEMTYPES">Plan by item types</a></li>
                     [% FOREACH auth_cats_loo IN auth_cats_loop %]
                         [% IF ( CAN_user_acquisition_planning_manage ) %]
                         <li>
                         [% ELSE %]
                         <li class="disabled">
                         [% END %]
-                        <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id %]&amp;authcat=[% auth_cats_loo %]">Plan by [% auth_cats_loo %]</a>
+                        <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id | html %]&amp;authcat=[% auth_cats_loo | html %]">Plan by [% auth_cats_loo | html %]</a>
                         </li>
                     [% END %]
                 </ul>
index f13a1fa..653221e 100644 (file)
@@ -2,8 +2,8 @@
 <script type="text/javascript">
 //<![CDATA[
 
-var debug    = "[% debug %]";
-var dformat  = "[% dateformat %]";
+var debug    = "[% debug | html %]";
+var dformat  = "[% dateformat | html %]";
 var sentmsg = 0;
 if (debug > 1) {alert("dateformat: " + dformat + "\ndebug is on (level " + debug + ")");}
 var MSG_PLEASE_ENTER_A_VALID_DATE = (_("Please enter a valid date (should match %s)."));
@@ -12,7 +12,7 @@ function is_valid_date(date) {
     // An empty string is considered as a valid date for convenient reasons.
     if ( date === '' ) return 1;
 
-    var dateformat = dateformat_str = '[% Koha.Preference('dateformat') %]';
+    var dateformat = dateformat_str = '[% Koha.Preference('dateformat') | html %]';
     if ( dateformat == 'us' ) {
         if ( date.search(/^\d{2}\/\d{2}\/\d{4}($|\s)/) == -1 ) return 0;
         dateformat = 'mm/dd/yy';
@@ -50,7 +50,7 @@ function get_dateformat_str(dateformat) {
 
 function validate_date (dateText, inst) {
     if ( !is_valid_date(dateText) ) {
-        var dateformat_str = get_dateformat_str( '[% Koha.Preference('dateformat') %]' );
+        var dateformat_str = get_dateformat_str( '[% Koha.Preference('dateformat') | html %]' );
         alert(MSG_PLEASE_ENTER_A_VALID_DATE.format(dateformat_str));
         $('#'+inst.id).val('');
     }
@@ -118,7 +118,7 @@ jQuery(function($){
         dayNamesMin: [_("Su"),_("Mo"),_("Tu"),_("We"),_("Th"),_("Fr"),_("Sa")],
         weekHeader: _("Wk"),
         dateFormat: "[% IF ( dateformat == "us" ) %]mm/dd/yy[% ELSIF ( dateformat == "metric" ) %]dd/mm/yy[% ELSIF ( dateformat == "dmydot" ) %]dd.mm.yy[% ELSE %]yy-mm-dd[% END %]",
-        firstDay: [% Koha.Preference('CalendarFirstDayOfWeek') %],
+        firstDay: [% Koha.Preference('CalendarFirstDayOfWeek') | html %],
         isRTL: [% IF ( bidi ) %]true[% ELSE %]false[% END %],
         showMonthAfterYear: false,
         yearSuffix: ''};
@@ -131,7 +131,7 @@ $.datepicker.setDefaults({
         showOn: "both",
         changeMonth: true,
         changeYear: true,
-        buttonImage: '[% interface %]/[% theme %]/img/famfamfam/silk/calendar.png',
+        buttonImage: '[% interface | html %]/[% theme | html %]/img/famfamfam/silk/calendar.png',
         buttonImageOnly: true,
         showButtonPanel: true,
         showOtherMonths: true,
index ada7f19..0737885 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Catalogue Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Catalogue Resident Search Box -->
 <div id="header_search">
 
 [% INCLUDE 'patron-search-box.inc' %]
index 781b797..d5191e3 100644 (file)
@@ -11,17 +11,17 @@ CAN_user_serials_create_subscription ) %]
             [% END %]
 
             [% IF ( CAN_user_editcatalogue_edit_items ) %]
-             <li><a id="newitem" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]#additema">New item</a></li>
+             <li><a id="newitem" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber | html %]#additema">New item</a></li>
             [% END %]
             [% IF ( CAN_user_serials_create_subscription ) %]
-             <li><a id="newsub" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber %]">New subscription</a></li>
+             <li><a id="newsub" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber | html %]">New subscription</a></li>
             [% END %]
 
             [% IF ( EasyAnalyticalRecords && CAN_user_editcatalogue_edit_catalogue ) %]
-                <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]&amp;analyze=1">Analyze items</a></li>
+                <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]&amp;analyze=1">Analyze items</a></li>
             [% END %]
             [% IF CAN_user_editcatalogue_edit_catalogue && ! EasyAnalyticalRecords %]
-                <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?parentbiblionumber=[% biblionumber %]">New child record</a></li>
+                <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?parentbiblionumber=[% biblionumber | html %]">New child record</a></li>
             [% END %]
     </ul>
     </div>
@@ -32,16 +32,16 @@ CAN_user_serials_create_subscription ) %]
     <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-pencil"></i> Edit <span class="caret"></span></button>
         <ul class="dropdown-menu">
             [% IF CAN_user_editcatalogue_edit_catalogue or ( frameworkcode == 'FA' and CAN_user_editcatalogue_fast_cataloging ) %]
-            <li><a id="editbiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">Edit record</a></li>
+            <li><a id="editbiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber | html %]">Edit record</a></li>
             [% END %]
 
             [% IF CAN_user_editcatalogue_edit_items or ( frameworkcode == 'FA' and CAN_user_editcatalogue_fast_cataloging ) %]
-            <li><a id="edititems" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]">Edit items</a></li>
+            <li><a id="edititems" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber | html %]">Edit items</a></li>
             [% END %]
 
             [% IF ( CAN_user_tools_items_batchmod ) %]
                 [% IF ( count ) %]
-                    <li><a id="batchedit" href="/cgi-bin/koha/tools/batchMod.pl?op=show&amp;biblionumber=[% biblionumber %]&amp;src=CATALOGUING">Edit items in batch</a></li>
+                    <li><a id="batchedit" href="/cgi-bin/koha/tools/batchMod.pl?op=show&amp;biblionumber=[% biblionumber | html %]&amp;src=CATALOGUING">Edit items in batch</a></li>
                 [% ELSE %]
                     <li class="disabled"><a id="batchedit-disabled" href="#" data-toggle="tooltip" data-placement="left" title="This record has no items">Edit items in batch</a></li>
                 [% END %]
@@ -49,27 +49,27 @@ CAN_user_serials_create_subscription ) %]
 
             [% IF ( CAN_user_tools_items_batchdel ) %]
                 [% IF ( count ) %]
-                    <li><a id="batchdelete" href="/cgi-bin/koha/tools/batchMod.pl?del=1&amp;op=show&amp;biblionumber=[% biblionumber %]&amp;src=CATALOGUING">Delete items in a batch</a></li>
+                    <li><a id="batchdelete" href="/cgi-bin/koha/tools/batchMod.pl?del=1&amp;op=show&amp;biblionumber=[% biblionumber | html %]&amp;src=CATALOGUING">Delete items in a batch</a></li>
                 [% ELSE %]
                     <li class="disabled"><a id="batchdelete-disabled" href="#" data-toggle="tooltip" data-placement="left" title="This record has no items">Delete items in a batch</a></li>
                 [% END %]
             [% END %]
 
-            [% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber %]">Attach item</a></li>[% END %]
+            [% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber | html %]">Attach item</a></li>[% END %]
 
-            [% IF ( EasyAnalyticalRecords ) %][% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/linkitem.pl?biblionumber=[% biblionumber %]">Link to host item</a>[% END %][% END %]
-            [% IF ( LocalCoverImages || OPACLocalCoverImages) %][% IF ( CAN_user_tools_upload_local_cover_images ) %]<li><a href="/cgi-bin/koha/tools/upload-cover-image.pl?biblionumber=[% biblionumber %]&amp;filetype=image">Upload image</a>[% END %][% END %]
+            [% IF ( EasyAnalyticalRecords ) %][% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/linkitem.pl?biblionumber=[% biblionumber | html %]">Link to host item</a>[% END %][% END %]
+            [% IF ( LocalCoverImages || OPACLocalCoverImages) %][% IF ( CAN_user_tools_upload_local_cover_images ) %]<li><a href="/cgi-bin/koha/tools/upload-cover-image.pl?biblionumber=[% biblionumber | html %]&amp;filetype=image">Upload image</a>[% END %][% END %]
 
             [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
-                <li><a id="duplicatebiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]&amp;op=duplicate">Edit as new (duplicate)</a></li>
+                <li><a id="duplicatebiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber | html %]&amp;op=duplicate">Edit as new (duplicate)</a></li>
                 <li><a href="#" id="z3950copy">Replace record via Z39.50/SRU</a></li>
             [% END %]
 
             [% IF CAN_user_editcatalogue_edit_catalogue or ( frameworkcode == 'FA' and CAN_user_editcatalogue_fast_cataloging ) %]
                 [% IF ( count ) %]
-                    <li class="disabled"><a id="deletebiblio" data-toggle="tooltip" data-placement="left" title="[% count %] item(s) are attached to this record. You must delete all items before deleting this record." href="#">Delete record</a></li>
+                    <li class="disabled"><a id="deletebiblio" data-toggle="tooltip" data-placement="left" title="[% count | html %] item(s) are attached to this record. You must delete all items before deleting this record." href="#">Delete record</a></li>
                 [% ELSE %]
-                    <li><a id="deletebiblio" data-order-manage="[% CAN_user_acquisition_order_manage %]" href="#">Delete record</a></li>
+                    <li><a id="deletebiblio" data-order-manage="[% CAN_user_acquisition_order_manage | html %]" href="#">Delete record</a></li>
                 [% END %]
             [% END %]
 
@@ -88,14 +88,14 @@ CAN_user_serials_create_subscription ) %]
     <div class="btn-group">
     <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-download"></i> Save <span class="caret"></span></button>
     <ul class="dropdown-menu">
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=bibtex&amp;op=export&amp;bib=[% biblionumber %]">BIBTEX</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=bibtex&amp;op=export&amp;bib=[% biblionumber | html %]">BIBTEX</a></li>
         <li><a href="#" data-toggle="modal" data-target="#exportModal_">Dublin Core</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marcxml&amp;op=export&amp;bib=[% biblionumber %]">MARCXML</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marc8&amp;op=export&amp;bib=[% biblionumber %]">MARC (non-Unicode/MARC-8)</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=utf8&amp;op=export&amp;bib=[% biblionumber %]">MARC (Unicode/UTF-8)</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marcstd&amp;op=export&amp;bib=[% biblionumber %]">MARC (Unicode/UTF-8, Standard)</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=mods&amp;op=export&amp;bib=[% biblionumber %]">MODS (XML)</a></li>
-        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=ris&amp;op=export&amp;bib=[% biblionumber %]">RIS</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marcxml&amp;op=export&amp;bib=[% biblionumber | html %]">MARCXML</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marc8&amp;op=export&amp;bib=[% biblionumber | html %]">MARC (non-Unicode/MARC-8)</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=utf8&amp;op=export&amp;bib=[% biblionumber | html %]">MARC (Unicode/UTF-8)</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=marcstd&amp;op=export&amp;bib=[% biblionumber | html %]">MARC (Unicode/UTF-8, Standard)</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=mods&amp;op=export&amp;bib=[% biblionumber | html %]">MODS (XML)</a></li>
+        <li><a href="/cgi-bin/koha/catalogue/export.pl?format=ris&amp;op=export&amp;bib=[% biblionumber | html %]">RIS</a></li>
     </ul>
     </div>
 
@@ -125,18 +125,18 @@ CAN_user_serials_create_subscription ) %]
                     <span class="caret"></span>
                 </button>
                 <ul class="dropdown-menu">
-                    <li><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber %]">Place hold</a></li>
-                    <li><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber %]&amp;findborrower=[% holdfor_cardnumber %]">Place hold for [% holdfor_firstname %] [% holdfor_surname %] ([% holdfor_cardnumber %])</a></li>
+                    <li><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber | html %]">Place hold</a></li>
+                    <li><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber | html %]&amp;findborrower=[% holdfor_cardnumber | html %]">Place hold for [% holdfor_firstname | html %] [% holdfor_surname | html %] ([% holdfor_cardnumber | html %])</a></li>
                 </ul>
             </div>
         [% ELSE %]
-            <div class="btn-group"><a id="placehold" class="btn btn-default btn-sm" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber %]"><i class="fa fa-sticky-note-o"></i> Place hold</a></div>
+            <div class="btn-group"><a id="placehold" class="btn btn-default btn-sm" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber | html %]"><i class="fa fa-sticky-note-o"></i> Place hold</a></div>
         [% END %]
     [% END %]
 [% END %]
 
 [% IF Koha.Preference('ArticleRequests') %]
-    <div class="btn-group"><a id="placehold" class="btn btn-default btn-sm" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% biblionumber %]"><i class="fa fa-file-text-o"></i> Request article</a></div>
+    <div class="btn-group"><a id="placehold" class="btn btn-default btn-sm" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% biblionumber | html %]"><i class="fa fa-file-text-o"></i> Request article</a></div>
 [% END %]
 
 </div>
@@ -168,7 +168,7 @@ CAN_user_serials_create_subscription ) %]
             <button class="btn btn-link" data-dismiss="modal" aria-hidden="true">Cancel</button>
         </div>
         <input type="hidden" name="op" value="export" />
-        <input type="hidden" name="bib" value="[% biblionumber %]" />
+        <input type="hidden" name="bib" value="[% biblionumber | html %]" />
         </form>
         </div>
         </div>
index 86502ef..549f26b 100644 (file)
     var MSG_NO_ITEMS = _("This record has no items.");
 
     /* Some required variables from the template */
-    var biblionumber = [% biblionumber %];
-    var count = [% count %];
-    var holdcount = [% holdcount %];
-    var countorders = [% countorders %];
-    var countdeletedorders = [% countdeletedorders %];
+    var biblionumber = [% biblionumber | html %];
+    var count = [% count | html %];
+    var holdcount = [% holdcount | html %];
+    var countorders = [% countorders | html %];
+    var countdeletedorders = [% countdeletedorders | html %];
 
     /* provide Z3950 search points */
     function GetZ3950Terms(){
index a289b70..35a496a 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Cataloging Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Cataloging Resident Search Box -->
     <div id="header_search">
         <div id="addbooks_search" class="residentsearch">
         <p class="tip">Search the catalog and the reservoir:</p>
index 5e38a58..39dad76 100644 (file)
@@ -1,5 +1,5 @@
 [%- USE Branches -%]
 [%- USE Koha -%]
-[%- biblio = item.biblio -%]
-[%- biblioitem = item.biblioitem -%]
-"[% biblio.title |html %] [% IF ( Koha.Preference( 'marcflavour' ) == 'UNIMARC' && biblio.author ) %]by [% END %][% biblio.author |html %]", "[% (biblioitem.publicationyear || biblio.copyrightdate) |html %]", "[% biblioitem.publishercode |html %]", "[% biblioitem.collectiontitle |html %]", "[% item.barcode |html %]", "[% item.itemcallnumber |html %]", "[% Branches.GetName(item.homebranch) |html %]", "[% Branches.GetName(item.holdingbranch) |html %]", "[% item.location |html %]", "[% item.stocknumber |html %]", "[% item.status |html %]", "[% (item.issues || 0) |html %]"
+[%- biblio = item.biblio | html -%]
+[%- biblioitem = item.biblioitem | html -%]
+"[% biblio.title | html %] [% IF ( Koha.Preference( 'marcflavour' ) == 'UNIMARC' && biblio.author ) %]by [% END %][% biblio.author | html %]", "[% (biblioitem.publicationyear || biblio.copyrightdate) | html %]", "[% biblioitem.publishercode | html %]", "[% biblioitem.collectiontitle | html %]", "[% item.barcode | html %]", "[% item.itemcallnumber | html %]", "[% Branches.GetName(item.homebranch) | html %]", "[% Branches.GetName(item.holdingbranch) | html %]", "[% item.location | html %]", "[% item.stocknumber | html %]", "[% item.status | html %]", "[% (item.issues || 0) | html %]"
index 30b7178..f3e1ac4 100644 (file)
@@ -1,26 +1,26 @@
 [%- USE Branches -%]
 [%- USE Koha -%]
 [% USE AuthorisedValues %]
-[%- biblio = item.biblio -%]
-[%- biblioitem = item.biblioitem -%]
+[%- biblio = item.biblio | html -%]
+[%- biblioitem = item.biblioitem | html -%]
 [
   "[% FILTER escape_quotes = replace('"', '\"') ~%]
-    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber %]" title="Go to record detail page">[% biblio.title |html %]</a>[% IF ( Koha.Preference( 'marcflavour' ) == 'UNIMARC' && biblio.author ) %] by[% END %] [% biblio.author |html %]
+    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber | html %]" title="Go to record detail page">[% biblio.title | html %]</a>[% IF ( Koha.Preference( 'marcflavour' ) == 'UNIMARC' && biblio.author ) %] by[% END %] [% biblio.author | html %]
   [%~ END %]",
-  "[% (biblioitem.publicationyear || biblio.copyrightdate) |html %]",
-  "[% biblioitem.publishercode |html %]",
-  "[% AuthorisedValues.GetByCode( 'CCODE', item.ccode ) %]",
+  "[% (biblioitem.publicationyear || biblio.copyrightdate) | html %]",
+  "[% biblioitem.publishercode | html %]",
+  "[% AuthorisedValues.GetByCode( 'CCODE', item.ccode ) | html %]",
   "[% FILTER escape_quotes ~%]
-    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber %]#item[% item.itemnumber %]" title="Go to item details">[% item.barcode |html %]</a>
+    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber | html %]#item[% item.itemnumber | html %]" title="Go to item details">[% item.barcode | html %]</a>
   [%~ END %]",
-  "[% item.itemcallnumber |html %]",
-  "[% Branches.GetName(item.homebranch) |html %]",
-  "[% Branches.GetName(item.holdingbranch) |html %]",
-  "[% item.location |html %]",
-  "[% item.stocknumber |html %]",
-  "[% item.status |html %]",
-  "[% (item.issues || 0) |html %]",
+  "[% item.itemcallnumber | html %]",
+  "[% Branches.GetName(item.homebranch) | html %]",
+  "[% Branches.GetName(item.holdingbranch) | html %]",
+  "[% item.location | html %]",
+  "[% item.stocknumber | html %]",
+  "[% item.status | html %]",
+  "[% (item.issues || 0) | html %]",
   "[% FILTER escape_quotes ~%]
-    <div class="btn-group dropup"><button type="button" class="btn btn-xs btn-default dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="fa fa-pencil"></i> Edit <span class="caret"></span> </button> <ul class="dropdown-menu"> <li><a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&biblionumber=[% item.biblionumber %]&itemnumber=[% item.itemnumber %]">Edit item</a></li> <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% item.biblionumber %]">Edit record</a></li> </ul> </div>
+    <div class="btn-group dropup"><button type="button" class="btn btn-xs btn-default dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <i class="fa fa-pencil"></i> Edit <span class="caret"></span> </button> <ul class="dropdown-menu"> <li><a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&biblionumber=[% item.biblionumber | html %]&itemnumber=[% item.itemnumber | html %]">Edit item</a></li> <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% item.biblionumber | html %]">Edit record</a></li> </ul> </div>
   [%~ END %]"
 ]
index 25902af..7dd6f9d 100644 (file)
@@ -1,22 +1,23 @@
-[% Asset.js("lib/codemirror/codemirror-compressed.js") %]
-[% Asset.js("lib/filesaver.js") %]
-[% Asset.js("lib/koha/cateditor/marc-mode.js") %]
-[% Asset.js("lib/require.js") %]
+[% USE raw %]
+[% Asset.js("lib/codemirror/codemirror-compressed.js") | $raw %]
+[% Asset.js("lib/filesaver.js") | $raw %]
+[% Asset.js("lib/koha/cateditor/marc-mode.js") | $raw %]
+[% Asset.js("lib/require.js") | $raw %]
 <script>
     var authInfo = {
         [%- FOREACH authtag = authtags -%]
-            [% authtag.tagfield %]: {
-                subfield: '[% authtag.tagsubfield %]',
-                authtypecode: '[% authtag.authtypecode %]',
+            [% authtag.tagfield | html %]: {
+                subfield: '[% authtag.tagsubfield | html %]',
+                authtypecode: '[% authtag.authtypecode | html %]',
                 },
         [%- END -%]
     };
 require.config( {
-    baseUrl: '[% interface %]/lib/koha/cateditor/',
+    baseUrl: '[% interface | html %]/lib/koha/cateditor/',
     config: {
         resources: {
-            marcflavour: '[% marcflavour %]',
-            themelang: '[% themelang %]',
+            marcflavour: '[% marcflavour | html %]',
+            themelang: '[% themelang | html %]',
         },
     },
     waitSeconds: 30,
@@ -38,10 +39,10 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
             checked: false,
         },
         [%- FOREACH server = z3950_servers -%]
-            [% server.id %]: {
-                name: '[% server.servername %]',
-                recordtype: '[% server.recordtype %]',
-                checked: [% server.checked ? 'true' : 'false' %],
+            [% server.id | html %]: {
+                name: '[% server.servername | html %]',
+                recordtype: '[% server.recordtype | html %]',
+                checked: [% server.checked ? 'true' : 'false' | html %],
             },
         [%- END -%]
     };
@@ -620,7 +621,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
             $( sel ).on( event, function (e) {
                 e.preventDefault();
                 handler( e, Preferences.user[pref] );
-                Preferences.Save( [% logged_in_user.borrowernumber %] );
+                Preferences.Save( [% logged_in_user.borrowernumber | html %] );
                 showPreference(pref);
             } );
         }
@@ -645,7 +646,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
                 $( document ).on( 'change', 'input.search-toggle-server', function() {
                     var server_id = $( this ).closest('li').data('server-id');
                     Preferences.user.selected_search_targets[server_id] = this.checked;
-                    Preferences.Save( [% logged_in_user.borrowernumber %] );
+                    Preferences.Save( [% logged_in_user.borrowernumber | html %] );
                 } );
                 break;
         }
@@ -683,7 +684,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
             delete Preferences.user.macros[name];
         }
 
-        Preferences.Save( [% logged_in_user.borrowernumber %] );
+        Preferences.Save( [% logged_in_user.borrowernumber | html %] );
     }
 
     function showSavedMacros( macros ) {
@@ -980,7 +981,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
         $( '#switch-editor' ).click( function() {
             if ( !confirm( _("Any changes will not be saved. Continue?") ) ) return;
 
-            $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber %]', 'basic', { expires: 365, path: '/' } );
+            $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'basic', { expires: 365, path: '/' } );
 
             if ( state.backend == 'catalog' ) {
                 window.location = '/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=' + state.recordID;
@@ -1093,7 +1094,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
         };
 
         // Start editor
-        Preferences.Load( [% logged_in_user.borrowernumber || 0 %] );
+        Preferences.Load( [% logged_in_user.borrowernumber || 0 | html %] );
         displayPreferences(editor);
         makeAuthorisedValueWidgets( '' );
         Search.Init( {
@@ -1112,8 +1113,8 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
             } );
         }
 
-        if ( "[% auth_forwarded_hash %]" ) {
-            document.location.hash = "[% auth_forwarded_hash %]";
+        if ( "[% auth_forwarded_hash | html %]" ) {
+            document.location.hash = "[% auth_forwarded_hash | html %]";
         }
 
         if ( !document.location.hash || !openRecord( document.location.hash.slice(1), editor, finishCb ) ) {
index ba049d5..b425fd3 100644 (file)
@@ -171,7 +171,7 @@ require( [ 'widget' ], function( Widget ) {
     Widget.Register( '008@', {
         makeTemplate: function() {
             var now = new Date();
-            return Widget.PadNum( now.getYear() % 100, 2 ) + Widget.PadNum( now.getMonth() + 1, 2 ) + Widget.PadNum( now.getDate(), 2 ) + "b        xxu||||| |||| 00| 0 [% DefaultLanguageField008 %] d";
+            return Widget.PadNum( now.getYear() % 100, 2 ) + Widget.PadNum( now.getMonth() + 1, 2 ) + Widget.PadNum( now.getDate(), 2 ) + "b        xxu||||| |||| 00| 0 [% DefaultLanguageField008 | html %] d";
         },
         init: function() {
             var $result = $( '<span class="subfield-widget fixed-widget">' + _("Fixed data:") + '<span class="hint widget-loading">' + _("Loading...") + '</span></span>' );
index 0f4fc67..05c5de6 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Checkin Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Checkin Resident Search Box -->
 <div id="header_search">
 [% INCLUDE 'patron-search-box.inc' %]
 
index 3adbfa3..b831c1e 100644 (file)
@@ -1,11 +1,11 @@
 <tfoot>
        <tr>
         <td colspan="11" style="text-align: right; font-weight:bold;">Totals:</td>
-        <td id="totaldue" style="text-align: right;">[% totaldue %]</td>
-        <td id="totalfine" style="text-align: right;">[% finetotal %]</td>
-        <td id="totalprice" style="text-align: right;">[% totalprice %]</td>
+        <td id="totaldue" style="text-align: right;">[% totaldue | html %]</td>
+        <td id="totalfine" style="text-align: right;">[% finetotal | html %]</td>
+        <td id="totalprice" style="text-align: right;">[% totalprice | html %]</td>
                 <td colspan="3"><div class="date-select">
-            <p><label for="newduedate">Renewal due date:</label> <input type="text" size="12" id="newduedate" name="newduedate" value="[% newduedate %]" />
+            <p><label for="newduedate">Renewal due date:</label> <input type="text" size="12" id="newduedate" name="newduedate" value="[% newduedate | html %]" />
 </p>
             <p><label for="exemptfine">Forgive fines on return: <input type="checkbox" id="exemptfine" name="exemptfine" value="1" /></label></p></div>
                </td>
index b34089d..9bcf780 100644 (file)
                         [% IF csv_profiles.size %]
                             <select name="csv_profile_id">
                                 [% FOREACH csv_profile IN csv_profiles %]
-                                    <option value="[% csv_profile.export_format_id %]">[% csv_profile.profile %]</option>
+                                    <option value="[% csv_profile.export_format_id | html %]">[% csv_profile.profile | html %]</option>
                                 [% END %]
                             </select>
                         [% END %]
-                       <label for="export_remove_fields">Don't export fields:</label> <input type="text" id="export_remove_fields" name="export_remove_fields" value="[% Koha.Preference('ExportRemoveFields') %]" title="Use for iso2709 exports" />
+                       <label for="export_remove_fields">Don't export fields:</label> <input type="text" id="export_remove_fields" name="export_remove_fields" value="[% Koha.Preference('ExportRemoveFields') | html %]" title="Use for iso2709 exports" />
                         <input type="hidden" name="op" value="export" />
                         <input type="hidden" id="output_format" name="output_format" value="iso2709" />
                         <input type="hidden" id="dont_export_item" name="dont_export_item" value="0" />
index 2d36462..03cc9a7 100644 (file)
         [% END %]
     [% END %]
     [% IF !(Koha.Preference('HidePersonalPatronDetailOnCirculation')) %]
-        [% IF Koha.Preference( 'AddressFormat' ) %]
-            [% INCLUDE "member-display-address-style-${ Koha.Preference( 'AddressFormat' ) }.inc" %]
-        [% ELSE %]
-            [% INCLUDE 'member-display-address-style-us.inc' %]
+        [% SWITCH Koha.Preference( 'AddressFormat' ) %]
+            [% CASE 'de' %]
+                [% INCLUDE 'member-display-address-style-de.inc' %]
+            [% CASE # us %]
+                [% INCLUDE 'member-display-address-style-us.inc' %]
         [% END %]
 
         [% IF ( patron.phone || patron.mobile || patron.phonepro ) %]<li class="patronphone">
     [% IF ( ExtendedPatronAttributes ) %][% FOREACH extendedattribute IN extendedattributes %]
         [% IF ( extendedattribute.display_checkout ) %]
             [% IF ( extendedattribute.value ) %]
-                <li class="patronattribute"><span class="patronattributelabel">[% extendedattribute.description %]</span> : [% IF ( extendedattribute.value_description ) %][% extendedattribute.value_description %][% ELSE %][% extendedattribute.value %][% END %]</li>
+                <li class="patronattribute"><span class="patronattributelabel">[% extendedattribute.description | html %]</span> : [% IF ( extendedattribute.value_description ) %][% extendedattribute.value_description | html %][% ELSE %][% extendedattribute.value | html %][% END %]</li>
             [% END %]
         [% END %]
     [% END %][% END %]
-    <li class="patroncategory">Category: [% patron.category.description %] ([% patron.categorycode %])</li>
-    <li class="patronlibrary">Home library: [% Branches.GetName( patron.branchcode ) %]</li>
-    <li class="patronborrowernumber">Borrowernumber: [% patron.borrowernumber %]</li>
+    <li class="patroncategory">Category: [% patron.category.description | html %] ([% patron.categorycode | html %])</li>
+    <li class="patronlibrary">Home library: [% Branches.GetName( patron.branchcode ) | html %]</li>
+    <li class="patronborrowernumber">Borrowernumber: [% patron.borrowernumber | html %]</li>
   </ul></div>
 <div id="menu">
 <ul>
     [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]
-        [% IF ( circview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber %]">Check out</a></li>
+        [% IF ( circview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber | html %]">Check out</a></li>
         [% IF Koha.Preference('BatchCheckouts') && Koha.Preference('BatchCheckoutsValidCategories').split('\|').grep('^' _ patron.categorycode _ '$').size > 0 %]
-          [% IF ( batch_checkout_view ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber %]&amp;batch=1">Batch check out</a></li>
+          [% IF ( batch_checkout_view ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;batch=1">Batch check out</a></li>
         [% END %]
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
-        [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">Details</a></li>
+        [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Details</a></li>
     [% END %]
     [% IF ( CAN_user_updatecharges ) %]
-        [% IF ( finesview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]">Fines</a></li>
+        [% IF ( finesview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Fines</a></li>
     [% END %]
     [% IF ( CAN_user_circulate_circulate_remaining_permissions  )  %]
-        [% IF Koha.Preference("RoutingSerials") %][% IF ( routinglistview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/routing-lists.pl?borrowernumber=[% patron.borrowernumber %]">Routing lists</a></li>[% END %]
+        [% IF Koha.Preference("RoutingSerials") %][% IF ( routinglistview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/routing-lists.pl?borrowernumber=[% patron.borrowernumber | html %]">Routing lists</a></li>[% END %]
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( intranetreadinghistory ) %]
-            [% IF ( readingrecordview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% patron.borrowernumber %]">Circulation history</a></li>
+            [% IF ( readingrecordview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% patron.borrowernumber | html %]">Circulation history</a></li>
         [% END %]
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( intranetreadinghistory ) %]
-            [% IF ( holdshistoryview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/holdshistory.pl?borrowernumber=[% patron.borrowernumber %]">Holds history</a></li>
+            [% IF ( holdshistoryview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/holdshistory.pl?borrowernumber=[% patron.borrowernumber | html %]">Holds history</a></li>
         [% END %]
     [% END %]
     [% IF ( CAN_user_parameters ) %]
-        [% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=MEMBERS&amp;modules=circulation&amp;object=[% patron.borrowernumber %]&amp;src=circ">Modification log</a></li>
+        [% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=MEMBERS&amp;modules=circulation&amp;object=[% patron.borrowernumber | html %]&amp;src=circ">Modification log</a></li>
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
-    [% IF ( sentnotices ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/notices.pl?borrowernumber=[% patron.borrowernumber %]">Notices</a></li>
+    [% IF ( sentnotices ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/notices.pl?borrowernumber=[% patron.borrowernumber | html %]">Notices</a></li>
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
-        [% IF (  statisticsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/statistics.pl?borrowernumber=[% patron.borrowernumber %]">Statistics</a></li>
+        [% IF (  statisticsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/statistics.pl?borrowernumber=[% patron.borrowernumber | html %]">Statistics</a></li>
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( EnableBorrowerFiles ) %]
-            [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% patron.borrowernumber %]">Files</a></li>
+            [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% patron.borrowernumber | html %]">Files</a></li>
         [% END %]
     [% END %]
 
     [% IF CAN_user_acquisition_suggestions_manage %]
-        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber %]">Purchase suggestions</a></li>
+        [% IF ( suggestionsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/purchase-suggestions.pl?borrowernumber=[% patron.borrowernumber | html %]">Purchase suggestions</a></li>
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
-        [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber %]">Discharges</a></li>
+        [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | html %]">Discharges</a></li>
     [% END %]
     [% IF Koha.Preference('HouseboundModule') %]
-        [% IF houseboundview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber %]">Housebound</a></li>
+        [% IF houseboundview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber | html %]">Housebound</a></li>
     [% END %]
     [% IF Koha.Preference('ILLModule') && CAN_user_ill %]
-        <li><a href="/cgi-bin/koha/ill/ill-requests.pl?borrowernumber=[% patron.borrowernumber %]">Interlibrary loans</a></li>
+        <li><a href="/cgi-bin/koha/ill/ill-requests.pl?borrowernumber=[% patron.borrowernumber | html %]">Interlibrary loans</a></li>
     [% END %]
 </ul></div>
 [% END %]
index b686fbb..48f28d9 100644 (file)
@@ -21,7 +21,7 @@
                 <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=FA">Fast cataloging</a></li>
             [% END %][% END %]
             [% IF Koha.Preference('AllowCheckoutNotes') && CAN_user_circulate_manage_checkout_notes %]
-                <li><a href="/cgi-bin/koha/circ/checkout-notes.pl">Checkout notes</a> [% IF pending_checkout_notes.count %]<span class="number_box"><a href="/cgi-bin/koha/circ/checkout-notes.pl">[% pending_checkout_notes.count %]</span>[% END %]</li>
+                <li><a href="/cgi-bin/koha/circ/checkout-notes.pl">Checkout notes</a> [% IF pending_checkout_notes.count %]<span class="number_box"><a href="/cgi-bin/koha/circ/checkout-notes.pl">[% pending_checkout_notes.count | html %]</span>[% END %]</li>
             [% END %]
         </ul>
 
index d255186..08e4a2a 100644 (file)
     <tbody>
         [% FOREACH borrower IN borrowers %]
             [% IF destination == "circ" %]
-                <tr class="clickable" data-url="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrower.borrowernumber %]">
-                    <td><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrower.borrowernumber %]">[% borrower.surname %], [% borrower.firstname %]</a></td>
+                <tr class="clickable" data-url="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrower.borrowernumber | html %]">
+                    <td><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrower.borrowernumber | html %]">[% borrower.surname | html %], [% borrower.firstname | html %]</a></td>
             [% ELSIF destination == "holds" %]
                 [% IF multi_hold %]
                     [% SET data_url = "/cgi-bin/koha/reserve/request.pl?borrowernumber=" _ borrower.borrowernumber _ "&amp;multi_hold=1&amp;biblionumbers=" _ biblionumbers %]
                 [% ELSE %]
                     [% SET data_url = "/cgi-bin/koha/reserve/request.pl?borrowernumber=" _ borrower.borrowernumber _ "&amp;biblionumber=" _ biblionumber %]
                 [% END %]
-                <tr class="clickable" data-url="[% data_url %]">
-                    <td><a href="[% data_url %]">[% borrower.surname %], [% borrower.firstname %]</a></td>
+                <tr class="clickable" data-url="[% data_url | html %]">
+                    <td><a href="[% data_url | html %]">[% borrower.surname | html %], [% borrower.firstname | html %]</a></td>
             [% END %]
-                <td>[% borrower.cardnumber %]</td>
+                <td>[% borrower.cardnumber | html %]</td>
                 <td>[% borrower.dateofbirth | $KohaDates %]</td>
-                <td>[% Categories.GetName( borrower.categorycode ) %]</td>
-                <td>[% Branches.GetName( borrower.branchcode ) %]</td>
-                <td>[% borrower.address %]</td>
+                <td>[% Categories.GetName( borrower.categorycode ) | html %]</td>
+                <td>[% Branches.GetName( borrower.branchcode ) | html %]</td>
+                <td>[% borrower.address | html %]</td>
             </tr>
         [% END %]
     </tbody>
index 7fec2dd..6cb15b0 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Circulation Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Circulation Resident Search Box -->
 
 <div id="header_search">
     [% INCLUDE 'patron-search-box.inc' %]
index 2247a49..16a3508 100644 (file)
@@ -1,11 +1,11 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Cities Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Cities Resident Search Box -->
 <div id="header_search">
        <div id="city_search" class="residentsearch">
     <p class="tip">City search:</p>
-       <form action="[% script_name %]" method="post">
-        <input class="head-searchbox" type="text" name="city_name" value="[% searchfield %]" size="40" />
+       <form action="[% script_name | html %]" method="post">
+        <input class="head-searchbox" type="text" name="city_name" value="[% searchfield | html %]" size="40" />
                <input type="submit" name="submit" value="OK" class="submit" />
        </form>
        </div>
index 7837466..d694952 100644 (file)
@@ -1,12 +1,12 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Patrons Admin Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Patrons Admin Resident Search Box -->
 
 <div id="header_search">
        <div id="contract_description_search" class="residentsearch">
        <p class="tip">Search by contract name or/and description:</p>
-       <form action="[% script_name %]" method="post">
-        <input class="head-searchbox" type="text" name="searchfield" size="40" value="[% searchfield %]" />
+       <form action="[% script_name | html %]" method="post">
+        <input class="head-searchbox" type="text" name="searchfield" size="40" value="[% searchfield | html %]" />
                <input type="submit" class="submit" name="search" value="Search" />
        </form> 
        </div>
index b6e434f..517dab9 100644 (file)
@@ -1,4 +1,4 @@
 [%- USE Koha -%]
 [%- SET delimiter = Koha.Preference( 'delimiter' ) || ',' -%]
 
-[%- BLOCK -%]Contract name[% delimiter %]Order number[% delimiter %]Entry date[% delimiter %]ISBN[% delimiter %]Author[% delimiter %]Title[% delimiter %]Publication year[% delimiter %]Publisher[% delimiter %]Collection title[% delimiter %]Note for vendor[% delimiter %]Quantity[% delimiter %]RRP[% delimiter %]Delivery place[% delimiter %]Billing place[%- END -%]
\ No newline at end of file
+[%- BLOCK -%]Contract name[% delimiter | html %]Order number[% delimiter | html %]Entry date[% delimiter | html %]ISBN[% delimiter | html %]Author[% delimiter | html %]Title[% delimiter | html %]Publication year[% delimiter | html %]Publisher[% delimiter | html %]Collection title[% delimiter | html %]Note for vendor[% delimiter | html %]Quantity[% delimiter | html %]RRP[% delimiter | html %]Delivery place[% delimiter | html %]Billing place[%- END -%]
index 81a33c7..43221a6 100644 (file)
@@ -1,4 +1,4 @@
 [%- USE Koha -%]
 [%- SET delimiter = Koha.Preference( 'delimiter' ) || ',' -%]
 
-[%- BLOCK -%]Account number[% delimiter %]Basket name[% delimiter %]Order number[% delimiter %]Author[% delimiter %]Title[% delimiter %]Publisher[% delimiter %]Publication year[% delimiter %]Collection title[% delimiter %]ISBN[% delimiter %]Quantity[% delimiter %]RRP tax included[% delimiter %]RRP tax excluded[% delimiter %]Discount[% delimiter %]Estimated cost tax included[% delimiter %]Estimated cost tax excluded[% delimiter %]Note for vendor[% delimiter %]Entry date[% delimiter %]Bookseller name[% delimiter %]Bookseller physical address[% delimiter %]Bookseller postal address[% delimiter %]Contract number[% delimiter %]Contract name[% delimiter %]Basket group delivery place[% delimiter %]Basket group billing place[% delimiter %]Basket delivery place[% delimiter %]Basket billing place[%- END -%]
\ No newline at end of file
+[%- BLOCK -%]Account number[% delimiter | html %]Basket name[% delimiter | html %]Order number[% delimiter | html %]Author[% delimiter | html %]Title[% delimiter | html %]Publisher[% delimiter | html %]Publication year[% delimiter | html %]Collection title[% delimiter | html %]ISBN[% delimiter | html %]Quantity[% delimiter | html %]RRP tax included[% delimiter | html %]RRP tax excluded[% delimiter | html %]Discount[% delimiter | html %]Estimated cost tax included[% delimiter | html %]Estimated cost tax excluded[% delimiter | html %]Note for vendor[% delimiter | html %]Entry date[% delimiter | html %]Bookseller name[% delimiter | html %]Bookseller physical address[% delimiter | html %]Bookseller postal address[% delimiter | html %]Contract number[% delimiter | html %]Contract name[% delimiter | html %]Basket group delivery place[% delimiter | html %]Basket group billing place[% delimiter | html %]Basket delivery place[% delimiter | html %]Basket billing place[%- END -%]
index 29b77d5..8231efb 100644 (file)
@@ -1,4 +1,4 @@
 [%- USE Koha -%]
 [%- SET delimiter = Koha.Preference( 'delimiter' ) || ',' -%]
 
-[%- BLOCK -%]ORDER DATE[%- delimiter -%]ESTIMATED DELIVERY DATE[%- delimiter -%]VENDOR[%- delimiter -%]INFORMATION[%- delimiter -%]TOTAL COST[%- delimiter -%]BASKET[%- delimiter -%]CLAIMS COUNT[%- delimiter -%]CLAIMED DATE[%- END -%]
\ No newline at end of file
+[%- BLOCK -%]ORDER DATE[%- delimiter | html -%]ESTIMATED DELIVERY DATE[%- delimiter | html -%]VENDOR[%- delimiter | html -%]INFORMATION[%- delimiter | html -%]TOTAL COST[%- delimiter | html -%]BASKET[%- delimiter | html -%]CLAIMS COUNT[%- delimiter | html -%]CLAIMED DATE[%- END -%]
index 11ec56b..ffc92c8 100644 (file)
@@ -1 +1 @@
-[%- BLOCK -%]mfirstname[% sep %]card number[% sep %]firstname[% sep %]branchname[% sep %]date[% sep %]accounttype[% sep %]amount[% sep %]title[% sep %]barcode[% sep %]itype[%- END -%]
+[%- BLOCK -%]mfirstname[% sep | html %]card number[% sep | html %]firstname[% sep | html %]branchname[% sep | html %]date[% sep | html %]accounttype[% sep | html %]amount[% sep | html %]title[% sep | html %]barcode[% sep | html %]itype[%- END -%]
index 2494d4e..d184b8b 100644 (file)
@@ -1 +1 @@
-[%- BLOCK -%]Fund[% sep %]"Basket num"[% sep %]"Basket name"[% sep %]"Authorised by"[% sep %]"Biblio number"[% sep %]Title[% sep %]Currency[% sep %]"Vendor price"[% sep %]RRP[% sep %]"Budgeted cost"[% sep %]Quantity[% sep %]"Total RRP"[% sep %]"Total cost"[% sep %]"Entry date"[% sep %]"Date received"[% sep %]"Internal note"[% sep %]"Vendor note"[%- END -%]
+[%- BLOCK -%]Fund[% sep | html %]"Basket num"[% sep | html %]"Basket name"[% sep | html %]"Authorised by"[% sep | html %]"Biblio number"[% sep | html %]Title[% sep | html %]Currency[% sep | html %]"Vendor price"[% sep | html %]RRP[% sep | html %]"Budgeted cost"[% sep | html %]Quantity[% sep | html %]"Total RRP"[% sep | html %]"Total cost"[% sep | html %]"Entry date"[% sep | html %]"Date received"[% sep | html %]"Internal note"[% sep | html %]"Vendor note"[%- END -%]
index 299c323..0dfa51b 100644 (file)
@@ -1,11 +1,11 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Currencies Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Currencies Resident Search Box -->
 <div id="header_search">
        <div id="currency_search" class="residentsearch">
     <p class="tip">Currencies search:</p>
-        <form action="[% script_name %]" method="post">
-                <input class="head-searchbox" type="text" name="description" size="40" value="[% searchfield %]" />
+        <form action="[% script_name | html %]" method="post">
+                <input class="head-searchbox" type="text" name="description" size="40" value="[% searchfield | html %]" />
                 <input type="submit" class="submit" name="search" value="Search" />
         </form>        
        </div>
index b6cd884..f89d518 100644 (file)
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'format_price.inc' %]
-[% Asset.css("css/buttons.dataTables.min.css") %]
-[% Asset.js("lib/jquery/plugins/jquery.dataTables.min.js") %]
-[% Asset.js("lib/jquery/plugins/dataTables.buttons.min.js") %]
-[% Asset.js("lib/jquery/plugins/buttons.colVis.min.js") %]
-[% Asset.js("lib/jquery/plugins/jszip.min.js") %]
-[% Asset.js("lib/jquery/plugins/buttons.print.min.js") %]
-[% Asset.js("lib/jquery/plugins/buttons.html5.min.js") %]
+[% Asset.css("css/buttons.dataTables.min.css") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.dataTables.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/dataTables.buttons.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/buttons.colVis.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jszip.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/buttons.print.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/buttons.html5.min.js") | $raw %]
 <script type="text/javascript">
 //<![CDATA[
     var MSG_DT_FIRST = _("First");
@@ -30,4 +31,4 @@
     var MSG_DT_COPY_SUCCESS_X = _("Copied %d rows to clipboard");
 //]]>
 </script>
-[% Asset.js("js/datatables.js") %]
+[% Asset.js("js/datatables.js") | $raw %]
index a380870..7643694 100644 (file)
@@ -1,5 +1,5 @@
+[% USE raw %]
 [% USE Asset %]
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("css/print.css", { media = "print" }) %]
-
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("css/print.css", { media = "print" }) | $raw %]
index a0722f2..8be66b2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE String %]
     <style id="antiClickjack">body{display:none !important;}</style>
 [% END %]
 
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
 
-[% Asset.css("lib/jquery/jquery-ui-1.11.4.min.css") %]
-[% Asset.css("lib/bootstrap/bootstrap.min.css") %]
-[% Asset.css("lib/bootstrap/bootstrap-theme.min.css") %]
-[% Asset.css("lib/font-awesome/css/font-awesome.min.css") %]
-[% Asset.css("css/print.css", { media = "print" }) %]
+[% Asset.css("lib/jquery/jquery-ui-1.11.4.min.css") | $raw %]
+[% Asset.css("lib/bootstrap/bootstrap.min.css") | $raw %]
+[% Asset.css("lib/bootstrap/bootstrap-theme.min.css") | $raw %]
+[% Asset.css("lib/font-awesome/css/font-awesome.min.css") | $raw %]
+[% Asset.css("css/print.css", { media = "print" }) | $raw %]
 [% INCLUDE intranetstylesheet.inc %]
-[% IF ( bidi ) %][% Asset.css("css/right-to-left.css") %][% END %]
+[% IF ( bidi ) %][% Asset.css("css/right-to-left.css").raw %][% END %]
 
 [% IF ( login ) %]
-    [% Asset.css("css/login.css") %]
+    [% Asset.css("css/login.css") | $raw %]
 [% END %]
-[% IF ( IntranetUserCSS ) %]<style type="text/css">[% IntranetUserCSS %]</style>[% END %]
+[% IF ( IntranetUserCSS ) %]<style type="text/css">[% IntranetUserCSS | $raw %]</style>[% END %]
 
 [% UNLESS ( footerjs ) %]
     [% INCLUDE js_includes.inc %]
index 59e6d53..bfa90f4 100644 (file)
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<!-- TEMPLATE FILE: [% template.name.split('/').last %] -->
+<!-- TEMPLATE FILE: [% template.name.split('/').last | html %] -->
 
 [% USE Koha %]
 [% IF Koha.Preference('DumpTemplateVarsIntranet') %]
@@ -9,7 +9,7 @@
         <!--
         [% FILTER replace('<!--', '<!- -') %]
             [% FILTER replace('-->', '- ->') %]
-                [% Dumper.dump( Stash.stash() ) %]
+                [% Dumper.dump( Stash.stash() ) | html %]
             [% END %]
         [% END %]
         -->
@@ -21,5 +21,5 @@
     [% END %]
 [% END %]
 
-[% IF ( bidi ) %]<html lang="[% lang %]" dir="[% bidi %]">[% ELSE %]<html lang="[% lang %]">[% END %]
+[% IF ( bidi ) %]<html lang="[% lang | html %]" dir="[% bidi | html %]">[% ELSE %]<html lang="[% lang | html %]">[% END %]
 <head>
index eeb97ac..450197f 100644 (file)
@@ -4,14 +4,14 @@
 <div id="search-facets">
 <h4>Refine your search</h4>
 <ul>
-    <li id="availability_facet">Availability<ul><li>[% IF ( available ) %]<strong>Showing only available items</strong></li><li><a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi_not_availablity %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Show all items</a>[% ELSE %]<a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]&amp;limit=available">Limit to currently available items</a>[% END %]</li></ul>
-       [% IF ( related ) %] <li>(related searches: [% FOREACH relate IN related %][% relate.related_search %][% END %])</li>[% END %]
+    <li id="availability_facet">Availability<ul><li>[% IF ( available ) %]<strong>Showing only available items</strong></li><li><a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi | html %][% limit_cgi_not_availablity | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Show all items</a>[% ELSE %]<a href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi | html %][% limit_cgi | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]&amp;limit=available">Limit to currently available items</a>[% END %]</li></ul>
+       [% IF ( related ) %] <li>(related searches: [% FOREACH relate IN related %][% relate.related_search | html %][% END %])</li>[% END %]
        </li>
 
        [% FOREACH facets_loo IN facets_loop %]
 [% IF facets_loo.facets.size > 0 %]
-       <li id="[% facets_loo.type_id %]">
-[% facets_loo.type_label %]
+       <li id="[% facets_loo.type_id | html %]">
+[% facets_loo.type_label | html %]
 [% IF facets_loo.type_label_Authors %]<span id="facet-authors">Authors</span>[% END %]
 [% IF facets_loo.type_label_Titles %]<span id="facet-titles">Titles</span>[% END %]
 [% IF facets_loo.type_label_Topics %]<span id="facet-topics">Topics</span>[% END %]
 <ul>
   [% SET url = "/cgi-bin/koha/catalogue/search.pl?" _ query_cgi _ limit_cgi %]
   [% IF ( sort_by ) %]
-    [% url = BLOCK %][% url %][% "&amp;sort_by=" _ sort_by |url %][% END %]
+    [% url = BLOCK | html %][% url | html %][% "&amp;sort_by=" _ sort_by |url %][% END %]
   [% END %]
   [% FOREACH facet IN facets_loo.facets %]
   [% IF facets_loo.type_label_CollectionCodes %][% SET facet.facet_label_value = AuthorisedValues.GetByCode('CCODE',facet.facet_label_value,0) || facet.facet_label_value %][% END %]
     <li>
       [% IF facet.active %]
         [% SET local_url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-        <span class="facet-label">[% facet.facet_label_value %]</span>
-        [<a href="[% local_url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
+        <span class="facet-label">[% facet.facet_label_value | html %]</span>
+        [<a href="[% local_url | html %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
       [% ELSE %]
         [% SET local_url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-        <span class="facet-label"><a href="[% local_url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
+        <span class="facet-label"><a href="[% local_url | html %]" title="[% facet.facet_title_value | html %]">[% facet.facet_label_value | html %]</a></span>
         [% IF ( displayFacetCount ) %]
-          <span class="facet-count"> ([% facet.facet_count %])</span>
+          <span class="facet-count"> ([% facet.facet_count | html %])</span>
         [% END %]
       [% END %]
     </li>
   [% END %]
   [% IF ( facets_loo.expandable ) %]
       <li class="showmore">
-          <a href="[% url %][% IF offset %]&amp;offset=[% offset |url %][% END %]&amp;expand=[% facets_loo.expand |url %]#[% facets_loo.type_id |url %]">Show more</a>
+          <a href="[% url | html %][% IF offset %]&amp;offset=[% offset |url %][% END %]&amp;expand=[% facets_loo.expand |url %]#[% facets_loo.type_id |url %]">Show more</a>
       </li>
   [% END %]
 </ul></li>
index 8c307d5..6d1d7f6 100644 (file)
@@ -1,5 +1,5 @@
 [% BLOCK selectoptionopen %]
-    [% IF value == selected %]<option value='[% value %]' selected='selected'>
-    [% ELSE %]<option value='[% value %]'>
+    [% IF value == selected %]<option value='[% value | html %]' selected='selected'>
+    [% ELSE %]<option value='[% value | html %]'>
     [% END %]
 [% END %]
index 84918c2..5a497e2 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 <script type="text/javascript">
-    var GB_ROOT_DIR = "[% interface %]/lib/greybox/";
+    var GB_ROOT_DIR = "[% interface | html %]/lib/greybox/";
 </script>
-[% Asset.js("lib/greybox/AJS.js") %]
-[% Asset.js("lib/greybox/AJS_fx.js") %]
-[% Asset.js("lib/greybox/gb_scripts.js") %]
-[% Asset.css("lib/greybox/gb_styles.css") %]
+[% Asset.js("lib/greybox/AJS.js") | $raw %]
+[% Asset.js("lib/greybox/AJS_fx.js") | $raw %]
+[% Asset.js("lib/greybox/gb_scripts.js") | $raw %]
+[% Asset.css("lib/greybox/gb_styles.css") | $raw %]
index 3c112ee..8b47028 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Branches %]
 <div id="header" class="navbar navbar-default">
     <div class="container-fluid">
@@ -16,7 +17,7 @@
                     <a href="#" id="cartmenulink">Cart<span id="basketcount"></span></a>
                 </li>
             [% END %]
-            [% IntranetNav %]
+            [% IntranetNav | $raw %]
             <li class="dropdown">
                 <a href="/cgi-bin/koha/mainpage.pl" class="dropdown-toggle" data-toggle="dropdown">More <b class="caret"></b></a>
                 <ul class="dropdown-menu dropdown-menu-right">
                         <i class="fa fa-user"></i>
                     </span>
                     <span id="logged-in-info-full">
-                        <span class="loggedinusername">[% loggedinusername %]</span>
+                        <span class="loggedinusername">[% loggedinusername | html %]</span>
                         <span class="separator">|</span>
                         [% IF ( AutoLocation ) %]
                             <brand>
-                                [% LoginBranchname %]
+                                [% LoginBranchname | html %]
                             </brand>
                         [% ELSE %]
                             <strong>
                                 [% IF ( LoginBranchname == 'NO_LIBRARY_SET' ) %]
                                     NO LIBRARY SET
                                 [% ELSE %]
-                                    <span class="logged-in-branch-name">[% LoginBranchname %]</span>
-                                    <span class="logged-in-branch-code content_hidden">[% Branches.GetLoggedInBranchcode %]</span>
+                                    <span class="logged-in-branch-name">[% LoginBranchname | html %]</span>
+                                    <span class="logged-in-branch-code content_hidden">[% Branches.GetLoggedInBranchcode | html %]</span>
                                 [% END %]
                             </strong>
                         [% END %]
 
                     <li class="loggedin-menu-label">
                         Logged in as:<br />
-                        <span class="loggedinusername">[% loggedinusername %]</span>
+                        <span class="loggedinusername">[% loggedinusername | html %]</span>
                     </li>
                     <li class="loggedin-menu-label">
                         [% IF ( AutoLocation ) %]
                             <brand>
-                                [% LoginBranchname %]
+                                [% LoginBranchname | html %]
                             </brand>
                         [% ELSE %]
                             [% IF ( LoginBranchname == 'NO_LIBRARY_SET' ) %]
                                 NO LIBRARY SET
                             [% ELSE %]
                                 Location: <br />
-                                <span class="logged-in-branch-name">[% LoginBranchname %]</span>
-                                <span class="logged-in-branch-code content_hidden">[% Branches.GetLoggedInBranchcode %]</span>
+                                <span class="logged-in-branch-name">[% LoginBranchname | html %]</span>
+                                <span class="logged-in-branch-code content_hidden">[% Branches.GetLoggedInBranchcode | html %]</span>
                             [% END %]
                         [% END %]
                     </li>
                     [% END %]
                     [% IF loggedinusernumber %]
                         <li class ="toplinks-myaccount">
-                            <a class="toplinks" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loggedinusernumber %]">My account</a>
+                            <a class="toplinks" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loggedinusernumber | html %]">My account</a>
                         </li>
                         <li class="toplinks-mycheckouts">
-                            <a class="toplinks" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% loggedinusernumber %]">My checkouts</a>
+                            <a class="toplinks" href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% loggedinusernumber | html %]">My checkouts</a>
                         </li>
                     [% END %]
                     <li>
index 9a2fb5a..f85693f 100644 (file)
@@ -1,7 +1,7 @@
 <form action="/cgi-bin/koha/edithelp.pl" method="post">
   <fieldset class="action"><input type="button" class="close" value="Close help window" />
   <input type="hidden" name="type" value="modify" />
-  <input type="hidden" name="referer" value="[% referer %]" />
+  <input type="hidden" name="referer" value="[% referer | html %]" />
   <input type="submit" class="submit" value="Edit help" /></fieldset>
 </form>
 </body>
index 99946e2..6cd9aff 100644 (file)
@@ -1,21 +1,22 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Online help</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("lib/jquery/jquery-ui-1.11.4.min.css") %]
-[% Asset.css("css/print.css", { media = "print" }) %]
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("lib/jquery/jquery-ui-1.11.4.min.css") | $raw %]
+[% Asset.css("css/print.css", { media = "print" }) | $raw %]
 [% INCLUDE intranetstylesheet.inc %]
 [% IF ( bidi ) %]
-   [% Asset.css("css/right-to-left.css") %]
+   [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
-[% Asset.js("lib/jquery/jquery-2.2.3.min.js") %]
-[% Asset.js("lib/jquery/jquery-migrate-1.3.0.min.js") %]
-[% Asset.js("lib/jquery/jquery-ui-1.11.4.min.js") %]
-[% Asset.js("lib/shortcut/shortcut.js") %]
+[% Asset.js("lib/jquery/jquery-2.2.3.min.js") | $raw %]
+[% Asset.js("lib/jquery/jquery-migrate-1.3.0.min.js") | $raw %]
+[% Asset.js("lib/jquery/jquery-ui-1.11.4.min.js") | $raw %]
+[% Asset.js("lib/shortcut/shortcut.js") | $raw %]
 <!-- koha core js -->
-[% Asset.js("js/staff-global.js") %]
+[% Asset.js("js/staff-global.js") | $raw %]
 
-[% Asset.css("css/help.css") %]
+[% Asset.css("css/help.css") | $raw %]
 </head>
 <body id="help" class="help">
index 59ddcec..9c4f4ee 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Main page Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Main page Resident Search Box -->
 
 <div id="header_search">
     [% INCLUDE 'patron-search-box.inc' %]
index bef9628..b761688 100644 (file)
@@ -1,9 +1,9 @@
 [% BLOCK options_for_libraries %]
     [% FOREACH l IN libraries %]
         [% IF l.selected %]
-            <option value="[% prefix %][% l.branchcode | html %]" selected="selected">[% l.branchname %]</option>
+            <option value="[% prefix | html %][% l.branchcode | html %]" selected="selected">[% l.branchname | html %]</option>
         [% ELSE %]
-            <option value="[% prefix %][% l.branchcode | html %]">[% l.branchname |html %]</option>
+            <option value="[% prefix | html %][% l.branchcode | html %]">[% l.branchname | html %]</option>
         [% END%]
     [% END %]
 [% END %]
@@ -11,9 +11,9 @@
 [% BLOCK options_for_authorised_value_categories %]
     [% FOREACH avc IN authorised_value_categories %]
         [% IF avc.selected %]
-            <option value="[% avc.category %]" selected="selected">[% avc.category %]</option>
+            <option value="[% avc.category | html %]" selected="selected">[% avc.category | html %]</option>
         [% ELSE %]
-            <option value="[% avc.category %]">[% avc.category %]</option>
+            <option value="[% avc.category | html %]">[% avc.category | html %]</option>
         [% END %]
     [% END %]
 [% END %]
 [% BLOCK options_for_item_types %]
     [% FOREACH itemtype IN itemtypes %]
         [% IF itemtype.itemtype == selected_itemtype %]
-            <option value="[% itemtype.itemtype %]" selected="selected">
+            <option value="[% itemtype.itemtype | html %]" selected="selected">
         [% ELSE %]
-            <option value="[% itemtype.itemtype %]">
+            <option value="[% itemtype.itemtype | html %]">
         [% END %]
-            [% itemtype.translated_description %]
+            [% itemtype.translated_description | html %]
         </option>
     [% END %]
 [% END %]
index d725e26..45a3c68 100644 (file)
@@ -9,12 +9,12 @@
                 </button>
                 <ul class="dropdown-menu" aria-labelledby="ill-backend-dropdown">
                     [% FOREACH backend IN backends %]
-                        <li><a href="/cgi-bin/koha/ill/ill-requests.pl?method=create&amp;backend=[% backend %]">[% backend %]</a></li>
+                        <li><a href="/cgi-bin/koha/ill/ill-requests.pl?method=create&amp;backend=[% backend | html %]">[% backend | html %]</a></li>
                     [% END %]
                 </ul>
             </div>
           [% ELSE %]
-            <a id="ill-new" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=create&amp;backend=[% backends.0 %]">
+            <a id="ill-new" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=create&amp;backend=[% backends.0 | html %]">
                 <i class="fa fa-plus"></i> New ILL request
             </a>
           [% END %]
index 87229c2..d605fef 100644 (file)
@@ -1,14 +1,14 @@
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-<link rel="stylesheet" type="text/css" href="[% interface %]/lib/jquery/jquery-ui-1.11.4.min.css" />
-<link rel="stylesheet" type="text/css" href="[% interface %]/lib/bootstrap/bootstrap.min.css" />
-<link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/installer.css" />
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
+<link rel="stylesheet" type="text/css" href="[% interface | html %]/lib/jquery/jquery-ui-1.11.4.min.css" />
+<link rel="stylesheet" type="text/css" href="[% interface | html %]/lib/bootstrap/bootstrap.min.css" />
+<link rel="stylesheet" type="text/css" href="[% interface | html %]/[% theme | html %]/css/installer.css" />
 
-<script type="text/javascript" src="[% interface %]/lib/jquery/jquery-2.2.3.min.js"></script>
-<script type="text/javascript" src="[% interface %]/lib/jquery/jquery-migrate-1.3.0.min.js"></script>
-<script type="text/javascript" src="[% interface %]/lib/jquery/jquery-ui-1.11.4.min.js"></script>
-<script type="text/javascript" src="[% interface %]/lib/bootstrap/bootstrap.min.js"></script>
-<script type="text/javascript" src="[% interface %]/lib/jquery/plugins/jquery.validate.min.js"></script>
+<script type="text/javascript" src="[% interface | html %]/lib/jquery/jquery-2.2.3.min.js"></script>
+<script type="text/javascript" src="[% interface | html %]/lib/jquery/jquery-migrate-1.3.0.min.js"></script>
+<script type="text/javascript" src="[% interface | html %]/lib/jquery/jquery-ui-1.11.4.min.js"></script>
+<script type="text/javascript" src="[% interface | html %]/lib/bootstrap/bootstrap.min.js"></script>
+<script type="text/javascript" src="[% interface | html %]/lib/jquery/plugins/jquery.validate.min.js"></script>
 <script type="text/javascript">
     function _(s) { return s } // dummy function for gettext
     [%# Prevent XFS attacks -%]
index 21b8245..18da677 100644 (file)
@@ -4,4 +4,4 @@
     var MSG_ONE_ENROLLMENTPERIOD =(_("Please choose an enrollment period in months OR by date."));
     var MSG_ONLY_ONE_ENROLLMENTPERIOD=(_("Please only choose one enrollment period."));
     var MSG_LETTERS_NUMBERS_ONLY=(_("Please only enter letters or numbers."));
-</script>
\ No newline at end of file
+</script>
index cc862a8..89619a0 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Koha %]
         </div>
 [% IF ( ( languages_loop ) && ( ! popup_window ) && ( Koha.Preference('StaffLangSelectorMode') == 'both' || Koha.Preference('StaffLangSelectorMode') == 'footer') ) %]
 
             [% IF ( languages_loo.group_enabled ) %]
             [% IF ( languages_loo.plural ) %]
-                <li class="dropdown"><a class="dropdown-toggle dropup" data-toggle="dropdown" id="show[% languages_loo.rfc4646_subtag %]" href="#">
+                <li class="dropdown"><a class="dropdown-toggle dropup" data-toggle="dropdown" id="show[% languages_loo.rfc4646_subtag | html %]" href="#">
                     [% IF ( languages_loo.native_description ) %]
-                        [% languages_loo.native_description %]
+                        [% languages_loo.native_description | html %]
                     [% ELSE %]
-                        [% languages_loo.rfc4646_subtag %]
+                        [% languages_loo.rfc4646_subtag | html %]
                     [% END %]
                     [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]
                         [% IF ( sublanguages_loo.enabled ) %]
                             [% IF ( sublanguages_loo.sublanguage_current ) %]
-                                <span class="sublanguage-selected">([% sublanguages_loo.rfc4646_subtag %])</span>
+                                <span class="sublanguage-selected">([% sublanguages_loo.rfc4646_subtag | html %])</span>
                             [% END %]
                         [% END %]
                     [% END %]
                 <span class="caret"></span></a>
-            <ul id="sub[% languages_loo.rfc4646_subtag %]" class="dropdown-menu dropdown-menu-right">
+            <ul id="sub[% languages_loo.rfc4646_subtag | html %]" class="dropdown-menu dropdown-menu-right">
             [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]
         [% IF ( sublanguages_loo.enabled ) %]
                 [% IF ( sublanguages_loo.sublanguage_current ) %]
-                    <li class="navbar-text"> <span class="currentlanguage disabled">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %] ([% sublanguages_loo.rfc4646_subtag %])</span></li>
+                    <li class="navbar-text"> <span class="currentlanguage disabled">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %] ([% sublanguages_loo.rfc4646_subtag | html %])</span></li>
                 [% ELSE %]
-                <li><a href="/cgi-bin/koha/changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag %]"> [% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %] ([% sublanguages_loo.rfc4646_subtag %])</a></li>
+                <li><a href="/cgi-bin/koha/changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag | html %]"> [% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %] ([% sublanguages_loo.rfc4646_subtag | html %])</a></li>
         [% END %]
                 [% END %]
 
                 [% IF ( languages_loo.current ) %]
                     <li class="navbar-text">
                         [% IF ( languages_loo.native_description ) %]
-                            <span class="currentlanguage">[% languages_loo.native_description %]</span>
+                            <span class="currentlanguage">[% languages_loo.native_description | html %]</span>
                         [% ELSE %]
-                            <span class="currentlanguage">[% languages_loo.rfc4646_subtag %]</span>
+                            <span class="currentlanguage">[% languages_loo.rfc4646_subtag | html %]</span>
                         [% END %]
                     </li>
                 [% ELSE %]
-                    <li><a href="/cgi-bin/koha/changelanguage.pl?language=[% languages_loo.rfc4646_subtag %]">
+                    <li><a href="/cgi-bin/koha/changelanguage.pl?language=[% languages_loo.rfc4646_subtag | html %]">
                         [% IF ( languages_loo.native_description ) %]
-                            [% languages_loo.native_description %]
+                            [% languages_loo.native_description | html %]
                         [% ELSE %]
-                            [% languages_loo.rfc4646_subtag %]
+                            [% languages_loo.rfc4646_subtag | html %]
                         [% END %]
                     </a></li>
                 [% END %]
@@ -68,7 +69,7 @@
     <span id="audio-alert"></span>
     [% IF ( footerjs ) %]
         [% INCLUDE js_includes.inc %]
-        [% jsinclude # Parse the page template's JavaScript block if necessary %]
+        [% jsinclude.raw # Parse the page template's JavaScript block if necessary %]
     [% END %]
     </body>
 </html>
index 884aaea..e476d00 100644 (file)
@@ -1,16 +1,17 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET intranetstylesheet='staff-global.css' UNLESS intranetstylesheet %]
 [% IF (intranetstylesheet.match('^https?:|^\/')) %]
-    <link rel="stylesheet" type="text/css" href="[% intranetstylesheet %]" />
+    <link rel="stylesheet" type="text/css" href="[% intranetstylesheet | html %]" />
 [% ELSE %]
-    [% Asset.css("css/" _ intranetstylesheet) %]
+    [% Asset.css("css/" _ intranetstylesheet) | $raw %]
 [% END %]
 
 <!-- local colors -->
 [% IF ( intranetcolorstylesheet ) %]
     [% IF (intranetcolorstylesheet.match('^https?:|^\/')) %]
-        <link rel="stylesheet" type="text/css" href="[% intranetcolorstylesheet %]" />
+        <link rel="stylesheet" type="text/css" href="[% intranetcolorstylesheet | html %]" />
     [% ELSE %]
-        <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/[% intranetcolorstylesheet %]" />
+        <link rel="stylesheet" type="text/css" href="[% interface | html %]/[% theme | html %]/css/[% intranetcolorstylesheet | html %]" />
     [% END %]
 [% END %]
index de81f3f..beffefd 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AudioAlerts %]
 [%# Prevent XFS attacks -%]
     </script>
 [% END %]
 
-[% Asset.js("lib/jquery/jquery-2.2.3.min.js") %]
-[% Asset.js("lib/jquery/jquery-migrate-1.3.0.min.js") %]
-[% Asset.js("lib/jquery/jquery-ui-1.11.4.min.js") %]
-[% Asset.js("lib/shortcut/shortcut.js") %]
-[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") %]
-[% Asset.js("lib/jquery/plugins/jquery.highlight-3.js") %]
-[% Asset.js("lib/bootstrap/bootstrap.min.js") %]
-[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") %]
+[% Asset.js("lib/jquery/jquery-2.2.3.min.js") | $raw %]
+[% Asset.js("lib/jquery/jquery-migrate-1.3.0.min.js") | $raw %]
+[% Asset.js("lib/jquery/jquery-ui-1.11.4.min.js") | $raw %]
+[% Asset.js("lib/shortcut/shortcut.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.highlight-3.js") | $raw %]
+[% Asset.js("lib/bootstrap/bootstrap.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %]
 <!-- koha core js -->
-[% Asset.js("js/staff-global.js") %]
-[% Asset.js("js/commons.js") %]
+[% Asset.js("js/staff-global.js") | $raw %]
+[% Asset.js("js/commons.js") | $raw %]
 
 [% INCLUDE 'validator-strings.inc' %]
 [% IF ( IntranetUserJS ) %]
     <script type="text/javascript">
     //<![CDATA[
-    [% IntranetUserJS %]
+    [% IntranetUserJS | html %]
     //]]>
     </script>
 [% END %]
     //]]>
     </script>
 
-    [% Asset.js("js/basket.js") %]
+    [% Asset.js("js/basket.js") | $raw %]
 [% END %]
 
 [% IF LocalCoverImages %]
-    [% Asset.js("js/localcovers.js") %]
+    [% Asset.js("js/localcovers.js") | $raw %]
     <script type="text/javascript">
         //<![CDATA[
             var NO_LOCAL_JACKET = _("No cover image available");
@@ -68,8 +69,8 @@
 [% IF Koha.Preference('AudioAlerts') || AudioAlertsPage %]
     <script type="text/javascript">
         //<![CDATA[
-            var AUDIO_ALERT_PATH = '[% interface %]/[% theme %]/sound/';
-            var AUDIO_ALERTS = JSON.parse( '[% AudioAlerts.AudioAlerts | replace( "'", "\\'" ) | replace( '"', '\\"' ) %]' );
+            var AUDIO_ALERT_PATH = '[% interface | html %]/[% theme | html %]/sound/';
+            var AUDIO_ALERTS = JSON.parse( '[% AudioAlerts.AudioAlerts | replace( "'", "\\'" ) | replace( '"', '\\"' ) | html %]' );
         //]]>
 
         $( document ).ready(function() {
index cf7a5d9..21725d0 100644 (file)
@@ -9,18 +9,18 @@
                 [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]
                     [% IF ( sublanguages_loo.enabled ) %]
                         [% IF ( sublanguages_loo.sublanguage_current ) %]
-                            <li role="presentation"> <a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]&nbsp;<i class="fa fa-check"></i></a></li>
+                            <li role="presentation"> <a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]&nbsp;<i class="fa fa-check"></i></a></li>
                         [% ELSE %]
-                            <li role="presentation"><a href="/cgi-bin/koha/changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag %]"  tabindex="-1" role="menuitem"> [% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]</a></li>
+                            <li role="presentation"><a href="/cgi-bin/koha/changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag | html %]"  tabindex="-1" role="menuitem"> [% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]</a></li>
                         [% END %]
                     [% END # / IF sublanguages_loo.enabled %]
                 [% END # / FOREACH sublanguages_loo %]
             [% ELSE %]
                 [% IF ( languages_loo.group_enabled ) %]
                     [% IF ( languages_loo.current ) %]
-                        <li role="presentation"><a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]&nbsp;<i class="fa fa-check"></i></a></li>
+                        <li role="presentation"><a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]&nbsp;<i class="fa fa-check"></i></a></li>
                     [% ELSE %]
-                        <li role="presentation"><a href="/cgi-bin/koha/changelanguage.pl?language=[% languages_loo.rfc4646_subtag %]"  tabindex="-1" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]</a></li>
+                        <li role="presentation"><a href="/cgi-bin/koha/changelanguage.pl?language=[% languages_loo.rfc4646_subtag | html %]"  tabindex="-1" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]</a></li>
                     [% END %]
                 [% END # / IF languages_loo.current %]
             [% END # / IF ( languages_loo.plural ) %]
index 1eea7bb..ce7703b 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Notices Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Notices Resident Search Box -->
 <div id="header_search">
        <div id="notices_search" class="residentsearch">
     <p class="tip">Search existing notices:</p>
index 7856fc1..3171105 100644 (file)
@@ -8,7 +8,7 @@
                     <label for="B_address">
                 [% END %]
                 Address: </label>
-                    <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address %]" />
+                    <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address | html %]" />
       [% IF ( mandatoryB_address ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -25,9 +25,9 @@
             <option value=""></option>
             [% FOR roadtype IN roadtypes %]
                 [% IF roadtype.authorised_value == patron.B_streettype %]
-                    <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+                    <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
                 [% ELSE %]
-                    <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+                    <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
                 [% END %]
             [% END %]
             </select>
@@ -43,7 +43,7 @@
                     <label for="B_streetnumber">
                 [% END %]
                 Street Number: </label>
-                    <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber %]" />
+                    <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber | html %]" />
                 [% IF ( mandatoryB_streetnumber ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -56,7 +56,7 @@
                     <label for="B_address2">
                 [% END %]
                 Address 2: </label>
-                    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 %]" />
+                    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 | html %]" />
       [% IF ( mandatoryB_address2 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -68,7 +68,7 @@
                                         <label for="B_zipcode">
                                 [% END %]
                                 ZIP/Postal code: </label>
-                    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode %]" />
+                    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode | html %]" />
           [% IF ( mandatoryB_zipcode ) %]<span class="required">Required</span>[% END %]
                         </li>
         [% END %]
@@ -80,7 +80,7 @@
                     <label for="B_city">
                 [% END %]
                 City: </label>
-                <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city %]" />
+                <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city | html %]" />
       [% IF ( mandatoryB_city ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -92,7 +92,7 @@
                     <label for="B_state">
                 [% END %]
                 State: </label>
-                <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state %]" />
+                <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state | html %]" />
       [% IF ( mandatoryB_state ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                     <label for="B_country">
                 [% END %]
                 Country: </label>
-                    <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country %]" />
+                    <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country | html %]" />
       [% IF ( mandatoryB_country ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                 <label for="B_phone">
                 [% END %]
                 Phone: </label>
-                    <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone %]" />
+                    <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone | html %]" />
                 [% IF ( mandatoryB_phone ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
           <label for="B_email">
         [% END %]
         Email: </label>
-            <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email %]" />
+            <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email | html %]" />
         [% IF ( mandatoryB_email ) %]<span class="required">Required</span>[% END %] </li>
         [% END %]
         [% UNLESS nocontactnote %]
                 <label for="contactnote">
                 [% END %]
                 Contact note: </label>
-                <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% patron.contactnote %]</textarea>
+                <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% patron.contactnote | html %]</textarea>
         [% IF ( mandatorycontactnote ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
index 94f1dd7..9d0cda0 100644 (file)
@@ -9,7 +9,7 @@
          <label for="B_streetnumber">
     [% END %]
     Street Number: </label>
-    <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber %]" />
+    <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber | html %]" />
     [% IF ( mandatoryB_streetnumber ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -26,9 +26,9 @@
     <option value=""></option>
     [% FOR roadtype IN roadtypes %]
         [% IF roadtype.authorised_value == patron.B_streettype %]
-            <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
         [% ELSE %]
-            <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
         [% END %]
     [% END %]
     </select>
@@ -44,7 +44,7 @@
         <label for="B_address">
     [% END %]
         Address: </label>
-        <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address %]" />
+        <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address | html %]" />
     [% IF ( mandatoryB_address ) %]<span class="required">Required</span>[% END %]
         </li>
 [% END %]
@@ -57,7 +57,7 @@
         <label for="B_address2">
     [% END %]
     Address 2: </label>
-    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 %]" />
+    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 | html %]" />
     [% IF ( mandatoryB_address2 ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -69,7 +69,7 @@
         <label for="B_zipcode">
     [% END %]
     ZIP/Postal code: </label>
-    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode %]" />
+    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode | html %]" />
     [% IF ( mandatoryB_zipcode ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -81,7 +81,7 @@
         <label for="B_city">
     [% END %]
     City: </label>
-    <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city %]" />
+    <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city | html %]" />
     [% IF ( mandatoryB_city ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -93,7 +93,7 @@
         <label for="B_state">
     [% END %]
         State: </label>
-        <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state %]" />
+        <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state | html %]" />
     [% IF ( mandatoryB_state ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
         <label for="B_country">
     [% END %]
         Country: </label>
-        <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country %]" />
+        <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country | html %]" />
     [% IF ( mandatoryB_country ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
        <label for="B_phone">
    [% END %]
    Phone: </label>
-   <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone %]" />
+   <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone | html %]" />
    [% IF ( mandatoryB_phone ) %]<span class="required">Required</span>[% END %]
    </li>
 [% END %]
        <label for="B_email">
    [% END %]
        Email: </label>
-       <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email %]" />
+       <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email | html %]" />
    [% IF ( mandatoryB_email ) %]<span class="required">Required</span>[% END %] </li>
 [% END %]
 [% UNLESS nocontactnote %]
         <label for="contactnote">
     [% END %]
         Contact note: </label>
-        <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% patron.contactnote %]</textarea>
+        <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% patron.contactnote | html %]</textarea>
     [% IF ( mandatorycontactnote ) %]<span class="required">Required</span>[% END %]
         </li>
     [% END %]
index a4d77c3..6afd3e1 100644 (file)
@@ -8,7 +8,7 @@
                     <label for="B_streetnumber">
                 [% END %]
                 Street Number: </label>
-                <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber %]" />
+                <input type="text" id="B_streetnumber" name="B_streetnumber" size="5" value="[% patron.B_streetnumber | html %]" />
                [% IF ( mandatoryB_streetnumber ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -25,9 +25,9 @@
         <option value=""></option>
         [% FOR roadtype IN roadtypes %]
             [% IF roadtype.authorised_value == patron.B_streettype %]
-                <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+                <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
             [% ELSE %]
-                <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+                <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
             [% END %]
         [% END %]
         </select>
@@ -43,7 +43,7 @@
                     <label for="B_address">
                 [% END %]
                 Address: </label>
-                    <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address %]" />
+                    <input type="text" id="B_address" name="B_address" size="40" value="[% patron.B_address | html %]" />
       [% IF ( mandatoryB_address ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -55,7 +55,7 @@
                     <label for="B_address2">
                 [% END %]
                 Address 2: </label>
-                    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 %]" />
+                    <input type="text" id="B_address2" name="B_address2" size="40" value="[% patron.B_address2 | html %]" />
       [% IF ( mandatoryB_address2 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -67,7 +67,7 @@
                     <label for="B_city">
                 [% END %]
                 City: </label>
-                <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city %]" />
+                <input type="text" id="B_city" name="B_city" size="20" value="[% patron.B_city | html %]" />
       [% IF ( mandatoryB_city ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -79,7 +79,7 @@
                     <label for="B_state">
                 [% END %]
                 State: </label>
-                <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state %]" />
+                <input type="text" id="B_state" name="B_state" size="20" value="[% patron.B_state | html %]" />
       [% IF ( mandatoryB_state ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -91,7 +91,7 @@
                     <label for="B_zipcode">
                 [% END %]
                 ZIP/Postal code: </label>
-                    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode %]" />
+                    <input type="text" id="B_zipcode" name="B_zipcode" maxlength="10" size="10" value="[% patron.B_zipcode | html %]" />
       [% IF ( mandatoryB_zipcode ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                     <label for="B_country">
                 [% END %]
                 Country: </label>
-                    <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country %]" />
+                    <input type="text" id="B_country" name="B_country" size="20" value="[% patron.B_country | html %]" />
       [% IF ( mandatoryB_country ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                 <label for="B_phone">
                 [% END %]
                 Phone: </label>
-                    <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone %]" />
+                    <input type="text" id="B_phone" name="B_phone" value="[% patron.B_phone | html %]" />
                 [% IF ( mandatoryB_phone ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
           <label for="B_email">
         [% END %]
         Email: </label>
-            <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email %]" />
+            <input type="text" id="B_email" name="B_email" size="45" value="[% patron.B_email | html %]" />
         [% IF ( mandatoryB_email ) %]<span class="required">Required</span>[% END %] </li>
         [% END %]
         [% UNLESS nocontactnote %]
                 <label for="contactnote">
                 [% END %]
                 Contact note: </label>
-                <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% contactnote %]</textarea>
+                <textarea id="contactnote" name="contactnote" cols="40" rows="2">[% contactnote | html %]</textarea>
         [% IF ( mandatorycontactnote ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
index 2f3e4c3..cbc2f7e 100644 (file)
@@ -8,7 +8,7 @@
                 <label for="altcontactsurname">
                 [% END %]
                 Surname:</label>
-                    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname %]" />
+                    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname | html %]" />
                 [% IF ( mandatoryaltcontactsurname ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -20,7 +20,7 @@
                 <label for="altcontactfirstname">
                 [% END %]
                 First name:</label>
-                    <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname %]" />
+                    <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname | html %]" />
                 [% IF ( mandatoryaltcontactfirstname ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -32,7 +32,7 @@
                 <label for="altcontactaddress1">
                 [% END %]
                 Address:</label>
-                    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 %]" size="40" />
+                    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 | html %]" size="40" />
                 [% IF ( mandatoryaltcontactaddress1 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -44,7 +44,7 @@
                 <label for="altcontactaddress2">
                 [% END %]
                 Address 2:</label>
-                <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 %]" size="40" />
+                <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 | html %]" size="40" />
                 [% IF ( mandatoryaltcontactaddress2 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -56,7 +56,7 @@
                                 <label for="altcontactzipcode">
                                 [% END %]
                                 ZIP/Postal code:</label>
-                    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode %]" size="5" />
+                    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode | html %]" size="5" />
                                 [% IF ( mandatoryaltcontactzipcode ) %]<span class="required">Required</span>[% END %]
                         </li>
         [% END %]
@@ -68,7 +68,7 @@
                 <label for="altcontactaddress3">
                 [% END %]
                 City:</label>
-                <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 %]" size="20" />
+                <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 | html %]" size="20" />
                 [% IF ( mandatoryaltcontactaddress3 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -80,7 +80,7 @@
                 <label for="altcontactstate">
                 [% END %]
                 State:</label>
-                <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate %]" size="20" />
+                <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate | html %]" size="20" />
                 [% IF ( mandatoryaltcontactstate ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -92,7 +92,7 @@
                 <label for="altcontactcountry">
                 [% END %]
                 Country:</label>
-                    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry %]" size="20" />
+                    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry | html %]" size="20" />
                 [% IF ( mandatoryaltcontactcountry ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                 <label for="altcontactphone">
                 [% END %]
                 Phone:</label>
-                    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone %]" />
+                    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone | html %]" />
                 [% IF ( mandatoryaltcontactphone ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
index 50c1921..60c0fec 100644 (file)
@@ -8,7 +8,7 @@
         <label for="altcontactsurname">
     [% END %]
     Surname:</label>
-    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname %]" />
+    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname | html %]" />
     [% IF ( mandatoryaltcontactsurname ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -20,7 +20,7 @@
         <label for="altcontactfirstname">
     [% END %]
         First name:</label>
-        <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname %]" />
+        <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname | html %]" />
     [% IF ( mandatoryaltcontactfirstname ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -32,7 +32,7 @@
         <label for="altcontactaddress1">
     [% END %]
     Address:</label>
-    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 %]" size="40" />
+    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 | html %]" size="40" />
     [% IF ( mandatoryaltcontactaddress1 ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -44,7 +44,7 @@
         <label for="altcontactaddress2">
     [% END %]
     Address 2:</label>
-    <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 %]" size="40" />
+    <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 | html %]" size="40" />
     [% IF ( mandatoryaltcontactaddress2 ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -56,7 +56,7 @@
         <label for="altcontactzipcode">
     [% END %]
     ZIP/Postal code:</label>
-    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode %]" size="5" />
+    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode | html %]" size="5" />
     [% IF ( mandatoryaltcontactzipcode ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -68,7 +68,7 @@
         <label for="altcontactaddress3">
     [% END %]
     City:</label>
-    <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 %]" size="20" />
+    <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 | html %]" size="20" />
     [% IF ( mandatoryaltcontactaddress3 ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -80,7 +80,7 @@
         <label for="altcontactstate">
     [% END %]
     State:</label>
-    <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate %]" size="20" />
+    <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate | html %]" size="20" />
     [% IF ( mandatoryaltcontactstate ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -92,7 +92,7 @@
         <label for="altcontactcountry">
     [% END %]
     Country:</label>
-    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry %]" size="20" />
+    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry | html %]" size="20" />
     [% IF ( mandatoryaltcontactcountry ) %]<span class="required">Required</span>[% END %]
 </li>
 [% END %]
         <label for="altcontactphone">
     [% END %]
     Phone:</label>
-    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone %]" />
+    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone | html %]" />
     [% IF ( mandatoryaltcontactphone ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
index 7e7e790..bd8c049 100644 (file)
@@ -8,7 +8,7 @@
                 <label for="altcontactsurname">
                 [% END %]
                 Surname:</label>
-                    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname %]" />
+                    <input type="text" name="altcontactsurname" id="altcontactsurname" value="[% patron.altcontactsurname | html %]" />
                 [% IF ( mandatoryaltcontactsurname ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -20,7 +20,7 @@
                 <label for="altcontactfirstname">
                 [% END %]
                 First name:</label>
-                    <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname %]" />
+                    <input type="text" name="altcontactfirstname" id="altcontactfirstname" value="[% patron.altcontactfirstname | html %]" />
                 [% IF ( mandatoryaltcontactfirstname ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -32,7 +32,7 @@
                 <label for="altcontactaddress1">
                 [% END %]
                 Address:</label>
-                    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 %]" size="40" />
+                    <input type="text" name="altcontactaddress1" id="altcontactaddress1" value="[% patron.altcontactaddress1 | html %]" size="40" />
                 [% IF ( mandatoryaltcontactaddress1 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -44,7 +44,7 @@
                 <label for="altcontactaddress2">
                 [% END %]
                 Address 2:</label>
-                <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 %]" size="40" />
+                <input type="text" name="altcontactaddress2" id="altcontactaddress2" value="[% patron.altcontactaddress2 | html %]" size="40" />
                 [% IF ( mandatoryaltcontactaddress2 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -56,7 +56,7 @@
                 <label for="altcontactaddress3">
                 [% END %]
                 City:</label>
-                <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 %]" size="20" />
+                <input type="text" name="altcontactaddress3" id="altcontactaddress3" value="[% patron.altcontactaddress3 | html %]" size="20" />
                 [% IF ( mandatoryaltcontactaddress3 ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -68,7 +68,7 @@
                 <label for="altcontactstate">
                 [% END %]
                 State:</label>
-                <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate %]" size="20" />
+                <input type="text" name="altcontactstate" id="altcontactstate" value="[% patron.altcontactstate | html %]" size="20" />
                 [% IF ( mandatoryaltcontactstate ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -80,7 +80,7 @@
                 <label for="altcontactzipcode">
                 [% END %]
                 ZIP/Postal code:</label>
-                    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode %]" size="5" />
+                    <input type="text" name="altcontactzipcode" id="altcontactzipcode" value="[% patron.altcontactzipcode | html %]" size="5" />
                 [% IF ( mandatoryaltcontactzipcode ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
@@ -92,7 +92,7 @@
                 <label for="altcontactcountry">
                 [% END %]
                 Country:</label>
-                    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry %]" size="20" />
+                    <input type="text" name="altcontactcountry" id="altcontactcountry" value="[% patron.altcontactcountry | html %]" size="20" />
                 [% IF ( mandatoryaltcontactcountry ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
                 <label for="altcontactphone">
                 [% END %]
                 Phone:</label>
-                    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone %]" />
+                    <input type="text" name="altcontactphone" id="altcontactphone" value="[% patron.altcontactphone | html %]" />
                 [% IF ( mandatoryaltcontactphone ) %]<span class="required">Required</span>[% END %]
             </li>
         [% END %]
index b287c12..78e0388 100644 (file)
@@ -4,13 +4,13 @@
         [% IF patron.streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.streettype) %]
         [% END %]
-        <li class="patronaddress1">[% patron.address %][%IF roadtype_desc %] [% roadtype_desc %][% END %][% IF patron.streetnumber %] [% patron.streetnumber %][% END %]</li>
+        <li class="patronaddress1">[% patron.address | html %][%IF roadtype_desc %] [% roadtype_desc | html %][% END %][% IF patron.streetnumber %] [% patron.streetnumber | html %][% END %]</li>
     [% END %]
     [% IF ( patron.address2 ) %]
-        <li class="patronaddress2">[% patron.address2 %]</li>
+        <li class="patronaddress2">[% patron.address2 | html %]</li>
     [% END %]
 [% END %]
 [% IF ( patron.city ) %]<li class="patroncity">
-    [%IF ( patron.zipcode ) %][% patron.zipcode %] [% END %][% patron.city %][% IF ( patron.state ) %]</br>[% patron.state %][% END %]
-    [% IF ( patron.country ) %]<br />[% patron.country %][% END %]</li>
+    [%IF ( patron.zipcode ) %][% patron.zipcode | html %] [% END %][% patron.city | html %][% IF ( patron.state ) %]</br>[% patron.state | html %][% END %]
+    [% IF ( patron.country ) %]<br />[% patron.country | html %][% END %]</li>
 [% END %]
index 494bd25..cd8cb48 100644 (file)
@@ -4,16 +4,16 @@
         [% IF patron.streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.streettype) %]
         [% END %]
-        <li class="patronaddress1">[% IF patron.streetnumber %][% patron.streetnumber %] [% END %]
-        [%IF roadtype_desc %][% roadtype_desc %] [% END %]
-            [% patron.address %]
+        <li class="patronaddress1">[% IF patron.streetnumber %][% patron.streetnumber | html %] [% END %]
+        [%IF roadtype_desc %][% roadtype_desc | html %] [% END %]
+            [% patron.address | html %]
         </li>
     [% END %]
     [% IF ( patron.address2 ) %]
-        <li class="patronaddress2">[% patron.address2 %]</li>
+        <li class="patronaddress2">[% patron.address2 | html %]</li>
     [% END %]
 [% END %]
 [% IF ( patron.city ) %]
-    <li class="patroncity">[%IF ( patron.zipcode ) %][% patron.zipcode %] [% END %][% patron.city %][% IF ( patron.state ) %]</br>[% patron.state %][% END %]
-    [% IF ( patron.country ) %]<br />[% patron.country %][% END %]</li>
+    <li class="patroncity">[%IF ( patron.zipcode ) %][% patron.zipcode | html %] [% END %][% patron.city | html %][% IF ( patron.state ) %]</br>[% patron.state | html %][% END %]
+    [% IF ( patron.country ) %]<br />[% patron.country | html %][% END %]</li>
 [% END %]
index d7fb581..7b00bdd 100644 (file)
@@ -4,7 +4,7 @@
         [% IF patron.streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.streettype) %]
         [% END %]
-        <li class="patronaddress1">[% if (patron.streetnumber) %][% patron.streetnumber |html  %][% end %] [% patron.address |html %] [% IF roadtype_desc %][% roadtype_desc |html  %] [% END %][% end %]</li>
+        <li class="patronaddress1">[% if (patron.streetnumber) | html %][% patron.streetnumber |html  %][% end | html %] [% patron.address | html %] [% IF roadtype_desc %][% roadtype_desc |html  %] [% END %][% end | html %]</li>
     [% END %]
     [% IF ( patron.address2 ) %]
         <li class="patronaddress2">[% patron.address2 |html  %]</li>
index 28ae475..f7fc974 100644 (file)
@@ -4,13 +4,13 @@
         [% IF patron.B_streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.B_streettype) %]
         [% END %]
-        <li class="patronaddress1">[% patron.B_address %][%IF roadtype_desc %] [% roadtype_desc %][% END %][% IF patron.B_streetnumber %] [% patron.B_streetnumber %][% END %]</li>
+        <li class="patronaddress1">[% patron.B_address | html %][%IF roadtype_desc %] [% roadtype_desc | html %][% END %][% IF patron.B_streetnumber %] [% patron.B_streetnumber | html %][% END %]</li>
     [% END %]
     [% IF ( patron.B_address2 ) %]
-        <li class="patronaddress2">[% patron.B_address2 %]</li>
+        <li class="patronaddress2">[% patron.B_address2 | html %]</li>
     [% END %]
 [% END %]
 [% IF ( patron.B_city ) %]<li class="patroncity">
-    [%IF ( patron.B_zipcode ) %][% patron.B_zipcode %] [% END %][% patron.B_city %][% IF ( patron.B_state ) %]</br>[% patron.B_state %][% END %]
-    [% IF ( patron.B_country ) %]<br />[% patron.B_country %][% END %]</li>
+    [%IF ( patron.B_zipcode ) %][% patron.B_zipcode | html %] [% END %][% patron.B_city | html %][% IF ( patron.B_state ) %]</br>[% patron.B_state | html %][% END %]
+    [% IF ( patron.B_country ) %]<br />[% patron.B_country | html %][% END %]</li>
 [% END %]
index cad604c..2080a48 100644 (file)
@@ -4,18 +4,18 @@
         [% IF patron.B_streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.B_streettype) %]
         [% END %]
-        <li class="patronaddress1">[% IF patron.B_streetnumber %][% patron.B_streetnumber %][% END %]
-        [%IF roadtype_desc %][% roadtype_desc %] [% END %]
-            [% patron.B_address %]
+        <li class="patronaddress1">[% IF patron.B_streetnumber %][% patron.B_streetnumber | html %][% END %]
+        [%IF roadtype_desc %][% roadtype_desc | html %] [% END %]
+            [% patron.B_address | html %]
         </li>
     [% END %]
     [% IF ( patron.B_address2 ) %]
-        <li class="patronaddress2">[% patron.B_address2 %]</li>
+        <li class="patronaddress2">[% patron.B_address2 | html %]</li>
     [% END %]
 [% END %]
 [% IF ( patron.B_city ) %]
-    <li class="patroncity">[%IF ( patron.B_zipcode ) %][% patron.B_zipcode %] [% END %]
-    [% patron.B_city %]
-    [% IF ( patron.B_state ) %]</br>[% patron.B_state %][% END %]
-    [% IF ( patron.B_country ) %]<br />[% patron.B_country %][% END %]</li>
+    <li class="patroncity">[%IF ( patron.B_zipcode ) %][% patron.B_zipcode | html %] [% END %]
+    [% patron.B_city | html %]
+    [% IF ( patron.B_state ) %]</br>[% patron.B_state | html %][% END %]
+    [% IF ( patron.B_country ) %]<br />[% patron.B_country | html %][% END %]</li>
 [% END %]
index f2c38aa..9f8453f 100644 (file)
@@ -4,13 +4,13 @@
         [% IF patron.B_streettype %]
             [% SET roadtype_desc = AuthorisedValues.GetByCode('ROADTYPE', patron.B_streettype) %]
         [% END %]
-        <li class="patronaddress1">[% if (patron.B_streetnumber) %][% patron.B_streetnumber |html %][% end %] [% patron.B_address |html %] [% IF roadtype_desc %][% roadtype_desc |html %] [% END %][% end %]</li>
+        <li class="patronaddress1">[% if (patron.B_streetnumber) | html %][% patron.B_streetnumber | html %][% end | html %] [% patron.B_address | html %] [% IF roadtype_desc %][% roadtype_desc | html %] [% END %][% end | html %]</li>
     [% END %]
     [% IF ( patron.B_address2 ) %]
-        <li class="patronaddress2">[% patron.B_address2 |html %]</li>
+        <li class="patronaddress2">[% patron.B_address2 | html %]</li>
     [% END %]
 [% END %]
 [% IF ( patron.B_city ) %]<li class="patroncity">
-        [% patron.B_city |html %][% IF ( patron.B_state ) %], [% patron.B_state |html %][% END %]
-        [% patron.B_zipcode |html %][% IF ( patron.B_country ) %], [% patron.B_country |html %][% END %]</li>
+        [% patron.B_city | html %][% IF ( patron.B_state ) %], [% patron.B_state | html %][% END %]
+        [% patron.B_zipcode | html %][% IF ( patron.B_country ) %], [% patron.B_country | html %][% END %]</li>
 [% END %]
index 6bebd13..a5c7c0f 100644 (file)
@@ -13,9 +13,9 @@
         <option value=""></option>
         [% FOR roadtype IN roadtypes %]
           [% IF roadtype.authorised_value == patron.streettype %]
-            <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
           [% ELSE %]
-            <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
           [% END %]
         [% END %]
       </select>
@@ -31,7 +31,7 @@
       <label for="address">
       [% END %]
       Address: </label>
-            <input type="text" id="address" name="address" size="35" value="[% patron.address %]" />
+            <input type="text" id="address" name="address" size="35" value="[% patron.address | html %]" />
       [% IF ( mandatoryaddress ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
@@ -43,7 +43,7 @@
       <label for="streetnumber">
       [% END %]
       Street number: </label>
-        <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber %]" />
+        <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber | html %]" />
 [% IF ( mandatorystreetnumber ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
@@ -55,7 +55,7 @@
       <label for="address2">
       [% END %]
       Address 2: </label>
-            <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 %]" />
+            <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 | html %]" />
       [% IF ( mandatoryaddress2 ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
@@ -67,7 +67,7 @@
         <label for="zipcode">
       [% END %]
       ZIP/Postal code: </label>
-            <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode %]" />
+            <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode | html %]" />
           [% IF ( mandatoryzipcode ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
         <label for="city">
       [% END %]
       City: </label>
-        <input type="text" id="city" name="city" size="20" value="[% patron.city %]" />
+        <input type="text" id="city" name="city" size="20" value="[% patron.city | html %]" />
         [% IF cities.count %]or choose
         <select id="select_city" name="select_city">
             <option value="|||"></option>
             [% FOREACH c IN cities %]
                 [% IF c.city_name == patron.city && c.city_state == patron.state && c.city_zipcode == patron.zipcode %]
-                <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]" selected="selected">
+                <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]" selected="selected">
                 [% ELSE %]
-                <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]">
+                <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]">
                 [% END %]
-                    [% c.city_name %] [% c.city_state %] [% c.city_zipcode %]
+                    [% c.city_name | html %] [% c.city_state | html %] [% c.city_zipcode | html %]
                 </option>
             [% END %]
         </select>
         <label for="state">
       [% END %]
       State: </label>
-      <input type="text" name="state" id="state" size="20" value="[% patron.state %]" />
+      <input type="text" name="state" id="state" size="20" value="[% patron.state | html %]" />
       [% IF ( mandatorystate ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
         <label for="country">
       [% END %]
       Country: </label>
-        <input type="text" name="country" id="country" size="20" value="[% patron.country %]" />
+        <input type="text" name="country" id="country" size="20" value="[% patron.country | html %]" />
       [% IF ( mandatorycountry ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
index 696b327..245c773 100644 (file)
@@ -8,7 +8,7 @@
             <label for="streetnumber">
         [% END %]
             Street number: </label>
-            <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber %]" />
+            <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber | html %]" />
         [% IF ( mandatorystreetnumber ) %]<span class="required">Required</span>[% END %]
     [% END %]
 
@@ -24,9 +24,9 @@
            <option value=""></option>
         [% FOR roadtype IN roadtypes %]
             [% IF roadtype.authorised_value == patron.streettype %]
-                <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+                <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
             [% ELSE %]
-                <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+                <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
             [% END %]
         [% END %]
         </select>
@@ -42,7 +42,7 @@
         <label for="address">
     [% END %]
     Address: </label>
-        <input type="text" id="address" name="address" size="35" value="[% patron.address %]" />
+        <input type="text" id="address" name="address" size="35" value="[% patron.address | html %]" />
     [% IF ( mandatoryaddress ) %]<span class="required">Required</span>[% END %]
       </li>
 [% END %]
@@ -54,7 +54,7 @@
         <label for="address2">
     [% END %]
         Address 2: </label>
-        <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 %]" />
+        <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 | html %]" />
     [% IF ( mandatoryaddress2 ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
@@ -66,7 +66,7 @@
         <label for="zipcode">
     [% END %]
     ZIP/Postal code: </label>
-    <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode %]" />
+    <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode | html %]" />
     [% IF ( mandatoryzipcode ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
         <label for="city">
     [% END %]
     City: </label>
-    <input type="text" id="city" name="city" size="20" value="[% patron.city %]" />
+    <input type="text" id="city" name="city" size="20" value="[% patron.city | html %]" />
     [% IF cities.count %]or choose
         <select id="select_city" name="select_city">
             <option value="|||"></option>
         [% FOREACH c IN cities %]
             [% IF c.city_name == patron.city && c.city_state == patron.state && c.city_zipcode == patron.zipcode %]
-                <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]" selected="selected">
+                <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]" selected="selected">
             [% ELSE %]
-                 <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]">
+                 <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]">
             [% END %]
-                [% c.city_name %] [% c.city_state %] [% c.city_zipcode %]
+                [% c.city_name | html %] [% c.city_state | html %] [% c.city_zipcode | html %]
             </option>
         [% END %]
         </select>
         <label for="state">
     [% END %]
         State: </label>
-        <input type="text" name="state" id="state" size="20" value="[% patron.state %]" />
+        <input type="text" name="state" id="state" size="20" value="[% patron.state | html %]" />
     [% IF ( mandatorystate ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
       <label for="country">
     [% END %]
     Country: </label>
-      <input type="text" name="country" id="country" size="20" value="[% patron.country %]" />
+      <input type="text" name="country" id="country" size="20" value="[% patron.country | html %]" />
     [% IF ( mandatorycountry ) %]<span class="required">Required</span>[% END %]
     </li>
 [% END %]
index f76d3fd..4c95b59 100644 (file)
@@ -8,7 +8,7 @@
       <label for="streetnumber">
       [% END %]
       Street number: </label>
-        <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber %]" />
+        <input type="text" id="streetnumber" name="streetnumber" size="5" value="[% patron.streetnumber | html %]" />
 [% IF ( mandatorystreetnumber ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
@@ -25,9 +25,9 @@
         <option value=""></option>
         [% FOR roadtype IN roadtypes %]
           [% IF roadtype.authorised_value == patron.streettype %]
-            <option value="[% roadtype.authorised_value %]" selected="selected">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]" selected="selected">[% roadtype.lib | html %]</option>
           [% ELSE %]
-            <option value="[% roadtype.authorised_value %]">[% roadtype.lib %]</option>
+            <option value="[% roadtype.authorised_value | html %]">[% roadtype.lib | html %]</option>
           [% END %]
         [% END %]
       </select>
@@ -43,7 +43,7 @@
       <label for="address">
       [% END %]
       Address: </label>
-            <input type="text" id="address" name="address" size="35" value="[% patron.address %]" />
+            <input type="text" id="address" name="address" size="35" value="[% patron.address | html %]" />
       [% IF ( mandatoryaddress ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
@@ -55,7 +55,7 @@
       <label for="address2">
       [% END %]
       Address 2: </label>
-            <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 %]" />
+            <input type="text" id="address2" name="address2" size="35" value="[% patron.address2 | html %]" />
       [% IF ( mandatoryaddress2 ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
         <label for="city">
       [% END %]
       City: </label>
-        <input type="text" id="city" name="city" size="20" value="[% patron.city %]" />
+        <input type="text" id="city" name="city" size="20" value="[% patron.city | html %]" />
         [% IF cities.count %]or choose
         <select id="select_city" name="select_city">
             <option value="|||"></option>
             [% FOREACH c IN cities %]
                 [% IF c.city_name == patron.city && c.city_state == patron.state && c.city_zipcode == patron.zipcode %]
-                <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]" selected="selected">
+                <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]" selected="selected">
                 [% ELSE %]
-                <option value="[% c.city_zipcode %]|[% c.city_name %]|[% c.city_state %]|[% c.city_country %]">
+                <option value="[% c.city_zipcode | html %]|[% c.city_name | html %]|[% c.city_state | html %]|[% c.city_country | html %]">
                 [% END %]
-                    [% c.city_name %] [% c.city_state %] [% c.city_zipcode %]
+                    [% c.city_name | html %] [% c.city_state | html %] [% c.city_zipcode | html %]
                 </option>
             [% END %]
         </select>
@@ -93,7 +93,7 @@
         <label for="state">
       [% END %]
       State: </label>
-      <input type="text" name="state" id="state" size="20" value="[% patron.state %]" />
+      <input type="text" name="state" id="state" size="20" value="[% patron.state | html %]" />
       [% IF ( mandatorystate ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
         <label for="zipcode">
       [% END %]
       ZIP/Postal code: </label>
-            <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode %]" />
+            <input type="text" name="zipcode" id="zipcode" size="10" value="[% patron.zipcode | html %]" />
       [% IF ( mandatoryzipcode ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
         <label for="country">
       [% END %]
       Country: </label>
-        <input type="text" name="country" id="country" size="20" value="[% patron.country %]" />
+        <input type="text" name="country" id="country" size="20" value="[% patron.country | html %]" />
       [% IF ( mandatorycountry ) %]<span class="required">Required</span>[% END %]
     </li>
         [% END %]
index 43d0e5a..d7d08b5 100644 (file)
@@ -1,27 +1,27 @@
 [% IF ( borrowernumber ) %]
 <div id="menu">
   <ul>
-    [% IF ( circview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrowernumber %]">Check out</a></li>
-    [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Details</a></li>
+    [% IF ( circview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% borrowernumber | html %]">Check out</a></li>
+    [% IF ( detailview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">Details</a></li>
     [% IF ( CAN_user_updatecharges ) %]
-        [% IF ( finesview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% borrowernumber %]">Fines</a></li>
+        [% IF ( finesview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% borrowernumber | html %]">Fines</a></li>
     [% END %]
     [% IF ( intranetreadinghistory ) %]
-        [% IF ( readingrecordview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber %]">Circulation history</a></li>
+        [% IF ( readingrecordview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/readingrec.pl?borrowernumber=[% borrowernumber | html %]">Circulation history</a></li>
     [% END %]
     [% IF ( CAN_user_parameters ) %]
-        [% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=MEMBERS&amp;action=MODIFY&amp;object=[% borrowernumber %]">Modification log</a></li>
+        [% IF ( logview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/tools/viewlog.pl?do_it=1&amp;modules=MEMBERS&amp;action=MODIFY&amp;object=[% borrowernumber | html %]">Modification log</a></li>
     [% END %]
-       [% IF ( sentnotices ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber %]">Notices</a></li>
-    [% IF (  statisticsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/statistics.pl?borrowernumber=[% borrowernumber %]">Statistics</a></li>
+       [% IF ( sentnotices ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber | html %]">Notices</a></li>
+    [% IF (  statisticsview ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/statistics.pl?borrowernumber=[% borrowernumber | html %]">Statistics</a></li>
     [% IF EnableBorrowerFiles %]
-        [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% borrowernumber %]">Files</a></li>
+        [% IF ( borrower_files ) %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/files.pl?borrowernumber=[% borrowernumber | html %]">Files</a></li>
     [% END %]
     [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
-        [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% borrowernumber %]">Discharge</a></li>
+        [% IF dischargeview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% borrowernumber | html %]">Discharge</a></li>
     [% END %]
     [% IF Koha.Preference('HouseboundModule') %]
-        [% IF houseboundview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% borrowernumber %]">Housebound</a></li>
+        [% IF houseboundview %]<li class="active">[% ELSE %]<li>[% END %]<a href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% borrowernumber | html %]">Housebound</a></li>
     [% END %]
   </ul>
 </div>
index 67f4ce0..6d4b896 100644 (file)
@@ -8,21 +8,21 @@
 <div id="toolbar" class="btn-toolbar">
     [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF ( guarantor ) %]
-            <a id="editpatron" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber %]&amp;guarantorid=[% guarantor.borrowernumber %]&amp;categorycode=[% patron.categorycode %]">
+            <a id="editpatron" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;guarantorid=[% guarantor.borrowernumber | html %]&amp;categorycode=[% patron.categorycode | html %]">
         [% ELSE %]
-            <a id="editpatron" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber %]&amp;categorycode=[% patron.categorycode %]">
+            <a id="editpatron" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;categorycode=[% patron.categorycode | html %]">
         [% END %]
         <i class="fa fa-pencil"></i> Edit</a>
     [% END %]
 
     [% IF CAN_user_borrowers_edit_borrowers %]
         [% IF patron.is_adult AND Koha.Preference("borrowerRelationship") %]
-            <a id="addchild" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;guarantorid=[% patron.borrowernumber %]"><i class="fa fa-plus"></i> Add child</a>
+            <a id="addchild" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;guarantorid=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> Add child</a>
         [% END %]
         [% IF CAN_user_borrowers_edit_borrowers %]
-            <a id="changepassword" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber %]"><i class="fa fa-lock"></i> Change password</a>
+            <a id="changepassword" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]"><i class="fa fa-lock"></i> Change password</a>
         [% END %]
-        <a id="duplicate" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=duplicate&amp;borrowernumber=[% patron.borrowernumber %]&amp;categorycode=[% patron.categorycode %]"><i class="fa fa-copy"></i> Duplicate</a>
+        <a id="duplicate" class="btn btn-default btn-sm" href="/cgi-bin/koha/members/memberentry.pl?op=duplicate&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;categorycode=[% patron.categorycode | html %]"><i class="fa fa-copy"></i> Duplicate</a>
     [% END %]
 
     [% IF CAN_user_circulate_circulate_remaining_permissions %]
         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown">More <span class="caret"></span></button>
             <ul class="dropdown-menu">
                 [% IF CAN_user_borrowers_edit_borrowers %]
-                    <li><a id="renewpatron" href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber %]&amp;destination=[% destination %]&amp;reregistration=y">Renew patron</a></li>
+                    <li><a id="renewpatron" href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;destination=[% destination | html %]&amp;reregistration=y">Renew patron</a></li>
                 [% ELSE %]
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to renew patrons" id="renewpatron" href="#">Renew patron</a></li>
                 [% END %]
                 [% IF ( CAN_user_permissions ) %]
-                    <li><a id="patronflags" href="/cgi-bin/koha/members/member-flags.pl?member=[% patron.borrowernumber %]">Set permissions</a></li>
+                    <li><a id="patronflags" href="/cgi-bin/koha/members/member-flags.pl?member=[% patron.borrowernumber | html %]">Set permissions</a></li>
                 [% ELSE %]
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
                 [% END %]
 
                 [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
-                    <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber %]">Discharge</a></li>
+                    <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | html %]">Discharge</a></li>
                 [% END %]
 
                 [% IF Koha.Preference('RESTOAuth2ClientCredentials') %]
                     [% IF CAN_user_borrowers_edit_borrowers %]
-                        <li><a id="apikeys" href="/cgi-bin/koha/members/apikeys.pl?patron_id=[% patron.borrowernumber %]">Manage API keys</a></li>
+                        <li><a id="apikeys" href="/cgi-bin/koha/members/apikeys.pl?patron_id=[% patron.borrowernumber | html %]">Manage API keys</a></li>
                     [% ELSE %]
                         <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to manage API keys" id="apikeys" href="#">Manage API keys</a></li>
                     [% END %]
                             <option value="B">OPAC - [% patron.firstname | html %] [% patron.surname | html %]</option>
                         </select>
                     </div>
-                    [% bor_notes = AuthorisedValues.Get( 'BOR_NOTES' ) %]
+                    [% bor_notes = AuthorisedValues.Get( 'BOR_NOTES' ) | html %]
                     [% IF bor_notes %]
                         <div class="form-group">
                             <label for="select_patron_messages">Predefined notes: </label>
                             <select name="type" id="select_patron_messages">
                                 <option value="">Select note</option>
                                 [% FOREACH bor_note IN bor_notes %]
-                                    <option value="[% bor_note.lib %]">[% bor_note.lib %]</option>
+                                    <option value="[% bor_note.lib | html %]">[% bor_note.lib | html %]</option>
                                 [% END %]
                             </select>
                         </div>
                     <div class="form-group">
                         <textarea rows="3" class="modal-textarea" name="borrower_message" id="borrower_message" ></textarea>
                     </div>
-                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-                    <input type="hidden" name="batch" value="[% batch %]" />
-                    <input type="hidden" name="branchcode" value="[% LoginBranchcode %]" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                    <input type="hidden" name="batch" value="[% batch | html %]" />
+                    <input type="hidden" name="branchcode" value="[% LoginBranchcode | html %]" />
                 </div>
                 <div class="modal-footer">
                     <button class="btn btn-default approve" type="submit"><i class="fa fa-check"></i> Save</button>
index df79d8e..0a36656 100644 (file)
@@ -1,37 +1,37 @@
 [% BLOCK sourcetab %]
-    <div id="tabrecord[% record.recordid %]">
+    <div id="tabrecord[% record.recordid | html %]">
         <div class="record">
-            <ul id="ulrecord[% record.recordid %]">
+            <ul id="ulrecord[% record.recordid | html %]">
                 [% FOREACH field IN record.display %]
                   [% IF field.tag != biblionumbertag %]
-                    <li id="k[% field.key %]">
+                    <li id="k[% field.key | html %]">
                         [% IF (tabrecord.reference) %]
-                            <input type="checkbox" checked="checked" class="fieldpick" id="rec_[% record.recordid %]_[% field.key %]" />
+                            <input type="checkbox" checked="checked" class="fieldpick" id="rec_[% record.recordid | html %]_[% field.key | html %]" />
                         [% ELSE %]
-                            <input type="checkbox" class="fieldpick" id="rec_[% record.recordid %]_[% field.key %]" />
+                            <input type="checkbox" class="fieldpick" id="rec_[% record.recordid | html %]_[% field.key | html %]" />
                         [% END %]
-                        <label for="rec_[% record.recordid %]_[% field.key %]"><span class="field">[% field.tag %]</span></label>
+                        <label for="rec_[% record.recordid | html %]_[% field.key | html %]"><span class="field">[% field.tag | html %]</span></label>
 
-                        <input type="hidden" name="tag_[% field.tag %]_indicator1_[% field.key %]" value="[% field.indicator1 %]" />
-                        <input type="hidden" name="tag_[% field.tag %]_indicator2_[% field.key %]" value="[% field.indicator2 %]" />
+                        <input type="hidden" name="tag_[% field.tag | html %]_indicator1_[% field.key | html %]" value="[% field.indicator1 | html %]" />
+                        <input type="hidden" name="tag_[% field.tag | html %]_indicator2_[% field.key | html %]" value="[% field.indicator2 | html %]" />
                         [% IF ( field.value ) %]
-                            / [% field.value %]
-                            <input type="hidden" name="tag_[% field.tag %]_code_00_[% field.key %]" value="00" />
-                            <input type="hidden" name="tag_[% field.tag %]_subfield_00_[% field.key %]" value="[% field.value %]" />
+                            / [% field.value | html %]
+                            <input type="hidden" name="tag_[% field.tag | html %]_code_00_[% field.key | html %]" value="00" />
+                            <input type="hidden" name="tag_[% field.tag | html %]_subfield_00_[% field.key | html %]" value="[% field.value | html %]" />
                         [% END %]
 
                         [% IF ( field.subfield.size ) %]
                             <ul>
                                 [% FOREACH subfield IN field.subfield %]
-                                    <li id="k[% subfield.subkey %]">
+                                    <li id="k[% subfield.subkey | html %]">
                                         [% IF (tabrecord.reference) %]
-                                            <input type="checkbox" checked="checked" class="subfieldpick" id="rec_[% record.recordid %]_[% subfield.subkey %]" />
+                                            <input type="checkbox" checked="checked" class="subfieldpick" id="rec_[% record.recordid | html %]_[% subfield.subkey | html %]" />
                                         [% ELSE %]
-                                            <input type="checkbox" class="subfieldpick" id="rec_[% record.recordid %]_[% subfield.subkey %]" />
+                                            <input type="checkbox" class="subfieldpick" id="rec_[% record.recordid | html %]_[% subfield.subkey | html %]" />
                                         [% END %]
-                                        <label for="rec_[% record.recordid %]_[% subfield.subkey %]"><span class="subfield">[% subfield.subtag %]</span> / [% subfield.value %]</label>
-                                        <input type="hidden" name="tag_[% field.tag %]_code_[% subfield.subtag %]_[% field.key %]_[% subfield.subkey %]" value="[% subfield.subtag %]" />
-                                        <input type="hidden" name="tag_[% field.tag %]_subfield_[% subfield.subtag %]_[% subfield.key %]_[% subfield.subkey %]" value="[% subfield.value |html%]" />
+                                        <label for="rec_[% record.recordid | html %]_[% subfield.subkey | html %]"><span class="subfield">[% subfield.subtag | html %]</span> / [% subfield.value | html %]</label>
+                                        <input type="hidden" name="tag_[% field.tag | html %]_code_[% subfield.subtag | html %]_[% field.key | html %]_[% subfield.subkey | html %]" value="[% subfield.subtag | html %]" />
+                                        <input type="hidden" name="tag_[% field.tag | html %]_subfield_[% subfield.subtag | html %]_[% subfield.key | html %]_[% subfield.subkey | html %]" value="[% subfield.value | html %]" />
                                     </li>
                                 [% END %]
                             </ul>
@@ -50,8 +50,8 @@
     <ul>
         [% FOREACH record IN sourcerecords %]
             <li>
-                <a href="#tabrecord[% record.recordid %]">
-                    [% record.recordid %]
+                <a href="#tabrecord[% record.recordid | html %]">
+                    [% record.recordid | html %]
                     [% IF record.reference %](ref)[% END %]
                 </a>
             </li>
index 1f2ac94..e0c880f 100644 (file)
@@ -2,7 +2,7 @@
 <!-- snippet for form to set borrower and patron category messaging preferences -->
 
 <input type="hidden" name="modify" value="yes" />
-<input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+<input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
   <table>
     <tr><th></th>
         <th>Days in advance</th>
       [% IF ( messaging_preference.takes_days ) %]
       <td>
           [% IF ( messaging_form_inactive ) %]
-            <select name="[% messaging_preference.message_attribute_id %]-DAYS" disabled="disabled">
+            <select name="[% messaging_preference.message_attribute_id | html %]-DAYS" disabled="disabled">
           [% ELSE %]
-            <select name="[% messaging_preference.message_attribute_id %]-DAYS">
+            <select name="[% messaging_preference.message_attribute_id | html %]-DAYS">
           [% END %]
           [% FOREACH select_day IN messaging_preference.select_days %]
-          [% IF ( select_day.selected ) %]<option value="[% select_day.day %]" selected="selected">[% select_day.day %]</option>[% ELSE %]
-          <option value="[% select_day.day %]">[% select_day.day %]</option>
+          [% IF ( select_day.selected ) %]<option value="[% select_day.day | html %]" selected="selected">[% select_day.day | html %]</option>[% ELSE %]
+          <option value="[% select_day.day | html %]">[% select_day.day | html %]</option>
       [% END %]
           [% END %]
         </select>
           [% IF ( messaging_form_inactive ) %]
               [% IF ( messaging_preference.transports_sms ) %]
                  <input type="checkbox"
-                 id="sms[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
+                 id="sms[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
                  value="sms" checked="checked" disabled="disabled" />
               [% ELSE %]
                  <input type="checkbox"
-                 id="sms[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
+                 id="sms[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
                  value="sms" disabled="disabled" />
               [% END %]
           [% ELSE %]
               [% IF ( messaging_preference.transports_sms ) %]
                  <input type="checkbox"
-                 id="sms[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="sms" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="sms[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="sms" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% ELSE %]
                  <input type="checkbox"
-                 id="sms[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="sms" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="sms[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="sms" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% END %]
           [% END %]
           </td>
           [% IF ( messaging_form_inactive ) %]
               [% IF ( messaging_preference.transports_phone ) %]
                  <input type="checkbox"
-                 id="phone[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
+                 id="phone[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
                  value="phone" checked="checked" disabled="disabled" />
               [% ELSE %]
                  <input type="checkbox"
-                 id="phone[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
+                 id="phone[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
                  value="phone" disabled="disabled" />
               [% END %]
           [% ELSE %]
               [% IF ( messaging_preference.transports_phone ) %]
                  <input type="checkbox"
-                 id="phone[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="phone" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="phone[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="phone" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% ELSE %]
                  <input type="checkbox"
-                 id="phone[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="phone" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="phone[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="phone" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% END %]
           [% END %]
           </td>
           [% IF ( messaging_form_inactive ) %]
               [% IF ( messaging_preference.transports_email ) %]
                 <input type="checkbox"
-                   id="email[% messaging_preference.message_attribute_id %]"
-                   name="[% messaging_preference.message_attribute_id %]"
+                   id="email[% messaging_preference.message_attribute_id | html %]"
+                   name="[% messaging_preference.message_attribute_id | html %]"
                    value="email" checked="checked" disabled="disabled" />
               [% ELSE %]
                 <input type="checkbox"
-                   id="email[% messaging_preference.message_attribute_id %]"
-                   name="[% messaging_preference.message_attribute_id %]"
+                   id="email[% messaging_preference.message_attribute_id | html %]"
+                   name="[% messaging_preference.message_attribute_id | html %]"
                    value="email" disabled="disabled" />
               [% END %]
           [% ELSE %]
               [% IF ( messaging_preference.transports_email ) %]
             <input type="checkbox"
-                 id="email[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="email" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="email[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="email" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% ELSE %]
             <input type="checkbox"
-                 id="email[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="email" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="email[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="email" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% END %]
           [% END %]
       </td>
           [% IF ( messaging_form_inactive ) %]
               [% IF ( messaging_preference.digest ) %]
                 <input type="checkbox"
-                     id="digest[% messaging_preference.message_attribute_id %]"
-                     value="[% messaging_preference.message_attribute_id %]"
+                     id="digest[% messaging_preference.message_attribute_id | html %]"
+                     value="[% messaging_preference.message_attribute_id | html %]"
                      name="digest" checked="checked" disabled="disabled" />
               [% ELSE %]
                 <input type="checkbox"
-                     id="digest[% messaging_preference.message_attribute_id %]"
-                     value="[% messaging_preference.message_attribute_id %]"
+                     id="digest[% messaging_preference.message_attribute_id | html %]"
+                     value="[% messaging_preference.message_attribute_id | html %]"
                      name="digest" disabled="disabled" />
               [% END %]
           [% ELSE %]
               [% IF ( messaging_preference.digest ) %]
                 <input type="checkbox"
-                     id="digest[% messaging_preference.message_attribute_id %]"
-                     value="[% messaging_preference.message_attribute_id %]"
-                     name="digest" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                     id="digest[% messaging_preference.message_attribute_id | html %]"
+                     value="[% messaging_preference.message_attribute_id | html %]"
+                     name="digest" checked="checked" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% ELSE %]
                 <input type="checkbox"
-                     id="digest[% messaging_preference.message_attribute_id %]"
-                     value="[% messaging_preference.message_attribute_id %]"
-                     name="digest" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                     id="digest[% messaging_preference.message_attribute_id | html %]"
+                     value="[% messaging_preference.message_attribute_id | html %]"
+                     name="digest" class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
               [% END %]
           [% END %]
       </td>
       <td>
           [% IF ( messaging_form_inactive ) %]
             <input type="checkbox"
-                 id="rss[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="rss"   [% messaging_preference.transport_rss %] disabled="disabled" />
+                 id="rss[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="rss"   [% messaging_preference.transport_rss | html %] disabled="disabled" />
           [% ELSE %]
             <input type="checkbox"
-                 id="rss[% messaging_preference.message_attribute_id %]"
-                 name="[% messaging_preference.message_attribute_id %]"
-                 value="rss"   [% messaging_preference.transport_rss %] class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id %]" />
+                 id="rss[% messaging_preference.message_attribute_id | html %]"
+                 name="[% messaging_preference.message_attribute_id | html %]"
+                 value="rss"   [% messaging_preference.transport_rss | html %] class="active_notify" data-attr-id="[% messaging_preference.message_attribute_id | html %]" />
           [% END %]
       </td>
       [% ELSE %]
       [% END %] -->
 
       [% UNLESS ( messaging_form_inactive ) %]
-      <td><input type="checkbox" class="none" id="none[% messaging_preference.message_attribute_id %]" /></td>
+      <td><input type="checkbox" class="none" id="none[% messaging_preference.message_attribute_id | html %]" /></td>
       [% END %]
     </tr>
     [% END %]
index e88d2e6..74e9be3 100644 (file)
@@ -18,7 +18,7 @@
                         <input type="hidden" name="op" value="gennext" />
 
                         [%# subscriptionidlist is used from serials-collection, subscriptionid is used from serils-edit %]
-                        <input type="hidden" name="subscriptionid" value="[% subscriptionidlist || subscriptionid %]" />
+                        <input type="hidden" name="subscriptionid" value="[% subscriptionidlist || subscriptionid | html %]" />
                     </fieldset>
                 </div>
 
index a8eeef5..cf133a9 100644 (file)
@@ -1,9 +1,9 @@
 <form method="POST" action="nl-search.pl" autocomplete="off"> <!-- This form will be used for things like social security numbers, so it makes sense not to remember them. -->
 <input type="hidden" name="op" value="search" />
     <fieldset>
-        <legend>[% nl_search_form_title %]</legend>
+        <legend>[% nl_search_form_title | html %]</legend>
         <label for="q">Social security or card number: </label>
-        <input type="text" name="q" value="[% q %]">
+        <input type="text" name="q" value="[% q | html %]">
         <input type="submit" value="Search">
     </fieldset>
 </form>
index fbe0d3a..135cc43 100644 (file)
@@ -32,6 +32,6 @@
             <div class="alert alert-danger">The patron has not been created the entered password was too weak, must contain at least one uppercase, and lower case letter and one number</div>
         [% CASE 'ERROR_password_has_whitespaces' %]
             <div class="alert alert-danger">The patron has not been created the entered password contained whitespaces</div>
-        [% CASE %][% message %]
+        [% CASE %][% message | html %]
     [% END %]
 [% END %]
index 599907e..77af494 100644 (file)
@@ -1,19 +1,19 @@
 [% IF ( PAGE_NUMBERS ) %]<nav><ul class="pagination">
- [% IF hits_to_paginate < total %]<h6>[% hits_to_paginate %] of [% total %] results loaded, refine your search to view other records</h6>[% END %]
+ [% IF hits_to_paginate < total %]<h6>[% hits_to_paginate | html %] of [% total | html %] results loaded, refine your search to view other records</h6>[% END %]
     [% IF ( previous_page_offset.defined ) %]
-        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">First</a></li>
+        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi | html %][% limit_cgi | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">First</a></li>
         <!-- Row of numbers corresponding to search result pages -->
-        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">&lt;&lt; Previous</a></li>
+        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;offset=[% previous_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">&lt;&lt; Previous</a></li>
     [% END %]
     [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %]
         [% IF ( PAGE_NUMBER.highlight ) %]
-            <li class="active"><span>[% PAGE_NUMBER.pg %]</span></li>
+            <li class="active"><span>[% PAGE_NUMBER.pg | html %]</span></li>
         [% ELSE %]
-            <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">[% PAGE_NUMBER.pg %]</a></li>
+            <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">[% PAGE_NUMBER.pg | html %]</a></li>
         [% END %]
     [% END %]
     [% IF ( next_page_offset ) %]
-        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Next &gt;&gt;</a></li>
-        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% last_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Last</a></li>
+        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Next &gt;&gt;</a></li>
+        <li><a class="nav" href="/cgi-bin/koha/catalogue/search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% last_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Last</a></li>
     [% END %]
 </ul></nav>[% END %]
index 346929e..3493921 100644 (file)
@@ -3,13 +3,13 @@
 <script type="text/javascript">
     var pwd_title = "";
     var pattern_title = "";
-    var new_password_node_name = "[% new_password %]";
+    var new_password_node_name = "[% new_password | html %]";
     [% IF Koha.Preference('RequireStrongPassword') %]
-        pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength %]);
-        pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength %],}/;
+        pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength | html %]);
+        pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength | html %],}/;
     [% ELSIF minPasswordLength %]
-        pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength %]);
-        pattern_regex = /.{[% minPasswordLength %],}/;
+        pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength | html %]);
+        pattern_regex = /.{[% minPasswordLength | html %],}/;
     [% END %]
     jQuery.validator.addMethod("password_strong", function(value, element){
         return this.optional(element) || value == '****' || pattern_regex.test(value);
index 0f7dda5..dca996e 100644 (file)
             [% FOREACH ar IN patron.article_requests_current %]
                 <tr>
                     <td class="article-request-record-title">
-                        <a class="article-request-title" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% ar.biblionumber %]">
-                            [% ar.biblio.title %]
-                            [% ar.item.enumchron %]
+                        <a class="article-request-title" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% ar.biblionumber | html %]">
+                            [% ar.biblio.title | html %]
+                            [% ar.item.enumchron | html %]
                         </a>
-                        [% ar.biblio.author %]
-                        [% IF ar.itemnumber %] <i>(only [% ar.item.barcode %])</i>[% END %]
+                        [% ar.biblio.author | html %]
+                        [% IF ar.itemnumber %] <i>(only [% ar.item.barcode | html %])</i>[% END %]
                     </td>
 
                     <td class="article-request-created_on">
                     </td>
 
                     <td class="article-request-title">
-                        [% ar.title %]
+                        [% ar.title | html %]
                     </td>
 
                     <td class="article-request-author">
-                        [% ar.author %]
+                        [% ar.author | html %]
                     </td>
 
                     <td class="article-request-volume">
-                        [% ar.volume %]
+                        [% ar.volume | html %]
                     </td>
 
                     <td class="article-request-issue">
-                        [% ar.issue %]
+                        [% ar.issue | html %]
                     </td>
 
                     <td class="article-request-date">
-                        [% ar.date %]
+                        [% ar.date | html %]
                     </td>
 
                     <td class="article-request-pages">
-                        [% ar.pages %]
+                        [% ar.pages | html %]
                     </td>
 
                     <td class="article-request-chapters">
-                        [% ar.chapters %]
+                        [% ar.chapters | html %]
                     </td>
 
                     <td class="article-request-patron-notes">
-                        [% ar.patron_notes %]
+                        [% ar.patron_notes | html %]
                     </td>
 
                     <td class="article-request-status">
@@ -79,7 +79,7 @@
                     </td>
 
                     <td class="article-request-branchcode">
-                        [% ar.branch.branchname %]
+                        [% ar.branch.branchname | html %]
                     </td>
                 </tr>
             [% END %]
index cb13280..a705093 100644 (file)
@@ -7,15 +7,15 @@
                 <input autocomplete="off" id="findborrower" name="findborrower" size="40" class="head-searchbox focus" type="text" />
                 <input id="autocsubmit" type="submit" class="submit" value="Submit" />
             [% IF ( stickyduedate ) %]
-                <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
-                <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
+                <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
+                <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
             [% END %]
         </div>
        [% ELSE %]
             <input id="findborrower" name="findborrower" size="40" class="head-searchbox focus" type="text" />
             [% IF ( stickyduedate ) %]
-            <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
-            <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
+            <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
+            <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
             [% END %]
             <input value="Submit" class="submit" type="submit" />
        [% END %]
index 71dfeee..72405d8 100644 (file)
@@ -2,12 +2,12 @@
 [% USE Branches %]
 [% USE Categories %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Patrons Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Patrons Resident Search Box -->
 <div id="header_search">
     <div id="patron_search" class="residentsearch">
     <p class="tip">Enter patron card number or partial name:</p>
     <form action="/cgi-bin/koha/members/member.pl" method="post">
-    <input id="searchmember" data-toggle="tooltip" size="25" class="head-searchbox focus" name="searchmember" type="text" value="[% searchmember %]"/>
+    <input id="searchmember" data-toggle="tooltip" size="25" class="head-searchbox focus" name="searchmember" type="text" value="[% searchmember | html %]"/>
     <input type="hidden" name="quicksearch" value="1" />
     <span class="filteraction" id="filteraction_off"> <a href="#">[-]</a></span>
     <span class="filteraction" id="filteraction_on"> <a href="#">[+]</a></span>
@@ -92,9 +92,9 @@
                 [% END %]
                 [% FOREACH b IN branches %]
                     [% IF b.selected %]
-                        <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                        <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                     [% ELSE %]
-                        <option value="[% b.branchcode %]">[% b.branchname |html %]</option>
+                        <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                     [% END %]
                 [% END %]
             </select>
                 <option value="">Any</option>
                 [% FOREACH category IN categories %]
                     [% IF category.categorycode == categorycode_filter %]
-                        <option value="[% category.categorycode %]" selected="selected">[% category.description |html %]</option>
+                        <option value="[% category.categorycode | html %]" selected="selected">[% category.description | html %]</option>
                     [% ELSE %]
-                        <option value="[% category.categorycode %]">[% category.description |html %]</option>
+                        <option value="[% category.categorycode | html %]">[% category.description | html %]</option>
                     [% END %]
                 [% END %]
             </select>
index 1aa4a64..f78dfe8 100644 (file)
 [%# Parameter no_html - if 1, the html tags are NOT generated %]
 [%- IF data.title %]
     [%- IF no_html %]
-        [%- span_start = '' %]
-        [%- span_end   = '' %]
+        [%- span_start = '' | html %]
+        [%- span_end   = '' | html %]
     [%- ELSE %]
         [%- span_start = '<span class="patron-title">' %]
-        [%- span_end   = '</span>' %]
+        [%- span_end   = '</span>' | html %]
     [%- END %]
     [%- SET data.title = span_start _ data.title _ span_end _ ' ' -%]
 [%- END -%]
     [%- END -%]
 [%- END -%]
 [%- IF hide_patron_infos_if_needed AND ( display_patron_name OR display_cardnumber ) -%]
-    [%- IF link_to == 'circulation_reserves' %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% data.borrowernumber %]#reserves">
-    [%- ELSE %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber %]">
+    [%- IF link_to == 'circulation_reserves' %]<a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% data.borrowernumber | html %]#reserves">
+    [%- ELSE %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]">
     [%- END -%]
 [%- END -%]
 [%- IF display_patron_name -%]
     [%- IF data.category_type == 'I' -%]
         [%- data.surname | html %] [% IF data.othernames %] ([% data.othernames | html %])[% END -%]
     [%- ELSIF invert_name -%]
-        [% data.title%][%- data.surname | html %], [% data.firstname | html %] [% IF data.othernames %] ([% data.othernames | html %]) [% END -%]
+        [% data.title | html %][%- data.surname | html %], [% data.firstname | html %] [% IF data.othernames %] ([% data.othernames | html %]) [% END -%]
     [%- ELSE -%]
-        [% data.title %][%- data.firstname | html %] [% IF data.othernames %] ([% data.othernames | html %]) [% END %] [% data.surname | html -%]
+        [% data.title | html %][%- data.firstname | html %] [% IF data.othernames %] ([% data.othernames | html %]) [% END %] [% data.surname | html -%]
     [%- END -%]
     [%- IF display_cardnumber AND data.cardnumber %] ([% data.cardnumber | html %])[% END -%]
 [%- ELSIF display_cardnumber -%]
@@ -67,7 +67,7 @@
         [%- data.cardnumber | html -%]
     [%- END -%]
 [%- ELSE -%]
-    A patron from library [% Branches.GetName( patron.branchcode ) -%]
+    A patron from library [% Branches.GetName( patron.branchcode ) | html -%]
 [%- END -%]
 
 [%- IF hide_patron_infos_if_needed AND ( display_patron_name OR display_cardnumber ) -%]
index 147ff11..e0bc706 100644 (file)
@@ -8,14 +8,14 @@
     <div class="btn-group" id="new-patron-button">
         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> New patron <span class="caret"></span></button>
             <ul class="dropdown-menu">
-                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode %]">[% category.description |html %]</a></li>[% END %]
+                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode | html %]">[% category.description | html %]</a></li>[% END %]
             </ul>
     </div>
     [% IF Koha.Preference('PatronQuickAddFields') || Koha.Preference('BorrowerMandatoryField') %]
     <div class="btn-group" id="quick-add-new-patron-button">
         <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-plus"></i> Quick add new patron <span class="caret"></span></button>
             <ul class="dropdown-menu">
-                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode %]&amp;quickadd=true">[% category.description |html %]</a></li>[% END %]
+                [% FOREACH category IN categories %]<li><a href="/cgi-bin/koha/members/memberentry.pl?op=add&amp;categorycode=[% category.categorycode | html %]&amp;quickadd=true">[% category.description | html %]</a></li>[% END %]
             </ul>
     </div>
     [% END %]
index f220fe8..84e4adc 100644 (file)
     <strong>WARNING:</strong>
         [% IF CGI.param('pdferr') %]<span>Error while creating PDF file. </span>
             [% IF CGI.param('errnocards') %]<span>No cards created (empty batch or list?) </span>[% END %]
-            [% IF CGI.param('errba') %][% INCLUDE b_batch %]<span class="ex">[%- CGI.param('errba') -%]</span>[% END %]
-            [% IF CGI.param('errpl') %][% INCLUDE b_patronlist %]<span class="ex">[%- CGI.param('errpl') -%]</span>][% END %]
-            [% IF CGI.param('errpt') %][% INCLUDE b_patronnumber %]<span class="ex">[%- CGI.param('errpt') -%]</span>[% END %]
-            [% IF CGI.param('errlo') %][% INCLUDE b_layout %]<span class="ex">[%- CGI.param('errlo') -%]</span>[% END %]
-            [% IF CGI.param('errtpl') %][% INCLUDE b_template %]<span class="ex">[%- CGI.param('errtpl') -%]</span>[% END %]
+            [% IF CGI.param('errba') %][% INCLUDE b_batch %]<span class="ex">[%- CGI.param('errba') | html -%]</span>[% END %]
+            [% IF CGI.param('errpl') %][% INCLUDE b_patronlist %]<span class="ex">[%- CGI.param('errpl') | html -%]</span>][% END %]
+            [% IF CGI.param('errpt') %][% INCLUDE b_patronnumber %]<span class="ex">[%- CGI.param('errpt') | html -%]</span>[% END %]
+            [% IF CGI.param('errlo') %][% INCLUDE b_layout %]<span class="ex">[%- CGI.param('errlo') | html -%]</span>[% END %]
+            [% IF CGI.param('errtpl') %][% INCLUDE b_template %]<span class="ex">[%- CGI.param('errtpl') | html -%]</span>[% END %]
             [% INCLUDE asksysadmin %]
         [% END %]
 
         [% IF ( error == 101 ) %]
-           [% IF ( card_element ) %]<span>The database returned an error while saving [% card_element %] [% element_id %]. </span>
+           [% IF ( card_element ) %]<span>The database returned an error while saving [% card_element | html %] [% element_id | html %]. </span>
           [% ELSE %]<span>The database returned an error while attempting a save operation. </span>[% END %][% INCLUDE asksysadmin %]
         [% ELSIF ( error == 102 ) %]
-            [% IF ( card_element ) %]<span>The database returned an error while deleting [% card_element %] [% element_id %]. </span>
-            [% ELSIF ( image_ids ) %]<span>The database returned an error while deleting [% image_ids %]. </span>
+            [% IF ( card_element ) %]<span>The database returned an error while deleting [% card_element | html %] [% element_id | html %]. </span>
+            [% ELSIF ( image_ids ) %]<span>The database returned an error while deleting [% image_ids | html %]. </span>
             [% ELSE %]<span>The database returned an error while attempting a delete operation. </span>[% END %][% INCLUDE asksysadmin %]
         [% ELSIF ( error == 201 ) %]
-            [%IF ( element_id ) %]<span>An unsupported operation was attempted on [% card_element %] [% element_id %]. </span>
+            [%IF ( element_id ) %]<span>An unsupported operation was attempted on [% card_element | html %] [% element_id | html %]. </span>
             [% ELSE %]<span>An unsupported operation was attempted. </span>[% END %][% INCLUDE asksysadmin %]
         [% ELSIF ( error == 202 ) %]
             <span>An error has occurred. </span>[% INCLUDE asksysadmin %]
         [% ELSIF ( error == 302 ) %]
             <span>Image exceeds 500KB. Please resize and import again. </span>
         [% ELSIF ( error == 303 ) %]
-            <span>The database image quota currently only allows a maximum of [% image_limit %] images to be stored at any one time. Please delete one or more images to free up quota space. </span>
+            <span>The database image quota currently only allows a maximum of [% image_limit | html %] images to be stored at any one time. Please delete one or more images to free up quota space. </span>
         [% ELSIF ( error == 304 ) %]
-            <span>An image with the name '[% IMAGE_NAME %]' already exists.</span>
+            <span>An image with the name '[% IMAGE_NAME | html %]' already exists.</span>
         [% ELSIF ( error == 401 ) %]
-            <span>An error has occurred and no items have been added to batch [% batch_id %]. </span>[% INCLUDE asksysadmin %]
+            <span>An error has occurred and no items have been added to batch [% batch_id | html %]. </span>[% INCLUDE asksysadmin %]
         [% ELSIF ( error == 402 ) %]
             <span>No items added because the library is not set. Please set your library before adding items to a batch. </span><a href="/cgi-bin/koha/circ/selectbranchprinter.pl">Set library</a>
         [% ELSIF ( error == 403 ) %]
-            <span>An error has occurred and the item(s) was not removed from batch [% batch_id %]. </span>[% INCLUDE asksysadmin %]
+            <span>An error has occurred and the item(s) was not removed from batch [% batch_id | html %]. </span>[% INCLUDE asksysadmin %]
         [% ELSIF ( error == 404 ) %]
-            <span>An error has occurred and batch [% batch_id %] was not deleted. </span>[% INCLUDE asksysadmin %]
+            <span>An error has occurred and batch [% batch_id | html %] was not deleted. </span>[% INCLUDE asksysadmin %]
         [% ELSIF ( error == 405 ) %]
-            <span>An error has occurred and batch [% batch_id %] was not fully de-duplicated. </span>
+            <span>An error has occurred and batch [% batch_id | html %] was not fully de-duplicated. </span>
         [% END %]
   </p>
 </div>
index d1e77a6..a77b92c 100644 (file)
@@ -1,11 +1,11 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Patrons Admin Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Patrons Admin Resident Search Box -->
 <div id="header_search">
        <div id="patron_category_search" class="residentsearch">
     <p class="tip">Search by patron category name:</p>
-       <form action="[% script_name %]" method="post">
-        <input class="head-searchbox" type="text" name="description" size="40" value="[% searchfield %]" />
+       <form action="[% script_name | html %]" method="post">
+        <input class="head-searchbox" type="text" name="description" size="40" value="[% searchfield | html %]" />
                <input type="submit" class="submit" name="search" value="Search" />
        </form> 
        </div>
index 78496c6..7fd95b9 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
     [% IF ( footerjs ) %]
         [% INCLUDE js_includes.inc popup=1 %]
-        [% jsinclude # Parse the page template's JavaScript block if necessary %]
+        [% jsinclude.raw # Parse the page template's JavaScript block if necessary %]
     [% END %]
 </body>
 </html>
index 4170576..8d4aeba 100644 (file)
@@ -1,11 +1,11 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1>
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1>
 <div id="header_search">
        <div id="syspref_search" class="residentsearch">
        <p class="tip">System preference search:</p>
            <form action="/cgi-bin/koha/admin/preferences.pl">
-        <input type="hidden" name="tab" value="[% last_tab %]" />
+        <input type="hidden" name="tab" value="[% last_tab | html %]" />
         <input type="hidden" name="op" value="search" />
         <input class="head-searchbox" type="text" size="40" name="searchfield" value="">
         <input type="submit" class="submit" value="Search" />
index 4d89ed5..4f98175 100644 (file)
@@ -14,7 +14,7 @@
         [% IF ( CAN_user_reports_create_reports ) %]
             [% UNLESS ( editsql ) # Do not show edit button on edit page %]
                 <div class="btn-group">
-                    <a id="editreport" class="btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id %]&amp;phase=Edit%20SQL">
+                    <a id="editreport" class="btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id | html %]&amp;phase=Edit%20SQL">
                         <i class="fa fa-pencil"></i> Edit
                     </a>
                 </div>
@@ -28,7 +28,7 @@
 
         [% IF ( CAN_user_reports_delete_reports ) %]
             <div class="btn-group">
-                <a class="delete btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id %]&phase=Delete%20Saved">
+                <a class="delete btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id | html %]&phase=Delete%20Saved">
                     <i class="fa fa-trash"></i> Delete
                 </a>
             </div>
 
         [% UNLESS ( errors ) # Unless there are errors saving a report %]
             <div class="btn-group">
-                <a id="runreport" class="btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id %]&amp;phase=Run%20this%20report">
+                <a id="runreport" class="btn btn-default btn-sm" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% id | html %]&amp;phase=Run%20this%20report">
                     <i class="fa fa-play"></i> Run report
                 </a>
             </div>
             <div class="btn-group">
-                <a class="btn btn-default btn-sm" href="/cgi-bin/koha/tools/scheduler.pl?id=[% id %]">
+                <a class="btn btn-default btn-sm" href="/cgi-bin/koha/tools/scheduler.pl?id=[% id | html %]">
                     <i class="fa fa-clock-o"></i> Schedule
                 </a>
             </div>
@@ -57,9 +57,9 @@
             <div class="btn-group">
                 <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" id="format"><i class="fa fa-upload"></i> Download <span class="caret"></span></button>
                 <ul class="dropdown-menu">
-                    <li><a id="csv" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=csv&amp;report_id=[% id %]&amp;reportname=[% name |uri %][% PROCESS params %]">[% PROCESS 'delimiter_text.inc' %]</a></li>
-                    <li><a id="tab" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=tab&amp;report_id=[% id %]&amp;reportname=[% name |uri %][% PROCESS params %]">Tab separated text</a></li>
-                    <li><a id="ods" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=ods&amp;report_id=[% id %]&amp;reportname=[% name |uri %][% PROCESS params %]">Open Document Spreadsheet</a></li>
+                    <li><a id="csv" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=csv&amp;report_id=[% id | html %]&amp;reportname=[% name |uri %][% PROCESS params %]">[% PROCESS 'delimiter_text.inc' %]</a></li>
+                    <li><a id="tab" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=tab&amp;report_id=[% id | html %]&amp;reportname=[% name |uri %][% PROCESS params %]">Tab separated text</a></li>
+                    <li><a id="ods" href="/cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Export&amp;format=ods&amp;report_id=[% id | html %]&amp;reportname=[% name |uri %][% PROCESS params %]">Open Document Spreadsheet</a></li>
                 </ul>
             </div>
             <div class="btn-group">
index cfcc609..804fcfa 100644 (file)
@@ -6,13 +6,13 @@
 
     [% IF ( colId ) %]
         <div class="btn-group">
-            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/transferCollection.pl?colId=[% colId %]"><i class="fa fa-exchange"></i> Transfer</a>
+            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/transferCollection.pl?colId=[% colId | html %]"><i class="fa fa-exchange"></i> Transfer</a>
         </div>
         <div class="btn-group">
-            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=edit&amp;colId=[% colId %]"><i class="fa fa-pencil"></i> Edit</a>
+            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=edit&amp;colId=[% colId | html %]"><i class="fa fa-pencil"></i> Edit</a>
         </div>
         <div class="btn-group">
-            <a class="btn btn-default btn-sm confirmdelete" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=delete&amp;colId=[% colId %]"><i class="fa fa-trash"></i> Delete</a>
+            <a class="btn btn-default btn-sm confirmdelete" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=delete&amp;colId=[% colId | html %]"><i class="fa fa-trash"></i> Delete</a>
         </div>
     [% END %]
 </div>
index 8817860..13db6fb 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
-<script src="[% interface %]/lib/select2/js/select2.min.js"></script>
-[% Asset.css("lib/select2/css/select2.min.css") %]
-[% Asset.css("css/select2.css") %]
+<script src="[% interface | html %]/lib/select2/js/select2.min.js"></script>
+[% Asset.css("lib/select2/css/select2.min.css") | $raw %]
+[% Asset.css("css/select2.css") | $raw %]
 <script>
   jQuery.extend($.fn.select2.defaults, {
     allowClear: true,
index 21dff3a..af7989d 100644 (file)
@@ -1,12 +1,12 @@
 [% IF ( subscriptionid ) %]
 <ul>
-<li><a href="serials-collection.pl?subscriptionid=[% subscriptionid %]">Serial collection</a></li>
+<li><a href="serials-collection.pl?subscriptionid=[% subscriptionid | html %]">Serial collection</a></li>
   [% UNLESS closed %]
     [% IF ( routing && CAN_user_serials_routing ) %]
         [% IF ( hasRouting ) %]
-             <li><a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid %]">Edit routing list</a></li>
+             <li><a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid | html %]">Edit routing list</a></li>
         [% ELSE %]
-            <li><a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid %]&amp;op=new">Create routing list</a></li>
+            <li><a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid | html %]&amp;op=new">Create routing list</a></li>
         [% END %]
     [% END %]
   [% END %]
index cb78faf..977c837 100644 (file)
@@ -1,12 +1,12 @@
 [% USE Koha %]
 <div class="gradient">
-  <h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Serials Resident Search Box -->
+  <h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Serials Resident Search Box -->
   <div id="header_search">
     <div id="subscription_search" class="residentsearch">
     <p class="tip">Search subscriptions:</p>
     <form action="/cgi-bin/koha/serials/serials-search.pl" method="get">
       [% IF ( routing ) %]
-        <input type="hidden" name="routing" value="[% routing %]" />
+        <input type="hidden" name="routing" value="[% routing | html %]" />
       [% END %]
       <input type="hidden" name="searched" value="1" />
       <label for="ISSN_filter">ISSN:</label> <input type="text" size="10" maxlength="11" name="ISSN_filter" id="ISSN_filter" value="[% ISSN_filter | html %]" />
index 0c91099..55d3722 100644 (file)
@@ -3,7 +3,7 @@
     <div id="toolbar" class="btn-toolbar">
         [% IF CAN_user_serials_create_subscription %]
             [% IF biblionumber_for_new_subscription %]
-                <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription %]"><i class="fa fa-plus"></i> New subscription</a></div>
+                <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription | html %]"><i class="fa fa-plus"></i> New subscription</a></div>
             [% ELSE %]
                 <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl"><i class="fa fa-plus"></i> New subscription</a></div>
             [% END %]
                         <ul class="dropdown-menu">
                             [% IF ( cannotedit ) %] <li class="disabled"> [% ELSE %]
                             <li> [% END %]
-                            <a href="/cgi-bin/koha/serials/subscription-add.pl?op=modify&amp;subscriptionid=[% subscriptionid %]">Edit subscription</a></li>
+                            <a href="/cgi-bin/koha/serials/subscription-add.pl?op=modify&amp;subscriptionid=[% subscriptionid | html %]">Edit subscription</a></li>
                             [% IF ( cannotedit ) %] <li class="disabled"> [% ELSE %]
                             <li> [% END %]
-                            <a href="/cgi-bin/koha/serials/subscription-add.pl?op=dup&amp;subscriptionid=[% subscriptionid %]">Edit as new (duplicate)</a></li>
+                            <a href="/cgi-bin/koha/serials/subscription-add.pl?op=dup&amp;subscriptionid=[% subscriptionid | html %]">Edit as new (duplicate)</a></li>
 
                             [% IF CAN_user_editcatalogue_edit_catalogue %]
-                                <li><a id="editbiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">Edit record</a></li>
+                                <li><a id="editbiblio" href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber | html %]">Edit record</a></li>
                             [% END %]
 
                             [% IF serialsadditems && CAN_user_editcatalogue_edit_items %]
-                                <li><a id="edititems" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]">Edit items</a></li>
+                                <li><a id="edititems" href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber | html %]">Edit items</a></li>
                             [% END %]
 
                             [% IF ( CAN_user_serials_delete_subscription ) %]
@@ -43,7 +43,7 @@
                 <div class="btn-group"><a id="renew" class="btn btn-default btn-sm" href="#"><i class="fa fa-refresh"></i> Renew</a></div>
             [% END %]
             [% IF CAN_user_serials_receive_serials and not closed %]
-                <div class="btn-group"><a id="receive" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/serials-edit.pl?subscriptionid=[% subscriptionid %]&amp;serstatus=1,3"><i class="fa fa-inbox"></i> Receive</a></div>
+                <div class="btn-group"><a id="receive" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/serials-edit.pl?subscriptionid=[% subscriptionid | html %]&amp;serstatus=1,3"><i class="fa fa-inbox"></i> Receive</a></div>
             [% END %]
             [% UNLESS cannotedit %]
                 [% IF closed %]
@@ -57,7 +57,7 @@
 [% ELSIF CAN_user_serials_create_subscription %]
     <div id="toolbar" class="btn-toolbar">
         [% IF ( biblionumber_for_new_subscription ) %]
-            <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription %]"><i class="fa fa-plus"></i> New subscription</a></div>
+            <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl?biblionumber_for_new_subscription=[% biblionumber_for_new_subscription | html %]"><i class="fa fa-plus"></i> New subscription</a></div>
         [% ELSE %]
             <div class="btn-group"><a id="newsubscription" class="btn btn-default btn-sm" href="/cgi-bin/koha/serials/subscription-add.pl"><i class="fa fa-plus"></i> New subscription</a></div>
         [% END %]
index 689375b..be7908e 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 <script type="text/javascript">
 [% IF ( Koha.Preference('IntranetSlipPrinterJS') ) %]
-    [% Koha.Preference('IntranetSlipPrinterJS') %]
+    [% Koha.Preference('IntranetSlipPrinterJS') | $raw %]
 [% ELSE %]
     $( window ).load(function() {
         window.print();
index bd86309..cd92d68 100644 (file)
@@ -3,22 +3,22 @@
 [% USE Categories %]
 
 <script type="text/javascript">
-    var advsearch = "[% advsearch %]";
-    var destination = "[% destination %]";
+    var advsearch = "[% advsearch | html %]";
+    var destination = "[% destination | html %]";
 
-    var CAN_user_borrowers_edit_borrowers = "[% CAN_user_borrowers_edit_borrowers %]";
+    var CAN_user_borrowers_edit_borrowers = "[% CAN_user_borrowers_edit_borrowers | html %]";
 
-    var dateformat = "[% Koha.Preference('dateformat') %]";
-    var NorwegianPatronDBEnable = "[% Koha.Preference('NorwegianPatronDBEnable') %]";
+    var dateformat = "[% Koha.Preference('dateformat') | html %]";
+    var NorwegianPatronDBEnable = "[% Koha.Preference('NorwegianPatronDBEnable') | html %]";
 
     var borrowernumber;
     var number_of_adult_categories = 0;
     [% IF patron %]
-        borrowernumber = "[% patron.borrowernumber %]";
+        borrowernumber = "[% patron.borrowernumber | html %]";
         [% IF patron.is_child %]
             [% SET adult_categories = Categories.scalar.all(category_type => 'A') %]
             [% SET number_of_adult_categories = adult_categories.count %]
-            number_of_adult_categories = [% number_of_adult_categories %]
+            number_of_adult_categories = [% number_of_adult_categories | html %]
         [% END %]
     [% END %]
 </script>
index 42a231e..6f2da8e 100644 (file)
@@ -1,14 +1,14 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin Suggestions Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin Suggestions Resident Search Box -->
 <div id="header_search">
        <div id="suggestions_search" class="residentsearch">
     <p class="tip">Suggestions search:</p>
        <form action="/cgi-bin/koha/acqui/newordersuggestion.pl" method="get">
-    <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-       <label for="searchtitle">Title:</label> <input type="text" id="searchtitle" name="title" size="10" value="[% title %]" />
-    <label for="searchauthor">Author:</label> <input type="text" id="searchauthor" name="author" size="10" value="[% author %]" />
-    <label for="searchpublishercode">Publisher:</label> <input type="text" id="searchpublishercode" name="publishercode" size="10" value="[% publishercode %]" />
+    <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+       <label for="searchtitle">Title:</label> <input type="text" id="searchtitle" name="title" size="10" value="[% title | html %]" />
+    <label for="searchauthor">Author:</label> <input type="text" id="searchauthor" name="author" size="10" value="[% author | html %]" />
+    <label for="searchpublishercode">Publisher:</label> <input type="text" id="searchpublishercode" name="publishercode" size="10" value="[% publishercode | html %]" />
     <input type="submit" class="submit" value="Search" />
         </form>
        </div>
index 106221e..e5a5214 100644 (file)
@@ -1,14 +1,14 @@
 [% IF ( booksellerid ) %]
 <div id="menu">
     <ul>
-        [% IF ( CAN_user_acquisition_order_manage ) %]<li><a href="/cgi-bin/koha/acqui/booksellers.pl?booksellerid=[% booksellerid %]">Baskets</a></li>[% END %]
-        [% IF ( CAN_user_acquisition_group_manage ) %]<li><a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid %]">Basket groups</a></li>[% END %]
-        [% IF ( CAN_user_acquisition_contracts_manage ) %]<li><a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]">Contracts</a></li>[% END %]
-        <li><a href="/cgi-bin/koha/acqui/invoices.pl?supplierid=[% booksellerid %]&amp;op=do_search">Invoices</a></li>
+        [% IF ( CAN_user_acquisition_order_manage ) %]<li><a href="/cgi-bin/koha/acqui/booksellers.pl?booksellerid=[% booksellerid | html %]">Baskets</a></li>[% END %]
+        [% IF ( CAN_user_acquisition_group_manage ) %]<li><a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid | html %]">Basket groups</a></li>[% END %]
+        [% IF ( CAN_user_acquisition_contracts_manage ) %]<li><a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]">Contracts</a></li>[% END %]
+        <li><a href="/cgi-bin/koha/acqui/invoices.pl?supplierid=[% booksellerid | html %]&amp;op=do_search">Invoices</a></li>
         [% IF ( CAN_user_acquisition_order_manage ) %][% IF ( basketno ) %]
-        <li><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;owner=1">Uncertain prices</a></li>
+        <li><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;owner=1">Uncertain prices</a></li>
         [% ELSE %]
-        <li><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid %]&amp;owner=1">Uncertain prices</a></li>
+        <li><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid | html %]&amp;owner=1">Uncertain prices</a></li>
         [% END %] [% END %]
     </ul>
 </div>
index dacd451..8d2df29 100644 (file)
@@ -1,15 +1,15 @@
 [% INCLUDE 'blocking_errors.inc' %]
 
 <div id="toolbar" class="btn-toolbar">
-    <div class="btn-group"><a id="newshelf" class="btn btn-default btn-sm" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=add_form&amp;referer=[% op %]"><i class="fa fa-plus"></i> New list</a></div>
+    <div class="btn-group"><a id="newshelf" class="btn btn-default btn-sm" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=add_form&amp;referer=[% op | html %]"><i class="fa fa-plus"></i> New list</a></div>
 
     [% IF shelf AND op == 'view' %]
         [% IF can_manage_shelf %]
         <div class="btn-group">
             <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-pencil"></i> Edit <span class="caret"></span></button>
             <ul class="dropdown-menu">
-                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=edit_form&amp;shelfnumber=[% shelf.shelfnumber %]&amp;referer=[% op %]">Edit list</a></li>
-                <li><a id="deleteshelf" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=delete&amp;shelfnumber=[% shelf.shelfnumber %]">Delete list</a></li>
+                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=edit_form&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;referer=[% op | html %]">Edit list</a></li>
+                <li><a id="deleteshelf" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=delete&amp;shelfnumber=[% shelf.shelfnumber | html %]">Delete list</a></li>
             </ul>
         </div>
         [% END %]
         <div class="btn-group">
             <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-download"></i> Download list <span class="caret"></span></button>
                 <ul class="dropdown-menu">
-                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=iso2709&amp;shelfid=[% shelf.shelfnumber %]">iso2709</a></li>
-                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=ris&amp;shelfid=[% shelf.shelfnumber %]">RIS</a></li>
-                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=bibtex&amp;shelfid=[% shelf.shelfnumber %]">BibTex</a></li>
+                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=iso2709&amp;shelfid=[% shelf.shelfnumber | html %]">iso2709</a></li>
+                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=ris&amp;shelfid=[% shelf.shelfnumber | html %]">RIS</a></li>
+                    <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=bibtex&amp;shelfid=[% shelf.shelfnumber | html %]">BibTex</a></li>
                     [% FOREACH csv_profile IN csv_profiles %]
-                        <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=[% csv_profile.export_format_id %]&amp;shelfid=[% shelf.shelfnumber %]">CSV - [% csv_profile.profile %]</a></li>
+                        <li><a href="/cgi-bin/koha/virtualshelves/downloadshelf.pl?format=[% csv_profile.export_format_id | html %]&amp;shelfid=[% shelf.shelfnumber | html %]">CSV - [% csv_profile.profile | html %]</a></li>
                     [% END %]
                 </ul>
         </div>
         <div class="btn-group"><a class="btn btn-default btn-sm" href="#" id="sendlist"><i class="fa fa-envelope"></i> Send list</a></div>
-        <div class="btn-group"><a class="btn btn-default btn-sm" id="printlist" target="_blank" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]&amp;print=1"><i class="fa fa-print"></i> Print list</a></div>
+        <div class="btn-group"><a class="btn btn-default btn-sm" id="printlist" target="_blank" href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;print=1"><i class="fa fa-print"></i> Print list</a></div>
     [% END %]
 </div>
index 886db7e..8f5d2d7 100644 (file)
@@ -1,13 +1,13 @@
 <form><table><caption>Merge</caption>
 [% FOREACH field IN fields %]
 <tr>
-<td>[% field.from %]</td>
-<td>[% field.tag %] <input type="checkbox" name="selected_field" value="[% field.id %]">
+<td>[% field.from | html %]</td>
+<td>[% field.tag | html %] <input type="checkbox" name="selected_field" value="[% field.id | html %]">
 </td>
 <td><dl>
 [% FOREACH subfield IN field.subfields %]
-    <dt>[% subfield.key %]</dt>
-    <dd>[% subfield.value %]</dd>
+    <dt>[% subfield.key | html %]</dt>
+    <dd>[% subfield.value | html %]</dd>
 [% END %]
 </dl>
 </td>
index 5dcd1cc..066502b 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Asset %]
 [% #Enable tinymce for system preferences %]
-[% Asset.js("lib/tiny_mce/tiny_mce.js") %]
+[% Asset.js("lib/tiny_mce/tiny_mce.js") | $raw %]
 <script>
 
 [%# Save TinyMCE content and trigger an event on the original element %]
@@ -10,7 +11,7 @@ function wysiwyg_change (ed){
     $(original_textarea).trigger("input");
 }
 
-tinyMCE.baseURL = "[% interface %]/lib/tiny_mce";
+tinyMCE.baseURL = "[% interface | html %]/lib/tiny_mce";
 tinyMCE.init({
     setup : function(ed) {
         ed.onInit.add(function(editor){
@@ -44,7 +45,7 @@ tinyMCE.init({
     mode : "specific_textareas",
     editor_selector : "mce",
     theme : "advanced",
-    content_css : "[% interface %]/[% theme %]/css/tinymce.css",
+    content_css : "[% interface | html %]/[% theme | html %]/css/tinymce.css",
     plugins : "table,save,advhr,advlink,contextmenu,advimage",
     theme_advanced_buttons1 : "bold,italic,|,cut,copy,paste,|,justifyleft,justifycenter,justifyright,justifyfull,|,formatselect,|,image,link,unlink,anchor,cleanup,help,code,advhr,",
     theme_advanced_buttons2 : "tablecontrols,|,bullist,numlist,|,outdent,indent,|,undo,redo,|,removeformat,|,visualaid,|,sub,sup,|,charmap|,forecolor,backcolor",
index 6723a23..389d3bd 100644 (file)
@@ -1,11 +1,11 @@
 [% USE Koha %]
 <div class="gradient">
-<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName %]</a></h1><!-- Begin z3950 Admin Resident Search Box -->
+<h1 id="logo"><a href="/cgi-bin/koha/mainpage.pl">[% LibraryName | html %]</a></h1><!-- Begin z3950 Admin Resident Search Box -->
 <div id="header_search">
     <div id="z3950_search" class="residentsearch">
     <p class="tip">Z39.50/SRU server search:</p>
        <form action="/cgi-bin/koha/admin/z3950servers.pl" method="post">
-                <input class="head-searchbox" type="text" name="searchfield" size="40" value="[% searchfield %]" />
+                <input class="head-searchbox" type="text" name="searchfield" size="40" value="[% searchfield | html %]" />
                 <input type="submit" class="submit" name="search" value="Search" />
         </form>
        </div>
index 86ed0d0..703b760 100644 (file)
@@ -4,8 +4,8 @@
     var MSG_CHOOSE_Z3950 = _("Please choose at least one external target");
 
 [% IF ( total_pages ) %]
-    var interface = "[% interface %]";
-    var theme = "[% theme %]";
+    var interface = "[% interface | html %]";
+    var theme = "[% theme | html %]";
     var MSG_LOADING = _("Loading");
 
 function validate_goto_page(){
@@ -14,8 +14,8 @@ function validate_goto_page(){
         alert(_("The page entered is not a number."));
         return false;
     }
-    else if(page < 1 || page > [% total_pages %] ) {
-        alert(_("The page should be a number between 1 and %s.").format([% total_pages %]));
+    else if(page < 1 || page > [% total_pages | html %] ) {
+        alert(_("The page should be a number between 1 and %s.").format([% total_pages | html %]));
         return false;
     }
     else {
index e40bb12..3497607 100644 (file)
 
         <table>
             <caption>Server information</caption>
-            <tr><th scope="row">Koha version: </th><td>[% kohaVersion |html %]</td></tr>
-            <tr><th scope="row">OS version ('uname -a'): </th><td>[% osVersion |html %]</td></tr>
-            <tr><th scope="row">Perl interpreter: </th><td>[% perlPath |html %]</td></tr>
-            <tr><th scope="row">Perl version: </th><td>[% perlVersion |html %]</td></tr>
+            <tr><th scope="row">Koha version: </th><td>[% kohaVersion | html %]</td></tr>
+            <tr><th scope="row">OS version ('uname -a'): </th><td>[% osVersion | html %]</td></tr>
+            <tr><th scope="row">Perl interpreter: </th><td>[% perlPath | html %]</td></tr>
+            <tr><th scope="row">Perl version: </th><td>[% perlVersion | html %]</td></tr>
             <tr><th scope="row">Perl @INC: </th><td>
                 [% FOREACH perlIncPat IN perlIncPath %]
-                    [% perlIncPat.perlinc |html %] <br />
+                    [% perlIncPat.perlinc | html %] <br />
                 [% END %]
             </td></tr>
-            <tr><th scope="row">MySQL version: </th><td>[% mysqlVersion |html %]</td></tr>
-            <tr><th scope="row">Apache version: </th><td>[% apacheVersion |html %]</td></tr>
+            <tr><th scope="row">MySQL version: </th><td>[% mysqlVersion | html %]</td></tr>
+            <tr><th scope="row">Apache version: </th><td>[% apacheVersion | html %]</td></tr>
           [% IF (is_psgi) %]
-            <tr><th scope="row">PSGI: </th><td>[% psgi_server |html %]</td></tr>
+            <tr><th scope="row">PSGI: </th><td>[% psgi_server | html %]</td></tr>
           [% END %]
           [% IF Koha.Preference('SearchEngine') == 'Elasticsearch' %]
             <tr>
                 <th scope="row">Elasticsearch: </th>
             [% IF elasticsearch_fatal_config_error %]
-                <td><span class="status_warn">[% elasticsearch_fatal_config_error %]</span></td>
+                <td><span class="status_warn">[% elasticsearch_fatal_config_error | html %]</span></td>
             [% ELSE %]
                 <td>
                     Nodes:
-                    <span>[% elasticsearch_status.nodes.join(' / ') %]</span>
+                    <span>[% elasticsearch_status.nodes.join(' / ') | html %]</span>
                     |
                     Status:
                 [% IF elasticsearch_status.running %]
@@ -63,7 +63,7 @@
                     |
                     Indices:
                   [% FOREACH index IN elasticsearch_status.indexes %]
-                      [% index.index_name %] (count: <emph>[% index.count %]</emph>)[% UNLESS loop.last %], [% END %]
+                      [% index.index_name | html %] (count: <emph>[% index.count | html %]</emph>)[% UNLESS loop.last %], [% END %]
                   [% END %]
                 [% ELSE %]
                     <span class="status_warn">not running</span>
                             <span class="status_warn">Nowhere</span> Note that the right place to define the memcached config is in your $KOHA_CONF file. Currently you do not have a valid memcached configuration defined.
                     [% END %]
                   [% IF effective_caching_method != 'Cache::Memcached::Fast' %]
-                    | Effective caching method: [% effective_caching_method %]
+                    | Effective caching method: [% effective_caching_method | html %]
                   [% END %]
                 </td>
             </tr>
-            <tr><th scope="row">Zebra version: </th><td>[% zebraVersion |html %]</td></tr>
+            <tr><th scope="row">Zebra version: </th><td>[% zebraVersion | html %]</td></tr>
             [% IF (errZebraConnection == 10000) %]
             <tr><th scope="row"><b>Error</b> </th><td>Zebra server seems not to be available. Is it started?</td></tr>
             [% ELSIF (errZebraConnection) %]
-            <tr><th scope="row"><b>Warning</b> </th><td>Error message from Zebra: [% ( errZebraConnection ) %] </td></tr>
+            <tr><th scope="row"><b>Warning</b> </th><td>Error message from Zebra: [% ( errZebraConnection ) | html %] </td></tr>
             [% END %]
             <tr>
               <th scope="row">Date and time: </th>
-              <td>[% current_date_and_time | $KohaDates with_hours => 1 %]</td>
+              <td>[% current_date_and_time | $KohaDates with_hours => 1 | html %]</td>
             </tr>
             <tr>
-              [% timezone_config_class = (time_zone.config_invalid) ? 'status_warn' : '' %]
-              [% timezone_env_class    = (time_zone.env_invalid)    ? 'status_warn' : '' %]
+              [% timezone_config_class = (time_zone.config_invalid) ? 'status_warn' : '' | html %]
+              [% timezone_env_class    = (time_zone.env_invalid)    ? 'status_warn' : '' | html %]
               <th scope="row">Time zone: </th>
-              <td>Used: <span>[% time_zone.actual %]</span>
+              <td>Used: <span>[% time_zone.actual | html %]</span>
                           [% IF time_zone.actual_bad_tz_fallback %]
                              <span>(This is a fallback value due to a bad configuration)</span>
                           [% END %]
                            |
                   Config: [% IF time_zone.config != '' %]
-                            <span class="[% timezone_config_class %]">[% time_zone.config %]</span>
+                            <span class="[% timezone_config_class | html %]">[% time_zone.config | html %]</span>
                           [% ELSE %]
                             <span>Undefined</span>
                           [% END %] |
                   Environment (TZ):  [% IF time_zone.environment != '' %]
-                          <span class="[% timezone_env_class %]">[% time_zone.environment %]</span>
+                          <span class="[% timezone_env_class | html %]">[% time_zone.environment | html %]</span>
                         [% ELSE %]
                           <span>Undefined</span>
                         [% END %]
                     [% END %]
                     [% END %]
                     [% IF ( ro.name ) %]
-                    [% ro.name %] <span style="font-weight:normal; font-size:smaller"> ([%ro.reqversion %])</span>
+                    [% ro.name | html %] <span style="font-weight:normal; font-size:smaller"> ([% ro.reqversion | html %])</span>
                     [% END %]
                     </th>
                     [% IF ( ro.name == '' ) %]
                     <td>
                     [% ELSIF ( ro.version ) %]
-                    <td>[% ro.version %]
+                    <td>[% ro.version | html %]
                     [% ELSE %]
                     <td style="font-weight:bold">Not Installed [% END %]</td>
                     [% END %]
             <h3>Problems found</h3>
             [% IF ai_patrons %]
                 <h4>Patrons</h4>
-                <p>The following ids exist in both tables [% "borrowers" | $HtmlTags tag="strong" %] and [% "deletedborrowers" | $HtmlTags tag="strong" %]:</p>
-                <p>[% FOR p IN ai_patrons %][% p.borrowernumber %][% UNLESS loop.last %], [% END %][% END %]</p>
+                <p>The following ids exist in both tables [% "borrowers" | $HtmlTags tag="strong" | html %] and [% "deletedborrowers" | $HtmlTags tag="strong" | html %]:</p>
+                <p>[% FOR p IN ai_patrons %][% p.borrowernumber | html %][% UNLESS loop.last %], [% END %][% END %]</p>
             [% END %]
             [% IF ai_biblios %]
                 <h4>Biblios</h4>
-                <p>The following ids exist in both tables [% "biblio" | $HtmlTags tag="strong" %] and [% "deletedbiblio" | $HtmlTags tag="strong" %]:</p>
-                <p>[% FOR b IN ai_biblios %][% b.biblionumber %][% UNLESS loop.last %], [% END %][% END %]</p>
+                <p>The following ids exist in both tables [% "biblio" | $HtmlTags tag="strong" | html %] and [% "deletedbiblio" | $HtmlTags tag="strong" | html %]:</p>
+                <p>[% FOR b IN ai_biblios %][% b.biblionumber | html %][% UNLESS loop.last %], [% END %][% END %]</p>
             [% END %]
             [% IF ai_items %]
                 <h4>Items</h4>
-                <p>The following ids exist in both tables [% "items" | $HtmlTags tag="strong" %] and [% "deleteditems" | $HtmlTags tag="strong" %]:</p>
-                <p>[% FOR i IN ai_items %][% i.itemnumber %][% UNLESS loop.last %], [% END %][% END %]</p>
+                <p>The following ids exist in both tables [% "items" | $HtmlTags tag="strong" | html %] and [% "deleteditems" | $HtmlTags tag="strong" | html %]:</p>
+                <p>[% FOR i IN ai_items %][% i.itemnumber | html %][% UNLESS loop.last %], [% END %][% END %]</p>
             [% END %]
             [% IF ai_checkouts %]
                 <h4>Checkouts</h4>
-                <p>The following ids exist in both tables [% "issues" | $HtmlTags tag="strong" %] and [% "old_issues" | $HtmlTags tag="strong" %]:</p>
-                <p>[% FOR c IN ai_checkouts %][% c.issue_id %][% UNLESS loop.last %], [% END %][% END %]</p>
+                <p>The following ids exist in both tables [% "issues" | $HtmlTags tag="strong" | html %] and [% "old_issues" | $HtmlTags tag="strong" | html %]:</p>
+                <p>[% FOR c IN ai_checkouts %][% c.issue_id | html %][% UNLESS loop.last %], [% END %][% END %]</p>
             [% END %]
             [% IF ai_holds %]
                 <h4>Holds</h4>
-                <p>The following ids exist in both tables [% "holds" | $HtmlTags tag="strong" %] and [% "old_reserves" | $HtmlTags tag="strong" %]:</p>
-                <p>[% FOR h IN ai_holds %][% h.reserve_id %][% UNLESS loop.last %], [% END %][% END %]</p>
+                <p>The following ids exist in both tables [% "holds" | $HtmlTags tag="strong" | html %] and [% "old_reserves" | $HtmlTags tag="strong" | html %]:</p>
+                <p>[% FOR h IN ai_holds %][% h.reserve_id | html %][% UNLESS loop.last %], [% END %][% END %]</p>
             [% END %]
             <br/>
         [% END %]
                     <tr><th scope="row"><b>Warning</b> </th><td>No active currency is defined. Please go to <a href="/cgi-bin/koha/admin/currency.pl">Administration &gt; Currencies and exchange rates</a> and mark one currency as active.</td></tr>
                 [% END %]
                 [% IF warnStatisticsFieldsError %]
-                    <tr><th scope="row"><b>Warning</b> </th><td>System preference 'StatisticsFields' contains field names not belonging to the items database table: [% warnStatisticsFieldsError %] </td></tr>
+                    <tr><th scope="row"><b>Warning</b> </th><td>System preference 'StatisticsFields' contains field names not belonging to the items database table: [% warnStatisticsFieldsError | html %] </td></tr>
                 [% END %]
                 [% IF QueryParserError %]
                     <tr><th scope="row"><b>Warning</b> </th><td>
                         You have set UseQueryParser but there was a problem inititializing QueryParser.
                     [% IF QueryParserError.fallback %]
                         The 'queryparser_config' entry is missing in your configuration file.
-                        The following configuration file was used without success: [% QueryParserError.file %].
+                        The following configuration file was used without success: [% QueryParserError.file | html %].
                     [% ELSE %]
-                        The following configuration file was used without success: [% QueryParserError.file %].
+                        The following configuration file was used without success: [% QueryParserError.file | html %].
                     [% END %]
                         </td>
                     </tr>
                   [%END %]
                   [% IF ill_partner_code_doesnt_exist %]
                     <tr><th scope="row"><b>Warning</b> </th><td>
-                    The ILL module is enabled, but the configured 'partner_code' ([% ill_partner_code_doesnt_exist %]) is not defined on the system.
+                    The ILL module is enabled, but the configured 'partner_code' ([% ill_partner_code_doesnt_exist | html %]) is not defined on the system.
                     </td></tr>
                   [% END %]
                 [% END %]
                 <tr>
                     <th scope="row"><b>Warning</b></th>
                     <td>You have set UseQueryParser but the 'queryparser_config' entry is missing in your configuration
-                        file. [% config_entry.file %] is used as a fallback.
+                        file. [% config_entry.file | html %] is used as a fallback.
                     </td>
                 </tr>
                 [% ELSIF config_entry.error == 'use_zebra_facets_entry_missing' %]
                     <th scope="row"><b>Warning</b></th>
                     <td>You are missing the &lt;tmp_path&gt; entry in your koha-conf.xml file. Please
                         add it, pointing to the configured temporary directory for your Koha instance.
-                        The effective temporary directory is '[% config_entry.effective_tmp_dir %]'.
+                        The effective temporary directory is '[% config_entry.effective_tmp_dir | html %]'.
                     </td>
                 </tr>
                 [% END %]
         </tr>
         </thead>
         [% FOREACH tabl IN table2 %]
-            <tr class="[% loop.parity %]">
+            <tr class="[% loop.parity | html %]">
                 [% FOREACH ro IN tabl.row2 %]
-                     <td>[% ro.date %]</td>
-                     <td>[% ro.desc|html %]</td>
+                     <td>[% ro.date | html %]</td>
+                     <td>[% ro.desc | html %]</td>
                 [% END %]
             </tr>
         [% END %]
index 32a1332..b579b11 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Price %]
 [% USE Branches %]
@@ -5,8 +6,8 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
-[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
+[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") | $raw %]
 </head>
 
 <body id="acq_acqui-home" class="acq">
@@ -54,7 +55,7 @@
     <div id="acqui_acqui_home_suggestions">
         <fieldset>
         <legend>Pending suggestions</legend>
-            <p>[% suggestions_count %] suggestions waiting. <a href="/cgi-bin/koha/suggestion/suggestion.pl#ASKED">Manage suggestions</a>.</p>
+            <p>[% suggestions_count | html %] suggestions waiting. <a href="/cgi-bin/koha/suggestion/suggestion.pl#ASKED">Manage suggestions</a>.</p>
         </fieldset>
     </div>
 </div>
@@ -64,7 +65,7 @@
 
 [% IF ( loop_budget ) %]
 
-            <h3>All available funds[% IF LoginBranchname %] for [% LoginBranchname %][% END %]</h3>
+            <h3>All available funds[% IF LoginBranchname %] for [% LoginBranchname | html %][% END %]</h3>
 
     <div id="BudgetsAndFunds">
     <table id="accounts">
         <tbody>
         [% FOREACH loop_budge IN loop_budget %]
             [% IF loop_budge.budget_parent_id %]
-                <tr data-tt-id="[% loop_budge.budget_id %]" data-tt-parent-id="[% loop_budge.budget_parent_id %]">
+                <tr data-tt-id="[% loop_budge.budget_id | html %]" data-tt-parent-id="[% loop_budge.budget_parent_id | html %]">
             [% ELSE %]
-                <tr data-tt-id="[% loop_budge.budget_id %]">
+                <tr data-tt-id="[% loop_budge.budget_id | html %]">
             [% END %]
 
-                <td>[% loop_budge.budget_period_active %]</td>
-                <td>Budget [% loop_budge.budget_period_description %] [id=[% loop_budge.budget_period_id %]][% UNLESS loop_budge.budget_period_active %] (inactive)[% END %]</td>
+                <td>[% loop_budge.budget_period_active | html %]</td>
+                <td>Budget [% loop_budge.budget_period_description | html %] [id=[% loop_budge.budget_period_id | html %]][% UNLESS loop_budge.budget_period_active %] (inactive)[% END %]</td>
                 <td>
                     [% IF ( CAN_user_acquisition_budget_manage ) %]
-                        <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% loop_budge.budget_period_id %]">[% loop_budge.budget_code %]</a>
+                        <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% loop_budge.budget_period_id | html %]">[% loop_budge.budget_code | html %]</a>
                     [% ELSE %]
-                        [% loop_budge.budget_code %]
+                        [% loop_budge.budget_code | html %]
                     [% END %]
                 </td>
-                <td>[% loop_budge.budget_name %]</td>
+                <td>[% loop_budge.budget_name | html %]</td>
                 <td>[% IF ( loop_budge.budget_owner ) %]
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loop_budge.budget_owner.borrowernumber %]">[% loop_budge.budget_owner.surname %], [% loop_budge.budget_owner.firstname %]</a>
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loop_budge.budget_owner.borrowernumber | html %]">[% loop_budge.budget_owner.surname | html %], [% loop_budge.budget_owner.firstname | html %]</a>
                     [% ELSE %]
                         &nbsp;
                     [% END %]
                 </td>
-                <td>[% Branches.GetName( loop_budge.budget_branchcode ) %]</td>
+                <td>[% Branches.GetName( loop_budge.budget_branchcode ) | html %]</td>
                 <td class="data">
                     [% IF loop_budge.budget_parent_id %]
-                        [% loop_budge.budget_amount | $Price %]
+                        [% loop_budge.budget_amount | $Price | html %]
                     [% ELSE %]
-                        <span class="total_amount">[% loop_budge.budget_amount | $Price %]</span>
+                        <span class="total_amount">[% loop_budge.budget_amount | $Price | html %]</span>
                     [% END %]
                 </td>
                 <td class="data">
-                    <a href="ordered.pl?fund=[% loop_budge.budget_id %]&amp;fund_code=[% loop_budge.budget_code %]">
+                    <a href="ordered.pl?fund=[% loop_budge.budget_id | html %]&amp;fund_code=[% loop_budge.budget_code | html %]">
                     [% IF loop_budge.budget_parent_id %]
-                        [% loop_budge.budget_ordered | $Price %]
+                        [% loop_budge.budget_ordered | $Price | html %]
                     [% ELSE %]
-                        <span class="total_amount">[% loop_budge.budget_ordered | $Price %]</span>
+                        <span class="total_amount">[% loop_budge.budget_ordered | $Price | html %]</span>
                     [% END %]
                     </a>
                 </td>
                 <td class="data">
-                    <a href="spent.pl?fund=[% loop_budge.budget_id %]&amp;fund_code=[% loop_budge.budget_code %]">
+                    <a href="spent.pl?fund=[% loop_budge.budget_id | html %]&amp;fund_code=[% loop_budge.budget_code | html %]">
                     [% IF loop_budge.budget_parent_id %]
-                        [% loop_budge.budget_spent | $Price %]
+                        [% loop_budge.budget_spent | $Price | html %]
                     [% ELSE %]
-                        <span class="total_amount">[% loop_budge.budget_spent | $Price %]</span>
+                        <span class="total_amount">[% loop_budge.budget_spent | $Price | html %]</span>
                     [% END %]
                     </a>
                 </td>
                 <td class="data">
                     [% IF loop_budge.budget_parent_id %]
-                        [% loop_budge.budget_avail | $Price %]
+                        [% loop_budge.budget_avail | $Price | html %]
                     [% ELSE %]
-                        <span class="total_amount">[% loop_budge.budget_avail | $Price %]</span>
+                        <span class="total_amount">[% loop_budge.budget_avail | $Price | html %]</span>
                     [% END %]
                 </td>
             </tr>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     <script>
         dt_overwrite_html_sorting_localeCompare();
 
index 18f5429..de927ac 100644 (file)
@@ -11,7 +11,7 @@
         <form action="/cgi-bin/koha/acqui/addorder.pl" method="post">
           [% FOREACH var IN vars_loop %]
             [% FOREACH val IN var.values %]
-              <input type="hidden" name="[% var.name %]" value="[% val |html %]" />
+              <input type="hidden" name="[% var.name | html %]" value="[% val | html %]" />
             [% END %]
           [% END %]
           <input type="hidden" name="confirm_budget_exceeding" value="1" />
               <p>Warning! Order total amount exceeds allowed budget.</p>
             [% END %]
             [% IF (encumbrance_exceeded) %]
-              <p>Warning! You will exceed [% encumbrance %]% of your fund.</p>
+              <p>Warning! You will exceed [% encumbrance | html %]% of your fund.</p>
             [% END %]
             [% IF (expenditure_exceeded) %]
-              <p>Warning! You will exceed maximum limit ([% expenditure %][% IF (currency) %] [% currency %][% END %]) for your fund.</p>
+              <p>Warning! You will exceed maximum limit ([% expenditure | html %][% IF (currency) %] [% currency | html %][% END %]) for your fund.</p>
             [% END %]
             <p>Do you want to confirm this order?</p>
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, I confirm</button>
-            <button type="button" class="deny" onclick="window.location.href = '[% referer %]'"><i class="fa fa-fw fa-remove"></i> No, I don't confirm</button>
+            <button type="button" class="deny" onclick="window.location.href = '[% referer | html %]'"><i class="fa fa-fw fa-remove"></i> No, I don't confirm</button>
           </div>
         </form>
       [% END %]
index 3f5d736..7911662 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -5,12 +6,12 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Order staged MARC records
 [% IF ( batch_details ) %]
- &rsaquo; Batch [% import_batch_id %]
+ &rsaquo; Batch [% import_batch_id | html %]
 [% ELSE %]
  &rsaquo; Batch list
 [% END %]
 </title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">#dataPreview { width : 80%; } @media (max-width: 767px) { #dataPreview { margin: 0; width : auto; } }</style>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
@@ -18,7 +19,7 @@
 <body id="acq_addorderiso2709" class="acq">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo;  Add orders from iso2709 file</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo;  Add orders from iso2709 file</div>
 
     <div class="container-fluid">
         <div class="row">
@@ -30,8 +31,8 @@
              [% END %]
 
              [% IF ( batch_details ) %]
-                <h1>Add orders from [% comments %]
-                    ([% file_name %] staged on [% upload_timestamp | $KohaDates with_hours => 1 %])
+                <h1>Add orders from [% comments | html %]
+                    ([% file_name | html %] staged on [% upload_timestamp | $KohaDates with_hours => 1 | html %])
                 </h1>
                 <form action="/cgi-bin/koha/acqui/addorderiso2709.pl" method="post" id="Aform">
                 <div id="tabs" class="toptabs">
                                         <option value="">Do not look for matching records</option>
                                         [% FOREACH available_matcher IN available_matchers %]
                                             [% IF ( available_matcher.code == current_matcher_code ) %]
-                                                <option value="[% available_matcher.matcher_id %]" selected="selected">
-                                                    [% available_matcher.code %] ([% available_matcher.description %])
+                                                <option value="[% available_matcher.matcher_id | html %]" selected="selected">
+                                                    [% available_matcher.code | html %] ([% available_matcher.description | html %])
                                                 </option>
                                             [% ELSE %]
-                                                <option value="[% available_matcher.matcher_id %]">
-                                                    [% available_matcher.code %] ([% available_matcher.description %])
+                                                <option value="[% available_matcher.matcher_id | html %]">
+                                                    [% available_matcher.code | html %] ([% available_matcher.description | html %])
                                                 </option>
                                             [% END %]
                                         [% END %]
                     </div>
 
                         <input type="hidden" name="op" value="import_records"/>
-                        <input type="hidden" name="basketno" value="[% basketno %]" />
-                        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-                        <input type="hidden" name="import_batch_id" value="[%import_batch_id %]" />
-                        <input type="hidden" name="ordernumber" value="[% ordernumber %]" />
+                        <input type="hidden" name="basketno" value="[% basketno | html %]" />
+                        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+                        <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
+                        <input type="hidden" name="ordernumber" value="[% ordernumber | html %]" />
 
                         [% FOREACH biblio IN biblio_list %]
                         <fieldset class="biblio unselected rows" style="float:none;">
                           <legend>
-                            <label for="record_[% biblio.import_record_id %]" style="width:auto;">
-                              <input type="checkbox" name="import_record_id" id="record_[% biblio.import_record_id %]" value="[% biblio.import_record_id %]" />
-                              <span class="citation">[% biblio.citation %]</span>
+                            <label for="record_[% biblio.import_record_id | html %]" style="width:auto;">
+                              <input type="checkbox" name="import_record_id" id="record_[% biblio.import_record_id | html %]" value="[% biblio.import_record_id | html %]" />
+                              <span class="citation">[% biblio.citation | html %]</span>
                             </label>
                             <span class="links" style="font-weight: normal;">
-                              ( <a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% biblio.import_record_id %]" class="previewData">MARC</a> | <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% biblio.import_record_id %]" class="previewData">Card</a> | <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;breedingid=[% biblio.import_record_id %]&amp;import_batch_id=[% biblio.import_batch_id %]&amp;biblionumber=[% biblio.match_biblionumber %]">Add order</a> )
+                              ( <a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% biblio.import_record_id | html %]" class="previewData">MARC</a> | <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% biblio.import_record_id | html %]" class="previewData">Card</a> | <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;breedingid=[% biblio.import_record_id | html %]&amp;import_batch_id=[% biblio.import_batch_id | html %]&amp;biblionumber=[% biblio.match_biblionumber | html %]">Add order</a> )
                             </span>
                           </legend>
                           <div style="float:left">
                                 [% ELSIF ( biblio_lis.overlay_status == 'auto_match' ) %]
                                     Match found
                                 [% ELSE %]
-                                    [% biblio_lis.overlay_status %]
+                                    [% biblio_lis.overlay_status | html %]
                                 [% END %]
                                 [% IF ( biblio.match_biblionumber ) %]
-                                  Matches biblio [% biblio.match_biblionumber %] (score = [% biblio.match_score %]): <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.match_biblionumber %]">[% biblio.match_citation %]</a>
+                                  Matches biblio [% biblio.match_biblionumber | html %] (score = [% biblio.match_score | html %]): <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.match_biblionumber | html %]">[% biblio.match_citation | html %]</a>
                                 [% END %]
                               </span>
                             </li>
                             <li class="quantity">
-                                <label for="quantity_record_[% biblio.import_record_id %]" class="required">Quantity: </label>
-                                <input id="quantity_record_[% biblio.import_record_id %]" type="text" value="[% biblio.quantity.length ? biblio.quantity : 1 %]" name="quantity" />
+                                <label for="quantity_record_[% biblio.import_record_id | html %]" class="required">Quantity: </label>
+                                <input id="quantity_record_[% biblio.import_record_id | html %]" type="text" value="[% biblio.quantity.length ? biblio.quantity : 1 | html %]" name="quantity" />
                             </li>
                             <li class="price">
-                                <label for="price_record_[% biblio.import_record_id %]">Price: </label>
-                                <input id="price_record_[% biblio.import_record_id %]" type="text" value="[% biblio.price %]" name="price" />
+                                <label for="price_record_[% biblio.import_record_id | html %]">Price: </label>
+                                <input id="price_record_[% biblio.import_record_id | html %]" type="text" value="[% biblio.price | html %]" name="price" />
                             </li>
                             <li class="discount">
-                                <label for="discount_record_[% biblio.import_record_id %]">Discount: </label>
-                                <input id="discount_record_[% biblio.import_record_id %]" type="text" value="[% biblio.discount %]" name="discount" size="6" /> %
+                                <label for="discount_record_[% biblio.import_record_id | html %]">Discount: </label>
+                                <input id="discount_record_[% biblio.import_record_id | html %]" type="text" value="[% biblio.discount | html %]" name="discount" size="6" /> %
                                 (If empty, discount rate from vendor will be used)
                             </li>
                             <li class="budget">
-                                <label for="fund_record_[% biblio.import_record_id %]">Fund: </label>
+                                <label for="fund_record_[% biblio.import_record_id | html %]">Fund: </label>
                                 [% IF ( close ) %]
-                                  <input type="hidden" size="20" name="budget_id" value="[% budget_id %]" />[% Budget_name %]
+                                  <input type="hidden" size="20" name="budget_id" value="[% budget_id | html %]" />[% Budget_name | html %]
                                 [% ELSE %]
-                                  <select id="fund_record_[% biblio.import_record_id %]" size="1" name="budget_id">
+                                  <select id="fund_record_[% biblio.import_record_id | html %]" size="1" name="budget_id">
                                     <option value="">Select a fund</option>
                                     [% FOREACH budget IN budget_loop %]
                                         [% IF ( budget.b_id == biblio.budget_id ) %]
                                           [% IF budget.b_active %]
-                                            <option value="[% budget.b_id %]" data-sort1-authcat="[% budget.b_sort1_authcat %]" data-sort2-authcat="[% budget.b_sort2_authcat %]" selected="selected">[% budget.b_txt %]</option>
+                                            <option value="[% budget.b_id | html %]" data-sort1-authcat="[% budget.b_sort1_authcat | html %]" data-sort2-authcat="[% budget.b_sort2_authcat | html %]" selected="selected">[% budget.b_txt | html %]</option>
                                           [% ELSE %]
-                                            <option value="[% budget.b_id %]" data-sort1-authcat="[% budget.b_sort1_authcat %]" data-sort2-authcat="[% budget.b_sort2_authcat %]" selected="selected">[% budget.b_txt %] (inactive)</option>
+                                            <option value="[% budget.b_id | html %]" data-sort1-authcat="[% budget.b_sort1_authcat | html %]" data-sort2-authcat="[% budget.b_sort2_authcat | html %]" selected="selected">[% budget.b_txt | html %] (inactive)</option>
                                           [% END %]
                                         [% ELSE %]
-                                            [% IF budget.b_active %]<option value="[% budget.b_id %]" data-sort1-authcat="[% budget.b_sort1_authcat %]" data-sort2-authcat="[% budget.b_sort2_authcat %]">[% budget.b_txt %]</option>
-                                            [% ELSE %]<option value="[% budget.b_id %]" class="b_inactive" data-sort1-authcat="[% budget.b_sort1_authcat %]" data-sort2-authcat="[% budget.b_sort2_authcat %]">[% budget.b_txt %] (inactive)</option>
+                                            [% IF budget.b_active %]<option value="[% budget.b_id | html %]" data-sort1-authcat="[% budget.b_sort1_authcat | html %]" data-sort2-authcat="[% budget.b_sort2_authcat | html %]">[% budget.b_txt | html %]</option>
+                                            [% ELSE %]<option value="[% budget.b_id | html %]" class="b_inactive" data-sort1-authcat="[% budget.b_sort1_authcat | html %]" data-sort2-authcat="[% budget.b_sort2_authcat | html %]">[% budget.b_txt | html %] (inactive)</option>
                                             [% END %]
                                         [% END %]
                                     [% END %]
                                 [% END %]
                             </li>
                             <li class="sort1">
-                                <label for="sort1_record_[% biblio.import_record_id %]">Statistic 1: </label>
-                                <input id="sort1_record_[% biblio.import_record_id %]" type="text" id="sort1" size="20" name="sort1" value="[% biblio.sort1 %]" />
+                                <label for="sort1_record_[% biblio.import_record_id | html %]">Statistic 1: </label>
+                                <input id="sort1_record_[% biblio.import_record_id | html %]" type="text" id="sort1" size="20" name="sort1" value="[% biblio.sort1 | html %]" />
                             </li>
                             <li class="sort2">
-                                <label for="sort2_record_[% biblio.import_record_id %]">Statistic 2: </label>
-                                <input id="sort2_record_[% biblio.import_record_id %]" type="text" id="sort2" size="20" name="sort2" value="[% biblio.sort2 %]" />
+                                <label for="sort2_record_[% biblio.import_record_id | html %]">Statistic 2: </label>
+                                <input id="sort2_record_[% biblio.import_record_id | html %]" type="text" id="sort2" size="20" name="sort2" value="[% biblio.sort2 | html %]" />
                             </li>
                           </ol>
                         </div>
                         [% IF biblio.item_error %]Item records could not be processed because the number of item fields was uneven.[% END %]
                         [% FOREACH item IN biblio.iteminfos %]
                         <fieldset>
-                        <legend>Item Record [% item.item_id %]</legend>
+                        <legend>Item Record [% item.item_id | html %]</legend>
                         <ol>
                         <li>
-                        <label for="homebranch_item_[% item.item_id %]">homebranch</label><select id="homebranch_item_[% item.item_id %]" name="homebranch_[% item.biblio_count %]">
+                        <label for="homebranch_item_[% item.item_id | html %]">homebranch</label><select id="homebranch_item_[% item.item_id | html %]" name="homebranch_[% item.biblio_count | html %]">
                         [% FOREACH l IN libraries %]
                           [% IF l.branchcode == item.homebranch %]
-                            <option value="[% l.branchcode %]" selected="selected">[% l.branchname %]</option>
+                            <option value="[% l.branchcode | html %]" selected="selected">[% l.branchname | html %]</option>
                           [% ELSE %]
-                            <option value="[% l.branchcode %]">[% l.branchname %]</option>
+                            <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
                           [% END %]
                         [% END %]
                         </select>
                         </li>
 
-                        <li><label for="holdingbranch_item_[% item.item_id %]">holdingbranch</label><select id="holdingbranch_item_[% item.item_id %]" name="holdingbranch_[% item.biblio_count %]">
+                        <li><label for="holdingbranch_item_[% item.item_id | html %]">holdingbranch</label><select id="holdingbranch_item_[% item.item_id | html %]" name="holdingbranch_[% item.biblio_count | html %]">
                         [% FOREACH l IN libraries %]
                           [% IF l.branchcode == item.holdingbranch %]
-                            <option value="[% l.branchcode %]" selected="selected">[% l.branchname %]</option>
+                            <option value="[% l.branchcode | html %]" selected="selected">[% l.branchname | html %]</option>
                           [% ELSE %]
-                            <option value="[% l.branchcode %]">[% l.branchname %]</option>
+                            <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
                           [% END %]
                         [% END %]
                         </select>
                         </li>
-                        <li><label for="itype_item_[% item.item_id %]">itype</label><select id="itype_item_[% item.item_id %]" name="itype_[% item.biblio_count %]">
+                        <li><label for="itype_item_[% item.item_id | html %]">itype</label><select id="itype_item_[% item.item_id | html %]" name="itype_[% item.biblio_count | html %]">
                         [% FOREACH itypeloo IN itypeloop %]
                           [% IF ( itypeloo.itemtype ) == ( item.itype ) %]
-                            <option value="[% itypeloo.itemtype %]" selected="selected">[% itypeloo.description |html %]</option>
+                            <option value="[% itypeloo.itemtype | html %]" selected="selected">[% itypeloo.description | html %]</option>
                           [% ELSE %]
-                            <option value="[% itypeloo.itemtype %]">[% itypeloo.description |html %]</option>
+                            <option value="[% itypeloo.itemtype | html %]">[% itypeloo.description | html %]</option>
                           [% END %]
                         [% END %]
                         </select>
                         </li>
 
-                        <li><label for="nonpublic_note_item_[% item.item_id %]">nonpublic_note</label><input type="text" id="nonpublic_note_item_[% item.item_id %]" name="nonpublic_note_[% item.biblio_count %]" value="[% item.nonpublic_note %]"></li>
-                        <li><label for="public_note_item_[% item.item_id %]">public_note</label><input type="text" id="public_note_item_[% item.item_id %]" name="public_note_[% item.biblio_count %]" value="[% item.public_note %]"></li>
-                        <li><label for="loc_item_[% item.item_id %]">loc</label><select id="loc_item_[% item.item_id %]" name="loc_[% item.biblio_count %]">
+                        <li><label for="nonpublic_note_item_[% item.item_id | html %]">nonpublic_note</label><input type="text" id="nonpublic_note_item_[% item.item_id | html %]" name="nonpublic_note_[% item.biblio_count | html %]" value="[% item.nonpublic_note | html %]"></li>
+                        <li><label for="public_note_item_[% item.item_id | html %]">public_note</label><input type="text" id="public_note_item_[% item.item_id | html %]" name="public_note_[% item.biblio_count | html %]" value="[% item.public_note | html %]"></li>
+                        <li><label for="loc_item_[% item.item_id | html %]">loc</label><select id="loc_item_[% item.item_id | html %]" name="loc_[% item.biblio_count | html %]">
                         <option value=""> </option>
                         [% FOREACH locationloo IN locationloop %]
-                            [% IF ( locationloo.code ) == (item.loc) %]<option value="[% locationloo.code %]" selected="selected">[% locationloo.description %]</option>[% ELSE %]<option value="[% locationloo.code %]">[% locationloo.description %]</option>[% END %]
+                            [% IF ( locationloo.code ) == (item.loc) %]<option value="[% locationloo.code | html %]" selected="selected">[% locationloo.description | html %]</option>[% ELSE %]<option value="[% locationloo.code | html %]">[% locationloo.description | html %]</option>[% END %]
                         [% END %]
                        </select>
                         </li>
 
-                        <li><label for="ccode_item_[% item.item_id %]">ccode</label><select id="ccode_item_[% item.item_id %]" name="ccode_[% item.biblio_count %]">
+                        <li><label for="ccode_item_[% item.item_id | html %]">ccode</label><select id="ccode_item_[% item.item_id | html %]" name="ccode_[% item.biblio_count | html %]">
                         [% FOREACH ccodeloo IN ccodeloop %]
-                            [% IF ( ccodeloo.code ) == (item.ccode) %]<option value="[% ccodeloo.code %]" selected="selected">[% ccodeloo.description %]</option>[% ELSE %]<option value="[% ccodeloo.code %]">[% ccodeloo.description %]</option>[% END %]
+                            [% IF ( ccodeloo.code ) == (item.ccode) %]<option value="[% ccodeloo.code | html %]" selected="selected">[% ccodeloo.description | html %]</option>[% ELSE %]<option value="[% ccodeloo.code | html %]">[% ccodeloo.description | html %]</option>[% END %]
                         [% END %]
                         </select>
                         </li>
 
-                        <li><label for="notforloan_item_[% item.item_id %]">notforloan</label><select id="notforloan_item_[% item.item_id %]" name="notforloan_[% item.biblio_count %]">
+                        <li><label for="notforloan_item_[% item.item_id | html %]">notforloan</label><select id="notforloan_item_[% item.item_id | html %]" name="notforloan_[% item.biblio_count | html %]">
                         [% FOREACH n IN notforloanloop %]
                             [% IF n.code == item.notforloan %]
-                                <option value="[% n.code %]" selected="selected">[% n.description %]</option>
+                                <option value="[% n.code | html %]" selected="selected">[% n.description | html %]</option>
                             [% ELSE %]
-                                <option value="[% n.code %]">[% n.description %]</option>
+                                <option value="[% n.code | html %]">[% n.description | html %]</option>
                             [% END %]
                         [% END %]
                         </select>
                         </li>
-                        <li><label for="uri_item_[% item.item_id %]">uri</label><input type="text" id="uri_item_[% item.item_id %]" name="uri_[% item.biblio_count %]" value="[% item.uri %]"></li>
-                        <li><label for="copyno_item_[% item.item_id %]">copyno</label><input type="text" id="copyno_item_[% item.item_id %]" name="copyno_[% item.biblio_count %]" value="[% item.copyno %]"></li>
-                        <li><label for="budget_code_item_[% item.item_id %]">budget_code</label><select id="budget_code_item_[% item.item_id %]" name="budget_code_[% item.biblio_count %]">
+                        <li><label for="uri_item_[% item.item_id | html %]">uri</label><input type="text" id="uri_item_[% item.item_id | html %]" name="uri_[% item.biblio_count | html %]" value="[% item.uri | html %]"></li>
+                        <li><label for="copyno_item_[% item.item_id | html %]">copyno</label><input type="text" id="copyno_item_[% item.item_id | html %]" name="copyno_[% item.biblio_count | html %]" value="[% item.copyno | html %]"></li>
+                        <li><label for="budget_code_item_[% item.item_id | html %]">budget_code</label><select id="budget_code_item_[% item.item_id | html %]" name="budget_code_[% item.biblio_count | html %]">
                         <option value="">Select a fund</option>
                         [% FOREACH budget_loo IN budget_loop %]
-                            [% IF ( budget_loo.b_code ) == ( item.budget_code ) %]<option value="[% budget_loo.b_id %]" selected="selected">[% budget_loo.b_txt %]</option>
-                            [% ELSE %]<option value="[% budget_loo.b_id %]">[% budget_loo.b_txt %]</option>
+                            [% IF ( budget_loo.b_code ) == ( item.budget_code ) %]<option value="[% budget_loo.b_id | html %]" selected="selected">[% budget_loo.b_txt | html %]</option>
+                            [% ELSE %]<option value="[% budget_loo.b_id | html %]">[% budget_loo.b_txt | html %]</option>
                             [% END %]
                         [% END %]
                         </select>
                         </li>
-                        <li><label for="price_item_[% item.item_id %]">price</label><input type="text" id="price_item_[% item.item_id %]" name="itemprice_[% item.biblio_count %]" value="[% item.itemprice %]"></li>
-                        <li><label for="replacementprice_item_[% item.item_id %]">replacement price</label><input type="text" id="replacementprice_item_[% item.item_id %]" name="replacementprice_[% item.biblio_count %]" value="[% item.replacementprice %]"></li>
-                        <li><label for="callnumber_item_[% item.item_id %]">callnumber</label><input type="text" id="callnumber_item_[% item.item_id %]" name="itemcallnumber_[% item.biblio_count %]" value="[% item.itemcallnumber %]"></li>
+                        <li><label for="price_item_[% item.item_id | html %]">price</label><input type="text" id="price_item_[% item.item_id | html %]" name="itemprice_[% item.biblio_count | html %]" value="[% item.itemprice | html %]"></li>
+                        <li><label for="replacementprice_item_[% item.item_id | html %]">replacement price</label><input type="text" id="replacementprice_item_[% item.item_id | html %]" name="replacementprice_[% item.biblio_count | html %]" value="[% item.replacementprice | html %]"></li>
+                        <li><label for="callnumber_item_[% item.item_id | html %]">callnumber</label><input type="text" id="callnumber_item_[% item.item_id | html %]" name="itemcallnumber_[% item.biblio_count | html %]" value="[% item.itemcallnumber | html %]"></li>
                         </ol>
                         </fieldset>
                         [% END %]
                                     <h3 id="dataPreviewLabel">MARC preview</h3>
                                 </div>
                                 <div class="modal-body">
-                                    <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+                                    <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
                                 </div>
                                 <div class="modal-footer">
                                     <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
                             <div id="outeritemblock">
                             <div id="itemblock">
                                 <ol>
-                                [% FOREACH iteminformatio IN item.iteminformation %]<li style="[% iteminformatio.hidden %];">
-                                    <div class="subfield_line" id="subfield[% iteminformatio.serialid %][% iteminformatio.countitems %][% iteminformatio.subfield %][% iteminformatio.random %]">
+                                [% FOREACH iteminformatio IN item.iteminformation %]<li style="[% iteminformatio.hidden | html %];">
+                                    <div class="subfield_line" id="subfield[% iteminformatio.serialid | html %][% iteminformatio.countitems | html %][% iteminformatio.subfield | html %][% iteminformatio.random | html %]">
                                         [% IF (iteminformatio.mandatory) %]
-                                            <label class="required">[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                                            <label class="required">[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                                         [% ELSE %]
-                                            <label>[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                                            <label>[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                                         [% END %]
 
                                         [% IF ( iteminformatio.marc_value.type == 'select' ) %]
                                             <select name="field_value" size="1">
                                             [% FOREACH value IN iteminformatio.marc_value.values %]
                                                 [% IF ( value == iteminformatio.marc_value.default ) %]
-                                                    <option value="[% value %]" selected="selected">[% iteminformatio.marc_value.labels.$value %]</option>
+                                                    <option value="[% value | html %]" selected="selected">[% iteminformatio.marc_value.labels.$value | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% value %]">[% iteminformatio.marc_value.labels.$value %]</option>
+                                                    <option value="[% value | html %]">[% iteminformatio.marc_value.labels.$value | html %]</option>
                                                 [% END %]
                                             [% END %]
                                             </select>
                                         [% ELSE %]
-                                        [% iteminformatio.marc_value %]
+                                        [% iteminformatio.marc_value | html %]
                                         [% END %]
                                         <input type="hidden" name="itemid" value="1" />
-                                        <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield %]" />
-                                        <input type="hidden" name="tag" value="[% iteminformatio.tag %]" />
-                                        <input type="hidden" name="subfield" value="[% iteminformatio.subfield %]" />
-                                        <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory %]" />
+                                        <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield | html %]" />
+                                        <input type="hidden" name="tag" value="[% iteminformatio.tag | html %]" />
+                                        <input type="hidden" name="subfield" value="[% iteminformatio.subfield | html %]" />
+                                        <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory | html %]" />
                                         [% IF ( iteminformatio.mandatory ) %] <span class="required">Required</span>[% END %]
                                     </div></li>
                                 [% END %]
                                 <li>
                                     [% IF ( close ) %]
                                         <span class="label">Fund: </span>
-                                        <input type="hidden" size="20" name="budget_id" id="budget_id" value="[% budget_id %]" />[% Budget_name %]
+                                        <input type="hidden" size="20" name="budget_id" id="budget_id" value="[% budget_id | html %]" />[% Budget_name | html %]
                                     [% ELSE %]
                                         <li>
                                             <label for="all_currency">Currency:</label>
                                             <select name="all_currency" id="all_currency">
                                             [% FOREACH currency IN currencies %]
                                                 [% IF currency.currency == bookseller.listprice %]
-                                                    <option value="[% currency.currency %]" selected="selected">[% currency.currency %]</option>
+                                                    <option value="[% currency.currency | html %]" selected="selected">[% currency.currency | html %]</option>
                                                 [% ELSIF not currency.archived %]
-                                                    <option value="[% currency.currency %]">[% currency.currency %]</option>
+                                                    <option value="[% currency.currency | html %]">[% currency.currency | html %]</option>
                                                 [% END %]
                                             [% END %]
                                             </select>
                                             <select id="all_budget_id" size="1" name="all_budget_id">
                                               <option value="">Select a fund</option>
                                             [% FOREACH budget_loo IN budget_loop %]
-                                                [% IF ( budget_loo.b_active ) %]<option value="[% budget_loo.b_id %]" data-sort1-authcat="[% budget_loo.b_sort1_authcat %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat %]">[% budget_loo.b_txt %]</option>
-                                                [% ELSE %]<option value="[% budget_loo.b_id %]" class="b_inactive" data-sort1-authcat="[% budget_loo.b_sort1_authcat %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat %]">[% budget_loo.b_txt %] (inactive)</option>
+                                                [% IF ( budget_loo.b_active ) %]<option value="[% budget_loo.b_id | html %]" data-sort1-authcat="[% budget_loo.b_sort1_authcat | html %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat | html %]">[% budget_loo.b_txt | html %]</option>
+                                                [% ELSE %]<option value="[% budget_loo.b_id | html %]" class="b_inactive" data-sort1-authcat="[% budget_loo.b_sort1_authcat | html %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat | html %]">[% budget_loo.b_txt | html %] (inactive)</option>
                                                 [% END %]
                                             [% END %]
                                             </select>
                       </div>
 
                       <fieldset class="action">
-                          <input type="submit" value="Save" /><a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Cancel</a>
+                          <input type="submit" value="Save" /><a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Cancel</a>
                       </fieldset>
                     </form>
                 [% ELSE %]
                     <tbody>
                       [% FOREACH batch_lis IN batch_list %]
                       <tr>
-                        <td>[% batch_lis.file_name %]</td>
-                        <td>[% batch_lis.comments %]</td>
+                        <td>[% batch_lis.file_name | html %]</td>
+                        <td>[% batch_lis.comments | html %]</td>
                         <td>
                           [% IF ( batch_lis.import_status == 'cleaned' ) %]
                             Cleaned
                           [% ELSIF ( batch_lis.import_status == 'staged' ) %]
                             Staged
                           [% ELSE %]
-                            [% batch_lis.import_status %]
+                            [% batch_lis.import_status | html %]
                           [% END %]
                         </td>
-                        <td><span title="[% batch_lis.staged_date %]">[% batch_lis.staged_date | $KohaDates with_hours => 1 %]</span></td>
-                        <td>[% batch_lis.num_records %]</td>
-                        <td><a href="[% batch_lis.scriptname %]?import_batch_id=[% batch_lis.import_batch_id %]&amp;basketno=[% basketno %]&amp;booksellerid=[% booksellerid %]">Add orders</a></td>
+                        <td><span title="[% batch_lis.staged_date | html %]">[% batch_lis.staged_date | $KohaDates with_hours => 1 | html %]</span></td>
+                        <td>[% batch_lis.num_records | html %]</td>
+                        <td><a href="[% batch_lis.scriptname | html %]?import_batch_id=[% batch_lis.import_batch_id | html %]&amp;basketno=[% basketno | html %]&amp;booksellerid=[% booksellerid | html %]">Add orders</a></td>
                       </tr>
                       [% END %]
                     </tbody>
        </div> [% # /div.row %]
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
 [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("js/acq.js") | $raw %]
     <script type="text/JavaScript">
         $(document).ready(function() {
             $("#files").dataTable($.extend(true, {}, dataTablesDefaults, {
             });
             $("#dataPreview").on("hidden", function(){
                 $("#dataPreviewLabel").html("");
-                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
         });
 
index 707cd61..b206e6f 100644 (file)
@@ -1 +1 @@
-[% IF ( return ) %][% return %][% END %]
\ No newline at end of file
+[% IF ( return ) %][% return | html %][% END %]
index e1ff9c5..ec4ed9a 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% BLOCK csv_export %]
     <div class="btn-group">
-        <a id="exportbutton" class="btn btn-default btn-sm" href="[% script_name %]?op=export&amp;basketno=[% basketno %]&amp;booksellerid=[% booksellerid %]"><i class="fa fa-download"></i> Export as CSV</a>
+        <a id="exportbutton" class="btn btn-default btn-sm" href="[% script_name | html %]?op=export&amp;basketno=[% basketno | html %]&amp;booksellerid=[% booksellerid | html %]"><i class="fa fa-download"></i> Export as CSV</a>
       <a class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><span class="caret"></span></a>
       <ul class="dropdown-menu" id="export-csv-menu">
           <li><a href="#">Default</a></li>
           [% IF csv_profiles %]
               [% FOR csv IN csv_profiles %]
-                <li><a href="#" data-value="[% csv.export_format_id %]">[% csv.profile %]</a></li>
+                <li><a href="#" data-value="[% csv.export_format_id | html %]">[% csv.profile | html %]</a></li>
               [% END %]
           [% END %]
        </ul>
@@ -19,8 +20,8 @@
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for [% booksellername|html %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Acquisitions &rsaquo; [% UNLESS ( basketno ) %]New [% END %]Basket [% basketname | html %] ([% basketno | html %]) for [% booksellername | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css">
     .sortmsg {font-size: 80%;}
@@ -35,8 +36,8 @@
 <div id="breadcrumbs">
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername|html %]</a> &rsaquo;
-    [% UNLESS ( basketno ) %][% IF ( delete_confirmed ) %]Deleted [% ELSE %]New [% END %][% END %]Basket [% basketname|html %] [% IF ( basketno ) %]([% basketno |html %])[% END %] for [% booksellername|html %]
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo;
+    [% UNLESS ( basketno ) %][% IF ( delete_confirmed ) %]Deleted [% ELSE %]New [% END %][% END %]Basket [% basketname | html %] [% IF ( basketno ) %]([% basketno | html %])[% END %] for [% booksellername | html %]
 </div>
 
 <div id="doc3" class="yui-t2">
                     [% IF active %]
                         <div class="btn-group"><a href="#addtoBasket" role="button" class="btn btn-default btn-sm" data-toggle="modal"><i class="fa fa-plus"></i> Add to basket</a></div>
                     [% END %]
-                    <div class="btn-group"><a href="basketheader.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;op=add_form" class="btn btn-default btn-sm" id="basketheadbutton"><i class="fa fa-pencil"></i> Edit basket</a></div>
+                    <div class="btn-group"><a href="basketheader.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;op=add_form" class="btn btn-default btn-sm" id="basketheadbutton"><i class="fa fa-pencil"></i> Edit basket</a></div>
                     [%# FIXME This action should not be available for everyone %]
                     <div class="btn-group"><a href="#deleteBasketModal" role="button" class="btn btn-default btn-sm" data-toggle="modal" id="delbasketbutton"><i class="fa fa-trash"></i> Delete this basket</a></div>
                    [% IF ( unclosable ) %]
                     [% ELSIF ( uncertainprices ) %]
-                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid %]&amp;owner=1" class="btn btn-default btn-sm" id="uncertpricesbutton"><i class="fa fa-usd"></i> Uncertain prices</a></div>
+                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/uncertainprice.pl?booksellerid=[% booksellerid | html %]&amp;owner=1" class="btn btn-default btn-sm" id="uncertpricesbutton"><i class="fa fa-usd"></i> Uncertain prices</a></div>
                         <div title="Can not close baskets that have items with uncertain prices in them." class="btn-group">
                             <a href="" class="btn btn-default btn-sm disabled" id="closebutton"><i class="fa fa-times-circle"></i> Close this basket</a>
                         </div>
                     [% ELSE %]
                         <div class="btn-group">
-                            <a href="/cgi-bin/koha/acqui/basket.pl?op=close&amp;basketno=[% basketno %]&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="closebutton"><i class="fa fa-times-circle"></i> Close this basket</a>
+                            <a href="/cgi-bin/koha/acqui/basket.pl?op=close&amp;basketno=[% basketno | html %]&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="closebutton"><i class="fa fa-times-circle"></i> Close this basket</a>
                         </div>
                     [% END %]
 
                     [% PROCESS csv_export %]
 
                         [% IF ediaccount %]
-                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/edi_ean.pl?op=ediorder&amp;basketno=[% basketno %]&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="ediorderbutton"><i class="fa fa-download"></i> Create EDIFACT order</a></div>
+                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/edi_ean.pl?op=ediorder&amp;basketno=[% basketno | html %]&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="ediorderbutton"><i class="fa fa-download"></i> Create EDIFACT order</a></div>
                         [% END %]
 
                         [% IF ( active && books_loop ) %]
                             <div class="btn-group">
                                 <form action="/cgi-bin/koha/acqui/basket.pl" method="post">
                                     <input type="hidden" name="op" value="email" />
-                                    <input type="hidden" name="basketno" value="[% basketno %]" />
+                                    <input type="hidden" name="basketno" value="[% basketno | html %]" />
                                     <button type="submit" class="btn btn-default btn-sm" id="emailvendorbutton"><i class="fa fa-envelope"></i> E-mail order</button>
                                 </form>
                             </div>
                             <button type="button" class="btn btn-primary" data-dismiss="modal">Cancel</button>
                             <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
                                 <input type="hidden" name="op" value="delete_confirm" />
-                                <input type="hidden" name="basketno" value="[% basketno %]" />
-                                <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                                <input type="hidden" name="basketno" value="[% basketno | html %]" />
+                                <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                                 <input type="hidden" name="delbiblio" value="0" />
                                 <button type="submit" class="btn btn-default btn-default">Delete basket</button>
                             </form>
                             <button type="button" class="btn btn-primary" data-dismiss="modal">Cancel</button>
                             <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
                                 <input type="hidden" name="op" value="delete_confirm" />
-                                <input type="hidden" name="basketno" value="[% basketno %]" />
-                                <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                                <input type="hidden" name="basketno" value="[% basketno | html %]" />
+                                <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                                 <input type="hidden" name="delbiblio" value="0" />
                                 <button type="submit" class="btn btn-default btn-default">Delete basket and orders</button>
                             </form>
 
                             <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
                                 <input type="hidden" name="op" value="delete_confirm" />
-                                <input type="hidden" name="basketno" value="[% basketno %]" />
-                                <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                                <input type="hidden" name="basketno" value="[% basketno | html %]" />
+                                <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                                 <input type="hidden" name="delbiblio" value="1" />
                                 <button type="submit" class="btn btn-default btn-default">Delete basket, orders, and records</button>
                             </form>
                     <p><strong>The following records could not be deleted:</strong></p>
                     <ul>
                     [% FOREACH cannotdelbiblio IN cannotdelbiblios %]
-                        <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cannotdelbiblio.biblionumber %]">[% cannotdelbiblio.title |html %]</a> by [% cannotdelbiblio.author %]:
+                        <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cannotdelbiblio.biblionumber | html %]">[% cannotdelbiblio.title | html %]</a> by [% cannotdelbiblio.author | html %]:
                             <ul>
-                            [% IF (cannotdelbiblio.itemcount) %]<li>[% cannotdelbiblio.itemcount %] item(s) attached.</li>[% END %]
-                            [% IF (cannotdelbiblio.subscriptions) %]<li>[% cannotdelbiblio.subscriptions %] subscription(s) attached.</li>[% END %]
-                            [% IF (cannotdelbiblio.countbiblio) %]<li>[% cannotdelbiblio.countbiblio %] order(s) attached.</li>[% END %]
+                            [% IF (cannotdelbiblio.itemcount) %]<li>[% cannotdelbiblio.itemcount | html %] item(s) attached.</li>[% END %]
+                            [% IF (cannotdelbiblio.subscriptions) %]<li>[% cannotdelbiblio.subscriptions | html %] subscription(s) attached.</li>[% END %]
+                            [% IF (cannotdelbiblio.countbiblio) %]<li>[% cannotdelbiblio.countbiblio | html %] order(s) attached.</li>[% END %]
                             [% IF (cannotdelbiblio.othererror) %]<li>Unknown error.</li>[% END %]
                             </ul>
                         </li>
                 </div>
                 <a href="booksellers.pl">Click here to go back to booksellers page</a>
             [% ELSE %]
-                <a href="/cgi-bin/koha/acqui/booksellers.pl?booksellerid=[% booksellerid %]" class="btn btn-default btn-sm">Show baskets for vendor [% booksellername | html %]</a> <a href="/cgi-bin/koha/acqui/booksellers.pl" class="btn btn-default btn-sm">Show all active baskets</a>
+                <a href="/cgi-bin/koha/acqui/booksellers.pl?booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm">Show baskets for vendor [% booksellername | html %]</a> <a href="/cgi-bin/koha/acqui/booksellers.pl" class="btn btn-default btn-sm">Show all active baskets</a>
             [% END %]
         [% ELSE %]
 
         [% FOR m IN messages %]
-            <div class="dialog [% m.type %]">
+            <div class="dialog [% m.type | html %]">
                 [% SWITCH m.code %]
                 [% CASE 'no_email' %]
                     This vendor has no contact selected for sending orders to or is missing an e-mail address.
                 [% CASE 'email_sent' %]
                     Order e-mail was sent to the vendor.
                 [% CASE %]
-                    ERROR! - [% m.code %]
+                    ERROR! - [% m.code | html %]
                 [% END %]
             </div>
         [% END %]
-        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname|html %] ([% basketno |html %]) for <a href="supplier.pl?booksellerid=[% booksellerid %]">[% booksellername|html %]</a></h1>
+        <h1>[% UNLESS ( basketno ) %]New [% END %]Basket [% basketname | html %] ([% basketno | html %]) for <a href="supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
         [% IF ( basketno ) %]
             <div id="acqui_basket_summary" class="yui-g">
                 <div class="rows">
                 <div class="yui-u first">
                 <ol>
-                [% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote |html %]</li>[% END %]
-                [% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote |html %]</li>[% END %]
+                [% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote | html %]</li>[% END %]
+                [% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote | html %]</li>[% END %]
                 [% IF ( basketcontractno ) %]
-                    <li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno %]&amp;booksellerid=[% booksellerid %]">[% basketcontractname %]</a></li>
+                    <li><span class="label">Contract name:</span> <a href="../admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno | html %]&amp;booksellerid=[% booksellerid | html %]">[% basketcontractname | html %]</a></li>
                 [% END %]
-                [% IF deliveryplace %]<li><span class="label">Delivery place:</span> [% Branches.GetName( deliveryplace ) %]</li>[% END %]
-                [% IF billingplace %]<li><span class="label">Billing place:</span> [% Branches.GetName( billingplace ) %]</li>[% END %]
-                [% IF ( authorisedbyname ) %]<li><span class="label">Created by:</span>  [% authorisedbyname %]</li>[% END %]
+                [% IF deliveryplace %]<li><span class="label">Delivery place:</span> [% Branches.GetName( deliveryplace ) | html %]</li>[% END %]
+                [% IF billingplace %]<li><span class="label">Billing place:</span> [% Branches.GetName( billingplace ) | html %]</li>[% END %]
+                [% IF ( authorisedbyname ) %]<li><span class="label">Created by:</span>  [% authorisedbyname | html %]</li>[% END %]
                 <li id="managedby">
                     <form action="" method="post">
                         <span class="label">Managed by:</span>
                         <div style="float:left">
                             <ul id="users_names" style="padding-left:0">
                               [% FOREACH user IN users %]
-                                <li id="user_[% user.borrowernumber %]">
-                                    [% user.firstname %] [% user.surname %]
-                                    <a href="#" data-borrowernumber="[% user.borrowernumber %]" class="del_user"><i class="fa fa-trash"></i> Delete user</a>
+                                <li id="user_[% user.borrowernumber | html %]">
+                                    [% user.firstname | html %] [% user.surname | html %]
+                                    <a href="#" data-borrowernumber="[% user.borrowernumber | html %]" class="del_user"><i class="fa fa-trash"></i> Delete user</a>
                                 </li>
                               [% END %]
                             </ul>
-                            <input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
-                            <input type="hidden" id="users_ids" name="users_ids" value="[% users_ids %]" />
+                            <input type="hidden" id="basketno" name="basketno" value="[% basketno | html %]" />
+                            <input type="hidden" id="users_ids" name="users_ids" value="[% users_ids | html %]" />
                             <input type="hidden" id="op" name="op" value="mod_users" />
                             <input type="button" id="add_user" value="Add user" />
                             <input type="submit" value="Save changes" />
                 <li id="branch">
                     <span class="label">Library:</span>
                     [% IF basketbranchcode %]
-                        [% Branches.GetName( basketbranchcode ) %]
+                        [% Branches.GetName( basketbranchcode ) | html %]
                     [% ELSE %]
                         No library
                     [% END %]
                                 <option value="">(no library)</option>
                                 [% FOREACH branch IN branches_loop %]
                                     [% IF (branch.selected) %]
-                                        <option selected="selected" value="[% branch.branchcode %]"> [% branch.branchname %]</option>
+                                        <option selected="selected" value="[% branch.branchcode | html %]"> [% branch.branchname | html %]</option>
                                     [% ELSE %]
-                                        <option value="[% branch.branchcode %]"> [% branch.branchname %]</option>
+                                        <option value="[% branch.branchcode | html %]"> [% branch.branchname | html %]</option>
                                     [% END %]
                                 [% END %]
                             </select>
-                            <input type="hidden" id="basketno" name="basketno" value="[% basketno %]" />
+                            <input type="hidden" id="basketno" name="basketno" value="[% basketno | html %]" />
                             <input type="hidden" id="op" name="op" value="mod_branch" />
                             <input type="submit" value="Change" />
                         </form>
                 </li>
                 [% IF ( creationdate ) %]<li><span class="label">Opened on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
                 [% IF ( closedate ) %]<li><span class="label">Closed on:</span> [% closedate | $KohaDates %]</li>[% END %]
-                [% IF ( estimateddeliverydate ) %]<li><span class="label">Estimated delivery date:</span> [% estimateddeliverydate | $KohaDates  %]</li>[% END %]
+                [% IF ( estimateddeliverydate ) %]<li><span class="label">Estimated delivery date:</span> [% estimateddeliverydate | $KohaDates | html %]</li>[% END %]
                 <li><span class="label">Orders are standing:</span> [% IF is_standing %]Yes[% ELSE %]No[% END %]</li>
 
                 [% IF basket.create_items %]
                           [% END %]
                           [% IF basketgroup.closed %]
                               [% IF ( CAN_user_acquisition_group_manage ) %]
-                                  <a href="basketgroup.pl?op=add&booksellerid=[% booksellerid %]&basketgroupid=[% basketgroup.id %]" title="basketgroup">[% basketgroup.name %] (closed)</a>
+                                  <a href="basketgroup.pl?op=add&booksellerid=[% booksellerid | html %]&basketgroupid=[% basketgroup.id | html %]" title="basketgroup">[% basketgroup.name | html %] (closed)</a>
                               [% ELSE %]
-                                  [% basketgroup.name %] (closed)
+                                  [% basketgroup.name | html %] (closed)
                               [% END %]
                           [% ELSIF ( ! CAN_user_acquisition_group_manage ) %]
                             [%- IF basketgroup.id -%]
-                                [% basketgroup.name %]
+                                [% basketgroup.name | html %]
                             [%- ELSE -%]
                                 No group
                             [%- END -%]
                               <option value="">No group</option>
                               [% FOREACH bg IN basketgroups %]
                                 [% IF ( bg.default ) %]
-                                    <option value="[% bg.id %]" selected="selected">[% bg.name %]</option>
+                                    <option value="[% bg.id | html %]" selected="selected">[% bg.name | html %]</option>
                                 [% ELSE %]
                                   [% UNLESS bg.closed %]
-                                    <option value="[% bg.id %]">[% bg.name %]</option>
+                                    <option value="[% bg.id | html %]">[% bg.name | html %]</option>
                                   [% ELSE %]
-                                    <option value="[% bg.id %]" disabled="disabled">[% bg.name %] (closed)</option>
+                                    <option value="[% bg.id | html %]" disabled="disabled">[% bg.name | html %] (closed)</option>
                                   [% END %]
                                 [% END %]
                               [% END %]
                               <option value="new">Add new group</option>
                             </select>
-                            <input type="hidden" id="basketno" value="[% basketno %]" name="basketno" />
+                            <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
                             <input type="hidden" value="mod_basket" name="op" />
-                            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                             <input type="submit" value="Change basket group" />
                           [% END %]
                         </li>
-                    [% IF basketgroup.deliveryplace %]<li><span class="label">Basket group delivery placename:</span> [% Branches.GetName( basketgroup.deliveryplace ) %]</li>[% END %]
-                    [% IF basketgroup.billingplace %]<li><span class="label">Basket group billing place:</span> [% Branches.GetName( basketgroup.billingplace ) %]</li>[% END %]
+                    [% IF basketgroup.deliveryplace %]<li><span class="label">Basket group delivery placename:</span> [% Branches.GetName( basketgroup.deliveryplace ) | html %]</li>[% END %]
+                    [% IF basketgroup.billingplace %]<li><span class="label">Basket group billing place:</span> [% Branches.GetName( basketgroup.billingplace ) | html %]</li>[% END %]
                         </ol>
                     [% IF ( CAN_user_acquisition_group_manage ) %]
                     </form>
         [% END %]
         [% IF ( duplinbatch ) %]<div class="dialog alert">
         <h4>Duplicate warning</h4>
-        <p>Some records have not been automatically added because they match an existing record in your catalog:<a href="/cgi-bin/koha/acqui/addorderiso2709.pl?import_batch_id=[% duplinbatch %]&amp;basketno=[% basketno %]&amp;booksellerid=[% booksellerid %]" title="Open in new window" target="_blank" class="popup" style="margin-left:10px">Display them</a></p>
+        <p>Some records have not been automatically added because they match an existing record in your catalog:<a href="/cgi-bin/koha/acqui/addorderiso2709.pl?import_batch_id=[% duplinbatch | html %]&amp;basketno=[% basketno | html %]&amp;booksellerid=[% booksellerid | html %]" title="Open in new window" target="_blank" class="popup" style="margin-left:10px">Display them</a></p>
         </div>[% END %]
 
         <div id="acqui_basket_content" class="yui-g">
                         <th class="tax_included">RRP tax inc.</th>
                         <th class="tax_included">ecost tax inc.</th>
                         <th>Qty.</th>
-                        <th class="tax_excluded">Total tax exc. ([% currency %])</th>
-                        <th class="tax_included">Total tax inc. ([% currency %])</th>
+                        <th class="tax_excluded">Total tax exc. ([% currency | html %])</th>
+                        <th class="tax_included">Total tax inc. ([% currency | html %])</th>
                         <th>GST %</th>
                         <th>GST</th>
                         <th>Fund</th>
                 [% FOREACH foot_loo IN book_foot_loop %]
                     <tr>
                         <th></th>
-                        <th>Total (GST [% foot_loo.tax_rate * 100 %])</th>
+                        <th>Total (GST [% foot_loo.tax_rate * 100 | html %])</th>
                         <th class="tax_excluded">&nbsp;</th>
                         <th class="tax_excluded">&nbsp;</th>
                         <th class="tax_included">&nbsp;</th>
                         <th class="tax_included">&nbsp;</th>
-                        <th>[% foot_loo.quantity %]</th>
-                        <th class="tax_excluded">[% foot_loo.total_tax_excluded | $Price%]</th>
-                        <th class="tax_included">[% foot_loo.total_tax_included | $Price %]</th>
+                        <th>[% foot_loo.quantity | html %]</th>
+                        <th class="tax_excluded">[% foot_loo.total_tax_excluded | $Price | html %]</th>
+                        <th class="tax_included">[% foot_loo.total_tax_included | $Price | html %]</th>
                         <th>&nbsp;</th>
-                        <th>[% foot_loo.tax_value | $Price %]</th>
+                        <th>[% foot_loo.tax_value | $Price | html %]</th>
                         <th>&nbsp;</th>
                         <th>&nbsp;</th>
                         [% IF ( active ) %]
                 [% END %]
                 <tr>
                     <th></th>
-                    <th>Total ([% currency %])</th>
+                    <th>Total ([% currency | html %])</th>
                     <th class="tax_excluded">&nbsp;</th>
                     <th class="tax_excluded">&nbsp;</th>
                     <th class="tax_included">&nbsp;</th>
                     <th class="tax_included">&nbsp;</th>
-                    <th>[% total_quantity %]</th>
-                    <th class="tax_excluded">[% total_tax_excluded | $Price %]</th>
-                    <th class="tax_included">[% total_tax_included | $Price %]</th>
+                    <th>[% total_quantity | html %]</th>
+                    <th class="tax_excluded">[% total_tax_excluded | $Price | html %]</th>
+                    <th class="tax_included">[% total_tax_included | $Price | html %]</th>
                     <th>&nbsp;</th>
-                    <th>[% total_tax_value | $Price %]</th>
+                    <th>[% total_tax_value | $Price | html %]</th>
                     <th>&nbsp;</th>
                     <th>&nbsp;</th>
                     [% IF ( active ) %]
                         <tr>
                     [% END %]
                         <td>
-                            [% books_loo.ordernumber %]
+                            [% books_loo.ordernumber | html %]
                         </td>
                         <td>
                             <p>
                                 [% IF ( books_loo.order_received ) %] (rcvd)[% END %]
                                 [% IF books_loo.title %]
-                                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% books_loo.biblionumber %]">[% books_loo.title |html %]</a>[% IF books_loo.author %] by [% books_loo.author %][% END %]
+                                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% books_loo.biblionumber | html %]">[% books_loo.title | html %]</a>[% IF books_loo.author %] by [% books_loo.author | html %][% END %]
                                 [% ELSE %]
                                     <em>Deleted bibliographic record, can't find title</em><br />
                                 [% END %]
                                 <br />
-                                [% IF ( books_loo.isbn ) %] - [% books_loo.isbn %][% END %]
-                                [% IF ( books_loo.issn ) %] - [% books_loo.issn %][% END %]
-                                [% IF ( books_loo.publishercode ) %], [% books_loo.publishercode %][% END %]
-                                [% IF ( books_loo.publicationyear ) %], [% books_loo.publicationyear %]
-                                [% ELSIF ( books_loo.copyrightdate ) %] [% books_loo.copyrightdate %][% END %]
-                                [% IF ( books_loo.editionstatement ) %], [% books_loo.editionstatement %][% END %]
+                                [% IF ( books_loo.isbn ) %] - [% books_loo.isbn | html %][% END %]
+                                [% IF ( books_loo.issn ) %] - [% books_loo.issn | html %][% END %]
+                                [% IF ( books_loo.publishercode ) %], [% books_loo.publishercode | html %][% END %]
+                                [% IF ( books_loo.publicationyear ) %], [% books_loo.publicationyear | html %]
+                                [% ELSIF ( books_loo.copyrightdate ) %] [% books_loo.copyrightdate | html %][% END %]
+                                [% IF ( books_loo.editionstatement ) %], [% books_loo.editionstatement | html %][% END %]
                                 [% IF ( books_loo.suggestionid ) %]
                                     <br/>
-                                    Suggested by: [% books_loo.surnamesuggestedby %][% IF ( books_loo.firstnamesuggestedby ) %], [% books_loo.firstnamesuggestedby %] [% END %]
-                                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% books_loo.suggestionid %]&amp;op=show">suggestion #[% books_loo.suggestionid %]</a>)
+                                    Suggested by: [% books_loo.surnamesuggestedby | html %][% IF ( books_loo.firstnamesuggestedby ) %], [% books_loo.firstnamesuggestedby | html %] [% END %]
+                                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% books_loo.suggestionid | html %]&amp;op=show">suggestion #[% books_loo.suggestionid | html %]</a>)
                                 [% END %]
                             </p>
                                 [% IF ( books_loo.order_internalnote ) %]
-                                    <p class="ordernote"><strong>Internal note: </strong><span id="internal-note-[% books_loo.ordernumber %]">[% books_loo.order_internalnote|html %]</span> <a class="edit_note" data-ordernumber="[% books_loo.ordernumber %]" data-note_type="internal" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber %]&type=internal" title="Edit internal note"><i class="fa fa-pencil"></i> Edit internal note</a></p>
+                                    <p class="ordernote"><strong>Internal note: </strong><span id="internal-note-[% books_loo.ordernumber | html %]">[% books_loo.order_internalnote | html %]</span> <a class="edit_note" data-ordernumber="[% books_loo.ordernumber | html %]" data-note_type="internal" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber | html %]&type=internal" title="Edit internal note"><i class="fa fa-pencil"></i> Edit internal note</a></p>
                                 [% ELSE %]
-                                    <a class="edit_note" data-ordernumber="[% books_loo.ordernumber %]" data-note_type="internal" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber %]&type=internal" title="Add internal note"><i class="fa fa-plus"></i> Add internal note</a>
+                                    <a class="edit_note" data-ordernumber="[% books_loo.ordernumber | html %]" data-note_type="internal" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber | html %]&type=internal" title="Add internal note"><i class="fa fa-plus"></i> Add internal note</a>
                                 [% END %]
                                 [% IF ( books_loo.order_vendornote ) %]
-                                    <p class="ordernote"><strong>Vendor note: </strong> <span id="vendor-note-[% books_loo.ordernumber %]">[% books_loo.order_vendornote|html %]</span> <a class="edit_note" data-ordernumber="[% books_loo.ordernumber %]" data-note_type="vendor" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber %]&type=vendor" title="Edit vendor note"><i class="fa fa-pencil"></i> Edit vendor note</a></p>
+                                    <p class="ordernote"><strong>Vendor note: </strong> <span id="vendor-note-[% books_loo.ordernumber | html %]">[% books_loo.order_vendornote | html %]</span> <a class="edit_note" data-ordernumber="[% books_loo.ordernumber | html %]" data-note_type="vendor" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber | html %]&type=vendor" title="Edit vendor note"><i class="fa fa-pencil"></i> Edit vendor note</a></p>
                                 [% ELSE %]
-                                    <a class="edit_note" data-ordernumber="[% books_loo.ordernumber %]" data-note_type="vendor" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber %]&type=vendor" title="Add vendor note"><i class="fa fa-plus"></i> Add vendor note</a>
+                                    <a class="edit_note" data-ordernumber="[% books_loo.ordernumber | html %]" data-note_type="vendor" href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% books_loo.ordernumber | html %]&type=vendor" title="Add vendor note"><i class="fa fa-plus"></i> Add vendor note</a>
                                 [% END %]
                             [% IF (books_loo.transferred_from) %]
-                              [% basket = books_loo.transferred_from.basket %]
-                              [% bookseller = books_loo.transferred_from.bookseller %]
-                              [% timestamp = books_loo.transferred_from.timestamp %]
+                              [% basket = books_loo.transferred_from.basket | html %]
+                              [% bookseller = books_loo.transferred_from.bookseller | html %]
+                              [% timestamp = books_loo.transferred_from.timestamp | html %]
                               <p>Transferred from basket:
-                                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno %]"> [% basket.basketname %]</a>
-                                (<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% bookseller.id %]">[% bookseller.name %]</a>)
-                                on <span title="[% timestamp | $KohaDates with_hours = 1 %]">
+                                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno | html %]"> [% basket.basketname | html %]</a>
+                                (<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% bookseller.id | html %]">[% bookseller.name | html %]</a>)
+                                on <span title="[% timestamp | $KohaDates with_hours = 1 | html %]">
                                   [% timestamp | $KohaDates %]
                                 </span>
                               </p>
                         </td>
                         [% SET zero_regex = "^0{1,}\.?0{1,}[^1-9]" %] [%# 0 or 0.0 or 0.00 or 00 or 00.0 or 00.00 or 0.000 ... %]
                         [%# FIXME: use of a regexp is not ideal; bugs 9410 and 10929 suggest better way of handling this %]
-                        <td class="number tax_excluded [% IF books_loo.rrp_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.rrp_tax_excluded | $Price %]</td>
-                        <td class="number tax_excluded [% IF books_loo.ecost_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.ecost_tax_excluded | $Price%]</td>
-                        <td class="number tax_included [% IF books_loo.rrp_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.rrp_tax_included | $Price %]</td>
-                        <td class="number tax_included [% IF books_loo.ecost_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.ecost_tax_included | $Price %]</td>
-                        <td class="number [% IF books_loo.quantity.search(zero_regex) %]error[% END %]">[% books_loo.quantity %]</td>
-                        <td class="number tax_excluded [% IF books_loo.total_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.total_tax_excluded | $Price %]</td>
-                        <td class="number tax_included [% IF books_loo.total_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.total_tax_included | $Price %]</td>
-                        <td class="number">[% books_loo.tax_rate * 100 %]</td>
-                        <td class="number [% IF books_loo.tax_value.search(zero_regex) %]error[% END %]">[% books_loo.tax_value | $Price %]</td>
-                        <td>[% books_loo.budget_name %]</td>
-                        <td>[% books_loo.suppliers_report %]</td>
+                        <td class="number tax_excluded [% IF books_loo.rrp_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.rrp_tax_excluded | $Price | html %]</td>
+                        <td class="number tax_excluded [% IF books_loo.ecost_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.ecost_tax_excluded | $Price | html %]</td>
+                        <td class="number tax_included [% IF books_loo.rrp_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.rrp_tax_included | $Price | html %]</td>
+                        <td class="number tax_included [% IF books_loo.ecost_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.ecost_tax_included | $Price | html %]</td>
+                        <td class="number [% IF books_loo.quantity.search(zero_regex) %]error[% END %]">[% books_loo.quantity | html %]</td>
+                        <td class="number tax_excluded [% IF books_loo.total_tax_excluded.search(zero_regex) %]error[% END %]">[% books_loo.total_tax_excluded | $Price | html %]</td>
+                        <td class="number tax_included [% IF books_loo.total_tax_included.search(zero_regex) %]error[% END %]">[% books_loo.total_tax_included | $Price | html %]</td>
+                        <td class="number">[% books_loo.tax_rate * 100 | html %]</td>
+                        <td class="number [% IF books_loo.tax_value.search(zero_regex) %]error[% END %]">[% books_loo.tax_value | $Price | html %]</td>
+                        <td>[% books_loo.budget_name | html %]</td>
+                        <td>[% books_loo.suppliers_report | html %]</td>
                         [% IF ( active ) %]
                             [% UNLESS ( closedate ) %]
                             <td>
-                                <a href="neworderempty.pl?ordernumber=[% books_loo.ordernumber %]&amp;booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">Modify</a>
+                                <a href="neworderempty.pl?ordernumber=[% books_loo.ordernumber | html %]&amp;booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">Modify</a>
                                 [% UNLESS (books_loo.order_received) %]
                                     <br />
-                                    <a href="#" class="transfer_order" data-ordernumber="[% books_loo.ordernumber %]">Transfer</a>
+                                    <a href="#" class="transfer_order" data-ordernumber="[% books_loo.ordernumber | html %]">Transfer</a>
                                 [% END %]
                             </td>
                             <td>
                             [% IF ( books_loo.left_holds_on_order ) %]
-                            <span class="button" title="Can't cancel order, ([% books_loo.holds_on_order %]) holds are linked with this order cancel holds first">Can't cancel order</span><br>
+                            <span class="button" title="Can't cancel order, ([% books_loo.holds_on_order | html %]) holds are linked with this order cancel holds first">Can't cancel order</span><br>
                             [% ELSE %]
-                            <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% books_loo.ordernumber %]&biblionumber=[% books_loo.biblionumber %]&basketno=[% basketno %]&referrer=/cgi-bin/koha/acqui/basket.pl%3Fbasketno=[% basketno %]" class="button">Cancel order</a><br>
+                            <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% books_loo.ordernumber | html %]&biblionumber=[% books_loo.biblionumber | html %]&basketno=[% basketno | html %]&referrer=/cgi-bin/koha/acqui/basket.pl%3Fbasketno=[% basketno | html %]" class="button">Cancel order</a><br>
                             [% END %]
                             [% IF ( books_loo.can_del_bib ) %]
-                            <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% books_loo.ordernumber %]&biblionumber=[% books_loo.biblionumber %]&basketno=[% basketno %]&del_biblio=1&referrer=/cgi-bin/koha/acqui/basket.pl%3Fbasketno=[% basketno %]" class="button">Cancel order and delete catalog record</a><br>
+                            <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% books_loo.ordernumber | html %]&biblionumber=[% books_loo.biblionumber | html %]&basketno=[% basketno | html %]&del_biblio=1&referrer=/cgi-bin/koha/acqui/basket.pl%3Fbasketno=[% basketno | html %]" class="button">Cancel order and delete catalog record</a><br>
                             [% ELSE %]
                             <span class="button" title="Can't delete catalog record, see constraints below">Can't cancel order and delete catalog record</span><br>
                             [% END %]
                             [% IF ( books_loo.left_item ) %]
-                            <b title="Can't delete catalog record, because of [% books_loo.items %] existing hold(s)" >[% books_loo.items %] item(s) left</b><br>
+                            <b title="Can't delete catalog record, because of [% books_loo.items | html %] existing hold(s)" >[% books_loo.items | html %] item(s) left</b><br>
                             [% END %]
                             [% IF ( books_loo.left_biblio ) %]
-                            <b title="Can't delete catalog record, delete other orders linked to it first">[% books_loo.biblios %] order(s) left</b><br>
+                            <b title="Can't delete catalog record, delete other orders linked to it first">[% books_loo.biblios | html %] order(s) left</b><br>
                             [% END %]
                             [% IF ( books_loo.left_subscription ) %]
-                            <b title="Can't delete catalog record, delete subscriptions first">[% books_loo.subscriptions %] subscription(s) left</b><br>
+                            <b title="Can't delete catalog record, delete subscriptions first">[% books_loo.subscriptions | html %] subscription(s) left</b><br>
                             [% END %]
                             [% IF ( books_loo.left_holds ) %]
-                            <b title="Can't delete catalog record or order, cancel holds first">[% books_loo.holds %] hold(s) left</b>
+                            <b title="Can't delete catalog record or order, cancel holds first">[% books_loo.holds | html %] hold(s) left</b>
                             [% END %]
                             </td>
                             [% END %]
                   <th class="tax_included">RRP tax inc.</th>
                   <th class="tax_included">ecost tax inc.</th>
                   <th>Qty.</th>
-                  <th class="tax_excluded">Total tax exc. ([% currency %])</th>
-                  <th class="tax_included">Total tax inc. ([% currency %])</th>
+                  <th class="tax_excluded">Total tax exc. ([% currency | html %])</th>
+                  <th class="tax_included">Total tax inc. ([% currency | html %])</th>
                   <th>GST %</th>
                   <th>GST</th>
                   <th>Fund</th>
                 [% FOREACH order IN cancelledorders_loop %]
                   <tr style="color:grey">
                     <td>
-                        [% order.ordernumber %]
+                        [% order.ordernumber | html %]
                     </td>
                     <td>
                       <p>
                         [% IF ( order.order_received ) %] (rcvd)[% END %]
                         [% IF (order.title) %]
-                          [% order.title |html %][% IF order.author %] by [% order.author %][% END %]
+                          [% order.title | html %][% IF order.author %] by [% order.author | html %][% END %]
                         [% ELSE %]
                           <em>Deleted bibliographic record, can't find title</em>
                         [% END %]
                         <br />
-                        [% IF ( order.order_internalnote ) %] [% order.order_internalnote %][% END %]
-                        [% IF ( order.isbn ) %] - [% order.isbn %][% END %]
-                        [% IF ( order.issn ) %] - [% order.issn %][% END %]
-                        [% IF ( order.publishercode ) %], [% order.publishercode %][% END %]
-                        [% IF ( order.publicationyear ) %], [% order.publicationyear %]
-                        [% ELSIF ( order.copyrightdate ) %] [% order.copyrightdate %][% END %]
-                        [% IF ( books_loo.editionstatement ) %], [% books_loo.editionstatement %][% END %]
+                        [% IF ( order.order_internalnote ) %] [% order.order_internalnote | html %][% END %]
+                        [% IF ( order.isbn ) %] - [% order.isbn | html %][% END %]
+                        [% IF ( order.issn ) %] - [% order.issn | html %][% END %]
+                        [% IF ( order.publishercode ) %], [% order.publishercode | html %][% END %]
+                        [% IF ( order.publicationyear ) %], [% order.publicationyear | html %]
+                        [% ELSIF ( order.copyrightdate ) %] [% order.copyrightdate | html %][% END %]
+                        [% IF ( books_loo.editionstatement ) %], [% books_loo.editionstatement | html %][% END %]
                         [% IF ( order.cancellationreason ) %]
                           <br />
-                          Cancellation reason: [% AuthorisedValues.GetByCode( 'ORDER_CANCELLATION_REASON', order.cancellationreason ) %]
+                          Cancellation reason: [% AuthorisedValues.GetByCode( 'ORDER_CANCELLATION_REASON', order.cancellationreason ) | html %]
                         [% END %]
                       </p>
                       [% IF order.transferred_to %]
-                        [% basket = order.transferred_to.basket %]
-                        [% bookseller = order.transferred_to.bookseller %]
-                        [% timestamp = order.transferred_to.timestamp %]
+                        [% basket = order.transferred_to.basket | html %]
+                        [% bookseller = order.transferred_to.bookseller | html %]
+                        [% timestamp = order.transferred_to.timestamp | html %]
                         <p>Transferred to basket:
-                          <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno %]"> [% basket.basketname %]</a>
-                          (<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% bookseller.id %]">[% bookseller.name %]</a>)
-                          on <span title="[% timestamp | $KohaDates with_hours = 1%]">
+                          <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno | html %]"> [% basket.basketname | html %]</a>
+                          (<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% bookseller.id | html %]">[% bookseller.name | html %]</a>)
+                          on <span title="[% timestamp | $KohaDates with_hours = 1 | html %]">
                             [% timestamp | $KohaDates %]
                           </span>
                         </p>
                       [% END %]
                     </td>
-                    <td class="number tax_excluded">[% order.rrp_tax_excluded | $Price %]</td>
-                    <td class="number tax_excluded">[% order.ecost_tax_excluded | $Price %]</td>
-                    <td class="number tax_included">[% order.rrp_tax_included | $Price %]</td>
-                    <td class="number tax_included">[% order.ecost_tax_included | $Price %]</td>
-                    <td class="number">[% order.quantity %]</td>
-                    <td class="number tax_excluded">[% order.total_tax_excluded | $Price %]</td>
-                    <td class="number tax_included">[% order.total_tax_included | $Price %]</td>
-                    <td class="number">[% order.tax_rate * 100 %]</td>
-                    <td class="number">[% order.tax_value | $Price %]</td>
-                    <td>[% order.budget_name %]
+                    <td class="number tax_excluded">[% order.rrp_tax_excluded | $Price | html %]</td>
+                    <td class="number tax_excluded">[% order.ecost_tax_excluded | $Price | html %]</td>
+                    <td class="number tax_included">[% order.rrp_tax_included | $Price | html %]</td>
+                    <td class="number tax_included">[% order.ecost_tax_included | $Price | html %]</td>
+                    <td class="number">[% order.quantity | html %]</td>
+                    <td class="number tax_excluded">[% order.total_tax_excluded | $Price | html %]</td>
+                    <td class="number tax_included">[% order.total_tax_included | $Price | html %]</td>
+                    <td class="number">[% order.tax_rate * 100 | html %]</td>
+                    <td class="number">[% order.tax_value | $Price | html %]</td>
+                    <td>[% order.budget_name | html %]
                   </tr>
                 [% END %]
               </tbody>
         <div id="closebasket_needsconfirmation" class="dialog alert">
 
         <form action="/cgi-bin/koha/acqui/basket.pl">
-            <h1>Are you sure you want to close basket [% basketname|html %]?</h1>
+            <h1>Are you sure you want to close basket [% basketname | html %]?</h1>
             [% IF ( CAN_user_acquisition_group_manage ) %]
             <p>
             <label for="createbasketgroup">Attach this basket to a new basket group with the same name</label>
             <input type="checkbox" id="createbasketgroup" name="createbasketgroup"/>
             </p>
             [% END %]
-            <input type="hidden" id="basketno" value="[% basketno %]" name="basketno" />
+            <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
             <input type="hidden" value="close" name="op" />
-            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
             <input type="hidden" name="confirm" value="1" />
-            <input type="hidden" name="basketgroupname" value="[% basketgroupname %]" />
+            <input type="hidden" name="basketgroupname" value="[% basketgroupname | html %]" />
             <button type="submit" class="approve" accesskey="y"><i class="fa fa-fw fa-check"></i> Yes, close (Y)</button>
         </form>
         <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
-            <input type="hidden" name="basketno" value="[% basketno %]" />
+            <input type="hidden" name="basketno" value="[% basketno | html %]" />
             <button type="submit" class="deny" accesskey="n"><i class="fa fa-fw fa-remove"></i> No, don't close (N)</button>
         </form>
         </div>
         <div id="closebasket_needsconfirmation" class="dialog alert">
 
         <form action="/cgi-bin/koha/acqui/basket.pl">
-            <h1>Are you sure you want to generate an EDIFACT order and close basket [% basketname|html %]?</h1>
+            <h1>Are you sure you want to generate an EDIFACT order and close basket [% basketname | html %]?</h1>
             [% IF CAN_user_acquisition_group_manage %]
             <p>
             <label for="createbasketgroup">Attach this basket to a new basket group with the same name</label>
             <input type="checkbox" id="createbasketgroup" name="createbasketgroup"/>
             </p>
             [% END %]
-            <input type="hidden" id="basketno" value="[% basketno %]" name="basketno" />
+            <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
             <input type="hidden" value="ediorder" name="op" />
-            <input type="hidden" name="ean" value="[% ean %]" />
-            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+            <input type="hidden" name="ean" value="[% ean | html %]" />
+            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
             <input type="hidden" name="confirm" value="1" />
-            <input type="hidden" name="basketgroupname" value="[% basketgroupname %]" />
+            <input type="hidden" name="basketgroupname" value="[% basketgroupname | html %]" />
             <button type="submit" class="approve" accesskey="Y"><i class="fa fa-fw fa-check"></i> Yes, close (Y)</button>
         </form>
         <form action="/cgi-bin/koha/acqui/basket.pl" method="get">
-            <input type="hidden" name="basketno" value="[% basketno %]" />
+            <input type="hidden" name="basketno" value="[% basketno | html %]" />
             <button type="submit" class="deny" accesskey="N"><i class="fa fa-fw fa-remove"></i> No, don't close (N)</button>
         </form>
         </div>
                     <h4 class="modal-title" id="noteEditorLabel">Order note</h4>
                 </div>
                 <div class="modal-body">
-                <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes %]</textarea>
+                <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes | html %]</textarea>
                 <input type="hidden" id="ordernumber" name="ordernumber" value="" />
                 <input type="hidden" name="op" value="save" />
                 <input type="hidden" id="type" name="type" value="" />
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
 [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     <script type="text/javascript">
         function updateColumnsVisibility(visible) {
             if ( visible ) {
             function confirm_ediorder() {
                 var is_confirmed = confirm(_("Are you sure you want to close this basket and generate an EDIFACT order?"));
                 if (is_confirmed) {
-                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno |html %]";
+                    window.location = "/cgi-bin/koha/acqui/basket.pl?op=edi_confirm&basketno=[% basketno | html %]";
                 }
             }
         </script>
             $(document).ready(function(){
                 $("#basketgroupid").change(function(){
                     if($(this).val() == "new"){
-                        location.href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% booksellerid %]";
+                        location.href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% booksellerid | html %]";
                     }
                 });
             });
                     var skip = [% IF ( skip_confirm_reopen ) %] 1 [% ELSE %] 0 [% END %];
                     var is_confirmed = skip || confirm(_("Are you sure you want to reopen this basket?"));
                     if (is_confirmed) {
-                        window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno |html %]";
+                        window.location = "/cgi-bin/koha/acqui/basket.pl?op=reopen&basketno=[% basketno | html %]";
                     }
                 }
             </script>
index a1d6cc3..7847ff4 100644 (file)
@@ -1,21 +1,22 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE Price %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Basket grouping for [% booksellername |html %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Basket grouping for [% booksellername | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 [% INCLUDE 'datatables.inc' %]
-[% Asset.js("lib/yui/utilities/utilities.js") %]
-[% Asset.js("lib/yui/button/button-min.js") %]
-[% Asset.js("lib/yui/container/container_core-min.js") %]
-[% Asset.js("lib/yui/menu/menu-min.js") %]
-[% Asset.js("js/basketgroup.js") %]
+[% Asset.js("lib/yui/utilities/utilities.js") | $raw %]
+[% Asset.js("lib/yui/button/button-min.js") | $raw %]
+[% Asset.js("lib/yui/container/container_core-min.js") | $raw %]
+[% Asset.js("lib/yui/menu/menu-min.js") | $raw %]
+[% Asset.js("js/basketgroup.js") | $raw %]
 [% IF ( grouping ) %]
-[% Asset.js("lib/yui/yahoo-dom-event/yahoo-dom-event.js") %]
-[% Asset.js("lib/yui/animation/animation-min.js") %]
-[% Asset.js("lib/yui/dragdrop/dragdrop-min.js") %]
-[% Asset.js("lib/yui/element/element-min.js") %]
+[% Asset.js("lib/yui/yahoo-dom-event/yahoo-dom-event.js") | $raw %]
+[% Asset.js("lib/yui/animation/animation-min.js") | $raw %]
+[% Asset.js("lib/yui/dragdrop/dragdrop-min.js") | $raw %]
+[% Asset.js("lib/yui/element/element-min.js") | $raw %]
 <style type="text/css">
 /*margin and padding on body element
   can introduce errors in determining
@@ -129,9 +130,9 @@ function submitForm(form) {
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
 [% IF ( grouping ) %]
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid %]">Basket grouping</a> &rsaquo; Add basket group for [% booksellername |html %]</div>
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid | html %]">Basket grouping</a> &rsaquo; Add basket group for [% booksellername | html %]</div>
 [% ELSE %]
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a> &rsaquo; Basket grouping</div>
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; Basket grouping</div>
 [% END %]
 
 
@@ -143,23 +144,23 @@ function submitForm(form) {
                 [% IF ( grouping ) %]
                     [% IF (closedbg) %]
                         <div id="toolbar" class="btn-toolbar">
-                            <div class="btn-group"><a href="[% script_name %]?op=reopen&amp;basketgroupid=[% basketgroupid %]&amp;booksellerid=[% booksellerid %]&amp;mode=singlebg" class="btn btn-default btn-sm" id="reopenbutton"><i class="fa fa-download"></i> Reopen this basket group</a></div>
-                            <div class="btn-group"><a href="[% script_name %]?op=export&amp;basketgroupid=[% basketgroupid %]&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="exportbutton"><i class="fa fa-download"></i> Export this basket group as CSV</a></div>
-                            <div class="btn-group"><a href="[% script_name %]?op=print&amp;basketgroupid=[% basketgroupid %]&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Print this basket group in PDF</a></div>
-                            <div class="btn-group"><a href="[% script_name %]?op=ediprint&amp;basketgroupid=[% basketgroupid %]&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Generate EDIFACT order</a></div>
+                            <div class="btn-group"><a href="[% script_name | html %]?op=reopen&amp;basketgroupid=[% basketgroupid | html %]&amp;booksellerid=[% booksellerid | html %]&amp;mode=singlebg" class="btn btn-default btn-sm" id="reopenbutton"><i class="fa fa-download"></i> Reopen this basket group</a></div>
+                            <div class="btn-group"><a href="[% script_name | html %]?op=export&amp;basketgroupid=[% basketgroupid | html %]&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="exportbutton"><i class="fa fa-download"></i> Export this basket group as CSV</a></div>
+                            <div class="btn-group"><a href="[% script_name | html %]?op=print&amp;basketgroupid=[% basketgroupid | html %]&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Print this basket group in PDF</a></div>
+                            <div class="btn-group"><a href="[% script_name | html %]?op=ediprint&amp;basketgroupid=[% basketgroupid | html %]&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="printbutton"><i class="fa fa-download"></i> Generate EDIFACT order</a></div>
                         </div>
                     [% END %]
                     [% IF (name && closedbg) %]
-                        <h1>Basket group [% name %] ([% basketgroupid %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a></h1>
+                        <h1>Basket group [% name | html %] ([% basketgroupid | html %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
                     [% ELSIF (name) %]
-                        <h1>Edit basket group [% name %] ([% basketgroupid %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a></h1>
+                        <h1>Edit basket group [% name | html %] ([% basketgroupid | html %]) for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
                     [% ELSE %]
-                        <h1>Add basket group for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a></h1>
+                        <h1>Add basket group for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
                     [% END %]
                     <div id="basketgroupcolumns" class="row">
                         [% UNLESS (closedbg) %]
                             <div class="col-xs-6 col-xs-push-6">
-                                <form action="[% scriptname %]" method="post" name="basketgroups" id="basketgroups">
+                                <form action="[% scriptname | html %]" method="post" name="basketgroups" id="basketgroups">
                                     <div id="groups">
                                         <fieldset class="brief">
                                             <div class="workarea_alt" >
@@ -167,16 +168,16 @@ function submitForm(form) {
                                                 <ul id="ungrouped" class="draglist_alt">
                                                     [% IF ( baskets ) %]
                                                         [% FOREACH basket IN baskets %]
-                                                            <li class="ungrouped" id="b-[% basket.basketno %]" >
-                                                                <a href="basket.pl?basketno=[% basket.basketno %]">
+                                                            <li class="ungrouped" id="b-[% basket.basketno | html %]" >
+                                                                <a href="basket.pl?basketno=[% basket.basketno | html %]">
                                                                     [% IF ( basket.basketname ) %]
-                                                                        [% basket.basketname %]
+                                                                        [% basket.basketname | html %]
                                                                     [% ELSE %]
-                                                                        No name, basketnumber: [% basket.basketno %]
+                                                                        No name, basketnumber: [% basket.basketno | html %]
                                                                     [% END %]
                                                                 </a>, <br />
-                                                                Total: [% basket.total | $Price %]
-                                                                <input type="hidden" class="basket" name="basket" value="[% basket.basketno %]" />
+                                                                Total: [% basket.total | $Price | html %]
+                                                                <input type="hidden" class="basket" name="basket" value="[% basket.basketno | html %]" />
                                                             </li>
                                                         [% END %]
                                                     [% END %]
@@ -198,10 +199,10 @@ function submitForm(form) {
                                         [% UNLESS (closedbg) %]
                                             <li>
                                                 <label for="basketgroupname">Basket group name:</label>
-                                                <input type="text" name="basketgroupname" id="basketgroupname" value="[% name %]" class="focus" />
+                                                <input type="text" name="basketgroupname" id="basketgroupname" value="[% name | html %]" class="focus" />
                                             </li>
                                         [% ELSE %]
-                                            <input type="hidden" name="basketgroupname" id="basketgroupname" value="[% name %]" />
+                                            <input type="hidden" name="basketgroupname" id="basketgroupname" value="[% name | html %]" />
                                         [% END %]
                                         <li>
                                             [% UNLESS (closedbg) %]
@@ -212,7 +213,7 @@ function submitForm(form) {
                                                 </select>
                                             [% ELSE %]
                                                 <span class="label">Billing place:</span>
-                                                <input name="billingplace" id="billingplace" type ="hidden" value="[% billingplace %]" />[% Branches.GetName( billingplace ) %]
+                                                <input name="billingplace" id="billingplace" type ="hidden" value="[% billingplace | html %]" />[% Branches.GetName( billingplace ) | html %]
                                             [% END %]
                                         </li>
                                         [% UNLESS (closedbg) %]
@@ -226,16 +227,16 @@ function submitForm(form) {
                                             <li><p>or</p></li>
                                             <li>
                                                 <label for="freedeliveryplace">Delivery place:</label>
-                                                <textarea cols="26" rows="3" name="freedeliveryplace" id="freedeliveryplace">[% freedeliveryplace %]</textarea>
+                                                <textarea cols="26" rows="3" name="freedeliveryplace" id="freedeliveryplace">[% freedeliveryplace | html %]</textarea>
                                             </li>
                                             [% ELSE %]
                                                 <li>
                                                     <span class="label">Delivery place:</span>
                                                     [% IF (freedeliveryplace) %]
-                                                        <input name="freedeliveryplace" id="freedeliveryplace" type ="hidden" value="[% freedeliveryplace %]" />[% freedeliveryplace %]
+                                                        <input name="freedeliveryplace" id="freedeliveryplace" type ="hidden" value="[% freedeliveryplace | html %]" />[% freedeliveryplace | html %]
                                                         <input name="deliveryplace" id="deliveryplace" type ="hidden" value="" />
                                                     [% ELSE %]
-                                                        <input name="deliveryplace" id="deliveryplace" type ="hidden" value="[% deliveryplace %]" />[% Branches.GetName( deliveryplace ) %]
+                                                        <input name="deliveryplace" id="deliveryplace" type ="hidden" value="[% deliveryplace | html %]" />[% Branches.GetName( deliveryplace ) | html %]
                                                         <input name="freedeliveryplace" id="freedeliveryplace" type ="hidden" value="" />
                                                     [% END %]
                                                 </li>
@@ -243,10 +244,10 @@ function submitForm(form) {
                                             <li>
                                                 [% UNLESS (closedbg) %]
                                                     <label for="deliverycomment">Delivery comment:</label>
-                                                    <textarea cols="26" rows="3" name="deliverycomment" id="deliverycomment">[% deliverycomment %]</textarea>
+                                                    <textarea cols="26" rows="3" name="deliverycomment" id="deliverycomment">[% deliverycomment | html %]</textarea>
                                                 [% ELSE %]
-                                                    <span class="label">Delivery comment:</span>[% deliverycomment %]
-                                                    <input name="deliverycomment" id="deliverycomment" type="hidden" value = "[% deliverycomment %]" />
+                                                    <span class="label">Delivery comment:</span>[% deliverycomment | html %]
+                                                    <input name="deliverycomment" id="deliverycomment" type="hidden" value = "[% deliverycomment | html %]" />
                                                 [% END %]
                                             </li>
                                             <li>
@@ -257,16 +258,16 @@ function submitForm(form) {
                                                     <ul>
                                                 [% END %]
                                                 [% FOREACH selectedbasket IN selectedbaskets %]
-                                                    <li class="grouped" id="b-[% selectedbasket.basketno %]" >
-                                                        <a href="basket.pl?basketno=[% selectedbasket.basketno %]">
+                                                    <li class="grouped" id="b-[% selectedbasket.basketno | html %]" >
+                                                        <a href="basket.pl?basketno=[% selectedbasket.basketno | html %]">
                                                             [% IF ( selectedbasket.basketname ) %]
-                                                                [% selectedbasket.basketname %]
+                                                                [% selectedbasket.basketname | html %]
                                                             [% ELSE %]
-                                                                No name, basketnumber: [% selectedbasket.basketno %]
+                                                                No name, basketnumber: [% selectedbasket.basketno | html %]
                                                             [% END %]
                                                         </a>, <br />
-                                                        Total: [% selectedbasket.total | $Price %]
-                                                        <input type="hidden" class="basket" name="basket" value="[% selectedbasket.basketno %]" />
+                                                        Total: [% selectedbasket.total | $Price | html %]
+                                                        <input type="hidden" class="basket" name="basket" value="[% selectedbasket.basketno | html %]" />
                                                     </li>
                                                 [% END %]
                                             </ul>
@@ -279,12 +280,12 @@ function submitForm(form) {
                                     </ol>
                                 </fieldset>
                                 [% UNLESS (closedbg) %]
-                                    <fieldset class="action"><input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                                    <fieldset class="action"><input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                                         [% IF ( basketgroupid ) %]
-                                            <input type="hidden" name="basketgroupid" value="[% basketgroupid %]" />
+                                            <input type="hidden" name="basketgroupid" value="[% basketgroupid | html %]" />
                                         [% END %]
                                         <input type="hidden" name="op" value="attachbasket" />
-                                        <input type="submit" value="Save" /> <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid %]" class="cancel">Cancel</a>
+                                        <input type="submit" value="Save" /> <a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% booksellerid | html %]" class="cancel">Cancel</a>
                                     </fieldset>
                                 [% END %]
                             </form>
@@ -292,9 +293,9 @@ function submitForm(form) {
                     </div>
                 [% ELSE %]
                     <div id="toolbar" class="btn-toolbar">
-                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid=[% booksellerid %]" class="btn btn-default btn-sm" id="newbasketgroup"><i class="fa fa-plus"></i> New basket group</a></div>
+                        <div class="btn-group"><a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid=[% booksellerid | html %]" class="btn btn-default btn-sm" id="newbasketgroup"><i class="fa fa-plus"></i> New basket group</a></div>
                     </div>
-                    <h1>Basket grouping for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername |html %]</a></h1>
+                    <h1>Basket grouping for <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
                     <div id="basket_groups" class="toptabs">
                         <ul class="ui-tabs-nav">
                             [% UNLESS ( listclosed) %]<li class="ui-tabs-active"><a href="#opened">Open</a></li>
@@ -319,20 +320,20 @@ function submitForm(form) {
                                         [% UNLESS ( basketgroup.closed ) %]
                                             <tr>
                                                 <td>[% IF ( basketgroup.name ) %]
-                                                    [% basketgroup.name %]
+                                                    [% basketgroup.name | html %]
                                                     [% ELSE %]
-                                                        Basket group no. [% basketgroup.id %]
+                                                        Basket group no. [% basketgroup.id | html %]
                                                     [% END %]
                                                 </td>
-                                                <td>[% basketgroup.id %]</td>
-                                                <td>[% Branches.GetName( basketgroup.billingplace ) %]</td>
-                                                <td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) %][% END %]</td>
-                                                <td>[% basketgroup.basketsqty %]</td>
+                                                <td>[% basketgroup.id | html %]</td>
+                                                <td>[% Branches.GetName( basketgroup.billingplace ) | html %]</td>
+                                                <td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) | html %][% END %]</td>
+                                                <td>[% basketgroup.basketsqty | html %]</td>
                                                 <td>
-                                                    <input type="button" onclick="closeandprint('[% basketgroup.id %]');" value="Close and export as PDF" />
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Edit" /></form>
+                                                    <input type="button" onclick="closeandprint('[% basketgroup.id | html %]');" value="Close and export as PDF" />
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Edit" /></form>
                                                     [% UNLESS basketgroup.basketsqty %]
-                                                        <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="delete" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Delete" /></form>
+                                                        <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="delete" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Delete" /></form>
                                                     [% END %]
                                                 </td>
                                             </tr>
@@ -359,21 +360,21 @@ function submitForm(form) {
                                             <tr>
                                                 <td>
                                                     [% IF ( basketgroup.name ) %]
-                                                        [% basketgroup.name %]
+                                                        [% basketgroup.name | html %]
                                                         [% ELSE %]
-                                                            Basket group no. [% basketgroup.id %]
+                                                            Basket group no. [% basketgroup.id | html %]
                                                         [% END %]
                                                 </td>
-                                                <td>[% basketgroup.id %]</td>
-                                                <td>[% Branches.GetName( basketgroup.billingplace ) %]</td>
-                                                <td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) %][% END %]</td>
-                                                <td>[% basketgroup.basketsqty %]</td>
+                                                <td>[% basketgroup.id | html %]</td>
+                                                <td>[% Branches.GetName( basketgroup.billingplace ) | html %]</td>
+                                                <td>[% IF (basketgroup.freedeliveryplace) %]Free delivery place[% ELSE %][% Branches.GetName( basketgroup.deliveryplace ) | html %][% END %]</td>
+                                                <td>[% basketgroup.basketsqty | html %]</td>
                                                 <td>
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="View" /></form>
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="reopen" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Reopen" /></form>
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="print" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Export as PDF" /></form>
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="export" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Export as CSV" /></form>
-                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="ediprint" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id %]" /><input type="submit" value="Generate EDIFACT order" /></form>
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="add" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="View" /></form>
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="reopen" /><input type="hidden" name="booksellerid" value="[% basketgroup.booksellerid | html %]" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Reopen" /></form>
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="print" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Export as PDF" /></form>
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="export" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Export as CSV" /></form>
+                                                    <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="get"><input type="hidden" name="op" value="ediprint" /><input type="hidden" name="basketgroupid" value="[% basketgroup.id | html %]" /><input type="submit" value="Generate EDIFACT order" /></form>
                                                 </td>
                                             </tr>
                                         [% END %]
index 15c64e8..e16ffd1 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE Koha %]
@@ -5,8 +6,8 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo;
 [% IF ( add_form ) %]
-    [% IF ( basketno ) %]Edit basket '[% basketname %]'
-        [% ELSE %]Add a basket to [% booksellername %]
+    [% IF ( basketno ) %]Edit basket '[% basketname | html %]'
+        [% ELSE %]Add a basket to [% booksellername | html %]
     [% END %]
 [% END %]
 </title>
 <div id="breadcrumbs">
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a> &rsaquo;
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo;
     [% IF ( add_form ) %]
-        [% IF ( basketno ) %]Edit basket '[% basketname |html %]'
-        [% ELSE %]Add a basket to [% booksellername %]
+        [% IF ( basketno ) %]Edit basket '[% basketname | html %]'
+        [% ELSE %]Add a basket to [% booksellername | html %]
         [% END %]
     [% END %]
 </div>
 
     [% IF ( add_form ) %]
         [% IF ( basketno ) %]
-            <h1>Edit basket [% basketname |html %]</h1>
-        [% ELSE %]<h1>Add a basket to [% booksellername %]</h1>
+            <h1>Edit basket [% basketname | html %]</h1>
+        [% ELSE %]<h1>Add a basket to [% booksellername | html %]</h1>
         [% END %]
-    <form name="Aform" action="[% script_name %]" method="post" class="validated">
-        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+    <form name="Aform" action="[% script_name | html %]" method="post" class="validated">
+        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <fieldset class="rows">
             <ol>
                 [% IF ( basketno ) %]
                     <li>
-                        <input type="hidden" name="basketno" value="[% basketno %]" />
+                        <input type="hidden" name="basketno" value="[% basketno | html %]" />
                         <input type="hidden" name="is_an_edit" value="1" />
                     </li>
                 [% END %]
                 <li>
                     <label for="basketname" class="required">Basket name: </label>
-                    <input type="text" name="basketname" id="basketname" size="40" maxlength="80" value="[% basketname %]" required="required" class="required" />
+                    <input type="text" name="basketname" id="basketname" size="40" maxlength="80" value="[% basketname | html %]" required="required" class="required" />
                     <span class="required">Required</span>
                 </li>
                 <li>
@@ -71,9 +72,9 @@
                     <select name="basketbooksellerid" id="basketbooksellerid">
                     [% FOREACH b IN booksellers %]
                         [% IF booksellerid == b.id %]
-                           <option value="[% b.id %]" selected="selected">[% b.name %]</option>
+                           <option value="[% b.id | html %]" selected="selected">[% b.name | html %]</option>
                         [% ELSE %]
-                           <option value="[% b.id %]">[% b.name %]</option>
+                           <option value="[% b.id | html %]">[% b.name | html %]</option>
                         [% END %]
                     [% END %]
             </select>
@@ -92,9 +93,9 @@
                             <option value=""></option>
                             [% FOREACH contractloo IN contractloop %]
                                 [% IF ( contractloo.selected ) %]
-                                    <option value="[% contractloo.contractnumber %]" selected="selected">[% contractloo.contractname %]</option>
+                                    <option value="[% contractloo.contractnumber | html %]" selected="selected">[% contractloo.contractname | html %]</option>
                                 [% ELSE %]
-                                     <option value="[% contractloo.contractnumber %]">[% contractloo.contractname %]</option>
+                                     <option value="[% contractloo.contractnumber | html %]">[% contractloo.contractname | html %]</option>
                                 [% END %]
                             [% END %]
                         </select>
             <input type="hidden" name="op" value="add_validate" />
             <input type="submit" value="Save" />
             [% IF ( basketno ) %]
-                <a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Cancel</a>
+                <a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Cancel</a>
             [% ELSE %]
-                <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">Cancel</a>
+                <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">Cancel</a>
             [% END %]
         </fieldset>
     </form>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
+    [% Asset.js("js/acq.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 4618e8d..7fa8f2f 100644 (file)
@@ -1,22 +1,23 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Search for vendor [% supplier %]</title>
+<title>Koha &rsaquo; Search for vendor [% supplier | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css">
 #vendors td{
        vertical-align: top;
 }
 </style>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="acq_booksellers" class="acq">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Search for vendor <em>[% supplier |html %]</em> </div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Search for vendor <em>[% supplier | html %]</em> </div>
 
 <div class="main container-fluid">
     <div class="row">
@@ -28,9 +29,9 @@
     [% UNLESS count %]
         <h1>Your search returned no results.</h1>
     [% ELSIF ( supplier.length < 1 ) %]
-        <h1>Vendor search: [% count %] results found</h1>
+        <h1>Vendor search: [% count | html %] results found</h1>
     [% ELSE %]
-        <h1>Vendor search: [% count %] results found for '[% supplier %]'</h1>
+        <h1>Vendor search: [% count | html %] results found for '[% supplier | html %]'</h1>
     [% END %]
 [% END %]
 [% IF ( loop_suppliers.size ) %]
         <p>Choose a vendor in the list to jump directly to the right place.
         <select id="supplierlist">
             [% FOREACH supplier1 IN loop_suppliers %]
-                <option value="[% supplier1.booksellerid %]">[% supplier1.name %]</option>
+                <option value="[% supplier1.booksellerid | html %]">[% supplier1.name | html %]</option>
             [% END %]
         </select>
         </p>
     [% END %]
     [% IF ( allbaskets ) %]
-        <a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier %]&amp;booksellerid=[% booksellerid %]">Show active baskets only</a>
+        <a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier | html %]&amp;booksellerid=[% booksellerid | html %]">Show active baskets only</a>
     [% ELSE %]
-        <a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier %]&amp;booksellerid=[% booksellerid %]&amp;allbaskets=1">Show all baskets</a>
+        <a href="/cgi-bin/koha/acqui/booksellers.pl?supplier=[% supplier | html %]&amp;booksellerid=[% booksellerid | html %]&amp;allbaskets=1">Show all baskets</a>
     [% END %]
     [% UNLESS booksellerid %]
         | <a href="#" id="show_active_vendors">Show active vendors only</a><a href="#" id="show_all_vendors">Show all vendors</a>
             [% END %]
                 <span class="suppliername">
                     [% IF (supplier.name) %]
-                        <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">[% supplier.name |html %]</a>
+                        <a name="[% supplier.booksellerid | html %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid | html %]">[% supplier.name | html %]</a>
                     [% ELSE %]
-                        <a name="[% supplier.booksellerid %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid %]">NO NAME</a>
+                        <a name="[% supplier.booksellerid | html %]" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% supplier.booksellerid | html %]">NO NAME</a>
                     [% END %]
                 </span>
                 <span class="action">
                     [% IF ( CAN_user_acquisition_order_manage ) %]
                         [% IF ( supplier.active ) %]
-                            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% supplier.booksellerid %]&amp;op=add_form"><i class="fa fa-plus"></i> New basket</a>
+                            <a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/basketheader.pl?booksellerid=[% supplier.booksellerid | html %]&amp;op=add_form"><i class="fa fa-plus"></i> New basket</a>
                         [% ELSE %]
                             (inactive)
                         [% END %]
                     [% END %]
                         [% IF ( supplier.loop_basket.size ) %]
-                    <a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% supplier.booksellerid %]"><i class="fa fa-inbox"></i> Receive shipment</a>
+                    <a class="btn btn-default btn-sm" href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% supplier.booksellerid | html %]"><i class="fa fa-inbox"></i> Receive shipment</a>
                         [% END %]
                 </span>
                 <div class="baskets">
                                     [% ELSE %]
                                         <tr>
                                     [% END %]
-                                        <td>[% basket.basketno %]</td>
-                                        <td>[% basket.basketname |html %]</td>
+                                        <td>[% basket.basketno | html %]</td>
+                                        <td>[% basket.basketname | html %]</td>
                                         <td>
-                                            <span title="[% basket.total_items %]">[% basket.total_items %]
+                                            <span title="[% basket.total_items | html %]">[% basket.total_items | html %]
                                                 [% IF basket.total_items_cancelled %]
-                                                    ([% basket.total_items_cancelled %] cancelled)
+                                                    ([% basket.total_items_cancelled | html %] cancelled)
                                                 [% END %]
                                             </span>
                                         </td>
                                         <td>
-                                            <span title="[% basket.total_biblios %]">[% basket.total_biblios %]
+                                            <span title="[% basket.total_biblios | html %]">[% basket.total_biblios | html %]
                                                 [% IF basket.total_biblios_cancelled %]
-                                                    ([% basket.total_biblios_cancelled %] cancelled)
+                                                    ([% basket.total_biblios_cancelled | html %] cancelled)
                                                 [% END %]
                                             </span>
                                         </td>
-                                        <td>[% basket.expected_items %]</td>
+                                        <td>[% basket.expected_items | html %]</td>
                                         <td>
                                             [% IF basket.authorisedby %]
-                                                [% basket.authorisedby.firstname %]
-                                                [% basket.authorisedby.surname %]
+                                                [% basket.authorisedby.firstname | html %]
+                                                [% basket.authorisedby.surname | html %]
                                             [% END %]
                                         </td>
-                                        <td><span title="[% basket.creationdate %]">[% basket.creationdate | $KohaDates %]</span></td>
+                                        <td><span title="[% basket.creationdate | html %]">[% basket.creationdate | $KohaDates %]</span></td>
                                         <td>
                                           [% IF basket.basketgroup %]
-                                            [% basketgroup = basket.basketgroup %]
+                                            [% basketgroup = basket.basketgroup | html %]
                                             [% IF basketgroup.closed %]
-                                              [% basketgroup.name %] (closed)
+                                              [% basketgroup.name | html %] (closed)
                                             [% ELSE %]
-                                              <a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid=[% basket.booksellerid %]&amp;basketgroupid=[% basketgroup.id %]">[% basketgroup.name %]</a>
+                                              <a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&amp;booksellerid=[% basket.booksellerid | html %]&amp;basketgroupid=[% basketgroup.id | html %]">[% basketgroup.name | html %]</a>
                                             [% END %]
                                           [% END %]
                                         </td>
                                         <td>
                                             [% IF ( basket.closedate ) %]
-                                                <span title="[% basket.closedate %]">[% basket.closedate | $KohaDates %]</span>
+                                                <span title="[% basket.closedate | html %]">[% basket.closedate | $KohaDates %]</span>
                                             [% ELSE %]
                                                 <span title="9999-99-99"></span>
                                             [% END %]
                                         </td>
                                         <td class="actions">
-                                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno %]"><i class="fa fa-eye"></i> View</a>
+                                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno | html %]"><i class="fa fa-eye"></i> View</a>
 
                                             [% IF not basket.closedate and supplier.active %]
-                                                <a class="btn btn-default btn-xs" id="addtoBasketLabel[% basket.basketno %]" href="#addtoBasket[% basket.basketno %]" role="button" data-toggle="modal"><i class="fa fa-plus"></i> Add to basket</a>
+                                                <a class="btn btn-default btn-xs" id="addtoBasketLabel[% basket.basketno | html %]" href="#addtoBasket[% basket.basketno | html %]" role="button" data-toggle="modal"><i class="fa fa-plus"></i> Add to basket</a>
                                                 <!-- Modal -->
-                                                <div id="addtoBasket[% basket.basketno %]" class="modal" tabindex="-1" role="dialog" aria-labelledby="addtoBasketLabel[% basket.basketno %]" aria-hidden="true" data-basketno="[% basket.basketname %]">
+                                                <div id="addtoBasket[% basket.basketno | html %]" class="modal" tabindex="-1" role="dialog" aria-labelledby="addtoBasketLabel[% basket.basketno | html %]" aria-hidden="true" data-basketno="[% basket.basketname | html %]">
                                                     <div class="modal-dialog">
                                                     <div class="modal-content">
                                                     <div class="modal-body">
 </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script>
         $(document).ready(function() {
index 1cd5bea..667be18 100644 (file)
@@ -9,8 +9,8 @@
 <div id="breadcrumbs">
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% basket.bookseller.id %]">[% basket.bookseller.name | html %]</a> &rsaquo;
-    <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno %]">Basket [% basket.basketname | html %] ([% basket.basketno %]) for [% basket.bookseller.name | html %]</a> &rsaquo;
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% basket.bookseller.id | html %]">[% basket.bookseller.name | html %]</a> &rsaquo;
+    <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basket.basketno | html %]">Basket [% basket.basketname | html %] ([% basket.basketno | html %]) for [% basket.bookseller.name | html %]</a> &rsaquo;
     Cancel order
 </div>
 
@@ -21,7 +21,7 @@
       [% UNLESS ( confirmcancel ) %]
       <form method="post" action="">
         <div class="dialog alert">
-          <h3>Are you sure you want to cancel this order ([% ordernumber %])</h3>
+          <h3>Are you sure you want to cancel this order ([% ordernumber | html %])</h3>
           <p>
             [% IF (del_biblio) %]
               Bibliographic record will be deleted too.
             [% PROCESS 'av-build-dropbox.inc' name="reason", category="ORDER_CANCELLATION_REASON" default="0" %]
           </p>
           <input type="hidden" name="action" value="confirmcancel" />
-          <input type="hidden" value="[% ordernumber %]" name="ordernumber" />
-          <input type="hidden" value="[% biblionumber %]" name="biblionumber" />
-          <input type="hidden" value="[% basket.basketno %]" name="basketno" />
-          <input type="hidden" value="[% referrer %]" name="referrer" />
+          <input type="hidden" value="[% ordernumber | html %]" name="ordernumber" />
+          <input type="hidden" value="[% biblionumber | html %]" name="biblionumber" />
+          <input type="hidden" value="[% basket.basketno | html %]" name="basketno" />
+          <input type="hidden" value="[% referrer | html %]" name="referrer" />
           [% IF (del_biblio) %]
             <input type="hidden" value="1" name="del_biblio" />
           [% END %]
           <button type="submit" class="approve" accesskey="y"><i class="fa fa-fw fa-check"></i> Yes, cancel (Y)</button>
-          <button class="deny" accesskey="n" onclick="window.location='[% referrer %]';return false;"><i class="fa fa-fw fa-remove"></i> No, don't cancel (N)</button>
+          <button class="deny" accesskey="n" onclick="window.location='[% referrer | html %]';return false;"><i class="fa fa-fw fa-remove"></i> No, don't cancel (N)</button>
         </div>
       </form>
       [% ELSE %]
@@ -58,7 +58,7 @@
                 <p>The order has been cancelled, although the record has not been deleted.</p>
                 [% END %]
         [% END %]
-                <p><a href="[% referrer %]">OK</a></p>
+                <p><a href="[% referrer | html %]">OK</a></p>
             </div>
       [% END %]
 
index ea32c7e..e37637e 100644 (file)
@@ -5,19 +5,19 @@
 [%- INCLUDE empty_line.inc -%]
 
 [%- FOREACH r IN rows -%]
-"[% r.contractname %]"[%- delimiter -%]
-[% r.ordernumber %][%- delimiter -%]
-[% r.entrydate %][%- delimiter -%]
-[% r.isbn %][%- delimiter -%]
-"[% r.author %]"[%- delimiter -%]
-"[% r.title %]"[%- delimiter -%]
-[% r.publicationyear %][%- delimiter -%]
-"[% r.publishercode %]"[%- delimiter -%]
-"[% r.collectiontitle %]"[%- delimiter -%]
-"[% r.notes %]"[%- delimiter -%]
-[% r.quantity %][%- delimiter -%]
-[% r.rrp %][%- delimiter -%]
-"[% r.deliveryplace %]"[%- delimiter -%]
-"[% r.billingplace %]"
+"[% r.contractname | html %]"[%- delimiter | html -%]
+[% r.ordernumber | html %][%- delimiter | html -%]
+[% r.entrydate | html %][%- delimiter | html -%]
+[% r.isbn | html %][%- delimiter | html -%]
+"[% r.author | html %]"[%- delimiter | html -%]
+"[% r.title | html %]"[%- delimiter | html -%]
+[% r.publicationyear | html %][%- delimiter | html -%]
+"[% r.publishercode | html %]"[%- delimiter | html -%]
+"[% r.collectiontitle | html %]"[%- delimiter | html -%]
+"[% r.notes | html %]"[%- delimiter | html -%]
+[% r.quantity | html %][%- delimiter | html -%]
+[% r.rrp | html %][%- delimiter | html -%]
+"[% r.deliveryplace | html %]"[%- delimiter | html -%]
+"[% r.billingplace | html %]"
 [%- INCLUDE empty_line.inc -%]
 [%- END -%]
index f3715ca..423d145 100644 (file)
@@ -6,31 +6,31 @@
 [%- INCLUDE empty_line.inc -%]
 
 [%- FOREACH r IN rows -%]
-[% r.clientnumber %][%- delimiter -%]
-"[% r.basketname %]"[%- delimiter -%]
-[% r.ordernumber %][%- delimiter -%]
-"[% r.author %]"[%- delimiter -%]
-"[% r.title %]"[%- delimiter -%]
-"[% r.publishercode %]"[%- delimiter -%]
-[% r.publicationyear %][%- delimiter -%]
-"[% r.collectiontitle %]"[%- delimiter -%]
-[% r.isbn %][%- delimiter -%]
-[% r.quantity %][%- delimiter -%]
-[% r.rrp_tax_included | $Price %][%- delimiter -%]
-[% r.rrp_tax_excluded | $Price %][%- delimiter -%]
-[% r.discount %][%- delimiter -%]
-[% r.ecost_tax_included | $Price %][%- delimiter -%]
-[% r.ecost_tax_excluded | $Price %][%- delimiter -%]
-"[% r.notes %]"[%- delimiter -%]
-[% r.entrydate %][%- delimiter -%]
-"[% r.booksellername %]"[%- delimiter -%]
-"[% r.bookselleraddress %]"[%- delimiter -%]
-"[% r.booksellerpostal %]"[%- delimiter -%]
-[% r.contractnumber %][%- delimiter -%]
-"[% r.contractname %]"[%- delimiter -%]
-"[% r.basketgroupdeliveryplace %]"[%- delimiter -%]
-"[% r.basketgroupbillingplace %]"[%- delimiter -%]
-"[% r.basketdeliveryplace %]"[%- delimiter -%]
-"[% r.basketbillingplace %]"
+[% r.clientnumber | html %][%- delimiter | html -%]
+"[% r.basketname | html %]"[%- delimiter | html -%]
+[% r.ordernumber | html %][%- delimiter | html -%]
+"[% r.author | html %]"[%- delimiter | html -%]
+"[% r.title | html %]"[%- delimiter | html -%]
+"[% r.publishercode | html %]"[%- delimiter | html -%]
+[% r.publicationyear | html %][%- delimiter | html -%]
+"[% r.collectiontitle | html %]"[%- delimiter | html -%]
+[% r.isbn | html %][%- delimiter | html -%]
+[% r.quantity | html %][%- delimiter | html -%]
+[% r.rrp_tax_included | $Price | html %][%- delimiter | html -%]
+[% r.rrp_tax_excluded | $Price | html %][%- delimiter | html -%]
+[% r.discount | html %][%- delimiter | html -%]
+[% r.ecost_tax_included | $Price | html %][%- delimiter | html -%]
+[% r.ecost_tax_excluded | $Price | html %][%- delimiter | html -%]
+"[% r.notes | html %]"[%- delimiter | html -%]
+[% r.entrydate | html %][%- delimiter | html -%]
+"[% r.booksellername | html %]"[%- delimiter | html -%]
+"[% r.bookselleraddress | html %]"[%- delimiter | html -%]
+"[% r.booksellerpostal | html %]"[%- delimiter | html -%]
+[% r.contractnumber | html %][%- delimiter | html -%]
+"[% r.contractname | html %]"[%- delimiter | html -%]
+"[% r.basketgroupdeliveryplace | html %]"[%- delimiter | html -%]
+"[% r.basketgroupbillingplace | html %]"[%- delimiter | html -%]
+"[% r.basketdeliveryplace | html %]"[%- delimiter | html -%]
+"[% r.basketbillingplace | html %]"
 [%- INCLUDE empty_line.inc -%]
 [%- END -%]
index 7a62124..68b2467 100644 (file)
@@ -6,17 +6,17 @@
 [%- INCLUDE empty_line.inc -%]
 
 [%- FOREACH o IN orders -%]
-"[% o.orderdate %] ([% o.latesince %] days)"[%- delimiter -%]
-"[% o.estimateddeliverydate | $KohaDates %]"[%- delimiter -%]
-"[% o.supplier (o.supplierid) %]"[%- delimiter -%]
-"[% o.title %] [% IF o.author %]Author: [% o.author %].[% END %][% IF o.publisher %]Published by: [% o.publisher %].[% END %]"[%- delimiter -%]
-"[% o.unitpricesupplier %] x [% o.quantity_to_receive %] = [% o.subtotal %] ([% o.budget %])"[%- delimiter -%]
-"[% o.basketname %] ([% o.basketno %])"[%- delimiter -%]
-"[% o.claims_count %]"[%- delimiter -%]
-"[% o.claimed_date %]"
+"[% o.orderdate | html %] ([% o.latesince | html %] days)"[%- delimiter | html -%]
+"[% o.estimateddeliverydate | $KohaDates %]"[%- delimiter | html -%]
+"[% o.supplier (o.supplierid) | html %]"[%- delimiter | html -%]
+"[% o.title | html %] [% IF o.author %]Author: [% o.author | html %].[% END %][% IF o.publisher %]Published by: [% o.publisher | html %].[% END %]"[%- delimiter | html -%]
+"[% o.unitpricesupplier | html %] x [% o.quantity_to_receive | html %] = [% o.subtotal | html %] ([% o.budget | html %])"[%- delimiter | html -%]
+"[% o.basketname | html %] ([% o.basketno | html %])"[%- delimiter | html -%]
+"[% o.claims_count | html %]"[%- delimiter | html -%]
+"[% o.claimed_date | html %]"
 [%- INCLUDE empty_line.inc -%]
 [%- END -%]
-[%- delimiter -%]
-[%- delimiter -%]
-"Total orders in late"[%- delimiter -%]
-[% orders.size %]
\ No newline at end of file
+[%- delimiter | html -%]
+[%- delimiter | html -%]
+"Total orders in late"[%- delimiter | html -%]
+[% orders.size | html %]
index 12543e3..e8b1dfe 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; Basket ([% basketno %])</title>
+<title>Koha &rsaquo; Acquisitions &rsaquo; Basket ([% basketno | html %])</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
 </head>
@@ -7,7 +7,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Basket ([% basketno %])</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Basket ([% basketno | html %])</div>
 
 <div class="main container-fluid">
     <div class="row">
          <p>Select ordering library account: </p>
          <select id="ean" name="ean">
              [% FOREACH eanacct IN eans %]
-             <option value="[% eanacct.ean %]">[% eanacct.branch.branchname %] ([% eanacct.ean %]) [% IF eanacct.description %][[% eanacct.description %]][% END %]</option>
+             <option value="[% eanacct.ean | html %]">[% eanacct.branch.branchname | html %] ([% eanacct.ean | html %]) [% IF eanacct.description %][[% eanacct.description | html %]][% END %]</option>
              [% END %]
         </select>
-        <input type="hidden" id="basketno" value="[% basketno %]" name="basketno" />
+        <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
         <input type="hidden" value="ediorder" name="op" />
         <p>
             <input type="submit" value="Send EDI order" />
index bdf9faf..c730c7c 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; EDIFACT messages</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css">
 #EDI_modal { width : 80%; } @media (max-width: 767px) { #EDI_modal { margin: 0; width : auto; } }
 <tbody>
 [% FOREACH msg IN messages %]
 <tr>
-<td>[% msg.message_type %]</td>
-<td><span title="[% msg.transfer_date %]">[% msg.transfer_date | $KohaDates %]</span></td>
-<td>[% msg.status %]</td>
+<td>[% msg.message_type | html %]</td>
+<td><span title="[% msg.transfer_date | html %]">[% msg.transfer_date | $KohaDates %]</span></td>
+<td>[% msg.status | html %]</td>
 <td>
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% msg.vendor_id %]">
-        [% msg.vendor.name %]
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% msg.vendor_id | html %]">
+        [% msg.vendor.name | html %]
     </a>
 </td>
 <td>
 [% IF msg.message_type == 'QUOTE' || msg.message_type == 'ORDERS' %]
     [% IF msg.basketno %]
-    <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% msg.basketno.basketno %]">
-    Basket: [% msg.basketno.basketno %]
+    <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% msg.basketno.basketno | html %]">
+    Basket: [% msg.basketno.basketno | html %]
     </a>
     [% END %]
 [% ELSE %]
 <!-- Assuming invoices -->
-     <a href="/cgi-bin/koha/acqui/invoices.pl?message_id=[% msg.id %]">
+     <a href="/cgi-bin/koha/acqui/invoices.pl?message_id=[% msg.id | html %]">
       Invoices
      </a>
 [% END %]
 </td>
-<td>[% msg.filename %]</td>
+<td>[% msg.filename | html %]</td>
 
 <td class="actions">
-    <a class="btn btn-default btn-xs view_message" target="_blank" href="/cgi-bin/koha/acqui/edimsg.pl?id=[% msg.id %]"><i class="fa fa-search"></i> View message</a>
-    <a class="btn btn-default btn-xs delete_msg" href="/cgi-bin/koha/acqui/edifactmsgs.pl?op=delete&amp;message_id=[% msg.id %]"><i class="fa fa-trash"></i> Delete</a>
+    <a class="btn btn-default btn-xs view_message" target="_blank" href="/cgi-bin/koha/acqui/edimsg.pl?id=[% msg.id | html %]"><i class="fa fa-search"></i> View message</a>
+    <a class="btn btn-default btn-xs delete_msg" href="/cgi-bin/koha/acqui/edifactmsgs.pl?op=delete&amp;message_id=[% msg.id | html %]"><i class="fa fa-trash"></i> Delete</a>
 </td>
 </tr>
 [% END %]
@@ -87,7 +88,7 @@
         <h3 id="EDI_modal_label">EDIFACT message</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
 </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script>
         $(document).ready(function() {
                 EDIModal.modal("hide");
             });
             EDIModal.on("hidden", function(){
-                EDIModalBody.html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                EDIModalBody.html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
             $(".delete_msg").on("click",function(){
                 return confirm(_("Are you sure you want to delete this message?"));
index 8499d90..024222a 100644 (file)
@@ -1,11 +1,42 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE ColumnsSettings %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; [% IF ( order_loop ) %]Orders search &rsaquo; Search results[% ELSE %]Order search[% END %]</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
+[% INCLUDE 'calendar.inc' %]
+[% INCLUDE 'datatables.inc' %]
+[% INCLUDE 'columns_settings.inc' %]
+
+<script type="text/javascript" src="[% interface | html %]/js/autocomplete/patrons.js"></script>
+<script type="text/javascript">
+//<![CDATA[
+var MSG_REMOVE_PATRON = _("Remove");
+ $(document).ready(function() {
+    var columns_settings = [% ColumnsSettings.GetColumns( 'acqui', 'histsearch', 'histsearcht', 'json' ) | $raw %];
+    KohaTable("#histsearcht", {
+        "aoColumnDefs": [
+            { "sType": "anti-the", "aTargets" : [ "anti-the" ] },
+            { "sType": "title-string", "aTargets" : [ "title-string" ] }
+        ],
+        "sPaginationType": "four_button"
+    }, columns_settings );
+
+    [% UNLESS order_loop %]
+        patron_autocomplete({
+            patron_container: $("#basket_creators"),
+            input_autocomplete: $("#find_patron"),
+            patron_input_name: 'created_by',
+            field_to_retrieve: 'borrowernumber'
+        });
+    [% END %]
+});
+
+ //]]>
+</script>
 </head>
 
 <body id="acq_histsearch" class="acq">
 <fieldset class="rows">
     <legend>Search orders</legend>
                <ol>
-               <li><label for="title">Title: </label> <input type="text" name="title" id="title" value="[% title %]" /></li>
-               <li><label for="author">Author: </label> <input type="text" name="author" id="author" value="[% author %]" /></li>
-        <li><label for="isbn">ISBN: </label> <input type="text" name="isbn" id="isbn" value="[% isbn %]" /></li>
+               <li><label for="title">Title: </label> <input type="text" name="title" id="title" value="[% title | html %]" /></li>
+               <li><label for="author">Author: </label> <input type="text" name="author" id="author" value="[% author | html %]" /></li>
+        <li><label for="isbn">ISBN: </label> <input type="text" name="isbn" id="isbn" value="[% isbn | html %]" /></li>
                 [% IF (UNIMARC) %]
-        <li><label for="ean">EAN: </label> <input type="text" name="ean" id="ean" value="[% ean %]" /></li>
+        <li><label for="ean">EAN: </label> <input type="text" name="ean" id="ean" value="[% ean | html %]" /></li>
                 [% END %]
-               <li><label for="name">Vendor: </label> <input type="text" name="name" id="name" value="[% name %]" /></li>
-               <li><label for="basket">Basket: </label> <input type="text" name="basket" id="basket" value="[% basket %]" /></li>
+               <li><label for="name">Vendor: </label> <input type="text" name="name" id="name" value="[% name | html %]" /></li>
+               <li><label for="basket">Basket: </label> <input type="text" name="basket" id="basket" value="[% basket | html %]" /></li>
         <li><label for="basket_creators">Basket created by: </label>
             <input autocomplete="off" id="find_patron" type="text" style="width:150px" class="noEnterSubmit" />
             <div>
                 <div id="basket_creators" style="float:left;"></div>
             </div>
         </li>
-        <li><label for="booksellerinvoicenumber ">Bookseller invoice no: </label> <input type="text" name="booksellerinvoicenumber" id="booksellerinvoicenumber" value="[% booksellerinvoicenumber %]" /></li>
+        <li><label for="booksellerinvoicenumber ">Bookseller invoice no: </label> <input type="text" name="booksellerinvoicenumber" id="booksellerinvoicenumber" value="[% booksellerinvoicenumber | html %]" /></li>
         <li>
             <label for="basketgroupname">Basket group:</label>
-            <input type="text" name="basketgroupname" id="basketgroupname" value="[% basketgroupname %]" />
+            <input type="text" name="basketgroupname" id="basketgroupname" value="[% basketgroupname | html %]" />
         </li>
         <li>
           <label for="ordernumber">Order line:</label>
-          <input type="text" name="ordernumber" id="ordernumber" value="[% ordernumber %]" />
+          <input type="text" name="ordernumber" id="ordernumber" value="[% ordernumber | html %]" />
           [% IF search_children_too %]
             <input type="checkbox" name="search_children_too" id="search_children_too" value="1" checked="checked" />
           [% ELSE %]
             <select name="budget" id="fund">
                 <option value="">All funds</option>
                 [% FOREACH bp_loo IN bp_loop %]
-                    <optgroup label="[% bp_loo.budget_period_description %]">
+                    <optgroup label="[% bp_loo.budget_period_description | html %]">
                     [% FOREACH h_loo IN bp_loo.hierarchy %]
                       [% IF h_loo.budget_id == budget_id %]
-                        <option type="text" value="[% h_loo.budget_id %]" branchcode="[% h_loo.budget_branchcode %]" selected="selected">
+                        <option type="text" value="[% h_loo.budget_id | html %]" branchcode="[% h_loo.budget_branchcode | html %]" selected="selected">
                       [% ELSE %]
-                        <option type="text" value="[% h_loo.budget_id %]" branchcode="[% h_loo.budget_branchcode %]">
+                        <option type="text" value="[% h_loo.budget_id | html %]" branchcode="[% h_loo.budget_branchcode | html %]">
                       [% END %]
-                            [% h_loo.budget_display_name %]
+                            [% h_loo.budget_display_name | html %]
                         </option>
                     [% END %]
                     </optgroup>
             [% FOREACH order IN order_loop %]
                 <tr>
                     <td>
-                        [% order.ordernumber %]
-                        [% IF order.ordernumber != order.parent_ordernumber %]([% order.parent_ordernumber %])[% END %]
+                        [% order.ordernumber | html %]
+                        [% IF order.ordernumber != order.parent_ordernumber %]([% order.parent_ordernumber | html %])[% END %]
                     </td>
                     <td>
                         [% SWITCH order.orderstatus %]
                             [% CASE 'cancelled' %]Cancelled
                         [% END %]
                     </td>
-                    <td>[% order.basketname %] (<a href="basket.pl?basketno=[% order.basketno %]">[% order.basketno %]</a>)</td>
-                    <td>[% order.authorisedbyname %]</td>
+                    <td>[% order.basketname | html %] (<a href="basket.pl?basketno=[% order.basketno | html %]">[% order.basketno | html %]</a>)</td>
+                    <td>[% order.authorisedbyname | html %]</td>
                     <td>
                         [% IF ( order.basketgroupid ) %]
-                            [% order.groupname %] (<a href="basketgroup.pl?op=add&booksellerid=[% order.id %]&basketgroupid=[% order.basketgroupid %]">[% order.basketgroupid %]</a>)
+                            [% order.groupname | html %] (<a href="basketgroup.pl?op=add&booksellerid=[% order.id | html %]&basketgroupid=[% order.basketgroupid | html %]">[% order.basketgroupid | html %]</a>)
                         [% ELSE %]
                             &nbsp;
                         [% END %]
                     </td>
                     <td>[% IF ( order.invoicenumber ) %]
-                            <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% order.invoiceid %]">[% order.invoicenumber %]</a>
+                            <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% order.invoiceid | html %]">[% order.invoicenumber | html %]</a>
                         [% ELSE %]
                             &nbsp;
                         [% END %]
                     </td>
                     <td>
-                        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber %]">[% order.title |html %]</a>
-                        <br />[% order.author %] <br /> [% order.isbn %]
+                        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber | html %]">[% order.title | html %]</a>
+                        <br />[% order.author | html %] <br /> [% order.isbn | html %]
                     </td>
-                    <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.id %]">[% order.name %]</a></td>
-                    <td><span title="[% order.creationdate %]">[% order.creationdate | $KohaDates %]</span></td>
+                    <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.id | html %]">[% order.name | html %]</a></td>
+                    <td><span title="[% order.creationdate | html %]">[% order.creationdate | $KohaDates %]</span></td>
                     <td>
                         [% IF order.datereceived %]
-                            <span title="[% order.datereceived %]">[% order.datereceived | $KohaDates %]</span>
+                            <span title="[% order.datereceived | html %]">[% order.datereceived | $KohaDates %]</span>
                         [% ELSE %]
                             <span title="0000-00-00"></span>
                         [% END %]
                     </td>
-                    <td>[% order.quantityreceived %]</td>
-                    <td>[% order.quantity %]</td>
-                    <td>[% order.ecost %]</td>
-                    <td>[% order.budget_name %]</td>
+                    <td>[% order.quantityreceived | html %]</td>
+                    <td>[% order.quantity | html %]</td>
+                    <td>[% order.ecost | html %]</td>
+                    <td>[% order.budget_name | html %]</td>
                 </tr>
             [% END %]
             </tbody>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
 [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("js/autocomplete/patrons.js") %]
+    [% Asset.js("js/autocomplete/patrons.js") | $raw %]
     <script>
         var MSG_REMOVE_PATRON = _("Remove");
         $(document).ready(function() {
-            var columns_settings = [% ColumnsSettings.GetColumns( 'acqui', 'histsearch', 'histsearcht', 'json' ) %];
+            var columns_settings = [% ColumnsSettings.GetColumns( 'acqui', 'histsearch', 'histsearcht', 'json' ) | $raw %];
             KohaTable("histsearcht", {
                 "aoColumnDefs": [
                     { "sType": "anti-the", "aTargets" : [ "anti-the" ] },
index b139404..ed32bc4 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Invoice &rsaquo; Files</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -11,7 +12,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid %]">[% invoicenumber %]</a> &rsaquo; Files</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">[% invoicenumber | html %]</a> &rsaquo; Files</div>
 
 <div class="main container-fluid">
     <div class="row">
@@ -19,7 +20,7 @@
             <main>
 
       <h2>Files for invoice: [% invoicenumber | html %]</h2>
-      <p><b>Vendor: </b><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% suppliername %]</a></p>
+      <p><b>Vendor: </b><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% suppliername | html %]</a></p>
       <br />
       [% IF errors %]
         <div class="dialog alert">
               <tbody>
                 [% FOREACH f IN files %]
                   <tr>
-                      <td><a href="?invoiceid=[% invoiceid %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id %]">[% f.file_name | html %]</a></td>
+                      <td><a href="?invoiceid=[% invoiceid | html %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | html %]">[% f.file_name | html %]</a></td>
                       <td>[% f.file_type | html %]</td>
                       <td>[% f.file_description | html %]</td>
                       <td class="title-string">
-                        <span title="[% f.date_uploaded %]">[% f.date_uploaded | $KohaDates %]</span>
+                        <span title="[% f.date_uploaded | html %]">[% f.date_uploaded | $KohaDates %]</span>
                       </td>
-                      <td>[% f.file_size %]</td>
-                      <td><a class="delete_file" href="?invoiceid=[% invoiceid %]&amp;op=delete&amp;file_id=[% f.file_id %]">Delete</a></td>
-                      <td><a href="?invoiceid=[% invoiceid %]&amp;op=download&amp;file_id=[% f.file_id %]">Download</a></td>
+                      <td>[% f.file_size | html %]</td>
+                      <td><a class="delete_file" href="?invoiceid=[% invoiceid | html %]&amp;op=delete&amp;file_id=[% f.file_id | html %]">Delete</a></td>
+                      <td><a href="?invoiceid=[% invoiceid | html %]&amp;op=download&amp;file_id=[% f.file_id | html %]">Download</a></td>
                   </tr>
                 [% END %]
               </tbody>
@@ -69,7 +70,7 @@
                   <legend>Upload New File</legend>
                   <ol>
                       <li><input type="hidden" name="op" value="upload" />
-                      <input type="hidden" name="invoiceid" value="[% invoiceid %]" />
+                      <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
                       <label for="description">Description:</label>
                       <input name="description" id="description" type="text" /></li>
                       <li><label for="uploadfile">File:</label><input name="uploadfile" type="file" id="uploadfile" /></li>
@@ -89,7 +90,7 @@
 </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script>
         $(document).ready(function() {
index 85a23c5..aa5770f 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -7,7 +8,7 @@
 
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Invoice</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -15,7 +16,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid %]">[% invoicenumber %]</a></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoices.pl">Invoices</a> &rsaquo; <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">[% invoicenumber | html %]</a></div>
 
 <div class="main container-fluid">
     <div class="row">
           <p>Invoice has been modified</p>
         </div>
       [% END %]
-      <h1>Invoice: [% invoicenumber %]</h1>
+      <h1>Invoice: [% invoicenumber | html %]</h1>
 
-      <p>Vendor: <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% suppliername %]</a></p>
+      <p>Vendor: <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% suppliername | html %]</a></p>
         <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
         <fieldset class="rows">
             <ol>
             <li>
                 <label for="shipmentdate" class="required">Invoice number:</label>
-                <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber %]" class="required" required="required"/>
+                <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="required" required="required"/>
                 <span class="required">Required</span>
             </li>
 
                     <input type="text" size="10" id="billingdate" name="billingdate" value="[% billingdate | $KohaDates %]" class="datepicker" /></li>
 
             <li><label for="shipmentcost">Shipping cost:</label>
-                    <input type="text" size="10" id="shipmentcost" name="shipmentcost" value="[% shipmentcost %]" /></li>
+                    <input type="text" size="10" id="shipmentcost" name="shipmentcost" value="[% shipmentcost | html %]" /></li>
             <li><label for="shipment_budget_id">Shipping fund:</label>
                     <select id="shipment_budget_id" name="shipment_budget_id">
                         <option value="">No fund</option>
                       [% FOREACH budget IN budgets_loop %]
                         [% IF ( budget.selected ) %]
-                          <option selected="selected" value="[% budget.budget_id %]">
+                          <option selected="selected" value="[% budget.budget_id | html %]">
                         [% ELSE %]
-                          <option value="[% budget.budget_id %]">
+                          <option value="[% budget.budget_id | html %]">
                         [% END %]
-                          [% budget.budget_name %]
+                          [% budget.budget_name | html %]
                         </option>
                       [% END %]
                     </select></li>
             [% END %]
             </ol>
           <input type="hidden" name="op" value="mod" />
-          <input type="hidden" name="invoiceid" value="[% invoiceid %]" />
+          <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
             <fieldset class="action">
                 <input type="submit" value="Save" />
                 [% UNLESS orders_loop.size %]
-                <a href="invoice.pl?op=delete&invoiceid=[% invoiceid %]" id="delete">Delete</a>
+                <a href="invoice.pl?op=delete&invoiceid=[% invoiceid | html %]" id="delete">Delete</a>
                 [% END %]
             </fieldset>
         </fieldset>
@@ -91,7 +92,7 @@
 
           <form action="/cgi-bin/koha/acqui/invoice.pl" method="post" class="validated">
               <fieldset class="rows">
-                  <input type="hidden" name="invoiceid" value="[% invoiceid %]" />
+                  <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
                   [% IF (adjustments && adjustments.count > 0) %]
                       <table id="invoice_adj_table">
                           <tr>
                              <th>Encumber while invoice open</th>
                              <th>&nbsp</th>
                           </tr>
-                          [% total_adj = 0 %]
+                          [% total_adj = 0 | html %]
                           [% FOREACH adjustment IN adjustments %]
-                              [% total_adj = total_adj + adjustment.adjustment %]
+                              [% total_adj = total_adj + adjustment.adjustment | html %]
                               <tr>
-                                  <td><input type="hidden" name="adjustment_id" value="[% adjustment.adjustment_id %]" />[% adjustment.adjustment_id %]</td>
-                                  <td><input type="text" name="adjustment" id="adjustment_[% adjustment.adjustment_id %]" value="[% adjustment.adjustment | $Price %]" /></td>
+                                  <td><input type="hidden" name="adjustment_id" value="[% adjustment.adjustment_id | html %]" />[% adjustment.adjustment_id | html %]</td>
+                                  <td><input type="text" name="adjustment" id="adjustment_[% adjustment.adjustment_id | html %]" value="[% adjustment.adjustment | $Price | html %]" /></td>
                                   <td>
-                                      [% reasons = AuthorisedValues.Get("ADJ_REASON") %]
+                                      [% reasons = AuthorisedValues.Get("ADJ_REASON") | html %]
                                       [% IF reasons.0 %]
-                                          <select id="reason_[% adjustment.adjustment_id %]" name="reason">
+                                          <select id="reason_[% adjustment.adjustment_id | html %]" name="reason">
                                               <option value="">No reason</option>
                                               [% FOREACH reason IN reasons %]
                                                   [% IF ( adjustment.reason == reason.authorised_value ) %]
-                                                      <option selected="selected" value="[% reason.authorised_value %]">
+                                                      <option selected="selected" value="[% reason.authorised_value | html %]">
                                                   [% ELSE %]
-                                                      <option value="[% reason.authorised_value %]">
+                                                      <option value="[% reason.authorised_value | html %]">
                                                   [% END %]
-                                                  [% reason.lib %]
+                                                  [% reason.lib | html %]
                                                   </option>
                                               [% END %]
                                           </select>
                                       [% ELSE %]
                                           <p title="Define values in authorised value category ADJ_REASON to enable">None</p>
-                                          <input type="hidden" name="reason" id="reason_[% adjustment.adjustment_id %]" value="" />
+                                          <input type="hidden" name="reason" id="reason_[% adjustment.adjustment_id | html %]" value="" />
                                   [% END %]
                                   </td>
-                                  <td><input type="text" name="note" id="note_new" value="[% adjustment.note %]"/></td>
+                                  <td><input type="text" name="note" id="note_new" value="[% adjustment.note | html %]"/></td>
                                   <td>
-                                      <select id="budget_id_[% adjustment.adjustment_id %]" name="budget_id">
+                                      <select id="budget_id_[% adjustment.adjustment_id | html %]" name="budget_id">
                                               <option value="">No fund</option>
                                           [% FOREACH budget IN budgets_loop %]
                                               [% IF ( budget.budget_id == adjustment.budget_id ) %]
-                                                  <option selected="selected" value="[% budget.budget_id %]">
+                                                  <option selected="selected" value="[% budget.budget_id | html %]">
                                               [% ELSE %]
-                                                  <option value="[% budget.budget_id %]">
+                                                  <option value="[% budget.budget_id | html %]">
                                               [% END %]
-                                              [% budget.budget_name %]
+                                              [% budget.budget_name | html %]
                                               </option>
                                           [% END %]
                                       </select>
                                   </td>
                                   [% IF adjustment.encumber_open %]
                                       <td>
-                                          <input type="checkbox" name="encumber_open" id="encumber_[% adjustment.adjustment_id %]"  value="[% adjustment.adjustment_id %]" checked/>
+                                          <input type="checkbox" name="encumber_open" id="encumber_[% adjustment.adjustment_id | html %]"  value="[% adjustment.adjustment_id | html %]" checked/>
                                       </td>
                                   [% ELSE %]
                                       <td>
-                                          <input type="checkbox" name="encumber_open" id="encumber_[% adjustment.adjustment_id %]"  value="[% adjustment.adjustment_id %]" />
+                                          <input type="checkbox" name="encumber_open" id="encumber_[% adjustment.adjustment_id | html %]"  value="[% adjustment.adjustment_id | html %]" />
                                       </td>
                                   [% END %]
                                   <td>
-                                     <a class="btn btn-default btn-xs delete_adjustment" href="/cgi-bin/koha/acqui/invoice.pl?op=del_adj&adjustment_id=[% adjustment.adjustment_id %]&invoiceid=[% invoiceid %]"><i class="fa fa-trash"></i> Delete</a>
+                                     <a class="btn btn-default btn-xs delete_adjustment" href="/cgi-bin/koha/acqui/invoice.pl?op=del_adj&adjustment_id=[% adjustment.adjustment_id | html %]&invoiceid=[% invoiceid | html %]"><i class="fa fa-trash"></i> Delete</a>
                                   </td>
                               </tr>
                           [% END %]
                                   <label for="adjustment_new">Amount: </label>
                                   <input type="text" name="adjustment" id="adjustment_new" />
                               </li>
-                              [% reasons = AuthorisedValues.Get("ADJ_REASON") %]
+                              [% reasons = AuthorisedValues.Get("ADJ_REASON") | html %]
                               [% IF reasons.0 %]
                                   <li>
-                                      <label for="reason_[% adjustment.adjustment_id %]">Reason: </label>
-                                      <select id="reason_[% adjustment.adjustment_id %]" name="reason">
+                                      <label for="reason_[% adjustment.adjustment_id | html %]">Reason: </label>
+                                      <select id="reason_[% adjustment.adjustment_id | html %]" name="reason">
                                           <option value="">No reason</option>
                                           [% FOREACH reason IN reasons %]
-                                              <option value="[% reason.authorised_value %]">
-                                                  [% reason.lib %]
+                                              <option value="[% reason.authorised_value | html %]">
+                                                  [% reason.lib | html %]
                                               </option>
                                           [% END %]
                                       </select>
                                   <select id="budget_id_new" name="budget_id">
                                       <option selected="selected" value="">No fund</option>
                                       [% FOREACH budget IN budgets_loop %]
-                                          <option value="[% budget.budget_id %]">
-                                          [% budget.budget_name %]
+                                          <option value="[% budget.budget_id | html %]">
+                                          [% budget.budget_name | html %]
                                           </option>
                                       [% END %]
                                   </select>
                   </fieldset>
               </form>
       <p>
-          <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid %]">Go to receipt page</a>
-          [% IF Koha.Preference('AcqEnableFiles') %]| <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid %]">Manage invoice files</a>[% END %]
+          <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid | html %]">Go to receipt page</a>
+          [% IF Koha.Preference('AcqEnableFiles') %]| <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | html %]">Manage invoice files</a>[% END %]
       </p>
       <h2>Invoice details</h2>
       <fieldset>
                 <th class="tax_excluded">Actual cost tax exc.</th>
                 <th class="tax_included">Actual cost tax inc.</th>
                 <th>Qty.</th>
-                <th class="tax_excluded">Total tax exc. ([% currency.symbol %])</th>
-                <th class="tax_included">Total tax inc. ([% currency.symbol %])</th>
+                <th class="tax_excluded">Total tax exc. ([% currency.symbol | html %])</th>
+                <th class="tax_included">Total tax inc. ([% currency.symbol | html %])</th>
                 <th>GST %</th>
                 <th>GST</th>
                 <th>Fund</th>
                 <tr>
                   <td>
                     [% IF order.biblionumber %]
-                      <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber %]">[% order.title |html %]</a>
+                      <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber | html %]">[% order.title | html %]</a>
                       [% IF ( order.author ) %]
-                        <br /><em>by</em> [% order.author %]
+                        <br /><em>by</em> [% order.author | html %]
                       [% END %]
                     [% ELSE %]
                       <em>Deleted bibliographic record, can't find title</em>
                     [% END %]
-                    [% IF ( order.isbn ) %] &ndash; [% order.isbn %][% END %]
+                    [% IF ( order.isbn ) %] &ndash; [% order.isbn | html %][% END %]
                     [% IF ( order.publishercode ) %]
-                      <br/>[% order.publishercode %]
-                        [% IF order.publicationyear %], [% order.publicationyear %]
-                        [% ELSIF ( order.copyrightdate ) %][% order.copyrightdate %][% END %]
+                      <br/>[% order.publishercode | html %]
+                        [% IF order.publicationyear %], [% order.publicationyear | html %]
+                        [% ELSIF ( order.copyrightdate ) %][% order.copyrightdate | html %][% END %]
                     [% END %]
                   </td>
-                  <td><p>[% order.branchcode %]</p></td>
-                  <td class="number tax_excluded">[% order.unitprice_tax_excluded | $Price %]</td>
-                  <td class="number tax_included">[% order.unitprice_tax_included | $Price %]</td>
-                  <td class="number">[% order.quantity %]</td>
-                  <td class="number tax_excluded">[% order.total_tax_excluded | $Price %]</td>
-                  <td class="number tax_included">[% order.total_tax_included | $Price %]</td>
-                  <td class="number">[% order.tax_rate * 100 %]</td>
-                  <td class="number">[% order.tax_value | $Price %]</td>
-                  <td>[% order.budget_name %]</td>
+                  <td><p>[% order.branchcode | html %]</p></td>
+                  <td class="number tax_excluded">[% order.unitprice_tax_excluded | $Price | html %]</td>
+                  <td class="number tax_included">[% order.unitprice_tax_included | $Price | html %]</td>
+                  <td class="number">[% order.quantity | html %]</td>
+                  <td class="number tax_excluded">[% order.total_tax_excluded | $Price | html %]</td>
+                  <td class="number tax_included">[% order.total_tax_included | $Price | html %]</td>
+                  <td class="number">[% order.tax_rate * 100 | html %]</td>
+                  <td class="number">[% order.tax_value | $Price | html %]</td>
+                  <td>[% order.budget_name | html %]</td>
                 </tr>
               [% END %]
             </tbody>
             <tfoot>
               [% FOR tf IN foot_loop %]
                 <tr>
-                    <th colspan="2">Total (GST [% tf.tax_rate * 100 %] %)</th>
+                    <th colspan="2">Total (GST [% tf.tax_rate * 100 | html %] %)</th>
                     <th class="tax_excluded"></th>
                     <th class="tax_included"></th>
-                    <th>[% tf.quantity %]</th>
-                    <th class="tax_excluded">[% tf.total_tax_excluded | $Price %]</th>
-                    <th class="tax_included">[% tf.total_tax_included | $Price %]</th>
+                    <th>[% tf.quantity | html %]</th>
+                    <th class="tax_excluded">[% tf.total_tax_excluded | $Price | html %]</th>
+                    <th class="tax_included">[% tf.total_tax_included | $Price | html %]</th>
                     <th>&nbsp;</th>
-                    <th>[% tf.tax_value | $Price %]</th>
+                    <th>[% tf.tax_value | $Price | html %]</th>
                     <th>&nbsp;</th>
                 </tr>
               [% END %]
               <tr>
-                <th colspan="2">Total ([% currency.symbol %])</th>
+                <th colspan="2">Total ([% currency.symbol | html %])</th>
                 <th class="tax_excluded"></th>
                 <th class="tax_included"></th>
-                <th>[% total_quantity %]</th>
-                <th class="tax_excluded">[% total_tax_excluded | $Price %]</th>
-                <th class="tax_included">[% total_tax_included | $Price %]</th>
+                <th>[% total_quantity | html %]</th>
+                <th class="tax_excluded">[% total_tax_excluded | $Price | html %]</th>
+                <th class="tax_included">[% total_tax_included | $Price | html %]</th>
                 <th>&nbsp;</th>
-                <th>[% total_tax_value | $Price %]</th>
+                <th>[% total_tax_value | $Price | html %]</th>
                 <th>&nbsp;</th>
               </tr>
               <tr>
-                <th colspan="2">Total + Adjustments + Shipment cost ([% currency.symbol %])</th>
+                <th colspan="2">Total + Adjustments + Shipment cost ([% currency.symbol | html %])</th>
                 <th class="tax_excluded"></th>
                 <th class="tax_included"></th>
-                <th>[% total_quantity %]</th>
-                <th class="tax_excluded">[% total_tax_excluded_shipment + total_adj | $Price %]</th>
-                <th class="tax_included">[% total_tax_included_shipment | $Price %]</th>
+                <th>[% total_quantity | html %]</th>
+                <th class="tax_excluded">[% total_tax_excluded_shipment + total_adj | $Price | html %]</th>
+                <th class="tax_included">[% total_tax_included_shipment | $Price | html %]</th>
                 <th>&nbsp;</th>
-                <th>[% total_tax_value | $Price %]</th>
+                <th>[% total_tax_value | $Price | html %]</th>
                 <th>&nbsp;</th>
               </tr>
             </tfoot>
         [% ELSE %]
             <div class="dialog message"><p>No orders yet</p>
             [% IF adjustments && adjustments.count > 0 || shipmentcost && shipmentcost > 0 %]
-            <p>Adjustments plus shipping:[% total_adj + shipmentcost | $Price %]</p>
+            <p>Adjustments plus shipping:[% total_adj + shipmentcost | $Price | html %]</p>
             [% END %]
             </div>
         [% END %]
                 <tbody>
                 [% FOREACH f IN files %]
                     <tr>
-                         <td><a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id %]">[% f.file_name | html %]</a></td>
+                         <td><a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | html %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | html %]">[% f.file_name | html %]</a></td>
                          <td>[% f.file_type | html %]</td>
                          <td>[% f.file_description | html %]</td>
                          <td class="title-string">
-                           <span title="[% f.date_uploaded %]">[% f.date_uploaded | $KohaDates %]</span>
+                           <span title="[% f.date_uploaded | html %]">[% f.date_uploaded | $KohaDates %]</span>
                          </td>
                     </tr>
                 [% END %]
 </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script>
index fe65803..af7eee9 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Invoices</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 
 </head>
             </thead>
             <tbody>
               [% FOREACH invoice IN invoices %]
-                <tr data-invoiceid="[% invoice.invoiceid %]" data-booksellerid="[% invoice.booksellerid %]" data-shipmentdate="[% invoice.shipmentdate | $KohaDates %]" data-billingdate="[% invoice.billingdate | $KohaDates %]" data-shipmentcost="[% invoice.shipmentcost %]" data-shipment_budgetid="[% invoice.shipmentcost_budgetid %]" data-closedate="[% invoice.closedate | $KohaDates %]">
-                  <td>[% invoice.is_linked_to_subscriptions %]</td>
-                  <td><input type="checkbox" class="select-invoice" value="[% invoice.invoiceid %]" /></td>
-                  <td><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid %]">[% invoice.invoicenumber %]</a></td>
-                  <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% invoice.booksellerid %]">[% invoice.suppliername %]</a></td>
+                <tr data-invoiceid="[% invoice.invoiceid | html %]" data-booksellerid="[% invoice.booksellerid | html %]" data-shipmentdate="[% invoice.shipmentdate | $KohaDates %]" data-billingdate="[% invoice.billingdate | $KohaDates %]" data-shipmentcost="[% invoice.shipmentcost | html %]" data-shipment_budgetid="[% invoice.shipmentcost_budgetid | html %]" data-closedate="[% invoice.closedate | $KohaDates %]">
+                  <td>[% invoice.is_linked_to_subscriptions | html %]</td>
+                  <td><input type="checkbox" class="select-invoice" value="[% invoice.invoiceid | html %]" /></td>
+                  <td><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid | html %]">[% invoice.invoicenumber | html %]</a></td>
+                  <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% invoice.booksellerid | html %]">[% invoice.suppliername | html %]</a></td>
                   <td>
                     [% IF invoice.shipmentdate %]
-                      <span title="[% invoice.shipmentdate %]">[% invoice.shipmentdate | $KohaDates %]</span>
+                      <span title="[% invoice.shipmentdate | html %]">[% invoice.shipmentdate | $KohaDates %]</span>
                     [% ELSE %]
                       <span title="0000-00-00"></span>
                     [% END %]
                   </td>
                   <td>
                     [% IF invoice.billingdate %]
-                      <span title="[% invoice.billingdate %]">[% invoice.billingdate | $KohaDates %]</span>
+                      <span title="[% invoice.billingdate | html %]">[% invoice.billingdate | $KohaDates %]</span>
                     [% ELSE %]
                       <span title="0000-00-00"></span>
                     [% END %]
                   </td>
-                  <td>[% invoice.receivedbiblios %]</td>
-                  <td>[% invoice.receiveditems %]</td>
+                  <td>[% invoice.receivedbiblios | html %]</td>
+                  <td>[% invoice.receiveditems | html %]</td>
                   <td>
                     [% IF invoice.closedate %]
                       Closed on [% invoice.closedate | $KohaDates %]
                   <td>
 
                       <div class="dropdown dropup">
-                          <a class="btn btn-default btn-xs dropdown-toggle" id="invoiceactions[% invoice.invoiceid %]" role="button" data-toggle="dropdown" href="#">
+                          <a class="btn btn-default btn-xs dropdown-toggle" id="invoiceactions[% invoice.invoiceid | html %]" role="button" data-toggle="dropdown" href="#">
                              Actions <b class="caret"></b>
                           </a>
-                          <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="invoiceactions[% invoice.invoiceid %]">
-                              <li><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid %]"><i class="fa fa-search"></i> Details</a></li>
+                          <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="invoiceactions[% invoice.invoiceid | html %]">
+                              <li><a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoice.invoiceid | html %]"><i class="fa fa-search"></i> Details</a></li>
                             [% IF invoice.closedate %]
-                                <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber %]%26supplier=[% booksellerid %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn %]%26title=[% title %]%26author=[% author %]%26publisher=[% publisher %]%26publicationyear=[% publicationyear %]%26branch=[% branch %]"><i class="fa fa-refresh"></i> Reopen</a></li>
+                                <li><a href="invoice.pl?op=reopen&amp;invoiceid=[% invoice.invoiceid | html %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | html %]%26supplier=[% booksellerid | html %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | html %]%26title=[% title | html %]%26author=[% author | html %]%26publisher=[% publisher | html %]%26publicationyear=[% publicationyear | html %]%26branch=[% branch | html %]"><i class="fa fa-refresh"></i> Reopen</a></li>
                             [% ELSE %]
-                                <li><a href="invoice.pl?op=close&amp;invoiceid=[% invoice.invoiceid %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber %]%26supplier=[% booksellerid %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn %]%26title=[% title %]%26author=[% author %]%26publisher=[% publisher %]%26publicationyear=[% publicationyear %]%26branch=[% branch %]"><i class="fa fa-times-circle"></i> Close</a></li>
+                                <li><a href="invoice.pl?op=close&amp;invoiceid=[% invoice.invoiceid | html %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | html %]%26supplier=[% booksellerid | html %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | html %]%26title=[% title | html %]%26author=[% author | html %]%26publisher=[% publisher | html %]%26publicationyear=[% publicationyear | html %]%26branch=[% branch | html %]"><i class="fa fa-times-circle"></i> Close</a></li>
                             [% END %]
                             [% UNLESS invoice.receivedbiblios || invoice.receiveditems %]
-                                <li><a href="invoice.pl?op=delete&amp;invoiceid=[% invoice.invoiceid %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber %]%26supplier=[% booksellerid %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn %]%26title=[% title %]%26author=[% author %]%26publisher=[% publisher %]%26publicationyear=[% publicationyear %]%26branch=[% branch %]" class="delete_invoice"><i class="fa fa-trash"></i> Delete</a></li>
+                                <li><a href="invoice.pl?op=delete&amp;invoiceid=[% invoice.invoiceid | html %]&amp;referer=/cgi-bin/koha/acqui/invoices.pl%3Fop=do_search%26invoicenumber=[% invoicenumber | html %]%26supplier=[% booksellerid | html %]%26shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]%26shipmentdateto=[% shipmentdateto | $KohaDates %]%26billingdatefrom=[% billingdatefrom | $KohaDates %]%26billingdateto=[% billingdateto | $KohaDates %]%26isbneanissn=[% isbneanissn | html %]%26title=[% title | html %]%26author=[% author | html %]%26publisher=[% publisher | html %]%26publicationyear=[% publicationyear | html %]%26branch=[% branch | html %]" class="delete_invoice"><i class="fa fa-trash"></i> Delete</a></li>
                             [% END %]
                           </ul>
                       </div>
                             <select id="merge_shipment_budgetid" name="shipment_budget_id">
                                 <option value="">No fund</option>
                               [% FOREACH budget IN budgets_loop %]
-                                  <option value="[% budget.budget_id %]">[% budget.budget_name %]
+                                  <option value="[% budget.budget_id | html %]">[% budget.budget_name | html %]
                                   </option>
                               [% END %]
                             </select></li>
           <p>Search was:
             <ul>
               [% IF ( invoicenumber ) %]
-                <li>Invoice no.: [% invoicenumber |html %]</li>
+                <li>Invoice no.: [% invoicenumber | html %]</li>
               [% END %]
               [% IF booksellerid %]
-                <li>Vendor: [% suppliername %]</li>
+                <li>Vendor: [% suppliername | html %]</li>
               [% END %]
               [% IF shipmentdatefrom %]
                 <li>Shipment date:
                 [% END %]
               [% END %]
               [% IF ( isbneanissn ) %]
-                <li>ISBN/EAN/ISSN: [% isbneanissn |html %]</li>
+                <li>ISBN/EAN/ISSN: [% isbneanissn | html %]</li>
               [% END %]
               [% IF ( title ) %]
-                <li>Title: [% title |html %]</li>
+                <li>Title: [% title | html %]</li>
               [% END %]
               [% IF ( author ) %]
-                <li>Author: [% author |html %]</li>
+                <li>Author: [% author | html %]</li>
               [% END %]
               [% IF ( publisher ) %]
-                <li>Publisher: [% publisher |html %]</li>
+                <li>Publisher: [% publisher | html %]</li>
               [% END %]
               [% IF ( publicationyear ) %]
-                <li>Publication year: [% publicationyear |html %]</li>
+                <li>Publication year: [% publicationyear | html %]</li>
               [% END %]
               [% IF ( branch ) %]
-                <li>Library: [% Branches.GetName( branch ) %]</li>
+                <li>Library: [% Branches.GetName( branch ) | html %]</li>
               [% END %]
             </ul>
           </p>
         <ol>
           <li>
             <label for="invoicenumber">Invoice no:</label>
-            <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber |html %]" class="focus" />
+            <input type="text" id="invoicenumber" name="invoicenumber" value="[% invoicenumber | html %]" class="focus" />
           </li>
           <li>
             <label for="supplier">Vendor:</label>
               <option value="">All</option>
               [% FOREACH supplier IN suppliers_loop %]
                 [% IF ( supplier.selected ) %]
-                  <option selected="selected" value="[% supplier.booksellerid %]">[% supplier.suppliername %]</option>
+                  <option selected="selected" value="[% supplier.booksellerid | html %]">[% supplier.suppliername | html %]</option>
                 [% ELSE %]
-                  <option value="[% supplier.booksellerid %]">[% supplier.suppliername %]</option>
+                  <option value="[% supplier.booksellerid | html %]">[% supplier.suppliername | html %]</option>
                 [% END %]
               [% END %]
             </select>
           </li>
           <li>
             <label for="isbneanissn">ISBN / EAN / ISSN:</label>
-            <input type="text" id="isbneanissn" name="isbneanissn" value="[% isbneanissn |html %]" />
+            <input type="text" id="isbneanissn" name="isbneanissn" value="[% isbneanissn | html %]" />
           </li>
           <li>
             <label for="title">Title:</label>
-            <input type="text" id="title" name="title" value="[% title |html %]" />
+            <input type="text" id="title" name="title" value="[% title | html %]" />
           </li>
           <li>
             <label for="author">Author:</label>
-            <input type="text" id="author" name="author" value="[% author |html %]" />
+            <input type="text" id="author" name="author" value="[% author | html %]" />
           </li>
           <li>
             <label for="publisher">Publisher:</label>
-            <input type="text" id="publisher" name="publisher" value="[% publisher |html %]" />
+            <input type="text" id="publisher" name="publisher" value="[% publisher | html %]" />
           </li>
           <li>
             <label for="publicationyear">Publication year:</label>
-            <input type="text" id="publicationyear" name="publicationyear" value="[% publicationyear |html %]" />
+            <input type="text" id="publicationyear" name="publicationyear" value="[% publicationyear | html %]" />
           </li>
           <li>
             <label for="branch">Library:</label>
 </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'calendar.inc' %]
     <script>
index 7711a33..69faed4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Late orders</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -20,7 +21,7 @@
         <div class="col-sm-10 col-sm-push-2">
             <main>
 
-<h1>[% IF ( Supplier ) %][% Supplier %] : [% END %]Late orders</h1>
+<h1>[% IF ( Supplier ) %][% Supplier | html %] : [% END %]Late orders</h1>
 <div id="acqui_lateorders">
 
 [% IF error_claim %]
@@ -29,7 +30,7 @@
     [% ELSIF ( error_claim == "no_order_selected" ) %]
         <div class="error">No order selected</div>
     [% ELSE %]
-        <div class="error">[% error_claim %]</div>
+        <div class="error">[% error_claim | html %]</div>
     [% END %]
 [% END %]
 [% IF info_claim %]
 [% IF ( lateorders ) %]
 <form action="lateorders.pl" name="claim" method="post">
   <input type="hidden" name="op" value="send_alert" />
-  <input type="hidden" name="delay" value="[% delay | html%]" />
-  <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+  <input type="hidden" name="delay" value="[% delay | html %]" />
+  <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
        [% IF ( letters ) %]
        <p><label for="letter_code">Claim using notice: </label><select name="letter_code" id="letter_code">
          [% FOREACH letter IN letters %]
-               <option value="[% letter.code %]">[% letter.name %]</option>
+               <option value="[% letter.code | html %]">[% letter.name | html %]</option>
          [% END %]
          </select>
        </p>
       [% FOREACH lateorder IN lateorders %]
         <tr>
             <td>
-                <input type="checkbox" value="[% lateorder.ordernumber %]" data-booksellerid="[% lateorder.supplierid %]" name="ordernumber">
+                <input type="checkbox" value="[% lateorder.ordernumber | html %]" data-booksellerid="[% lateorder.supplierid | html %]" name="ordernumber">
             </td>
             <td>
-                <span title="[% lateorder.orderdate %]">[% lateorder.orderdate | $KohaDates %] ([% lateorder.latesince %] days)</span>
+                <span title="[% lateorder.orderdate | html %]">[% lateorder.orderdate | $KohaDates %] ([% lateorder.latesince | html %] days)</span>
             </td>
             <td>
                 [% IF ( lateorder.estimateddeliverydate ) %]
-                    <span title="[% lateorder.estimateddeliverydate %]">[% lateorder.estimateddeliverydate | $KohaDates  %]</span>
+                    <span title="[% lateorder.estimateddeliverydate | html %]">[% lateorder.estimateddeliverydate | $KohaDates | html %]</span>
                 [% ELSE %]
                     <span title="0000-00-00"></span>
                 [% END %]
             </td>
             <td>
-                [% lateorder.supplier %]
-                ([% lateorder.supplierid %])
+                [% lateorder.supplier | html %]
+                ([% lateorder.supplierid | html %])
             </td>
             <td>
-                <b>[% lateorder.title |html %]</b>
-                   [% IF ( lateorder.author ) %]<br/><i>Author:</i> [% lateorder.author %][% END %]
+                <b>[% lateorder.title | html %]</b>
+                   [% IF ( lateorder.author ) %]<br/><i>Author:</i> [% lateorder.author | html %][% END %]
                    [% IF ( lateorder.publisher ) %]
-                        <br/><i>Published by:</i> [% lateorder.publisher %]
+                        <br/><i>Published by:</i> [% lateorder.publisher | html %]
                         [% IF ( lateorder.publicationyear ) %]
-                            <i> in </i>[% lateorder.publicationyear %]
+                            <i> in </i>[% lateorder.publicationyear | html %]
                         [% END %]
                    [% END %]
             </td>
             <td>
-                   [% lateorder.unitpricesupplier %]x[% lateorder.quantity %] = 
-                   [% lateorder.subtotal %]
+                   [% lateorder.unitpricesupplier | html %]x[% lateorder.quantity | html %] = 
+                   [% lateorder.subtotal | html %]
             </td>
             <td>
                 [% IF ( CAN_user_acquisition_order_manage ) %]
-                    <a href="basket.pl?basketno=[% lateorder.basketno %]" title="basket">[% lateorder.basketname %] ([% lateorder.basketno %])</a>
+                    <a href="basket.pl?basketno=[% lateorder.basketno | html %]" title="basket">[% lateorder.basketname | html %] ([% lateorder.basketno | html %])</a>
                 [% ELSE %]
-                    [% lateorder.basketname %] ([% lateorder.basketno %])
+                    [% lateorder.basketname | html %] ([% lateorder.basketno | html %])
                 [% END %]
             </td>
             <td>
                 [% IF ( lateorder.basketgroupid ) %]
                     [% IF ( CAN_user_acquisition_group_manage ) %]
-                        <a href="basketgroup.pl?op=add&booksellerid=[% lateorder.supplierid %]&basketgroupid=[% lateorder.basketgroupid %]" title="basketgroup">[% lateorder.basketgroupname %] ([% lateorder.basketgroupid %])</a>
+                        <a href="basketgroup.pl?op=add&booksellerid=[% lateorder.supplierid | html %]&basketgroupid=[% lateorder.basketgroupid | html %]" title="basketgroup">[% lateorder.basketgroupname | html %] ([% lateorder.basketgroupid | html %])</a>
                     [% ELSE %]
-                        [% lateorder.basketgroupname %] ([% lateorder.basketgroupid %])</a>
+                        [% lateorder.basketgroupname | html %] ([% lateorder.basketgroupid | html %])</a>
                     [% END %]
                 [% END %]
             </td>
-            <td>[% Branches.GetName( lateorder.branch ) %]
+            <td>[% Branches.GetName( lateorder.branch ) | html %]
             </td>
-            <td>[% lateorder.budget %]
+            <td>[% lateorder.budget | html %]
             </td>
-            <td>[% lateorder.claims_count %]</td>
+            <td>[% lateorder.claims_count | html %]</td>
             <td>
                 [% IF ( lateorder.claimed_date ) %]
-                    <span title="[% lateorder.claimed_date %]">[% lateorder.claimed_date | $KohaDates %]</span>
+                    <span title="[% lateorder.claimed_date | html %]">[% lateorder.claimed_date | $KohaDates %]</span>
                 [% ELSE %]
                     <span title="0000-00-00"></span>
                 [% END %]
       <tfoot>
         <tr>
             <th colspan="5">Total</th>
-            <th>[% total %]</th>
+            <th>[% total | html %]</th>
             <th colspan="6">&nbsp;</th>
         </tr>
       </tfoot>
 [% IF ( ERROR_LOO.delay_digits ) %]<p class="error">The number of days ([% ERROR_LOO.bad_delay | html %]) must be a number between 0 and 999.</p>[% END %]
 [% END %]
 <ol>
-    <li><label for="delay">Order date:</label><input size="3" maxlength="3" id="delay" type="text" name="delay" value="[% delay | html%]" /> days ago</li>
+    <li><label for="delay">Order date:</label><input size="3" maxlength="3" id="delay" type="text" name="delay" value="[% delay | html %]" /> days ago</li>
     <li><label for="from">Estimated delivery date from: </label>
-        <input type="text" size="10" id="from" name="estimateddeliverydatefrom" value="[% estimateddeliverydatefrom %]" class="datepickerfrom" />
+        <input type="text" size="10" id="from" name="estimateddeliverydatefrom" value="[% estimateddeliverydatefrom | html %]" class="datepickerfrom" />
         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
     </li>
     <li><label for="to">To: </label>
-        <input type="text" size="10" id="to" name="estimateddeliverydateto" value="[% estimateddeliverydateto %]" class="datepickerto" />
+        <input type="text" size="10" id="to" name="estimateddeliverydateto" value="[% estimateddeliverydateto | html %]" class="datepickerto" />
         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
     </li>
 
                <select id="booksellerid" size="1" tabindex="" name="booksellerid">
             <option value=""></option>
                        [% FOREACH SUPPLIER_LOO IN SUPPLIER_LOOP %]
-                [% IF ( SUPPLIER_LOO.selected ) %]<option value="[% SUPPLIER_LOO.id %]" selected="selected">[% SUPPLIER_LOO.name %]</option>
-                [% ELSE %]<option value="[% SUPPLIER_LOO.id %]">[% SUPPLIER_LOO.name %]</option>[% END %]
+                [% IF ( SUPPLIER_LOO.selected ) %]<option value="[% SUPPLIER_LOO.id | html %]" selected="selected">[% SUPPLIER_LOO.name | html %]</option>
+                [% ELSE %]<option value="[% SUPPLIER_LOO.id | html %]">[% SUPPLIER_LOO.name | html %]</option>[% END %]
                [% END %]
                </select>
 </ol>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script>
         var late_orderst;
 
         $(document).ready(function() {
 
-            var columns_settings = [% ColumnsSettings.GetColumns( 'acqui', 'lateorders', 'late_orders', 'json' ) %];
+            var columns_settings = [% ColumnsSettings.GetColumns( 'acqui', 'lateorders', 'late_orders', 'json' ) | $raw %];
             late_orderst = KohaTable("late_orders", {
                 "aoColumnDefs": [
                     { "aTargets": [ 0 ], "bSortable": false, "bSearchable": false },
index c6fd643..4bb82de 100644 (file)
 <body id="acq_modordernotes" class="acq">
 [% INCLUDE 'header.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisition</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername|html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketname|html %] ([% basketno %])</a> &rsaquo; Change order [% IF (type == "vendor") %]vendor[% ELSE %]internal[% END %] note</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisition</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketname | html %] ([% basketno | html %])</a> &rsaquo; Change order [% IF (type == "vendor") %]vendor[% ELSE %]internal[% END %] note</div>
 
 <div class="main container-fluid">
     <div class="row">
         <div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
 
       [% IF (type == "vendor") %]
-          <h1>Change order vendor note (order no. [% ordernumber %])</h1>
+          <h1>Change order vendor note (order no. [% ordernumber | html %])</h1>
       [% ELSE %]
-          <h1>Change order internal note (order no. [% ordernumber %])</h1>
+          <h1>Change order internal note (order no. [% ordernumber | html %])</h1>
       [% END %]
       <form action="/cgi-bin/koha/acqui/modordernotes.pl" method="post">
         <fieldset class="brief">
           <label for="ordernotes">Note:</label>
-          <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes %]</textarea>
+          <textarea id="ordernotes" name="ordernotes" rows="3" cols="30" class="focus">[% ordernotes | html %]</textarea>
         </fieldset>
-        <input type="hidden" name="referrer" value="[% referrer %]" />
-        <input type="hidden" name="ordernumber" value="[% ordernumber %]" />
+        <input type="hidden" name="referrer" value="[% referrer | html %]" />
+        <input type="hidden" name="ordernumber" value="[% ordernumber | html %]" />
         <input type="hidden" name="op" value="save" />
-        <input type="hidden" name="type" value="[% type %]" />
+        <input type="hidden" name="type" value="[% type | html %]" />
         <fieldset class="action">
           <input type="submit" value="Save" />
-          <a class="cancel" href="[% referrer %]">Cancel</a>
+          <a class="cancel" href="[% referrer | html %]">Cancel</a>
         </fieldset>
       </form>
   </div>
index 877e41a..1d8e1a7 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Search existing records</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -10,7 +11,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo; Search existing records</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo; Search existing records</div>
 
 <div id="doc3" class="yui-t2">
    
 
 
 [% IF ( total ) %]
-<b>[% total %] results found </b> 
-<div class="pages">[% pagination_bar %]</div>
+<b>[% total | html %] results found </b> 
+<div class="pages">[% pagination_bar | $raw %]</div>
 [% ELSE %]
 <h3> No results found</h3>
 <p>
-    No results match your search for <span style="font-weight: bold;">&ldquo;[% query %]&rdquo;</span> in [% LibraryName %]
+    No results match your search for <span style="font-weight: bold;">&ldquo;[% query | html %]&rdquo;</span> in [% LibraryName | html %]
 </p>
 [% END %]
 
 [% IF ( query_error ) %]
-    <div class="dialog alert"><p><strong>Error:</strong> [% query_error %]</p></div>
+    <div class="dialog alert"><p><strong>Error:</strong> [% query_error | html %]</p></div>
 [% END %]
 
 [% IF ( total ) %]
       [% FOREACH biblio IN resultsloop %]
         <tr>
             <td>
-                <p><span class="title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.title | html %]</a></span>
-                [% FOREACH subtitle IN biblio.subtitles %] <span class="subtitle">[% subtitle.subfield %]</span>[% END %]
-                [% IF ( biblio.author ) %]  by <span class="author">[% biblio.author %]</span>,[% END %]</p>
-                <p>[% IF ( biblio.isbn ) %] [% biblio.isbn %][% END %]
-                [% IF ( biblio.pages ) %] - [% biblio.pages %][% END %]
-                [% IF ( biblio.notes ) %] : [% biblio.notes %][% END %]
-                [% IF ( biblio.size ) %] ; [% biblio.size %][% END %]
+                <p><span class="title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.title | html %]</a></span>
+                [% FOREACH subtitle IN biblio.subtitles %] <span class="subtitle">[% subtitle.subfield | html %]</span>[% END %]
+                [% IF ( biblio.author ) %]  by <span class="author">[% biblio.author | html %]</span>,[% END %]</p>
+                <p>[% IF ( biblio.isbn ) %] [% biblio.isbn | html %][% END %]
+                [% IF ( biblio.pages ) %] - [% biblio.pages | html %][% END %]
+                [% IF ( biblio.notes ) %] : [% biblio.notes | html %][% END %]
+                [% IF ( biblio.size ) %] ; [% biblio.size | html %][% END %]
                 </p>
             </td>
             <td>
-                [% biblio.publishercode %]
-                [% IF ( biblio.place ) %] ; [% biblio.place %][% END %]
+                [% biblio.publishercode | html %]
+                [% IF ( biblio.place ) %] ; [% biblio.place | html %][% END %]
             </td>
             <td>
-                [% biblio.copyrightdate %]
+                [% biblio.copyrightdate | html %]
             </td>
         <td>
-        <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblio.biblionumber %]&amp;viewas=html" class="previewMARC">View MARC</a>
+        <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblio.biblionumber | html %]&amp;viewas=html" class="previewMARC">View MARC</a>
         </td>
             <td>
-            <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;biblionumber=[% biblio.biblionumber %]" title="Order this one">
+            <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;biblionumber=[% biblio.biblionumber | html %]" title="Order this one">
                 Order
             </a>
             </td>
@@ -87,7 +88,7 @@
             <h3 id="marcPreviewLabel">MARC preview</h3>
         </div>
         <div class="modal-body">
-            <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+            <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
         </div>
         <div class="modal-footer">
             <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
          $(document).ready(function() {
             });
             $("#marcPreview").on("hidden", function(){
                 $("#marcPreviewLabel").html("");
-                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
          });
     </script>
index 1a10af9..cd90a0e 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; Basket [% basketno %] &rsaquo; [% IF ( ordernumber ) %]Modify order details (line #[% ordernumber %])[% ELSE %]New order[% END %]</title>
+<title>Koha &rsaquo; Acquisitions &rsaquo; Basket [% basketno | html %] &rsaquo; [% IF ( ordernumber ) %]Modify order details (line #[% ordernumber | html %])[% ELSE %]New order[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo; [% IF ( ordernumber ) %]Modify order details (line #[% ordernumber %])[% ELSE %]New order[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo; [% IF ( ordernumber ) %]Modify order details (line #[% ordernumber | html %])[% ELSE %]New order[% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
     <fieldset class="rows">
         <legend>Basket details</legend>
         <ol>
-        [% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote %]</li>[% END %]
-        [% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote %]</li>[% END %]
+        [% IF ( basketnote ) %]<li><span class="label">Internal note:</span> [% basketnote | html %]</li>[% END %]
+        [% IF ( basketbooksellernote ) %]<li><span class="label">Vendor note:</span> [% basketbooksellernote | html %]</li>[% END %]
         [% IF ( basketcontractno ) %]
-            <li><span class="label">Contract number: </span>[% basketcontractno %]</li>
-            <li><span class="label">Contract name:</span> <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno %]">[% basketcontractname %]</a></li>
+            <li><span class="label">Contract number: </span>[% basketcontractno | html %]</li>
+            <li><span class="label">Contract name:</span> <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% basketcontractno | html %]">[% basketcontractname | html %]</a></li>
         [% END %]
-        [% IF ( authorisedbyname ) %]<li><span class="label">Managed by:</span>  [% authorisedbyname %]</li>[% END %]
+        [% IF ( authorisedbyname ) %]<li><span class="label">Managed by:</span>  [% authorisedbyname | html %]</li>[% END %]
         [% IF ( creationdate ) %]<li><span class="label">Open on:</span>  [% creationdate | $KohaDates %]</li>[% END %]
         [% IF ( closedate ) %]
         <form action="/cgi-bin/koha/acqui/basketgroup.pl" method="post">
             <li>Basketgroup: <select id="basketgroupid" name="basketgroupid">
                 [% FOREACH basketgroup IN basketgroups %]
                     [% IF ( basketgroup.default ) %]
-                    <option value="[% basketgroup.id %]" selected="selected">[% basketgroup.name %]</option>
+                    <option value="[% basketgroup.id | html %]" selected="selected">[% basketgroup.name | html %]</option>
                     [% ELSE %]
-                    <option value="[% basketgroup.id %]">[% basketgroup.name %]</option>
+                    <option value="[% basketgroup.id | html %]">[% basketgroup.name | html %]</option>
                     [% END %]
                 [% END %]
                 </select>
-                <input type="hidden" id="basketno" value="[% basketno %]" name="basketno" />
+                <input type="hidden" id="basketno" value="[% basketno | html %]" name="basketno" />
                 <input type="hidden" value="mod_basket" name="op" />
-                <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
             </li>
             <fieldset class="action"><input type="submit" value="Change basketgroup" /></fieldset>
         [% END %]
                 <div style="float:left">
                     <ul id="users_names" style="padding-left:0">
                       [% FOREACH user IN users %]
-                        <li id="user_[% user.borrowernumber %]">
-                            [% user.firstname %] [% user.surname %]
-                            [<a onclick="del_user([% user.borrowernumber %]);" style="cursor:pointer">Delete user</a>]
+                        <li id="user_[% user.borrowernumber | html %]">
+                            [% user.firstname | html %] [% user.surname | html %]
+                            [<a onclick="del_user([% user.borrowernumber | html %]);" style="cursor:pointer">Delete user</a>]
                         </li>
                       [% END %]
                     </ul>
-                    <input type="hidden" id="users_ids" name="users_ids" value="[% users_ids %]" />
+                    <input type="hidden" id="users_ids" name="users_ids" value="[% users_ids | html %]" />
                     <input type="hidden" id="op" name="op" value="mod_users" />
                     <input type="button" id="add_user" onclick="UserSearchPopup();" value="Add user" />
                 </div>
         <legend>
             Catalog details
             [% IF ( biblionumber ) %]
-                <span><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]"> Edit record</a></span>
+                <span><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber | html %]"> Edit record</a></span>
             [% END %]
         </legend>
         [% UNLESS ( existing ) %]
         <input type="hidden" name="existing" value="no" />
         [% END %]
-        <input type="hidden" name="ordernumber" value="[% ordernumber %]" />
-        <input type="hidden" name="basketno" value="[% basketno %]" />
-        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-        <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
-        <input type="hidden" name="listinc" id="listinc" value="[% listincgst %]" />
-        <input type="hidden" name="invoiceincgst" id="invoiceincgst" value="[% invoiceincgst %]" />
-        <input type="hidden" name="suggestionid" value="[% suggestionid %]" />
-        <input type="hidden" name="import_batch_id" value="[% import_batch_id %]" />
+        <input type="hidden" name="ordernumber" value="[% ordernumber | html %]" />
+        <input type="hidden" name="basketno" value="[% basketno | html %]" />
+        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+        <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+        <input type="hidden" name="listinc" id="listinc" value="[% listincgst | html %]" />
+        <input type="hidden" name="invoiceincgst" id="invoiceincgst" value="[% invoiceincgst | html %]" />
+        <input type="hidden" name="suggestionid" value="[% suggestionid | html %]" />
+        <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
 
         [% FOREACH c IN currencies %]
-            <input type="hidden" id="currency_rate_[% c.currency %]"  name="[% c.currency %]" value="[% c.rate %]" />
+            <input type="hidden" id="currency_rate_[% c.currency | html %]"  name="[% c.currency | html %]" value="[% c.rate | html %]" />
         [% END %]
 
         [% IF NOT Koha.Preference('UseACQFrameworkForBiblioRecords') OR NoACQframework %]
             <ol><li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Title</span>
-                    <input type="hidden" name="title" value="[% title |html %]" /> <span class="title">[% title |html %]</span>
+                    <input type="hidden" name="title" value="[% title | html %]" /> <span class="title">[% title | html %]</span>
                 [% ELSE %]
                 <label for="entertitle">Title: </label>
-                    <input type="text" id="entertitle" size="50" name="title" value="[% title |html %]" class="focus" required="required" />
+                    <input type="text" id="entertitle" size="50" name="title" value="[% title | html %]" class="focus" required="required" />
                     <span class="required">Required</span>
                 [% END %]
             </li>
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Author: </span>
-                    <input type="hidden" name="author" id="author" value="[% author %]" />[% author %]
+                    <input type="hidden" name="author" id="author" value="[% author | html %]" />[% author | html %]
                 [% ELSE %]
                 <label for="author">Author: </label>
-                    <input type="text" size="50" name="author" id="author" value="[% author %]" />
+                    <input type="text" size="50" name="author" id="author" value="[% author | html %]" />
                 [% END %]
             </li>
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Publisher: </span>
-                    <input type="hidden" name="publishercode" id="publishercode" value="[% publishercode %]" />[% publishercode %]
+                    <input type="hidden" name="publishercode" id="publishercode" value="[% publishercode | html %]" />[% publishercode | html %]
                 [% ELSE %]
                 <label for="publishercode"> Publisher: </label>
-                    <input type="text" size="50" name="publishercode" id="publishercode" value="[% publishercode %]" />
+                    <input type="text" size="50" name="publishercode" id="publishercode" value="[% publishercode | html %]" />
                 [% END %]
             </li>
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Edition: </span>
-                    <input type="hidden" name="editionstatement" id="editionstatement" value="[% editionstatement %]" />[% editionstatement %]
+                    <input type="hidden" name="editionstatement" id="editionstatement" value="[% editionstatement | html %]" />[% editionstatement | html %]
 
                 [% ELSE %]
                 <label for="editionstatement">Edition: </label>
-                    <input type="text" size="20" name="editionstatement" id="editionstatement" value="[% editionstatement %]" />
+                    <input type="text" size="20" name="editionstatement" id="editionstatement" value="[% editionstatement | html %]" />
                 [% END %]
             </li>
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Publication year: </span>
-                    <input type="hidden" name="publicationyear" id="publicationyear" value="[% publicationyear %]" />[% publicationyear %]
+                    <input type="hidden" name="publicationyear" id="publicationyear" value="[% publicationyear | html %]" />[% publicationyear | html %]
                 [% ELSE %]
                 <label for="publicationyear">Publication year: </label>
-                    <input type="text" size="10" name="publicationyear" id="publicationyear" value="[% publicationyear %]" />
+                    <input type="text" size="10" name="publicationyear" id="publicationyear" value="[% publicationyear | html %]" />
                 [% END %]
             </li>
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">ISBN: </span>
-                    <input type="hidden" name="isbn" id="ISBN" value="[% isbn %]" />[% isbn %]
+                    <input type="hidden" name="isbn" id="ISBN" value="[% isbn | html %]" />[% isbn | html %]
                 [% ELSE %]
                 <label for="ISBN">ISBN: </label>
-                    <input type="text" size="50" name="isbn" id="ISBN" value="[% isbn %]" />
+                    <input type="text" size="50" name="isbn" id="ISBN" value="[% isbn | html %]" />
                 [% END %]
             </li>
             [% IF (UNIMARC) %]
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">EAN: </span>
-                    <input type="hidden" name="ean" id="EAN" value="[% ean %]" />[% ean %]
+                    <input type="hidden" name="ean" id="EAN" value="[% ean | html %]" />[% ean | html %]
                 [% ELSE %]
                 <label for="EAN">EAN: </label>
-                    <input type="text" size="20" name="ean" id="EAN" value="[% ean %]" />
+                    <input type="text" size="20" name="ean" id="EAN" value="[% ean | html %]" />
                 [% END %]
             </li>
             [% END %]
             <li>
                 [% IF ( biblionumber ) %]
                 <span class="label">Series: </span>
-                    <input type="hidden" name="series" id="series" value="[% seriestitle %]" />[% seriestitle %]
+                    <input type="hidden" name="series" id="series" value="[% seriestitle | html %]" />[% seriestitle | html %]
                 [% ELSE %]
                 <label for="series">Series: </label>
-                    <input type="text" size="50" name="series" id="series" value="[% seriestitle %]" />
+                    <input type="text" size="50" name="series" id="series" value="[% seriestitle | html %]" />
                 [% END %]
             </li>
                 [% UNLESS ( biblionumber ) %]
                     <span class="label">Item type:</span>
                     <select name="itemtype" style="width:12em;">
                     [% FOREACH itemtype IN itemtypeloop %]
-                        <option value="[% itemtype.itemtype %]">[% itemtype.description %]</option>
+                        <option value="[% itemtype.itemtype | html %]">[% itemtype.description | html %]</option>
                     [% END %]
                     </select>
                 </li>
                     [% FOREACH field IN catalog_details %]
                         <li>
                             <div class="subfield_line">
-                                <label>[% field.lib %] ([% field.tag %][% field.subfield %])</label>
-                                [% field.value %]
+                                <label>[% field.lib | html %] ([% field.tag | html %][% field.subfield | html %])</label>
+                                [% field.value | html %]
                             </div>
                         </li>
                     [% END %]
         <ol>
           <li>
             <span class="label">Suggested by: </span>
-            [% surnamesuggestedby %][% IF ( firstnamesuggestedby ) %], [% firstnamesuggestedby %][% END %] (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% suggestionid %]&amp;op=show">suggestion #[% suggestionid %]</a>)
+            [% surnamesuggestedby | html %][% IF ( firstnamesuggestedby ) %], [% firstnamesuggestedby | html %][% END %] (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% suggestionid | html %]&amp;op=show">suggestion #[% suggestionid | html %]</a>)
           </li>
         </ol>
         </fieldset>
           [% END %]
 
           [% UNLESS Koha.Preference('autoBarcode') == 'OFF' %]
-              <div class="dialog message">The autoBarcode system preference is set to [% Koha.Preference('autoBarcode') %] and items with blank barcodes will have barcodes generated upon save to database</div>
+              <div class="dialog message">The autoBarcode system preference is set to [% Koha.Preference('autoBarcode') | html %] and items with blank barcodes will have barcodes generated upon save to database</div>
           [% END %]
 
           <div id="outeritemblock"></div>
 
       </fieldset>
-      [% END %][%# UNLESS subscriptionid %]
+      [% END %][%# | html UNLESS subscriptionid %]
     [% END %][%# IF (AcqCreateItemOrdering) %]
     <fieldset class="rows">
         <legend>Accounting details</legend>
             <li>
                 [% IF ( close ) %]
                     <span class="label required">Quantity: </span>
-                    <input type="hidden" name="quantity" value="[% quantity %]" />[% quantity %]
+                    <input type="hidden" name="quantity" value="[% quantity | html %]" />[% quantity | html %]
                 [% ELSE %]
                     <label class="required" for="quantity">Quantity: </label>
                     [% IF (AcqCreateItemOrdering) %]
                         [% IF subscriptionid || basket.is_standing %]
                             <input type="text" readonly="readonly" size="20" id="quantity" name="quantity" value="1" />
                         [% ELSE %]
-                            <input type="text" size="20" id="quantity" name="quantity" value="[% quantityrec %]" onchange="updateCosts();" />
+                            <input type="text" size="20" id="quantity" name="quantity" value="[% quantityrec | html %]" onchange="updateCosts();" />
                         [% END %]
                     [% END %]
                     <span class="required">Required</span>
             <li>
                 [% IF ( close ) %]
             <span class="label required">Fund: </span>
-                    <input type="hidden" name="budget_id" id="budget_id" value="[% budget_id %]" />[% Budget_name %]
+                    <input type="hidden" name="budget_id" id="budget_id" value="[% budget_id | html %]" />[% Budget_name | html %]
                 [% ELSE %]
                 <label class="required" for="budget_id">Fund: </label>
-                [% active_count = 0 %]
+                [% active_count = 0 | html %]
                 [% IF !ordernumber %]
                     [% FOREACH budget_loo IN budget_loop %]
-                        [% active_count= active_count + budget_loo.b_active %]
+                        [% active_count= active_count + budget_loo.b_active | html %]
                     [% END %]
                 [% END %]
                 <select id="budget_id" size="1" name="budget_id">
                     <option value="">Select a fund</option>
                 [% FOREACH budget_loo IN budget_loop %]
                     [% IF ( budget_loo.b_sel ) %]
-                        [% active_count = 0 #select no other fund %]
-                        <option value="[% budget_loo.b_id %]" selected="selected" data-sort1-authcat="[% budget_loo.b_sort1_authcat %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat %]"
-                                style="padding-left:[% budget_loo.b_level %]em;"
+                        [% active_count = 0 #select no other fund | html %]
+                        <option value="[% budget_loo.b_id | html %]" selected="selected" data-sort1-authcat="[% budget_loo.b_sort1_authcat | html %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat | html %]"
+                                style="padding-left:[% budget_loo.b_level | html %]em;"
                         >
                     [% ELSIF active_count==1 && budget_loo.b_active %]
-                        <option value="[% budget_loo.b_id %]" selected="selected" data-sort1-authcat="[% budget_loo.b_sort1_authcat %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat %]"
-                                style="padding-left:[% budget_loo.b_level %]em;"
+                        <option value="[% budget_loo.b_id | html %]" selected="selected" data-sort1-authcat="[% budget_loo.b_sort1_authcat | html %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat | html %]"
+                                style="padding-left:[% budget_loo.b_level | html %]em;"
                         >
                     [% ELSE %]
-                        [% bdgclass=budget_loo.b_active? "": "b_inactive" %]
-                        <option value="[% budget_loo.b_id %]" class="[% bdgclass %]" data-sort1-authcat="[% budget_loo.b_sort1_authcat %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat %]"
-                                style="padding-left:[% budget_loo.b_level %]em;"
+                        [% bdgclass=budget_loo.b_active? "": "b_inactive" | html %]
+                        <option value="[% budget_loo.b_id | html %]" class="[% bdgclass | html %]" data-sort1-authcat="[% budget_loo.b_sort1_authcat | html %]" data-sort2-authcat="[% budget_loo.b_sort2_authcat | html %]"
+                                style="padding-left:[% budget_loo.b_level | html %]em;"
                         >
                     [% END %]
-                    [% budget_loo.b_txt %][% IF !budget_loo.b_active %] (inactive)[% END %]
+                    [% budget_loo.b_txt | html %][% IF !budget_loo.b_active %] (inactive)[% END %]
                     </option>
                 [% END %]
                 </select>
                <li>
                 [% IF ( close ) %]
                        <span class="label">Currency: </span>
-            <input type="hidden" name="currency" id="currency" value="[% currency %]" />[% currency %]
+            <input type="hidden" name="currency" id="currency" value="[% currency | html %]" />[% currency | html %]
                 [% ELSE %]
                        <label for="currency">Currency:</label>
             <select name="currency" id="currency" onchange="updateCosts();">
                 [% FOREACH c IN currencies %]
                     [% IF ordernumber and c.currency == currency or not ordernumber and c.currency == vendor_currency %]
-                        <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
+                        <option value="[% c.currency | html %]" selected="selected">[% c.currency | html %]</option>
                     [% ELSIF not c.archived %]
-                        <option value="[% c.currency %]">[% c.currency %]</option>
+                        <option value="[% c.currency | html %]">[% c.currency | html %]</option>
                     [% END %]
                 [% END %]
             </select>
             <li>
                 [% IF ( close ) %]
                     <span class="label">Vendor price: </span>
-                    <input type="hidden" name="listprice" id="listprice" value="[% listprice %]" />[% listprice %] [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
+                    <input type="hidden" name="listprice" id="listprice" value="[% listprice | html %]" />[% listprice | html %] [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
                 [% ELSE %]
                 <label for="listprice">Vendor price: </label>
-                    <input type="text" size="20" name="listprice" id="listprice" value="[% listprice %]" onchange="updateCosts()" /> [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
+                    <input type="text" size="20" name="listprice" id="listprice" value="[% listprice | html %]" onchange="updateCosts()" /> [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
                 [% END %]
             </li>
             [% UNLESS ( close ) %]
                 <li>
                     [% IF ( close ) %]
                         <span class="label">Tax rate: </span>
-                        <input type="hidden" name="tax_rate" id="tax_rate" value="[% tax_rate %]" />[% tax_rate %]%
+                        <input type="hidden" name="tax_rate" id="tax_rate" value="[% tax_rate | html %]" />[% tax_rate | html %]%
                     [% ELSE %]
                         <label for="tax_rate">Tax rate: </label>
                         <select name="tax_rate" id="tax_rate" onchange="updateCosts();">
                         [% FOREACH gst IN gst_values %]
                           [% IF ( gst.option == tax_rate ) %]
-                            <option value="[% gst.option %]" selected="selected">[% gst.option * 100 %]%</option>
+                            <option value="[% gst.option | html %]" selected="selected">[% gst.option * 100 | html %]%</option>
                           [% ELSE %]
-                            <option value="[% gst.option %]">[% gst.option * 100 %]%</option>
+                            <option value="[% gst.option | html %]">[% gst.option * 100 | html %]%</option>
                           [% END %]
                         [% END %]
                         </select>
                 <label for="discount">Discount: </label>
                 [% IF ( close ) %]
                     [% IF ( orderdiscount ) %]
-                        <input type="hidden" name="discount" id="discount" value="[% orderdiscount %]" />[% orderdiscount_2dp %]%
+                        <input type="hidden" name="discount" id="discount" value="[% orderdiscount | html %]" />[% orderdiscount_2dp | html %]%
                     [% ELSE %]
-                        <input type="hidden" name="discount" id="discount" value="[% discount %]" />[% discount_2dp %]%
+                        <input type="hidden" name="discount" id="discount" value="[% discount | html %]" />[% discount_2dp | html %]%
                     [% END %]
                 [% ELSE %]
                     [% IF ( orderdiscount ) %]
-                        <input type="text" size="6" name="discount" id="discount" value="[% orderdiscount %]" onchange="updateCosts();" />%
+                        <input type="text" size="6" name="discount" id="discount" value="[% orderdiscount | html %]" onchange="updateCosts();" />%
                     [% ELSE %]
-                        <input type="text" size="6" name="discount" id="discount" value="[% discount %]" onchange="updateCosts();" />%
+                        <input type="text" size="6" name="discount" id="discount" value="[% discount | html %]" onchange="updateCosts();" />%
                     [% END %]
                 [% END %]
             </li>
             <li>
                 [% IF ( close ) %]
                     <span class="label">Replacement cost: </span>
-                    <input type="hidden" name="rrp" id="rrp" value="[% rrp %]" />[% rrp %]  (adjusted for [% cur_active %], [% IF (listincgst == 1) %]tax inc.[% ELSE %]tax exc.[% END %])
+                    <input type="hidden" name="rrp" id="rrp" value="[% rrp | html %]" />[% rrp | html %]  (adjusted for [% cur_active | html %], [% IF (listincgst == 1) %]tax inc.[% ELSE %]tax exc.[% END %])
                 [% ELSE %]
                     <label for="rrp">Replacement cost: </label>
-                    <input type="text" size="20" name="rrp" id="rrp" value="[% rrp %]" /> (adjusted for [% cur_active %], [% IF (listincgst == 1) %]tax inc.[% ELSE %]tax exc.[% END %])
+                    <input type="text" size="20" name="rrp" id="rrp" value="[% rrp | html %]" /> (adjusted for [% cur_active | html %], [% IF (listincgst == 1) %]tax inc.[% ELSE %]tax exc.[% END %])
                 [% END %]
             </li>
             <li>
                 <label for="ecost">Budgeted cost: </label>
-                <input type="text" size="20" name="ecost" id="ecost" value="[% ecost %]" readonly="readonly"  /> [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
+                <input type="text" size="20" name="ecost" id="ecost" value="[% ecost | html %]" readonly="readonly"  /> [% IF (listincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
             </li>
             <li>
                 <label for="total">Total: </label>
-                <input type="text" id="total" size="20" name="total" value="[% total %]" readonly="readonly" /> (budgeted cost * quantity)
+                <input type="text" id="total" size="20" name="total" value="[% total | html %]" readonly="readonly" /> (budgeted cost * quantity)
             </li>
             <li>
                 [% IF ( close ) %]
                     <label for="unitprice">Actual cost: </label>
-                    <input type="text" id="unitprice" size="20" name="unitprice" value="[% unitprice %]" readonly="readonly" /> [% IF (invoiceincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
+                    <input type="text" id="unitprice" size="20" name="unitprice" value="[% unitprice | html %]" readonly="readonly" /> [% IF (invoiceincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
                 [% ELSE %]
                     <label for="unitprice">Actual cost: </label>
-                    <input type="text" id="unitprice" size="20" name="unitprice" value="[% unitprice %]" /> [% IF (invoiceincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
+                    <input type="text" id="unitprice" size="20" name="unitprice" value="[% unitprice | html %]" /> [% IF (invoiceincgst == 1) %](tax inc.)[% ELSE %](tax exc.)[% END %]
                 [% END %]
             </li>
             <li>
                 <label for="order_internalnote">Internal note: </label>
-                <textarea id="order_internalnote" cols="30" rows="3" name="order_internalnote" >[% IF ( order_internalnote ) %][% order_internalnote %][% END %]</textarea>
+                <textarea id="order_internalnote" cols="30" rows="3" name="order_internalnote" >[% IF ( order_internalnote ) %][% order_internalnote | html %][% END %]</textarea>
             </li>
             <li>
                 <label for="order_vendornote">Vendor note: </label>
-                <textarea id="order_vendornote" cols="30" rows="3" name="order_vendornote" >[% IF ( order_vendornote ) %][% order_vendornote %][% END %]</textarea>
+                <textarea id="order_vendornote" cols="30" rows="3" name="order_vendornote" >[% IF ( order_vendornote ) %][% order_vendornote | html %][% END %]</textarea>
             </li>
             <li><div class="hint">The 2 following fields are available for your own usage. They can be useful for statistical purposes</div>
                 <label for="sort1">Statistic 1: </label>
-                <input id="sort1" type="text" id="sort1" size="20" name="sort1" value="[% sort1 %]" />
+                <input id="sort1" type="text" id="sort1" size="20" name="sort1" value="[% sort1 | html %]" />
             <li>
                 <label for="sort2">Statistic 2: </label>
-                <input id="sort2" type="text" id="sort2" size="20" name="sort2" value="[% sort2 %]" />
+                <input id="sort2" type="text" id="sort2" size="20" name="sort2" value="[% sort2 | html %]" />
             </li>
         </ol>
     </fieldset>
     <fieldset class="action">
-        <input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+        <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
         <input type="submit" value="Save" />
         [% IF (suggestionid) %]
-            <a class="cancel" href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">Cancel</a>
+            <a class="cancel" href="/cgi-bin/koha/acqui/newordersuggestion.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">Cancel</a>
         [% ELSE %]
             [% IF subscriptionid %]
-                <a class="cancel" href="/cgi-bin/koha/acqui/newordersubscription.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]">Cancel</a>
+                <a class="cancel" href="/cgi-bin/koha/acqui/newordersubscription.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]">Cancel</a>
             [% ELSE %]
-                <a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Cancel</a>
+                <a class="cancel" href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Cancel</a>
             [% END %]
         [% END %]
     </fieldset>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
+    [% Asset.js("js/acq.js") | $raw %]
     [% INCLUDE 'additem.js.inc' %]
-    [% Asset.js("js/additem.js") %]
-    [% Asset.js("js/cataloging.js") %]
-    [% Asset.js("js/prevent_submit.js") %]
+    [% Asset.js("js/additem.js") | $raw %]
+    [% Asset.js("js/cataloging.js") | $raw %]
+    [% Asset.js("js/prevent_submit.js") | $raw %]
     <script type="text/javascript">
         actTotal = "";
 
             }
 
             [% IF (AcqCreateItemOrdering) %]
-                if(check_additem('[% UniqueItemFields %]') == false) {
+                if(check_additem('[% UniqueItemFields | html %]') == false) {
                     alert(_("Duplicate values detected. Please correct the errors and resubmit.") );
                     if(tobedeleted) {
                         $(lastitemblock).appendTo('#outeritemblock');
 
         $(document).ready(function(){
             [% IF AcqCreateItemOrdering and not basket.is_standing %]
-                cloneItemBlock(0, '[% UniqueItemFields %]');
+                cloneItemBlock(0, '[% UniqueItemFields | html %]');
             [% END %]
 
             [% IF ( suggestionid ) %]updateCosts();[% END %]
                 [% IF ( acqcreate ) %]
                     $('#quantity').blur(function(){
                         // if user decreases the quantity
-                        if($(this).val() < [% quantityrec %]){
+                        if($(this).val() < [% quantityrec | html %]){
                             alert(_("You have deleted item(s) in the order, don't forget to delete it(them) in the catalog"));
                             return true;
                         } else {
                             // if user increases the quantity
                             alert(_("You can't add a new item, please create a new order line"));
                             // and we replace the original value
-                            $(this).val([% quantityrec %])
+                            $(this).val([% quantityrec | html %])
                             updateCosts(); // blur is invoked after change which updated values
                             return false;
                         }
 [% INCLUDE 'intranet-bottom.inc' %]
 
 [% BLOCK display_subfield %]
-    <label>[% field.lib %] ([% field.tag %][% field.subfield %])</label>
+    <label>[% field.lib | html %] ([% field.tag | html %][% field.subfield | html %])</label>
     [% IF field.authorised_value %]
         [% SWITCH field.authorised_value %]
         [% CASE 'branches' %]
         [% END %]
     [% ELSE %]
         [% IF field.mandatory %]
-        <input type="text" name="bib_field_value" value="[% field.value %]" required="required" size="50" />
+        <input type="text" name="bib_field_value" value="[% field.value | html %]" required="required" size="50" />
         [% ELSE %]
-        <input type="text" name="bib_field_value" value="[% field.value %]" size="50" />
+        <input type="text" name="bib_field_value" value="[% field.value | html %]" size="50" />
         [% END %]
 
     [% END %]
-    <input type="hidden" name="bib_kohafield" value="[% field.kohafield %]" />
-    <input type="hidden" name="bib_tag" value="[% field.tag %]" />
-    <input type="hidden" name="bib_subfield" value="[% field.subfield %]" />
+    <input type="hidden" name="bib_kohafield" value="[% field.kohafield | html %]" />
+    <input type="hidden" name="bib_tag" value="[% field.tag | html %]" />
+    <input type="hidden" name="bib_subfield" value="[% field.subfield | html %]" />
     [% IF field.mandatory %] <span class="required">Required</span>[% END %]
 [% END %]
index 78ad410..3cfde12 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; Basket [% basketno %] &rsaquo; Duplicate warning</title>
+<title>Koha &rsaquo; Acquisitions &rsaquo; Basket [% basketno | html %] &rsaquo; Duplicate warning</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="acq_neworderempty_duplicate" class="acq">
@@ -7,7 +7,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo; Duplicate warning</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo; Duplicate warning</div>
 
 <div id="doc3" class="yui-t2">
 
@@ -20,7 +20,7 @@
 <p>You selected a record from an external source that matches an existing record in your catalog: [% IF ( BiblioDefaultViewmarc ) %]<a class="popup" target="_blank" title="Open in new window" href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% biblionumber |url %]">
 [% ELSIF ( BiblioDefaultViewlabeled_marc ) %]<a class="popup" target="_blank" title="Open in new window" href="/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=[% biblionumber |url %]">
 [% ELSIF ( BiblioDefaultViewisbd ) %]<a class="popup" target="_blank" title="Open in new window" href="/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=[% biblionumber |url %]">
-[% ELSE %]<a class="popup" target="_blank" title="Open in new window" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber |url %]">[% END %][% duplicatetitle %]</a></p>
+[% ELSE %]<a class="popup" target="_blank" title="Open in new window" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber |url %]">[% END %][% duplicatetitle | html %]</a></p>
 </div>
 
 <div class="yui-gb">
@@ -29,9 +29,9 @@
 <form action="/cgi-bin/koha/acqui/neworderempty.pl">
 <h4>Use existing record</h4>
 <p>Do not create a duplicate record. Add an order from the existing record in your catalog.</p>
-<input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-<input type="hidden" name="basketno" value="[% basketno %]" />
-<input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+<input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+<input type="hidden" name="basketno" value="[% basketno | html %]" />
+<input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
 <input type="submit" value="Use Existing" />
 </form>
 </div>
@@ -42,7 +42,7 @@
 <form action="/cgi-bin/koha/acqui/basket.pl">
 <h4>Cancel and return to order</h4>
 <p>Return to the basket without making a new order.</p>
-<input type="hidden" name="basketno" value="[% basketno %]" />
+<input type="hidden" name="basketno" value="[% basketno | html %]" />
 <input type="submit" value="Cancel" />
 </form>
 </div>
@@ -53,9 +53,9 @@
 <form action="/cgi-bin/koha/acqui/neworderempty.pl">
 <h4>Create new record</h4>
 <p>Create a new record by importing the external (duplicate) record.</p>
-<input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-<input type="hidden" name="basketno" value="[% basketno %]" />
-<input type="hidden" name="breedingid" value="[% breedingid %]" />
+<input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+<input type="hidden" name="basketno" value="[% basketno | html %]" />
+<input type="hidden" name="breedingid" value="[% breedingid | html %]" />
 <input type="hidden" name="use_external_source" value="1" />
 <input type="submit" value="Create New" />
 </form>
index aad7d34..2b041c9 100644 (file)
@@ -1,11 +1,12 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials [% biblionumber %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Serials [% biblionumber | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -13,7 +14,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo; Add order from a subscription</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo; Add order from a subscription</div>
 
 <div id="doc3" class="yui-t2">
     <div id="bd">
                         </thead>
                         <tbody>
                         [% FOREACH sub IN subs_loop %]
-                            <tr data-reneweddate="[% sub.reneweddate %]" >
-                                <td>[% sub.issn %]</td>
-                                <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid %]" class="button" title="subscription detail">[% IF (sub.title) %][% sub.title |html %][% ELSE %]
+                            <tr data-reneweddate="[% sub.reneweddate | html %]" >
+                                <td>[% sub.issn | html %]</td>
+                                <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid | html %]" class="button" title="subscription detail">[% IF (sub.title) %][% sub.title | html %][% ELSE %]
                                 ---
-                            [% END %][% IF (sub.unititle) %], [% sub.unititle %][% END %]</a>
+                            [% END %][% IF (sub.unititle) %], [% sub.unititle | html %][% END %]</a>
                                 </td>
-                                <td>[% IF (sub.publicnotes) %][% sub.publicnotes %][% END %]
-                                    [% IF (sub.internalnotes) %]([% sub.internalnotes %])[% END %]
+                                <td>[% IF (sub.publicnotes) %][% sub.publicnotes | html %][% END %]
+                                    [% IF (sub.internalnotes) %]([% sub.internalnotes | html %])[% END %]
                                 </td>
                                 <td>
-                                    [% IF (sub.vendorname) %][% sub.vendorname %][% END %]
+                                    [% IF (sub.vendorname) %][% sub.vendorname | html %][% END %]
                                 </td>
                                 <td>
-                                    [% IF (sub.branchcode) %][% Branches.GetName( sub.branchcode ) %][% END %]
+                                    [% IF (sub.branchcode) %][% Branches.GetName( sub.branchcode ) | html %][% END %]
                                 </td>
                                 <td>
-                                    [% IF (sub.callnumber) %][% sub.callnumber %][% END %]
+                                    [% IF (sub.callnumber) %][% sub.callnumber | html %][% END %]
                                 </td>
                                 <td>
                                     [% IF (sub.enddate) %]
-                                        <span title="[% sub.enddate %]">[% sub.enddate | $KohaDates %]</span>
+                                        <span title="[% sub.enddate | html %]">[% sub.enddate | $KohaDates %]</span>
                                     [% ELSE %]
                                         <span title="0000-00-00"></span>
                                     [% END %]
@@ -70,7 +71,7 @@
                                     [% IF (sub.alreadyOnOrder) %]
                                         Outstanding order (only one order per subscription is allowed)
                                     [% ELSIF not sub.aqbooksellerid || booksellerid == sub.aqbooksellerid%]
-                                        <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;biblionumber=[% sub.biblionumber %]&amp;from_subscriptionid=[% sub.subscriptionid %]" title="Order this one">
+                                        <a href="/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;biblionumber=[% sub.biblionumber | html %]&amp;from_subscriptionid=[% sub.subscriptionid | html %]" title="Order this one">
                                             Order
                                         </a>
                                     [% ELSE %]
@@ -97,7 +98,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         function updateRowsVisibility(show_only_renewed) {
index 9b5fd90..2331fa9 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Add order from a suggestion</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -10,7 +11,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'suggestions-add-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">Basket [% basketno %]</a> &rsaquo; Add order from a suggestion</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">Basket [% basketno | html %]</a> &rsaquo; Add order from a suggestion</div>
 
 <div id="doc3" class="yui-t2">
    
         <tbody>
         [% FOREACH suggestions_loo IN suggestions_loop %]
             <tr>
-                <td>[% suggestions_loo.managedby %]</td>
+                <td>[% suggestions_loo.managedby | html %]</td>
                 <td>
-                    <p>[% suggestions_loo.title |html %] - [% suggestions_loo.author %]</p>
+                    <p>[% suggestions_loo.title | html %] - [% suggestions_loo.author | html %]</p>
                     <p>
-                        [% IF ( suggestions_loo.copyrightdate ) %]&copy; [% suggestions_loo.copyrightdate %] [% END %]
-                        [% IF ( suggestions_loo.volumedesc ) %]volume: <i>[% suggestions_loo.volumedesc %]</i> [% END %]
-                        [% IF ( suggestions_loo.isbn ) %]ISBN: <i>[% suggestions_loo.isbn %]</i> [% END %]
-                        [% IF ( suggestions_loo.publishercode ) %]<br />published by: [% suggestions_loo.publishercode %] [% END %]
-                        [% IF ( suggestions_loo.publicationyear ) %] in <i>[% suggestions_loo.publicationyear %]</i> [% END %]
-                        [% IF ( suggestions_loo.place ) %] in <i>[% suggestions_loo.place %]</i> [% END %]
-                        [% IF ( suggestions_loo.note ) %]<p><i>([% suggestions_loo.note %])</i></p> [% END %]
+                        [% IF ( suggestions_loo.copyrightdate ) %]&copy; [% suggestions_loo.copyrightdate | html %] [% END %]
+                        [% IF ( suggestions_loo.volumedesc ) %]volume: <i>[% suggestions_loo.volumedesc | html %]</i> [% END %]
+                        [% IF ( suggestions_loo.isbn ) %]ISBN: <i>[% suggestions_loo.isbn | html %]</i> [% END %]
+                        [% IF ( suggestions_loo.publishercode ) %]<br />published by: [% suggestions_loo.publishercode | html %] [% END %]
+                        [% IF ( suggestions_loo.publicationyear ) %] in <i>[% suggestions_loo.publicationyear | html %]</i> [% END %]
+                        [% IF ( suggestions_loo.place ) %] in <i>[% suggestions_loo.place | html %]</i> [% END %]
+                        [% IF ( suggestions_loo.note ) %]<p><i>([% suggestions_loo.note | html %])</i></p> [% END %]
                     </p>
                 </td>
                 <td>
-                    [% suggestions_loo.surnamesuggestedby %][% IF ( suggestions_loo.firstnamesuggestedby ) %],[% END %] [% suggestions_loo.firstnamesuggestedby %]
+                    [% suggestions_loo.surnamesuggestedby | html %][% IF ( suggestions_loo.firstnamesuggestedby ) %],[% END %] [% suggestions_loo.firstnamesuggestedby | html %]
                 </td>
                 <td>
-                    [% suggestions_loo.surnamemanagedby %][% IF ( suggestions_loo.firstnamemanagedby ) %],[% END %] [% suggestions_loo.firstnamemanagedby %]
+                    [% suggestions_loo.surnamemanagedby | html %][% IF ( suggestions_loo.firstnamemanagedby ) %],[% END %] [% suggestions_loo.firstnamemanagedby | html %]
                 </td>
                 <td class="actions">
                     [% IF ( suggestions_loo.biblionumber ) %]
-                        <a href="neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;suggestionid=[% suggestions_loo.suggestionid %]&amp;biblio=[% suggestions_loo.biblionumber %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Order</a>
+                        <a href="neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;suggestionid=[% suggestions_loo.suggestionid | html %]&amp;biblio=[% suggestions_loo.biblionumber | html %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Order</a>
                     [% ELSE %]
-                        <a href="neworderempty.pl?booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;suggestionid=[% suggestions_loo.suggestionid %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Order</a>
+                        <a href="neworderempty.pl?booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;suggestionid=[% suggestions_loo.suggestionid | html %]" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Order</a>
                     [% END %]
                 </td>
             </tr>
@@ -75,7 +76,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
     $(document).ready(function() {
@@ -88,7 +89,7 @@
         }));
         $("#show_only_mine").on('click', function(e){
             e.preventDefault();
-            suggestionst.fnFilter('^[% loggedinuser %]$', 0, true);
+            suggestionst.fnFilter('^[% loggedinuser | html %]$', 0, true);
         });
         $("#show_all").on('click', function(e){
             e.preventDefault();
index f1418cd..834af9e 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE ItemTypes %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Ordered</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Ordered - [% fund_code %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Ordered - [% fund_code | html %]</div>
 
 <div id="doc3" class="yui-t2">
 
@@ -20,7 +21,7 @@
     <div id="yui-main">
         <div class="yui-b">
 
-<h1>Fund: [% fund_code %]</h1>
+<h1>Fund: [% fund_code | html %]</h1>
 <h2>Ordered</h2>
 
 <table id="spent">
 [% FOREACH order IN ordered %]
     <tr>
        <td class="cell">
-            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber %]">
-           [% order.title %]
+            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber | html %]">
+           [% order.title | html %]
             </a>
        </td>
        <td class="cell">
         [% IF ( CAN_user_acquisition_order_manage ) %]
-            <a href="/cgi-bin/koha/acqui/neworderempty.pl?ordernumber=[% order.ordernumber %]&amp;booksellerid=[% order.booksellerid %]&amp;basketno=[% order.basketno %]">[% order.ordernumber %]</a>
+            <a href="/cgi-bin/koha/acqui/neworderempty.pl?ordernumber=[% order.ordernumber | html %]&amp;booksellerid=[% order.booksellerid | html %]&amp;basketno=[% order.basketno | html %]">[% order.ordernumber | html %]</a>
         [% ELSE %]
-            [% order.ordernumber %]
+            [% order.ordernumber | html %]
         [% END %]
        </td>
        <td class="cell">
-           <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.booksellerid %]">[% order.booksellerid %]</a>
+           <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.booksellerid | html %]">[% order.booksellerid | html %]</a>
        </td>
        <td class="cell">
-        [% ItemTypes.GetDescription( order.itype ) %]
+        [% ItemTypes.GetDescription( order.itype ) | html %]
        </td>
        <td class="cell">
-           [% order.left %]
+           [% order.left | html %]
        </td>
     <td class="data cell">
-           [% order.ecost %]
+           [% order.ecost | html %]
        </td>
     <td class="cell">
-        <span title="[% order.entrydate %]">[% order.entrydate | $KohaDates %]</span>
+        <span title="[% order.entrydate | html %]">[% order.entrydate | $KohaDates %]</span>
        </td>
     <td class="data cell">
-           [% order.subtotal %]
+           [% order.subtotal | html %]
        </td>
     </tr>
 [% END %]
@@ -77,8 +78,8 @@
             [% FOREACH adjustment IN adjustments %]
                 <tr>
                     <td></td>
-                    <td colspan="6">Adjustment cost for invoice [% adjustment.invoiceid %]</td>
-                    <td class="data total">[% adjustment.adjustment %]</td>
+                    <td colspan="6">Adjustment cost for invoice [% adjustment.invoiceid | html %]</td>
+                    <td class="data total">[% adjustment.adjustment | html %]</td>
                 </tr>
             [% END %]
 
@@ -92,7 +93,7 @@
         <td> </td>
        <td> </td>
         <td class="data">
-            [% total %]
+            [% total | html %]
         </td>
     </tr>
     </tfoot>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index 679d5a6..6fc9291 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; Receipt summary for : [% name %] [% IF ( invoice ) %]invoice, [% invoice %][% END %]</title>
+<title>Koha &rsaquo; Acquisitions &rsaquo; Receipt summary for : [% name | html %] [% IF ( invoice ) %]invoice, [% invoice | html %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> &rsaquo; Receive items from : [% name %] [% IF ( invoice ) %][[% invoice |html %]][% END %] (order #[% ordernumber %])</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; Receive items from : [% name | html %] [% IF ( invoice ) %][[% invoice | html %]][% END %] (order #[% ordernumber | html %])</div>
 
 <div id="doc3" class="yui-t2">
    
@@ -20,7 +21,7 @@
        <div id="yui-main">
        <div class="yui-b">
 
-<h1>Receive items from : [% name %] [% IF ( invoice ) %][[% invoice |html %]] [% END %] (order #[% ordernumber %])</h1>
+<h1>Receive items from : [% name | html %] [% IF ( invoice ) %][[% invoice | html %]] [% END %] (order #[% ordernumber | html %])</h1>
 
 [% IF ( count ) %]
     <form action="/cgi-bin/koha/acqui/finishreceive.pl" method="post" onsubmit="return Check(this);">
 
     <fieldset class="rows">
     <legend>Catalog details</legend>
-    <ol><li><span class="label">Title: </span><span class="title">[% title |html %]</span></li>
+    <ol><li><span class="label">Title: </span><span class="title">[% title | html %]</span></li>
     <li> <span class="label">Author: </span>
-        [% author %]</li>
+        [% author | html %]</li>
     <li><span class="label">Copyright: </span>
-        [% copyrightdate %]</li>
+        [% copyrightdate | html %]</li>
     <li> <span class="label">ISBN: </span>
-        [% isbn %]</li>
+        [% isbn | html %]</li>
     <li> <span class="label">Series: </span>
-        [% seriestitle %]</li>
+        [% seriestitle | html %]</li>
     </ol>
        </fieldset>
 
@@ -48,7 +49,7 @@
         <ol>
           <li>
             <span class="label">Suggested by: </span>
-            [% surnamesuggestedby %][% IF ( firstnamesuggestedby ) %], [% firstnamesuggestedby %][% END %] (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% suggestionid %]&amp;op=show">suggestion #[% suggestionid %]</a>)
+            [% surnamesuggestedby | html %][% IF ( firstnamesuggestedby ) %], [% firstnamesuggestedby | html %][% END %] (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% suggestionid | html %]&amp;op=show">suggestion #[% suggestionid | html %]</a>)
           </li>
         </ol>
         </fieldset>
                     </thead>
                     <tbody>
                         [% FOREACH item IN items %]
-                            <tr id="item_[% item.itemnumber %]">
-                                <td style="text-align:center"><input type="checkbox" name="items_to_receive" value="[% item.itemnumber %]" /></td>
-                                <td><a style="cursor:pointer" onclick="PopupEditPage([% item.biblionumber %],[% item.itemnumber %]);">Edit</a></td>
-                                <td>[% item.barcode %]</td>
-                                <td>[% Branches.GetName( item.homebranch )%]</td>
-                                <td>[% Branches.GetName( item.holdingbranch ) %]</td>
-                                <td>[% item.notforloan %]</td>
-                                <td>[% item.restricted %]</td>
-                                <td>[% item.location %]</td>
-                                <td>[% item.itemcallnumber %]</td>
-                                <td>[% item.copynumber %]</td>
-                                <td>[% item.stocknumber %]</td>
-                                <td>[% item.collection %]</td>
-                                <td>[% item.itemtype %]</td>
-                                <td>[% item.materials %]</td>
-                                <td>[% item.itemnotes %]</td>
+                            <tr id="item_[% item.itemnumber | html %]">
+                                <td style="text-align:center"><input type="checkbox" name="items_to_receive" value="[% item.itemnumber | html %]" /></td>
+                                <td><a style="cursor:pointer" onclick="PopupEditPage([% item.biblionumber | html %],[% item.itemnumber | html %]);">Edit</a></td>
+                                <td>[% item.barcode | html %]</td>
+                                <td>[% Branches.GetName( item.homebranch ) | html %]</td>
+                                <td>[% Branches.GetName( item.holdingbranch ) | html %]</td>
+                                <td>[% item.notforloan | html %]</td>
+                                <td>[% item.restricted | html %]</td>
+                                <td>[% item.location | html %]</td>
+                                <td>[% item.itemcallnumber | html %]</td>
+                                <td>[% item.copynumber | html %]</td>
+                                <td>[% item.stocknumber | html %]</td>
+                                <td>[% item.collection | html %]</td>
+                                <td>[% item.itemtype | html %]</td>
+                                <td>[% item.materials | html %]</td>
+                                <td>[% item.itemnotes | html %]</td>
                             </tr>
                         [% END %]
                     </tbody>
             </div>
         [% END %]
     [% END %]
-    <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
-    <input type="hidden" name="invoiceid" value="[% invoiceid %]" />
-    <input type="hidden" name="ordernumber" value="[% ordernumber %]" />
-    <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+    <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+    <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
+    <input type="hidden" name="ordernumber" value="[% ordernumber | html %]" />
+    <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
        </div>
        <div class="yui-u">
     <fieldset class="rows">
                 <input type="text" size="10" id="datereceived" name="datereceived" value="[% datereceived | $KohaDates %]" class="datepicker" />
             </li>
        <li><label for="bookfund">Fund: </label><select id="bookfund" name="bookfund">
-            <option value="">Keep current ([% budget_period_description %] - [% bookfund %])</option>
+            <option value="">Keep current ([% budget_period_description | html %] - [% bookfund | html %])</option>
             [% FOREACH period IN budget_loop %]
-                <optgroup label="[% period.description %]">
+                <optgroup label="[% period.description | html %]">
                 [% FOREACH fund IN period.funds %]
                     [% IF ( fund.b_sel ) %]
-                        <option value="[% fund.b_id %]" selected="selected">[% fund.b_txt %]</option>
+                        <option value="[% fund.b_id | html %]" selected="selected">[% fund.b_txt | html %]</option>
                     [% ELSE %]
-                        <option value="[% fund.b_id %]">[% fund.b_txt %]</option>
+                        <option value="[% fund.b_id | html %]">[% fund.b_txt | html %]</option>
                     [% END %]
                 [% END %]
                 </optgroup>
             [% END %]
        </select></li>
-       <li><label>&nbsp;</label><span>(Current: [% budget_period_description %] - [% bookfund %])</span></li>
+       <li><label>&nbsp;</label><span>(Current: [% budget_period_description | html %] - [% bookfund | html %])</span></li>
        <li>
         <label for="creator">Ordered by: </label>
         <span>
        </li>
        <li><label for="quantity_to_receive">Quantity to receive: </label><span class="label">
            [% IF ( edit and not subscriptionid) %]
-               <input type="text" id="quantity_to_receive" name="quantity" value="[% quantity %]" />
+               <input type="text" id="quantity_to_receive" name="quantity" value="[% quantity | html %]" />
            [% ELSE%]
-               <input type="text" readonly="readonly" id="quantity_to_receive" name="quantity" value="[% quantity %]" />
+               <input type="text" readonly="readonly" id="quantity_to_receive" name="quantity" value="[% quantity | html %]" />
            [% END %]
            </span></li>
         <li><label for="quantity">Quantity received: </label>
           [% ELSE %]
             [% IF ( quantityreceived ) %]
                 [% IF ( edit ) %]
-                    <input type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceived %]" />
-                    <input id="origquantityrec" readonly="readonly" type="hidden" name="origquantityrec" value="[% quantityreceived %]" />
+                    <input type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceived | html %]" />
+                    <input id="origquantityrec" readonly="readonly" type="hidden" name="origquantityrec" value="[% quantityreceived | html %]" />
                 [% ELSE %]
                     [% IF ( items ) %]
-                        <input readonly="readonly" type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceivedplus1 %]" />
+                        <input readonly="readonly" type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceivedplus1 | html %]" />
                     [% ELSE %]
-                        <input type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceivedplus1 %]" />
+                        <input type="text" size="20" name="quantityrec" id="quantity" value="[% quantityreceivedplus1 | html %]" />
                     [% END %]
-                    <input id="origquantityrec" readonly="readonly" type="hidden" name="origquantityrec" value="[% quantityreceived %]" />
+                    <input id="origquantityrec" readonly="readonly" type="hidden" name="origquantityrec" value="[% quantityreceived | html %]" />
                 [% END %]
             [% ELSE %]
                 [% IF ( subscriptionid ) %]
                 <select name="tax_rate" id="tax_rate">
                 [% FOREACH gst IN gst_values %]
                     [% IF gst.option == tax_rate %]
-                        <option value="[% gst.option %]" selected="selected">[% gst.option * 100 %]%</option>
+                        <option value="[% gst.option | html %]" selected="selected">[% gst.option * 100 | html %]%</option>
                     [% ELSE %]
-                        <option value="[% gst.option %]">[% gst.option * 100 %]%</option>
+                        <option value="[% gst.option | html %]">[% gst.option * 100 | html %]%</option>
                     [% END %]
                 [% END %]
                 </select>
             <input type="hidden" name="tax_rate" value="0" />
         [% END %]
 
-        <li><label for="rrp">Replacement cost: </label>[% rrp | $Price %]</li>
-        <li><label for="ecost">Budgeted cost: </label>[% ecost | $Price %]</li>
+        <li><label for="rrp">Replacement cost: </label>[% rrp | $Price | html %]</li>
+        <li><label for="ecost">Budgeted cost: </label>[% ecost | $Price | html %]</li>
         <li>
             <label for="unitprice">Actual cost:</label>
-            <input type="text" size="20" name="unitprice" id="unitprice" value="[% unitprice | $Price on_editing => 1 %]" />
+            <input type="text" size="20" name="unitprice" id="unitprice" value="[% unitprice | $Price on_editing => 1 | html %]" />
         </li>
-        <li><label for="order_internalnote">Internal note: </label><textarea name="order_internalnote" width="40" rows="8" >[% order_internalnote %]</textarea></li>
+        <li><label for="order_internalnote">Internal note: </label><textarea name="order_internalnote" width="40" rows="8" >[% order_internalnote | html %]</textarea></li>
         [% IF order_vendornote %]
-            <li><label for="order_vendornote">Vendor note: </label><span>[% order_vendornote %]</span></li>
+            <li><label for="order_vendornote">Vendor note: </label><span>[% order_vendornote | html %]</span></li>
         [% END %]
         </ol>
     </fieldset>
 </div>
 </div><div class="yui-g"><fieldset class="action">
         <input type="submit"  value="Save" class="button" accesskey="w" />
-        <a class="cancel" href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid %]&sticky_filters=1">Cancel</a>
+        <a class="cancel" href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid | html %]&sticky_filters=1">Cancel</a>
 </fieldset></div>    </form>
 [% ELSE %]
     This ordernumber does not exist.
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
 [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'additem.js.inc' %]
-    [% Asset.js("js/additem.js") %]
-    [% Asset.js("js/cataloging.js") %]
-    [% Asset.js("js/prevent_submit.js") %]
+    [% Asset.js("js/additem.js") | $raw %]
+    [% Asset.js("js/cataloging.js") | $raw %]
+    [% Asset.js("js/prevent_submit.js") | $raw %]
     <script type="text/javascript">
         function Check(form) {
             [% IF (AcqCreateItemReceiving) %]
                     return false;
                 }
 
-                if(check_additem('[% UniqueItemFields %]') == false){
+                if(check_additem('[% UniqueItemFields | html %]') == false){
                     alert(_("Duplicate values detected. Please correct the errors and resubmit.") );
                     return false;
                 };
                     $(lastitemblock).remove();
                 }
 
-                if(check_additem('[% UniqueItemFields %]') == false){
+                if(check_additem('[% UniqueItemFields | html %]') == false){
                     alert(_("Duplicate values detected. Please correct the errors and resubmit.") );
                     if(tobedeleted) {
                         $(lastitemblock).appendTo("#outeritemblock");
 
         $(document).ready(function() {
             [% IF (AcqCreateItemReceiving) %]
-                cloneItemBlock(0, '[% UniqueItemFields %]');
+                cloneItemBlock(0, '[% UniqueItemFields | html %]');
             [% ELSIF (AcqCreateItem == 'ordering') && not subscriptionid %]
                 $("input[name='items_to_receive']").change(function() {
                     CalcQtyToReceive();
index 37a35af..f3021db 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,8 +7,8 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; [% IF ( date ) %]
-            Receipt summary for [% name %] [% IF ( invoice ) %]invoice [% invoice %][% END %] on [% datereceived | $KohaDates %][% ELSE %]Receive orders from [% name %][% END %]</title>
-[% Asset.css("css/datatables.css") %]
+            Receipt summary for [% name | html %] [% IF ( invoice ) %]invoice [% invoice | html %][% END %] on [% datereceived | $KohaDates %][% ELSE %]Receive orders from [% name | html %][% END %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
     [% IF datereceived %]
-        Receipt summary for <i>[% name %]</i>
+        Receipt summary for <i>[% name | html %]</i>
         [% IF ( invoice ) %]
-            <i>[ [% invoice |html %] ]</i>
+            <i>[ [% invoice | html %] ]</i>
         [% END %]
         on <i>[% datereceived | $KohaDates %]</i>
     [% ELSE %]
-        Receive orders from [% name %]
+        Receive orders from [% name | html %]
     [% END %]
 </div>
 
        <h3>Error adding items:</h3>
        <ul>
        [% FOREACH error_loo IN error_loop %]
-               <li>[% error_loo.error_param %][% IF ( error_loo.error_duplicate_barcode ) %]Duplicate Barcode[% END %] <!-- todo: other error conditions come here. --></li>
+               <li>[% error_loo.error_param | html %][% IF ( error_loo.error_duplicate_barcode ) %]Duplicate Barcode[% END %] <!-- todo: other error conditions come here. --></li>
        [% END %]
        </ul>
        </div>
        [% END %]
     <h1>
         [% IF datereceived %]
-            Receipt summary for <i>[% name %]</i> [% IF ( invoice ) %] <i> [ [% invoice |html %] ] </i>[% END %] on <i>[% datereceived | $KohaDates %]</i>
+            Receipt summary for <i>[% name | html %]</i> [% IF ( invoice ) %] <i> [ [% invoice | html %] ] </i>[% END %] on <i>[% datereceived | $KohaDates %]</i>
         [% ELSE %]
-            Receive orders from [% name %]
+            Receive orders from [% name | html %]
         [% END %]
     </h1>
 
@@ -87,7 +88,7 @@
 
 [% UNLESS no_orders_to_display %]
 <div id="acqui_receive_summary">
-<p><strong>Invoice number:</strong> [% invoice |html %] <strong>Received by:</strong> [% loggedinusername %] <strong>On:</strong> [% datereceived | $KohaDates %]</p>
+<p><strong>Invoice number:</strong> [% invoice | html %] <strong>Received by:</strong> [% loggedinusername | html %] <strong>On:</strong> [% datereceived | $KohaDates %]</p>
 </div>
 [% UNLESS (invoiceclosedate) %]
   <div id="acqui_receive_search">
         <tbody class="filterclass">
         [% FOREACH loop_order IN loop_orders %]
             <tr>
-                <td class="basketfilterclass">[% loop_order.basketname %] (<a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% loop_order.basketno %]">[% loop_order.basketno %]</a>)</td>
+                <td class="basketfilterclass">[% loop_order.basketname | html %] (<a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% loop_order.basketno | html %]">[% loop_order.basketno | html %]</a>)</td>
                 <td>
                   [% IF loop_order.basketgroupid %]
-                    [% loop_order.basketgroupname %] (<a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% loop_order.booksellerid %]">[% loop_order.basketgroupid %]</a>)
+                    [% loop_order.basketgroupname | html %] (<a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% loop_order.booksellerid | html %]">[% loop_order.basketgroupid | html %]</a>)
                   [% ELSE %]
                     No basket group
                   [% END %]
                 </td>
-                <td class="orderfilterclass"><a href="neworderempty.pl?ordernumber=[% loop_order.ordernumber %]&amp;booksellerid=[% loop_order.booksellerid %]">[% loop_order.ordernumber %]</a></td>
+                <td class="orderfilterclass"><a href="neworderempty.pl?ordernumber=[% loop_order.ordernumber | html %]&amp;booksellerid=[% loop_order.booksellerid | html %]">[% loop_order.ordernumber | html %]</a></td>
                 <td class="summaryfilterclass">
-                  <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loop_order.biblionumber %]">[% loop_order.title |html %]</a>
-                [% IF ( loop_order.author ) %] by [% loop_order.author %][% END %]
-                [% IF ( loop_order.isbn ) %] &ndash; [% loop_order.isbn %][% END %]
+                  <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loop_order.biblionumber | html %]">[% loop_order.title | html %]</a>
+                [% IF ( loop_order.author ) %] by [% loop_order.author | html %][% END %]
+                [% IF ( loop_order.isbn ) %] &ndash; [% loop_order.isbn | html %][% END %]
                 [% IF ( loop_order.publishercode ) %]
-                    <br />Publisher: [% loop_order.publishercode %]
-                    [%- IF    ( loop_order.publicationyear > 0) -%], [% loop_order.publicationyear %]
-                    [%- ELSIF ( loop_order.copyrightdate   > 0) -%] [% loop_order.copyrightdate %]
+                    <br />Publisher: [% loop_order.publishercode | html %]
+                    [%- IF    ( loop_order.publicationyear > 0) -%], [% loop_order.publicationyear | html %]
+                    [%- ELSIF ( loop_order.copyrightdate   > 0) -%] [% loop_order.copyrightdate | html %]
                     [% END %]
                 [% END %]
                 [% IF ( loop_order.suggestionid ) %]
                     <br/>
-                    Suggested by: [% loop_order.surnamesuggestedby %][% IF ( loop_order.firstnamesuggestedby ) %], [% loop_order.firstnamesuggestedby %] [% END %]
-                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% loop_order.suggestionid %]&amp;op=show">suggestion #[% loop_order.suggestionid %]</a>)
+                    Suggested by: [% loop_order.surnamesuggestedby | html %][% IF ( loop_order.firstnamesuggestedby ) %], [% loop_order.firstnamesuggestedby | html %] [% END %]
+                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% loop_order.suggestionid | html %]&amp;op=show">suggestion #[% loop_order.suggestionid | html %]</a>)
                 [% END %]
                 <br />
                 [% IF ( loop_order.order_internalnote ) %]
-                    <p class="ordernote"><strong>Internal note: </strong>[% loop_order.order_internalnote|html %] [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid %]&type=internal">Change internal note</a>]</p>
+                    <p class="ordernote"><strong>Internal note: </strong>[% loop_order.order_internalnote | html %] [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber | html %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | html %]&type=internal">Change internal note</a>]</p>
                 [% ELSE %]
-                    [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid %]&type=internal">Add internal note</a>]
+                    [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber | html %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | html %]&type=internal">Add internal note</a>]
                 [% END %]
                 [% IF ( loop_order.order_vendornote ) %]
-                    <p class="ordernote"><strong>Vendor note: </strong>[% loop_order.order_vendornote|html %]</p>
+                    <p class="ordernote"><strong>Vendor note: </strong>[% loop_order.order_vendornote | html %]</p>
                 [% ELSE %]
-                    [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid %]&type=vendor">Add vendor note</a>]
+                    [<a href="/cgi-bin/koha/acqui/modordernotes.pl?ordernumber=[% loop_order.ordernumber | html %]&amp;referrer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | html %]&type=vendor">Add vendor note</a>]
                 [% END %]
                 </td>
                 <td>
-                  <a href="/cgi-bin/koha/acqui/showorder.pl?ordernumber=[% loop_order.ordernumber %]" class="previewData">Order</a><br>
-                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% loop_order.biblionumber %]" class="previewData">MARC</a><br>
-                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% loop_order.biblionumber %]" class="previewData">Card</a>
+                  <a href="/cgi-bin/koha/acqui/showorder.pl?ordernumber=[% loop_order.ordernumber | html %]" class="previewData">Order</a><br>
+                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% loop_order.biblionumber | html %]" class="previewData">MARC</a><br>
+                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% loop_order.biblionumber | html %]" class="previewData">Card</a>
                 </td>
-                <td>[% loop_order.quantity %]</td>
-                <td>[% loop_order.ecost | $Price %]</td>
-                <td>[% loop_order.total | $Price %]</td>
-                <td>[% loop_order.budget_name %]</td>
+                <td>[% loop_order.quantity | html %]</td>
+                <td>[% loop_order.ecost | $Price | html %]</td>
+                <td>[% loop_order.total | $Price | html %]</td>
+                <td>[% loop_order.budget_name | html %]</td>
                                <td>
-                              <a href="orderreceive.pl?ordernumber=[% loop_order.ordernumber %]&amp;invoiceid=[% invoiceid %]">Receive</a>
+                              <a href="orderreceive.pl?ordernumber=[% loop_order.ordernumber | html %]&amp;invoiceid=[% invoiceid | html %]">Receive</a>
                     <br />
-                    <a href="#" onclick="transfer_order_popup([% loop_order.ordernumber %]); return false;">Transfer</a>
+                    <a href="#" onclick="transfer_order_popup([% loop_order.ordernumber | html %]); return false;">Transfer</a>
                                </td>
                                <td>
                         [% IF ( loop_order.left_holds_on_order ) %]
-                        <span class="button" title="Can't cancel order, ([% loop_order.holds_on_order %]) holds are linked with this order cancel holds first">Can't cancel order</span><br>
+                        <span class="button" title="Can't cancel order, ([% loop_order.holds_on_order | html %]) holds are linked with this order cancel holds first">Can't cancel order</span><br>
                         [% ELSE %]
-                        <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% loop_order.ordernumber %]&biblionumber=[% loop_order.biblionumber %]&referrer=[% "/cgi-bin/koha/acqui/parcel.pl?invoiceid=$invoiceid" | uri %]">Cancel order</a><br />
+                        <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% loop_order.ordernumber | html %]&biblionumber=[% loop_order.biblionumber | html %]&referrer=[% "/cgi-bin/koha/acqui/parcel.pl?invoiceid=$invoiceid" | uri %]">Cancel order</a><br />
                         [% END %]
                         [% IF ( loop_order.can_del_bib ) %]
-                        <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% loop_order.ordernumber %]&biblionumber=[% loop_order.biblionumber %]&del_biblio=1&referrer=[% "/cgi-bin/koha/acqui/parcel.pl?invoiceid=$invoiceid" | uri %]">Cancel order and catalog record</a><br />
+                        <a href="/cgi-bin/koha/acqui/cancelorder.pl?ordernumber=[% loop_order.ordernumber | html %]&biblionumber=[% loop_order.biblionumber | html %]&del_biblio=1&referrer=[% "/cgi-bin/koha/acqui/parcel.pl?invoiceid=$invoiceid" | uri %]">Cancel order and catalog record</a><br />
                         [% ELSE %]
                         <span class="button" title="Can't delete catalog record, see constraints below">Can't cancel order and delete catalog record</span><br>
                         [% END %]
                         [% IF ( loop_order.left_item ) %]
-                        <b title="Can't delete catalog record, because of [% loop_order.items %] existing item(s)" >[% loop_order.items %] item(s) left</b><br>
+                        <b title="Can't delete catalog record, because of [% loop_order.items | html %] existing item(s)" >[% loop_order.items | html %] item(s) left</b><br>
                         [% END %]
                         [% IF ( loop_order.left_biblio ) %]
-                        <b title="Can't delete catalog record, delete other orders linked to it first">[% loop_order.biblios %] order(s) left</b><br>
+                        <b title="Can't delete catalog record, delete other orders linked to it first">[% loop_order.biblios | html %] order(s) left</b><br>
                         [% END %]
                         [% IF ( loop_order.left_subscription ) %]
-                        <b title="Can't delete catalog record, delete subscriptions first">[% loop_order.subscriptions %] subscription(s) left</b><br>
+                        <b title="Can't delete catalog record, delete subscriptions first">[% loop_order.subscriptions | html %] subscription(s) left</b><br>
                         [% END %]
                         [% IF ( loop_order.left_holds ) %]
-                        <b title="Can't delete catalog record or order, cancel holds first">[% loop_order.holds %] hold(s) left</b>
+                        <b title="Can't delete catalog record or order, cancel holds first">[% loop_order.holds | html %] hold(s) left</b>
                         [% END %]
                     </td>
                 </tr>
 [% ELSE %]
     <p>
         Invoice is closed, so you can't receive orders anymore.
-        <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid %]">Reopen it</a>.
+        <a href="/cgi-bin/koha/acqui/invoice.pl?op=reopen&invoiceid=[% invoiceid | html %]&referer=/cgi-bin/koha/acqui/parcel.pl%3Finvoiceid=[% invoiceid | html %]">Reopen it</a>.
     </p>
 [% END %]
 
                 [% ELSE %]
                     <td colspan="6" class="total">(Tax exc.)</td>
                 [% END %]
-                <td colspan="2"><i>Subtotal for</i> [% key %]</td>
-                <td>[% subtotal_for_funds.$key.ecost | $Price %]</td>
-                <td>[% subtotal_for_funds.$key.unitprice | $Price  %]</td>
+                <td colspan="2"><i>Subtotal for</i> [% key | html %]</td>
+                <td>[% subtotal_for_funds.$key.ecost | $Price | html %]</td>
+                <td>[% subtotal_for_funds.$key.unitprice | $Price | html %]</td>
                 <td>&nbsp;</td>
                 <td>&nbsp;</td>
             </tr>
         [% END %]
         <tr>
             <th colspan="10" class="total">Total tax exc.</th>
-            <th>[% total_tax_excluded | $Price %]</th>
+            <th>[% total_tax_excluded | $Price | html %]</th>
             <th></th>
         </tr>
         [% FOREACH book_foot IN book_foot_loop %]
             <tr>
-                <th colspan="10">Total (GST [% book_foot.tax_rate * 100 %]%)</th>
-                <th>[% book_foot.tax_value | $Price %]</th>
+                <th colspan="10">Total (GST [% book_foot.tax_rate * 100 | html %]%)</th>
+                <th>[% book_foot.tax_value | $Price | html %]</th>
                 <th></th>
             </tr>
         [% END %]
         <tr>
             <th colspan="10" class="total">Total tax inc.</th>
-            <th>[% total_tax_included | $Price %]</th>
+            <th>[% total_tax_included | $Price | html %]</th>
             <th></th>
         </tr>
     </tfoot>
     <tbody class="filterclass">
         [% FOREACH order IN loop_received %]
             <tr>
-                <td>[% order.basketname %] (<a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% order.basketno %]">[% order.basketno %]</a>)</td>
+                <td>[% order.basketname | html %] (<a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% order.basketno | html %]">[% order.basketno | html %]</a>)</td>
                 <td>
                   [% IF order.basketgroupid %]
-                    [% order.basketgroupname %] (<a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% order.booksellerid %]">[% order.basketgroupid %]</a>)
+                    [% order.basketgroupname | html %] (<a href="/cgi-bin/koha/acqui/basketgroup.pl?booksellerid=[% order.booksellerid | html %]">[% order.basketgroupid | html %]</a>)
                   [% ELSE %]
                     No basket group
                   [% END %]
                 </td>
                 <td>
-                  <a href="neworderempty.pl?ordernumber=[% order.ordernumber %]&amp;booksellerid=[% booksellerid %]">[% order.ordernumber %]</a>
+                  <a href="neworderempty.pl?ordernumber=[% order.ordernumber | html %]&amp;booksellerid=[% booksellerid | html %]">[% order.ordernumber | html %]</a>
                   [% IF (order.parent_ordernumber && (order.parent_ordernumber != order.ordernumber)) %]
-                    (<a href="neworderempty.pl?ordernumber=[% order.parent_ordernumber %]&amp;booksellerid=[% booksellerid %]" title="Original order line">[% order.parent_ordernumber %]</a>)
+                    (<a href="neworderempty.pl?ordernumber=[% order.parent_ordernumber | html %]&amp;booksellerid=[% booksellerid | html %]" title="Original order line">[% order.parent_ordernumber | html %]</a>)
                   [% END %]
                 </td>
                 <td>
                   [% IF order.total_holds > 0 %]
                     [% IF order.item_holds > 0 %]
-                      <span class="error"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% order.biblionumber %]">[% order.item_holds %]</a></span>
+                      <span class="error"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% order.biblionumber | html %]">[% order.item_holds | html %]</a></span>
                     [% ELSE %]
                       0
                     [% END %]
                     /
-                    <span class="error"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% order.biblionumber %]">[% order.total_holds %]</a></span>
+                    <span class="error"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% order.biblionumber | html %]">[% order.total_holds | html %]</a></span>
                   [% ELSE %]
                     0
                   [% END %]
                 </td>
-                <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber %]">[% order.title |html %]</a>
-                [% IF ( order.author ) %] / [% order.author %][% END %]
-                [% IF ( order.isbn ) %] - [% order.isbn %][% END %]
+                <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber | html %]">[% order.title | html %]</a>
+                [% IF ( order.author ) %] / [% order.author | html %][% END %]
+                [% IF ( order.isbn ) %] - [% order.isbn | html %][% END %]
                 [% IF ( order.publishercode ) %]
-                    <br />Publisher: [% order.publishercode %]
-                    [%- IF    ( order.publicationyear > 0) -%], [% order.publicationyear %]
-                    [%- ELSIF ( order.copyrightdate   > 0) -%] [% order.copyrightdate %]
+                    <br />Publisher: [% order.publishercode | html %]
+                    [%- IF    ( order.publicationyear > 0) -%], [% order.publicationyear | html %]
+                    [%- ELSIF ( order.copyrightdate   > 0) -%] [% order.copyrightdate | html %]
                     [% END %]
                 [% END %]
                 [% IF ( order.suggestionid ) %]
                     <br/>
-                    Suggested by: [% order.surnamesuggestedby %][% IF ( order.firstnamesuggestedby ) %], [% order.firstnamesuggestedby %] [% END %]
-                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% order.suggestionid %]&amp;op=show">suggestion #[% order.suggestionid %]</a>)
+                    Suggested by: [% order.surnamesuggestedby | html %][% IF ( order.firstnamesuggestedby ) %], [% order.firstnamesuggestedby | html %] [% END %]
+                    (<a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% order.suggestionid | html %]&amp;op=show">suggestion #[% order.suggestionid | html %]</a>)
                 [% END %]
                 </td>
                 <td>
-                  <a href="/cgi-bin/koha/acqui/showorder.pl?ordernumber=[% order.ordernumber %]" class="previewData">Order</a><br>
-                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% order.biblionumber %]" class="previewData">MARC</a><br>
-                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% order.biblionumber %]" class="previewData">Card</a>
+                  <a href="/cgi-bin/koha/acqui/showorder.pl?ordernumber=[% order.ordernumber | html %]" class="previewData">Order</a><br>
+                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% order.biblionumber | html %]" class="previewData">MARC</a><br>
+                  <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% order.biblionumber | html %]" class="previewData">Card</a>
                 </td>
-                <td>[% order.quantityreceived %]</td>
-                <td>[% order.budget.budget_name %]</td>
-                <td>[% order.ecost | $Price %]</td>
-                <td>[% order.unitprice | $Price %]</td>
-                <td>[% order.total | $Price %]</td>
+                <td>[% order.quantityreceived | html %]</td>
+                <td>[% order.budget.budget_name | html %]</td>
+                <td>[% order.ecost | $Price | html %]</td>
+                <td>[% order.unitprice | $Price | html %]</td>
+                <td>[% order.total | $Price | html %]</td>
                 <td>
                     [% IF loop_receive.cannot_cancel or ( order.basket.effective_create_items == "receiving" and loop_receive.holds > 0 ) %]
                       [% IF loop_receive.cannot_cancel %]
-                        [% span_title = BLOCK %]
+                        [% span_title = BLOCK | html %]
                             Cannot cancel receipt of this order line because it
                             was created from a partial receipt of order line no.
-                            [% order.parent_ordernumber %], which is
+                            [% order.parent_ordernumber | html %], which is
                             already received. Try cancelling this one first and
                             retry.
                         [% END %]
                       [% ELSE %]
                         [%# FIXME Here we block the cancellation if holds exist. Actually it could be possible if items will be exist after the deletion %]
                         [%# Some additional checks should be added in the pl file %]
-                        [% span_title = BLOCK %]
+                        [% span_title = BLOCK | html %]
                           Cannot cancel receipt of this order line because at least one reservation exists on the records.
                         [% END %]
                       [% END %]
-                      <span title="[% span_title | collapse %]">
+                      <span title="[% span_title | collapse | html %]">
                           Can't cancel receipt
                       </span>
                     [% ELSE %]
-                        <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid %]&op=cancelreceipt&ordernumber=[% order.ordernumber %]">Cancel receipt</a>
+                        <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid | html %]&op=cancelreceipt&ordernumber=[% order.ordernumber | html %]">Cancel receipt</a>
                     [% END %]
                 </td>
             </tr>
         <h3 id="dataPreviewLabel">MARC preview</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
 </div>
 
 [% IF (invoiceclosedate) %]
-    <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid %]">View invoice</a>
+    <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">View invoice</a>
 [% ELSE %]
     <form action="/cgi-bin/koha/acqui/invoice.pl" method="get">
-        <input type="hidden" name="invoiceid" value="[% invoiceid %]" />
+        <input type="hidden" name="invoiceid" value="[% invoiceid | html %]" />
         <fieldset class="action">
             <input type="submit" value="Finish receiving" />
         </fieldset>
     <ol>
       <li>
         <label for="summaryfilter">ISBN, author or title :</label>
-        <input type="text" name="summaryfilter" id="summaryfilter" value="[% summaryfilter %]"/>
+        <input type="text" name="summaryfilter" id="summaryfilter" value="[% summaryfilter | html %]"/>
       </li>
       <li>
         <label for="basketfilter">Basket :</label>
-        <input type="text" name="basketfilter" id="basketfilter" value="[% basketfilter %]"/>
+        <input type="text" name="basketfilter" id="basketfilter" value="[% basketfilter | html %]"/>
       </li>
       <li>
           <label for="basketgroupnamefilter">Basket group name :</label>
-          <input type="text" name="basketgroupnamefilter" id="basketgroupnamefilter" value="[% basketgroupnamefilter %]" />
+          <input type="text" name="basketgroupnamefilter" id="basketgroupnamefilter" value="[% basketgroupnamefilter | html %]" />
       </li>
       <li>
         <label for="orderfilter">Order line :</label>
-        <input type="text" name="orderfilter" id="orderfilter" value="[% orderfilter %]"/>
+        <input type="text" name="orderfilter" id="orderfilter" value="[% orderfilter | html %]"/>
       </li>
       [% IF (UNIMARC) %]
         <li>
           <label for="eanfilter">EAN :</label>
-          <input type="text" name="eanfilter" id="eanfilter" value="[% eanfilter %]"/>
+          <input type="text" name="eanfilter" id="eanfilter" value="[% eanfilter | html %]"/>
         </li>
       [% END %]
     </ol>
     <fieldset class="action">
       <input type="hidden" value="search" name="op" />
-      <input type="hidden" value="[% invoiceid %]" name="invoiceid" />
+      <input type="hidden" value="[% invoiceid | html %]" name="invoiceid" />
       <input type="submit" value="Filter" />
-      <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid %]">Clear</a>
+      <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoiceid | html %]">Clear</a>
     </fieldset>
   </fieldset>
 </form>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") | $raw %]
     <style type="text/css">#dataPreview { width : 80%; } @media (max-width: 767px) { #dataPreview { margin: 0; width : auto; } }</style>
     <script type="text/javascript">
 
         dt_overwrite_html_sorting_localeCompare();
-        var sticky_filters = [% sticky_filters %];
+        var sticky_filters = [% sticky_filters | html %];
 
         $(document).ready(function(){
             if ( $("#pendingt").length ) {
             });
             $("#dataPreview").on("hidden", function(){
                 $("#dataPreviewLabel").html("");
-                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
 
         });
index ee0ecd0..2031230 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; Receive shipment from vendor [% name %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Acquisitions &rsaquo; Receive shipment from vendor [% name | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -11,7 +12,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>  &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a> &rsaquo; Receive shipment from vendor [% name %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>  &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; Receive shipment from vendor [% name | html %]</div>
 
 [% IF ( count ) %]<div id="doc3" class="yui-t2">[% ELSE %]<div id="doc" class="yui-t7">[% END %]
    
@@ -24,7 +25,7 @@
         <p>An error has occurred. Invoice cannot be created.</p>
     </div>
 [% END %]
-<h1>Receive shipment from vendor <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name %]</a></h1>
+<h1>Receive shipment from vendor <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a></h1>
 
     [% IF duplicate_invoices %]
     <div id="parcels_duplicate_invoice" class="dialog alert">
             <tbody>
                 [% FOREACH invoice IN duplicate_invoices %]
                     <tr>
-                        <td>[% invoice.invoicenumber %]</td>
+                        <td>[% invoice.invoicenumber | html %]</td>
                         <td>[% invoice.shipmentdate | $KohaDates %]</td>
-                        <td><a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoice.invoiceid %]">Receive</a></td>
+                        <td><a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoice.invoiceid | html %]">Receive</a></td>
                     </tr>
                 [% END %]
             </tbody>
         </table>
         <form method="get" action="parcels.pl">
-            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
             <input type="hidden" name="op" value="confirm" />
-            <input type="hidden" name="invoice" value="[% invoicenumber %]" />
+            <input type="hidden" name="invoice" value="[% invoicenumber | html %]" />
             <input type="hidden" name="shipmentdate" value="[% shipmentdate | $KohaDates %]" />
-            <input type="hidden" name="shipmentcost" value="[% shipmentcost %]" />
-            <input type="hidden" name="shipmentcost_budgetid" value="[% shipmentcost_budgetid %]" />
+            <input type="hidden" name="shipmentcost" value="[% shipmentcost | html %]" />
+            <input type="hidden" name="shipmentcost_budgetid" value="[% shipmentcost_budgetid | html %]" />
             <input type="submit" class="button" value="Create new invoice anyway" />
         </form>
     </div>
@@ -55,7 +56,7 @@
 
 
 [% IF ( count ) %]
-<p> [% count %] shipments</p>
+<p> [% count | html %] shipments</p>
 <div id="resultlist">
 <!-- Search Results Table -->
 
     [% FOREACH searchresult IN searchresults %]
         <tr>
             <td>
-                [% searchresult.number %]
+                [% searchresult.number | html %]
             </td>
             <td>
-                <span title="[% searchresult.datereceived %]">[% searchresult.datereceived | $KohaDates %]</span>
+                <span title="[% searchresult.datereceived | html %]">[% searchresult.datereceived | $KohaDates %]</span>
             </td>
             <td>
                 [% IF ( searchresult.code ) %]
-                    <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% searchresult.invoiceid %]">[% searchresult.code |html %]</a>
+                    <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% searchresult.invoiceid | html %]">[% searchresult.code | html %]</a>
                 [% ELSE %]
                     <abbr title="not available">n/a</abbr>
                 [% END %]
             </td>
             <td>
-                [% searchresult.reccount %]
+                [% searchresult.reccount | html %]
             </td>
             <td>
-                [% searchresult.bibcount %]
+                [% searchresult.bibcount | html %]
             </td>
             <td>
-                [% searchresult.itemcount %]
+                [% searchresult.itemcount | html %]
             </td>
         </tr>
     [% END %]
 <div id="resultnumber">
 <!-- Row of numbers corresponding to search result pages -->
 [% IF ( displayprev ) %]
-    <a href="parcels.pl?booksellerid=[% booksellerid %]&amp;startfrom=[% prevstartfrom %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto %][% END %][% IF ( code ) %]&amp;filter=[% code %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage %][% END %]&amp;type=intra">&lt;&lt; Previous</a>
+    <a href="parcels.pl?booksellerid=[% booksellerid | html %]&amp;startfrom=[% prevstartfrom | html %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom | html %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto | html %][% END %][% IF ( code ) %]&amp;filter=[% code | html %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby | html %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage | html %][% END %]&amp;type=intra">&lt;&lt; Previous</a>
 [% END %]
 [% FOREACH number IN numbers %]
     [% IF ( number.highlight ) %]
-    <span class="current">[% number.number %]</span>
+    <span class="current">[% number.number | html %]</span>
     [% ELSE %]
-    <a href="parcels.pl?booksellerid=[% booksellerid %]&amp;startfrom=[% number.startfrom %][% IF ( number.datefrom ) %]&amp;datefrom=[% number.datefrom %][% END %][% IF ( number.dateto ) %]&amp;dateto=[% number.dateto %][% END %][% IF ( number.code ) %]&amp;filter=[% number.code %][% END %][% IF ( number.orderby ) %]&amp;orderby=[% number.orderby %][% END %][% IF ( number.resultsperpage ) %]&amp;resultsperpage=[% number.resultsperpage %][% END %]&amp;type=intra">[% number.number %]</a>
+    <a href="parcels.pl?booksellerid=[% booksellerid | html %]&amp;startfrom=[% number.startfrom | html %][% IF ( number.datefrom ) %]&amp;datefrom=[% number.datefrom | html %][% END %][% IF ( number.dateto ) %]&amp;dateto=[% number.dateto | html %][% END %][% IF ( number.code ) %]&amp;filter=[% number.code | html %][% END %][% IF ( number.orderby ) %]&amp;orderby=[% number.orderby | html %][% END %][% IF ( number.resultsperpage ) %]&amp;resultsperpage=[% number.resultsperpage | html %][% END %]&amp;type=intra">[% number.number | html %]</a>
     [% END %]
 [% END %]
 [% IF ( displaynext ) %]
-    <a href="parcels.pl?booksellerid=[% booksellerid %]&amp;startfrom=[% nextstartfrom %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto %][% END %][% IF ( code ) %]&amp;filter=[% code %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage %][% END %]&amp;type=intra">Next &gt;&gt;</a>
+    <a href="parcels.pl?booksellerid=[% booksellerid | html %]&amp;startfrom=[% nextstartfrom | html %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom | html %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto | html %][% END %][% IF ( code ) %]&amp;filter=[% code | html %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby | html %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage | html %][% END %]&amp;type=intra">Next &gt;&gt;</a>
 [% END %]
 </div>
 </div>
     <legend>Receive a new shipment</legend>
        <ol> <li>
             <label for="invoice" class="required">Vendor invoice:</label>
-            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
             <input type="hidden" name="op" value="new" />
             <input type="text" size="20" id="invoice" name="invoice" class="focus required" required="required" />
         </li>
                 <option value="">No fund</option>
                 [% FOREACH budget IN budgets %]
                     [% IF ( budget.b_active ) %]
-                        <option value="[% budget.b_id %]">[% budget.b_txt %]</option>
+                        <option value="[% budget.b_id | html %]">[% budget.b_txt | html %]</option>
                     [% ELSE %]
-                        <option value="[% budget.b_id %]" class="b_inactive">[% budget.b_txt %] (inactive)</option>
+                        <option value="[% budget.b_id | html %]" class="b_inactive">[% budget.b_txt | html %] (inactive)</option>
                     [% END %]
                 [% END %]
             </select>
         </li>
                </ol>
     </fieldset>
-            <fieldset class="action"><input type="submit" class="button" value="Next" /> <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">Cancel</a></fieldset>
+            <fieldset class="action"><input type="submit" class="button" value="Next" /> <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">Cancel</a></fieldset>
         </form>
     </div>
 </div>
     <fieldset class="brief">
        <h4>Filter</h4>
         <ol>
-            <li> <input type="hidden" name="booksellerid" value="[% booksellerid %]" /></li>
-            <li><label for="filter">Invoice number:</label><input type="text" size="20" name="filter" value="[% filter %]" id="filter" /></li>
-            <li><label for="datefrom">From:</label><input type="text" size="9" id="datefrom" name="datefrom" value="[% datefrom %]" class="datepicker" /><br />
-                <label for="dateto">To:</label><input type="text" size="9" id="dateto" name="dateto" value="[% dateto %]" class="datepicker" /></li>
+            <li> <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" /></li>
+            <li><label for="filter">Invoice number:</label><input type="text" size="20" name="filter" value="[% filter | html %]" id="filter" /></li>
+            <li><label for="datefrom">From:</label><input type="text" size="9" id="datefrom" name="datefrom" value="[% datefrom | html %]" class="datepicker" /><br />
+                <label for="dateto">To:</label><input type="text" size="9" id="dateto" name="dateto" value="[% dateto | html %]" class="datepicker" /></li>
             <li><label for="orderby">Sort by :</label><select name="orderby" id="orderby">
                 <option value="invoicenumber">Invoice number</option>
                 <option value="shipmentdate">Shipment date</option>
                 <option value="100">100</option>
                 </select></li>
         </ol>
-       <fieldset class="action"><input type="submit" class="button" value="Filter" /> <a href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid %]">Clear</a></fieldset>
+       <fieldset class="action"><input type="submit" class="button" value="Filter" /> <a href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid | html %]">Clear</a></fieldset>
        </fieldset>
 </form>[% END %]
 </div>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
index 6d525bf..9a4e538 100644 (file)
@@ -9,7 +9,7 @@
                 <ol>
                     <li>
                         <span class="label">Creation date: </span>
-                        [% order.entrydate %]
+                        [% order.entrydate | html %]
                     </li>
                     <li>
                         <span class="label">Ordered by: </span>
                     </li>
                     <li>
                         <span class="label">Claims count: </span>
-                        [% order.claims_count %]
+                        [% order.claims_count | html %]
                     </li>
                     <li>
                         <span class="label">Last claim date: </span>
-                        [% order.claimed_date %]
+                        [% order.claimed_date | html %]
                     </li>
             </ol>
           </fieldset>
index b045c53..21b0701 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE ItemTypes %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Spent</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Spent - [% fund_code %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; Spent - [% fund_code | html %]</div>
 
 <div id="doc3" class="yui-t2">
 
@@ -20,7 +21,7 @@
     <div id="yui-main">
         <div class="yui-b">
 
-<h1>Fund: [% fund_code %]</h1>
+<h1>Fund: [% fund_code | html %]</h1>
 <h2>Spent</h2>
 
 <table id="spent">
     [% FOREACH order IN spent %]
         <tr>
             <td class="cell">
-                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber %]">
-                    [% order.title %]
+                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% order.biblionumber | html %]">
+                    [% order.title | html %]
                 </a>
             </td>
             <td class="cell">
-                [% order.ordernumber %]
+                [% order.ordernumber | html %]
             </td>
             <td class="cell">
-                <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.booksellerid %]">[% order.booksellerid %]</a>
+                <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.booksellerid | html %]">[% order.booksellerid | html %]</a>
             </td>
             <td class="cell">
-                <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% order.invoiceid %]">[% order.invoicenumber %]</a>
+                <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% order.invoiceid | html %]">[% order.invoicenumber | html %]</a>
             </td>
             <td class="cell">
-                [% ItemTypes.GetDescription( order.itype ) %]
+                [% ItemTypes.GetDescription( order.itype ) | html %]
             </td>
             <td class="cell">
-                [% order.quantityreceived %]
+                [% order.quantityreceived | html %]
             </td>
             <td class="cell">
-                [% order.unitprice %]
+                [% order.unitprice | html %]
             </td>
             <td class="cell">
-                <span title="[% order.entrydate %]">[% order.entrydate | $KohaDates %]</span>
+                <span title="[% order.entrydate | html %]">[% order.entrydate | $KohaDates %]</span>
             </td>
             <td class="cell">
-                <span title="[% order.datereceived %]">[% order.datereceived | $KohaDates %]</span>
+                <span title="[% order.datereceived | html %]">[% order.datereceived | $KohaDates %]</span>
             </td>
             <td class="data cell">
-                [% order.rowtotal %]
+                [% order.rowtotal | html %]
             </td>
         </tr>
     [% END %]
         [% IF shipmentcosts.size || ( adjustments && adjustments.count > 0 ) %]
             <tr valign="top">
                 <td colspan="9"> Sub total </td>
-                <td class="data"> [% subtotal %] </td>
+                <td class="data"> [% subtotal | html %] </td>
             </tr>
         [% END %]
         [% IF shipmentcosts.size %]
             [% FOREACH shipmentcost IN shipmentcosts %]
                 <tr>
                     <td></td>
-                    <td colspan="8">Shipping cost for invoice [% shipmentcost.invoicenumber %]</td>
-                    <td class="data total">[% shipmentcost.shipmentcost %]</td>
+                    <td colspan="8">Shipping cost for invoice [% shipmentcost.invoicenumber | html %]</td>
+                    <td class="data total">[% shipmentcost.shipmentcost | html %]</td>
                 </tr>
             [% END %]
         [% END %]
             [% FOREACH adjustment IN adjustments %]
                 <tr>
                     <td></td>
-                    <td colspan="8">Adjustment cost for invoice [% adjustment.invoiceid %]</td>
-                    <td class="data total">[% adjustment.adjustment %]</td>
+                    <td colspan="8">Adjustment cost for invoice [% adjustment.invoiceid | html %]</td>
+                    <td class="data total">[% adjustment.adjustment | html %]</td>
                 </tr>
             [% END %]
         [% END %]
         <tr>
             <td colspan="9">TOTAL</td>
-            <td class="data total">[% total %]</td>
+            <td class="data total">[% total | html %]</td>
         </tr>
     </tfoot>
 </table>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index 1d7b033..5ab90cd 100644 (file)
@@ -1,73 +1,74 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% BLOCK edit_contact %]
     <ol id="contact-form">
-        <input type="hidden" name="contact_id" value="[% contact.id %]" />
-        <li><label for="contact_name[% contact.id %]">Contact name: </label>
-            <input type="text" size="40" id="contact_name[% contact.id %]" name="contact_name" value="[% contact.name %]" /></li>
-        <li><label for="contact_position[% contact.id %]">Position: </label>
-            <input type="text" size="40" id="contact_position[% contact.id %]" name="contact_position" value="[% contact.position %]" /></li>
-        <li><label for="contact_phone[% contact.id %]">Phone: </label>
-                <input type="text" size="20" id="contact_phone[% contact.id %]" name="contact_phone" value="[% contact.phone %]" /> </li>
-        <li><label for="contact_altphone[% contact.id %]">Alternative phone: </label>
-            <input type="text" size="20" id="contact_altphone[% contact.id %]" name="contact_altphone" value="[% contact.altphone %]" /></li>
-        <li><label for="contact_fax[% contact.id %]">Fax: </label>
-            <input type="text" size="20" id="contact_fax[% contact.id %]" name="contact_fax" value="[% contact.fax %]" /></li>
-        <li><label for="contact_email[% contact.id %]">Email: </label>
-            <input type="text" size="40" id="contact_email[% contact.id %]" name="contact_email" value="[% contact.email %]" class="email" /></li>
-        <li><label for="contact_notes[% contact.id %]">Notes: </label>
-            <textarea id="contact_notes[% contact.id %]" name="contact_notes" cols="40" rows="4">[% contact.notes %]</textarea></li>
-        <li><label for="contact_acqprimary[% contact.id %]">Primary acquisitions contact:</label>
+        <input type="hidden" name="contact_id" value="[% contact.id | html %]" />
+        <li><label for="contact_name[% contact.id | html %]">Contact name: </label>
+            <input type="text" size="40" id="contact_name[% contact.id | html %]" name="contact_name" value="[% contact.name | html %]" /></li>
+        <li><label for="contact_position[% contact.id | html %]">Position: </label>
+            <input type="text" size="40" id="contact_position[% contact.id | html %]" name="contact_position" value="[% contact.position | html %]" /></li>
+        <li><label for="contact_phone[% contact.id | html %]">Phone: </label>
+                <input type="text" size="20" id="contact_phone[% contact.id | html %]" name="contact_phone" value="[% contact.phone | html %]" /> </li>
+        <li><label for="contact_altphone[% contact.id | html %]">Alternative phone: </label>
+            <input type="text" size="20" id="contact_altphone[% contact.id | html %]" name="contact_altphone" value="[% contact.altphone | html %]" /></li>
+        <li><label for="contact_fax[% contact.id | html %]">Fax: </label>
+            <input type="text" size="20" id="contact_fax[% contact.id | html %]" name="contact_fax" value="[% contact.fax | html %]" /></li>
+        <li><label for="contact_email[% contact.id | html %]">Email: </label>
+            <input type="text" size="40" id="contact_email[% contact.id | html %]" name="contact_email" value="[% contact.email | html %]" class="email" /></li>
+        <li><label for="contact_notes[% contact.id | html %]">Notes: </label>
+            <textarea id="contact_notes[% contact.id | html %]" name="contact_notes" cols="40" rows="4">[% contact.notes | html %]</textarea></li>
+        <li><label for="contact_acqprimary[% contact.id | html %]">Primary acquisitions contact:</label>
             [% IF contact.acqprimary %]
-                <input type="checkbox" id="contact_acqprimary[% contact.id %]" class="contact_acqprimary" checked="checked"></input>
+                <input type="checkbox" id="contact_acqprimary[% contact.id | html %]" class="contact_acqprimary" checked="checked"></input>
             [% ELSE %]
-                <input type="checkbox" id="contact_acqprimary[% contact.id %]" class="contact_acqprimary"></input>
+                <input type="checkbox" id="contact_acqprimary[% contact.id | html %]" class="contact_acqprimary"></input>
             [% END %]
-            <input type="hidden" class="contact_acqprimary_hidden" name="contact_acqprimary" value="[% contact.acqprimary %]"></input>
-        <li><label for="contact_serialsprimary[% contact.id %]">Primary serials contact:</label>
+            <input type="hidden" class="contact_acqprimary_hidden" name="contact_acqprimary" value="[% contact.acqprimary | html %]"></input>
+        <li><label for="contact_serialsprimary[% contact.id | html %]">Primary serials contact:</label>
             [% IF contact.serialsprimary %]
-                <input type="checkbox" id="contact_serialsprimary[% contact.id %]" class="contact_serialsprimary" checked="checked"></input>
+                <input type="checkbox" id="contact_serialsprimary[% contact.id | html %]" class="contact_serialsprimary" checked="checked"></input>
             [% ELSE %]
-                <input type="checkbox" id="contact_serialsprimary[% contact.id %]" class="contact_serialsprimary"></input>
+                <input type="checkbox" id="contact_serialsprimary[% contact.id | html %]" class="contact_serialsprimary"></input>
             [% END %]
-            <input type="hidden" class="contact_serialsprimary_hidden" name="contact_serialsprimary" value="[% contact.serialsprimary %]"></input>
-        <li><label for="contact_orderacquisition[% contact.id %]">Contact when ordering?</label>
+            <input type="hidden" class="contact_serialsprimary_hidden" name="contact_serialsprimary" value="[% contact.serialsprimary | html %]"></input>
+        <li><label for="contact_orderacquisition[% contact.id | html %]">Contact when ordering?</label>
             [% IF contact.orderacquisition %]
-                <input type="checkbox" id="contact_orderacquisition[% contact.id %]" class="contact_orderacquisition" checked="checked"></input>
+                <input type="checkbox" id="contact_orderacquisition[% contact.id | html %]" class="contact_orderacquisition" checked="checked"></input>
             [% ELSE %]
-                <input type="checkbox" id="contact_orderacquisition[% contact.id %]" class="contact_orderacquisition"></input>
+                <input type="checkbox" id="contact_orderacquisition[% contact.id | html %]" class="contact_orderacquisition"></input>
             [% END %]
-            <input type="hidden" class="contact_orderacquisition_hidden" name="contact_orderacquisition" value="[% contact.orderacquisition %]"></input>
-        <li><label for="contact_claimacquisition[% contact.id %]">Contact about late orders?</label>
+            <input type="hidden" class="contact_orderacquisition_hidden" name="contact_orderacquisition" value="[% contact.orderacquisition | html %]"></input>
+        <li><label for="contact_claimacquisition[% contact.id | html %]">Contact about late orders?</label>
             [% IF contact.claimacquisition %]
-                <input type="checkbox" id="contact_claimacquisition[% contact.id %]" class="contact_claimacquisition" checked="checked"></input>
+                <input type="checkbox" id="contact_claimacquisition[% contact.id | html %]" class="contact_claimacquisition" checked="checked"></input>
             [% ELSE %]
-                <input type="checkbox" id="contact_claimacquisition[% contact.id %]" class="contact_claimacquisition"></input>
+                <input type="checkbox" id="contact_claimacquisition[% contact.id | html %]" class="contact_claimacquisition"></input>
             [% END %]
-            <input type="hidden" class="contact_claimacquisition_hidden" name="contact_claimacquisition" value="[% contact.claimacquisition %]"></input>
-        <li><label for="contact_claimissues[% contact.id %]">Contact about late issues?</label>
+            <input type="hidden" class="contact_claimacquisition_hidden" name="contact_claimacquisition" value="[% contact.claimacquisition | html %]"></input>
+        <li><label for="contact_claimissues[% contact.id | html %]">Contact about late issues?</label>
             [% IF contact.claimissues %]
-                <input type="checkbox" id="contact_claimissues[% contact.id %]" class="contact_claimissues" checked="checked"></input>
+                <input type="checkbox" id="contact_claimissues[% contact.id | html %]" class="contact_claimissues" checked="checked"></input>
             [% ELSE %]
-                <input type="checkbox" id="contact_claimissues[% contact.id %]" class="contact_claimissues"></input>
+                <input type="checkbox" id="contact_claimissues[% contact.id | html %]" class="contact_claimissues"></input>
             [% END %]
-            <input type="hidden" class="contact_claimissues_hidden" name="contact_claimissues" value="[% contact.claimissues %]"></input>
+            <input type="hidden" class="contact_claimissues_hidden" name="contact_claimissues" value="[% contact.claimissues | html %]"></input>
         </li>
         [% IF contact.id %]<li><button class="btn btn-default delete-contact"><i class="fa fa-trash"></i> Delete contact</li>[% END %]
     </ol>
 [% END %]
 
 [% BLOCK show_contact %]
-    <h3>[% contact.name |html %]</h3>
-    <p><span class="label">Position: </span>[% contact.position |html %]</p>
-    <p><span class="label">Phone: </span>[% contact.phone |html %]</p>
-    <p><span class="label">Alternative phone: </span>[% contact.altphone |html %]</p>
-    <p><span class="label">Fax: </span>[% contact.fax |html %]</p>
+    <h3>[% contact.name | html %]</h3>
+    <p><span class="label">Position: </span>[% contact.position | html %]</p>
+    <p><span class="label">Phone: </span>[% contact.phone | html %]</p>
+    <p><span class="label">Alternative phone: </span>[% contact.altphone | html %]</p>
+    <p><span class="label">Fax: </span>[% contact.fax | html %]</p>
     [% IF ( contact.email ) %]
-        <p><span class="label">Email: </span><a href="mailto:[% contact.email %]">[% contact.email %]</a></p>
+        <p><span class="label">Email: </span><a href="mailto:[% contact.email | html %]">[% contact.email | html %]</a></p>
     [% END %]
     [% IF ( contact.notes ) %]
-        <p><span class="label">Notes: </span>[% contact.notes |html %]</p>
+        <p><span class="label">Notes: </span>[% contact.notes | html %]</p>
     [% END %]
     [% IF ( contact.acqprimary ) %]
         <p><span class="label">Primary acquisitions contact</span></p>
@@ -88,8 +89,8 @@
 
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Vendor [% name %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Vendor [% name | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -97,7 +98,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% name |html %]</a> &rsaquo; Update: [% name |html %][% ELSE %]Add vendor[% END %] [% ELSE %][% name |html %][% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; [% IF ( enter ) %][% IF ( booksellerid ) %] <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% name | html %]</a> &rsaquo; Update: [% name | html %][% ELSE %]Add vendor[% END %] [% ELSE %][% name | html %][% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
     <div class="yui-b">
     [% IF ( enter ) %]
         [% IF ( booksellerid ) %]
-        <h1>Update: [% name |html %]</h1>
+        <h1>Update: [% name | html %]</h1>
     [% ELSE %]
         <h1>Add vendor</h1>
     [% END %]
 [% IF ( enter ) %]
     <form action="updatesupplier.pl" name="updatesupplier" class="validated" method="post">
     <div class="yui-g">
-        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <fieldset class="rows">
             <legend>Company details</legend>
             <ol><li><label for="company" class="required">Name:</label>
-                <input type="text" size="40" id="company" name="company" value="[% name %]" required="required" class="required" /><span class="required">Required</span></li>
+                <input type="text" size="40" id="company" name="company" value="[% name | html %]" required="required" class="required" /><span class="required">Required</span></li>
             <li><label for="company_postal">Postal address: </label>
-                    <textarea id="company_postal" name="company_postal" cols="40" rows="3">[% postal %]</textarea></li>
+                    <textarea id="company_postal" name="company_postal" cols="40" rows="3">[% postal | html %]</textarea></li>
             <li><label for="physical">Physical address: </label>
-                <textarea id="physical" name="physical" cols="40" rows="3">[% address1 %][% address2 %][% address3 %][% address4 %]</textarea></li>
+                <textarea id="physical" name="physical" cols="40" rows="3">[% address1 | html %][% address2 | html %][% address3 | html %][% address4 | html %]</textarea></li>
             <li><label for="company_phone">Phone: </label>
-                <input type="text" size="20" id="company_phone" name="company_phone" value="[% phone %]" /></li>
+                <input type="text" size="20" id="company_phone" name="company_phone" value="[% phone | html %]" /></li>
             <li><label for="company_fax">Fax: </label>
-                <input type="text" size="20" id="company_fax" name="company_fax" value="[% fax %]" /></li>
+                <input type="text" size="20" id="company_fax" name="company_fax" value="[% fax | html %]" /></li>
             <li><label for="website">Website: </label>
-                <input type="text" size="40" id="website" name="website" value="[% url %]" class="url" /></li>
+                <input type="text" size="40" id="website" name="website" value="[% url | html %]" class="url" /></li>
             <li><label for="accountnumber">Account number: </label>
-                <input type="text" size="40" id="accountnumber" name="accountnumber" value="[% accountnumber %]" /></li></ol>
+                <input type="text" size="40" id="accountnumber" name="accountnumber" value="[% accountnumber | html %]" /></li></ol>
         </fieldset>
         <fieldset class="rows">
             <legend>Contacts</legend>
                 <select name="list_currency" id="list_currency">
                     [% FOREACH c IN currencies %]
                         [% IF booksellerid and c.currency == listprice or not booksellerid and c.active %]
-                            <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
+                            <option value="[% c.currency | html %]" selected="selected">[% c.currency | html %]</option>
                         [% ELSIF not c.archived %]
-                            <option value="[% c.currency %]">[% c.currency %]</option>
+                            <option value="[% c.currency | html %]">[% c.currency | html %]</option>
                         [% END %]
                     [% END %]
                 </select>
                 <select name="invoice_currency" id="invoice_currency">
                     [% FOREACH c IN currencies %]
                         [% IF booksellerid and c.currency == invoiceprice or not booksellerid and c.active %]
-                            <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
+                            <option value="[% c.currency | html %]" selected="selected">[% c.currency | html %]</option>
                         [% ELSIF not c.archived %]
-                            <option value="[% c.currency %]">[% c.currency %]</option>
+                            <option value="[% c.currency | html %]">[% c.currency | html %]</option>
                         [% END %]
                     [% END %]
                 </select>
                     <select name="tax_rate" id="tax_rate">
                     [% FOREACH gst IN gst_values %]
                       [% IF ( tax_rate == gst.option ) %]
-                        <option value="[% gst.option %]" selected="selected">[% gst.option * 100 %] %</option>
+                        <option value="[% gst.option | html %]" selected="selected">[% gst.option * 100 | html %] %</option>
                       [% ELSE %]
-                        <option value="[% gst.option %]">[% gst.option * 100 %] %</option>
+                        <option value="[% gst.option | html %]">[% gst.option * 100 | html %] %</option>
                       [% END %]
                     [% END %]
                     </select>
                 <input type="text" size="6" id="discount" name="discount" value="[% discount | format ("%.1f") %]" />%</li>
             <li>
                 <label for="deliverytime">Delivery time: </label>
-                <input type="text" size="2" id="deliverytime" name="deliverytime" value="[% deliverytime %]" /> days
+                <input type="text" size="2" id="deliverytime" name="deliverytime" value="[% deliverytime | html %]" /> days
             </li>
             <li><label for="notes">Notes: </label>
-                <textarea cols="40" rows="4" id="notes" name="notes" >[% notes %]</textarea></li></ol>
+                <textarea cols="40" rows="4" id="notes" name="notes" >[% notes | html %]</textarea></li></ol>
         </fieldset>
         <fieldset class="action"><input type="submit" value="Save" /> [% IF ( booksellerid ) %]
-        <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% ELSE %]<a class="cancel" href="/cgi-bin/koha/acqui/acqui-home.pl">
+        <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% ELSE %]<a class="cancel" href="/cgi-bin/koha/acqui/acqui-home.pl">
         [% END %]Cancel</a></fieldset>
         </div>
     </form>
 [% ELSE %]
-    <h1>[% name |html %]</h1>
+    <h1>[% name | html %]</h1>
         <div class="yui-g">
             <div id="supplier-company-details" class="yui-u first">
                 <h2>Vendor details</h2>
-                <p><span class="label">Company name: </span>[% name |html %]</p>
-                <p><span class="label">Postal address: </span>[% postal |html %]</p>
-                <p><span class="label">Physical address: </span>[% address1 |html %][% address2 |html %][% address3 |html %][% address4 |html %]</p>
-                <p><span class="label">Phone: </span>[% phone |html %]</p>
-                <p><span class="label">Fax: </span>[% fax |html %]</p>
+                <p><span class="label">Company name: </span>[% name | html %]</p>
+                <p><span class="label">Postal address: </span>[% postal | html %]</p>
+                <p><span class="label">Physical address: </span>[% address1 | html %][% address2 | html %][% address3 | html %][% address4 | html %]</p>
+                <p><span class="label">Phone: </span>[% phone | html %]</p>
+                <p><span class="label">Fax: </span>[% fax | html %]</p>
                 [% IF ( url ) %]
-                    <p><span class="label">Website: </span><a href="[% url %]">[% url %]</a></p>
+                    <p><span class="label">Website: </span><a href="[% url | html %]">[% url | html %]</a></p>
                 [% END %]
                 [% IF ( accountnumber ) %]
-                    <p><span class="label">Account number: </span>[% accountnumber |html %]</p>
+                    <p><span class="label">Account number: </span>[% accountnumber | html %]</p>
                 [% END %]
 
             <div id="supplier-ordering-information">
                         [% ELSE %]
                             Inactive
                         [% END %]</p>
-                <p><strong>List prices are: </strong>[% listprice %]</p>
-                <p><strong>Invoice prices are: </strong>[% invoiceprice %]</p>
+                <p><strong>List prices are: </strong>[% listprice | html %]</p>
+                <p><strong>Invoice prices are: </strong>[% invoiceprice | html %]</p>
                 [% IF ( tax_rate ) %]<p><strong>Tax number registered: </strong>
                         [% IF ( gstreg ) %]Yes[% ELSE %]No[% END %]</p>
                 <p><strong>List item price includes tax: </strong>
                 <p><strong>Discount: </strong>
                     [% discount | format("%.1f") %] %</p>
                 <p><strong>Tax rate: </strong>
-                    [% ( tax_rate || 0 ) * 100 %] %</p>
+                    [% ( tax_rate || 0 ) * 100 | html %] %</p>
                 [% IF deliverytime.defined %]
                     <p><strong>Delivery time: </strong>
-                        [% deliverytime %] days</p>
+                        [% deliverytime | html %] days</p>
                 [% END %]
                 [% IF ( notes ) %]<p><strong>Notes: </strong>
-                    [% notes |html %]</p>[% END %]
+                    [% notes | html %]</p>[% END %]
             </div>
             </div>
 
 
                 <div class="subscription-details">
                     <h2>Subscription details</h2>
-                    <p><strong>Number of subscriptions: </strong>[% subscriptioncount %]</p>
+                    <p><strong>Number of subscriptions: </strong>[% subscriptioncount | html %]</p>
                 </div>
 
             </div>
                     [% FOREACH contract IN contracts %]
                         <tr>
                         <td>
-                            <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]">[% contract.contractname %]</a>
+                            <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber | html %]&amp;booksellerid=[% contract.booksellerid | html %]">[% contract.contractname | html %]</a>
                         </td>
-                        <td>[% contract.contractdescription %]</td>
-                        <td><span title="[% contract.contractstartdate %]">[% contract.contractstartdate | $KohaDates %]</span></td>
-                        <td><span title="[% contract.contractenddate %]">[% contract.contractenddate | $KohaDates %]</span></td>
+                        <td>[% contract.contractdescription | html %]</td>
+                        <td><span title="[% contract.contractstartdate | html %]">[% contract.contractstartdate | $KohaDates %]</span></td>
+                        <td><span title="[% contract.contractenddate | html %]">[% contract.contractenddate | $KohaDates %]</span></td>
                         <td class="actions">
-                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]"><i class="fa fa-pencil"></i> Edit</a>
-                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/aqcontract.pl?op=delete_confirm&amp;contractnumber=[% contract.contractnumber %]&amp;booksellerid=[% contract.booksellerid %]"><i class="fa fa-trash"></i> Delete</a>
+                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;contractnumber=[% contract.contractnumber | html %]&amp;booksellerid=[% contract.booksellerid | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/aqcontract.pl?op=delete_confirm&amp;contractnumber=[% contract.contractnumber | html %]&amp;booksellerid=[% contract.booksellerid | html %]"><i class="fa fa-trash"></i> Delete</a>
                         </td>
                         </tr>
                     [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         function confirm_deletion() {
             if (confirm(_("Confirm deletion of this vendor ?"))) {
-                window.location="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]&op=delete";
+                window.location="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]&op=delete";
             }
         }
 
index 1ff3156..77a5188 100644 (file)
@@ -1,24 +1,24 @@
 [% USE To %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 "dt_cardnumber":
-                    "[% data.cardnumber %]",
+                    "[% data.cardnumber | html %]",
                 "dt_name":
-                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
+                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
                 "dt_branch":
-                    "[% data.branchname |html %]",
+                    "[% data.branchname | html %]",
                 "dt_category":
-                    "[% data.category_description |html %] ([% data.category_type |html %])",
+                    "[% data.category_description | html %] ([% data.category_type | html %])",
                 "dt_action":
                     [%- IF selection_type == 'select' -%]
-                        "<a class=\"btn btn-default btn-xs select_user\" href=\"#\" data-borrowernumber=\"[% data.borrowernumber %]\" data-borrowerdata=\"[% To.json(data) | html %]\">Select</a><input type=\"hidden\" id=\"borrower_data[% data.borrowernumber %]\" name=\"borrower_data[% data.borrowernumber %]\" value=\"[% To.json(data) | html %]\" />"
+                        "<a class=\"btn btn-default btn-xs select_user\" href=\"#\" data-borrowernumber=\"[% data.borrowernumber | html %]\" data-borrowerdata=\"[% To.json(data) | html %]\">Select</a><input type=\"hidden\" id=\"borrower_data[% data.borrowernumber | html %]\" name=\"borrower_data[% data.borrowernumber | html %]\" value=\"[% To.json(data) | html %]\" />"
                     [%- ELSE -%]
-                        "<a href=\"#\" data-borrowernumber=\"[% data.borrowernumber %]\" data-firstname=\"[% data.firstname %]\" data-surname=\"[% data.surname %]\" class=\"btn btn-default btn-xs add_user\"><i class=\"fa fa-plus\"></i> Add</a>"
+                        "<a href=\"#\" data-borrowernumber=\"[% data.borrowernumber | html %]\" data-firstname=\"[% data.firstname | html %]\" data-surname=\"[% data.surname | html %]\" class=\"btn btn-default btn-xs add_user\"><i class=\"fa fa-plus\"></i> Add</a>"
                     [%- END -%]
             }[% UNLESS loop.last %],[% END %]
         [% END %]
index 160c790..94849e9 100644 (file)
@@ -11,9 +11,9 @@
             <h3>Search for a vendor to transfer to</h3>
               <div class="transferinfo">
                 <ul>
-                  <li><span class="label">From vendor: </span>[% booksellerfromname %]</li>
-                  <li><span class="label">Basket: </span>[% basketfromname %]</li>
-                  <li><span class="label">Order: </span>[% ordernumber %]</li>
+                  <li><span class="label">From vendor: </span>[% booksellerfromname | html %]</li>
+                  <li><span class="label">Basket: </span>[% basketfromname | html %]</li>
+                  <li><span class="label">Order: </span>[% ordernumber | html %]</li>
                 </ul>
               </div>
         [% ELSE %]
             <fieldset>
             <input type="hidden" name="op" value="do_search" />
             [% IF ( ordernumber ) %]
-                <input type="hidden" name="ordernumber" value="[% ordernumber %]" />
+                <input type="hidden" name="ordernumber" value="[% ordernumber | html %]" />
             [% END %]
             [% IF ( bookselleridfrom ) %]
-                <input type="hidden" name="bookselleridfrom" value="[% bookselleridfrom %]" />
+                <input type="hidden" name="bookselleridfrom" value="[% bookselleridfrom | html %]" />
             [% END %]
             <label for="query">Vendor:</label>
             <input type="text" id="query" name="query" />
@@ -34,7 +34,7 @@
             </fieldset>
         </form>
         [% IF ( show_baskets ) %]
-            <h3>Baskets for [% booksellertoname %]</h3>
+            <h3>Baskets for [% booksellertoname | html %]</h3>
             [% IF ( basketsloop ) %]
                 <table>
                     <thead>
                     <tbody>
                         [% FOREACH basket IN basketsloop %]
                           <tr>
-                            <td>[% basket.basketname %] (#[% basket.basketno %])</td>
-                            <td>[% basket.createdby %]</td>
+                            <td>[% basket.basketname | html %] (#[% basket.basketno | html %])</td>
+                            <td>[% basket.createdby | html %]</td>
                             <td>[% basket.creationdate | $KohaDates %]</td>
-                            <td><a class="btn btn-default btn-xs confirm_transfer" href="transferorder.pl?basketno=[% basket.basketno %]&ordernumber=[% ordernumber %]">Choose</a>
+                            <td><a class="btn btn-default btn-xs confirm_transfer" href="transferorder.pl?basketno=[% basket.basketno | html %]&ordernumber=[% ordernumber | html %]">Choose</a>
                           </tr>
                         [% END %]
                     </tbody>
@@ -61,7 +61,7 @@
             [% END %]
         [% END %]
         [% IF ( ordersloop ) %]
-            <h3>Orders for [% booksellerfromname %]</h3>
+            <h3>Orders for [% booksellerfromname | html %]</h3>
             <table>
                 <thead>
                     <tr>
                 <tbody>
                     [% FOREACH ordersloo IN ordersloop %]
                       <tr>
-                        <td><a href="neworderempty.pl?ordernumber=[% ordersloo.ordernumber %]">[% ordersloo.ordernumber %]</a></td>
+                        <td><a href="neworderempty.pl?ordernumber=[% ordersloo.ordernumber | html %]">[% ordersloo.ordernumber | html %]</a></td>
                         <td>
-                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ordersloo.biblionumber %]">[% ordersloo.title |html %]</a>
-                            [% IF ( ordersloo.author ) %] by [% ordersloo.author %][% END %]
-                            [% IF ( ordersloo.isbn ) %] &ndash; [% ordersloo.isbn %][% END %]
+                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ordersloo.biblionumber | html %]">[% ordersloo.title | html %]</a>
+                            [% IF ( ordersloo.author ) %] by [% ordersloo.author | html %][% END %]
+                            [% IF ( ordersloo.isbn ) %] &ndash; [% ordersloo.isbn | html %][% END %]
                             [% IF ( ordersloo.publishercode ) %]
-                                <br />Publisher: [% ordersloo.publishercode %]
-                                [%- IF    ( ordersloo.publicationyear > 0) -%], [% ordersloo.publicationyear %]
-                                [%- ELSIF ( ordersloo.copyrightdate   > 0) -%] [% ordersloo.copyrightdate %]
+                                <br />Publisher: [% ordersloo.publishercode | html %]
+                                [%- IF    ( ordersloo.publicationyear > 0) -%], [% ordersloo.publicationyear | html %]
+                                [%- ELSIF ( ordersloo.copyrightdate   > 0) -%] [% ordersloo.copyrightdate | html %]
                                 [% END %]
                             [% END %]
                         </td>
-                        <td><a class="btn btn-default btn-xs" href="transferorder.pl?bookselleridfrom=[% ordersloo.bookselleridfrom %]&ordernumber=[% ordersloo.ordernumber %]">Transfer</a></td>
+                        <td><a class="btn btn-default btn-xs" href="transferorder.pl?bookselleridfrom=[% ordersloo.bookselleridfrom | html %]&ordernumber=[% ordersloo.ordernumber | html %]">Transfer</a></td>
                       </tr>
                     [% END %]
                 </tbody>
                     <tbody>
                         [% FOREACH bookseller IN booksellersloop %]
                           <tr>
-                            <td>[% bookseller.name %]</td>
-                            <td><a class="btn btn-default btn-xs" href="transferorder.pl?[% IF (bookselleridfrom) %]bookselleridto[% ELSE %]bookselleridfrom[% END %]=[% bookseller.id %][% IF (ordernumber) %]&ordernumber=[% ordernumber %][% END %]">Choose</a></td>
+                            <td>[% bookseller.name | html %]</td>
+                            <td><a class="btn btn-default btn-xs" href="transferorder.pl?[% IF (bookselleridfrom) %]bookselleridto[% ELSE %]bookselleridfrom[% END %]=[% bookseller.id | html %][% IF (ordernumber) %]&ordernumber=[% ordernumber | html %][% END %]">Choose</a></td>
                           </tr>
                         [% END %]
                     </tbody>
     [% END %]
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 0b24419..5e5c2c5 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Acquisitions &rsaquo; [% IF ( booksellername ) %]Orders with uncertain prices for vendor [% booksellername %][% ELSE %]Orders with uncertain prices[% END %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Acquisitions &rsaquo; [% IF ( booksellername ) %]Orders with uncertain prices for vendor [% booksellername | html %][% ELSE %]Orders with uncertain prices[% END %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -11,7 +12,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; [% IF ( booksellername ) %]<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a> &rsaquo; Uncertain prices for vendor [% booksellername %][% ELSE %]Uncertain prices[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; [% IF ( booksellername ) %]<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a> &rsaquo; Uncertain prices for vendor [% booksellername | html %][% ELSE %]Uncertain prices[% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
 [% INCLUDE 'acquisitions-toolbar.inc' %]
         [% IF ( validate ) %]
             [% SET metacontent = '0; url=' _  scriptname  _ '?booksellerid=' _  booksellerid %]
-            <META HTTP-EQUIV=Refresh CONTENT="[% metacontent %]">
+            <META HTTP-EQUIV=Refresh CONTENT="[% metacontent | html %]">
         [% ELSE %]
         [% IF ( booksellername ) %]
-            <h1>Orders with uncertain prices for vendor <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a></h1>
+            <h1>Orders with uncertain prices for vendor <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a></h1>
             <h2>Contact information</h2>
             <p><strong>Address: </strong>
-                [% booksellerpostal %]
-                [% bookselleraddress1 %]
-                [% bookselleraddress2 %]
-                [% bookselleraddress3 %]
-                [% bookselleraddress4 %]
-                <a href="[% booksellerurl %]">[% booksellerurl %]</a>
+                [% booksellerpostal | html %]
+                [% bookselleraddress1 | html %]
+                [% bookselleraddress2 | html %]
+                [% bookselleraddress3 | html %]
+                [% bookselleraddress4 | html %]
+                <a href="[% booksellerurl | html %]">[% booksellerurl | html %]</a>
             </p>
             <p><strong>Phone: </strong>
-                [% booksellerphone %] / Fax:
-                [% booksellerfax %]</p>
+                [% booksellerphone | html %] / Fax:
+                [% booksellerfax | html %]</p>
             <dl>
                 [% FOREACH contact IN contacts %]
                     <dt><strong>Contact: </strong></dt>
-                    <dd>[% contact.name %]
-                        [% contact.position %]
-                        [% contact.phone %]
-                        [% contact.altphone %]
-                        [% contact.email %]
-                        [% contact.notes %]
+                    <dd>[% contact.name | html %]
+                        [% contact.position | html %]
+                        [% contact.phone | html %]
+                        [% contact.altphone | html %]
+                        [% contact.email | html %]
+                        [% contact.notes | html %]
                     </dd>
                 [% END %]
             </dl>
             [% IF ( booksellernotes ) %]
             <p><strong>Notes: </strong>
-                [% booksellernotes %]</p>
+                [% booksellernotes | html %]</p>
             [% END %]
         [% END %]
 
         <h2>Orders with uncertain prices</h2>
-        <form action="[% scriptname %]" method="post">
-        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+        <form action="[% scriptname | html %]" method="post">
+        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <label for="owner">Orders from:</label>
         <select id="owner" name="owner">
             [% IF ( owner ) %]
@@ -71,8 +72,8 @@
         </select>
         <input type="submit" value="Filter" />
         </form>
-        <form action="[% scriptname %]" method="post" id="uncertainprices">
-        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+        <form action="[% scriptname | html %]" method="post" id="uncertainprices">
+        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
         <input type="hidden" name="op" value="validate" />
         <table id="uncertainpricet">
         <thead>
            [% FOREACH uncertainpriceorder IN uncertainpriceorders %]
            <tr>
         <td>
-            [% uncertainpriceorder.basketname %]
+            [% uncertainpriceorder.basketname | html %]
         </td>
            <td>
-            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% uncertainpriceorder.biblionumber %]">[% uncertainpriceorder.title |html %]</a>
-            [% IF ( uncertainpriceorder.author ) %] <em>by</em> [% uncertainpriceorder.author %][% END %]
+            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% uncertainpriceorder.biblionumber | html %]">[% uncertainpriceorder.title | html %]</a>
+            [% IF ( uncertainpriceorder.author ) %] <em>by</em> [% uncertainpriceorder.author | html %][% END %]
             [% IF ( uncertainpriceorder.publishercode ) %]
-                <br /><em>Publisher:</em> [% uncertainpriceorder.publishercode %]
-                [%- IF    ( uncertainpriceorder.publicationyear ) -%], [% uncertainpriceorder.publicationyear %]
-                [%- ELSIF ( uncertainpriceorder.copyrightdate ) -%] [% uncertainpriceorder.copyrightdate %]
+                <br /><em>Publisher:</em> [% uncertainpriceorder.publishercode | html %]
+                [%- IF    ( uncertainpriceorder.publicationyear ) -%], [% uncertainpriceorder.publicationyear | html %]
+                [%- ELSIF ( uncertainpriceorder.copyrightdate ) -%] [% uncertainpriceorder.copyrightdate | html %]
                 [% END %]
             [% END %]
-            [% IF ( uncertainpriceorder.isbn ) %]<br />[% uncertainpriceorder.isbn %][% END %]
+            [% IF ( uncertainpriceorder.isbn ) %]<br />[% uncertainpriceorder.isbn | html %][% END %]
             <br />
-            <a href="neworderempty.pl?ordernumber=[% uncertainpriceorder.ordernumber %]&amp;booksellerid=[% booksellerid %]&amp;basketno=[% uncertainpriceorder.basketno %]">
+            <a href="neworderempty.pl?ordernumber=[% uncertainpriceorder.ordernumber | html %]&amp;booksellerid=[% booksellerid | html %]&amp;basketno=[% uncertainpriceorder.basketno | html %]">
                 Edit
             </a>
         </td>
         <td>
-            [% uncertainpriceorder.firstname %] [% uncertainpriceorder.surname %]
+            [% uncertainpriceorder.firstname | html %] [% uncertainpriceorder.surname | html %]
         </td>
            <td>
-               <input type="checkbox" name="uncertainprice[% uncertainpriceorder.ordernumber %]" value="1" checked="checked" />
+               <input type="checkbox" name="uncertainprice[% uncertainpriceorder.ordernumber | html %]" value="1" checked="checked" />
            </td>
            <td>
-            <input class="check_uncertain" data-ordernumber="[% uncertainpriceorder.ordernumber %]" type="text" size="10" name="price[% uncertainpriceorder.ordernumber %]" value="[% uncertainpriceorder.listprice %]" />
+            <input class="check_uncertain" data-ordernumber="[% uncertainpriceorder.ordernumber | html %]" type="text" size="10" name="price[% uncertainpriceorder.ordernumber | html %]" value="[% uncertainpriceorder.listprice | html %]" />
            </td>
            <td>
         [% IF basket.effective_create_items == 'ordering' %]
-            [% uncertainpriceorder.quantity %]
-            <input type="hidden" name="qty[% uncertainpriceorder.ordernumber %]" value="[% uncertainpriceorder.quantity %]" />
+            [% uncertainpriceorder.quantity | html %]
+            <input type="hidden" name="qty[% uncertainpriceorder.ordernumber | html %]" value="[% uncertainpriceorder.quantity | html %]" />
         [% ELSE %]
-            <input class="check_uncertain" data-ordernumber="[% uncertainpriceorder.ordernumber %]" type="text" size="10" name="qty[% uncertainpriceorder.ordernumber %]" value="[% uncertainpriceorder.quantity %]" />
+            <input class="check_uncertain" data-ordernumber="[% uncertainpriceorder.ordernumber | html %]" type="text" size="10" name="qty[% uncertainpriceorder.ordernumber | html %]" value="[% uncertainpriceorder.quantity | html %]" />
         [% END %]
            </td>
            </tr>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
         });
         var MSG_INVALIDPRICE = _("ERROR: Price is not a valid number, please check the price and try again!");
     </script>
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 81445f0..79bd43b 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; [% IF ( opsearch ) %]Order from external source[% ELSE %]Order from external source &rsaquo; Search results[% END %]</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css">
 .linktools { background-color:#FFF;border-top:1px solid #DDD; border-left: 1px solid #DDD; border-right: 1px solid #666; border-bottom:1px solid #666;display: none; white-space: nowrap;}
@@ -16,7 +17,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'acquisitions-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% name %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | uri %]">Basket [% basketno | html %]</a> &rsaquo; [% IF ( opsearch ) %]Order from external source[% ELSE %]<a href="/cgi-bin/koha/acqui/z3950_search.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order from external source</a> &rsaquo; Search results[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo; <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% name | html %]</a> &rsaquo; <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | uri %]">Basket [% basketno | html %]</a> &rsaquo; [% IF ( opsearch ) %]Order from external source[% ELSE %]<a href="/cgi-bin/koha/acqui/z3950_search.pl?booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order from external source</a> &rsaquo; Search results[% END %]</div>
 
 <div class="main container-fluid">
     <form method="post" action="z3950_search.pl" name="f" class="checkboxed">
@@ -27,7 +28,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
     <input type="hidden" name="op" id="op" value="do_search" />
            <fieldset class="rows">
          <ol>
-             <li><label for="searchtitle">Title: </label> <input type="text" id="searchtitle"  name="title" value="[% title |html %]" class="focus" /></li>
+             <li><label for="searchtitle">Title: </label> <input type="text" id="searchtitle"  name="title" value="[% title | html %]" class="focus" /></li>
              <li><label for="isbn">ISBN: </label> <input type="text" id="isbn" name="isbn" value="[% isbn | html %]" /></li>
              <li><label for="lccall">LC call number: </label> <input type="text" id="lccall" name="lccall" value="" /></li>
              <li><label for="controlnumber">Control no.: </label> <input type="text" id="controlnumber" name="controlnumber" value="" /></li>
@@ -41,7 +42,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
              <select id="frameworkcode" name="frameworkcode" >
              <option value="">Default</option>
                  [% FOREACH framework IN frameworks %]
-                    <option value="[% framework.frameworkcode %]" >[% framework.frameworktext %]</option>
+                    <option value="[% framework.frameworkcode | html %]" >[% framework.frameworktext | html %]</option>
                  [% END %]
               </select>
               </li>
@@ -59,11 +60,11 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
     [% FOREACH serverloo IN serverloop %]
         <p>
             [% IF ( serverloo.checked ) %]
-                <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" checked="checked" />
+                <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" checked="checked" />
             [% ELSE %]
-                <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" />
+                <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" />
             [% END %]
-            <label for="z3950_[% serverloo.id %]">[% serverloo.servername %] [[% serverloo.host %]]</label>
+            <label for="z3950_[% serverloo.id | html %]">[% serverloo.servername | html %] [[% serverloo.host | html %]]</label>
 
         </p>
     [% END %]
@@ -109,13 +110,13 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
         [% IF ( breeding_loo.breedingid ) %]
 
         <tr>
-            <td>[% breeding_loo.server %] <div class="linktools"><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid %]" class="previewData">Preview MARC</a> <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid %]" class="previewData">Preview card</a> <a href="/cgi-bin/koha/acqui/neworderempty.pl?frameworkcode=[% frameworkcode | uri  %]&amp;breedingid=[% breeding_loo.breedingid %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order</a> <a href="#" id="closemenu" title="Close this menu"> X </a></div></td>
-            <td>[% breeding_loo.title |html %]</td>
-            <td>[% breeding_loo.author %]</td>
-            <td>[% breeding_loo.isbn %]</td>
-            <td>[% breeding_loo.lccn %]</td>
-            <td><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid %]" title="MARC" class="previewData">MARC</a> | <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid %]" title="Card" class="previewData">Card</a></td>
-            <td><a href="/cgi-bin/koha/acqui/neworderempty.pl?frameworkcode=[% frameworkcode | uri %]&amp;breedingid=[% breeding_loo.breedingid %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order</a></td>
+            <td>[% breeding_loo.server | html %] <div class="linktools"><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid | html %]" class="previewData">Preview MARC</a> <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid | html %]" class="previewData">Preview card</a> <a href="/cgi-bin/koha/acqui/neworderempty.pl?frameworkcode=[% frameworkcode | uri  %]&amp;breedingid=[% breeding_loo.breedingid | html %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order</a> <a href="#" id="closemenu" title="Close this menu"> X </a></div></td>
+            <td>[% breeding_loo.title | html %]</td>
+            <td>[% breeding_loo.author | html %]</td>
+            <td>[% breeding_loo.isbn | html %]</td>
+            <td>[% breeding_loo.lccn | html %]</td>
+            <td><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid | html %]" title="MARC" class="previewData">MARC</a> | <a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid | html %]" title="Card" class="previewData">Card</a></td>
+            <td><a href="/cgi-bin/koha/acqui/neworderempty.pl?frameworkcode=[% frameworkcode | uri %]&amp;breedingid=[% breeding_loo.breedingid | html %]&amp;booksellerid=[% booksellerid | uri %]&amp;basketno=[% basketno | uri %]">Order</a></td>
 
         </tr>
         [% END %]
@@ -131,7 +132,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
             <h3 id="dataPreviewLabel">MARC preview</h3>
         </div>
         <div class="modal-body">
-            <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+            <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
         </div>
         <div class="modal-footer">
             <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
@@ -142,8 +143,8 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
 
     <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
         <input type="hidden" name="op" id="op" value="do_search" />
-        <input type="hidden" name="current_page" id="current_page" value="[% current_page %]" />
-        <input type="hidden" id="searchtitle"  name="title" value="[% title |html %]" />
+        <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
+        <input type="hidden" id="searchtitle"  name="title" value="[% title | html %]" />
         <input type="hidden" id="isbn" name="isbn" value="[% isbn | html %]" />
         <input type="hidden" id="lccall" name="lccall" value="[% lccall | html %]" />
         <input type="hidden" id="author" name="author" value="[% author | html %]" />
@@ -156,17 +157,17 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
         <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
 
         [% FOREACH server IN servers %]
-        <input type="hidden" name="id" id="z3950_[% server.id %]" value="[% server.id %]" />
+        <input type="hidden" name="id" id="z3950_[% server.id | html %]" value="[% server.id | html %]" />
         [% END %]
 
         [% IF ( show_prevbutton ) %]
-            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        Page [% current_page %] / [% total_pages %]
+        Page [% current_page | html %] / [% total_pages | html %]
         [% IF ( show_nextbutton ) %]
-            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
+        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page | html %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
     </form>
 
     [% ELSE %]
@@ -177,7 +178,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
                 <div class="dialog alert">
                     <ul>
                     [% FOREACH errcon IN errconn %]
-                        <li>Connection failed to [% errcon.server %]</li>
+                        <li>Connection failed to [% errcon.server | html %]</li>
                     [% END %]
                     </ul>
                 </div>
@@ -189,12 +190,12 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
 
 [% END %]
 
-[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending %] servers to search</h3>[% END %]
+[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending | html %] servers to search</h3>[% END %]
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
             var resultst = $("#resultst").dataTable($.extend(true, {}, dataTablesDefaults, {
@@ -224,7 +225,7 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
         });
     </script>
     [% INCLUDE 'z3950_search.inc' %]
-    [% Asset.js("js/z3950_search.js") %]
+    [% Asset.js("js/z3950_search.js") | $raw %]
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' %]
index 841a3f3..db94433 100644 (file)
@@ -23,7 +23,7 @@
                     <h4><a href="/cgi-bin/koha/admin/preferences.pl">Global system preferences</a></h4>
                     <p>Manage global system preferences like MARC flavor, date format, administrator email, and templates.</p>
                     <input type="hidden" name="op" value="search" />
-                    <input type="text" name="searchfield" value="[% searchfield %]" />
+                    <input type="text" name="searchfield" value="[% searchfield | html %]" />
                     <input type="submit" name="ok" class="submit" value="Search" />
                 </fieldset>
                 </form>
index ea68e0d..472f64e 100644 (file)
@@ -1,33 +1,34 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Price %]
 [% SET footerjs = 1 %]
 [%- BLOCK action_menu %]
     <div class="dropdown">
-        <a class="btn btn-default btn-xs dropdown-toggle" id="budgetmenu_[% block_budget.budget_period_id %]" role="button" data-toggle="dropdown" href="#">
+        <a class="btn btn-default btn-xs dropdown-toggle" id="budgetmenu_[% block_budget.budget_period_id | html %]" role="button" data-toggle="dropdown" href="#">
            Actions <b class="caret"></b>
         </a>
-        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="budgetmenu_[% block_budget.budget_period_id %]">
+        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="budgetmenu_[% block_budget.budget_period_id | html %]">
               <li>
-                  <a href="[% script_name %]?op=add_form&amp;budget_period_id=[% block_budget.budget_period_id |html %]"><i class="fa fa-pencil"></i> Edit</a>
+                  <a href="[% script_name | html %]?op=add_form&amp;budget_period_id=[% block_budget.budget_period_id | html %]"><i class="fa fa-pencil"></i> Edit</a>
               </li>
               [% IF block_budget.count %]
                   <li class="disabled">
-                      <a data-toggle="tooltip" data-placement="left" title="[% block_budget.count %] fund(s) are attached to this budget. You must delete all attached funds before deleting this budget." href="#"><i class="fa fa-trash"></i> Delete</a>
+                      <a data-toggle="tooltip" data-placement="left" title="[% block_budget.count | html %] fund(s) are attached to this budget. You must delete all attached funds before deleting this budget." href="#"><i class="fa fa-trash"></i> Delete</a>
                   </li>
               [% ELSE %]
                   <li>
-                      <a href="[% script_name %]?op=delete_confirm&amp;budget_period_id=[% block_budget.budget_period_id %]"><i class="fa fa-trash"></i> Delete</a>
+                      <a href="[% script_name | html %]?op=delete_confirm&amp;budget_period_id=[% block_budget.budget_period_id | html %]"><i class="fa fa-trash"></i> Delete</a>
                   </li>
               [% END %]
               <li>
-                  <a href="[% script_name %]?op=duplicate_form&amp;budget_period_id=[% block_budget.budget_period_id %]"><i class="fa fa-copy"></i> Duplicate</a>
+                  <a href="[% script_name | html %]?op=duplicate_form&amp;budget_period_id=[% block_budget.budget_period_id | html %]"><i class="fa fa-copy"></i> Duplicate</a>
               </li>
               <li>
-                  <a href="[% script_name %]?op=close_form&amp;budget_period_id=[% block_budget.budget_period_id %]"><i class="fa fa-times-circle"></i> Close</a>
+                  <a href="[% script_name | html %]?op=close_form&amp;budget_period_id=[% block_budget.budget_period_id | html %]"><i class="fa fa-times-circle"></i> Close</a>
               </li>
               <li>
-                  <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_period_id=[% block_budget.budget_period_id %]"><i class="fa fa-plus"></i> Add fund</a>
+                  <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_period_id=[% block_budget.budget_period_id | html %]"><i class="fa fa-plus"></i> Add fund</a>
               </li>
         </ul>
     </div>
@@ -35,9 +36,9 @@
 
 [% INCLUDE 'doc-head-open.inc' %]
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% IF close_form %]
-    [% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") %]
+    [% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") | $raw %]
 [% END %]
 
 <title>
 
     [% IF ( add_form ) %]&rsaquo;
         [% IF ( budget_period_id ) %]
-            Modify budget [% budget_period_description %]
+            Modify budget [% budget_period_description | html %]
         [% ELSE %]
             Add budget
         [% END %]
     [% END %]
     [% IF ( duplicate_form ) %]&rsaquo; Duplicate budget[% END %]
     [% IF ( delete_confirm ) %]&rsaquo;
-            Delete budget '[% budget_period_description %]'?
+            Delete budget '[% budget_period_description | html %]'?
     [% END %]
     [% IF ( delete_confirmed ) %]&rsaquo;
         Data deleted
     [% END %]
     [% IF close_form %]&rsaquo;
-      Close budget [% budget_period_description %]
+      Close budget [% budget_period_description | html %]
     [% END %]
     [% IF closed %]&rsaquo;
-      Budget [% budget_period_description %] closed
+      Budget [% budget_period_description | html %] closed
     [% END %]
 </title>
 
@@ -84,7 +85,7 @@
     [% IF ( add_form ) %]
         <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo;
         [% IF ( budget_period_id ) %]
-            <span>Modify budget '[% budget_period_description %]'</span>
+            <span>Modify budget '[% budget_period_description | html %]'</span>
         [% ELSE %]
             <span>Add budget</span>
         [% END %]
@@ -92,9 +93,9 @@
     [% IF ( delete_confirm ) %]
         <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo;
         [% IF ( total || funds_exist ) %]
-            <span>Cannot delete budget '[% budget_period_description %]'</span>
+            <span>Cannot delete budget '[% budget_period_description | html %]'</span>
         [% ELSE %]
-            <span>Delete budget '[% budget_period_description %]'?</span>
+            <span>Delete budget '[% budget_period_description | html %]'?</span>
         [% END %]
     [% END %]
     [% IF ( duplicate_form ) %]
     [% END %]
     [% IF close_form %]
         <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo;
-        <span>Close budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">[% budget_period_description %]</a></span>
+        <span>Close budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">[% budget_period_description | html %]</a></span>
     [% END %]
     [% IF closed %]
         <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo;
-        <span>Budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">[% budget_period_description %]</a> closed</span>
+        <span>Budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">[% budget_period_description | html %]</a> closed</span>
     [% END %]
     [% IF ( else ) %]
         <span>Budgets administration</span>
 <form action="/cgi-bin/koha/admin/aqbudgetperiods.pl" name="f" method="post">
     <fieldset class="rows">
     <input type="hidden" name="op" value="duplicate_budget" />
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 
     <ol>
 
 
     <li>
     <label class="required" for="budget_period_description">Description</label>
-    <input type="text" id="budget_period_description" name="budget_period_description" value="[% budgetperiod.budget_period_description %]" />
+    <input type="text" id="budget_period_description" name="budget_period_description" value="[% budgetperiod.budget_period_description | html %]" />
     </li>
 
     <li>
     </fieldset>
 
     <fieldset class="action">
-        <input type="button" value="Save Changes"  onclick="CheckDuplicateForm(this.form)" /> <a class="cancel" href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">Cancel</a>
+        <input type="button" value="Save Changes"  onclick="CheckDuplicateForm(this.form)" /> <a class="cancel" href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">Cancel</a>
     </fieldset>
 
 </form>
     <!--  add or modify a budget period   -->
 
     [% IF ( budget_period_id ) %]
-        <h3>Modify budget <i>[% budget_period_description %]</i></h3>
+        <h3>Modify budget <i>[% budget_period_description | html %]</i></h3>
     [% ELSE %]
         <h3>Add budget</h3>
        [% END %]
     <!-- display information about the budget period that must be added or modified -->
     <!-- ################################################################################# -->
     <input type="hidden" name="op" value="add_validate" />
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
     <ol>
     <li>
     <label class="required" for="from">Start date: </label>
         <!-- ############################## -->
         <label class="required" for="budget_period_description">Description: </label>
         <input type="text" id="budget_period_description" name="budget_period_description"
-        size="48" maxlength="80" value="[% budget_period_description %]" />
+        size="48" maxlength="80" value="[% budget_period_description | html %]" />
     </li>
 
     <li>
         <!-- ############################## -->
         <label for="budget_period_total">Total amount: </label>
         <input type="text" id="budget_period_total" name="budget_period_total"
-        size="10" maxlength="80" value="[% budget_period_total | $Price on_editing => 1 %]" />
+        size="10" maxlength="80" value="[% budget_period_total | $Price on_editing => 1 | html %]" />
     </li>
 
     <li>
         <input type="button" value="Save"  onclick="Check(this.form)" />
         <!--             <input type="submit" value="Save Changes"  />  -->
         [% IF ( budget_period_id ) %]
-            <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]" class="cancel">Cancel</a>
+            <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]" class="cancel">Cancel</a>
         [% ELSE %]
             <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl" class="cancel">Cancel</a>
         [% END %]
     [% IF ( total ) %]
         <div class="dialog message">
         <h3>Cannot delete budget</h3>
-        <p><strong>This record is used [% total %] times</strong>
+        <p><strong>This record is used [% total | html %] times</strong>
         . Deletion is not possible.</p>
     [% ELSIF ( funds_exist ) %]
         <div class="dialog message">
         <p>This budget has funds attached. You must delete all attached funds before you can delete this budget.</p>
     [% ELSE %]
         <div class="dialog alert">
-        <h3>Delete budget '[% budget_period_description %]'?</h3>
+        <h3>Delete budget '[% budget_period_description | html %]'?</h3>
 
     <!-- ############################################################# -->
     <!-- "delete" and "cancel" buttons    -->
     <!-- ############################################################# -->
 
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <input type="hidden" name="op" value="delete_confirmed" />
-        <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+        <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
     </form>
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
     </form>
     [% END %]
     <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Back</a>
   [% ELSE %]
     <h3>The unreceived orders from the following funds will be moved</h3>
-      Fund list of budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">[% budget_period_description %]</a>:
+      Fund list of budget <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">[% budget_period_description | html %]</a>:
     <table id="budgeth">
       <thead>
         <tr>
       <tbody>
         [% FOREACH budget IN budgets_to_move %]
           <tr>
-            <td>[% budget.budget_id %]</td>
-            <td>[% budget.budget_code_indent %]</td>
-            <td>[% budget.budget_name %]</td>
-            <td>[% budget.unreceived_orders.size %]</td>
+            <td>[% budget.budget_id | html %]</td>
+            <td>[% budget.budget_code_indent | html %]</td>
+            <td>[% budget.budget_name | html %]</td>
+            <td>[% budget.unreceived_orders.size | html %]</td>
           </tr>
         [% END %]
       </tbody>
             <select name="to_budget_period_id" id="to_budget_period_id" required="required">
               <option value=""></option>
               [% FOR budget_period IN budget_periods %]
-                <option value="[% budget_period.budget_period_id %]">[% budget_period.budget_period_description %]</option>
+                <option value="[% budget_period.budget_period_id | html %]">[% budget_period.budget_period_description | html %]</option>
               [% END %]
             </select>
           </li>
       </fieldset>
       <fieldset class="action">
           <input type="hidden" name="op" value="close_confirmed" />
-          <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+          <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
           <input type="submit" value="Move unreceived orders" />
           <a class="cancel" href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Cancel</a>
       </fieldset>
     </form>
   [% END %]
 [% ELSIF closed %]
-  <h3>Report after moving unreceived orders from budget [% from_budget_period.budget_period_description %] ([% from_budget_period.budget_period_startdate | $KohaDates %] - [% from_budget_period.budget_period_enddate | $KohaDates %]) to [% to_budget_period.budget_period_description %] ([% to_budget_period.budget_period_startdate | $KohaDates %] - [% to_budget_period.budget_period_enddate | $KohaDates%])</h3>
+  <h3>Report after moving unreceived orders from budget [% from_budget_period.budget_period_description | html %] ([% from_budget_period.budget_period_startdate | $KohaDates %] - [% from_budget_period.budget_period_enddate | $KohaDates %]) to [% to_budget_period.budget_period_description | html %] ([% to_budget_period.budget_period_startdate | $KohaDates %] - [% to_budget_period.budget_period_enddate | $KohaDates%])</h3>
 
   <table id="closed_report">
     <thead>
             [% IF r.orders_moved.size > 0 %]
               [% FOR order IN r.orders_moved %]
                 <tr>
-                  <td>[% r.budget.budget_name %] (id=[% r.budget.budget_id %]) Amount=[% r.budget.budget_amount | $Price %][% IF r.unspent_moved %] ([% r.unspent_moved | $Price %] remaining has been moved)[% END %]</td>
-                  <td>[% order.basketname %]</td>
-                  <td>[% order.ordernumber %]</td>
+                  <td>[% r.budget.budget_name | html %] (id=[% r.budget.budget_id | html %]) Amount=[% r.budget.budget_amount | $Price | html %][% IF r.unspent_moved %] ([% r.unspent_moved | $Price | html %] remaining has been moved)[% END %]</td>
+                  <td>[% order.basketname | html %]</td>
+                  <td>[% order.ordernumber | html %]</td>
                   <td>Moved!</td>
                 </tr>
               [% END %]
             [% ELSE %]
               <tr>
-                <td>[% r.budget.budget_name %] (id=[% r.budget.budget_id %])</td>
+                <td>[% r.budget.budget_name | html %] (id=[% r.budget.budget_id | html %])</td>
                 <td></td>
                 <td></td>
                 <td>There were no unreceived orders for this fund.</td>
           [% ELSE %]
             [% IF r.error == 'budget_code_not_exists' %]
               <tr>
-                <td>[% r.budget.budget_id %] [% r.budget.budget_amount | $Price %][% IF r.unspent_moved %] ([% r.unspent_moved | $Price %] remaining has been moved)[% END %]</td>
+                <td>[% r.budget.budget_id | html %] [% r.budget.budget_amount | $Price | html %][% IF r.unspent_moved %] ([% r.unspent_moved | $Price | html %] remaining has been moved)[% END %]</td>
                 <td></td>
                 <td></td>
                 <td>This fund code does not exist in the destination budget.</td>
           <tbody>
               [% FOREACH period_active IN period_active_loop %]
                 <tr>
-                <td><a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% period_active.budget_period_id %]" title="View funds for [% period_active.budget_period_description %]">[% period_active.budget_period_description %]</a></td>
-                <td><span title="[% period_active.budget_period_startdate %]">[% period_active.budget_period_startdate | $KohaDates %]</span></td>
-                <td><span title="[% period_active.budget_period_enddate %]">[% period_active.budget_period_enddate | $KohaDates %]</span></td>
+                <td><a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% period_active.budget_period_id | html %]" title="View funds for [% period_active.budget_period_description | html %]">[% period_active.budget_period_description | html %]</a></td>
+                <td><span title="[% period_active.budget_period_startdate | html %]">[% period_active.budget_period_startdate | $KohaDates %]</span></td>
+                <td><span title="[% period_active.budget_period_enddate | html %]">[% period_active.budget_period_enddate | $KohaDates %]</span></td>
                 <td>
                   [% IF ( period_active.budget_period_locked ) %]
                     <span style="color:green;">Locked</span>&nbsp;
                   [% END %]
                 </td>
-                <td class="data">[% period_active.budget_period_total | $Price %]</td>
+                <td class="data">[% period_active.budget_period_total | $Price | html %]</td>
                 <td>
                     [% PROCESS action_menu block_budget=period_active %]
                 </td>
           <tbody>
               [% FOREACH period_loo IN period_inactive_loop %]
                   <tr>
-                  <td><a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% period_loo.budget_period_id %]" title="View funds for [% period_loo.budget_period_description %]">[% period_loo.budget_period_description %]</a></td>
-                  <td><span title="[% period_loo.budget_period_startdate %]">[% period_loo.budget_period_startdate | $KohaDates %]</span></td>
-                  <td><span title="[% period_loo.budget_period_enddate %]">[% period_loo.budget_period_enddate | $KohaDates %]</span></td>
+                  <td><a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% period_loo.budget_period_id | html %]" title="View funds for [% period_loo.budget_period_description | html %]">[% period_loo.budget_period_description | html %]</a></td>
+                  <td><span title="[% period_loo.budget_period_startdate | html %]">[% period_loo.budget_period_startdate | $KohaDates %]</span></td>
+                  <td><span title="[% period_loo.budget_period_enddate | html %]">[% period_loo.budget_period_enddate | $KohaDates %]</span></td>
                   <td> [% IF ( period_loo.budget_period_locked ) %]<span style="color:green;">Locked</span>&nbsp;[% ELSE %][% END %] </td>
-                  <td class="data">[% period_loo.budget_period_total | $Price %]</td>
+                  <td class="data">[% period_loo.budget_period_total | $Price | html %]</td>
                   <td>
                         [% PROCESS action_menu block_budget=period_loo %]
                   </td>
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     [% IF close_form %]
-        [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") %]
+        [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %]
     [% END %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
     <script type="text/javascript">
     // #################################################################################
     // Javascript
         $(document).ready(function() {
             var tabs = $('#budgetsTabs').tabs();
             [% IF ( tab ) %]
-                tabs.tabs("option", "active", [% tab %]);
+                tabs.tabs("option", "active", [% tab | html %]);
             [% END %]
             $("#activeperiodst,#inactiveperiodst").dataTable($.extend(true, {}, dataTablesDefaults, {
                 "aoColumnDefs": [
                 sDom: "t"
               }));
               $("#move_form").submit(function(){
-                var budget_from = "[% budget_period_description %]";
+                var budget_from = "[% budget_period_description | html %]";
                 var budget_to = $("#to_budget_period_id").find("option:selected").html();
                 var alert_message = _("You have chosen to move all unreceived orders from '%s' to '%s'.").format(budget_from, budget_to);
                 alert_message += "\n" + _("This action cannot be reversed. Do you wish to continue?");
index dd72013..a7a5369 100644 (file)
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Administration &rsaquo; Funds[% IF op == 'add_form' %] &rsaquo; [% IF ( budget_id ) %]Modify fund[% IF ( budget_name ) %] '[% budget_name %]'[% END %][% ELSE %]Add fund [% END %][% END %]</title>
-[% Asset.css("css/datatables.css") %]
-[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") %]
+<title>Koha &rsaquo; Administration &rsaquo; Funds[% IF op == 'add_form' %] &rsaquo; [% IF ( budget_id ) %]Modify fund[% IF ( budget_name ) %] '[% budget_name | html %]'[% END %][% ELSE %]Add fund [% END %][% END %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
+[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -15,9 +16,9 @@
 [% INCLUDE 'budgets-admin-search.inc' %]
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
-    <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo; [% IF op == 'list' %][% IF budget_period_id %]Funds for '[% budget_period_description %]'[% ELSE %]All funds[% END %][% END %]
+    <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo; [% IF op == 'list' %][% IF budget_period_id %]Funds for '[% budget_period_description | html %]'[% ELSE %]All funds[% END %][% END %]
     [% IF op == 'add_form' %]
-      <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">Funds</a> &rsaquo; [% IF ( budget_id ) %]Modify fund[% IF ( budget_name ) %] '[% budget_name %]'[% END %][% ELSE %]Add fund[% END %]
+      <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">Funds</a> &rsaquo; [% IF ( budget_id ) %]Modify fund[% IF ( budget_name ) %] '[% budget_name | html %]'[% END %][% ELSE %]Add fund[% END %]
     [% END %]
     [% IF op == 'delete_confirm' %]
       <a href="/cgi-bin/koha/admin/aqbudgets.pl">Funds</a> &rsaquo; Delete fund?
@@ -42,7 +43,7 @@
 
 <h1>
   [% IF budget_period_id %]
-    Funds for '[% budget_period_description %]'
+    Funds for '[% budget_period_description | html %]'
   [% ELSE %]
     All funds
   [% END %]
     <tr>
     <th></th>
     <th></th>
-    <th colspan="2" style="text-align: left;" nowrap="nowrap">Period allocated [% IF budget_period_total %][% budget_period_total | $Price %][% END %]  </th>
-    <th nowrap="nowrap" class="data"> [% period_alloc_total | $Price %]</th>
+    <th colspan="2" style="text-align: left;" nowrap="nowrap">Period allocated [% IF budget_period_total %][% budget_period_total | $Price | html %][% END %]  </th>
+    <th nowrap="nowrap" class="data"> [% period_alloc_total | $Price | html %]</th>
     <th></th>
-    <th class="data">[% ordered_total | $Price %]</th>
+    <th class="data">[% ordered_total | $Price | html %]</th>
     <th></th>
-    <th class="data">[% spent_total | $Price %]</th>
+    <th class="data">[% spent_total | $Price | html %]</th>
     <th></th>
-    <th class="data">[% available_total | $Price %]</th>
+    <th class="data">[% available_total | $Price | html %]</th>
     <th></th>
     </tr>
     </tfoot>
     <tbody>
     [% FOREACH budget IN budgets %]
     [% IF budget.budget_parent_id %]
-      <tr data-tt-id="[% budget.budget_id %]" data-tt-parent-id="[% budget.budget_parent_id %]">
+      <tr data-tt-id="[% budget.budget_id | html %]" data-tt-parent-id="[% budget.budget_parent_id | html %]">
     [% ELSE %]
-      <tr data-tt-id="[% budget.budget_id %]">
+      <tr data-tt-id="[% budget.budget_id | html %]">
     [% END %]
-    <td>[% budget.budget_period_active %]</td>
-    <td>Budget [% budget.budget_period_description %] [id=[% budget.budget_period_id %]][% UNLESS budget.budget_period_active %] (inactive)[% END %]</td>
-    <td>[% budget.budget_code %]</td>
-    <td>[% budget.budget_name %]</td>
+    <td>[% budget.budget_period_active | html %]</td>
+    <td>Budget [% budget.budget_period_description | html %] [id=[% budget.budget_period_id | html %]][% UNLESS budget.budget_period_active %] (inactive)[% END %]</td>
+    <td>[% budget.budget_code | html %]</td>
+    <td>[% budget.budget_name | html %]</td>
     <td class="data">
       [% IF budget.budget_parent_id %]
-        <span class="child_fund_amount">[% budget.budget_amount | $Price %]</span>
+        <span class="child_fund_amount">[% budget.budget_amount | $Price | html %]</span>
       [% ELSE %]
-        <span class="total_amount">[% budget.budget_amount | $Price %]</span>
+        <span class="total_amount">[% budget.budget_amount | $Price | html %]</span>
       [% END %]
     </td>
     <td class="data">
       [% IF budget.budget_parent_id %]
-        <span class="child_fund_amount">[% budget.budget_ordered | $Price %]</span>
+        <span class="child_fund_amount">[% budget.budget_ordered | $Price | html %]</span>
       [% ELSE %]
-        <span class="total_amount">[% budget.budget_ordered | $Price %]</span>
+        <span class="total_amount">[% budget.budget_ordered | $Price | html %]</span>
       [% END %]
     </td>
     <td class="data">
       [% IF budget.budget_parent_id %]
-        <span class="child_fund_amount">[% budget.total_ordered | $Price %]</span>
+        <span class="child_fund_amount">[% budget.total_ordered | $Price | html %]</span>
       [% ELSE %]
-        <span class="total_amount">[% budget.total_ordered | $Price %]</span>
+        <span class="total_amount">[% budget.total_ordered | $Price | html %]</span>
       [% END %]
     </td>
     <td class="data">
       [% IF budget.budget_parent_id %]
-        <span class="child_fund_amount">[% budget.budget_spent | $Price %]</span>
+        <span class="child_fund_amount">[% budget.budget_spent | $Price | html %]</span>
       [% ELSE %]
-        <span class="total_amount">[% budget.budget_spent | $Price %]</span>
+        <span class="total_amount">[% budget.budget_spent | $Price | html %]</span>
       [% END %]
     </td>
     <td class="data">
       [% IF budget.budget_parent_id %]
-        <span class="child_fund_amount">[% budget.total_spent | $Price %]</span>
+        <span class="child_fund_amount">[% budget.total_spent | $Price | html %]</span>
       [% ELSE %]
-        <span class="total_amount">[% budget.total_spent | $Price %]</span>
+        <span class="total_amount">[% budget.total_spent | $Price | html %]</span>
       [% END %]
     </td>
 
                 <span class="totalamount">
             [% END %]
         [% END %]
-            [% value | $Price %]
+            [% value | $Price | html %]
         </span>
     [% END %]
     <td class="data">
     [% ELSE %]
         <td>
             <div class="dropdown dropup">
-                <a class="btn btn-default btn-xs dropdown-toggle" id="budgetactions[% budget.budget_id %]_[% budget.budget_period_id %]" role="button" data-toggle="dropdown" href="#">
+                <a class="btn btn-default btn-xs dropdown-toggle" id="budgetactions[% budget.budget_id | html %]_[% budget.budget_period_id | html %]" role="button" data-toggle="dropdown" href="#">
                    Actions <b class="caret"></b>
                 </a>
-                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="budgetactions[% budget.budget_id %]_[% budget.budget_period_id %]">
-                    <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_id=[% budget.budget_id %]&amp;budget_period_id=[% budget.budget_period_id %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="budgetactions[% budget.budget_id | html %]_[% budget.budget_period_id | html %]">
+                    <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_id=[% budget.budget_id | html %]&amp;budget_period_id=[% budget.budget_period_id | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
                     [% IF budget.budget_has_children %]
                         <li class="disabled"><a href="#" class="deletefund-disabled" data-toggle="tooltip" data-placement="left" title="This fund has children"><i class="fa fa-trash"></i> Delete</a></li>
                     [% ELSE %]
-                        <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=delete_confirm&amp;budget_id=[% budget.budget_id %]&amp;budget_period_id=[% budget.budget_period_id %]"><i class="fa fa-trash"></i> Delete</a></li>
+                        <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=delete_confirm&amp;budget_id=[% budget.budget_id | html %]&amp;budget_period_id=[% budget.budget_period_id | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                     [% END %]
-                    <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_parent_id=[% budget.budget_id %]&amp;budget_period_id=[% budget.budget_period_id %]"><i class="fa fa-plus"></i> Add child fund</a></li>
+                    <li><a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_parent_id=[% budget.budget_id | html %]&amp;budget_period_id=[% budget.budget_period_id | html %]"><i class="fa fa-plus"></i> Add child fund</a></li>
                 </ul>
             </div>
         </td>
     <fieldset class="rows">
     <legend>[% IF ( budget_id ) %]Modify[% ELSE %]Add[% END %] Fund
     [% IF ( budget_period_description ) %]
-        [% budget_name %] for Budget '[% budget_period_description %]'
+        [% budget_name | html %] for Budget '[% budget_period_description | html %]'
     [% END %]
     </legend>
 
     [% IF ( budget_parent_id ) %]
     <li>
         <span class="label">Fund parent: </span>
-        [% budget_parent_name %]
-        [% budget_parent_id %] - [% budget_parent_name %]
-        <input type="hidden" name="budget_parent_id" value="[% budget_parent_id %]" />
+        [% budget_parent_name | html %]
+        [% budget_parent_id | html %] - [% budget_parent_name | html %]
+        <input type="hidden" name="budget_parent_id" value="[% budget_parent_id | html %]" />
     </li>
     [% END %]
     <li>
     <label class="required"  for="budget_code">Fund code: </label>
-    <input type="text" name="budget_code" id="budget_code" value="[% budget_code %]" size="30" />
+    <input type="text" name="budget_code" id="budget_code" value="[% budget_code | html %]" size="30" />
     </li>
 
     <li>
     <label class="required" for="budget_name">Fund name: </label>
-    <input type="text" name="budget_name" id="budget_name" value="[% budget_name %]" size="60" />
+    <input type="text" name="budget_name" id="budget_name" value="[% budget_name | html %]" size="60" />
     </li>
 
     <li>
     <label style="white-space: nowrap;" for="budget_amount" class="required">Amount: </label>
-    <input type="text" name="budget_amount" id="budget_amount" value="[% budget_amount | $Price on_editing => 1 %]" size="8" />
+    <input type="text" name="budget_amount" id="budget_amount" value="[% budget_amount | $Price on_editing => 1 | html %]" size="8" />
     </li>
 
     <li>
       <label for="budget_encumb">Warning at (%): </label>
-      <input type="text" name="budget_encumb" id="budget_encumb" value="[% budget_encumb %]" size="10" />
+      <input type="text" name="budget_encumb" id="budget_encumb" value="[% budget_encumb | html %]" size="10" />
       <span class="hint">0 to disable</span>
     </li>
 
     <li>
       <label for="budget_expend">Warning at (amount): </label>
-      <input type="text" name="budget_expend" id="budget_expend" value="[% budget_expend | $Price on_editing => 1 %]" size="10" />
+      <input type="text" name="budget_expend" id="budget_expend" value="[% budget_expend | $Price on_editing => 1 | html %]" size="10" />
       <span class="hint">0 to disable</span>
     </li>
 
         <span class="label">Owner: </span>
         [% IF  budget_owner %]
             <span  id="budget_owner_name">
-                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% budget_owner.borrowernumber %]">
-                    [% budget_owner.firstname %] [% budget_owner.surname %]
+                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% budget_owner.borrowernumber | html %]">
+                    [% budget_owner.firstname | html %] [% budget_owner.surname | html %]
                 </a> |
             </span>
         [% ELSE %]
         <a id="edit_owner" class="new_window" href="#"><i class="fa fa-search"></i> Select owner</a>
         <a id="remove_owner" href="#"><i class="fa fa-trash"></i> Remove owner</a>
         <input type="hidden" name="budget_owner_id" id="budget_owner_id"
-            value="[% budget_owner.borrowernumber %]" />
+            value="[% budget_owner.borrowernumber | html %]" />
     </li>
 
 
         <span class="label">Users:</span>
         <ul style="float:left;" id="budget_users">
             [% FOREACH user IN budget_users %]
-                <li id="user_[% user.borrowernumber %]">
-                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% user.borrowernumber %]">
-                        [% user.firstname %] [% user.surname %]
+                <li id="user_[% user.borrowernumber | html %]">
+                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% user.borrowernumber | html %]">
+                        [% user.firstname | html %] [% user.surname | html %]
                     </a>
-                    &bull; <a href="#" class="del_user" data-borrowernumber="[% user.borrowernumber %]"><i class="fa fa-trash"></i> Remove</a>
+                    &bull; <a href="#" class="del_user" data-borrowernumber="[% user.borrowernumber | html %]"><i class="fa fa-trash"></i> Remove</a>
                 </li>
             [% END %]
             <li><a href="#" id="add_user_button"><i class="fa fa-plus"></i> Add users</a></li>
         </ul>
-        <input type="hidden" name="budget_users_ids" id="budget_users_id" value="[% budget_users_ids %]" />
+        <input type="hidden" name="budget_users_ids" id="budget_users_id" value="[% budget_users_ids | html %]" />
     </li>
     <li>
     <label for="budget_branchcode">Library: </label>
 
     <li>
     <label for="budget_notes">Notes: </label>
-    <textarea name="budget_notes" id="budget_notes"  cols="80" rows="6">[% budget_notes %]</textarea>
+    <textarea name="budget_notes" id="budget_notes"  cols="80" rows="6">[% budget_notes | html %]</textarea>
     </li>
 
     <li>
     </ol>
 
     [% IF ( budget_id ) %]
-        <input type="hidden" name="budget_id" value="[% budget_id %]" />
+        <input type="hidden" name="budget_id" value="[% budget_id | html %]" />
     [% END %]
     </fieldset>
 
     <fieldset class="action">
         <input type="submit" value="Submit" /> <a class="cancel" href="/cgi-bin/koha/admin/aqbudgets.pl">Cancel</a>
-        <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+        <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
     </fieldset>
 </form>
 
 
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
-        <h3>Delete fund [% budget_name %]?</h3>
+        <h3>Delete fund [% budget_name | html %]?</h3>
         If you delete this fund, all orders linked to this fund will be deleted!
         <table>
             <tr>
             <th scope="row">Fund amount:</th>
-            <td>[% budget_amount | $Price %]</td>
+            <td>[% budget_amount | $Price | html %]</td>
             </tr>
         </table>
 
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="budget_id" value="[% budget_id %]" />
-            <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+            <input type="hidden" name="budget_id" value="[% budget_id | html %]" />
+            <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this fund</button>
         </form>
         <form action="/cgi-bin/koha/admin/aqbudgets.pl" method="get">
               <option value="">All budgets</option>
               [% FOR period IN periods %]
                 [% IF budget_period_id && period.budget_period_id == budget_period_id %]
-                  <option value="[% period.budget_period_id %]" selected="selected">[% period.budget_period_description %]</option>
+                  <option value="[% period.budget_period_id | html %]" selected="selected">[% period.budget_period_description | html %]</option>
                 [% ELSE %]
-                  <option value="[% period.budget_period_id %]">[% period.budget_period_description %]</option>
+                  <option value="[% period.budget_period_id | html %]">[% period.budget_period_description | html %]</option>
                 [% END %]
               [% END %]
             </select>
 </div>
 </div>
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
     <script type="text/javascript">
         var MSG_BUDGET_PARENT_ALLOCATION = "- " + _("Fund amount exceeds parent allocation") + "\n";
         var MSG_BUDGET_PERIOD_ALLOCATION = "- " + _("Fund amount exceeds period allocation") + "\n";
         var MSG_PARENT_BENEATH_BUDGET = "- " + _("New budget-parent is beneath budget") + "\n";
     </script>
 
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
     [% IF op == 'add_form' %]
         <script type="text/javascript">
         //<![CDATA[
         </script>
     [% ELSIF op == 'list' %]
         [% INCLUDE 'datatables.inc' %]
-        [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") %]
+        [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %]
 
         <script type="text/javascript">
         //<![CDATA[
index 4b0ab5f..f0a5f15 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Acquisitions &rsaquo; Contracts &rsaquo;
 [% IF ( add_form ) %]
-    [% IF ( contractnumber ) %]Modify contract '[% contractname %]'
+    [% IF ( contractnumber ) %]Modify contract '[% contractname | html %]'
 [% ELSE %]New contract[% END %]
 [% END %]
-[% IF ( else ) %]Contracts of [% booksellername %][% END %]
+[% IF ( else ) %]Contracts of [% booksellername | html %][% END %]
 [% IF ( add_validate ) %]Data recorded[% END %]
-[% IF ( delete_confirm ) %]Confirm deletion of contract '[% contractnumber %]'[% END %]
+[% IF ( delete_confirm ) %]Confirm deletion of contract '[% contractnumber | html %]'[% END %]
 [% IF ( delete_confirmed ) %]Contract deleted[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
     &rsaquo;
     <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>
     &rsaquo;
-    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid %]">[% booksellername %]</a>
+    <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">[% booksellername | html %]</a>
     &rsaquo;
     [% IF ( add_form ) %]
-        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]">Contracts</a>
+        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]">Contracts</a>
         &rsaquo;
-        [% IF ( contractnumber ) %]Modify contract '[% contractname %]'
+        [% IF ( contractnumber ) %]Modify contract '[% contractname | html %]'
         [% ELSE %]New contract
         [% END %]
     [% END %]
     [% IF ( add_validate ) %]
-        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]">Contracts</a>
+        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]">Contracts</a>
         &rsaquo; Data recorded
     [% END %]
     [% IF ( delete_confirm ) %]
-        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]">Contracts</a>
-        &rsaquo; Confirm deletion of contract [% contractnumber %]
+        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]">Contracts</a>
+        &rsaquo; Confirm deletion of contract [% contractnumber | html %]
     [% END %]
     [% IF ( delete_confirmed ) %]
-        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]">Contracts</a> &rsaquo; Contract deleted
+        <a href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]">Contracts</a> &rsaquo; Contract deleted
     [% END %]
     [% IF ( else ) %]Contracts[% END %]
 </div>
 [% END %]
 
                 [% IF ( add_form ) %]
-                    <form name="Aform" action="[% script_name %]" method="post">
+                    <form name="Aform" action="[% script_name | html %]" method="post">
                         <input type="hidden" name="op" value="add_validate" />
-                        <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                        <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                         <input type="hidden" name="checked" value="0" />
                         [% IF ( contractnumber ) %]
-                            <h1>Modify contract [% contractname %] for [% booksellername %]</h1>
+                            <h1>Modify contract [% contractname | html %] for [% booksellername | html %]</h1>
                         [% ELSE %]
-                            <h1>New contract for [% booksellername %]</h1>
+                            <h1>New contract for [% booksellername | html %]</h1>
                         [% END %]
                         <fieldset class="rows">
                             <ol>
                                 [% IF ( contractnumber ) %]
-                                        <li><span class="label">Contract id </span>[% contractnumber %]
-                                            <input type="hidden" name="contractnumber" value="[% contractnumber %]" />
+                                        <li><span class="label">Contract id </span>[% contractnumber | html %]
+                                            <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
                                             <input type="hidden" name="is_a_modif" value="1" />
                                         </li>
                                 [% END %]
                                 <li><label for="contractname" class="required">Name: *</label> &nbsp;
-                                        <input type="text" name="contractname" id="contractname" size="40" maxlength="80" value="[% contractname %]" />
+                                        <input type="text" name="contractname" id="contractname" size="40" maxlength="80" value="[% contractname | html %]" />
                                 </li>
                                 <li><label for="contractdescription">Description: </label> &nbsp;
-                                        <input type="text" name="contractdescription" id="contractdescription" size="40" maxlength="80" value="[% contractdescription %]" />
+                                        <input type="text" name="contractdescription" id="contractdescription" size="40" maxlength="80" value="[% contractdescription | html %]" />
                                 </li>
                                 <li><label for="from" class="required">Start date: *</label> &nbsp;
                                         <input type="text" name="contractstartdate" id="from" value="[% contractstartdate | $KohaDates %]" maxlength="10" size="10" class="datepickerfrom" />
                             </ol>
                         </fieldset>
                         <fieldset class="action">
-                            <input type="button" value="Save" onclick="Check(this.form);" /> <a class="cancel" href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid %]&amp;contractnumber=[% contractnumber %]">Cancel</a>
+                            <input type="button" value="Save" onclick="Check(this.form);" /> <a class="cancel" href="/cgi-bin/koha/admin/aqcontract.pl?booksellerid=[% booksellerid | html %]&amp;contractnumber=[% contractnumber | html %]">Cancel</a>
                         </fieldset>
                     </form>
             [% END %]
             [% IF ( add_validate ) %]
                 <h3>Data recorded</h3>
-                <form action="[% script_name %]" method="post">
+                <form action="[% script_name | html %]" method="post">
                     <input type="submit" value="OK" />
                 </form>
             [% END %]
             [% IF ( delete_confirm ) %]
                     <div class="dialog alert">
-                        <h3>Confirm deletion of contract <i>[% contractname %]</i></h3>
+                        <h3>Confirm deletion of contract <i>[% contractname | html %]</i></h3>
                         <table>
-                            <tr><th scope="row">Contract number:</th><td>[% contractnumber %]</td></tr>
-                            <tr><th scope="row">Contract name:</th><td>[% contractname %]</td></tr>
-                            <tr><th scope="row">Contract description:</th><td>[% contractdescription %]</td></tr>
+                            <tr><th scope="row">Contract number:</th><td>[% contractnumber | html %]</td></tr>
+                            <tr><th scope="row">Contract name:</th><td>[% contractname | html %]</td></tr>
+                            <tr><th scope="row">Contract description:</th><td>[% contractdescription | html %]</td></tr>
                             <tr><th scope="row">Contract start date:</th><td>[% contractstartdate | $KohaDates %]</td></tr>
                             <tr><th scope="row">Contract end date:</th><td>[% contractenddate | $KohaDates %]</td></tr>
-                            <tr><th scope="row">Vendor:</th><td>[% booksellername %]</td></tr>
+                            <tr><th scope="row">Vendor:</th><td>[% booksellername | html %]</td></tr>
                         </table>
-                        <form action="[% script_name %]" method="post">
+                        <form action="[% script_name | html %]" method="post">
                             <input type="hidden" name="op" value="delete_confirmed" />
-                            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-                            <input type="hidden" name="contractnumber" value="[% contractnumber %]" />
+                            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+                            <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
                             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete contract</button>
                         </form>
                         <form action="/cgi-bin/koha/admin/aqcontract.pl" method="get">
-                            <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-                            <input type="hidden" name="contractnumber" value="[% contractnumber %]" />
+                            <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+                            <input type="hidden" name="contractnumber" value="[% contractnumber | html %]" />
                             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
                         </form>
                     </div>
             [% END %]
             [% IF ( delete_confirmed ) %]
                 <h3>Contract deleted</h3>
-                <form action="[% script_name %]" method="post">
-                    <input type="hidden" name="booksellerid" value="[% booksellerid %]" />
+                <form action="[% script_name | html %]" method="post">
+                    <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
                     <input type="submit" value="OK" />
                 </form>
             [% END %]
             [% IF ( else ) %]
-                <h2>Contract(s) of [% booksellername %]</h2>
+                <h2>Contract(s) of [% booksellername | html %]</h2>
                 [% IF ( loop ) %]
                     <table>
                         <tr>
                     [% FOREACH loo IN loop %]
                         <tr>
                         <td>
-                            <a href="[% loo.script_name %]?op=add_form&amp;booksellerid=[% loo.booksellerid %]&amp;contractnumber=[% loo.contractnumber %]">[% loo.contractname %]</a>
+                            <a href="[% loo.script_name | html %]?op=add_form&amp;booksellerid=[% loo.booksellerid | html %]&amp;contractnumber=[% loo.contractnumber | html %]">[% loo.contractname | html %]</a>
                         </td>
-                        <td>[% loo.contractdescription %]</td>
-                        <td>[% loo.contractstartdate %]</td>
-                        <td>[% loo.contractenddate %]</td>
+                        <td>[% loo.contractdescription | html %]</td>
+                        <td>[% loo.contractstartdate | html %]</td>
+                        <td>[% loo.contractenddate | html %]</td>
                         <td class="actions">
-                            <a href="[% loo.script_name %]?op=add_form&amp;contractnumber=[% loo.contractnumber %]&amp;booksellerid=[% loo.booksellerid %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                            <a href="[% loo.script_name %]?op=delete_confirm&amp;contractnumber=[% loo.contractnumber %]&amp;booksellerid=[% loo.booksellerid %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
+                            <a href="[% loo.script_name | html %]?op=add_form&amp;contractnumber=[% loo.contractnumber | html %]&amp;booksellerid=[% loo.booksellerid | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+                            <a href="[% loo.script_name | html %]?op=delete_confirm&amp;contractnumber=[% loo.contractnumber | html %]&amp;booksellerid=[% loo.booksellerid | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
                         </td>
                         </tr>
                     [% END %]
                     <div class="dialog message">
                         There are no contracts with this vendor.
                         [% IF active %]
-                            <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;booksellerid=[% booksellerid %]">Add a contract</a>.
+                            <a href="/cgi-bin/koha/admin/aqcontract.pl?op=add_form&amp;booksellerid=[% booksellerid | html %]">Add a contract</a>.
                         [% END %]
                     </div>
                 [% END %]
 </div>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
     <script type="text/javascript">
     //<![CDATA[
     // to check if the data are correctly entered.
index 324e089..858cef3 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Administration &rsaquo; Budgets &rsaquo; Funds &rsaquo; Planning for [% budget_period_description %] by [% authcat %]</title>
+<title>Koha &rsaquo; Administration &rsaquo; Budgets &rsaquo; Funds &rsaquo; Planning for [% budget_period_description | html %] by [% authcat | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-<style type="text/css">td.locked { background-image: url('[% interface %]/[% theme %]/img/locked.png'); padding-left : 20px; background-repeat: no-repeat; background-position: 5px 5px; } a.control { font-size:85%;text-decoration:none; }</style>
+<style type="text/css">td.locked { background-image: url('[% interface | html %]/[% theme | html %]/img/locked.png'); padding-left : 20px; background-repeat: no-repeat; background-position: 5px 5px; } a.control { font-size:85%;text-decoration:none; }</style>
 </head>
 
 <body id="admin_aqplan" class="admin">
@@ -15,8 +16,8 @@
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;
     <a href="/cgi-bin/koha/admin/aqbudgetperiods.pl">Budgets</a> &rsaquo; 
-    <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id %]">Funds</a> &rsaquo;
-    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id %]">Planning</a> &rsaquo;
+    <a href="/cgi-bin/koha/admin/aqbudgets.pl?budget_period_id=[% budget_period_id | html %]">Funds</a> &rsaquo;
+    <a href="/cgi-bin/koha/admin/aqplan.pl?budget_period_id=[% budget_period_id | html %]">Planning</a> &rsaquo;
 </div>
 
 <div id="doc3" class="yui-t2">
@@ -27,8 +28,8 @@
 [% INCLUDE 'budgets-admin-toolbar.inc' %]
 
 <form method="post" id="Aform" name="Aform"  action="/cgi-bin/koha/admin/aqplan.pl">
-<h3>Planning for [% budget_period_description %] by [% authcat %]</h3>
-<input type="hidden" name="authcat" value="[% authcat %]" />
+<h3>Planning for [% budget_period_description | html %] by [% authcat | html %]</h3>
+<input type="hidden" name="authcat" value="[% authcat | html %]" />
 <!-- Budget Lines -->
 
     [% IF ( budget_lines ) %]
@@ -43,7 +44,7 @@
     <p id="selections">
         <strong>Show/hide columns:</strong> <span class="selected"><input type="checkbox" checked="checked" id="showall"/><label for="showall">Show all columns</label></span> <span><input type="checkbox" id="hideall"/><label for="hideall">Hide all columns</label></span>
         [% FOREACH authvals_ro IN authvals_row %]
-            <span class="selected"><label><input type="checkbox" checked="checked" id="col[% authvals_ro.colnum %]">[% authvals_ro.code %]</label></span>
+            <span class="selected"><label><input type="checkbox" checked="checked" id="col[% authvals_ro.colnum | html %]">[% authvals_ro.code | html %]</label></span>
         [% END %]
     </p>
     <table id="plan">
 
     [% FOREACH authvals_ro IN authvals_row %]
          [% IF ( authvals_ro.display ) %]
-            <th id="col[% authvals_ro.code %]" class="[% authvals_ro.colnum %]">
+            <th id="col[% authvals_ro.code | html %]" class="[% authvals_ro.colnum | html %]">
         [% ELSE %]
-            <th id="col[% authvals_ro.code %]" style="display:none;" class="[% authvals_ro.colnum %]">
+            <th id="col[% authvals_ro.code | html %]" style="display:none;" class="[% authvals_ro.colnum | html %]">
         [% END %]
 
-    [% authvals_ro.code %]</th>
+    [% authvals_ro.code | html %]</th>
     [% END %]
 
     <th class="remaining">Fund remaining</th><th>&nbsp;</th>
         [% ELSE %]
             <td>
         [% END %]
-        <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_id=[% budget_line.budget_id %]&amp;budget_period_id=[% budget_period_id %]">[% budget_line.budget_name %]</a></td>
-        <td><span id="[% budget_line.budget_amount %]">[% budget_line.budget_amount | $Price %]&nbsp;</span>
+        <a href="/cgi-bin/koha/admin/aqbudgets.pl?op=add_form&amp;budget_id=[% budget_line.budget_id | html %]&amp;budget_period_id=[% budget_period_id | html %]">[% budget_line.budget_name | html %]</a></td>
+        <td><span id="[% budget_line.budget_amount | html %]">[% budget_line.budget_amount | $Price | html %]&nbsp;</span>
 
 
         <!-- NEXT DIV ELEMENT IS USED BY JS FOR CALC-ING AUTO-FILL AND ESTIMATED AMOUNTS -->
-        <div style="display:none;" id="budget_tot_[% budget_line.budget_id %]">[% budget_line.budget_amount %]</div></td>
+        <div style="display:none;" id="budget_tot_[% budget_line.budget_id | html %]">[% budget_line.budget_amount | html %]</div></td>
 
         [% FOREACH line IN budget_line.lines %]
             [% IF ( line.display ) %]
-                <td class="[% line.colnum %]">
+                <td class="[% line.colnum | html %]">
             [% ELSE %]
-                <td style="display:none;" class="[% line.colnum %]">
+                <td style="display:none;" class="[% line.colnum | html %]">
             [% END %]
             <table class="invis">
                 <tr>
                     [% IF show_actual %]
-                        <td    >[% line.actual_amount %]</td>
+                        <td    >[% line.actual_amount | html %]</td>
                     [% END %]
                 <td>
 
                 [% IF ( line.budget_lock ) %]
-                    [% line.estimated_amount %]&nbsp;
-                    <input type="hidden" style="text-align: right;"  name="[% line.cell_name %]" value="[% line.estimated_amount %]"   />
+                    [% line.estimated_amount | html %]&nbsp;
+                    <input type="hidden" style="text-align: right;"  name="[% line.cell_name | html %]" value="[% line.estimated_amount | html %]"   />
                 [% ELSE %]
-                    <input type="text" style="text-align: right;  width:90%; " size="6" name="[% line.cell_name %]"  value="[% line.estimated_amount %]"  id="budget_[% line.budget_id %][% line.colnum %]" class="plan_entry_[% line.budget_id %]" onchange="calcTotalRow(this);" />
+                    <input type="text" style="text-align: right;  width:90%; " size="6" name="[% line.cell_name | html %]"  value="[% line.estimated_amount | html %]"  id="budget_[% line.budget_id | html %][% line.colnum | html %]" class="plan_entry_[% line.budget_id | html %]" onchange="calcTotalRow(this);" />
                 [% END %]
 
                 </td></tr>
             [% ELSE %]
                 <td>
             [% END %]
-                    [% budget_line.budget_act_remain %]
+                    [% budget_line.budget_act_remain | html %]
             </td>
         [% END %]
 
         [% IF ( budget_line.est_negative ) %]
-            <td style="color: red;" id="budget_est_[% budget_line.budget_id %]">
+            <td style="color: red;" id="budget_est_[% budget_line.budget_id | html %]">
         [% ELSIF ( budget_line.est_positive ) %]
-            <td style="color: green;" id="budget_est_[% budget_line.budget_id %]">
+            <td style="color: green;" id="budget_est_[% budget_line.budget_id | html %]">
         [% ELSE %]
-            <td id="budget_est_[% budget_line.budget_id %]">
+            <td id="budget_est_[% budget_line.budget_id | html %]">
         [% END %] 
-                [% budget_line.budget_est_remain | $Price %]&nbsp;
+                [% budget_line.budget_est_remain | $Price | html %]&nbsp;
             </td>
             </tr>
         </table>
 
         <td>
              [% UNLESS ( budget_line.budget_lock ) %]
-                    <input type="button"  onclick="autoFillRow('[% budget_line.budget_id %]')" value="Auto-fill row"/>
+                    <input type="button"  onclick="autoFillRow('[% budget_line.budget_id | html %]')" value="Auto-fill row"/>
             [% ELSE %]
              <div style="color:red;">not owned</div>
             [% END %]
     </tbody>
     </table>
 
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
     [% IF ( budget_period_locked ) %]
         <!-- <input STYLE="background: gray;"   type="submit" value="Save" disabled="disabled"/> -->
     [% ELSE %]
     [% FOREACH authvals_ro IN authvals_row %]
 
      [% UNLESS ( authvals_ro.display ) %]
-        <input type="hidden" value="[% authvals_ro.code %]"  name="hide_cols"/>
+        <input type="hidden" value="[% authvals_ro.code | html %]"  name="hide_cols"/>
      [% END %]
     [% END %]
 
 <div class="yui-b">
 
 <form method="post" action="/cgi-bin/koha/admin/aqplan.pl">
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
 <fieldset class="brief">
 <h4>Filter</h4>
 [% BLOCK planning_types %]
 [%     CASE 'MONTHS'    %]<span>by months</span>
 [%     CASE 'ITEMTYPES' %]<span>by item types</span>
 [%     CASE 'BRANCHES'  %]<span>by libraries</span>
-[%     CASE             %]<span>by [% type %]</span>
+[%     CASE             %]<span>by [% type | html %]</span>
 [%   END %]
 [% END %]
 <ol>
         <select name="authcat" id="authcat" size="1">
         [% FOREACH value IN authcat_dropbox.values %]
             [% IF ( value == authcat_dropbox.default ) %]
-            <option value="[% value %]" selected="selected">[% PROCESS planning_types type=value %]</option>
+            <option value="[% value | html %]" selected="selected">[% PROCESS planning_types type=value %]</option>
             [% ELSE %]
-            <option value="[% value %]">[% PROCESS planning_types type=value %]</option>
+            <option value="[% value | html %]">[% PROCESS planning_types type=value %]</option>
             [% END %]
         [% END %]
         </select>
     </ol>
     <fieldset class="action">
         <input type="submit" name="option_submit" value="Submit" />
-        <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
+        <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
     </fieldset>
 </fieldset>
 </form>
         <li><label class="inline" for="MIME">Into an application</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
         </li>
     </ol>
     <fieldset class="action">    <input type="submit" value="Submit"/>
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
-    <input type="hidden" name="report_name" value="[% report_name %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
+    <input type="hidden" name="report_name" value="[% report_name | html %]" />
     <input type="hidden" name="output" value="file" /></fieldset>
-    <input type="hidden" name="budget_period_id" value="[% budget_period_id %]" />
-    <input type="hidden" name="authcat" value="[% authcat %]" />
+    <input type="hidden" name="budget_period_id" value="[% budget_period_id | html %]" />
+    <input type="hidden" name="authcat" value="[% authcat | html %]" />
     </fieldset>
 </form>
 [% END %]
 </div>
 </div>
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("js/acq.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("js/acq.js") | $raw %]
     <script type="text/javascript">
     //<![CDATA[
         function Check(f) {
index ecf6226..c56ba7b 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
                         <tbody id="audio-alerts-table-body">
                             [% FOREACH a IN audio_alerts %]
                                 <tr>
-                                    <td><input type="checkbox" name="delete" value="[% a.id %]" /></td>
-                                    <td>[% a.precedence %]</td>
+                                    <td><input type="checkbox" name="delete" value="[% a.id | html %]" /></td>
+                                    <td>[% a.precedence | html %]</td>
                                     <td style="white-space:nowrap;">
-                                        <a title="Move alert up" href="audio_alerts.pl?action=move&amp;where=up&amp;id=[% a.id %]">
+                                        <a title="Move alert up" href="audio_alerts.pl?action=move&amp;where=up&amp;id=[% a.id | html %]">
                                             <i class="fa fa-arrow-up fa-lg order-control"></i>
                                         </a>
 
-                                        <a title="Move alert to top" href="audio_alerts.pl?action=move&amp;where=top&amp;id=[% a.id %]">
+                                        <a title="Move alert to top" href="audio_alerts.pl?action=move&amp;where=top&amp;id=[% a.id | html %]">
                                             <i class="fa fa-arrow-up fa-lg overline order-control"></i>
                                         </a>
 
-                                        <a title="Move alert to bottom" href="audio_alerts.pl?action=move&amp;where=bottom&amp;id=[% a.id %]">
+                                        <a title="Move alert to bottom" href="audio_alerts.pl?action=move&amp;where=bottom&amp;id=[% a.id | html %]">
                                             <i class="fa fa-arrow-down fa-lg underline order-control"></i>
                                         </a>
 
-                                        <a title="Move alert down" href="audio_alerts.pl?action=move&amp;where=down&amp;id=[% a.id %]">
+                                        <a title="Move alert down" href="audio_alerts.pl?action=move&amp;where=down&amp;id=[% a.id | html %]">
                                             <i class="fa fa-arrow-down fa-lg order-control"></i>
                                         </a>
                                     </td>
-                                    <td>[% a.selector %]</td>
-                                    <td>[% a.sound %]</td>
+                                    <td>[% a.selector | html %]</td>
+                                    <td>[% a.sound | html %]</td>
                                     <td>
-                                        <a class="btn btn-default btn-xs edit" data-soundid="[% a.id %]" data-precedence="[% a.precedence %]" data-selector="[% a.selector %]" data-sound="[% a.sound %]"><i class="fa fa-pencil"></i> Edit</a></td>
+                                        <a class="btn btn-default btn-xs edit" data-soundid="[% a.id | html %]" data-precedence="[% a.precedence | html %]" data-selector="[% a.selector | html %]" data-sound="[% a.sound | html %]"><i class="fa fa-pencil"></i> Edit</a></td>
                                 </tr>
                             [% END %]
                         </tbody>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         var MSG_AUDIO_EMPTY_SOUND = _("Please select or enter a sound.");
         var MSG_AUDIO_CONFIRM_DELETE = _("Are you sure you want to delete the selected audio alerts?");
         var MSG_AUDIO_CHECK_CHECKBOXES = _("Check the box next to the alert you want to delete.")
     </script>
-    [% Asset.js("js/audio_alerts.js") %]
+    [% Asset.js("js/audio_alerts.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 8e6e6d3..28a39a4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 [% INCLUDE 'prefs-admin-search.inc' %]
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;
   <a href="/cgi-bin/koha/admin/authtypes.pl">Authority types</a> &rsaquo;
-  [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | uri%]">[% authtypecode |html%] framework</a> &rsaquo;
+  [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | uri%]">[% authtypecode | html %] framework</a> &rsaquo;
   [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a> &rsaquo;
   [% END %]
   [% IF ( else ) %]Authority MARC subfield structure for [% tagfield | html %]
-  [% ELSE %]<a href="/cgi-bin/koha/admin/auth_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;tagsubfield=[% tagsubfield %]&amp;authtypecode=[% authtypecode |uri %]">Authority MARC subfield structure for [% tagfield | html %]</a> &rsaquo;
+  [% ELSE %]<a href="/cgi-bin/koha/admin/auth_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;tagsubfield=[% tagsubfield | html %]&amp;authtypecode=[% authtypecode |uri %]">Authority MARC subfield structure for [% tagfield | html %]</a> &rsaquo;
   [% END %]
-  [% IF ( delete_confirm ) %]Confirm deletion of subfield [% tagsubfield %]?[% END %]
+  [% IF ( delete_confirm ) %]Confirm deletion of subfield [% tagsubfield | html %]?[% END %]
   [% IF ( delete_confirmed ) %]Data deleted[% END %]
   [% IF ( add_form ) %]
   [% IF ( use_heading_flags_p ) %]
   [% IF ( heading_edit_subfields_p ) %]Edit MARC subfields constraints[% END %]
-  [% ELSE %][% action %][% END %]
+  [% ELSE %][% action | html %][% END %]
   [% END %]
 </div>
 
 [% IF ( add_form ) %]
 
     <h1>[% IF ( use_heading_flags_p ) %]
-    [% IF ( heading_edit_subfields_p ) %]Edit MARC subfields constraints for field [% tagfield | html %] authority [% authtypecode |html%][% END %]
-    [% ELSE %][% action %][% END %]</h1>
-    <form action="[% script_name %]" name="Aform" method="post">
+    [% IF ( heading_edit_subfields_p ) %]Edit MARC subfields constraints for field [% tagfield | html %] authority [% authtypecode | html %][% END %]
+    [% ELSE %][% action | html %][% END %]</h1>
+    <form action="[% script_name | html %]" name="Aform" method="post">
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
-        <input type="hidden" name="authtypecode" value="[% authtypecode | html%]" />
+        <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
         <fieldset class="action"><input type="submit" class="submit" value="Save changes" /> <a class="cancel" href="/cgi-bin/koha/admin/auth_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;authtypecode=[% authtypecode |uri %]">Cancel</a></fieldset>
         <div id="subfieldtabs" class="toptabs numbered">
             <ul>
                 [% FOREACH loo IN loop %]
                     [% IF ( loo.new_subfield ) %]
-                        <li><a href="#sub[% loo.tagsubfield %]field" title="[% loo.liblibrarian | html_entity %]">New</a></li>
+                        <li><a href="#sub[% loo.tagsubfield | html %]field" title="[% loo.liblibrarian | html_entity %]">New</a></li>
                     [% ELSE %]
-                        <li><a href="#sub[% loo.tagsubfield %]field" title="[% loo.liblibrarian | html_entity %]">
-                            [% loo.tagsubfield %]
+                        <li><a href="#sub[% loo.tagsubfield | html %]field" title="[% loo.liblibrarian | html_entity %]">
+                            [% loo.tagsubfield | html %]
                     </a></li>
                     [% END %]
                 [% END %]
             </ul>
 
         [% FOREACH loo IN loop %]
-        <div id="sub[% loo.tagsubfield %]field">
+        <div id="sub[% loo.tagsubfield | html %]field">
             <fieldset class="rows"><ol>
 
                 [% IF ( loo.new_subfield ) %]
                     <li>
-                        <label for="tagsubfieldinput[% loo.row %]">Subfield code: </label>
-                        <input type="text" name="tagsubfield" value="[% loo.tagsubfield %]" size="1" id="tagsubfield" maxlength="1" />
+                        <label for="tagsubfieldinput[% loo.row | html %]">Subfield code: </label>
+                        <input type="text" name="tagsubfield" value="[% loo.tagsubfield | html %]" size="1" id="tagsubfield" maxlength="1" />
                     </li>
                 [% ELSE %]
                     <li>
-                        <input type="hidden" name="tagsubfield" value="[% loo.tagsubfield %]" />
+                        <input type="hidden" name="tagsubfield" value="[% loo.tagsubfield | html %]" />
                     </li>
                 [% END %]
                 <li>
-                    <label for="repeatable[% loo.row %]">Repeatable: </label>
+                    <label for="repeatable[% loo.row | html %]">Repeatable: </label>
                     [% IF loo.repeatable %]
-                        <input type="checkbox" id="repeatable[% loo.row %]" name="repeatable[% loo.row %]" checked="checked" value="1" />
+                        <input type="checkbox" id="repeatable[% loo.row | html %]" name="repeatable[% loo.row | html %]" checked="checked" value="1" />
                     [% ELSE %]
-                        <input type="checkbox" id="repeatable[% loo.row %]" name="repeatable[% loo.row %]" value="1" />
+                        <input type="checkbox" id="repeatable[% loo.row | html %]" name="repeatable[% loo.row | html %]" value="1" />
                     [% END %]
                 </li>
                 <li>
-                    <label for="mandatory[% loo.row %]">Mandatory: </label>
+                    <label for="mandatory[% loo.row | html %]">Mandatory: </label>
                     [% IF loo.mandatory %]
-                        <input type="checkbox" id="mandatory[% loo.row %]" name="mandatory[% loo.row %]" checked="checked" value="1" />
+                        <input type="checkbox" id="mandatory[% loo.row | html %]" name="mandatory[% loo.row | html %]" checked="checked" value="1" />
                     [% ELSE %]
-                        <input type="checkbox" id="mandatory[% loo.row %]" name="mandatory[% loo.row %]" value="1" />
+                        <input type="checkbox" id="mandatory[% loo.row | html %]" name="mandatory[% loo.row | html %]" value="1" />
                     [% END %]
                 </li>
-                <li><label for="liblibrarian[% loo.row %]">Text for librarian: </label><input id="liblibrarian[% loo.row %]" type="text" name="liblibrarian" value="[% loo.liblibrarian | html_entity %]" size="40" maxlength="80" /></li>
-                <li><label for="libopac[% loo.row %]">Text for OPAC: </label><input type="text" id="libopac[% loo.row %]" name="libopac" value="[% loo.libopac | html_entity %]" size="40" maxlength="80" /></li>
-                <li><label for="tab[% loo.row %]">Managed in tab: </label>
-                    <select name="tab" size="1" id="tab[% loo.row %]">
+                <li><label for="liblibrarian[% loo.row | html %]">Text for librarian: </label><input id="liblibrarian[% loo.row | html %]" type="text" name="liblibrarian" value="[% loo.liblibrarian | html_entity %]" size="40" maxlength="80" /></li>
+                <li><label for="libopac[% loo.row | html %]">Text for OPAC: </label><input type="text" id="libopac[% loo.row | html %]" name="libopac" value="[% loo.libopac | html_entity %]" size="40" maxlength="80" /></li>
+                <li><label for="tab[% loo.row | html %]">Managed in tab: </label>
+                    <select name="tab" size="1" id="tab[% loo.row | html %]">
                         [%- IF ( loo.tab ==  -1 ) -%]
                         <option value="-1" selected="selected">ignore</option>
                         [%- ELSE -%]
                         [%- END -%]
                     [%- FOREACH t IN [ '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '10'] -%]
                         [%- IF ( loo.tab ==  t && t.length>0 ) -%]
-                        <option value="[%- t -%]" selected="selected">[%- t -%]</option>
+                        <option value="[%- t | html -%]" selected="selected">[%- t | html -%]</option>
                         [%- ELSIF ( loo.tab ==  t ) -%]
-                        <option value="[%- t -%]" selected="selected">&nbsp;</option>
+                        <option value="[%- t | html -%]" selected="selected">&nbsp;</option>
                         [%- ELSE -%]
-                        <option value="[%- t -%]">[%- t -%]</option>
+                        <option value="[%- t | html -%]">[%- t | html -%]</option>
                         [%- END -%]
                     [%- END -%]
                     </select>
                     <fieldset>
                         <legend>Display</legend>
                         <ol>
-                            <li><label for="ohidden[% loo.row %]">Select to display or not:</label>
-                                <select name="ohidden" size="1" id="ohidden[% loo.row %]">
+                            <li><label for="ohidden[% loo.row | html %]">Select to display or not:</label>
+                                <select name="ohidden" size="1" id="ohidden[% loo.row | html %]">
                                     [%- IF ( loo.ohidden ==  0 ) -%]
                                     <option value= "0" selected="selected">Show all</option>
                                     <option value="1">Hide all</option>
                         <legend>Advanced constraints:</legend>
                         <ol>
                             <li>
-                                <label for="isurl[% loo.row %]">Is a URL:</label>
+                                <label for="isurl[% loo.row | html %]">Is a URL:</label>
                                 [% IF loo.isurl %]
-                                    <input type="checkbox" id="isurl[% loo.row %]" name="isurl[% loo.row %]" checked="checked" value="1" />
+                                    <input type="checkbox" id="isurl[% loo.row | html %]" name="isurl[% loo.row | html %]" checked="checked" value="1" />
                                 [% ELSE %]
-                                    <input type="checkbox" id="isurl[% loo.row %]" name="isurl[% loo.row %]" value="1" />
+                                    <input type="checkbox" id="isurl[% loo.row | html %]" name="isurl[% loo.row | html %]" value="1" />
                                 [% END %]
                                 (if checked, it means that the subfield is a URL and can be clicked)
                             </li>
                             <li>
-                                <label for="defaultvalue[% loo.row %]">Default value:</label>
-                                <input type="text" name="defaultvalue" id="defaultvalue[% loo.row %]" value="[% loo.defaultvalue %]" />
+                                <label for="defaultvalue[% loo.row | html %]">Default value:</label>
+                                <input type="text" name="defaultvalue" id="defaultvalue[% loo.row | html %]" value="[% loo.defaultvalue | html %]" />
                             </li>
                         </ol>
                     </fieldset>
                     <fieldset><legend>Help input</legend>    
                         <ol>
                             <li>
-                                <label for="kohafield[% loo.row %]">Koha field:</label>
-                                <select name="kohafield" id="kohafield[% loo.row %]" size="1">
+                                <label for="kohafield[% loo.row | html %]">Koha field:</label>
+                                <select name="kohafield" id="kohafield[% loo.row | html %]" size="1">
                                 [%- FOREACH value IN loo.kohafields %]
                                     [% IF ( value == loo.kohafield  && value.length>0 ) -%]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [%- ELSIF ( value == loo.kohafield ) -%]
-                                    <option value="[% value %]" selected="selected">&nbsp;</option>
+                                    <option value="[% value | html %]" selected="selected">&nbsp;</option>
                                     [%- ELSIF ( value.length==0 ) -%]
-                                    <option value="[% value %]">&nbsp;</option>
+                                    <option value="[% value | html %]">&nbsp;</option>
                                     [%- ELSE -%]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [%- END -%]
                                 [%- END %]
                                 </select>
                             </li>
                             <li>
-                                <label for="authorised_value[% loo.row %]">Authorized value:</label>
-                                <select name="authorised_value" id="authorised_value[% loo.row %]" size="1">
+                                <label for="authorised_value[% loo.row | html %]">Authorized value:</label>
+                                <select name="authorised_value" id="authorised_value[% loo.row | html %]" size="1">
                                 [%- FOREACH value IN loo.authorised_values %]
                                     [% IF ( value == loo.authorised_value && value.length>0 ) -%]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [%- ELSIF ( value == loo.authorised_value ) -%]
-                                    <option value="[% value %]" selected>&nbsp;</option>
+                                    <option value="[% value | html %]" selected>&nbsp;</option>
                                     [%- ELSIF ( value.length==0 ) -%]
-                                    <option value="[% value %]">&nbsp;</option>
+                                    <option value="[% value | html %]">&nbsp;</option>
                                     [%- ELSE -%]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [%- END -%]
                                 [%- END %]
                                 </select>
                             </li>
                             <li>
-                                <label for="frameworkcode[% loo.row %]">Thesaurus:</label>
-                                <select name="frameworkcode" id="frameworkcode[% loo.row %]" size="1">
+                                <label for="frameworkcode[% loo.row | html %]">Thesaurus:</label>
+                                <select name="frameworkcode" id="frameworkcode[% loo.row | html %]" size="1">
                                 [%- FOREACH value IN loo.frameworkcodes %]
                                     [% IF ( value == loo.frameworkcode && value.length>0 ) -%]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [%- ELSIF ( value == loo.frameworkcode ) -%]
-                                    <option value="[% value %]" selected="selected">&nbsp;</option>
+                                    <option value="[% value | html %]" selected="selected">&nbsp;</option>
                                     [%- ELSIF ( value.length==0 ) -%]
-                                    <option value="[% value %]">&nbsp;</option>
+                                    <option value="[% value | html %]">&nbsp;</option>
                                     [%- ELSE -%]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [%- END -%]
                                 [%- END %]
                                 </select>
                             </li>
                             <li>
-                                <label for="value_builder[% loo.row %]">Plugin:</label>
-                                <select name="value_builder" id="value_builder[% loo.row %]" size="1">
+                                <label for="value_builder[% loo.row | html %]">Plugin:</label>
+                                <select name="value_builder" id="value_builder[% loo.row | html %]" size="1">
                                 [%- FOREACH value IN loo.value_builders %]
                                     [% IF ( value == loo.value_builder && value.length>0 ) -%]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [%- ELSIF ( value == loo.value_builder ) -%]
-                                    <option value="[% value %]" selected="selected">&nbsp;</option>
+                                    <option value="[% value | html %]" selected="selected">&nbsp;</option>
                                     [%- ELSIF ( value.length==0 ) -%]
-                                    <option value="[% value %]">&nbsp;</option>
+                                    <option value="[% value | html %]">&nbsp;</option>
                                     [%- ELSE -%]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [%- END -%]
                                 [%- END %]
                                 </select>
 [% IF ( delete_confirm ) %]
 
     <div class="dialog alert">
-        <h3>Delete subfield <span class="ex">'[% tagsubfield %]'?</span></h3>
-        <form action="[% delete_link %]" method="post">
+        <h3>Delete subfield <span class="ex">'[% tagsubfield | html %]'?</span></h3>
+        <form action="[% delete_link | html %]" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
             <table>
-                <tr><th scope="row">Subfield:</th> <td>[% tagsubfield %]</td></tr>
+                <tr><th scope="row">Subfield:</th> <td>[% tagsubfield | html %]</td></tr>
                 <tr><th scope="row">Description:</th> <td>[% liblibrarian | html_entity %]</td></tr>
             </table>
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
-            <input type="hidden" name="tagfield" value="[% tagfield%]" />
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
+            <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
             <input type="hidden" name="tagsubfield" value="[% tagsubfield | html %]" />
             <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this subfield</button>
         </form>
 
-        <form action="[% delete_link %]" method="get">
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
+        <form action="[% delete_link | html %]" method="get">
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
-            <input type="hidden" name="tagsubfield" value="[% tagsubfield %]" />
-            <input type="hidden" name="authtypecode" value="[% authtypecode |html %]" />
+            <input type="hidden" name="tagsubfield" value="[% tagsubfield | html %]" />
+            <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </form></div>
 [% IF ( delete_confirmed ) %]
 
    <div class="dialog message"> <h3>Data deleted</h3>
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
         <input type="submit" class="approve" value="OK" />
     </form></div>
 
 
 [% IF ( else ) %]
-<h1>Authority MARC subfield structure admin for [% tagfield | html %] (authority: [% authtypecode | html%])</h1>
+<h1>Authority MARC subfield structure admin for [% tagfield | html %] (authority: [% authtypecode | html %])</h1>
 <p>This screen shows the subfields associated with the selected tag. You can edit subfields or add a new one by clicking on edit.</p>
 <p>The column 'Koha field' shows that the subfield is linked with a Koha field.</p>
 
     </tr>
     [% FOREACH loo IN loop %]
     <tr>
-        <td>[% loo.tagsubfield %]</td>
+        <td>[% loo.tagsubfield | html %]</td>
         <td>
             [% IF ( loo.subfield_ignored ) %]
                     <i>[% loo.liblibrarian | html_entity %]</i>
             [% IF ( loo.subfield_ignored ) %]
                     <i>subfield ignored</i>
             [% ELSE %]
-                <strong>Tab:</strong>[% loo.tab %],
-                [% IF ( loo.kohafield ) %] | <strong>Koha field:</strong> [% loo.kohafield %], [% END %]
+                <strong>Tab:</strong>[% loo.tab | html %],
+                [% IF ( loo.kohafield ) %] | <strong>Koha field:</strong> [% loo.kohafield | html %], [% END %]
                 [% IF ( loo.repeatable ) %]Repeatable, [% ELSE %]Not repeatable,
                 [% END %]
                         [% IF ( loo.mandatory ) %]Mandatory, [% ELSE %]Not mandatory,
                 [% END %]
                         [% IF ( loo.isurl ) %]is a url,
                 [% END %]
-                        [% IF ( loo.authorised_value ) %] | <strong>Auth value:</strong>[% loo.authorised_value %],
+                        [% IF ( loo.authorised_value ) %] | <strong>Auth value:</strong>[% loo.authorised_value | html %],
                 [% END %]
-                        [% IF ( loo.frameworkcode ) %] | <strong>Authority:</strong>[% loo.frameworkcode %],
+                        [% IF ( loo.frameworkcode ) %] | <strong>Authority:</strong>[% loo.frameworkcode | html %],
                 [% END %]
-                [% IF ( loo.value_builder ) %] | <strong>Plugin:</strong>[% loo.value_builder %],[% END %]
+                [% IF ( loo.value_builder ) %] | <strong>Plugin:</strong>[% loo.value_builder | html %],[% END %]
             [% END %]
         </td>
-        <td><a href="[% loo.delete %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a></td>
+        <td><a href="[% loo.delete | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a></td>
     </tr>
     [% END %]
 </table>
 
-    <form action="[% script_name %]" method="get">
+    <form action="[% script_name | html %]" method="get">
     <fieldset class="action"><input type="hidden" name="op" value="add_form" />
-    <input type="hidden" name="tagfield" value="[% edit_tagfield %]" />
-    <input type="hidden" name="authtypecode" value="[% edit_authtypecode %]" />
+    <input type="hidden" name="tagfield" value="[% edit_tagfield | html %]" />
+    <input type="hidden" name="authtypecode" value="[% edit_authtypecode | html %]" />
     <input type="submit" value="Edit subfields" />
     <a class="cancel" href="auth_tag_structure.pl?searchfield=[% tagfield | uri%]&amp;authtypecode=[% authtypecode | uri %]">Cancel</a></fieldset>
     </form>
 
     [% IF ( previous ) %]
-    <input type="image" src="[% interface %]/[% theme %]/images/1leftarrow.png" title="previous" alt="previous" />
+    <input type="image" src="[% interface | html %]/[% theme | html %]/images/1leftarrow.png" title="previous" alt="previous" />
     </a>
     [% END %]
     [% IF ( next ) %]
-        [% next %]
-    <input type="image" src="[% interface %]/[% theme %]/images/1rightarrow.png" title="next" alt="next" />
+        [% next | html %]
+    <input type="image" src="[% interface | html %]/[% theme | html %]/images/1rightarrow.png" title="next" alt="next" />
     </a>
     [% END %]
 
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
      $(document).ready(function() {
         $('#subfieldtabs').tabs();
index 435210f..9495b09 100644 (file)
@@ -1,14 +1,15 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Authority MARC framework [% IF ( add_form ) %][% IF ( use_heading_flags_p ) %]
-    [% IF ( heading_modify_tag_p ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Modify tag[% END %]
-    [% IF ( heading_add_tag_p ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode %] Framework[% ELSE %]Default framework[% END %] &rsaquo; New tag[% END %]
-    [% ELSE %]&rsaquo; [% action %][% END %][% END %][% IF ( delete_confirm ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Confirm deletion[% END %][% IF ( delete_confirmed ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Data deleted[% END %]</title>
+    [% IF ( heading_modify_tag_p ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode | html %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Modify tag[% END %]
+    [% IF ( heading_add_tag_p ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode | html %] Framework[% ELSE %]Default framework[% END %] &rsaquo; New tag[% END %]
+    [% ELSE %]&rsaquo; [% action | html %][% END %][% END %][% IF ( delete_confirm ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode | html %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Confirm deletion[% END %][% IF ( delete_confirmed ) %]&rsaquo; [% IF ( authtypecode ) %][% authtypecode | html %] Framework[% ELSE %]Default framework[% END %] &rsaquo; Data deleted[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_auth_tag_structure" class="admin">
     [% IF ( add_form ) %]
         [% IF ( use_heading_flags_p ) %]
             [% IF ( heading_modify_tag_p ) %]
-                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]">[% authtypecode %] Framework</a>
+                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]">[% authtypecode | html %] Framework</a>
                 [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a>
                 [% END %] &rsaquo; Modify tag
             [% END %]
             [% IF ( heading_add_tag_p ) %]
-                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]">[% authtypecode %] framework</a>
+                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]">[% authtypecode | html %] framework</a>
                 [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a>
                 [% END %] &rsaquo; New tag
             [% END %]
         [% ELSE %]
-            [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]">[% authtypecode %] Framework</a>
+            [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]">[% authtypecode | html %] Framework</a>
             [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a>
-            [% END %] &rsaquo; [% action %]
+            [% END %] &rsaquo; [% action | html %]
         [% END %]
     [% ELSE %]
         [% IF ( delete_confirm ) %]
-            [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]">[% authtypecode %] framework</a>
+            [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]">[% authtypecode | html %] framework</a>
             [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a>
             [% END %] &rsaquo; Confirm deletion
         [% ELSE %]
             [% IF ( delete_confirmed ) %]
-                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]">[% authtypecode %] framework</a>
+                [% IF ( authtypecode ) %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]">[% authtypecode | html %] framework</a>
                 [% ELSE %]<a href="/cgi-bin/koha/admin/auth_tag_structure.pl">Default framework</a>
                 [% END %] &rsaquo; Data deleted
             [% ELSE %]
-                [% IF ( authtypecode ) %][% authtypecode %] Framework
+                [% IF ( authtypecode ) %][% authtypecode | html %] Framework
                 [% ELSE %]Default framework
                 [% END %]
             [% END %]
@@ -59,7 +60,7 @@
     <div id="yui-main">
     <div class="yui-b">
 
-<h1>Authority MARC framework for [% IF ( authtypecode ) %][% authtypecode %][% ELSE %]default framework[% END %]</h1>
+<h1>Authority MARC framework for [% IF ( authtypecode ) %][% authtypecode | html %][% ELSE %]default framework[% END %]</h1>
 
 
 [% IF ( add_form ) %]
     [% IF ( heading_modify_tag_p ) %]Modify tag[% END %]
     [% IF ( heading_add_tag_p ) %]New tag[% END %]
     </h2>
-    <form action="[% script_name %]" name="Aform" method="post" class="validated">
+    <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
         <input type="hidden" name="op" value="add_validate" />
         [% IF ( heading_modify_tag_p ) %]<input type="hidden" name="modif" value="1" />[% END %]
-        <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
+        <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
         <fieldset class="rows">
             <ol>
                 [% IF ( heading_modify_tag_p ) %]
                     <li>
                         <span class="label">Tag: </span>
-                        <input type="hidden" name="tagfield" value="[% searchfield %]" />
-                        [% searchfield %]
+                        <input type="hidden" name="tagfield" value="[% searchfield | html %]" />
+                        [% searchfield | html %]
                     </li>
                 [% ELSE %]
                     <li>
@@ -87,8 +88,8 @@
                     </li>
                 [% END %]
 
-        <li><label for="liblibrarian">Text for librarians: </label><input type="text" name="liblibrarian" id="liblibrarian" value="[% liblibrarian |html %]" size="40" maxlength="100" /></li>
-        <li><label for="libopac">Text for opac: </label><input type="text" name="libopac" id="libopac" value="[% libopac |html %]" size="40" maxlength="100" /></li>
+        <li><label for="liblibrarian">Text for librarians: </label><input type="text" name="liblibrarian" id="liblibrarian" value="[% liblibrarian | html %]" size="40" maxlength="100" /></li>
+        <li><label for="libopac">Text for opac: </label><input type="text" name="libopac" id="libopac" value="[% libopac | html %]" size="40" maxlength="100" /></li>
         <li><label for="repeatable">Repeatable: </label>
             [% IF ( repeatable ) %]
                 <input type="checkbox" name="repeatable" id="repeatable" value="1" checked="checked" />
         </fieldset>
         <fieldset class="action">
             <input type="submit" value="Submit" />
-            <a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode %]" class="cancel">Cancel</a>
+            <a href="/cgi-bin/koha/admin/auth_tag_structure.pl?authtypecode=[% authtypecode | html %]" class="cancel">Cancel</a>
         </fieldset>
     </form>
 [% END %]
 [% IF ( delete_confirm ) %]
     <div class="dialog alert">
         <h3>Confirm deletion</h3>
-        <form action="[% script_name %]" method="post">
+        <form action="[% script_name | html %]" method="post">
             <table>
-                <tr><th scope="row">Tag: </th><td>[% searchfield %] [% liblibrarian %]</td></tr>
+                <tr><th scope="row">Tag: </th><td>[% searchfield | html %] [% liblibrarian | html %]</td></tr>
             </table>
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
+            <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
         </form>
-        <form action="[% script_name %]" method="get">
+        <form action="[% script_name | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% IF ( delete_confirmed ) %]
 
   <div class="dialog message">  <h3>Data deleted</h3>
-    <form action="[% script_name %]" method="post">
-    <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
-    <input type="hidden" name="searchfield" value="[% searchfield %]" />
+    <form action="[% script_name | html %]" method="post">
+    <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
+    <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
     <input type="submit" value="OK" class="submit" />
     </form></div>
 [% END %]
 [% IF ( authtype_create ) %]
 
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <input type="hidden" name="op" value="authtype_create_confirm" />
-        <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
-        Create authority framework for [% authtypecode %] using
+        <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
+        Create authority framework for [% authtypecode | html %] using
         <select name="existingauthtypecode">
         [% FOREACH existingauthtypeloo IN existingauthtypeloop %]
             [% IF existingauthtypeloo.value == "" %]
-              <option value="" selected="selected">[% existingauthtypeloo.authtypetext %]</option>
+              <option value="" selected="selected">[% existingauthtypeloo.authtypetext | html %]</option>
             [% ELSE %]
-              <option value="[% existingauthtypeloo.value %]">[% existingauthtypeloo.authtypetext %]</option>
+              <option value="[% existingauthtypeloo.value | html %]">[% existingauthtypeloo.authtypetext | html %]</option>
             [% END %]
         [% END %]
         </select>
 [% IF ( else ) %]
 
 <div id="toolbar" class="btn-toolbar">
-    <div class="btn-group"><a class="btn btn-default btn-sm" id="newtag" href="/cgi-bin/koha/admin/auth_tag_structure.pl?op=add_form&amp;authtypecode=[% authtypecode %]"><i class="fa fa-plus"></i> New tag</a></div>
+    <div class="btn-group"><a class="btn btn-default btn-sm" id="newtag" href="/cgi-bin/koha/admin/auth_tag_structure.pl?op=add_form&amp;authtypecode=[% authtypecode | html %]"><i class="fa fa-plus"></i> New tag</a></div>
 </div>
 
 <h2>Select an authority framework</h2>
-<form action="[% script_name %]" method="post">
+<form action="[% script_name | html %]" method="post">
     <select name="authtypecode">
     [% FOREACH authority_type IN authority_types%]
         [% IF authority_type.authtypecode == authtypecode%]
-        <option value="[% authority_type.authtypecode %]" selected="selected">[% authority_type.authtypetext %]</option>
+        <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
         [% ELSE %]
-        <option value="[% authority_type.authtypecode%]">[% authority_type.authtypetext %]</option>
+        <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
         [% END %]
     [% END %]
     </select>
-    <input type="text" name="searchfield" value="[% searchfield %]" />
+    <input type="text" name="searchfield" value="[% searchfield | html %]" />
     <input type="submit" value="OK" class="submit" />
 </form><br />
 <div id="pagertable_authtagstructure">
     <tbody>
         [% FOREACH loo IN loop %]
         <tr>
-            <td><b>[% loo.tagfield %]</b></td>
-            <td>[% loo.liblibrarian %]</td>
+            <td><b>[% loo.tagfield | html %]</b></td>
+            <td>[% loo.liblibrarian | html %]</td>
             <td>[% IF ( loo.repeatable ) %]Yes[% ELSE %]No[% END %]</td>
             <td>[% IF ( loo.mandatory ) %]Yes[% ELSE %]No[% END %]</td>
-            <td>[% loo.authorised_value %]</td>
+            <td>[% loo.authorised_value | html %]</td>
             <td>
                 <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="authtagactions[% loo.tagfield %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="authtagactions[% loo.tagfield | html %]" role="button" data-toggle="dropdown" href="#">
                         Actions <b class="caret"></b></a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authtagactions[% loo.tagfield %]">
-                        <li><a href="[% loo.subfield_link %]"><i class="fa fa-eye"></i> Subfields</a></li>
-                        <li><a href="[% loo.edit %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                        <li><a href="[% loo.delete %]"><i class="fa fa-trash"></i> Delete</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authtagactions[% loo.tagfield | html %]">
+                        <li><a href="[% loo.subfield_link | html %]"><i class="fa fa-eye"></i> Subfields</a></li>
+                        <li><a href="[% loo.edit | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                        <li><a href="[% loo.delete | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                     </ul>
                 </div>
             </td>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#table_authtagstructure").dataTable($.extend(true, {}, dataTablesDefaults, {
index a728a45..f9dead1 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -10,7 +11,7 @@
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 
 <style type="text/css">
        fieldset.rows div.toptabs li { clear:none;margin-right:.5em;padding-bottom:0;width:auto; }
             </li>
         <li>
             <label for="authorised_value">Authorized value: </label>
-            [% IF ( action_modify ) %]<input type="hidden" id="id" name="id" value="[% id %]" />[% END %]
+            [% IF ( action_modify ) %]<input type="hidden" id="id" name="id" value="[% id | html %]" />[% END %]
             <input type="text" id="authorised_value" name="authorised_value" value="[% authorised_value | html %]" maxlength="80" class="focus" />
         </li>
         <li>
             <label for="lib">Description: </label>
-            <input type="text" name="lib" id="lib" value="[% lib %]" maxlength="200" />
+            <input type="text" name="lib" id="lib" value="[% lib | html %]" maxlength="200" />
         </li>
        <li>
             <label for="lib_opac">Description (OPAC): </label>
-            <input type="text" name="lib_opac" id="lib_opac" value="[% lib_opac %]" maxlength="200" />
+            <input type="text" name="lib_opac" id="lib_opac" value="[% lib_opac | html %]" maxlength="200" />
         </li>
         <li><label for="branches">Libraries limitation: </label>
             <select id="branches" name="branches" multiple size="10">
                 <option value="">All libraries</option>
                 [% FOREACH branch IN branches_loop %]
                   [% IF ( branch.selected ) %]
-                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                    <option selected="selected" value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                   [% ELSE %]
-                    <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                    <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                   [% END %]
                 [% END %]
             </select>
@@ -91,7 +92,7 @@
                        <ul>
                   <li><a href="#none">None</a></li>
                                  [% FOREACH imageset IN imagesets %]
-                        [% IF ( imageset.imagesetactive ) %]<li class="ui-tabs-active">[% ELSE %]<li>[% END %]<a href="#[% imageset.imagesetname %]">[% imageset.imagesetname %]</a></li>
+                        [% IF ( imageset.imagesetactive ) %]<li class="ui-tabs-active">[% ELSE %]<li>[% END %]<a href="#[% imageset.imagesetname | html %]">[% imageset.imagesetname | html %]</a></li>
                                  [% END %]
                        </ul>
   <div id="none"><ul>
   </ul>
   <br class="clear" /></div>
   [% FOREACH imageset IN imagesets %]
-  <div id="[% imageset.imagesetname %]"><ul>
+  <div id="[% imageset.imagesetname | html %]"><ul>
   [% FOREACH image IN imageset.images %]
                        <li style="float: none; display: inline-block; clear : none; width: auto;">
             <label> [% IF ( image.StaffImageUrl ) %]
-              <img src="[% image.StaffImageUrl %]" alt="[% image.StaffImageUrl %]" title="[% image.StaffImageUrl %]" />
+              <img src="[% image.StaffImageUrl | html %]" alt="[% image.StaffImageUrl | html %]" title="[% image.StaffImageUrl | html %]" />
         [% ELSE %]
         [% END %]
     [% IF ( image.checked ) %]
-              <input type="radio" name="imageurl" value="[% image.KohaImage %]" checked="checked" />
+              <input type="radio" name="imageurl" value="[% image.KohaImage | html %]" checked="checked" />
     [% ELSE %]
               [% IF ( image.KohaImage ) %] <!-- to delete the radio button if there is no image after -->
-              <input type="radio" name="imageurl" value="[% image.KohaImage %]" />
+              <input type="radio" name="imageurl" value="[% image.KohaImage | html %]" />
               [% END %]
     [% END %]
             </label>
   </div>
         [% END %]
         </fieldset>
-       <fieldset class="action"> <input type="hidden" name="id" value="[% id %]" />
+       <fieldset class="action"> <input type="hidden" name="id" value="[% id | html %]" />
         <input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/admin/authorised_values.pl?searchfield=[% category | url %]">Cancel</a></fieldset>
     </form>
 [% END %]
 [% IF op == 'list' %]
 
 <div id="toolbar" class="btn-toolbar">
-    <a id="addauth" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;category=[% category | url %]"><i class="fa fa-plus"> </i> New authorized value for [% category |html %]</a>
+    <a id="addauth" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;category=[% category | url %]"><i class="fa fa-plus"> </i> New authorized value for [% category | html %]</a>
     <a id="addcat" class="btn btn-default btn-sm" href= "/cgi-bin/koha/admin/authorised_values.pl?op=add_form"><i class="fa fa-plus"> </i> New category</a>
 </div>
 
 <div class="note"><i class="fa fa-exclamation"></i> <strong>NOTE:</strong> If you change an authorized value code, existing records using it won't be updated. Changes to value descriptions will show immediately.</div>
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this authorized value. Perhaps the value already exists.
         [% CASE 'invalid_category_name' %]
             The authorized value category 'branches', 'itemtypes' and 'cn_source' are used internally by Koha and are not valid.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
   <select name="searchfield" id="searchfield" size="1">
   [% FOR c IN categories %]
     [% IF c == searchfield %]
-      <option value="[% c %]" selected="selected">[% c |html %]</option>
+      <option value="[% c | html %]" selected="selected">[% c | html %]</option>
     [% ELSE %]
-      <option value="[% c %]">[% c |html %]</option>
+      <option value="[% c | html %]">[% c | html %]</option>
     [% END %]
   [% END %]
   <input type="submit" value="Submit" />
  [% IF ( category == 'NOT_LOAN' ) %]
     <p>Statuses to describe why an item is not for loan</p>
  [% END %]
-<h3>Authorized values for category [% category |html %]:</h3>
+<h3>Authorized values for category [% category | html %]:</h3>
 
 [% IF ( loop ) %]<div id="pagertable_authorized_values">
 </div>[% END %]
 <tr>
 [% END %]
        <td>[% loo.authorised_value | html %]</td>
-    <td>[% loo.lib |html %]</td>
-    <td>[% loo.lib_opac |html %]</td>
-       <td>[% IF ( loo.imageurl ) %]<img src="[% loo.imageurl %]" alt=""/>[% ELSE %]&nbsp;[% END %]</td>
+    <td>[% loo.lib | html %]</td>
+    <td>[% loo.lib_opac | html %]</td>
+       <td>[% IF ( loo.imageurl ) %]<img src="[% loo.imageurl | html %]" alt=""/>[% ELSE %]&nbsp;[% END %]</td>
     <td>
         [% IF loo.branches.size > 0 %]
-            [% branches_str = "" %]
+            [% branches_str = "" | html %]
             [% FOREACH branch IN loo.branches %]
-                [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" %]
+                [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" | html %]
             [% END %]
-            <span href="#" title="[% branches_str %]">
+            <span href="#" title="[% branches_str | html %]">
                 [% IF loo.branches.size > 1 %]
-                    [% loo.branches.size %] branches limitations
+                    [% loo.branches.size | html %] branches limitations
                 [% ELSE %]
-                    [% loo.branches.size %] branch limitation
+                    [% loo.branches.size | html %] branch limitation
                 [% END %]
         [% ELSE %]
             No limitation
         [% END %]
     </td>
-    <td class="actions"><a href="/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;id=[% loo.id %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-    <a class="delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/authorised_values.pl?op=delete&amp;searchfield=[% searchfield | url %]&amp;id=[% loo.id %]"><i class="fa fa-trash"></i> Delete</a></td>
+    <td class="actions"><a href="/cgi-bin/koha/admin/authorised_values.pl?op=add_form&amp;id=[% loo.id | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+    <a class="delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/authorised_values.pl?op=delete&amp;searchfield=[% searchfield | url %]&amp;id=[% loo.id | html %]"><i class="fa fa-trash"></i> Delete</a></td>
 </tr>
 [% END %]
 </tbody></table>[% ELSE %]
-<div class="dialog message">There are no authorized values defined for [% category |html %]</div>
+<div class="dialog message">There are no authorized values defined for [% category | html %]</div>
 [% END %]
 
 [% IF ( isprevpage ) %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index c75e410..887e9c3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -9,7 +10,7 @@
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_authtypes" class="admin">
@@ -33,7 +34,7 @@
          <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this authority type. Perhaps it already exists.
@@ -48,7 +49,7 @@
         [% CASE 'success_on_delete' %]
             Authority type deleted successfully.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -71,7 +72,7 @@
                             <span class="label">Authority type</span>
                             <input type="hidden" name="op" value="add_validate" />
                             <input type="hidden" name="checked" value="0" />
-                            <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode %]" />[% authority_type.authtypecode %]
+                            <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />[% authority_type.authtypecode | html %]
                     [% ELSE %]
                             <label for="authtypecode" class="required">Authority type: </label>
                             <input id="authtypecode" type="text" class="required" required="required" name="authtypecode" size="10" maxlength="10" />
                 </li>
                 <li>
                     <label for="authtypetext" class="required">Description: </label>
-                    <input type="text" id="authtypetext" name="authtypetext" size="40" maxlength="80" value="[% authority_type.authtypetext |html %]" class="required" required="required" />
+                    <input type="text" id="authtypetext" name="authtypetext" size="40" maxlength="80" value="[% authority_type.authtypetext | html %]" class="required" required="required" />
                     <span class="required">Required</span>
                 </li>
                 <li>
                     <label for="summary">Summary: </label>
-                    <textarea id="summary" name="summary" cols="55" rows="7">[% authority_type.summary %]</textarea>
+                    <textarea id="summary" name="summary" cols="55" rows="7">[% authority_type.summary | html %]</textarea>
                 </li>
                 <li>
                     <p class="tip">Note: for 'Authority field to copy', enter the authority field that should be copied from the authority record to the bibliographic record. E.g., in MARC21, field 100 in the authority record should be copied to field 100 in the bibliographic record</p>
                     <label for="auth_tag_to_report">Authority field to copy: </label>
-                    <input type="text" id="auth_tag_to_report" name="auth_tag_to_report" size="5" maxlength="3" value="[% authority_type.auth_tag_to_report %]" />
+                    <input type="text" id="auth_tag_to_report" name="auth_tag_to_report" size="5" maxlength="3" value="[% authority_type.auth_tag_to_report | html %]" />
                     <input type="hidden" name="op" value="add_validate" />
                     [% IF authority_type.authtypecode.defined %]
                         <input type="hidden" name="is_a_modif" value="1" />
     <div class="dialog alert">
         [% IF authorities_using_it %]
             <h3>This authority type cannot be deleted</h3>
-            <p>This record is used <strong>[% authorities_using_it %]</strong> times</p>
+            <p>This record is used <strong>[% authorities_using_it | html %]</strong> times</p>
             <a class="cancel" href="/cgi-bin/koha/admin/authtypes.pl">Back to the list</a>
         [% ELSE %]
-            <h3>Confirm deletion of authority structure definition for <span class="ex">'[% authority_type.authtypetext %]' ([% authority_type.authtypecode %])</span></h3>
+            <h3>Confirm deletion of authority structure definition for <span class="ex">'[% authority_type.authtypetext | html %]' ([% authority_type.authtypecode | html %])</span></h3>
             <form action="/cgi-bin/koha/admin/authtypes.pl" method="post">
                 <input type="hidden" name="op" value="delete_confirmed" />
-                <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode %]" />
+                <input type="hidden" name="authtypecode" value="[% authority_type.authtypecode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
             </form>
             <form action="/cgi-bin/koha/admin/authtypes.pl" method="get">
         <tbody>
         [% FOREACH authority_type IN authority_types %]
             <tr>
-                <td>[% authority_type.authtypecode %]</td>
-                <td>[% authority_type.authtypetext |html %]</td>
-                <td>[% authority_type.summary |html %]</td>
-                <td>[% authority_type.auth_tag_to_report %]</td>
+                <td>[% authority_type.authtypecode | html %]</td>
+                <td>[% authority_type.authtypetext | html %]</td>
+                <td>[% authority_type.summary | html %]</td>
+                <td>[% authority_type.auth_tag_to_report | html %]</td>
                 <td>
                   <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="authtypeactions[% authority_type.authtypecode %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="authtypeactions[% authority_type.authtypecode | html %]" role="button" data-toggle="dropdown" href="#">
                       Actions <b class="caret"></b></a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authtypeactions[% authority_type.authtypecode %]">
-                      <li><a href="auth_tag_structure.pl?authtypecode=[% authority_type.authtypecode %]" class="button parameters"><i class="fa fa-eye"></i> MARC structure</a></li>
-                      <li><a href="/cgi-bin/koha/admin/authtypes.pl?op=add_form&amp;authtypecode=[% authority_type.authtypecode |html %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                      [% IF authority_type.authtypecode %]<li><a href="/cgi-bin/koha/admin/authtypes.pl?op=delete_confirm&amp;authtypecode=[% authority_type.authtypecode |html %]"><i class="fa fa-trash"></i> Delete</a></li>[% END %]
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authtypeactions[% authority_type.authtypecode | html %]">
+                      <li><a href="auth_tag_structure.pl?authtypecode=[% authority_type.authtypecode | html %]" class="button parameters"><i class="fa fa-eye"></i> MARC structure</a></li>
+                      <li><a href="/cgi-bin/koha/admin/authtypes.pl?op=add_form&amp;authtypecode=[% authority_type.authtypecode | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                      [% IF authority_type.authtypecode %]<li><a href="/cgi-bin/koha/admin/authtypes.pl?op=delete_confirm&amp;authtypecode=[% authority_type.authtypecode | html %]"><i class="fa fa-trash"></i> Delete</a></li>[% END %]
                     </ul>
                   </div>
                 </td>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#authtypes").dataTable($.extend(true, {}, dataTablesDefaults, {
index beeaa66..399e2c9 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -5,11 +6,11 @@
 [% IF op == 'add_form' %]
 &rsaquo; [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
 [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
+&rsaquo; Delete framework for [% framework.frameworktext | html %] ([% framework.frameworkcode | html %])?
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_biblio_framework" class="admin">
@@ -23,7 +24,7 @@
 [% IF op == 'add_form' %]
 &rsaquo; [% IF framework %]Modify framework text[% ELSE %]Add framework[% END %]
 [% ELSIF op == 'delete_confirm' %]
-&rsaquo; Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?
+&rsaquo; Delete framework for [% framework.frameworktext | html %] ([% framework.frameworkcode | html %])?
 [% END %]
 </div>
 
@@ -33,7 +34,7 @@
       <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this framework. Perhaps it already exists.
@@ -50,7 +51,7 @@
         [% CASE 'already_exists' %]
             This framework code already exists.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -72,7 +73,7 @@
                 [% IF framework %]
                     <li>
                         <span class="label">Framework code: </span>
-                        <input type="hidden" id="frameworkcode" name="frameworkcode" value="[% framework.frameworkcode %]" />[% framework.frameworkcode %]
+                        <input type="hidden" id="frameworkcode" name="frameworkcode" value="[% framework.frameworkcode | html %]" />[% framework.frameworkcode | html %]
                         <input type="hidden" name="is_a_modif" value="1" />
                     </li>
                 [% ELSE %]
@@ -84,7 +85,7 @@
                 [% END %]
                 <li>
                     <label for="description" class="required">Description: </label>
-                    <input type="text" name="frameworktext" id="description" size="40" maxlength="80" value="[% framework.frameworktext |html %]" required="required" class="required" />
+                    <input type="text" name="frameworktext" id="description" size="40" maxlength="80" value="[% framework.frameworktext | html %]" required="required" class="required" />
                     <span class="required">Required</span>
                 </li>
             </ol>
     <div class="dialog alert">
         [% IF biblios_use_this_framework %]
             <h3>This framework cannot be deleted</h3>
-            <p><strong><span class="ex">[% framework.frameworktext |html %] ([% framework.frameworkcode %])</span></strong></p>
-            <p>The framework is used [% biblios_use_this_framework %] times.</p>
+            <p><strong><span class="ex">[% framework.frameworktext | html %] ([% framework.frameworkcode | html %])</span></strong></p>
+            <p>The framework is used [% biblios_use_this_framework | html %] times.</p>
             <form action="/cgi-bin/koha/admin/biblio_framework.pl" method="get">
                 <button type="submit"><i class="fa fa-fw fa-arrow-left"></i> Return to frameworks</button>
             </form>
         [% ELSE %]
-            <h3>Delete framework for [% framework.frameworktext |html %] ([% framework.frameworkcode %])?</h3>
+            <h3>Delete framework for [% framework.frameworktext | html %] ([% framework.frameworkcode | html %])?</h3>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="post">
                 <input type="hidden" name="op" value="delete_confirmed" />
-                <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
+                <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this framework</button>
             </form>
             <form class="inline" action="/cgi-bin/koha/admin/biblio_framework.pl" method="get">
         <td>Default framework</td>
         <td>
           <div class="dropdown">
-            <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+            <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode | html %]" role="button" data-toggle="dropdown" href="#">
               Actions <b class="caret"></b>
             </a>
-            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
+            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode | html %]">
               <li><a href="marctagstructure.pl?frameworkcode="><i class="fa fa-eye"></i> MARC structure</a></li>
               <!-- Trigger modal -->
               <li><a href="#" data-toggle="modal" data-target="#exportModal_default" title="Export framework structure (fields, subfields) to a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-upload"></i> Export</a></li>
               <!-- Trigger modal -->
-              <li><a href="#" data-toggle="modal" data-target="#importModal_[% framework.frameworkcode %][% frameworks.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
+              <li><a href="#" data-toggle="modal" data-target="#importModal_[% framework.frameworkcode | html %][% frameworks.count | html %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
             </ul>
             <!-- Modal to export default framework -->
             <div class="modal" id="exportModal_default" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_default" aria-hidden="true">
             </div>
 
             <!-- Modal to import default framework -->
-            <div class="modal" id="importModal_[% framework.frameworkcode %][% frameworks.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count %]" aria-hidden="true">
+            <div class="modal" id="importModal_[% framework.frameworkcode | html %][% frameworks.count | html %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_default[% frameworks.count | html %]" aria-hidden="true">
               <div class="modal-dialog">
               <div class="modal-content">
               <div class="modal-header">
                 <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
-                <h3 id="importLabelexportModal_[% framework.frameworkcode %][% frameworks.count %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h>
+                <h3 id="importLabelexportModal_[% framework.frameworkcode | html %][% frameworks.count | html %]">Import default framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h>
               </div>
               <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_default" id="form_i_default" method="post" enctype="multipart/form-data" class="form_import">
                 <div class="modal-body">
                   <input type="hidden" name="frameworkcode" value="default" />
                   <input type="hidden" name="action" value="import" />
                   <p><label for="file_import_default">Upload file:</label> <input type="file" name="file_import_default" id="file_import_default" class="input_import" /></p>
-                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
+                    <div id="importing_default" style="display:none" class="importing"><img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                 </div>
                 <div class="modal-footer">
                   <button type="submit" class="btn btn-default">Import</button>
 
     [% FOREACH loo IN frameworks %]
         <tr>
-            <td>[% loo.frameworkcode %]</td>
-            <td>[% loo.frameworktext |html %]</td>
+            <td>[% loo.frameworkcode | html %]</td>
+            <td>[% loo.frameworktext | html %]</td>
             <td>
               <div class="dropdown">
-                <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode %]" role="button" data-toggle="dropdown" href="#">
+                <a class="btn btn-default btn-xs dropdown-toggle" id="frameworkactions[% loo.frameworkcode | html %]" role="button" data-toggle="dropdown" href="#">
                   Actions <b class="caret"></b>
                 </a>
-                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode %]">
-                  <li><a href="marctagstructure.pl?frameworkcode=[% loo.frameworkcode %]"><i class="fa fa-eye"></i> MARC structure</a></li>
-                  <li><a href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form&amp;frameworkcode=[% loo.frameworkcode |html %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                  <li><a href="/cgi-bin/koha/admin/biblio_framework.pl?op=delete_confirm&amp;frameworkcode=[% loo.frameworkcode |html %]"><i class="fa fa-trash"></i> Delete</a></li>
+                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="frameworkactions[% loo.frameworkcode | html %]">
+                  <li><a href="marctagstructure.pl?frameworkcode=[% loo.frameworkcode | html %]"><i class="fa fa-eye"></i> MARC structure</a></li>
+                  <li><a href="/cgi-bin/koha/admin/biblio_framework.pl?op=add_form&amp;frameworkcode=[% loo.frameworkcode | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                  <li><a href="/cgi-bin/koha/admin/biblio_framework.pl?op=delete_confirm&amp;frameworkcode=[% loo.frameworkcode | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                   <!-- Trigger modal -->
-                  <li><a href="#" data-toggle="modal" data-target="#exportModal_[% loo.frameworkcode %][% loop.count %]" title="Export framework structure (fields, subfields) to a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-upload"></i> Export</a></li>
+                  <li><a href="#" data-toggle="modal" data-target="#exportModal_[% loo.frameworkcode | html %][% loop.count | html %]" title="Export framework structure (fields, subfields) to a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-upload"></i> Export</a></li>
                   <!-- Trigger modal -->
-                  <li><a href="#" data-toggle="modal" data-target="#importModal_[% loo.frameworkcode %][% loop.count %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
+                  <li><a href="#" data-toggle="modal" data-target="#importModal_[% loo.frameworkcode | html %][% loop.count | html %]" title="Import framework structure (fields, subfields) from a spreadsheet file (.csv, .xml, .ods)"><i class="fa fa-download"></i> Import</a></li>
                 </ul>
                 <!-- Modal to export other framework -->
-                <div class="modal" id="exportModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="exportModal_[% loo.frameworkcode | html %][% loop.count | html %]" tabindex="-1" role="dialog" aria-labelledby="exportLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]" aria-hidden="true">
                   <div class="modal-dialog">
                   <div class="modal-content">
                   <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
-                    <h3 id="exportLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Export [% loo.frameworktext |html %] framework</h3>
+                    <h3 id="exportLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]">Export [% loo.frameworktext | html %] framework</h3>
                   </div>
-                  <form action="import_export_framework.pl" name="form_[% loo.frameworkcode %]" method="get" target="_blank"  class="form_export">
+                  <form action="import_export_framework.pl" name="form_[% loo.frameworkcode | html %]" method="get" target="_blank"  class="form_export">
                     <div class="modal-body">
                       <fieldset>
-                        <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode %]" />
-                        <p><label for="csv_type_export_[% loo.frameworkcode %][% loop.count %]"><input type="radio" name="type_export_[% loo.frameworkcode %]" value="csv" id="csv_type_export_[% loo.frameworkcode %][% loop.count %]" checked="checked" /> Export to CSV spreadsheet</label></p>
-                        <p><label for="xml_type_export_[% loo.frameworkcode %][% loop.count %]"><input type="radio" name="type_export_[% loo.frameworkcode %]" value="excel" id="xml_type_export_[% loo.frameworkcode %][% loop.count %]" /> Export to Excel with XML format, compatible with OpenOffice/LibreOffice as well</label></p>
-                        <p><label for="ods_type_export_[% loo.frameworkcode %][% loop.count %]"><input type="radio" name="type_export_[% loo.frameworkcode %]" value="ods" id="ods_type_export_[% loo.frameworkcode %][% loop.count %]" /> Export to OpenDocument spreadsheet format</label></p>
+                        <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode | html %]" />
+                        <p><label for="csv_type_export_[% loo.frameworkcode | html %][% loop.count | html %]"><input type="radio" name="type_export_[% loo.frameworkcode | html %]" value="csv" id="csv_type_export_[% loo.frameworkcode | html %][% loop.count | html %]" checked="checked" /> Export to CSV spreadsheet</label></p>
+                        <p><label for="xml_type_export_[% loo.frameworkcode | html %][% loop.count | html %]"><input type="radio" name="type_export_[% loo.frameworkcode | html %]" value="excel" id="xml_type_export_[% loo.frameworkcode | html %][% loop.count | html %]" /> Export to Excel with XML format, compatible with OpenOffice/LibreOffice as well</label></p>
+                        <p><label for="ods_type_export_[% loo.frameworkcode | html %][% loop.count | html %]"><input type="radio" name="type_export_[% loo.frameworkcode | html %]" value="ods" id="ods_type_export_[% loo.frameworkcode | html %][% loop.count | html %]" /> Export to OpenDocument spreadsheet format</label></p>
                       </fieldset>
                     </div>
                     <div class="modal-footer">
                 </div>
 
                 <!-- Modal to import other framework -->
-                <div class="modal" id="importModal_[% loo.frameworkcode %][% loop.count %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]" aria-hidden="true">
+                <div class="modal" id="importModal_[% loo.frameworkcode | html %][% loop.count | html %]" tabindex="-1" role="dialog" aria-labelledby="importLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]" aria-hidden="true">
                   <div class="modal-dialog">
                   <div class="modal-content">
                   <div class="modal-header">
                     <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
-                    <h3 id="importLabelexportModal_[% loo.frameworkcode %][% loop.count %]">Import [% loo.frameworkcode %] framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h3>
+                    <h3 id="importLabelexportModal_[% loo.frameworkcode | html %][% loop.count | html %]">Import [% loo.frameworkcode | html %] framework structure (fields and subfields) from a spreadsheet file (.csv, .xml, .ods)</h3>
                   </div>
-                  <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_[% loo.frameworkcode %]" id="form_i_[% loo.frameworkcode %]" method="post" enctype="multipart/form-data" class="form_import">
+                  <form action="/cgi-bin/koha/admin/import_export_framework.pl" name="form_i_[% loo.frameworkcode | html %]" id="form_i_[% loo.frameworkcode | html %]" method="post" enctype="multipart/form-data" class="form_import">
                     <div class="modal-body">
-                      <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode %]" />
+                      <input type="hidden" name="frameworkcode" value="[% loo.frameworkcode | html %]" />
                       <input type="hidden" name="action" value="import" />
-                      <p><label for="file_import_[% loo.frameworkcode %]">Upload file:</label> <input type="file" name="file_import_[% loo.frameworkcode %]" id="file_import_[% loo.frameworkcode %]" class="input_import" /></p>
-                      <div id="importing_[% loo.frameworkcode %]" style="display:none" class="importing"><img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
+                      <p><label for="file_import_[% loo.frameworkcode | html %]">Upload file:</label> <input type="file" name="file_import_[% loo.frameworkcode | html %]" id="file_import_[% loo.frameworkcode | html %]" class="input_import" /></p>
+                      <div id="importing_[% loo.frameworkcode | html %]" style="display:none" class="importing"><img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /><span class="importing_msg"></span></div>
                     </div>
                     <div class="modal-footer">
                       <button type="submit" class="btn btn-default">Import</button>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         /* Set some variable needed in biblio_framework.js */
         var MSG_IMPORT_ERROR = _("Error importing the framework");
         var MSG_SELECT_FILE_FORMAT = _("Please select a CSV (.csv), ODS (.ods) or XML (.xml) spreadsheet file.");
         var MSG_OVERWRITE_WARNING = _("Do you really want to import the framework fields and subfields? This will overwrite the current configuration. For safety reasons please use the export option to make a backup");
         var MSG_IMPORTING_TO_FRAMEWORK = _("Importing to framework: %s. Importing from file: %s.");
-        var template_path = "[% interface %]/[% theme %]";
+        var template_path = "[% interface | html %]/[% theme | html %]";
     </script>
-    [% Asset.js("js/biblio_framework.js") %]
+    [% Asset.js("js/biblio_framework.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 3dd10b8..e0019ab 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Library checkin and transfer policy</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">td { text-align: center; } .sorted { min-width: 50%; }</style>
 </head>
 
@@ -20,7 +21,7 @@
      <div id="yui-main">
     <div class="yui-b">
 
-<h1>Library [% branchcode %] - [% Branches.GetName( branchcode ) %] Checkin and transfer policy</h1>
+<h1>Library [% branchcode | html %] - [% Branches.GetName( branchcode ) | html %] Checkin and transfer policy</h1>
     <form method="get" action="/cgi-bin/koha/admin/branch_transfer_limits.pl" id="selectlibrary">
         <label for="branchselect">Select a library :</label>
         <select name="branchcode" id="branchselect">
 
   <div id="transferlimit_tabs" class="toptabs">
        <ul class="ui-tabs-nav">
-      [% FOREACH codes_loo IN codes_loop %]<li><a href="#[% codes_loo.code %]set">[% codes_loo.code %]</a></li>[% END %]
+      [% FOREACH codes_loo IN codes_loop %]<li><a href="#[% codes_loo.code | html %]set">[% codes_loo.code | html %]</a></li>[% END %]
        </ul>
 
                <form method="post" action="branch_transfer_limits.pl">
 
        [% FOREACH codes_loo IN codes_loop %]
-       <div id="[% codes_loo.code %]set">
-               <h4>Policy for [% codes_loo.limit_phrase %]: [% codes_loo.code %]</h4>
-    <p><a id="CheckAll[% codes_loo.code %]table" class="checkall" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="UncheckAll[% codes_loo.code %]table" class="uncheckall" href="#"><i class="fa fa-remove"></i> Clear all</a></p>
+       <div id="[% codes_loo.code | html %]set">
+               <h4>Policy for [% codes_loo.limit_phrase | html %]: [% codes_loo.code | html %]</h4>
+    <p><a id="CheckAll[% codes_loo.code | html %]table" class="checkall" href="#"><i class="fa fa-check"></i> Select all</a> | <a id="UncheckAll[% codes_loo.code | html %]table" class="uncheckall" href="#"><i class="fa fa-remove"></i> Clear all</a></p>
        
-               <table id="[% codes_loo.code %]table" class="sorted">
+               <table id="[% codes_loo.code | html %]table" class="sorted">
                        <thead>
                                <tr>
                                    <th>Library</th>
                        <tbody>
                                        [% FOREACH to_branch_loo IN codes_loo.to_branch_loop %]
                         <tr>
-                            <td><label style="min-width:400px;" for="[% to_branch_loo.code %][% to_branch_loo.toBranch %]row">[% to_branch_loo.toBranch %] - [% Branches.GetName( to_branch_loo.toBranch ) %]</label></td>
+                            <td><label style="min-width:400px;" for="[% to_branch_loo.code | html %][% to_branch_loo.toBranch | html %]row">[% to_branch_loo.toBranch | html %] - [% Branches.GetName( to_branch_loo.toBranch ) | html %]</label></td>
                                                        <td>
                                                        [% IF ( to_branch_loo.isChecked ) %]
-                                                               <input type="checkbox" id="[% to_branch_loo.code %][% to_branch_loo.toBranch %]row" name="[% to_branch_loo.code %]_[% to_branch_loo.toBranch %]" checked="checked" />
+                                                               <input type="checkbox" id="[% to_branch_loo.code | html %][% to_branch_loo.toBranch | html %]row" name="[% to_branch_loo.code | html %]_[% to_branch_loo.toBranch | html %]" checked="checked" />
                                                        [% ELSE %]
-                                                               <input type="checkbox" id="[% to_branch_loo.code %][% to_branch_loo.toBranch %]row" name="[% to_branch_loo.code %]_[% to_branch_loo.toBranch %]" />
+                                                               <input type="checkbox" id="[% to_branch_loo.code | html %][% to_branch_loo.toBranch | html %]row" name="[% to_branch_loo.code | html %]_[% to_branch_loo.toBranch | html %]" />
                                                        [% END %]
                                                        </td>
                                                </tr>
@@ -72,7 +73,7 @@
                
                <fieldset class="action">
                    <input type="hidden" name="updateLimits" value="1" />
-                   <input type="hidden" name="branchcode" value="[% branchcode %]" />
+                   <input type="hidden" name="branchcode" value="[% branchcode | html %]" />
                    <input type="submit" value="Save" /> 
                    <a class="cancel" href="/cgi-bin/koha/admin/admin-home.pl">Cancel</a>
                </fieldset>
@@ -86,9 +87,9 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
             $("#CheckAll").click(function(){ $("#transferlimit_tabs").checkCheckboxes(); return false; });
index cbb0730..5ad1a50 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -9,7 +10,7 @@
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_branches" class="admin">
@@ -34,7 +35,7 @@
     <div class="yui-b">
 
 [% FOREACH m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this library. Perhaps it already exists.
         [% CASE 'cannot_delete_library' %]
             This library cannot be deleted. Patrons or items are still using it
             [% IF m.data.patrons_count and m.data.items_count %]
-                ([% m.data.patrons_count %] patrons and [% m.data.items_count %] items).
+                ([% m.data.patrons_count | html %] patrons and [% m.data.items_count | html %] items).
             [% ELSIF m.data.patrons_count %]
-                ([% m.data.patrons_count %] patrons).
+                ([% m.data.patrons_count | html %] patrons).
             [% ELSIF m.data.items_count %]
-                ([% m.data.items_count %] items).
+                ([% m.data.items_count | html %] items).
             [% END %]
         [% CASE 'error_on_update_category' %]
             An error occurred when updating this library category. Perhaps it already exists.
@@ -70,9 +71,9 @@
         [% CASE 'success_on_delete_category' %]
             Library category deleted successfully.
         [% CASE 'cannot_delete_category' %]
-            This library category cannot be deleted. [% m.data.libraries_count %] libraries are still using it.
+            This library category cannot be deleted. [% m.data.libraries_count | html %] libraries are still using it.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
                 <li>
                     [% IF library %]
                         <span class="label">Library code: </span>
-                        <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
+                        <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
                         [% library.branchcode | html %]
                     [% ELSE %]
                         <label for="branchcode" class="required">Library code: </label>
-                        <input type="text" name="branchcode" id="branchcode" size="10" maxlength="10" value="[% library.branchcode |html %]" class="required" required="required" />
+                        <input type="text" name="branchcode" id="branchcode" size="10" maxlength="10" value="[% library.branchcode | html %]" class="required" required="required" />
                         <span class="required">Required</span>
                     [% END %]
                 </li>
                 <li>
                     <label for="branchname" class="required">Name: </label>
-                    <input type="text" name="branchname" id="branchname" size="80" value="[% library.branchname |html %]" class="required" required="required" />
+                    <input type="text" name="branchname" id="branchname" size="80" value="[% library.branchname | html %]" class="required" required="required" />
                     <span class="required">Required</span>
                 </li>
             </ol>
                 <ol>
                     [% FOREACH category IN categories %]
                         <li>
-                            <label for="[% category.categorycode %]">[% category.categoryname |html %]: </label>
+                            <label for="[% category.categorycode | html %]">[% category.categoryname | html %]: </label>
                             [% IF category and selected_categorycodes.grep(category.categorycode).size %]
-                                <input type="checkbox" id="[% category.categorycode %]" name="selected_categorycode_[% category.categorycode %]" checked="checked" />
+                                <input type="checkbox" id="[% category.categorycode | html %]" name="selected_categorycode_[% category.categorycode | html %]" checked="checked" />
                             [% ELSE %]
-                                <input type="checkbox" id="[% category.categorycode %]" name="selected_categorycode_[% category.categorycode %]" />
+                                <input type="checkbox" id="[% category.categorycode | html %]" name="selected_categorycode_[% category.categorycode | html %]" />
                             [% END %]
-                            <span class="hint">[% category.codedescription |html %]</span>
+                            <span class="hint">[% category.codedescription | html %]</span>
                         </li>
                     [% END %]
                 </ol>
         [% END %]
         <fieldset class="rows">
             <ol>
-                <li><label for="branchaddress1">Address line 1: </label><input type="text" name="branchaddress1" id="branchaddress1" size="60" value="[% library.branchaddress1 |html %]" /></li>
-                <li><label for="branchaddress2">Address line 2: </label><input type="text" name="branchaddress2" id="branchaddress2" size="60" value="[% library.branchaddress2 |html %]" /></li>
-                <li><label for="branchaddress3">Address line 3: </label><input type="text" name="branchaddress3" id="branchaddress3" size="60" value="[% library.branchaddress3 |html %]" /></li>
-                <li><label for="branchcity">City: </label><input type="text" name="branchcity" id="branchcity" size="60" value="[% library.branchcity |html %]" /></li>
-                <li><label for="branchstate">State: </label><input type="text" name="branchstate" id="branchstate" size="60" value="[% library.branchstate |html %]" /></li>
-                <li><label for="branchzip">ZIP/Postal code: </label><input type="text" name="branchzip" id="branchzip"  size="25" maxlength="25" value="[% library.branchzip |html %]" /></li>
-                <li><label for="branchcountry">Country: </label><input type="text" name="branchcountry" id="branchcountry" size="60" value="[% library.branchcountry |html %]" /></li>
-                <li><label for="branchphone">Phone: </label><input type="text" name="branchphone" id="branchphone" size="60" value="[% library.branchphone |html %]" /></li>
-                <li><label for="branchfax">Fax: </label><input type="text" name="branchfax" id="branchfax" size="60" value="[% library.branchfax |html %]" /></li>
-                <li><label for="branchemail">Email: </label><input type="text" name="branchemail" id="branchemail" class="email"  size="80" value="[% library.branchemail |html %]" /></li>
-                <li><label for="branchreplyto">Reply-To: </label> <input type="text" name="branchreplyto" id="branchreplyto" class="email"  size="80" value="[% library.branchreplyto |html %]" /><br /><span class="hint">Default: ReplyToDefault system preference</span></li>
-                <li><label for="branchreturnpath">Return-Path: </label> <input type="text" name="branchreturnpath" id="branchreturnpath" class="email"  size="80" value="[% library.branchreturnpath |html %]" /><br /><span class="hint">Default: ReturnpathDefault system preference</span></li>
-                <li><label for="branchurl">URL: </label><input type="text" name="branchurl" id="branchurl"  size="80" value="[% library.branchurl |html %]" class="url" /></li>
-                <li><label for="opac_info">OPAC info: </label><textarea name="opac_info" id="opac_info">[% library.opac_info |html %]</textarea></li>
-                <li><label for="branchip">IP: </label><input type="text" name="branchip" id="branchip"  size="15" maxlength="15" value="[% library.branchip |html %]" /> <span class="hint">Can be entered as a single IP, or a subnet such as 192.168.1.*</span></li>
-                <li><label for="marcorgccode">MARC organization code</label> <input type="text" name="marcorgcode" id="marcorgcode" size="16" value="[% library.marcorgcode |html %]" /> <span class="hint">If not filled in defaults to system preference MARCOrgCode. You can obtain your code from <a href="http://www.loc.gov/marc/organizations/orgshome.html" target="_blank">Library of Congress</a>.</span>
-                <li><label for="branchnotes">Notes: </label><input type="text" name="branchnotes" id="branchnotes" size="80" value="[% library.branchnotes |html %]" /></li>
+                <li><label for="branchaddress1">Address line 1: </label><input type="text" name="branchaddress1" id="branchaddress1" size="60" value="[% library.branchaddress1 | html %]" /></li>
+                <li><label for="branchaddress2">Address line 2: </label><input type="text" name="branchaddress2" id="branchaddress2" size="60" value="[% library.branchaddress2 | html %]" /></li>
+                <li><label for="branchaddress3">Address line 3: </label><input type="text" name="branchaddress3" id="branchaddress3" size="60" value="[% library.branchaddress3 | html %]" /></li>
+                <li><label for="branchcity">City: </label><input type="text" name="branchcity" id="branchcity" size="60" value="[% library.branchcity | html %]" /></li>
+                <li><label for="branchstate">State: </label><input type="text" name="branchstate" id="branchstate" size="60" value="[% library.branchstate | html %]" /></li>
+                <li><label for="branchzip">ZIP/Postal code: </label><input type="text" name="branchzip" id="branchzip"  size="25" maxlength="25" value="[% library.branchzip | html %]" /></li>
+                <li><label for="branchcountry">Country: </label><input type="text" name="branchcountry" id="branchcountry" size="60" value="[% library.branchcountry | html %]" /></li>
+                <li><label for="branchphone">Phone: </label><input type="text" name="branchphone" id="branchphone" size="60" value="[% library.branchphone | html %]" /></li>
+                <li><label for="branchfax">Fax: </label><input type="text" name="branchfax" id="branchfax" size="60" value="[% library.branchfax | html %]" /></li>
+                <li><label for="branchemail">Email: </label><input type="text" name="branchemail" id="branchemail" class="email"  size="80" value="[% library.branchemail | html %]" /></li>
+                <li><label for="branchreplyto">Reply-To: </label> <input type="text" name="branchreplyto" id="branchreplyto" class="email"  size="80" value="[% library.branchreplyto | html %]" /><br /><span class="hint">Default: ReplyToDefault system preference</span></li>
+                <li><label for="branchreturnpath">Return-Path: </label> <input type="text" name="branchreturnpath" id="branchreturnpath" class="email"  size="80" value="[% library.branchreturnpath | html %]" /><br /><span class="hint">Default: ReturnpathDefault system preference</span></li>
+                <li><label for="branchurl">URL: </label><input type="text" name="branchurl" id="branchurl"  size="80" value="[% library.branchurl | html %]" class="url" /></li>
+                <li><label for="opac_info">OPAC info: </label><textarea name="opac_info" id="opac_info">[% library.opac_info | $raw %]</textarea></li>
+                <li><label for="branchip">IP: </label><input type="text" name="branchip" id="branchip"  size="15" maxlength="15" value="[% library.branchip | html %]" /> <span class="hint">Can be entered as a single IP, or a subnet such as 192.168.1.*</span></li>
+                <li><label for="marcorgccode">MARC organization code</label> <input type="text" name="marcorgcode" id="marcorgcode" size="16" value="[% library.marcorgcode | html %]" /> <span class="hint">If not filled in defaults to system preference MARCOrgCode. You can obtain your code from <a href="http://www.loc.gov/marc/organizations/orgshome.html" target="_blank">Library of Congress</a>.</span>
+                <li><label for="branchnotes">Notes: </label><input type="text" name="branchnotes" id="branchnotes" size="80" value="[% library.branchnotes | html %]" /></li>
             </ol>
         </fieldset>
         <fieldset class="action">
 [% IF op == 'delete_confirm' and not ( items_count or patrons_count )%]
     <div class="dialog alert">
         <form action="/cgi-bin/koha/admin/branches.pl" method="post">
-            <h3>Are you sure you want to delete [% library.branchname |html %] ([% library.branchcode | html %])?</h3>
+            <h3>Are you sure you want to delete [% library.branchname | html %] ([% library.branchcode | html %])?</h3>
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
-            <input type="hidden" name="branchname" value="[% library.branchname |html %]">
+            <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
+            <input type="hidden" name="branchname" value="[% library.branchname | html %]">
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
         </form>
         <form action="/cgi-bin/koha/admin/branches.pl" method="get">
             <tbody>
                 [% FOREACH library IN libraries %]
                     <tr>
-                        <td>[% library.branchname |html %]</td>
-                        <td>[% library.branchcode |html %]</td>
+                        <td>[% library.branchname | html %]</td>
+                        <td>[% library.branchcode | html %]</td>
                         <td>
                             [% IF library.branchaddress1 %]
-                                [% library.branchaddress1 |html %][% END %]
+                                [% library.branchaddress1 | html %][% END %]
                             [% IF library.branchaddress2 %]
-                                <br />[% library.branchaddress2 |html %][% END %]
+                                <br />[% library.branchaddress2 | html %][% END %]
                             [% IF library.branchaddress3 %]
-                                <br />[% library.branchaddress3 |html %][% END %]
+                                <br />[% library.branchaddress3 | html %][% END %]
                             [% IF library.branchcity %]
-                                <br />[% library.branchcity |html %][% END %][% IF ( library.branchstate ) %],
-                                [% library.branchstate |html %][% END %]
+                                <br />[% library.branchcity | html %][% END %][% IF ( library.branchstate ) %],
+                                [% library.branchstate | html %][% END %]
                             [% IF library.branchzip %]
-                                [% library.branchzip |html %][% END %]
+                                [% library.branchzip | html %][% END %]
                             [% IF library.branchcountry %]
-                                <br />[% library.branchcountry |html %][% END %]
+                                <br />[% library.branchcountry | html %][% END %]
                             [% IF library.branchphone %]
-                                <br />Ph: [% library.branchphone |html %][% END %]
+                                <br />Ph: [% library.branchphone | html %][% END %]
                             [% IF library.branchfax %]
-                                <br />Fax: [% library.branchfax |html %][% END %]
+                                <br />Fax: [% library.branchfax | html %][% END %]
                             [% IF library.branchemail %]
-                                <br /><a href="mailto:[% library.branchemail %]">[% library.branchemail |html %]</a>[% END %]
+                                <br /><a href="mailto:[% library.branchemail | html %]">[% library.branchemail | html %]</a>[% END %]
                             [% IF library.branchurl %]
-                                <br /><a href="[% library.branchurl %]">[% library.branchurl |html %]</a>[% END %]
+                                <br /><a href="[% library.branchurl | html %]">[% library.branchurl | html %]</a>[% END %]
                             [% IF library.opac_info %]
-                                <br />OPAC Info: <div>[% library.opac_info %]</div>[% END %]
+                                <br />OPAC Info: <div>[% library.opac_info | $raw %]</div>[% END %]
                             [% IF library.branchnotes %]
-                                <br />Notes: [% library.branchnotes |html %][% END %]
+                                <br />Notes: [% library.branchnotes | html %][% END %]
                         </td>
-                        <td>[% library.marcorgcode %]</td>
-                        <td>[% library.branchip %]</td>
+                        <td>[% library.marcorgcode | html %]</td>
+                        <td>[% library.branchip | html %]</td>
                         <td class="actions">
                             <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/branches.pl?op=add_form&amp;branchcode=[% library.branchcode |uri %]"><i class="fa fa-pencil"></i> Edit</a>
                             <form action="/cgi-bin/koha/admin/branches.pl" method="post">
-                                <input type="hidden" name="branchcode" value="[% library.branchcode |html %]" />
+                                <input type="hidden" name="branchcode" value="[% library.branchcode | html %]" />
                                 <input type="hidden" name="op" value="delete_confirm" />
                                 <button type="submit" id="delete_library_[% library.branchcode | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button>
                             </form>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/tiny_mce/tiny_mce.js") %]
+    [% Asset.js("lib/tiny_mce/tiny_mce.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#branchest").dataTable($.extend(true, {}, dataTablesDefaults, {
                 });
             [% END %]
         });
-        tinyMCE.baseURL = "[% interface %]/lib/tiny_mce";
+        tinyMCE.baseURL = "[% interface | html %]/lib/tiny_mce";
         tinyMCE.init({
             mode : "textareas",
             theme : "advanced",
-            content_css : "[% interface %]/[% theme %]/css/tinymce.css",
+            content_css : "[% interface | html %]/[% theme | html %]/css/tinymce.css",
             plugins : "table,save,advhr,advlink,contextmenu",
             theme_advanced_buttons1 : "save,|,bold,italic,|,cut,copy,paste,|,justifyleft,justifycenter,justifyright,justifyfull,|,formatselect,|,link,unlink,anchor,cleanup,help,code,advhr,",
             theme_advanced_buttons2 : "tablecontrols,|,bullist,numlist,|,outdent,indent,|,undo,redo,|,removeformat,|,visualaid,|,sub,sup,|,charmap",
index c71e6fb..6c4aa54 100644 (file)
@@ -1,14 +1,15 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Administration &rsaquo; Patron categories &rsaquo; [% IF op == 'add_form' %][% IF ( categorycode ) %]Modify category '[% categorycode |html %]'[% ELSE %]New category[% END %][% END %]
-[% IF op == 'delete_confirm' %][% IF ( patrons_in_category > 0 ) %]Cannot delete: category [% categorycode |html %] in use[% ELSE %]Confirm deletion of category '[% categorycode |html %]'[% END %][% END %]
+<title>Koha &rsaquo; Administration &rsaquo; Patron categories &rsaquo; [% IF op == 'add_form' %][% IF ( categorycode ) %]Modify category '[% categorycode | html %]'[% ELSE %]New category[% END %][% END %]
+[% IF op == 'delete_confirm' %][% IF ( patrons_in_category > 0 ) %]Cannot delete: category [% categorycode | html %] in use[% ELSE %]Confirm deletion of category '[% categorycode | html %]'[% END %][% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">#enrolmentmessage.hint { display : none; }</style>
 </head>
 
@@ -16,8 +17,8 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patrons-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF op == 'add_form' %] <a href="/cgi-bin/koha/admin/categories.pl">Patron categories</a> &rsaquo; [% IF ( categorycode ) %]Modify category '[% categorycode |html %]'[% ELSE %]New category[% END %][% END %]
-[% IF op == 'delete_confirm' %] <a href="/cgi-bin/koha/admin/categories.pl">Patron categories</a> &rsaquo; [% IF ( patrons_in_category > 0 ) %]Cannot delete: Category [% categorycode |html %] in use[% ELSE %]Confirm deletion of category '[% categorycode |html %]'[% END %][% END %]
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF op == 'add_form' %] <a href="/cgi-bin/koha/admin/categories.pl">Patron categories</a> &rsaquo; [% IF ( categorycode ) %]Modify category '[% categorycode | html %]'[% ELSE %]New category[% END %][% END %]
+[% IF op == 'delete_confirm' %] <a href="/cgi-bin/koha/admin/categories.pl">Patron categories</a> &rsaquo; [% IF ( patrons_in_category > 0 ) %]Cannot delete: Category [% categorycode | html %] in use[% ELSE %]Confirm deletion of category '[% categorycode | html %]'[% END %][% END %]
 [% IF op == 'delete_confirmed' %] <a href="/cgi-bin/koha/admin/categories.pl">Patron categories</a> &rsaquo; Category deleted[% END %]
 [% IF op == 'list' %]Patron categories[% END %]</div>
 
@@ -27,7 +28,7 @@
     <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this patron category. Perhaps it already exists.
@@ -44,7 +45,7 @@
         [% CASE 'already_exists' %]
             This patron category already exists.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -54,7 +55,7 @@
         <input type="hidden" name="op" value="add_validate" />
         <input type="hidden" name="checked" value="0" />
         [% IF category %]
-            <h1>Modify category [% categorycode |html %]</h1>
+            <h1>Modify category [% categorycode | html %]</h1>
         [% ELSE %]
             <h1>New category</h1>
         [% END %]
@@ -62,8 +63,8 @@
             <ol>
                 [% IF category %]
                     <li>
-                        <span class="label">Category code: </span>[% categorycode |html %]
-                        <input type="hidden" name="categorycode" value="[% category.categorycode |html %]" /><input type="hidden" name="is_a_modif" value="1" />
+                        <span class="label">Category code: </span>[% categorycode | html %]
+                        <input type="hidden" name="categorycode" value="[% category.categorycode | html %]" /><input type="hidden" name="is_a_modif" value="1" />
                     </li>
                 [% ELSE %]
                     <li>
@@ -74,7 +75,7 @@
                 [% END %]
                 <li>
                     <label for="description" class="required">Description: </label>
-                    <input type="text" name="description" id="description" size="40" maxlength="80" class="required" required="required" value="[% category.description |html %]" />
+                    <input type="text" name="description" id="description" size="40" maxlength="80" class="required" required="required" value="[% category.description | html %]" />
                     <span class="required">Required</span>
                 </li>
                 <li>
@@ -85,7 +86,7 @@
                             <li>
                                 <label for="enrolmentperiod" style="width:6em;">In months: </label>
                                 [% IF category.enrolmentperiod %]
-                                    <input type="text" class="enrollmentperiod" name="enrolmentperiod" id="enrolmentperiod" size="3" maxlength="3" value="[% category.enrolmentperiod %]" /> months
+                                    <input type="text" class="enrollmentperiod" name="enrolmentperiod" id="enrolmentperiod" size="3" maxlength="3" value="[% category.enrolmentperiod | html %]" /> months
                                [% ELSE %]
                                     <input type="text" class="enrollmentperiod" name="enrolmentperiod" id="enrolmentperiod" size="3" maxlength="3" value="" /> months
                                [% END %]
                 </li>
                 <li>
                     <label for="dateofbirthrequired">Age required: </label>
-                    <input type="text" name="dateofbirthrequired" id="dateofbirthrequired" value="[% category.dateofbirthrequired %]" size="3" maxlength="3" /> years
+                    <input type="text" name="dateofbirthrequired" id="dateofbirthrequired" value="[% category.dateofbirthrequired | html %]" size="3" maxlength="3" /> years
                 </li>
                 <li>
                     <label for="upperagelimit">Upperage limit: </label>
-                    <input type="text" name="upperagelimit" id="upperagelimit" size="3" maxlength="3" value="[% category.upperagelimit %]" /> years
+                    <input type="text" name="upperagelimit" id="upperagelimit" size="3" maxlength="3" value="[% category.upperagelimit | html %]" /> years
                 </li>
                 <li>
                     <label for="enrolmentfee">Enrollment fee: </label>
-                    <input type="text" name="enrolmentfee" id="enrolmentfee" size="6" value="[% category.enrolmentfee | $Price on_editing => 1 %]" />
+                    <input type="text" name="enrolmentfee" id="enrolmentfee" size="6" value="[% category.enrolmentfee | $Price on_editing => 1 | html %]" />
                 </li>
                 <li>
                     <label for="overduenoticerequired">Overdue notice required: </label>
                 </li>
                 <li>
                     <label for="reservefee">Hold fee: </label>
-                    <input type="text" name="reservefee" id="reservefee" size="6" value="[% category.reservefee | $Price on_editing => 1 %]" />
+                    <input type="text" name="reservefee" id="reservefee" size="6" value="[% category.reservefee | $Price on_editing => 1 | html %]" />
                 </li>
                 <li>
                     <label for="category_type" class="required">Category type: </label>
                         <option value="">All branches</option>
                         [% FOREACH branch IN branches_loop %]
                           [% IF branch.selected %]
-                            <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                            <option selected="selected" value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                           [% ELSE %]
-                            <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                            <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                           [% END %]
                         [% END %]
                     </select>
         <fieldset>
             <legend>
                 [% IF patrons_in_category > 0 %]
-                    Category [% categorycode |html %] is in use.  Deletion not possible!
+                    Category [% categorycode | html %] is in use.  Deletion not possible!
                 [% ELSE %]
-                    Confirm deletion of category [% categorycode |html %]
+                    Confirm deletion of category [% categorycode | html %]
                 [% END %]
             </legend>
 
             [% IF patrons_in_category > 0  %]
                 <div class="dialog alert">
-                    <strong>This category is used [% patrons_in_category %] times</strong>. Deletion not possible
+                    <strong>This category is used [% patrons_in_category | html %] times</strong>. Deletion not possible
                 </div>
             [% END %]
             <table>
-                <tr><th scope="row">Category code: </th><td>[% category.categorycode |html %]</td></tr>
-                <tr><th scope="row">Description: </th><td>[% category.description |html %]</td></tr>
+                <tr><th scope="row">Category code: </th><td>[% category.categorycode | html %]</td></tr>
+                <tr><th scope="row">Description: </th><td>[% category.description | html %]</td></tr>
                 <tr><th scope="row">Enrollment period: </th>
                     <td>
                         [% IF category.enrolmentperiod %]
-                            [% category.enrolmentperiod %] months
+                            [% category.enrolmentperiod | html %] months
                         [% ELSE %]
                             until [% category.enrolmentperioddate | $KohaDates %]
                         [% END %]
                     </td>
                 </tr>
-                <tr><th scope="row">Age required: </th><td>[% category.dateofbirthrequired %] years</td></tr>
-                <tr><th scope="row">Upperage limit: </th><td>[% category.upperagelimit %] years</td></tr>
-                <tr><th scope="row">Enrollment fee: </th><td>[% category.enrolmentfee | $Price %]</td></tr>
+                <tr><th scope="row">Age required: </th><td>[% category.dateofbirthrequired | html %] years</td></tr>
+                <tr><th scope="row">Upperage limit: </th><td>[% category.upperagelimit | html %] years</td></tr>
+                <tr><th scope="row">Enrollment fee: </th><td>[% category.enrolmentfee | $Price | html %]</td></tr>
                 <tr><th scope="row">Receives overdue notices: </th><td>[% IF category. overduenoticerequired %]Yes[% ELSE %]No[% END %]</td></tr>
                 <tr><th scope="row">Lost items in staff client</th><td>[% IF category.hidelostitems %]Hidden by default[% ELSE %]Shown[% END %]</td></tr>
-                <tr><th scope="row">Hold fee: </th><td>[% category.reservefee | $Price %]</td></tr>
+                <tr><th scope="row">Hold fee: </th><td>[% category.reservefee | $Price | html %]</td></tr>
 
                 [% IF ( Koha.Preference('CheckPrevCheckout') == 'softyes' || Koha.Preference('CheckPrevCheckout') == 'softno' ) %]
                   <tr>
                     <input type="submit" value="OK" />
                 [% ELSE %]
                     <input type="hidden" name="op" value="delete_confirmed" />
-                    <input type="hidden" name="categorycode" value="[% categorycode |html %]" />
+                    <input type="hidden" name="categorycode" value="[% categorycode | html %]" />
                     <input type="submit" value="Delete this category" />
                     <a class="cancel" href="/cgi-bin/koha/admin/categories.pl">Cancel</a>
                 [% END %]
 
     <h2>Patron categories</h2>
     [% IF searchfield %]
-        You Searched for [% searchfield |html %]</span>
+        You Searched for [% searchfield | html %]</span>
     [% END %]
     [% IF categories%]
         <table id="table_categorie">
             <tbody>
                 [% FOREACH category IN categories %]
                     <tr>
-                        <td>[% category.categorycode |html %]</td>
+                        <td>[% category.categorycode | html %]</td>
                         <td>
-                            <a href="/cgi-bin/koha/admin/categories.pl?op=add_form&amp;categorycode=[% category.categorycode |uri %]">[% category.description |html %]</a>
+                            <a href="/cgi-bin/koha/admin/categories.pl?op=add_form&amp;categorycode=[% category.categorycode |uri %]">[% category.description | html %]</a>
                         </td>
                         <td>
                             [% SWITCH category.category_type %]
                         </td>
                         <td>
                             [% IF ( category.enrolmentperiod ) %]
-                                [% category.enrolmentperiod %] months
+                                [% category.enrolmentperiod | html %] months
                             [% ELSE %]
                                 until [% category.enrolmentperioddate | $KohaDates %]
                             [% END %]
                         </td>
                         [% IF (category.dateofbirthrequired) %]
-                            <td>[% category.dateofbirthrequired %] years</td>
+                            <td>[% category.dateofbirthrequired | html %] years</td>
                         [% ELSE %]
                             <td>-</td>
                         [% END %]
                         [% IF (category.upperagelimit) %]
-                            <td>[% category.upperagelimit %] years</td>
+                            <td>[% category.upperagelimit | html %] years</td>
                         [% ELSE %]
                             <td>-</td>
                         [% END %]
                         [% IF (category.enrolmentfee > 0) %]
-                            <td>[% category.enrolmentfee | $Price %]</td>
+                            <td>[% category.enrolmentfee | $Price | html %]</td>
                         [% ELSE %]
                             <td>-</td>
                         [% END %]
                         <td>[% IF ( category.overduenoticerequired ) %]Yes[% ELSE %]No[% END %]</td>
                         <td>[% IF ( category.hidelostitems ) %]Hidden[% ELSE %]Shown[% END %]</td>
                         [% IF (category.reservefee > 0) %]
-                            <td>[% category.reservefee | $Price %]</td>
+                            <td>[% category.reservefee | $Price | html %]</td>
                         [% ELSE %]
                             <td>-</td>
                         [% END %]
                                                 [% ELSIF ( prefs.Item_Checkout ) %]Item checkout
                                                 [% ELSE %]Unknown
                                                 [% END %]:
-                                                <strong>[% transport.transport %]</strong><br />
+                                                <strong>[% transport.transport | html %]</strong><br />
                                             [% ELSE %]None<br />[% END %]
                                         [% END %]
                                     [% END %]
                         <td>
                             [% SET branch_limitations = category.branch_limitations %]
                             [% IF branch_limitations.size > 0 %]
-                                [% branches_str = "" %]
+                                [% branches_str = "" | html %]
                                 [% FOREACH branch IN branch_limitations %]
-                                    [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" %]
+                                    [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" | html %]
                                 [% END %]
-                                <span title="[% branches_str %]">
+                                <span title="[% branches_str | html %]">
                                     [% IF branch_limitations.size > 1 %]
-                                        [% branch_limitations.size %] branches limitations
+                                        [% branch_limitations.size | html %] branches limitations
                                     [% ELSE %]
-                                        [% branch_limitations.size %] branch limitation
+                                        [% branch_limitations.size | html %] branch limitation
                                     [% END %]
                                 </span>
                             [% ELSE %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
-    [% Asset.js("js/messaging-preference-form.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
+    [% Asset.js("js/messaging-preference-form.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         var MSG_CATEGORYCODE_CHARS = _("Category code can only contain the following characters: letters, numbers, - and _.");
         var MSG_ONE_ENROLLMENTPERIOD = ("Please choose an enrollment period in months OR by date.");
     </script>
-    [% Asset.js("js/categories.js") %]
+    [% Asset.js("js/categories.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index db49419..6b95db3 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; MARC check
-[% IF ( total ) %] :[% total %] errors found[% ELSE %] : Configuration OK![% END %]</title>
+[% IF ( total ) %] :[% total | html %] errors found[% ELSE %] : Configuration OK![% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="admin_checkmarc" class="admin">
@@ -10,7 +11,7 @@
 [% INCLUDE 'prefs-admin-search.inc' %]
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; MARC check
-[% IF ( total ) %]: [% total %] errors found[% ELSE %] : Configuration OK![% END %]</div>
+[% IF ( total ) %]: [% total | html %] errors found[% ELSE %] : Configuration OK![% END %]</div>
 
 <div id="doc3" class="yui-t2">
    
@@ -55,7 +56,7 @@
     [% IF ( itemtags ) %]
         <tr>
             <td>Item tag</td>
-            <td>There is more than 1 MARC tag related to items tab (10) : [% itemtags %]</td>
+            <td>There is more than 1 MARC tag related to items tab (10) : [% itemtags | html %]</td>
         </tr>
     [% ELSE %]
         <tr>
                     </tr>
                     [% FOREACH tab_inf IN tab_info %]
                         <tr>
-                            <td>[% tab_inf.frameworkcode %]</td>
+                            <td>[% tab_inf.frameworkcode | html %]</td>
                             [% IF ( tab_inf.frameworkcode ) %]
-                                <td>[% tab_inf.frameworktext %]</td>
+                                <td>[% tab_inf.frameworktext | html %]</td>
                             [% ELSE %]
                                 <td>Default framework</td>
                             [% END %]
-                            <td>[% tab_inf.tagfield %]</td>
-                            <td>[% tab_inf.tabs %]</td>
+                            <td>[% tab_inf.tagfield | html %]</td>
+                            <td>[% tab_inf.tabs | html %]</td>
                         </tr>
                     [% END %]
                 </table>
                     </tr>
                     [% FOREACH authtypecode_inf IN authtypecode_info %]
                         <tr>
-                            <td>[% authtypecode_inf.frameworkcode %]</td>
+                            <td>[% authtypecode_inf.frameworkcode | html %]</td>
                             [% IF ( authtypecode_inf.frameworkcode ) %]
-                                <td>[% authtypecode_inf.frameworktext %]</td>
+                                <td>[% authtypecode_inf.frameworktext | html %]</td>
                             [% ELSE %]
                                 <td>Default framework</td>
                             [% END %]
-                            <td>[% authtypecode_inf.tagfield %]</td>
-                            <td>[% authtypecode_inf.tagsubfield %]</td>
-                            <td>[% authtypecode_inf.authtypecode %]</td>
+                            <td>[% authtypecode_inf.tagfield | html %]</td>
+                            <td>[% authtypecode_inf.tagsubfield | html %]</td>
+                            <td>[% authtypecode_inf.authtypecode | html %]</td>
                         </tr>
                     [% END %]
                 </table>
                     </tr>
                     [% FOREACH mapped_perm_loc IN mapped_permanent_location %]
                         <tr>
-                            <td>[% mapped_perm_loc.frameworkcode %]</td>
+                            <td>[% mapped_perm_loc.frameworkcode | html %]</td>
                             [% IF ( mapped_perm_loc.frameworkcode ) %]
-                                <td>[% mapped_perm_loc.frameworktext %]</td>
+                                <td>[% mapped_perm_loc.frameworktext | html %]</td>
                             [% ELSE %]
                                 <td>Default framework</td>
                             [% END %]
-                            <td>[% mapped_perm_loc.tagfield %]</td>
-                            <td>[% mapped_perm_loc.tagsubfield %]</td>
+                            <td>[% mapped_perm_loc.tagfield | html %]</td>
+                            <td>[% mapped_perm_loc.tagsubfield | html %]</td>
                         </tr>
                     [% END %]
                 </table>
 [% IF ( total ) %]
     <tr>
         <td>TOTAL</td>
-        <td>You have [% total %] error(s) in your MARC configuration. Please fix them before using Koha</td>
+        <td>You have [% total | html %] error(s) in your MARC configuration. Please fix them before using Koha</td>
     </tr>
 </table>
 [% ELSE %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index f7daa3c..f41a6cd 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; [% IF op =='add_form' %]Cities &rsaquo; [% IF city.cityid %] Modify city[% ELSE %] New city[% END %][% ELSE %][% IF op == 'delete_confirm' %]Cities &rsaquo; Confirm deletion of city[% ELSE %] Cities[% END %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_cities" class="admin">
@@ -28,7 +29,7 @@
     <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this city. Perhaps it already exists.
@@ -45,7 +46,7 @@
         [% CASE 'already_exists' %]
             This city already exists.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
 
     <form action="/cgi-bin/koha/admin/cities.pl" name="Aform" method="post" class="validated">
         <input type="hidden" name="op" value="add_validate" />
-        <input type="hidden" name="cityid" value="[% city.cityid %]" />
+        <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
 
         <fieldset class="rows">
             <ol>
                 [% IF city %]
-                    <li><span class="label">City ID: </span>[% city.cityid %]</li>
+                    <li><span class="label">City ID: </span>[% city.cityid | html %]</li>
                 [% END %]
                 <li>
                     <label for="city_name" class="required">City: </label>
-                    <input type="text" name="city_name" id="city_name" size="80" maxlength="100" value="[% city.city_name |html %]" required="required" class="required" /> <span class="required">Required</span>
+                    <input type="text" name="city_name" id="city_name" size="80" maxlength="100" value="[% city.city_name | html %]" required="required" class="required" /> <span class="required">Required</span>
                 </li>
                 <li>
                     <label for="city_state">State: </label>
-                    <input type="text" name="city_state" id="city_state" size="80" maxlength="100" value="[% city.city_state |html %]" />
+                    <input type="text" name="city_state" id="city_state" size="80" maxlength="100" value="[% city.city_state | html %]" />
                 </li>
                 <li>
                     <label for="city_zipcode" class="required">ZIP/Postal code: </label>
-                    <input type="text" name="city_zipcode" id="city_zipcode" size="20" maxlength="20" value="[% city.city_zipcode %]" required="required" class="required" /> <span class="required">Required</span>
+                    <input type="text" name="city_zipcode" id="city_zipcode" size="20" maxlength="20" value="[% city.city_zipcode | html %]" required="required" class="required" /> <span class="required">Required</span>
                 </li>
                 <li>
                     <label for="city_country">Country: </label>
-                    <input type="text" name="city_country" id="city_country" size="80" maxlength="100" value="[% city.city_country |html %]" />
+                    <input type="text" name="city_country" id="city_country" size="80" maxlength="100" value="[% city.city_country | html %]" />
                 </li>
             </ol>
         </fieldset>
 
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
-        <h3>Delete city "[% city.city_name %]?"</h3>
+        <h3>Delete city "[% city.city_name | html %]?"</h3>
         <table>
             <tr><th>City id</th>
-                <td>[% city.cityid %]</td>
+                <td>[% city.cityid | html %]</td>
             </tr>
             <tr><th>City</th>
-                <td>[% city.city_name %]</td>
+                <td>[% city.city_name | html %]</td>
             </tr>
             <tr><th>State</th>
-                <td>[% city.city_state %]</td>
+                <td>[% city.city_state | html %]</td>
             </tr>
             <tr><th>ZIP/Postal code</th>
-                <td>[% city.city_zipcode %]</td>
+                <td>[% city.city_zipcode | html %]</td>
             </tr>
             <tr><th>Country</th>
-                <td>[% city.city_country %]</td>
+                <td>[% city.city_country | html %]</td>
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/cities.pl" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="cityid" value="[% city.cityid %]" />
+            <input type="hidden" name="cityid" value="[% city.cityid | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
         </form>
         <form action="/cgi-bin/koha/admin/cities.pl" method="get">
 
     <h2>Cities</h2>
     [% IF searchfield %]
-        Searching: [% searchfield |html %]
+        Searching: [% searchfield | html %]
     [% END %]
 
     [% IF cities.count %]
             <tbody>
                 [% FOREACH city IN cities %]
                 <tr>
-                    <td>[% city.cityid %]</td>
-                    <td>[% city.city_name %]</td>
-                    <td>[% city.city_state %]</td>
-                    <td>[% city.city_zipcode %]</td>
-                    <td>[% city.city_country %]</td>
+                    <td>[% city.cityid | html %]</td>
+                    <td>[% city.city_name | html %]</td>
+                    <td>[% city.city_state | html %]</td>
+                    <td>[% city.city_zipcode | html %]</td>
+                    <td>[% city.city_country | html %]</td>
                     <td class="actions">
-                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid=[% city.cityid %]"><i class="fa fa-pencil"></i> Edit</a>
-                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid=[% city.cityid %]"><i class="fa fa-trash"></i> Delete</a>
+                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/cities.pl?op=add_form&amp;cityid=[% city.cityid | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/cities.pl?op=delete_confirm&amp;cityid=[% city.cityid | html %]"><i class="fa fa-trash"></i> Delete</a>
                     </td>
                 </tr>
                 [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index c89bfdb..a00e594 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
     [% IF ( edit_sort_rule ) %]Modify filing rule[% ELSE %]Add filing rule[% END %]
 [% END %]
 [% IF ( delete_class_source_form ) %]
-  &rsaquo; Confirm deletion of classification source [% class_source %]
+  &rsaquo; Confirm deletion of classification source [% class_source | html %]
 [% ELSIF ( delete_sort_rule_form ) %]
-  &rsaquo; Confirm deletion of filing rule [% sort_rule %]
+  &rsaquo; Confirm deletion of filing rule [% sort_rule | html %]
 [% ELSIF ( delete_sort_rule_impossible ) %]
-  &rsaquo; Cannot delete filing rule [% sort_rule %]
+  &rsaquo; Cannot delete filing rule [% sort_rule | html %]
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
 &rsaquo; [% IF ( edit_sort_rule ) %]Modify filing rule[% ELSE %]Add filing rule[% END %]
 [% END %]
 [% IF ( delete_class_source_form ) %]
-&rsaquo; Confirm deletion of classification source <span class="ex">'[% class_source %]'</span>
+&rsaquo; Confirm deletion of classification source <span class="ex">'[% class_source | html %]'</span>
 [% ELSIF ( delete_sort_rule_form ) %]
-&rsaquo; Confirm deletion of filing rule <span class="ex">'[% sort_rule %]'</span>
+&rsaquo; Confirm deletion of filing rule <span class="ex">'[% sort_rule | html %]'</span>
 [% ELSIF ( delete_sort_rule_impossible ) %]
-&rsaquo; Cannot delete filing rule <span class="ex">'[% sort_rule %]'</span>
+&rsaquo; Cannot delete filing rule <span class="ex">'[% sort_rule | html %]'</span>
 [% END %]
 </div>
 
   [% ELSE %]
 <h2>Add classification source</h2>
   [% END %]
-<form action="[% script_name %]" name="Aform" class="validated" method="post">
-  <input type="hidden" name="op" value="[% confirm_op %]" />
+<form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+  <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
       <li>
           [% IF ( edit_class_source ) %]
                  <span class="label">Classification source code: </span>
-            <input type="hidden" name="class_source" value="[% class_source %]" />
-            [% class_source %]
+            <input type="hidden" name="class_source" value="[% class_source | html %]" />
+            [% class_source | html %]
           [% ELSE %]
               <label class="required" for="class_source">Classification source code: </label>
               <input class="required" required="required" type="text" id="class_source" name="class_source"  size="10" maxlength="10" />
@@ -71,7 +72,7 @@
           [% END %]
        </li>
        <li><label class="required" for="description">Description: </label>
-           <input class="required" required="required" type="text" id="description" name="description" size="50" maxlength="250" value="[% description |html %]" />
+           <input class="required" required="required" type="text" id="description" name="description" size="50" maxlength="250" value="[% description | html %]" />
            <span class="required">Required</span>
        </li>
        <li><label for="used">Source in use?</label>
@@ -82,9 +83,9 @@
            <select class="required" required="required" id="sort_rule" name="sort_rule">
            [% FOREACH rules_dropdow IN rules_dropdown %]
              [% IF ( rules_dropdow.selected ) %]
-             <option value="[% rules_dropdow.rule %]" selected="selected">[% rules_dropdow.description %] ([% rules_dropdow.rule %])</option>
+             <option value="[% rules_dropdow.rule | html %]" selected="selected">[% rules_dropdow.description | html %] ([% rules_dropdow.rule | html %])</option>
              [% ELSE %]
-             <option value="[% rules_dropdow.rule %]">[% rules_dropdow.description %] ([% rules_dropdow.rule %])</option>
+             <option value="[% rules_dropdow.rule | html %]">[% rules_dropdow.description | html %] ([% rules_dropdow.rule | html %])</option>
              [% END %]
            [% END %]
            </select>
   [% ELSE %]
 <h2>Add filing rule</h2>
   [% END %]
-<form action="[% script_name %]" name="Aform" class="validated" method="post">
-  <input type="hidden" name="op" value="[% confirm_op %]" />
+<form action="[% script_name | html %]" name="Aform" class="validated" method="post">
+  <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
       <li>
           [% IF ( edit_sort_rule ) %]
                  <span class="label">Filing rule code: </span>
-            <input type="hidden" name="sort_rule" value="[% sort_rule %]" />
-            [% sort_rule %]
+            <input type="hidden" name="sort_rule" value="[% sort_rule | html %]" />
+            [% sort_rule | html %]
           [% ELSE %]
               <label for="sort_rule" class="required">Filing rule code: </label>
               <input class="required" required="required" type="text" id="sort_rule" name="sort_rule"  size="10" maxlength="10" />
           [% END %]
        </li>
        <li><label for="description" class="required">Description: </label>
-           <input class="required" required="required" type="text" id="description" name="description" size="50" maxlength="250" value="[% description |html %]" />
+           <input class="required" required="required" type="text" id="description" name="description" size="50" maxlength="250" value="[% description | html %]" />
            <span class="required">Required</span>
        </li>
        <li><label for="sort_routine" class="required">Filing routine: </label>
            <select class="required" required="required" id="sort_routine" name="sort_routine">
            [% FOREACH routines_dropdow IN routines_dropdown %]
              [% IF ( routines_dropdow.selected ) %]
-             <option value="[% routines_dropdow.routine %]" selected="selected">[% routines_dropdow.routine %]</option>
+             <option value="[% routines_dropdow.routine | html %]" selected="selected">[% routines_dropdow.routine | html %]</option>
              [% ELSE %]
-             <option value="[% routines_dropdow.routine %]">[% routines_dropdow.routine %]</option>
+             <option value="[% routines_dropdow.routine | html %]">[% routines_dropdow.routine | html %]</option>
              [% END %]
            [% END %]
            </select>
 
 [% IF ( delete_class_source_form ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of classification source <span class="ex">'[% class_source %]'</span>?</h3>
-        <form action="[% script_name %]" name="Aform" method="post">
-            <input type="hidden" name="op" value="[% confirm_op %]" />
-            <input type="hidden" name="class_source" value="[% class_source %]" />
+        <h3>Confirm deletion of classification source <span class="ex">'[% class_source | html %]'</span>?</h3>
+        <form action="[% script_name | html %]" name="Aform" method="post">
+            <input type="hidden" name="op" value="[% confirm_op | html %]" />
+            <input type="hidden" name="class_source" value="[% class_source | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete classification source</button>
         </form>
-        <form action="[% script_name %]" method="get">
+        <form action="[% script_name | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 
 [% IF ( delete_sort_rule_form ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of filing rule <span class="ex">'[% sort_rule %]'</span>?</h3>
-        <form action="[% script_name %]" name="Aform" method="post">
-            <input type="hidden" name="op" value="[% confirm_op %]" />
-            <input type="hidden" name="sort_rule" value="[% sort_rule %]" />
+        <h3>Confirm deletion of filing rule <span class="ex">'[% sort_rule | html %]'</span>?</h3>
+        <form action="[% script_name | html %]" name="Aform" method="post">
+            <input type="hidden" name="op" value="[% confirm_op | html %]" />
+            <input type="hidden" name="sort_rule" value="[% sort_rule | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete filing rule</button>
         </form>
-        <form action="[% script_name %]" method="get">
+        <form action="[% script_name | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% END %]
 
 [% IF ( delete_sort_rule_impossible ) %]
-<div class="dialog alert"><h3>Cannot delete filing rule <span class="ex">'[% sort_rule %]'</span></h3>
-    <p>The filing rule [% sort_rule %] is used by at least one classification source.  Please
+<div class="dialog alert"><h3>Cannot delete filing rule <span class="ex">'[% sort_rule | html %]'</span></h3>
+    <p>The filing rule [% sort_rule | html %] is used by at least one classification source.  Please
     remove it from all classification source definitions before trying again.
     </p>
-    <form action="[% script_name %]" method="get">
+    <form action="[% script_name | html %]" method="get">
           <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
     </form>
 </div>
 [% IF ( display_lists ) %]
 
 <div id="toolbar" class="btn-toolbar">
-    <a class="btn btn-default btn-sm" id="newsource" href="[% script_name %]?op=add_source"><i class="fa fa-plus"></i> New classification source</a>
-    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name %]?op=add_sort_rule"><i class="fa fa-plus"></i> New filing rule</a>
+    <a class="btn btn-default btn-sm" id="newsource" href="[% script_name | html %]?op=add_source"><i class="fa fa-plus"></i> New classification source</a>
+    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name | html %]?op=add_sort_rule"><i class="fa fa-plus"></i> New filing rule</a>
 </div>
 
 <h2>Classification sources</h2>
 [% IF ( added_source ) %]
-<div class="dialog message">Added classification source [% added_source %]</div>
+<div class="dialog message">Added classification source [% added_source | html %]</div>
 [% END %]
 [% IF ( edited_source ) %]
-<div class="dialog message">Modified classification source [% edited_source %]</div>
+<div class="dialog message">Modified classification source [% edited_source | html %]</div>
 [% END %]
 [% IF ( deleted_source ) %]
-<div class="dialog message">Deleted classification source [% deleted_source %]</div>
+<div class="dialog message">Deleted classification source [% deleted_source | html %]</div>
 [% END %]
 [% IF ( failed_add_source ) %]
-<div class="dialog message">Failed to add classification source [% failed_add_source %]. Perhaps the code already exists?</div>
+<div class="dialog message">Failed to add classification source [% failed_add_source | html %]. Perhaps the code already exists?</div>
 [% END %]
 <table>
   <tr>
   </tr>
   [% FOREACH class_source IN class_sources %]
   <tr>
-    <td>[% class_source.code %]</td>
-    <td>[% class_source.description |html %]</td>
+    <td>[% class_source.code | html %]</td>
+    <td>[% class_source.description | html %]</td>
     <td>[% IF ( class_source.used ) %]Yes[% ELSE %]No[% END %]</td>
-    <td>[% class_source.sortrule %]</td>
+    <td>[% class_source.sortrule | html %]</td>
     <td class="actions">
-      <a class="btn btn-default btn-xs" href="[% class_source.script_name %]?op=edit_source&amp;class_source=[% class_source.code |html %]"><i class="fa fa-pencil"></i> Edit</a>
-      <a class="btn btn-default btn-xs" href="[% class_source.script_name %]?op=delete_source&amp;class_source=[% class_source.code |html %]"><i class="fa fa-trash"></i> Delete</a>
+      <a class="btn btn-default btn-xs" href="[% class_source.script_name | html %]?op=edit_source&amp;class_source=[% class_source.code | html %]"><i class="fa fa-pencil"></i> Edit</a>
+      <a class="btn btn-default btn-xs" href="[% class_source.script_name | html %]?op=delete_source&amp;class_source=[% class_source.code | html %]"><i class="fa fa-trash"></i> Delete</a>
     </td>
   </tr>
   [% END %]
 
 <h2>Classification filing rules</h2>
 [% IF ( added_rule ) %]
-<div class="dialog message">Added filing rule [% added_rule %]</div>
+<div class="dialog message">Added filing rule [% added_rule | html %]</div>
 [% END %]
 [% IF ( edited_rule ) %]
-<div class="dialog message">Modified filing rule [% edited_rule %]</div>
+<div class="dialog message">Modified filing rule [% edited_rule | html %]</div>
 [% END %]
 [% IF ( deleted_rule ) %]
-<div class="dialog message">Deleted filing rule [% deleted_rule %]</div>
+<div class="dialog message">Deleted filing rule [% deleted_rule | html %]</div>
 [% END %]
 [% IF ( failed_add_rule ) %]
-<div class="dialog message">Failed to add filing rule [% failed_add_rule %]. Perhaps the code already exists?</div>
+<div class="dialog message">Failed to add filing rule [% failed_add_rule | html %]. Perhaps the code already exists?</div>
 [% END %]
 <table>
   <tr>
   </tr>
   [% FOREACH class_sort_rule IN class_sort_rules %]
   <tr>
-    <td>[% class_sort_rule.rule %]</td>
-    <td>[% class_sort_rule.description |html %]</td>
-    <td>[% class_sort_rule.sort_routine %]</td>
+    <td>[% class_sort_rule.rule | html %]</td>
+    <td>[% class_sort_rule.description | html %]</td>
+    <td>[% class_sort_rule.sort_routine | html %]</td>
     <td class="actions">
-      <a class="btn btn-default btn-xs" href="[% class_sort_rule.script_name %]?op=edit_sort_rule&amp;sort_rule=[% class_sort_rule.rule |html %]"><i class="fa fa-pencil"></i> Edit</a>
-      <a class="btn btn-default btn-xs" href="[% class_sort_rule.script_name %]?op=delete_sort_rule&amp;sort_rule=[% class_sort_rule.rule |html %]"><i class="fa fa-trash"></i> Delete</a>
+      <a class="btn btn-default btn-xs" href="[% class_sort_rule.script_name | html %]?op=edit_sort_rule&amp;sort_rule=[% class_sort_rule.rule | html %]"><i class="fa fa-pencil"></i> Edit</a>
+      <a class="btn btn-default btn-xs" href="[% class_sort_rule.script_name | html %]?op=delete_sort_rule&amp;sort_rule=[% class_sort_rule.rule | html %]"><i class="fa fa-trash"></i> Delete</a>
     </td>
   </tr>
   [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 9adae50..08fd070 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -17,8 +18,8 @@
     <div id="yui-main">
     <div class="yui-b">
     <h2>Cloning circulation and fine rules
-        [% IF frombranch %] from "[% Branches.GetName( frombranch ) %]"[% END %]
-        [% IF tobranch %] to "[% Branches.GetName( tobranch ) %]"[% END %]
+        [% IF frombranch %] from "[% Branches.GetName( frombranch ) | html %]"[% END %]
+        [% IF tobranch %] to "[% Branches.GetName( tobranch ) | html %]"[% END %]
     </h2>
 
     [% IF ( result ) %]
@@ -40,7 +41,7 @@
                     <option value="">Default</option>
                     [% PROCESS options_for_libraries libraries => Branches.all() %]
                 </select>
-                [% IF ( tobranch ) %]<input type="hidden" name="tobranch" value="[% tobranch %]" />[% END %]
+                [% IF ( tobranch ) %]<input type="hidden" name="tobranch" value="[% tobranch | html %]" />[% END %]
             </fieldset>
         [% END %]
 
@@ -52,7 +53,7 @@
                 <option value="">Default</option>
                 [% PROCESS options_for_libraries libraries => Branches.all() %]
             </select>
-            [% IF ( frombranch ) %]<input type="hidden" name="frombranch" value="[% frombranch %]" />[% END %]
+            [% IF ( frombranch ) %]<input type="hidden" name="frombranch" value="[% frombranch | html %]" />[% END %]
             </fieldset>
         [% END %]
         <input type="submit" value="Submit" />
@@ -68,7 +69,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index cfc1277..a5624c6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% SET panel_id = 0 %]
@@ -5,12 +6,12 @@
 <div class="pagelist">
   <form method="post" action="/cgi-bin/koha/admin/columns_settings.pl">
     <input type="hidden" name="action" value="save" />
-    <input type="hidden" name="module" value="[% modulename %]" />
-    <input type="hidden" name="panel" value="[% panel_id %]" />
+    <input type="hidden" name="module" value="[% modulename | html %]" />
+    <input type="hidden" name="panel" value="[% panel_id | html %]" />
     [% SET panel_id = panel_id + 1 %]
     [% IF module.keys and module.keys.size > 0 %]
       [% FOR pagename IN module.keys %]
-        <h5>[% pagename %]</h5>
+        <h5>[% pagename | html %]</h5>
         [% SET tables = module %]
         [% IF tables.$pagename.keys and tables.$pagename.keys.size > 0 %]
           [% FOR tablename IN tables.$pagename.keys.sort %]
@@ -24,7 +25,7 @@
                 [% ELSIF pagename == 'additem' AND tablename == 'itemst' %]
                   Items Editor
                 [% END %]
-                (id=[% tablename %])
+                (id=[% tablename | html %])
               </caption>
               <thead><tr><th>Column name</th><th>Is hidden by default</th><th>Cannot be toggled</th></tr></thead>
               <tbody>
                 [% SET value = pagename _ '#' _ tablename _ '#' _ column.columnname %]
                 <tr>
                   <td>
-                    [% column.columnname %]
-                    <input type="hidden" name="columnid" value="[% value %]" />
+                    [% column.columnname | html %]
+                    <input type="hidden" name="columnid" value="[% value | html %]" />
                   </td>
                   <td>
                     [% IF column.is_hidden %]
                       [% IF column.cannot_be_modified %]
-                        <input type="checkbox" name="[% value %]_hidden" value="1" checked="checked" disabled="disabled" />
-                        <input type="hidden" name="[% value %]_hidden" value="1" />
+                        <input type="checkbox" name="[% value | html %]_hidden" value="1" checked="checked" disabled="disabled" />
+                        <input type="hidden" name="[% value | html %]_hidden" value="1" />
                       [% ELSE %]
-                        <input type="checkbox" name="[% value %]_hidden" value="1" checked="checked" />
+                        <input type="checkbox" name="[% value | html %]_hidden" value="1" checked="checked" />
                       [% END %]
                     [% ELSE %]
                       [% IF column.cannot_be_modified %]
-                        <input type="checkbox" name="[% value %]_hidden" value="1" disabled="disabled" />
-                        <input type="hidden" name="[% value %]_hidden" value="0" />
+                        <input type="checkbox" name="[% value | html %]_hidden" value="1" disabled="disabled" />
+                        <input type="hidden" name="[% value | html %]_hidden" value="0" />
                       [% ELSE %]
-                        <input type="checkbox" name="[% value %]_hidden" value="1" />
+                        <input type="checkbox" name="[% value | html %]_hidden" value="1" />
                       [% END %]
                     [% END %]
                   </td>
                   <td>
                     [% IF column.cannot_be_toggled %]
                       [% IF column.cannot_be_modified %]
-                        <input type="checkbox" name="[% value %]_cannot_be_toggled" value="1" checked="checked" disabled="disabled" />
-                        <input type="hidden" name="[% value %]_cannot_be_toggled" value="1" />
+                        <input type="checkbox" name="[% value | html %]_cannot_be_toggled" value="1" checked="checked" disabled="disabled" />
+                        <input type="hidden" name="[% value | html %]_cannot_be_toggled" value="1" />
                       [% ELSE %]
-                        <input type="checkbox" name="[% value %]_cannot_be_toggled" value="1" checked="checked" />
+                        <input type="checkbox" name="[% value | html %]_cannot_be_toggled" value="1" checked="checked" />
                       [% END %]
                     [% ELSE %]
                       [% IF column.cannot_be_modified %]
-                        <input type="checkbox" name="[% value %]_cannot_be_toggled" value="1" disabled="disabled" />
-                        <input type="hidden" name="[% value %]_cannot_be_toggled" value="0" />
+                        <input type="checkbox" name="[% value | html %]_cannot_be_toggled" value="1" disabled="disabled" />
+                        <input type="hidden" name="[% value | html %]_cannot_be_toggled" value="0" />
                       [% ELSE %]
-                        <input type="checkbox" name="[% value %]_cannot_be_toggled" value="1" />
+                        <input type="checkbox" name="[% value | html %]_cannot_be_toggled" value="1" />
                       [% END %]
                     [% END %]
                   </td>
   </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready( function() {
             var accordion = $( "#modules" ).accordion({
                 header: "h3",
               [%- IF panel -%]
                 [%# we were asked to show a specific panel, usually on update %]
-                active: [%- panel -%]
+                active: [%- panel | html -%]
               [%- ELSE -%]
                 active: false
               [%- END -%]
index f9178a9..0b77dd2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE ColumnsSettings %]
@@ -5,19 +6,19 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Currencies &amp; Exchange rates &rsaquo;
-[% IF op == 'add_form' %][% IF currency %]Modify currency '[% currency.currency %]'[% ELSE %]New currency[% END %][% END %]
-[% IF op == 'delete_confirm' %]Confirm deletion of currency '[% currency.currency %]'[% END %]
+[% IF op == 'add_form' %][% IF currency %]Modify currency '[% currency.currency | html %]'[% ELSE %]New currency[% END %][% END %]
+[% IF op == 'delete_confirm' %]Confirm deletion of currency '[% currency.currency | html %]'[% END %]
 [% IF op == 'list' %]Currencies[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_currency" class="admin">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'currencies-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;  <a href="/cgi-bin/koha/admin/currency.pl">Currencies &amp; Exchange rates</a> &rsaquo; [% IF op == 'add_form' %][% IF currency %]Modify currency '[% currency.currency %]'[% ELSE %]New currency[% END %][% END %]
-[% IF op == 'delete_confirm' %]Confirm deletion of currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;  <a href="/cgi-bin/koha/admin/currency.pl">Currencies &amp; Exchange rates</a> &rsaquo; [% IF op == 'add_form' %][% IF currency %]Modify currency '[% currency.currency | html %]'[% ELSE %]New currency[% END %][% END %]
+[% IF op == 'delete_confirm' %]Confirm deletion of currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' | html %]
 [% ELSIF op == 'list' %]Currencies
 [% END %]
 </div>
@@ -34,7 +35,7 @@
 [% END %]
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this currency. Perhaps it already exists.
@@ -49,7 +50,7 @@
         [% CASE 'success_on_delete' %]
             Currency deleted successfully.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -73,7 +74,7 @@
                 [% IF currency %]
                     <span class="label">Currency: </span>
                     <input type="hidden" name="is_a_modif" value="1" />
-                    <input type="hidden" name="currency_code" id="currency" value="[% currency.currency %]" />[% currency.currency %]
+                    <input type="hidden" name="currency_code" id="currency" value="[% currency.currency | html %]" />[% currency.currency | html %]
                 [% ELSE %]
                     <label for="currency_code" class="required">Currency: </label>
                     <input type="text" name="currency_code" id="currency_code" size="50" maxlength="50" required="required" class="required" /> <span class="required">Required</span>
             </li>
             <li>
                 <label for="rate" class="required">Rate: </label>
-                <input type="text" name="rate" id="rate" size="10" maxlength="10" value="[% currency.rate %]" required="required" class="required" /> <span class="required">Required</span>
+                <input type="text" name="rate" id="rate" size="10" maxlength="10" value="[% currency.rate | html %]" required="required" class="required" /> <span class="required">Required</span>
             </li>
             <li>
                 <label for="symbol" class="required">Symbol: </label>
-                <input type="text" name="symbol" id="symbol" size="5" maxlength="5" value="[% currency.symbol %]" required="required" class="required" /> <span class="required">Required</span>
+                <input type="text" name="symbol" id="symbol" size="5" maxlength="5" value="[% currency.symbol | html %]" required="required" class="required" /> <span class="required">Required</span>
             </li>
             <li>
                 <label for="isocode">ISO code: </label>
-                <input type="text" name="isocode" id="isocode" size="5" maxlength="5" value="[% currency.isocode %]" />
+                <input type="text" name="isocode" id="isocode" size="5" maxlength="5" value="[% currency.isocode | html %]" />
             </li>
             <li>
                 <span class="label">Last updated: </span>[% currency.timestamp | $KohaDates %]
 [% IF op =='delete_confirm' %]
     [% IF nb_of_orders or nb_of_vendors %]
     <div class="dialog alert">
-        <h3>Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]</h3>
+        <h3>Cannot delete currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' | html %]</h3>
         <p>
             [% IF nb_of_orders %]
-                This currency is used by [% nb_of_orders %] orders.
+                This currency is used by [% nb_of_orders | html %] orders.
             [% ELSIF nb_of_vendors %]
-                This currency is used by [% nb_of_vendors %] vendors.
+                This currency is used by [% nb_of_vendors | html %] vendors.
             [% END %]
             Deletion not possible
         </p>
     </div>
     [% ELSE %]
     <div class="dialog alert">
-        <h3>Confirm deletion of currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' %]</h3>
+        <h3>Confirm deletion of currency [% currency.currency | $HtmlTags tag='span' attributes=>'class="ex"' | html %]</h3>
         <table>
             <tr><th>Currency</th>
-                <td>[% currency.currency %]</td>
+                <td>[% currency.currency | html %]</td>
             </tr>
             <tr><th>Rate</th>
-                <td>[% currency.rate %]</td>
+                <td>[% currency.rate | html %]</td>
             </tr>
         </table>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="currency_code" value="[% currency.currency %]" />
+            <input type="hidden" name="currency_code" value="[% currency.currency | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this currency</button>
         </form>
         <form action="/cgi-bin/koha/admin/currency.pl" method="post">
     [% END %]
 
     [% IF searchfield %]
-        You searched for [% searchfield |html %]</span>
+        You searched for [% searchfield | html %]</span>
     [% END %]
 
     <table id='currencies-table'>
       <tbody>
         [% FOREACH currency IN currencies %]
           <tr>
-            <td>[% currency.currency %]</td>
-            <td>[% currency.rate %]</td>
-            <td>[% currency.symbol |html %]</td>
-            <td>[% currency.isocode |html %]</td>
-            <td><span title="[% currency.timestamp %]">[% currency.timestamp | $KohaDates %]</span></td>
+            <td>[% currency.currency | html %]</td>
+            <td>[% currency.rate | html %]</td>
+            <td>[% currency.symbol | html %]</td>
+            <td>[% currency.isocode | html %]</td>
+            <td><span title="[% currency.timestamp | html %]">[% currency.timestamp | $KohaDates %]</span></td>
             <td style="color:green;">[% IF currency.active %]✓[% END %]</td>
             <td>[% IF currency.archived %]Yes[% END %]</td>
             <td class="actions">
-              <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/currency.pl?op=add_form&amp;currency_code=[% currency.currency %]"><i class="fa fa-pencil"></i> Edit</a>
-              <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/currency.pl?op=delete_confirm&amp;currency_code=[% currency.currency %]"><i class="fa fa-trash"></i> Delete</a>
+              <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/currency.pl?op=add_form&amp;currency_code=[% currency.currency | html %]"><i class="fa fa-pencil"></i> Edit</a>
+              <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/currency.pl?op=delete_confirm&amp;currency_code=[% currency.currency | html %]"><i class="fa fa-trash"></i> Delete</a>
             </td>
           </tr>
         [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
     <script type="text/javascript">
         }
 
         $(document).ready(function() {
-            columns_settings = [% ColumnsSettings.GetColumns( 'admin', 'currency', 'currencies-table', 'json' ) %]
+            columns_settings = [% ColumnsSettings.GetColumns( 'admin', 'currency', 'currencies-table', 'json' ).raw %]
             var issuest = KohaTable("currencies-table", {
                 dom: 'B<"clearfix">t',
                 "columnDefs": [
index ecaad4f..33881f7 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% BLOCK pluginlist %]
@@ -5,8 +6,8 @@
 [% FOREACH plugin IN plugins %]
     <div class="plugin">
         <div class="pluginname">
-            [% IF plugin.enabled %]<input type="checkbox" checked="checked" id="checkbox_[% type %][% plugin.name %]">[% ELSE %]<input type="checkbox" id="checkbox_[% type %][% plugin.name %]">[% END %]
-            <label class='pluginlabel' for="checkbox_[% type %][% plugin.name %]">[% plugin.name %]</label></div>
+            [% IF plugin.enabled %]<input type="checkbox" checked="checked" id="checkbox_[% type | html %][% plugin.name | html %]">[% ELSE %]<input type="checkbox" id="checkbox_[% type | html %][% plugin.name | html %]">[% END %]
+            <label class='pluginlabel' for="checkbox_[% type | html %][% plugin.name | html %]">[% plugin.name | html %]</label></div>
         <div class="plugindesc">
         [% SWITCH plugin.name %]
         [% CASE 'AuthorityFile' %]
@@ -69,7 +70,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $( ".pluginlist" ).sortable();
index 2dc1c09..7b8f553 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -53,7 +54,7 @@
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" name="Actform" method="post">
   <input type="hidden" name="op" value="save" />
   [% IF account %]
-  <input type="hidden" name="id" value="[% account.id %]" />
+  <input type="hidden" name="id" value="[% account.id | html %]" />
   [% END %]
   <fieldset class="rows">
   <legend>
@@ -70,9 +71,9 @@
      <select name="vendor_id" id="vendor_id">
      [% FOREACH vendor IN vendors %]
        [% IF account.vendor_id == vendor.id %]
-          <option value="[% vendor.id %]" selected="selected">[% vendor.name %]</option>
+          <option value="[% vendor.id | html %]" selected="selected">[% vendor.name | html %]</option>
        [% ELSE %]
-          <option value="[% vendor.id %]">[% vendor.name %]</option>
+          <option value="[% vendor.id | html %]">[% vendor.name | html %]</option>
        [% END %]
      [% END %]
      </select>
@@ -84,9 +85,9 @@
         <option value="">Do not use plugin</option>
         [% FOREACH plugin IN plugins %]
             [% IF account.plugin == plugin.class %]
-                <option value="[% plugin.class %]" selected="selected">[% plugin.metadata.name %]</option>
+                <option value="[% plugin.class | html %]" selected="selected">[% plugin.metadata.name | html %]</option>
             [% ELSE %]
-                <option value="[% plugin.class %]">[% plugin.metadata.name %]</option>
+                <option value="[% plugin.class | html %]">[% plugin.metadata.name | html %]</option>
             [% END %]
         [% END %]
      </select>
   [% END %]
   <li>
      <label for="description">Description: </label>
-     <input type="text" name="description" id="description" size="20" value="[% account.description %]" />
+     <input type="text" name="description" id="description" size="20" value="[% account.description | html %]" />
   </li>
   <li>
-     [% transport_types = [ 'FTP', 'SFTP', 'FILE' ] %]
+     [% transport_types = [ 'FTP', 'SFTP', 'FILE' ] | html %]
      <label for="transport">Transport: </label>
      <select name="transport" title="valid types of transport are FTP and SFTP"
       id="transport">
       [% FOREACH transport_type IN transport_types %]
            [% IF transport_type == account.transport %]
-              <option value="[% transport_type %]" selected="selected">[% transport_type %]</option>
+              <option value="[% transport_type | html %]" selected="selected">[% transport_type | html %]</option>
            [% ELSE %]
-              <option value="[% transport_type %]">[% transport_type %]</option>
+              <option value="[% transport_type | html %]">[% transport_type | html %]</option>
            [% END %]
        [% END %]
      </select>
   </li>
   <li>
      <label for="host">Remote host: </label>
-     <input type="text" name="host" id="host" size="20" maxlength="40" value="[% account.host %]" />
+     <input type="text" name="host" id="host" size="20" maxlength="40" value="[% account.host | html %]" />
   </li>
   <li>
      <label for="username">Username: </label>
-     <input type="text" name="username" id="username" size="20" maxlength="40" value="[% account.username %]" />
+     <input type="text" name="username" id="username" size="20" maxlength="40" value="[% account.username | html %]" />
   </li>
   <li>
      <label for="password">Password: </label>
-     <input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password %]" />
+     <input type="text" name="password" id="password" size="20" maxlength="40" value="[% account.password | html %]" />
   </li>
   <li>
      <label for="download_directory">Download directory: </label>
-     <input type="text" name="download_directory" id="download_directory" size="20" value="[% account.download_directory %]" />
+     <input type="text" name="download_directory" id="download_directory" size="20" value="[% account.download_directory | html %]" />
         <div class="hint">The download directory specifies the directory on the ftp site from which quotes and invoices are downloaded.</div>
   </li>
   <li>
      <label for="upload_directory">Upload directory: </label>
-     <input type="text" name="upload_directory" id="upload_directory" size="20" value="[% account.upload_directory %]" />
+     <input type="text" name="upload_directory" id="upload_directory" size="20" value="[% account.upload_directory | html %]" />
         <div class="hint">The upload directory specifies the directory on the ftp site to which orders are uploaded.</div>
   </li>
   <li>
      <select name="id_code_qualifier" id="id_code_qualifier">
      [% FOREACH qualifier IN code_qualifiers %]
         [% IF qualifier.code == account.id_code_qualifier %]
-           <option value="[% qualifier.code %]" selected="selected">
-               [% qualifier.description %] ([% qualifier.code %])
+           <option value="[% qualifier.code | html %]" selected="selected">
+               [% qualifier.description | html %] ([% qualifier.code | html %])
            </option>
         [% ELSE %]
-           <option value="[% qualifier.code %]">
-              [% qualifier.description %] ([% qualifier.code %])
+           <option value="[% qualifier.code | html %]">
+              [% qualifier.description | html %] ([% qualifier.code | html %])
            </option>
         [% END %]
      [% END %]
   </li>
   <li>
      <label for="san">SAN: </label>
-     <input type="text" name="san" id="san" size="20" maxlength="20" value="[% account.san %]" />
+     <input type="text" name="san" id="san" size="20" maxlength="20" value="[% account.san | html %]" />
   </li>
   <li>
      <label for="quotes_enabled">Quotes enabled: </label>
       [% IF account.quotes_enabled %]
-     <input type="checkbox" name="quotes_enabled" id="quotes_enabled" value="[% account.quotes_enabled %]" checked="checked" />
+     <input type="checkbox" name="quotes_enabled" id="quotes_enabled" value="[% account.quotes_enabled | html %]" checked="checked" />
       [% ELSE %]
-     <input type="checkbox" name="quotes_enabled" id="quotes_enabled" value="[% account.quotes_enabled %]" />
+     <input type="checkbox" name="quotes_enabled" id="quotes_enabled" value="[% account.quotes_enabled | html %]" />
       [% END %]
   </li>
   <li>
      <label for="orders_enabled">Orders enabled: </label>
 [% IF account.orders_enabled %]
-     <input type="checkbox" name="orders_enabled" id="orders_enabled" value="[% account.orders_enabled %]" checked="checked" />
+     <input type="checkbox" name="orders_enabled" id="orders_enabled" value="[% account.orders_enabled | html %]" checked="checked" />
 [% ELSE %]
-     <input type="checkbox" name="orders_enabled" id="orders_enabled" value="[% account.orders_enabled %]" />
+     <input type="checkbox" name="orders_enabled" id="orders_enabled" value="[% account.orders_enabled | html %]" />
 [% END %]
   </li>
   <li>
      <label for="invoices_enabled">Invoices enabled: </label>
 [% IF account.invoices_enabled %]
-     <input type="checkbox" name="invoices_enabled" id="invoices_enabled" value="[% account.invoices_enabled %]" checked="checked" />
+     <input type="checkbox" name="invoices_enabled" id="invoices_enabled" value="[% account.invoices_enabled | html %]" checked="checked" />
 [% ELSE %]
-     <input type="checkbox" name="invoices_enabled" id="invoices_enabled" value="[% account.invoices_enabled %]" />
+     <input type="checkbox" name="invoices_enabled" id="invoices_enabled" value="[% account.invoices_enabled | html %]" />
 [% END %]
   </li>
   <li>
      <label for="responses_enabled">Responses enabled: </label>
 [% IF account.responses_enabled %]
-     <input type="checkbox" name="responses_enabled" id="responses_enabled" value="[% account.responses_enabled %]" checked="checked" />
+     <input type="checkbox" name="responses_enabled" id="responses_enabled" value="[% account.responses_enabled | html %]" checked="checked" />
 [% ELSE %]
-     <input type="checkbox" name="responses_enabled" id="responses_enabled" value="[% account.responses_enabled %]" />
+     <input type="checkbox" name="responses_enabled" id="responses_enabled" value="[% account.responses_enabled | html %]" />
 [% END %]
   </li>
   <li>
      <label for="auto_orders">Automatic ordering: </label>
 [% IF account.auto_orders %]
-     <input type="checkbox" name="auto_orders" id="auto_orders" value="[% account.auto_orders %]" checked="checked" />
+     <input type="checkbox" name="auto_orders" id="auto_orders" value="[% account.auto_orders | html %]" checked="checked" />
 [% ELSE %]
-     <input type="checkbox" name="auto_orders" id="auto_orders" value="[% account.auto_orders %]" />
+     <input type="checkbox" name="auto_orders" id="auto_orders" value="[% account.auto_orders | html %]" />
 [% END %]
     <div class="hint">
         With automatic ordering quotes generate orders without staff intervention.
 <table>
     <tr>
     <th>Vendor</th>
-    <td>[% account.vendor.name %]</td>
+    <td>[% account.vendor.name | html %]</td>
     </tr>
     <tr>
     <th>Description</th>
-    <td>[% account.description %]</td>
+    <td>[% account.description | html %]</td>
     </tr>
     <tr>
     <th>SAN</th>
-    <td>[% account.san %]</td>
+    <td>[% account.san | html %]</td>
     </tr>
 </table>
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" method="post">
     <table>
     </table>
     <input type="hidden" name="op" value="delete_confirmed" />
-    <input type="hidden" name="id" value="[% account.id %]" />
+    <input type="hidden" name="id" value="[% account.id | html %]" />
     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
 </form>
 <form action="/cgi-bin/koha/admin/edi_accounts.pl" method="get">
     </tr>
     [% FOREACH account IN ediaccounts %]
     <tr>
-      <td>[% account.id %]</td>
-      <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% account.vendor_id %]">[% account.vendor.name %]</a></td>
-      <td>[% account.description %]</td>
-      <td>[% account.transport %]</td>
-      <td>[% account.host %]</td>
-      <td>[% account.username %]</td>
+      <td>[% account.id | html %]</td>
+      <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% account.vendor_id | html %]">[% account.vendor.name | html %]</a></td>
+      <td>[% account.description | html %]</td>
+      <td>[% account.transport | html %]</td>
+      <td>[% account.host | html %]</td>
+      <td>[% account.username | html %]</td>
       <td>[% IF account.password %]*****[% END %]</td>
-      <td>[% account.download_directory %]</td>
-      <td>[% account.upload_directory %]</td>
+      <td>[% account.download_directory | html %]</td>
+      <td>[% account.upload_directory | html %]</td>
       <td>
          [% FOREACH qualifier IN code_qualifiers %]
             [% IF qualifier.code == account.id_code_qualifier %]
-                   [% qualifier.description %]
+                   [% qualifier.description | html %]
             [% END %]
          [% END %]
-         ([% account.id_code_qualifier %])
+         ([% account.id_code_qualifier | html %])
      </td>
-      <td>[% account.san %]</td>
+      <td>[% account.san | html %]</td>
       [% IF account.quotes_enabled %]
          <td>Y</td>
       [% ELSE %]
          <td>N</td>
       [% END %]
       <td class="actions">
-          <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_accounts.pl?op=acct_form&id=[% account.id %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=[% account.id %]"><i class="fa fa-trash"></i> Delete</a>
+          <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_accounts.pl?op=acct_form&id=[% account.id | html %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_accounts.pl?op=delete_confirm&id=[% account.id | html %]"><i class="fa fa-trash"></i> Delete</a>
       </td>
     </tr>
     [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 7088736..a7ef2db 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -53,8 +54,8 @@
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" name="Eanform" method="post">
   <input type="hidden" name="op" value="save" />
   [% IF ean %]
-      <input type="hidden" name="oldbranchcode" value="[% ean.branch.branchcode %]" />
-      <input type="hidden" name="id" value="[% ean.id %]" />
+      <input type="hidden" name="oldbranchcode" value="[% ean.branch.branchcode | html %]" />
+      <input type="hidden" name="id" value="[% ean.id | html %]" />
   [% END %]
 
   <fieldset class="rows">
              <select name="branchcode" id="branchcode">
                 [% FOREACH branch IN branches %]
                     [% IF branch.branchcode == ean.branch.branchcode %]
-                       <option value="[% branch.branchcode %]" selected="selected">[% branch.branchname %]</option>
+                       <option value="[% branch.branchcode | html %]" selected="selected">[% branch.branchname | html %]</option>
                     [% ELSE %]
-                       <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                       <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                     [% END %]
                 [% END %]
               </select>
           </li>
           <li>
              <label for="description">Description: </label>
-             <input type="text" name="description" id="description" size="30" maxlength="128" value="[% ean.description %]" />
+             <input type="text" name="description" id="description" size="30" maxlength="128" value="[% ean.description | html %]" />
           </li>
           <li>
              <label for="ean">EAN: </label>
-             <input type="text" name="ean" id="ean" size="20" maxlength="15" value="[% ean.ean %]" />
+             <input type="text" name="ean" id="ean" size="20" maxlength="15" value="[% ean.ean | html %]" />
           </li>
           <li>
              <label for="id_code_qualifier">Qualifier: </label>
              <select name="id_code_qualifier" id="id_code_qualifier">
                  [% FOREACH qualifier IN code_qualifiers %]
                     [% IF qualifier.code == ean.id_code_qualifier %]
-                       <option value="[% qualifier.code %]" selected="selected">
-                           [% qualifier.description %] ([% qualifier.code %])
+                       <option value="[% qualifier.code | html %]" selected="selected">
+                           [% qualifier.description | html %] ([% qualifier.code | html %])
                        </option>
                     [% ELSE %]
-                       <option value="[% qualifier.code %]">
-                          [% qualifier.description %] ([% qualifier.code %])
+                       <option value="[% qualifier.code | html %]">
+                          [% qualifier.description | html %] ([% qualifier.code | html %])
                        </option>
                     [% END %]
                  [% END %]
 
 [% IF delete_confirm %]
 <div class="dialog alert">
-<h3>Delete EAN [% ean.ean %] for [% ean.branch.branchname %]?</h3>
+<h3>Delete EAN [% ean.ean | html %] for [% ean.branch.branchname | html %]?</h3>
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" method="post">
     <input type="hidden" name="op" value="delete_confirmed" />
-    <input type="hidden" name="id" value="[% ean.id %]" />
+    <input type="hidden" name="id" value="[% ean.id | html %]" />
     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
 </form>
 <form action="/cgi-bin/koha/admin/edi_ean_accounts.pl" method="get">
         </tr>
         [% FOREACH ean IN eans %]
             <tr>
-                <td>[% ean.branch.branchname %]</td>
-                <td>[% ean.description %]</td>
-                <td>[% ean.ean %]</td>
+                <td>[% ean.branch.branchname | html %]</td>
+                <td>[% ean.description | html %]</td>
+                <td>[% ean.ean | html %]</td>
                 <td>
                  [% FOREACH qualifier IN code_qualifiers %]
                     [% IF qualifier.code == ean.id_code_qualifier %]
-                        [% qualifier.description %] ([% qualifier.code %])
+                        [% qualifier.description | html %] ([% qualifier.code | html %])
                     [% END %]
                  [% END %]
                 </td>
                 <td class="actions">
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_ean_accounts.pl?op=ean_form&id=[% ean.id %]"><i class="fa fa-pencil"></i> Edit</a>
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_ean_accounts.pl?op=delete_confirm&id=[% ean.id %]"><i class="fa fa-trash"></i> Delete</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_ean_accounts.pl?op=ean_form&id=[% ean.id | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/edi_ean_accounts.pl?op=delete_confirm&id=[% ean.id | html %]"><i class="fa fa-trash"></i> Delete</a>
                 </td>
             </tr>
         [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 1f6b36d..89463d1 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -14,7 +15,7 @@
                <div class="yui-b">
             <h2>Keyword to MARC mapping</h2>
             [% UNLESS ( fields.count ) %]
-                <div class="dialog message"><p>There are no mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext |html %]</em>[% ELSE %]default[% END %] framework. </p></div>
+                <div class="dialog message"><p>There are no mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext | html %]</em>[% ELSE %]default[% END %] framework. </p></div>
             [% END %]
                        <form method="get" action="/cgi-bin/koha/admin/fieldmapping.pl" id="selectframework">
                                <label for="framework">Framework:</label>
@@ -22,9 +23,9 @@
                     <option value="">Default</option>
                 [% FOREACH f IN frameworks %]
                     [% IF f.frameworkcode == framework.frameworkcode %]
-                    <option selected="selected" value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option>
+                    <option selected="selected" value="[% f.frameworkcode | html %]">[% f.frameworktext | html %]</option>
                     [% ELSE %]
-                    <option value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option>
+                    <option value="[% f.frameworkcode | html %]">[% f.frameworktext | html %]</option>
                     [% END %]
                 [% END %]
                 </select>
@@ -33,7 +34,7 @@
 
 
                        <form method="post" action="" id="addfield">
-                <input type="hidden" name="framework" value="[% framework.frameworkcode %]" />
+                <input type="hidden" name="framework" value="[% framework.frameworkcode | html %]" />
                                <fieldset class="rows">
                                <legend>Add a mapping</legend>
                                <ol>
@@ -49,7 +50,7 @@
 
                 [% IF ( fields.count ) %]
                     <table>
-                    <caption>Mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext %]</em>[% ELSE %]default[% END %] framework</caption>
+                    <caption>Mappings for the [% IF framework.frameworktext %]<em>[% framework.frameworktext | html %]</em>[% ELSE %]default[% END %] framework</caption>
                                                                        <tr>
                                                                                <th>Field</th>
                                         <th>MARC field</th>
                                                                        </tr>
                                                                        [% FOREACH field IN fields %]
                                                                        <tr>
-                                        <td>[% field.field |html %]</td>
-                                                                               <td>[% field.fieldcode %]</td>
-                                                                               <td>[% field.subfieldcode %]</td>
-                                        <td><a class="btn btn-default btn-xs" href="?op=delete&amp;id=[% field.id %]&amp;framework=[% field.frameworkcode %]"><i class="fa fa-trash"></i> Delete</a></td>
+                                        <td>[% field.field | html %]</td>
+                                                                               <td>[% field.fieldcode | html %]</td>
+                                                                               <td>[% field.subfieldcode | html %]</td>
+                                        <td><a class="btn btn-default btn-xs" href="?op=delete&amp;id=[% field.id | html %]&amp;framework=[% field.frameworkcode | html %]"><i class="fa fa-trash"></i> Delete</a></td>
                                                                        </tr>
                                                                        [% END %]
                                                                </table>[% END %]
@@ -75,7 +76,7 @@
        </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $('#selectframework').find("input:submit").hide();
index f47d5f9..d8c0b37 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -92,7 +93,7 @@ table.grid td.default {
 </div>
 </div>
 
-<h2>Circulation alerts for [% Branches.GetName( branch ) || 'Default' %]</h2>
+<h2>Circulation alerts for [% Branches.GetName( branch ) || 'Default' | html %]</h2>
 <p>Click on the grid to toggle the settings.</p>
 
 <div id="alerttabs" class="toptabs">
@@ -108,16 +109,16 @@ table.grid td.default {
 <tr>
   <th>&nbsp;</th>
   [% FOREACH item_type IN item_types %]
-  <th>[% item_type.description %]</th>
+  <th>[% item_type.description | html %]</th>
   [% END %]
 </tr>
 </thead>
 <tbody>
 [% FOREACH grid_checkou IN grid_checkout %]
 <tr>
-  <th>[% grid_checkou.description %]</th>
+  <th>[% grid_checkou.description | html %]</th>
   [% FOREACH item IN grid_checkou.items %]
-  <td class="[% item.class %]" id="[% item.id %]">[% item.text %]</td>
+  <td class="[% item.class | html %]" id="[% item.id | html %]">[% item.text | html %]</td>
   [% END %]
 </tr>
 [% END %]
@@ -132,16 +133,16 @@ table.grid td.default {
 <tr>
   <th>&nbsp;</th>
   [% FOREACH item_type IN item_types %]
-  <th>[% item_type.description %]</th>
+  <th>[% item_type.description | html %]</th>
   [% END %]
 </tr>
 </thead>
 <tbody>
 [% FOREACH grid_checki IN grid_checkin %]
 <tr>
-  <th>[% grid_checki.description %]</th>
+  <th>[% grid_checki.description | html %]</th>
   [% FOREACH item IN grid_checki.items %]
-  <td class="[% item.class %]" id="[% item.id %]">[% item.text %]</td>
+  <td class="[% item.class | html %]" id="[% item.id | html %]">[% item.text | html %]</td>
   [% END %]
 </tr>
 [% END %]
@@ -159,9 +160,9 @@ table.grid td.default {
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
-        var $branch = "[% branch %]";
+        var $branch = "[% branch | html %]";
         $(function(){
             $('#alerttabs').tabs();
 
index c0ad079..45babac 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% USE AuthorisedValues %]
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;
     <a href="/cgi-bin/koha/admin/items_search_fields.pl">Item search fields</a> &rsaquo;
-    [% field.name |html %]
+    [% field.name | html %]
   </div>
 
   <div id="doc3" class="yui-t2">
     <div id="bd">
       <div id="yui-main">
         <div class="yui-b">
-          <h1>Item search field: [% field.label |html %]</h1>
+          <h1>Item search field: [% field.label | html %]</h1>
 
           <form action="/cgi-bin/koha/admin/items_search_field.pl" method="POST" class="validated">
             <fieldset class="rows">
@@ -42,7 +43,7 @@
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' %]
index 8db4c85..355adc6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% USE AuthorisedValues %]
@@ -26,7 +27,7 @@
 
           [% IF field_added %]
             <div class="dialog message">
-              Field successfully added: [% field_added.label |html %]
+              Field successfully added: [% field_added.label | html %]
             </div>
           [% ELSIF field_not_added %]
             <div class="dialog alert">
@@ -44,7 +45,7 @@
             </div>
           [% ELSIF field_updated %]
             <div class="dialog message">
-              Field successfully updated: [% field_updated.label %]
+              Field successfully updated: [% field_updated.label | html %]
             </div>
           [% ELSIF field_not_updated %]
             <div class="dialog alert">
                     <tbody>
                       [% FOREACH field IN fields %]
                         <tr>
-                          <td>[% field.name |html %]</td>
-                          <td>[% field.label |html %]</td>
-                          <td>[% field.tagfield %]</td>
-                          <td>[% field.tagsubfield %]</td>
-                          <td>[% field.authorised_values_category %]</td>
+                          <td>[% field.name | html %]</td>
+                          <td>[% field.label | html %]</td>
+                          <td>[% field.tagfield | html %]</td>
+                          <td>[% field.tagsubfield | html %]</td>
+                          <td>[% field.authorised_values_category | html %]</td>
                           <td>
-                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_field.pl?name=[% field.name |html %]" title="Edit [% field.name |html %] field"><i class="fa fa-pencil"></i> Edit</a>
-                            <a class="field-delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_fields.pl?op=del&name=[% field.name |html %]"><i class="fa fa-trash"></i> Delete</a>
+                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_field.pl?name=[% field.name | html %]" title="Edit [% field.name | html %] field"><i class="fa fa-pencil"></i> Edit</a>
+                            <a class="field-delete btn btn-default btn-xs" href="/cgi-bin/koha/admin/items_search_fields.pl?op=del&name=[% field.name | html %]"><i class="fa fa-trash"></i> Delete</a>
                           </td>
                         </tr>
                       [% END %]
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         var MSG_ITEM_SEARCH_DELETE_CONFIRM = _("Are you sure you want to delete this field?");
     </script>
-    [% Asset.js("js/item_search_fields.js") %]
+    [% Asset.js("js/item_search_fields.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 526ea9c..5e82aaf 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -6,16 +7,16 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Item types [% IF op == 'add_form' %]&rsaquo;
   [% IF ( itemtype ) %]
-Modify item type '[% itemtype.itemtype %]'
+Modify item type '[% itemtype.itemtype | html %]'
   [% ELSE %]
 Add item type
   [% END %]
 [% END %]
 [% IF op == 'delete_confirm' %]&rsaquo;
   [% IF ( total ) %]
-Cannot delete item type '[% itemtype.itemtype %]'
+Cannot delete item type '[% itemtype.itemtype | html %]'
   [% ELSE %]
-Delete item type '[% itemtype.itemtype %]'?
+Delete item type '[% itemtype.itemtype | html %]'?
   [% END %]
 [% END %]
 [% IF op == 'delete_confirmed' %]&rsaquo;
@@ -23,7 +24,7 @@ Data deleted
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
        fieldset.rows div.toptabs li { clear:none;margin-right:.5em;padding-bottom:0;width:auto; }
   fieldset.rows div.toptabs .ui-tabs-nav li.ui-tabs-active {background-color : #F4F8F9; }
@@ -38,16 +39,16 @@ Data deleted
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF op == 'add_form' %]
   [% IF itemtype %]
-<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Modify item type '[% itemtype.itemtype %]'
+<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Modify item type '[% itemtype.itemtype | html %]'
   [% ELSE %]
 <a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Add item type
   [% END %]
 [% END %]
 [% IF op == 'delete_confirm' %]
   [% IF total %]
-<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Cannot delete item type '[% itemtype.itemtype %]'
+<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Cannot delete item type '[% itemtype.itemtype | html %]'
   [% ELSE %]
-<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Delete item type '[% itemtype.itemtype %]'?
+<a href="/cgi-bin/koha/admin/itemtypes.pl">Item types</a> &rsaquo; Delete item type '[% itemtype.itemtype | html %]'?
   [% END %]
 [% END %]
 [% IF op == 'delete_confirmed' %]
@@ -69,7 +70,7 @@ Item types administration
 </div>[% END %]
 
 [% FOREACH m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this item type. Perhaps the value already exists.
@@ -88,7 +89,7 @@ Item types administration
         [% CASE 'cannot_be_deleted' %]
             Cannot delete this item type. <p><strong>This record is in use</strong>. Deletion is not possible.</p>
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -107,8 +108,8 @@ Item types administration
                 [% IF itemtype %]
                     <li>
                         <input type="hidden" name="is_a_modif" value="1" />
-                        <span class="label">Item type: </span> <input type="hidden" name="itemtype" value="[% itemtype.itemtype %]" />
-                        [% itemtype.itemtype %]
+                        <span class="label">Item type: </span> <input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
+                        [% itemtype.itemtype | html %]
                     </li>
                 [% ELSE %]
                     <li>
@@ -118,9 +119,9 @@ Item types administration
                 [% END %]
                 <li>
                     <label for="description" class="required">Description: </label>
-                    <input type="text" id="description" name="description" size="48" value="[% itemtype.description |html %]" required="required" /> <span class="required">Required</span>
+                    <input type="text" id="description" name="description" size="48" value="[% itemtype.description | html %]" required="required" /> <span class="required">Required</span>
                     [% IF can_be_translated %]
-                        <a href="/cgi-bin/koha/admin/localization.pl?entity=itemtypes&code=[% itemtype.itemtype %]" title="Translate item type [% itemtype.itemtype %]" rel="gb_page_center[600,500]"><i class="fa fa-pencil"></i> Translate into other languages</a>
+                        <a href="/cgi-bin/koha/admin/localization.pl?entity=itemtypes&code=[% itemtype.itemtype | html %]" title="Translate item type [% itemtype.itemtype | html %]" rel="gb_page_center[600,500]"><i class="fa fa-pencil"></i> Translate into other languages</a>
                     [% END %]
                 </li>
                 <li>
@@ -129,12 +130,12 @@ Item types administration
                     <option value="">None</option>
                         [% FOREACH cat IN searchcategory %]
                             [% IF cat.authorised_value == itemtype.searchcategory %]
-                                <option value="[% cat.authorised_value %]" selected="selected">
-                                    [% cat.lib %]
+                                <option value="[% cat.authorised_value | html %]" selected="selected">
+                                    [% cat.lib | html %]
                                 </option>
                             [% ELSE %]
-                                <option value="[% cat.authorised_value %]" >
-                                    [% cat.lib %]
+                                <option value="[% cat.authorised_value | html %]" >
+                                    [% cat.lib | html %]
                                 </option>
                             [% END %]
                         [% END %]
@@ -158,7 +159,7 @@ Item types administration
                             [% ELSE %]
                                 <li>
                             [% END %]
-                            <a href="#[% imageset.imagesetname %]">[% imageset.imagesetname %]</a>
+                            <a href="#[% imageset.imagesetname | html %]">[% imageset.imagesetname | html %]</a>
                             </li>
                         [% END %]
                         [% IF itemtype.image_location('intranet').match('^http') %]<li class="ui-tabs-active">[% ELSE %]<li>[% END %]<a href="#remote">Remote image</a></li>
@@ -171,18 +172,18 @@ Item types administration
                     </div>
 
                     [% FOREACH imageset IN imagesets %]
-                        <div id="[% imageset.imagesetname %]">
+                        <div id="[% imageset.imagesetname | html %]">
                             <ul>
                                 [% FOREACH image IN imageset.images %]
                                     <li style="float: none; display: inline-block; clear : none; width: auto;">
                                         <label>
                                             [% IF image.StaffImageUrl %]
-                                                <img src="[% image.StaffImageUrl %]" alt="[% image.StaffImageUrl %]" title="[% image.StaffImageUrl %]" />
+                                                <img src="[% image.StaffImageUrl | html %]" alt="[% image.StaffImageUrl | html %]" title="[% image.StaffImageUrl | html %]" />
                                             [% END %]
                                             [% IF image.checked %]
-                                                <input type="radio" name="image" value="[% image.KohaImage %]" checked="checked" />
+                                                <input type="radio" name="image" value="[% image.KohaImage | html %]" checked="checked" />
                                             [% ELSIF image.KohaImage %] <!-- to delete the radio button if there is no image after -->
-                                                <input type="radio" name="image" value="[% image.KohaImage %]" />
+                                                <input type="radio" name="image" value="[% image.KohaImage | html %]" />
                                             [% END %]
                                         </label>
                                     </li>
@@ -201,9 +202,9 @@ Item types administration
                                 [% ELSE %]
                                     <input type="radio" id="remote_image_check" name="image" value="remoteImage" />
                                 [% END %]
-                                <input type="text" name="remoteImage" size="48" maxlength="200" value="[% itemtype.imageurl %]" onmousedown="document.getElementById('remote_image_check').checked = true;" />
+                                <input type="text" name="remoteImage" size="48" maxlength="200" value="[% itemtype.imageurl | html %]" onmousedown="document.getElementById('remote_image_check').checked = true;" />
                                 [% IF itemtype.imageurl %]
-                                    <img src="[% itemtype.imageurl %]" alt="" />
+                                    <img src="[% itemtype.imageurl | html %]" alt="" />
                                 [% END %]
                             </li>
                         </ul>
@@ -232,19 +233,19 @@ Item types administration
                 </li>
                 <li>
                     <label for="rentalcharge">Rental charge: </label>
-                    <input type="text" id="rentalcharge" name="rentalcharge" size="10" value="[% itemtype.rentalcharge %]" />
+                    <input type="text" id="rentalcharge" name="rentalcharge" size="10" value="[% itemtype.rentalcharge | html %]" />
                 </li>
                 <li>
                     <label for="defaultreplacecost">Default replacement cost: </label>
-                    <input type="text" id="defaultreplacecost" name="defaultreplacecost" size="10" value="[% itemtype.defaultreplacecost %]" />
+                    <input type="text" id="defaultreplacecost" name="defaultreplacecost" size="10" value="[% itemtype.defaultreplacecost | html %]" />
                 </li>
                 <li>
                     <label for="processfee">Processing fee (when lost): </label>
-                    <input type="text" id="processfee" name="processfee" size="10" value="[% itemtype.processfee %]" />
+                    <input type="text" id="processfee" name="processfee" size="10" value="[% itemtype.processfee | html %]" />
                 </li>
                 <li>
                     <label for="checkinmsg">Checkin message: </label>
-                    <textarea id="checkinmsg" name="checkinmsg" cols="55" rows="5">[% itemtype.checkinmsg %]</textarea>
+                    <textarea id="checkinmsg" name="checkinmsg" cols="55" rows="5">[% itemtype.checkinmsg | html %]</textarea>
                 </li>
                 <li>
                     <label for="checkinmsgtype">Checkin message type: </label>
@@ -267,16 +268,16 @@ Item types administration
                         <option value=""></option>
                         [% FOREACH a IN AuthorisedValues.Get('SIP_MEDIA_TYPE') %]
                             [% IF a.authorised_value == itemtype.sip_media_type %]
-                                <option value="[% a.authorised_value %]" selected="selected">[% a.lib %]</option>
+                                <option value="[% a.authorised_value | html %]" selected="selected">[% a.lib | html %]</option>
                             [% ELSE %]
-                                <option value="[% a.authorised_value %]">[% a.lib %]</option>
+                                <option value="[% a.authorised_value | html %]">[% a.lib | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                 </li>
                 <li>
                     <label for="summary">Summary: </label>
-                   <textarea id="summary" name="summary" cols="55" rows="5">[% itemtype.summary %]</textarea>
+                   <textarea id="summary" name="summary" cols="55" rows="5">[% itemtype.summary | html %]</textarea>
                     <p>Enter a summary that will overwrite the default one in search results lists. Example, for a website itemtype : </p>
                     <p><b>&lt;a href="[856u]"&gt;open site&lt;/a&gt;</b> will show the link just below the title</p>
                 </li>
@@ -292,26 +293,26 @@ Item types administration
 
 [% IF op == 'delete_confirm' %]
     <div class="dialog alert">
-        <h3>Delete item type '[% itemtype.itemtype %]'?</h3>
+        <h3>Delete item type '[% itemtype.itemtype | html %]'?</h3>
         <table>
             <tr>
                 <th scope="row">Item type</th>
-                <td>[% itemtype.itemtype %]</td>
+                <td>[% itemtype.itemtype | html %]</td>
             </tr>
-            <tr><th scope="row">Description</th><td>[% itemtype.translated_description %]</td></tr>
+            <tr><th scope="row">Description</th><td>[% itemtype.translated_description | html %]</td></tr>
             [% UNLESS Koha.Preference('noItemTypeImages') %]
                 <tr>
                     <th scope="row">Image</th>
                     <td>
                         [% SET image_location = itemtype.image_location('intranet') %]
-                        [% IF image_location %]<img src="[% image_location %]" alt="" />[% END %]
+                        [% IF image_location %]<img src="[% image_location | html %]" alt="" />[% END %]
                     </td>
                 </tr>
             [% END %]
-            <tr><th scope="row">Rental charge</th><td>[% itemtype.rentalcharge | $Price %]</td></tr>
+            <tr><th scope="row">Rental charge</th><td>[% itemtype.rentalcharge | $Price | html %]</td></tr>
         </table>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
-            <input type="hidden" name="op" value="delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype %]" />
+            <input type="hidden" name="op" value="delete_confirmed" /><input type="hidden" name="itemtype" value="[% itemtype.itemtype | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this item type</button>
         </form>
         <form action="/cgi-bin/koha/admin/itemtypes.pl" method="post">
@@ -342,43 +343,43 @@ Item types administration
                 [% UNLESS Koha.Preference('noItemTypeImages') %]
                     <td>
                         [% SET image_location = itemtype.image_location('intranet') %]
-                        [% IF image_location %]<img src="[% image_location %]" alt="" />[% ELSE %]&nbsp;[% END %]
+                        [% IF image_location %]<img src="[% image_location | html %]" alt="" />[% ELSE %]&nbsp;[% END %]
                     </td>
                 [% END %]
             <td>
-              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype |html %]">
-                [% itemtype.itemtype %]
+              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype | html %]">
+                [% itemtype.itemtype | html %]
               </a>
             </td>
             <td>
                 [% IF itemtype.translated_descriptions.size %]
-                    [% itemtype.description %] (default)<br/>
+                    [% itemtype.description | html %] (default)<br/>
                     [% FOR description IN itemtype.translated_descriptions %]
                         [% IF description.translation == itemtype.translated_description %]
-                            <b>[% description.translation %]</b>
+                            <b>[% description.translation | html %]</b>
                         [% ELSE %]
-                            [% description.translation %] ([% description.lang %])
+                            [% description.translation | html %] ([% description.lang | html %])
                         [% END %]
                         <br/>
                     [% END %]
                 [% ELSE %]
-                    [% itemtype.description |html %]
+                    [% itemtype.description | html %]
                 [% END %]
             </td>
-            <td>[% itemtype.searchcategory %]</td>
+            <td>[% itemtype.searchcategory | html %]</td>
             <td>[% IF ( itemtype.notforloan ) %]Yes[% ELSE %]&nbsp;[% END %]</td>
             <td>[% IF ( itemtype.hideinopac ) %]Yes[% ELSE %]&nbsp;[% END %]</td>
             <td>
             [% UNLESS ( itemtype.notforloan ) %]
-              [% itemtype.rentalcharge | $Price %]
+              [% itemtype.rentalcharge | $Price | html %]
             [% END %]
             </td>
-            <td>[% itemtype.defaultreplacecost | $Price %]</td>
-            <td>[% itemtype.processfee | $Price %]</td>
-            <td>[% itemtype.checkinmsg | html | html_line_break %]</td>
+            <td>[% itemtype.defaultreplacecost | $Price | html %]</td>
+            <td>[% itemtype.processfee | $Price | html %]</td>
+            <td>[% itemtype.checkinmsg | html_line_break %]</td>
             <td class="actions">
-              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=delete_confirm&amp;itemtype=[% itemtype.itemtype |html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
+              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=add_form&amp;itemtype=[% itemtype.itemtype | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+              <a href="/cgi-bin/koha/admin/itemtypes.pl?op=delete_confirm&amp;itemtype=[% itemtype.itemtype | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
             </td>
           </tr>
           [% END %]
@@ -396,7 +397,7 @@ Item types administration
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'greybox.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
index a692ad2..0916e04 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Koha to MARC mapping</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_koha2marclinks" class="admin">
@@ -23,7 +24,7 @@
 <form action="/cgi-bin/koha/admin/koha2marclinks.pl" method="post" id="koha2marc">
 
 [% IF error_add %]
-    <div class="dialog alert">Failed to add mapping for [% error_info %]</div>
+    <div class="dialog alert">Failed to add mapping for [% error_info | html %]</div>
 [% END %]
 
 <table id="kohafields">
 <tbody>
 [% FOREACH loo IN loop %]
 <tr>
-    <td>[% loo.kohafield %]</td>
-    <td>[% loo.tagfield %]</td>
-    <td>[% loo.tagsubfield %]</td>
-    <td>[% loo.liblibrarian %]</td>
+    <td>[% loo.kohafield | html %]</td>
+    <td>[% loo.tagfield | html %]</td>
+    <td>[% loo.tagsubfield | html %]</td>
+    <td>[% loo.liblibrarian | html %]</td>
     <td class="actions">
         [% IF !loo.readonly %]
-            <a onclick="AddFld('[% loo.kohafield %]');" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Add</a>
-            [% IF loo.tagfield %] <a onclick="RemFld('[% loo.tagfield %]','[% loo.tagsubfield %]');" class="btn btn-default btn-xs"><i class="fa fa-remove"></i> Remove</a> [% END %]
+            <a onclick="AddFld('[% loo.kohafield | html %]');" class="btn btn-default btn-xs"><i class="fa fa-plus"></i> Add</a>
+            [% IF loo.tagfield %] <a onclick="RemFld('[% loo.tagfield | html %]','[% loo.tagsubfield | html %]');" class="btn btn-default btn-xs"><i class="fa fa-remove"></i> Remove</a> [% END %]
         [% END %]
     </td>
     </td>
@@ -69,7 +70,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         function AddFld(kohafield) {
             var fieldstr = prompt( _("Adding a mapping for: %s.").format(kohafield) + "\n" + _("Please enter field tag and subfield code, separated by a comma. (For control fields: add '@' as subfield code.)\nThe change will be applied immediately.") );
index b9b433f..5555ae1 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaSpan %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Library groups</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") %]
-[% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") %]
+[% Asset.css("lib/jquery/plugins/treetable/stylesheets/jquery.treetable.css") | $raw %]
+[% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %]
 <script type="text/javascript">
 //<![CDATA[
     $(document).ready(function() {
 [% IF added %]
     <div class="dialog message group-added">
         [% IF added.branchcode %]
-            [% added.library.branchname | $KohaSpan class = 'name' %] added to group.
+            [% added.library.branchname | $KohaSpan class = 'name' | html %] added to group.
         [% ELSE %]
-            Group [% added.title | $KohaSpan class = 'name' %] created.
+            Group [% added.title | $KohaSpan class = 'name' | html %] created.
         [% END %]
     </div>
 [% ELSIF deleted %]
     <div class="dialog message group-deleted">
         [% IF deleted.title %]
-            Group [% deleted.title | $KohaSpan class = 'name' %] has been deleted.
+            Group [% deleted.title | $KohaSpan class = 'name' | html %] has been deleted.
         [% ELSE %]
-            [% deleted.library | $KohaSpan class = 'name' %] has been removed from group.
+            [% deleted.library | $KohaSpan class = 'name' | html %] has been removed from group.
         [% END %]
     </div>
 [% ELSIF error_duplicate_title %]
     <div class="dialog alert error-duplicate-group-title">
-            A group with the title [% error_duplicate_title | $KohaSpan class = 'name' %] already exists.
+            A group with the title [% error_duplicate_title | $KohaSpan class = 'name' | html %] already exists.
     </div>
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
 
 [% BLOCK tree %]
-    <tr data-tt-id="[% group.id %]" data-tt-parent-id="[% group.parent_id %]">
+    <tr data-tt-id="[% group.id | html %]" data-tt-parent-id="[% group.parent_id | html %]">
         <td>
             [% IF group.branchcode %]
-                [% group.branchcode %]
+                [% group.branchcode | html %]
             [% ELSE %]
-                [% group.title %]
+                [% group.title | html %]
             [% END %]
         </td>
         <td>
             [% IF group.branchcode %]
-                [% group.library.branchname %]
+                [% group.library.branchname | html %]
             [% ELSE %]
-                [% group.description %]
+                [% group.description | html %]
             [% END %]
         </td>
         <td>
         </td>
         <td>
             [% IF group.branchcode %]
-                <button class="btn btn-default btn-sm remove-library" data-group-id="[% group.id %]" data-group-library="[% group.library.branchname %]" data-group-parent-title="[% group.parent.title %]" ><i class="fa fa-trash"></i> Remove from group</button>
+                <button class="btn btn-default btn-sm remove-library" data-group-id="[% group.id | html %]" data-group-library="[% group.library.branchname | html %]" data-group-parent-title="[% group.parent.title | html %]" ><i class="fa fa-trash"></i> Remove from group</button>
             [% ELSE %]
                 <div class="btn-group">
                     <button class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown"><i class="fa fa-wrench"></i> Actions <span class="caret"></span></button>
                     <ul class="dropdown-menu">
                         <li>
-                            <a id="add-group-[% group.id %]" href="#" class="add-group" data-group-id="[% group.id %]">
+                            <a id="add-group-[% group.id | html %]" href="#" class="add-group" data-group-id="[% group.id | html %]">
                                 <i class="fa fa-plus"></i> Add sub-group
                             </a>
                        </li>
 
                         <li>
-                            <a class="edit-group" id="edit-group-[% group.id %]" href="#" class="edit-group" data-group-id="[% group.id %]" data-group-parent-id="[% group.parent_id %]" data-group-title="[% group.title | html %]" data-group-description="[% group.description | html %]" data-group-ft_hide_patron_info="[% group.ft_hide_patron_info | html %]" data-group-ft_search_groups_opac="[% group.ft_search_groups_opac | html %]" data-group-ft_search_groups_staff="[% group.ft_search_groups_staff | html %]" >
+                            <a class="edit-group" id="edit-group-[% group.id | html %]" href="#" class="edit-group" data-group-id="[% group.id | html %]" data-group-parent-id="[% group.parent_id | html %]" data-group-title="[% group.title | html %]" data-group-description="[% group.description | html %]" data-group-ft_hide_patron_info="[% group.ft_hide_patron_info | html %]" data-group-ft_search_groups_opac="[% group.ft_search_groups_opac | html %]" data-group-ft_search_groups_staff="[% group.ft_search_groups_staff | html %]" >
                                 <i class="fa fa-pencil"></i> Edit
                             </a>
                        </li>
 
                         <li>
-                            <a class="delete-group" id="delete-group-[% group.id %]" href="#" class="delete-group" data-group-id="[% group.id %]" data-group-title="[% group.title | html %]">
+                            <a class="delete-group" id="delete-group-[% group.id | html %]" href="#" class="delete-group" data-group-id="[% group.id | html %]" data-group-title="[% group.title | html %]">
                                 <i class="fa fa-trash"></i> Delete
                             </a>
                        </li>
                     <ul class="dropdown-menu">
                         [% FOREACH library IN group.libraries_not_direct_children %]
                             <li>
-                                <a class="add-library" id="add-library-[% group.id %]" href="/cgi-bin/koha/admin/library_groups.pl?action=add&parent_id=[% group.id %]&branchcode=[% library.id %]">
-                                    [% library.branchname %]
+                                <a class="add-library" id="add-library-[% group.id | html %]" href="/cgi-bin/koha/admin/library_groups.pl?action=add&parent_id=[% group.id | html %]&branchcode=[% library.id | html %]">
+                                    [% library.branchname | html %]
                                 </a>
                            </li>
                         [% END %]
index fc62473..841ac57 100644 (file)
@@ -1,23 +1,24 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Localization</title>
 [% INCLUDE 'doc-head-close.inc' popup => 1 %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_localization" class="admin">
 <div id="main">
 <form id="add_translation" method="post">
-    <input type="hidden" name="entity" value="[% entity %]" />
-    <input type="hidden" name="code" value="[% code %]" />
+    <input type="hidden" name="entity" value="[% entity | html %]" />
+    <input type="hidden" name="code" value="[% code | html %]" />
     Lang: <select name="lang">
         [% FOR language IN languages %]
             [% FOR sublanguage IN language.sublanguages_loop %]
                 [% IF language.plural %]
-                    <option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] [% sublanguage.region_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                    <option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                 [% ELSE %]
-                    <option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                    <option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                 [% END %]
             [% END %]
         [% END %]
     </thead>
     <tbody>
         [% FOR t IN translations %]
-        <tr id="row_id_[% t.id %]" data-id="[% t.id %]">
-            <td>[% t.id %]</td>
-            <td>[% t.entity %]</td>
-            <td>[% t.code %]</td>
-            <td class="lang">[% t.lang %]</td>
-            <td class="translation" contenteditable="true">[% t.translation %]</td>
+        <tr id="row_id_[% t.id | html %]" data-id="[% t.id | html %]">
+            <td>[% t.id | html %]</td>
+            <td>[% t.entity | html %]</td>
+            <td>[% t.code | html %]</td>
+            <td class="lang">[% t.lang | html %]</td>
+            <td class="translation" contenteditable="true">[% t.translation | html %]</td>
             <td class="actions"><a href="#" class="delete"><i class="fa fa-trash"></i> Delete</a></td>
         </tr>
         [% END %]
                 [% FOR sublanguage IN language.sublanguages_loop %]
                     var option;
                     [% IF language.plural %]
-                        option = $('<option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] [% sublanguage.region_description %] ([% sublanguage.rfc4646_subtag %])</option>');
+                        option = $('<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>');
                         $(languages_select).append(option);
                     [% ELSE %]
-                        option = $('<option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] ([% sublanguage.rfc4646_subtag %])</option>');
+                        option = $('<option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>');
                     [% END %]
                     $(languages_select).append(option);
                 [% END %]
index 199bbe8..4dceab0 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Administration &rsaquo;[% IF ( add_form ) %][% IF ( use_heading_flags_p ) %][% IF ( heading_edit_subfields_p ) %] MARC subfield structure &rsaquo; Edit MARC subfields constraints[% END %][% ELSE %] MARC subfield structure &rsaquo; [% action %][% END %][% END %]
-[% IF ( delete_confirm ) %] MARC subfield structure &rsaquo; Confirm deletion of subfield [% tagsubfield %][% END %][% IF ( delete_confirmed ) %] MARC subfield structure &rsaquo; Subfield deleted[% END %][% IF ( else ) %]MARC subfield structure[% END %]</title>
+<title>Koha &rsaquo; Administration &rsaquo;[% IF ( add_form ) %][% IF ( use_heading_flags_p ) %][% IF ( heading_edit_subfields_p ) %] MARC subfield structure &rsaquo; Edit MARC subfields constraints[% END %][% ELSE %] MARC subfield structure &rsaquo; [% action | html %][% END %][% END %]
+[% IF ( delete_confirm ) %] MARC subfield structure &rsaquo; Confirm deletion of subfield [% tagsubfield | html %][% END %][% IF ( delete_confirmed ) %] MARC subfield structure &rsaquo; Subfield deleted[% END %][% IF ( else ) %]MARC subfield structure[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 [% INCLUDE 'prefs-admin-search.inc' %]
 
 <div id="breadcrumbs">
-  <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/biblio_framework.pl">MARC frameworks</a> &rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% frameworkcode %]&amp;searchfield=[% tagfield | uri %]">[% IF ( frameworkcode ) %][% frameworkcode %][% ELSE %]Default[% END %] framework structure</a> &rsaquo;
+  <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/biblio_framework.pl">MARC frameworks</a> &rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% frameworkcode | html %]&amp;searchfield=[% tagfield | uri %]">[% IF ( frameworkcode ) %][% frameworkcode | html %][% ELSE %]Default[% END %] framework structure</a> &rsaquo;
   [% IF ( add_form ) %]
   [% IF ( use_heading_flags_p ) %]
-  [% IF ( heading_edit_subfields_p ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode %]">Tag [% tagfield | html %] subfield structure</a> &rsaquo; Edit subfields constraints
+  [% IF ( heading_edit_subfields_p ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode | html %]">Tag [% tagfield | html %] subfield structure</a> &rsaquo; Edit subfields constraints
   [% END %]
-  [% ELSE %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode %]">Tag [% tagfield | html %] Subfield structure</a> &rsaquo; [% action %]
+  [% ELSE %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode | html %]">Tag [% tagfield | html %] Subfield structure</a> &rsaquo; [% action | html %]
   [% END %]
   [% END %]
-[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode %]">Tag [% tagfield | html %] Subfield structure</a> &rsaquo; Confirm deletion of subfield [% tagsubfield %]
+[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode | html %]">Tag [% tagfield | html %] Subfield structure</a> &rsaquo; Confirm deletion of subfield [% tagsubfield | html %]
 [% END %]
-[% IF ( delete_confirmed ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode %]">Tag [% tagfield | html %] subfield structure</a> &rsaquo; Subfield deleted
+[% IF ( delete_confirmed ) %] <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode | html %]">Tag [% tagfield | html %] subfield structure</a> &rsaquo; Subfield deleted
 [% END %]
 [% IF ( else ) %]Tag [% tagfield | html %] Subfield structure[% END %]
 </div>
         [% IF ( use_heading_flags_p ) %]
             [% IF ( heading_edit_subfields_p ) %]Tag [% tagfield | html %] Subfield constraints[% END %]
         [% ELSE %]
-            [% action %]
+            [% action | html %]
         [% END %]
     </h1>
-    <form action="[% script_name %]" name="Aform" method="post">
+    <form action="[% script_name | html %]" name="Aform" method="post">
     <input type="hidden" name="op" value="add_validate" />
     <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
-    <input type="hidden" name="frameworkcode" value="[% frameworkcode %]" />
+    <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
     <div id="subfieldtabs" class="toptabs numbered">
    <ul>
         [% FOREACH loo IN loop %]
             [% IF ( loo.new_subfield ) %]
-                <li><a href="#sub[% loo.urisubfieldcode %]field" title="[% loo.liblibrarian | html_entity %]">New</a></li>
+                <li><a href="#sub[% loo.urisubfieldcode | html %]field" title="[% loo.liblibrarian | html_entity %]">New</a></li>
             [% ELSE %]
-                <li><a href="#sub[% loo.urisubfieldcode %]field" title="[% loo.liblibrarian | html_entity %]">
-                    [% loo.subfieldcode %]
+                <li><a href="#sub[% loo.urisubfieldcode | html %]field" title="[% loo.liblibrarian | html_entity %]">
+                    [% loo.subfieldcode | html %]
                </a></li>
             [% END %]
         [% END %]
     </ul>
     
     [% FOREACH loo IN loop %] 
-        <div class="constraints" id="sub[% loo.urisubfieldcode %]field">
+        <div class="constraints" id="sub[% loo.urisubfieldcode | html %]field">
 
-               <h3><a href="#basic[% loo.urisubfieldcode %]">Basic constraints</a></h3>
-                    <div id="basic[% loo.urisubfieldcode %]">
+               <h3><a href="#basic[% loo.urisubfieldcode | html %]">Basic constraints</a></h3>
+                    <div id="basic[% loo.urisubfieldcode | html %]">
                     <fieldset class="rows">
                        <ol>
                                [% IF ( subfieldcode == 0 || subfieldcode ) %] 
-                               <li><span class="label">Subfield code:</span> [% loo.subfieldcode %] <input type="hidden" name="tagsubfield" value="[% loo.subfieldcode %]" /></li>
+                               <li><span class="label">Subfield code:</span> [% loo.subfieldcode | html %] <input type="hidden" name="tagsubfield" value="[% loo.subfieldcode | html %]" /></li>
                                [% ELSE %]
-                               <li><label for="tagsubfield[% loo.row %]">Subfield code:</label> <input type="text" id="tagsubfield[% loo.row %]" name="tagsubfield" value="[% loo.subfieldcode %]" /></li>
+                               <li><label for="tagsubfield[% loo.row | html %]">Subfield code:</label> <input type="text" id="tagsubfield[% loo.row | html %]" name="tagsubfield" value="[% loo.subfieldcode | html %]" /></li>
                                [% END %]
-                        <li><label for="liblibrarian[% loo.row %]">Text for librarian: </label><input id="liblibrarian[% loo.row %]" type="text" name="liblibrarian" value="[% loo.liblibrarian | html_entity %]" size="40" maxlength="80" /></li>
-                        <li><label for="libopac[% loo.row %]">Text for OPAC: </label><input type="text" id="libopac[% loo.row %]" name="libopac" value="[% loo.libopac | html_entity %]" size="40" maxlength="80" /></li>
+                        <li><label for="liblibrarian[% loo.row | html %]">Text for librarian: </label><input id="liblibrarian[% loo.row | html %]" type="text" name="liblibrarian" value="[% loo.liblibrarian | html_entity %]" size="40" maxlength="80" /></li>
+                        <li><label for="libopac[% loo.row | html %]">Text for OPAC: </label><input type="text" id="libopac[% loo.row | html %]" name="libopac" value="[% loo.libopac | html_entity %]" size="40" maxlength="80" /></li>
                         <li>
-                            <label for="repeatable[% loo.row %]">Repeatable: </label>
+                            <label for="repeatable[% loo.row | html %]">Repeatable: </label>
                             [% IF loo.repeatable %]
-                                <input type="checkbox" id="repeatable[% loo.row %]" name="repeatable[% loo.row %]" checked="checked" value="1" />
+                                <input type="checkbox" id="repeatable[% loo.row | html %]" name="repeatable[% loo.row | html %]" checked="checked" value="1" />
                             [% ELSE %]
-                                <input type="checkbox" id="repeatable[% loo.row %]" name="repeatable[% loo.row %]" value="1" />
+                                <input type="checkbox" id="repeatable[% loo.row | html %]" name="repeatable[% loo.row | html %]" value="1" />
                             [% END %]
                         </li>
                         <li>
-                            <label for="mandatory[% loo.row %]">Mandatory: </label>
+                            <label for="mandatory[% loo.row | html %]">Mandatory: </label>
                             [% IF loo.mandatory %]
-                                <input type="checkbox" id="mandatory[% loo.row %]" name="mandatory[% loo.row %]" checked="checked" value="1" />
+                                <input type="checkbox" id="mandatory[% loo.row | html %]" name="mandatory[% loo.row | html %]" checked="checked" value="1" />
                             [% ELSE %]
-                                <input type="checkbox" id="mandatory[% loo.row %]" name="mandatory[% loo.row %]" value="1" />
+                                <input type="checkbox" id="mandatory[% loo.row | html %]" name="mandatory[% loo.row | html %]" value="1" />
                             [% END %]
                         </li>
-                        <li><label for="tab[% loo.row %]">Managed in tab: </label>
-                            <select name="tab" tabindex="" size="1" id="tab[% loo.row %]">
+                        <li><label for="tab[% loo.row | html %]">Managed in tab: </label>
+                            <select name="tab" tabindex="" size="1" id="tab[% loo.row | html %]">
                             [%- IF ( loo.tab ==  -1 ) -%]
                                 <option value="-1" selected="selected">ignore</option>
                             [%- ELSE -%]
@@ -96,9 +97,9 @@
                             [%- END -%]
                             [%- FOREACH t IN [ '0', '1', '2', '3', '4', '5', '6', '7', '8', '9'] -%]
                                 [%- IF ( loo.tab ==  t ) -%]
-                                <option value="[%- t -%]" selected="selected">[%- t -%]</option>
+                                <option value="[%- t | html -%]" selected="selected">[%- t | html -%]</option>
                                 [%- ELSE -%]
-                                <option value="[%- t -%]">[%- t -%]</option>
+                                <option value="[%- t | html -%]">[%- t | html -%]</option>
                                 [%- END -%]
                             [%- END -%]
                             [%- IF ( loo.tab ==  10 ) -%]
                     </div>
 
 
-            <h3><a href="#advanced[% loo.urisubfieldcode %]">Advanced constraints</a></h3>
-            <div id="advanced[% loo.urisubfieldcode %]">
+            <h3><a href="#advanced[% loo.urisubfieldcode | html %]">Advanced constraints</a></h3>
+            <div id="advanced[% loo.urisubfieldcode | html %]">
             <fieldset class="rows">
-                <ol><li><label for="defaultvalue[% loo.row %]">Default value:</label>
-                    <input type="text" name="defaultvalue" id="defaultvalue[% loo.row %]" value="[% loo.defaultvalue %]" /></li>
-                               <li><label for="maxlength[% loo.row %]">Max length:</label><input type="text" id="maxlength[% loo.row %]" name="maxlength" value="[% loo.maxlength %]" size="4" /> (see online help)</li>
-                <li><input type="hidden" id="hidden-[% loo.row %]" name="hidden" value="[% loo.hidden %]" />
-                    <label for="hidden[% loo.row %]" style="float: none;">Visibility: </label>
-                    <input type="checkbox" id="hidden_opac_[% loo.row %]" class="inclusive_[% loo.row %]" name="hidden_opac_[% loo.row %]"/>
-                    <label for="hidden_opac_[% loo.row %]" style="float: none;">OPAC</label>
-                    <input type="checkbox" id="hidden_intranet_[% loo.row %]" class="inclusive_[% loo.row %]" name="hidden_intranet_[% loo.row %]"/>
-                    <label for="hidden_intranet_[% loo.row %]" style="float: none;">Intranet</label>
-                    <input type="checkbox" id="hidden_editor_[% loo.row %]" class="inclusive_[% loo.row %]" name="hidden_editor_[% loo.row %]"/>
-                    <label for="hidden_editor_[% loo.row %]" style="float: none;">Editor</label>
-                    <input type="checkbox" id="hidden_collapsed_[% loo.row %]" class="inclusive_[% loo.row %]" name="hidden_collapsed_[% loo.row %]"/>
-                    <label for="hidden_collapsed_[% loo.row %]" style="float: none;">Collapsed</label>
-                    <input type="checkbox" id="hidden_flagged_[% loo.row %]" name="flagged_[% loo.row %]"/>
-                    <label for="hidden_flagged_[% loo.row %]" style="float: none;">Flagged</label>
+                <ol><li><label for="defaultvalue[% loo.row | html %]">Default value:</label>
+                    <input type="text" name="defaultvalue" id="defaultvalue[% loo.row | html %]" value="[% loo.defaultvalue | html %]" /></li>
+                               <li><label for="maxlength[% loo.row | html %]">Max length:</label><input type="text" id="maxlength[% loo.row | html %]" name="maxlength" value="[% loo.maxlength | html %]" size="4" /> (see online help)</li>
+                <li><input type="hidden" id="hidden-[% loo.row | html %]" name="hidden" value="[% loo.hidden | html %]" />
+                    <label for="hidden[% loo.row | html %]" style="float: none;">Visibility: </label>
+                    <input type="checkbox" id="hidden_opac_[% loo.row | html %]" class="inclusive_[% loo.row | html %]" name="hidden_opac_[% loo.row | html %]"/>
+                    <label for="hidden_opac_[% loo.row | html %]" style="float: none;">OPAC</label>
+                    <input type="checkbox" id="hidden_intranet_[% loo.row | html %]" class="inclusive_[% loo.row | html %]" name="hidden_intranet_[% loo.row | html %]"/>
+                    <label for="hidden_intranet_[% loo.row | html %]" style="float: none;">Intranet</label>
+                    <input type="checkbox" id="hidden_editor_[% loo.row | html %]" class="inclusive_[% loo.row | html %]" name="hidden_editor_[% loo.row | html %]"/>
+                    <label for="hidden_editor_[% loo.row | html %]" style="float: none;">Editor</label>
+                    <input type="checkbox" id="hidden_collapsed_[% loo.row | html %]" class="inclusive_[% loo.row | html %]" name="hidden_collapsed_[% loo.row | html %]"/>
+                    <label for="hidden_collapsed_[% loo.row | html %]" style="float: none;">Collapsed</label>
+                    <input type="checkbox" id="hidden_flagged_[% loo.row | html %]" name="flagged_[% loo.row | html %]"/>
+                    <label for="hidden_flagged_[% loo.row | html %]" style="float: none;">Flagged</label>
                 </li>
                 <li>
-                    <label for="isurl[% loo.row %]">Is a URL:</label>
+                    <label for="isurl[% loo.row | html %]">Is a URL:</label>
                     [% IF loo.isurl %]
-                        <input type="checkbox" id="isurl[% loo.row %]" name="isurl[% loo.row %]" checked="checked" value="1" />
+                        <input type="checkbox" id="isurl[% loo.row | html %]" name="isurl[% loo.row | html %]" checked="checked" value="1" />
                     [% ELSE %]
-                        <input type="checkbox" id="isurl[% loo.row %]" name="isurl[% loo.row %]" value="1" />
+                        <input type="checkbox" id="isurl[% loo.row | html %]" name="isurl[% loo.row | html %]" value="1" />
                     [% END %]
                     (if checked, it means that the subfield is a URL and can be clicked)
                 </li>
-                <li><label for="link[% loo.row %]">Link:</label><input type="text" id="link[% loo.row %]" name="link" value="[% loo.link %]" size="10" maxlength="80" /> (e.g., Title or Local-Number) <span class="error"><em>NOTE: If you change this value you must ask your administrator to run misc/batchRebuildBiblioTables.pl.</em></span></li>
+                <li><label for="link[% loo.row | html %]">Link:</label><input type="text" id="link[% loo.row | html %]" name="link" value="[% loo.link | html %]" size="10" maxlength="80" /> (e.g., Title or Local-Number) <span class="error"><em>NOTE: If you change this value you must ask your administrator to run misc/batchRebuildBiblioTables.pl.</em></span></li>
                 <li>
-                    <label for="kohafield[% loo.row %]">Koha link:</label>
+                    <label for="kohafield[% loo.row | html %]">Koha link:</label>
                     <!-- This select should be DISABLED; value is submitted by the following hidden input -->
-                    <select name="kohafield" id="kohafield[% loo.row %]" size="1" disabled>
+                    <select name="kohafield" id="kohafield[% loo.row | html %]" size="1" disabled>
                     [% FOREACH value IN loo.kohafields %]
                       [% IF ( value == loo.kohafield ) %]
-                        <option value="[% value %]" selected="selected">[% value %]</option>
+                        <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                       [% ELSE %]
-                        <option value="[% value %]">[% value %]</option>
+                        <option value="[% value | html %]">[% value | html %]</option>
                       [% END %]
                     [% END %]
                     </select>
                     <!-- Do NOT remove this next hidden input! We need it to save kohafield. -->
-                    <input type="hidden" name="kohafield" value="[% loo.kohafield %]"/>
+                    <input type="hidden" name="kohafield" value="[% loo.kohafield | html %]"/>
                 </li>
                        </ol>
             </fieldset>
             </div>
-            <h3><a href="#oth[% loo.urisubfieldcode %]">Other options (choose one)</a></h3>
-            <div id="oth[% loo.urisubfieldcode %]">
+            <h3><a href="#oth[% loo.urisubfieldcode | html %]">Other options (choose one)</a></h3>
+            <div id="oth[% loo.urisubfieldcode | html %]">
             <fieldset class="rows">
                        <ol>
                             <li>
-                                <label for="authorised_value[% loo.row %]">Authorized value:</label>
-                                <select name="authorised_value" id="authorised_value[% loo.row %]" size="1">
+                                <label for="authorised_value[% loo.row | html %]">Authorized value:</label>
+                                <select name="authorised_value" id="authorised_value[% loo.row | html %]" size="1">
                                 <option value=""></option>
                                 [% FOREACH value IN loo.authorised_values %]
                                     [% IF ( value == loo.authorised_value ) %]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [% ELSE %]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [% END %]
                                 [% END %]
                                 </select>
                             </li>
                             <li>
-                                <label for="authtypecode[% loo.row %]">Thesaurus:</label>
-                                <select name="authtypecode" id="authtypecode[% loo.row %]" size="1">
+                                <label for="authtypecode[% loo.row | html %]">Thesaurus:</label>
+                                <select name="authtypecode" id="authtypecode[% loo.row | html %]" size="1">
                                 [% FOREACH value IN loo.authtypes %]
                                     [% IF ( value == loo.authtypecode ) %]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [% ELSE %]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [% END %]
                                 [% END %]
                                 </select>
                             </li>
                             <li>
-                                <label for="value_builder[% loo.row %]">Plugin:</label>
-                                <select name="value_builder" id="value_builder[% loo.row %]" size="1">
+                                <label for="value_builder[% loo.row | html %]">Plugin:</label>
+                                <select name="value_builder" id="value_builder[% loo.row | html %]" size="1">
                                 [% FOREACH value IN loo.value_builders %]
                                     [% IF ( value == loo.value_builder ) %]
-                                    <option value="[% value %]" selected="selected">[% value %]</option>
+                                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                                     [% ELSE %]
-                                    <option value="[% value %]">[% value %]</option>
+                                    <option value="[% value | html %]">[% value | html %]</option>
                                     [% END %]
                                 [% END %]
                                 </select>
         [% END %]
                </div><!-- /content -->
     <fieldset class="action">
-        <input type="submit" value="Save changes" /> <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield  | uri %]&amp;frameworkcode=[% frameworkcode %]" class="cancel">Cancel</a>
+        <input type="submit" value="Save changes" /> <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?tagfield=[% tagfield  | uri %]&amp;frameworkcode=[% frameworkcode | html %]" class="cancel">Cancel</a>
     </fieldset>
     </form>
 [% END %]
 [% IF ( delete_confirm ) %]
 
     <div class="dialog alert">
-        <h3>Confirm deletion of subfield [% tagsubfield %]?</h3>
-        <p>Subfield: [% tagsubfield %]</p>
+        <h3>Confirm deletion of subfield [% tagsubfield | html %]?</h3>
+        <p>Subfield: [% tagsubfield | html %]</p>
         <p>Description: [% liblibrarian | html_entity %]</p>
 
-        <form action="[% delete_link %]" method="post"><input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
+        <form action="[% delete_link | html %]" method="post"><input type="hidden" name="op" value="delete_confirmed" />
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
-            <input type="hidden" name="tagsubfield" value="[% tagsubfield %]" />
-            <input type="hidden" name="frameworkcode" value="[% frameworkcode %]" />
+            <input type="hidden" name="tagsubfield" value="[% tagsubfield | html %]" />
+            <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this subfield</button>
         </form>
 
 
-        <form action="[% script_name %]" method="post">
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
-            <input type="hidden" name="tagfield" value="[% tagfield | html%]" />
-            <input type="hidden" name="tagsubfield" value="[% tagsubfield %]" />
-            <input type="hidden" name="frameworkcode" value="[% frameworkcode %]" />
+        <form action="[% script_name | html %]" method="post">
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
+            <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
+            <input type="hidden" name="tagsubfield" value="[% tagsubfield | html %]" />
+            <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% IF ( delete_confirmed ) %]
 
     <h3>Data deleted</h3>
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <input type="hidden" name="tagfield" value="[% tagfield | html %]" />
     <input type="submit" value="OK" />
     </form>
 
 
 [% IF ( else ) %]
-<h1>MARC subfield structure admin for [% tagfield | html %] [% IF ( frameworkcode ) %](framework [% frameworkcode %])[% ELSE %](default framework)[% END %]</h1>
+<h1>MARC subfield structure admin for [% tagfield | html %] [% IF ( frameworkcode ) %](framework [% frameworkcode | html %])[% ELSE %](default framework)[% END %]</h1>
 <p>This screen shows the subfields associated with the selected tag. You can edit subfields or add a new one by clicking on edit.</p>
 <p>The column 'Koha field' shows that the subfield is linked with a Koha field.</p>
 
 </tr>
 [% FOREACH loo IN loop %]
 <tr>
-    <td><a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&amp;tagfield=[% loo.tagfield %]&amp;frameworkcode=[% frameworkcode %]#sub[% loo.tagsubfield %]field">[% loo.tagsubfield %]</a></td>
+    <td><a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&amp;tagfield=[% loo.tagfield | html %]&amp;frameworkcode=[% frameworkcode | html %]#sub[% loo.tagsubfield | html %]field">[% loo.tagsubfield | html %]</a></td>
     <td>
         [% IF ( loo.subfield_ignored ) %]
             <i>[% loo.liblibrarian | html_entity %]</i>
         [% IF ( loo.subfield_ignored ) %]
             <i>subfield ignored</i>
         [% ELSE %]
-            Tab:[% loo.tab %],
-            [% IF ( loo.kohafield ) %] | Koha field: [% loo.kohafield %], [% END %]
+            Tab:[% loo.tab | html %],
+            [% IF ( loo.kohafield ) %] | Koha field: [% loo.kohafield | html %], [% END %]
             [% IF ( loo.repeatable ) %]Repeatable, [% ELSE %]Not repeatable,[% END %]
             [% IF ( loo.mandatory ) %]Mandatory, [% ELSE %]Not mandatory,[% END %]
-            [% IF ( loo.seealso ) %] | See Also: [% loo.seealso %],[% END %]
+            [% IF ( loo.seealso ) %] | See Also: [% loo.seealso | html %],[% END %]
             [% IF ( loo.hidden ) %]hidden,[% END %]
             [% IF ( loo.isurl ) %]is a URL,[% END %]
-            [% IF ( loo.authorised_value ) %] | Auth value:[% loo.authorised_value %],[% END %]
-            [% IF ( loo.authtypecode ) %] | Authority:[% loo.authtypecode %],[% END %]
-            [% IF ( loo.value_builder ) %] | Plugin:[% loo.value_builder %],[% END %]
-            [% IF ( loo.link ) %] | Link:[% loo.link %],[% END %]
+            [% IF ( loo.authorised_value ) %] | Auth value:[% loo.authorised_value | html %],[% END %]
+            [% IF ( loo.authtypecode ) %] | Authority:[% loo.authtypecode | html %],[% END %]
+            [% IF ( loo.value_builder ) %] | Plugin:[% loo.value_builder | html %],[% END %]
+            [% IF ( loo.link ) %] | Link:[% loo.link | html %],[% END %]
         [% END %]
     </td>
     <td class="actions">
-        <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&amp;tagfield=[% loo.tagfield %]&amp;frameworkcode=[% frameworkcode %]#sub[% loo.tagsubfield %]field" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-        <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=delete_confirm&amp;tagfield=[% loo.tagfield %]&amp;tagsubfield=[% loo.tagsubfield %]&amp;frameworkcode=[% frameworkcode %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
+        <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&amp;tagfield=[% loo.tagfield | html %]&amp;frameworkcode=[% frameworkcode | html %]#sub[% loo.tagsubfield | html %]field" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+        <a href="/cgi-bin/koha/admin/marc_subfields_structure.pl?op=delete_confirm&amp;tagfield=[% loo.tagfield | html %]&amp;tagsubfield=[% loo.tagsubfield | html %]&amp;frameworkcode=[% frameworkcode | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
     </td>
 </tr>
 [% END %]
 </table>
 
-<form action="[% script_name %]" method="get">
+<form action="[% script_name | html %]" method="get">
     <fieldset class="action"><input type="hidden" name="op" value="add_form" />
-    <input type="hidden" name="tagfield" value="[% edit_tagfield %]" />
-    <input type="hidden" name="frameworkcode" value="[% edit_frameworkcode %]" />
+    <input type="hidden" name="tagfield" value="[% edit_tagfield | html %]" />
+    <input type="hidden" name="frameworkcode" value="[% edit_frameworkcode | html %]" />
     <input type="submit" value="Edit subfields" />
-        <a class="cancel" href="marctagstructure.pl?searchfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode %]">Cancel</a>
+        <a class="cancel" href="marctagstructure.pl?searchfield=[% tagfield | uri %]&amp;frameworkcode=[% frameworkcode | html %]">Cancel</a>
        </fieldset>
 </form>
 
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
-    [% Asset.js("js/marc_subfields_structure.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
+    [% Asset.js("js/marc_subfields_structure.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index 0d0431f..ae9f628 100644 (file)
@@ -1,14 +1,15 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo;
-[% IF ( add_form ) %]MARC frameworks &rsaquo; [% action %] [% searchfield %][% END %]
-[% IF ( delete_confirm ) %]MARC frameworks &rsaquo; Confirm deletion of tag '[% searchfield %]'[% END %]
+[% IF ( add_form ) %]MARC frameworks &rsaquo; [% action | html %] [% searchfield | html %][% END %]
+[% IF ( delete_confirm ) %]MARC frameworks &rsaquo; Confirm deletion of tag '[% searchfield | html %]'[% END %]
 [% IF ( delete_confirmed ) %]MARC frameworks &rsaquo;  Data deleted[% END %]
 [% IF ( else ) %]MARC frameworks[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_marctagstructure" class="admin">
 &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a>
 &rsaquo; <a href="/cgi-bin/koha/admin/biblio_framework.pl">MARC frameworks</a>
 [% IF ( add_form ) %]
-&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode %]">[% IF framework %][% framework.frameworktext |html %] ([% framework.frameworkcode %])[% ELSE %]Default MARC framework[% END%]</a>
-&rsaquo; [% action %] [% searchfield %]
+&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode | html %]">[% IF framework %][% framework.frameworktext | html %] ([% framework.frameworkcode | html %])[% ELSE %]Default MARC framework[% END%]</a>
+&rsaquo; [% action | html %] [% searchfield | html %]
 [% ELSIF ( else ) %]
-&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode %]">[% IF framework %][% framework.frameworktext |html %] ([% framework.frameworkcode %])[% ELSE %]Default MARC framework[% END %]</a>
+&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode | html %]">[% IF framework %][% framework.frameworktext | html %] ([% framework.frameworkcode | html %])[% ELSE %]Default MARC framework[% END %]</a>
 [% ELSIF ( delete_confirm ) %]
-&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode %]">[% IF framework %][% framework.frameworktext |html %] ([% framework.frameworkcode %])[% ELSE %]Default MARC framework[% END %]</a>
-&rsaquo; Confirm deletion of tag '[% searchfield %]'
+&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode | html %]">[% IF framework %][% framework.frameworktext | html %] ([% framework.frameworkcode | html %])[% ELSE %]Default MARC framework[% END %]</a>
+&rsaquo; Confirm deletion of tag '[% searchfield | html %]'
 [% ELSIF ( delete_confirmed ) %]
-&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode %]">[% IF framework %][% framework.frameworktext |html %] ([% framework.frameworkcode %])[% ELSE %]Default MARC framework[% END %]</a>
+&rsaquo; <a href="/cgi-bin/koha/admin/marctagstructure.pl?frameworkcode=[% framework.frameworkcode | html %]">[% IF framework %][% framework.frameworktext | html %] ([% framework.frameworkcode | html %])[% ELSE %]Default MARC framework[% END %]</a>
 &rsaquo; Data deleted
 [% END %]
 </div>
 
 [% IF ( else ) %]
 <div id="toolbar" class="btn-toolbar">
-    <a class="btn btn-default btn-sm" id="addtag" href="/cgi-bin/koha/admin/marctagstructure.pl?op=add_form&amp;frameworkcode=[% framework.frameworkcode %]"><i class="fa fa-plus"></i> New tag</a>
+    <a class="btn btn-default btn-sm" id="addtag" href="/cgi-bin/koha/admin/marctagstructure.pl?op=add_form&amp;frameworkcode=[% framework.frameworkcode | html %]"><i class="fa fa-plus"></i> New tag</a>
 </div>[% END %]
 
-<h1>MARC Framework for [% IF framework %][% framework.frameworktext |html %] ([% framework.frameworkcode %])[% ELSE %]default MARC framework[% END %]</h1>
+<h1>MARC Framework for [% IF framework %][% framework.frameworktext | html %] ([% framework.frameworkcode | html %])[% ELSE %]default MARC framework[% END %]</h1>
 
 [% IF ( add_form ) %]
 
-    <form action="[% script_name %]" name="Aform" method="post" class="validated">
+    <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
 
-      <fieldset class="rows"><legend>[% IF ( use_heading_flags_p ) %][% IF ( heading_modify_tag_p ) %]Modify tag <input type="hidden" name="modif" value="1" />[% searchfield %][% END %][% IF ( heading_add_tag_p ) %]Add tag[% END %][% ELSE %][% action %][% END %]</legend>  <input type="hidden" name="op" value="add_validate" />
-        <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
+      <fieldset class="rows"><legend>[% IF ( use_heading_flags_p ) %][% IF ( heading_modify_tag_p ) %]Modify tag <input type="hidden" name="modif" value="1" />[% searchfield | html %][% END %][% IF ( heading_add_tag_p ) %]Add tag[% END %][% ELSE %][% action | html %][% END %]</legend>  <input type="hidden" name="op" value="add_validate" />
+        <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
 
         <ol>
             <li>
                 [% IF ( heading_modify_tag_p ) %]
-                    <input type="hidden" name="tagfield" value="[% searchfield %]" />
+                    <input type="hidden" name="tagfield" value="[% searchfield | html %]" />
                     <span class="label">Tag:</span>
-                    [% searchfield %]
+                    [% searchfield | html %]
                 [% ELSE %]
                     <label for="tagfield" class="required">Tag: </label>
-                    <input id="tagfield" type="text" name="tagfield" value="[% searchfield %]" maxlength="3" size="3" required="required" class="required" />
+                    <input id="tagfield" type="text" name="tagfield" value="[% searchfield | html %]" maxlength="3" size="3" required="required" class="required" />
                     <span class="required">Required</span>
                 [% END %]
             </li>
-    <li><label for="liblibrarian">Label for lib: </label><input type="text" id="liblibrarian" name="liblibrarian" value="[% liblibrarian |html %]" size="40" maxlength="100" /></li>
-    <li><label for="libopac">Label for opac: </label><input type="text" id="libopac" name="libopac" value="[% libopac |html %]" size="40" maxlength="100" /></li>
+    <li><label for="liblibrarian">Label for lib: </label><input type="text" id="liblibrarian" name="liblibrarian" value="[% liblibrarian | html %]" size="40" maxlength="100" /></li>
+    <li><label for="libopac">Label for opac: </label><input type="text" id="libopac" name="libopac" value="[% libopac | html %]" size="40" maxlength="100" /></li>
     <li><label for="repeatable">Repeatable: </label>
         [% IF ( repeatable ) %]
             <input type="checkbox" name="repeatable" id="repeatable" value="1" checked="checked" />
         [% END %]
     </li>
     <li><label for="ind1_defaultvalue">First indicator default value: </label>
-        <input id="ind1_defaultvalue" type="text" name="ind1_defaultvalue" value="[% ind1_defaultvalue |html %]" maxlength="1" size="1" />
+        <input id="ind1_defaultvalue" type="text" name="ind1_defaultvalue" value="[% ind1_defaultvalue | html %]" maxlength="1" size="1" />
     </li>
     <li><label for="ind2_defaultvalue">Second indicator default value: </label>
-        <input id="ind2_defaultvalue" type="text" name="ind2_defaultvalue" value="[% ind2_defaultvalue |html %]" maxlength="1" size="1" />
+        <input id="ind2_defaultvalue" type="text" name="ind2_defaultvalue" value="[% ind2_defaultvalue | html %]" maxlength="1" size="1" />
     </li>
     <li><label for="authorised_value">Authorized value: </label>
         <select name="authorised_value" id="authorised_value" size="1">
@@ -95,7 +96,7 @@
 </ol></fieldset> 
     <fieldset class="action">
         <input type="submit" value="Save changes" />
-        <a class="cancel" href="[% script_name %]?frameworkcode=[% framework.frameworkcode %]">Cancel</a>
+        <a class="cancel" href="[% script_name | html %]?frameworkcode=[% framework.frameworkcode | html %]">Cancel</a>
     </fieldset>
     </form>
 [% END %]
 
 [% IF ( delete_confirm ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of tag <span class="ex">'[% searchfield %]'</span>?</h3>
-        <p>Tag: [% searchfield %]</p>
-        <p>Description: [% liblibrarian %]</p>
-        <form action="[% script_name %]" method="post">
+        <h3>Confirm deletion of tag <span class="ex">'[% searchfield | html %]'</span>?</h3>
+        <p>Tag: [% searchfield | html %]</p>
+        <p>Description: [% liblibrarian | html %]</p>
+        <form action="[% script_name | html %]" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
-            <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
+            <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete this tag</button>
         </form>
-        <form action="[% script_name %]" method="get"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
+        <form action="[% script_name | html %]" method="get"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% IF ( delete_confirmed ) %]
 
     <div class="dialog message"><h3>Tag deleted</h3>
-    <form action="[% script_name %]" method="post"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
+    <form action="[% script_name | html %]" method="post"><input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
     </form></div>
 [% END %]
 [% IF ( framework_create ) %]
 
-    <form action="[% script_name %]" method="post">
+    <form action="[% script_name | html %]" method="post">
         <input type="hidden" name="op" value="framework_create_confirm" />
-        <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode %]" />
-        Create framework for [% frameworkcode %] ([% framework.frameworktext |html %]) using
+        <input type="hidden" name="frameworkcode" value="[% framework.frameworkcode | html %]" />
+        Create framework for [% frameworkcode | html %] ([% framework.frameworktext | html %]) using
         <select name="existingframeworkcode">
             <option value="">Default</option>
         [% FOREACH existingframeworkloo IN existingframeworkloop %]
-            <option value="[% existingframeworkloo.value %]">[% existingframeworkloo.frameworktext |html %]</option>
+            <option value="[% existingframeworkloo.value | html %]">[% existingframeworkloo.frameworktext | html %]</option>
         [% END %]
         </select>
         <input type="submit" value="OK" />
 
 
 [% IF ( else ) %]
-<form name="f" action="[% script_name %]" method="post">
+<form name="f" action="[% script_name | html %]" method="post">
 <fieldset style="padding:.5em;">
         <label for="searchfield"><strong>Search for tag:</strong> </label>
-        <input type="text" name="searchfield" id="searchfield" size="4" value="[% searchfield %]" />
+        <input type="text" name="searchfield" id="searchfield" size="4" value="[% searchfield | html %]" />
 
 <label for="frameworkcode"><strong>In framework:</strong> </label>
         <select id="frameworkcode" name="frameworkcode">
             <option value="">Default</option>
             [% FOREACH f IN frameworks %]
             [% IF f.frameworkcode == framework.frameworkcode %]
-                <option value="[% f.frameworkcode %]" selected="selected">[% f.frameworktext |html %]</option>
+                <option value="[% f.frameworkcode | html %]" selected="selected">[% f.frameworktext | html %]</option>
                 [% ELSE %]
-                <option value="[% f.frameworkcode %]">[% f.frameworktext |html %]</option>
+                <option value="[% f.frameworkcode | html %]">[% f.frameworktext | html %]</option>
                 [% END %]
             [% END %]
         </select>
     [% IF ( select_display ) %]
         [% FOREACH loo IN loop %]
         <tr>
-            <td>[% loo.tagfield %]</td>
+            <td>[% loo.tagfield | html %]</td>
             <td>
-                [% loo.liblibrarian %]
+                [% loo.liblibrarian | html %]
                 [% FOREACH subfield IN loo.subfields %]
                     <p>
-                        Tab:[% subfield.tab %] | $[% subfield.tagsubfield %]
-                        [% subfield.liblibrarian %] [% IF ( subfield.kohafield ) %][% subfield.kohafield %][% END %][% IF ( subfield.repeatable ) %], repeatable[% END %][% IF ( subfield.mandatory ) %], Mandatory[% END %][% IF ( subfield.seealso ) %], See [% subfield.seealso %][% END %][% IF ( subfield.authorised_value ) %], [% subfield.authorised_value %][% END %][% IF ( subfield.authtypecode ) %], [% subfield.authtypecode %][% END %][% IF ( subfield.value_builder ) %], [% subfield.value_builder %][% END %]
+                        Tab:[% subfield.tab | html %] | $[% subfield.tagsubfield | html %]
+                        [% subfield.liblibrarian | html %] [% IF ( subfield.kohafield ) %][% subfield.kohafield | html %][% END %][% IF ( subfield.repeatable ) %], repeatable[% END %][% IF ( subfield.mandatory ) %], Mandatory[% END %][% IF ( subfield.seealso ) %], See [% subfield.seealso | html %][% END %][% IF ( subfield.authorised_value ) %], [% subfield.authorised_value | html %][% END %][% IF ( subfield.authtypecode ) %], [% subfield.authtypecode | html %][% END %][% IF ( subfield.value_builder ) %], [% subfield.value_builder | html %][% END %]
                     </p>
                 [% END %]
             </td>
             <td>[% IF ( loo.repeatable ) %]Yes[% ELSE %]No[% END %]</td>
             <td>[% IF ( loo.mandatory ) %]Yes[% ELSE %]No[% END %]</td>
-            <td>[% loo.authorised_value %]</td>
-            <td>[% loo.ind1_defaultvalue %]</td>
-            <td>[% loo.ind2_defaultvalue %]</td>
+            <td>[% loo.authorised_value | html %]</td>
+            <td>[% loo.ind1_defaultvalue | html %]</td>
+            <td>[% loo.ind2_defaultvalue | html %]</td>
             <td>
                 <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="marctagactions[% loo.tagfield %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="marctagactions[% loo.tagfield | html %]" role="button" data-toggle="dropdown" href="#">
                         Actions <b class="caret"></b></a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="marctagactions[% loo.tagfield %]">
-                        <li><a href="[% loo.subfield_link %]"><i class="fa fa-eye"></i> Subfields</a></li>
-                        <li><a href="[% loo.edit %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                        <li><a href="[% loo.delete %]"><i class="fa fa-trash"></i> Delete</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="marctagactions[% loo.tagfield | html %]">
+                        <li><a href="[% loo.subfield_link | html %]"><i class="fa fa-eye"></i> Subfields</a></li>
+                        <li><a href="[% loo.edit | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                        <li><a href="[% loo.delete | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                     </ul>
                 </div>
             </td>
     [% ELSE %]
     [% FOREACH loo IN loop %]
     <tr>
-        <td>[% loo.tagfield %]</td>
-        <td>[% loo.liblibrarian %]</td>
+        <td>[% loo.tagfield | html %]</td>
+        <td>[% loo.liblibrarian | html %]</td>
         <td>[% IF ( loo.repeatable ) %]Yes[% ELSE %]No[% END %]</td>
         <td>[% IF ( loo.mandatory ) %]Yes[% ELSE %]No[% END %]</td>
-        <td>[% loo.authorised_value %]</td>
-        <td>[% loo.ind1_defaultvalue %]</td>
-        <td>[% loo.ind2_defaultvalue %]</td>
+        <td>[% loo.authorised_value | html %]</td>
+        <td>[% loo.ind1_defaultvalue | html %]</td>
+        <td>[% loo.ind2_defaultvalue | html %]</td>
         <td>
             <div class="dropdown">
-                <a class="btn btn-default btn-xs dropdown-toggle" id="marctagactions[% loo.tagfield %]" role="button" data-toggle="dropdown" href="#">
+                <a class="btn btn-default btn-xs dropdown-toggle" id="marctagactions[% loo.tagfield | html %]" role="button" data-toggle="dropdown" href="#">
                     Actions <b class="caret"></b></a>
-                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="marctagactions[% loo.tagfield %]">
-                    <li><a href="[% loo.subfield_link %]"><i class="fa fa-eye"></i> Subfields</a></li>
-                    <li><a href="[% loo.edit %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                    <li><a href="[% loo.delete %]"><i class="fa fa-trash"></i> Delete</a></li>
+                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="marctagactions[% loo.tagfield | html %]">
+                    <li><a href="[% loo.subfield_link | html %]"><i class="fa fa-eye"></i> Subfields</a></li>
+                    <li><a href="[% loo.edit | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                    <li><a href="[% loo.delete | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                 </ul>
             </div>
         </td>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#table_marctagstructure").dataTable($.extend(true, {}, dataTablesDefaults, {
index fce8032..15858e2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -10,7 +11,7 @@
   [% END %]
 [% END %]
 [% IF ( delete_matching_rule_form ) %]
-  &rsaquo; Confirm deletion of record matching rule &quot;[% code %]&quot;
+  &rsaquo; Confirm deletion of record matching rule &quot;[% code | html %]&quot;
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -22,7 +23,7 @@
 [%        CASE 'upper_case'     %]Uppercase
 [%        CASE 'lower_case'     %]Lowercase
 [%        CASE 'legacy_default' %]Legacy default
-[%        CASE %][% norm %]
+[%        CASE %][% norm | html %]
 [%    END %]
 [% END %]
 
@@ -30,9 +31,9 @@
 [%# PARAMS: selected_norm %]
 [%    FOREACH norm IN valid_norms %]
 [%        IF ( norm == selected_norm ) %]
-        <option value="[% norm %]" selected="selected">[% PROCESS norms_text norm=norm %]</option>
+        <option value="[% norm | html %]" selected="selected">[% PROCESS norms_text norm=norm %]</option>
 [%        ELSE %]
-        <option value="[% norm %]">[% PROCESS norms_text norm=norm %]</option>
+        <option value="[% norm | html %]">[% PROCESS norms_text norm=norm %]</option>
 [%        END %]
 [%    END %]
 [% END %]
@@ -41,9 +42,9 @@
 [%# PARAMS: selected_norm, id, name %]
 [%    UNLESS valid_norms.grep(selected_norm).size %]
 [%#       Fallback to 'none' %]
-[%        selected_norm = 'none' %]
+[% selected_norm = 'none' | html %]
 [%    END %]
-    <select id="[% id %]" name="[% name %]">
+    <select id="[% id | html %]" name="[% name | html %]">
 [%    PROCESS norms_options selected_norm=selected_norm %]
     </select>
 [% END %]
@@ -69,7 +70,7 @@
   [% END %]
 [% END %]
 [% IF ( delete_matching_rule_form ) %]
-  &rsaquo; Confirm deletion of record matching rule &quot;[% code %]&quot;
+  &rsaquo; Confirm deletion of record matching rule &quot;[% code | html %]&quot;
 [% END %]
 </div>
 
   [% ELSE %]
 <h2>Add record matching rule</h2>
   [% END %]
-<form action="[% script_name %]" name="Aform" method="post">
-  <input type="hidden" name="op" value="[% confirm_op %]" />
+<form action="[% script_name | html %]" name="Aform" method="post">
+  <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
       <li>
           [% IF ( edit_matching_rule ) %]
                  <span class="label">Matching rule code: </span>
-            <input type="hidden" name="matcher_id" value="[% matcher_id %]" />
-            <input type="hidden" name="code" value="[% code %]" />
-            [% code %]
+            <input type="hidden" name="matcher_id" value="[% matcher_id | html %]" />
+            <input type="hidden" name="code" value="[% code | html %]" />
+            [% code | html %]
           [% ELSE %]
                  <label for="code" class="required">Matching rule code: </label>
             <input type="text" id="code" name="code"  size="10" maxlength="10" /> <span class="required">Required</span>
        </li>
        <li><label for="description" class="required">Description: </label>
            <input type="text" id="description" name="description" size="50" maxlength="250" 
-                  value="[% description |html %]" /> <span class="required">Required</span>
+                  value="[% description | html %]" /> <span class="required">Required</span>
        </li>
        <li><label for="threshold" class="required">Match threshold: </label>
            <input type="text" id="threshold" name="threshold" size="5" maxlength="5" 
-                  value="[% threshold |html %]" /> <span class="required">Required</span>
+                  value="[% threshold | html %]" /> <span class="required">Required</span>
        </li>
        <li><label for="record_type" class="required">Record type: </label>
            <select id="record_type" name="record_type">
   [% ELSE %]<p id="addMatchPoint" style="display:none;"><a href="#" class="button" onclick="InsertMatchpoint('mp_1', 'mp_template'); return false;">Add match point</a></p>[% END %]
   [% IF ( edit_matching_rule ) %]
   [% FOREACH matchpoint IN matchpoints %]
-  <div id="mp_[% matchpoint.mp_num %]" class="matchgroup">
+  <div id="mp_[% matchpoint.mp_num | html %]" class="matchgroup">
   <fieldset class="rows">
-    <legend>Match point [% matchpoint.mp_num %] | <a href="#" class="button" onclick="InsertMatchpoint('mp_[% matchpoint.mp_num %]', 'mp_template'); return false;">Add match point</a> | <a href="#" class="button" onclick="DeleteMatchpoint(this); return false;">Remove this match point</a></legend>
+    <legend>Match point [% matchpoint.mp_num | html %] | <a href="#" class="button" onclick="InsertMatchpoint('mp_[% matchpoint.mp_num | html %]', 'mp_template'); return false;">Add match point</a> | <a href="#" class="button" onclick="DeleteMatchpoint(this); return false;">Remove this match point</a></legend>
     <ol>
       <li>
-        <label for="mp_[% matchpoint.mp_num %]_search_index">Search index: </label>
-        <input type ="text" id="mp_[% matchpoint.mp_num %]_search_index" 
-               name="mp_[% matchpoint.mp_num %]_search_index" size="20" 
-               value="[% matchpoint.index |html %]"
+        <label for="mp_[% matchpoint.mp_num | html %]_search_index">Search index: </label>
+        <input type ="text" id="mp_[% matchpoint.mp_num | html %]_search_index" 
+               name="mp_[% matchpoint.mp_num | html %]_search_index" size="20" 
+               value="[% matchpoint.index | html %]"
           maxlength="30" />
       </li>
       <li>
-        <label for="mp_[% matchpoint.mp_num %]_score">Score: </label>
-        <input type ="text" id="mp_[% matchpoint.mp_num %]_score" 
-               name="mp_[% matchpoint.mp_num %]_score" size="5"
-               value="[% matchpoint.score |html %]" 
+        <label for="mp_[% matchpoint.mp_num | html %]_score">Score: </label>
+        <input type ="text" id="mp_[% matchpoint.mp_num | html %]_score" 
+               name="mp_[% matchpoint.mp_num | html %]_score" size="5"
+               value="[% matchpoint.score | html %]"
                maxlength="5" />
       </li>
       </ol>
       [% FOREACH component IN matchpoint.components %]
-      <fieldset class="rows" id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]">
+      <fieldset class="rows" id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]">
       <legend>Matchpoint components</legend>
         <ol>
           <li>
-            <label for="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_tag">Tag: </label>
-            <input type="text" id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_tag" 
-                   name="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_tag" 
-                   value="[% component.tag |html %]"
+            <label for="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_tag">Tag: </label>
+            <input type="text" id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_tag" 
+                   name="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_tag" 
+                   value="[% component.tag | html %]"
                    size="3" maxlength="3" />
           </li>
           <li>
-            <label for="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_subfields">Subfields: </label>
-            <input type="text" id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_subfields" 
-                   name="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_subfields" 
-                   value="[% component.subfields |html %]"
+            <label for="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_subfields">Subfields: </label>
+            <input type="text" id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_subfields" 
+                   name="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_subfields" 
+                   value="[% component.subfields | html %]"
                    size="10" maxlength="40" />
           </li>
           <li>
-            <label for="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_offset">Offset: </label>
-            <input type="text" id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_offset" 
-                   name="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_offset" 
-                   value="[% component.offset |html %]"
+            <label for="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_offset">Offset: </label>
+            <input type="text" id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_offset" 
+                   name="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_offset" 
+                   value="[% component.offset | html %]"
                    size="5" maxlength="5" />
           </li>
           <li>
-            <label for="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_length">Length: </label>
-            <input type="text" id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_length" 
-                   name="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_length" 
-                   value="[% component.length |html %]"
+            <label for="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_length">Length: </label>
+            <input type="text" id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_length" 
+                   name="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_length" 
+                   value="[% component.length | html %]"
                    size="5" maxlength="5" />
           </li>
               [% FOREACH norm IN component.norms %]
-              <li id="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_n_[% norm.norm_num %]">
-                <label for="mp_[% matchpoint.mp_num %]_c_[% component.comp_num %]_n__[% norm.norm_num %]_norm">Normalization rule: </label>
+              <li id="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_n_[% norm.norm_num | html %]">
+                <label for="mp_[% matchpoint.mp_num | html %]_c_[% component.comp_num | html %]_n__[% norm.norm_num | html %]_norm">Normalization rule: </label>
                 [%# Note: Following directive in one line, otherwise we have translatabiltiy problems %]
                 [% PROCESS norms_select selected_norm=norm.norm id="mp_${norm.mp_num}_c_${component.comp_num}_n__${norm.norm_num}_norm" name="mp_${matchpoint.mp_num}_c_${component.comp_num}_n_${norm.norm_num}_norm" %]
               </li>
   [% ELSE %]<p id="addMatchCheck" style="display:none;"><a href="#" class="button" onclick="InsertMatchcheck('mc_1', 'mc_template'); return false;">Add match check</a></p>[% END %]
   [% IF ( edit_matching_rule ) %]
   [% FOREACH matchcheck IN matchchecks %]
-  <div id="mc_[% matchcheck.mc_num %]" class="matchgroup">
+  <div id="mc_[% matchcheck.mc_num | html %]" class="matchgroup">
   <fieldset class="rows">
-    <legend>Match check [% matchcheck.mc_num %]<a href="#" class="button" onclick="InsertMatchcheck('mc_[% matchcheck.mc_num %]', 'mc_template'); return false;">Add match check</a> | <a href="#" class="button" onclick="DeleteMatchcheck(this); return false;">Remove this match check</a></legend>
-    <input type="hidden" id="mc_[% matchcheck.mc_num %]_id" name="mc_[% matchcheck.mc_num %]_id" value="1" />
+    <legend>Match check [% matchcheck.mc_num | html %]<a href="#" class="button" onclick="InsertMatchcheck('mc_[% matchcheck.mc_num | html %]', 'mc_template'); return false;">Add match check</a> | <a href="#" class="button" onclick="DeleteMatchcheck(this); return false;">Remove this match check</a></legend>
+    <input type="hidden" id="mc_[% matchcheck.mc_num | html %]_id" name="mc_[% matchcheck.mc_num | html %]_id" value="1" />
       [% FOREACH src_component IN matchcheck.src_components %]
-      <fieldset class="rows" id="mc_[% src_component.mc_num %]_src_c_[% src_component.comp_num %]">
+      <fieldset class="rows" id="mc_[% src_component.mc_num | html %]_src_c_[% src_component.comp_num | html %]">
         <legend>Source (incoming) record check field</legend>
         <ol>
           <li>
-            <label for="mc_[% src_component.mc_num %]_src_c_[% src_component.comp_num %]_tag">Tag: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_tag" 
-                   name="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_tag" 
-                   value="[% src_component.tag |html %]"
+            <label for="mc_[% src_component.mc_num | html %]_src_c_[% src_component.comp_num | html %]_tag">Tag: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_tag" 
+                   name="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_tag" 
+                   value="[% src_component.tag | html %]"
                    size="3" maxlength="3" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_subfields">Subfields: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_subfields" 
-                   name="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_subfields" 
-                   value="[% src_component.subfields |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_subfields">Subfields: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_subfields" 
+                   name="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_subfields" 
+                   value="[% src_component.subfields | html %]"
                    size="10" maxlength="40" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_offset">Offset: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_offset" 
-                   name="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_offset" 
-                   value="[% src_component.offset |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_offset">Offset: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_offset" 
+                   name="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_offset" 
+                   value="[% src_component.offset | html %]"
                    size="5" maxlength="5" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_length">Length: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_length" 
-                   name="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_length" 
-                   value="[% src_component.length |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_length">Length: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_length" 
+                   name="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_length" 
+                   value="[% src_component.length | html %]"
                    size="5" maxlength="5" />
           </li>
           [% FOREACH norm IN src_component.norms %]
-            <li id="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_n_[% norm.norm_num %]">
-              <label for="mc_[% matchcheck.mc_num %]_src_c_[% src_component.comp_num %]_n_[% norm.norm_num %]_norm">Normalization rule: </label>
+            <li id="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_n_[% norm.norm_num | html %]">
+              <label for="mc_[% matchcheck.mc_num | html %]_src_c_[% src_component.comp_num | html %]_n_[% norm.norm_num | html %]_norm">Normalization rule: </label>
                 [%# Note: Following directive in one line, otherwise we have translatabiltiy problems %]
                 [% PROCESS norms_select selected_norm=norm.norm id="mc_${matchcheck.mc_num}_src_c_${src_component.comp_num}_n_${norm.norm_num}_norm" name="mc_${matchcheck.mc_num}_src_c_${src_component.comp_num}_n_${norm.norm_num}_norm" %]
             </li>
       </fieldset>
       [% END %]
       [% FOREACH tgt_component IN matchcheck.tgt_components %]
-      <fieldset class="rows" id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]">
+      <fieldset class="rows" id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]">
         <legend>Target (database) record check field</legend>
         <ol>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_tag">Tag: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_tag" 
-                   name="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_tag" 
-                   value="[% tgt_component.tag |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_tag">Tag: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_tag" 
+                   name="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_tag" 
+                   value="[% tgt_component.tag | html %]"
                    size="3" maxlength="3" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_subfields">Subfields: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_subfields" 
-                   name="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_subfields" 
-                   value="[% tgt_component.subfields |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_subfields">Subfields: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_subfields" 
+                   name="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_subfields" 
+                   value="[% tgt_component.subfields | html %]"
                    size="10" maxlength="40" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_offset">Offset: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_offset" 
-                   name="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_offset" 
-                   value="[% tgt_component.offset |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_offset">Offset: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_offset" 
+                   name="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_offset" 
+                   value="[% tgt_component.offset | html %]"
                    size="5" maxlength="5" />
           </li>
           <li>
-            <label for="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_length">Length: </label>
-            <input type="text" id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_length" 
-                   name="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_length" 
-                   value="[% tgt_component.length |html %]"
+            <label for="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_length">Length: </label>
+            <input type="text" id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_length" 
+                   name="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_length" 
+                   value="[% tgt_component.length | html %]"
                    size="5" maxlength="5" />
           </li>
           [% FOREACH norm IN tgt_component.norms %]
-            <li id="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_n_[% norm.norm_num %]">
-              <label for="mc_[% matchcheck.mc_num %]_tgt_c_[% tgt_component.comp_num %]_n_[% norm.norm_num %]_norm">Normalization rule: </label>
+            <li id="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_n_[% norm.norm_num | html %]">
+              <label for="mc_[% matchcheck.mc_num | html %]_tgt_c_[% tgt_component.comp_num | html %]_n_[% norm.norm_num | html %]_norm">Normalization rule: </label>
                 [%# Note: Following directive in one line, otherwise we have translatabiltiy problems %]
                 [% PROCESS norms_select selected_norm=norm.norm id="mc_${matchcheck.mc_num}_tgt_c_${tgt_component.comp_num}_n_${norm.norm_num}_norm" name="mc_${matchcheck.mc_num}_tgt_c_${tgt_component.comp_num}_n_${norm.norm_num}_norm" %]
             </li>
 
 [% IF ( delete_matching_rule_form ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of record matching rule <span class="ex">'[% code %]' ([% description %])</span>?</h3>
-        <form action="[% script_name %]" name="Aform" method="post">
-            <input type="hidden" name="op" value="[% confirm_op %]" />
-            <input type="hidden" name="matcher_id" value="[% matcher_id %]" />
+        <h3>Confirm deletion of record matching rule <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h3>
+        <form action="[% script_name | html %]" name="Aform" method="post">
+            <input type="hidden" name="op" value="[% confirm_op | html %]" />
+            <input type="hidden" name="matcher_id" value="[% matcher_id | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete record matching rule</button>
         </form>
-        <form action="[% script_name %]" method="get">
+        <form action="[% script_name | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% IF ( display_list ) %]
 
 <div id="toolbar" class="btn-toolbar">
-    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name %]?op=add_matching_rule"><i class="fa fa-plus"></i> New record matching rule</a>
+    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name | html %]?op=add_matching_rule"><i class="fa fa-plus"></i> New record matching rule</a>
 </div>
 
 <h2>Record matching rules</h2>
 [% IF ( added_matching_rule ) %]
-<div class="dialog message">Added record matching rule &quot;[% added_matching_rule %]&quot;</div>
+<div class="dialog message">Added record matching rule &quot;[% added_matching_rule | html %]&quot;</div>
 [% END %]
 [% IF ( edited_matching_rule ) %]
-<div class="dialog message">Modified record matching rule &quot;[% edited_matching_rule %]&quot;</div>
+<div class="dialog message">Modified record matching rule &quot;[% edited_matching_rule | html %]&quot;</div>
 [% END %]
 [% IF ( deleted_matching_rule ) %]
-<div class="dialog message">Deleted record matching rule &quot;[% deleted_matching_rule %]&quot;</div>
+<div class="dialog message">Deleted record matching rule &quot;[% deleted_matching_rule | html %]&quot;</div>
 [% END %]
 [% IF ( available_matching_rules ) %]<table>
   <tr>
   </tr>
   [% FOREACH available_matching_rule IN available_matching_rules %]
   <tr>
-    <td>[% available_matching_rule.matcher_id %]</td>
-    <td>[% available_matching_rule.code %]</td>
-    <td>[% available_matching_rule.description |html %]</td>
+    <td>[% available_matching_rule.matcher_id | html %]</td>
+    <td>[% available_matching_rule.code | html %]</td>
+    <td>[% available_matching_rule.description | html %]</td>
     <td class="actions">
-      <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name %]?op=edit_matching_rule&amp;matcher_id=[% available_matching_rule.matcher_id |html %]"><i class="fa fa-pencil"></i> Edit</a>
-      <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name %]?op=delete_matching_rule&amp;matcher_id=[% available_matching_rule.matcher_id |html %]"><i class="fa fa-trash"></i> Delete</a>
+      <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name | html %]?op=edit_matching_rule&amp;matcher_id=[% available_matching_rule.matcher_id | html %]"><i class="fa fa-pencil"></i> Edit</a>
+      <a class="btn btn-default btn-xs" href="[% available_matching_rule.script_name | html %]?op=delete_matching_rule&amp;matcher_id=[% available_matching_rule.matcher_id | html %]"><i class="fa fa-trash"></i> Delete</a>
     </td>
   </tr>
   [% END %]
 </table>[% ELSE %]<p>There are no saved matching rules.</p>[% END %]
 
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 
 [% END %]
  [% IF ( matching_rule_form ) %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
-        var maxMatchPoint = [% max_matchpoint %];
-        var maxMatchCheck = [% max_matchcheck %];
+        var maxMatchPoint = [% max_matchpoint | html %];
+        var maxMatchCheck = [% max_matchcheck | html %];
 
         function InsertMatchpoint(loc, index) {
             var original= $("#"+index);
index 4846dc5..e600581 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -9,7 +10,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'prefs-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; <a href="/cgi-bin/koha/admin/oai_set_mappings.pl?id=[% id %]">OAI set mappings</a></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; <a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; <a href="/cgi-bin/koha/admin/oai_set_mappings.pl?id=[% id | html %]">OAI set mappings</a></div>
 
 <div id="doc3" class="yui-t2">
 
@@ -22,7 +23,7 @@
           <p><a href="/cgi-bin/koha/admin/oai_sets.pl">Return to sets management</a></p>
         </div>
       [% END %]
-      <h1>Mappings for set '[% setName |html %]' ([% setSpec |html %])</h1>
+      <h1>Mappings for set '[% setName | html %]' ([% setSpec | html %])</h1>
       [% UNLESS ( mappings ) %]
         <div class="dialog alert"><p><strong>Warning:</strong> No mappings have been defined for this set</p></div>
       [% END %]
@@ -42,8 +43,8 @@
             [% IF ( mappings ) %]
               [% FOREACH mapping IN mappings %]
                 <tr>
-                  <td><input type="text" name="marcfield" size="3" value="[% mapping.marcfield %]" /></td>
-                  <td style="text-align:center"><input type="text" name="marcsubfield" size="1" value="[% mapping.marcsubfield %]" /></td>
+                  <td><input type="text" name="marcfield" size="3" value="[% mapping.marcfield | html %]" /></td>
+                  <td style="text-align:center"><input type="text" name="marcsubfield" size="1" value="[% mapping.marcsubfield | html %]" /></td>
                   <td><select name=operator>
                       [% IF mapping.operator == 'equal' %]
                         <option value="equal" selected="selected">is equal to</option>
@@ -53,7 +54,7 @@
                         <option value="notequal" selected="selected">not equal to</option>
                       [% END %]
                       </select></td>
-                  <td><input type="text" name="marcvalue" value="[% mapping.marcvalue %]" /></td>
+                  <td><input type="text" name="marcvalue" value="[% mapping.marcvalue | html %]" /></td>
                   <td style="text-align:center">
                     [% IF ( loop.last ) %]
                       <input type="button" id="ORbutton" value="OR" title="Add another condition" />
@@ -79,7 +80,7 @@
             [% END %]
           </tbody>
         </table>
-        <input type="hidden" name="id" value="[% id %]" />
+        <input type="hidden" name="id" value="[% id | html %]" />
         <input type="hidden" name="op" value="save" />
         <fieldset class="action">
             <input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/admin/oai_sets.pl">Cancel</a>
@@ -94,7 +95,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#mappingform").submit(function(){
index 056365a..82f214c 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -9,7 +10,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'prefs-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec |html %]'[% ELSE %] OAI sets configuration[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( op_new ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Add a new OAI set[% ELSIF ( op_mod ) %]<a href="/cgi-bin/koha/admin/oai_sets.pl">OAI sets configuration</a> &rsaquo; Edit OAI set '[% spec | html %]'[% ELSE %] OAI sets configuration[% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
                 <h2>Add a new OAI set</h2>
                 <input type="hidden" name="op" value="savenew" />
             [% ELSIF ( op_mod ) %]
-                <h2>Edit OAI set '[% spec |html %]'</h2>
+                <h2>Edit OAI set '[% spec | html %]'</h2>
                     <input type="hidden" name="op" value="savemod" />
-                    <input type="hidden" name="id" value="[% id %]" />
+                    <input type="hidden" name="id" value="[% id | html %]" />
             [% END %]
                 <fieldset id="oaidetails" class="rows">
                     <ol>
                         <li>
                             <label for="spec" class="required">setSpec: </label>
-                            <input type="text" id="spec" name="spec" value="[% spec %]" required="required" class="required" />
+                            <input type="text" id="spec" name="spec" value="[% spec | html %]" required="required" class="required" />
                             <span class="required">Required</span>
                         </li>
                         <li>
                             <label for="name" class="required">setName: </label>
-                            <input type="text" id="name" name="name" value="[% name %]" required="required" class="required" />
+                            <input type="text" id="name" name="name" value="[% name | html %]" required="required" class="required" />
                             <span class="required">Required</span>
                         </li>
                         [% FOREACH desc IN descriptions %]
                             <li>
                                 <label>setDescription: </label>
-                                <textarea style="vertical-align:middle" rows="2" cols="30" name="description">[% desc.description %]</textarea>
+                                <textarea style="vertical-align:middle" rows="2" cols="30" name="description">[% desc.description | html %]</textarea>
                                 <a class="remove_description" href="#"><i class="fa fa-fw fa-trash"></i> Remove</a>
                             </li>
                         [% END %]
                 <tbody>
                     [% FOREACH set IN sets_loop %]
                         <tr>
-                            <td>[% set.spec |html %]</td>
-                            <td>[% set.name |html %]</td>
+                            <td>[% set.spec | html %]</td>
+                            <td>[% set.name | html %]</td>
                             <td>
                                 [% IF set.descriptions %]
                                     <ul>
                                         [% FOREACH desc IN set.descriptions %]
-                                            <li>[% desc.description |html %]</li>
+                                            <li>[% desc.description | html %]</li>
                                         [% END %]
                                     </ul>
                                 [% ELSE %]
                             </td>
                             <td>
                               <div class="dropdown">
-                                <a class="btn btn-default btn-xs dropdown-toggle" id="oaisetsactions[% set.id %]" role="button" data-toggle="dropdown" href="#">
+                                <a class="btn btn-default btn-xs dropdown-toggle" id="oaisetsactions[% set.id | html %]" role="button" data-toggle="dropdown" href="#">
                                   Actions <b class="caret"></b></a>
-                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="oaisetsactions[% set.id %]">
-                                  <li><a href="/cgi-bin/koha/admin/oai_sets.pl?op=mod&amp;id=[% set.id %]"><i class="fa fa-fw fa-pencil"></i> Edit</a></li>
-                                  <li><a class="delete_oai_set" href="/cgi-bin/koha/admin/oai_sets.pl?op=del&amp;id=[% set.id %]"><i class="fa fa-fw fa-trash"></i> Delete</a></li>
-                                  <li><a href="/cgi-bin/koha/admin/oai_set_mappings.pl?id=[% set.id %]"><i class="fa fa-fw fa-info"></i> Define mappings</a></li>
+                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="oaisetsactions[% set.id | html %]">
+                                  <li><a href="/cgi-bin/koha/admin/oai_sets.pl?op=mod&amp;id=[% set.id | html %]"><i class="fa fa-fw fa-pencil"></i> Edit</a></li>
+                                  <li><a class="delete_oai_set" href="/cgi-bin/koha/admin/oai_sets.pl?op=del&amp;id=[% set.id | html %]"><i class="fa fa-fw fa-trash"></i> Delete</a></li>
+                                  <li><a href="/cgi-bin/koha/admin/oai_set_mappings.pl?id=[% set.id | html %]"><i class="fa fa-fw fa-info"></i> Define mappings</a></li>
                                 </ul>
                               </div>
                             </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         function newDescField() {
             $("#adddescription").before(
index 5232b79..f8f7a2f 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
@@ -11,7 +12,7 @@
   [% END %]
 [% END %]
 [% IF ( delete_attribute_type_form ) %]
-  &rsaquo; Confirm deletion of patron attribute type &quot;[% code |html %]&quot;
+  &rsaquo; Confirm deletion of patron attribute type &quot;[% code | html %]&quot;
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -30,7 +31,7 @@
   [% END %]
 [% END %]
 [% IF ( delete_attribute_type_form ) %]
-  &rsaquo; Confirm deletion of patron attribute type &quot;[% code |html %]&quot;
+  &rsaquo; Confirm deletion of patron attribute type &quot;[% code | html %]&quot;
 [% END %]
 </div>
 
 <h2>Add patron attribute type</h2>
   [% END %]
 [% IF ( duplicate_code_error ) %]
-<div class="dialog message">Could not add patron attribute type &quot;[% duplicate_code_error %]&quot; 
+<div class="dialog message">Could not add patron attribute type &quot;[% duplicate_code_error | html %]&quot; 
     &mdash; one with that code already exists.
 </div>
 [% END %]
-<form action="[% script_name %]" class="validated" method="post">
-  <input type="hidden" name="op" value="[% confirm_op %]" />
+<form action="[% script_name | html %]" class="validated" method="post">
+  <input type="hidden" name="op" value="[% confirm_op | html %]" />
   <fieldset class="rows">
     <ol>
       <li>
           [% IF ( edit_attribute_type ) %]
                  <span class="label">Patron attribute type code: </span>
-            <input type="hidden" name="code" value="[% code |html %]" />
-            [% code |html %]
+            <input type="hidden" name="code" value="[% code | html %]" />
+            [% code | html %]
           [% ELSE %]
               <label for="code" class="required">Patron attribute type code: </label>
               <input type="text" id="code" name="code" required="required" class="required" size="10" maxlength="10" />
@@ -71,7 +72,7 @@
           [% END %]
        </li>
        <li><label for="description" class="required">Description: </label>
-           <input type="text" id="description" name="description" required="required" class="required" size="50" maxlength="250" value="[% description |html %]" />
+           <input type="text" id="description" name="description" required="required" class="required" size="50" maxlength="250" value="[% description | html %]" />
            <span class="required">Required</span>
        </li>
        <li><label for="repeatable">Repeatable: </label>
                 <option value="">All branches</option>
                 [% FOREACH branch IN branches_loop %]
                   [% IF ( branch.selected ) %]
-                    <option selected="selected" value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                    <option selected="selected" value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                   [% ELSE %]
-                    <option value="[% branch.branchcode %]">[% branch.branchname |html %]</option>
+                    <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                   [% END %]
                 [% END %]
             </select>
             <select name="category_code" id="category">
                 <option value=""></option>
                 [% FOREACH cat IN categories %]
-                    [% IF ( cat.categorycode == category_code ) %]<option value="[% cat.categorycode %]" selected="selected">[% cat.description |html %]</option>[% ELSE %]<option value="[% cat.categorycode %]">[% cat.description |html %]</option>[% END %]
+                    [% IF ( cat.categorycode == category_code ) %]<option value="[% cat.categorycode | html %]" selected="selected">[% cat.description | html %]</option>[% ELSE %]<option value="[% cat.categorycode | html %]">[% cat.description | html %]</option>[% END %]
                 [% END %]
             </select>
             <span>Choose one to limit this attribute to one patron type. Please leave blank if you want these attributes to be available for all types of patrons.</span>
                 <option value=""></option>
                 [% FOREACH class IN classes_val_loop %]
                     [% IF class.authorised_value == category_class %]
-                        <option value="[% class.authorised_value %]" selected="selected">
-                            [% class.lib |html %]
+                        <option value="[% class.authorised_value | html %]" selected="selected">
+                            [% class.lib | html %]
                         </option>
                     [% ELSE %]
-                        <option value="[% class.authorised_value %]" >
-                            [% class.lib |html %]
+                        <option value="[% class.authorised_value | html %]" >
+                            [% class.lib | html %]
                         </option>
                     [% END %]
                 [% END %]
 
 [% IF ( delete_attribute_type_form ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of patron attribute type <span class="ex">'[% code |html %]' ([% description %])</span>?</h3>
-        <form action="[% script_name %]" name="Aform" method="post">
-            <input type="hidden" name="op" value="[% confirm_op %]" />
-            <input type="hidden" name="code" value="[% code |html %]" />
+        <h3>Confirm deletion of patron attribute type <span class="ex">'[% code | html %]' ([% description | html %])</span>?</h3>
+        <form action="[% script_name | html %]" name="Aform" method="post">
+            <input type="hidden" name="op" value="[% confirm_op | html %]" />
+            <input type="hidden" name="code" value="[% code | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete patron attribute type</button>
         </form>
-        <form action="[% script_name %]" method="get">
+        <form action="[% script_name | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
         </form>
     </div>
 [% IF ( display_list ) %]
 
 <div id="toolbar" class="btn-toolbar">
-    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name %]?op=add_attribute_type"><i class="fa fa-plus"></i> New patron attribute type</a>
+    <a class="btn btn-default btn-sm" id="newrule" href="[% script_name | html %]?op=add_attribute_type"><i class="fa fa-plus"></i> New patron attribute type</a>
 </div>
 
 <h2>Patron attribute types</h2>
 [% IF ( added_attribute_type ) %]
-<div class="dialog message">Added patron attribute type &quot;[% added_attribute_type %]&quot;</div>
+<div class="dialog message">Added patron attribute type &quot;[% added_attribute_type | html %]&quot;</div>
 [% END %]
 [% IF ( edited_attribute_type ) %]
-<div class="dialog message">Modified patron attribute type &quot;[% edited_attribute_type %]&quot;</div>
+<div class="dialog message">Modified patron attribute type &quot;[% edited_attribute_type | html %]&quot;</div>
 [% END %]
 [% IF ( deleted_attribute_type ) %]
-<div class="dialog message">Deleted patron attribute type &quot;[% deleted_attribute_type %]&quot;</div>
+<div class="dialog message">Deleted patron attribute type &quot;[% deleted_attribute_type | html %]&quot;</div>
 [% END %]
 [% IF ( ERROR_delete_in_use ) %]
-<div class="dialog message">Could not delete patron attribute type &quot;[% ERROR_delete_in_use %]&quot; 
-    &mdash; it is in use by [% ERROR_num_patrons %] patron records</div>
+<div class="dialog message">Could not delete patron attribute type &quot;[% ERROR_delete_in_use | html %]&quot; 
+    &mdash; it is in use by [% ERROR_num_patrons | html %] patron records</div>
 [% END %]
 [% IF ( ERROR_delete_not_found ) %]
-<div class="dialog message">Could not delete patron attribute type &quot;[% ERROR_delete_not_found %]&quot; 
+<div class="dialog message">Could not delete patron attribute type &quot;[% ERROR_delete_not_found | html %]&quot; 
     &mdash; it was already absent from the database.</div>
 [% END %]
 [% IF ( available_attribute_types ) %]
   [% FOREACH attribute IN available_attribute_types %]
     [% IF attribute.class %]
-        <h4>[% attribute.lib %]</h4>
+        <h4>[% attribute.lib | html %]</h4>
     [% END %]
     <table class="patron_attributes_types">
       <thead>
       <tbody>
         [% FOREACH item IN attribute.items %]
           <tr>
-            <td>[% item.code |html %]</td>
-            <td>[% item.description |html %]</td>
+            <td>[% item.code | html %]</td>
+            <td>[% item.description | html %]</td>
             <td>
                 [% IF ( item.branches && item.branches.size > 0 ) %]
-                    [% branches_str = "" %]
+                    [% branches_str = "" | html %]
                     [% FOREACH branch IN item.branches %]
-                        [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" %]
+                        [% branches_str = branches_str _ " " _ branch.branchname _ "(" _ branch.branchcode _ ")" | html %]
                     [% END %]
-                    <span title="[% branches_str %]">
+                    <span title="[% branches_str | html %]">
                         [% IF item.branches.size > 1 %]
-                            [% item.branches.size %] branches limitations
+                            [% item.branches.size | html %] branches limitations
                         [% ELSE %]
-                            [% item.branches.size %] branch limitation
+                            [% item.branches.size | html %] branch limitation
                         [% END %]
                     </span>
                 [% ELSE %]
                 [% END %]
             </td>
             <td class="actions">
-              <a class="btn btn-default btn-xs" href="[% item.script_name %]?op=edit_attribute_type&amp;code=[% item.code |html %]"><i class="fa fa-pencil"></i> Edit</a>
-              <a class="btn btn-default btn-xs" href="[% item.script_name %]?op=delete_attribute_type&amp;code=[% item.code |html %]"><i class="fa fa-trash"></i> Delete</a>
+              <a class="btn btn-default btn-xs" href="[% item.script_name | html %]?op=edit_attribute_type&amp;code=[% item.code | html %]"><i class="fa fa-pencil"></i> Edit</a>
+              <a class="btn btn-default btn-xs" href="[% item.script_name | html %]?op=delete_attribute_type&amp;code=[% item.code | html %]"><i class="fa fa-trash"></i> Delete</a>
             </td>
           </tr>
         [% END %]
   <p>There are no saved patron attribute types.</p>
 [% END %]
 
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 
 [% END %]
  
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             if ( $("#branches option:selected").length < 1 ) {
index 2db4b2d..a1e8274 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; System preferences</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
-[% Asset.css("css/preferences.css") %]
-[% Asset.css("lib/jquery/plugins/multiple-select/multiple-select.css") %]
-[% Asset.css("css/humanmsg.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
+[% Asset.css("css/preferences.css") | $raw %]
+[% Asset.css("lib/jquery/plugins/multiple-select/multiple-select.css") | $raw %]
+[% Asset.css("css/humanmsg.css") | $raw %]
 </head>
 <body id="admin_preferences" class="admin">
 [% INCLUDE 'header.inc' %]
     [% IF ( jump_not_found ) %]
     <h2>System preferences</h2>
     <div class="dialog alert">
-        Could not find a system preference named <code>[% jumpfield %]</code>.
+        Could not find a system preference named <code>[% jumpfield | html %]</code>.
     </div>
     [% END %]
     [% IF ( search_not_found ) %]
     <div class="dialog alert">
-        No system preferences matched your search for: <strong>[% searchfield |html %]</strong>
+        No system preferences matched your search for: <strong>[% searchfield | html %]</strong>
     </div>
     [% ELSIF searchfield %]
         <h1>You searched for: [% searchfield | html %]</h1>
     [% END %]
     [% FOREACH TAB IN TABS %]
     <div class="prefs-tab">
-    <h2>[% TAB.tab_title %] preferences</h2>
+    <h2>[% TAB.tab_title | html %] preferences</h2>
     <form action="/cgi-bin/koha/admin/preferences.pl" method="post">
-        [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all submit" type="submit">Save all [% TAB.tab_title %] preferences</button></div>[% END %]
+        [% UNLESS ( searchfield ) %]<div id="toolbar"><button class="save-all submit" type="submit">Save all [% TAB.tab_title | html %] preferences</button></div>[% END %]
         <input type="hidden" name="op" value="save" />
-        <input type="hidden" name="tab" value="[% TAB.tab_id %]" />
+        <input type="hidden" name="tab" value="[% TAB.tab_id | html %]" />
 
             [% FOREACH LINE IN TAB.LINES %]
             [% IF ( LINE.is_group_title ) %]
             [% UNLESS ( loop.first ) %]</tbody></table>[% END %]
-            <h3>[% LINE.title %]</h3>
+            <h3>[% LINE.title | html %]</h3>
             <table class="preferences">
             <thead><tr><th>Preference</th><th>Value</th></tr></thead>
             [% UNLESS ( loop.last ) %]<tbody>[% END %]
                 <td class="name-cell">
                     <code>
                         [% FOREACH NAME IN LINE.NAMES %]
-                                               <label for="pref_[% NAME.name %]">
+                                               <label for="pref_[% NAME.name | html %]">
                                                        [% IF ( NAME.jumped ) %]
-                                                       <span class="term" id="jumped">[% NAME.name %]</span>
+                                                       <span class="term" id="jumped">[% NAME.name | html %]</span>
                             [% ELSIF ( NAME.highlighted ) %]
-                                                       <span class="term">[% NAME.name %]</span>
+                                                       <span class="term">[% NAME.name | html %]</span>
                                                        [% ELSE %]
-                                                       [% NAME.name %]
+                                                       [% NAME.name | html %]
                                                        [% END %]
 
                             [% IF NAME.overridden %]
-                                <span class="overridden" title="The system preference [% NAME.name %] may have been overridden from this value by one or more virtual hosts.">
+                                <span class="overridden" title="The system preference [% NAME.name | html %] may have been overridden from this value by one or more virtual hosts.">
                                     [Overridden]
                                 </span>
                             [% END %]
                 <td><div>
                     [% FOREACH CHUNK IN LINE.CHUNKS %]
                     [% IF ( CHUNK.type_text ) %]
-                    [% CHUNK.contents %]
+                    [% CHUNK.contents | $raw %]
                     [% ELSIF ( CHUNK.type_input ) %]
-                    <input type="[%IF CHUNK.input_type %][% CHUNK.input_type %][% ELSE %]text[% END %]" name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]" class="preference preference-[% CHUNK.class or "short" %]" value="[% CHUNK.value| html %]" autocomplete="off" /> [% IF ( CHUNK.dateinput ) %]<span class="hint">[% INCLUDE 'date-format.inc' %]</span>[% END %]
+                    <input type="[%IF CHUNK.input_type %][% CHUNK.input_type | html %][% ELSE %]text[% END %]" name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]" class="preference preference-[% CHUNK.class or "short" | html %]" value="[% CHUNK.value | html %]" autocomplete="off" /> [% IF ( CHUNK.dateinput ) %]<span class="hint">[% INCLUDE 'date-format.inc' %]</span>[% END %]
                     [% ELSIF ( CHUNK.type_select ) %]
-                    <select name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]" class="preference preference-[% CHUNK.class or "choice" %]">
+                    <select name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]" class="preference preference-[% CHUNK.class or "choice" | html %]">
                         [% FOREACH CHOICE IN CHUNK.CHOICES.sort('value') %]
                         [% IF ( CHOICE.selected ) %]
-                        <option value="[% CHOICE.value %]" selected="selected">
+                        <option value="[% CHOICE.value | html %]" selected="selected">
                         [% ELSE %]
-                        <option value="[% CHOICE.value %]">
+                        <option value="[% CHOICE.value | html %]">
                         [% END %]
-                            [% CHOICE.text %]
+                            [% CHOICE.text | html %]
                         </option>
                         [% END %]
                     </select>
                     [% ELSIF ( CHUNK.type_multiple ) %]
-                    <select name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]" class="preference preference-[% CHUNK.class or "choice" %]" multiple="multiple">
-                        [% FOREACH CHOICE IN CHUNK.CHOICES %][% IF ( CHOICE.selected ) %]<option value="[% CHOICE.value %]" selected="selected">[% ELSE %]<option value="[% CHOICE.value %]">[% END %][% CHOICE.text %]</option>[% END %]
+                    <select name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]" class="preference preference-[% CHUNK.class or "choice" | html %]" multiple="multiple">
+                        [% FOREACH CHOICE IN CHUNK.CHOICES %][% IF ( CHOICE.selected ) %]<option value="[% CHOICE.value | html %]" selected="selected">[% ELSE %]<option value="[% CHOICE.value | html %]">[% END %][% CHOICE.text | html %]</option>[% END %]
                     </select>
                     [% ELSIF ( CHUNK.type_textarea ) || ( CHUNK.type_htmlarea )%]
                         [% IF ( CHUNK.type_htmlarea ) && ( Koha.Preference('UseWYSIWYGinSystemPreferences') ) %]
-                        <textarea name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]" class="preference preference-[% CHUNK.class or "short" %] mce" rows="20" cols="60">[% CHUNK.value %]</textarea>
+                        <textarea name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]" class="preference preference-[% CHUNK.class or "short" | html %] mce" rows="20" cols="60">[% CHUNK.value | html %]</textarea>
                         [% ELSE %]
                         <a class="expand-textarea" style="display: none" href="#">Click to Edit</a>
-                        <textarea name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]" class="preference preference-[% CHUNK.class or "short" %]" rows="10" cols="40">[% CHUNK.value %]</textarea>
+                        <textarea name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]" class="preference preference-[% CHUNK.class or "short" | html %]" rows="10" cols="40">[% CHUNK.value | html %]</textarea>
                         <a class="collapse-textarea" style="display:none" href="#">Click to collapse</br></a>
                         [% END %]
                     [% ELSIF ( CHUNK.type_languages ) %]
                     <div>
                         [% IF ( language.plural ) %]
                         <dt>
-                            [% IF ( language.native_description ) %][% language.native_description %][% ELSE %][% language.rfc4646_subtag %][% END %]
+                            [% IF ( language.native_description ) %][% language.native_description | html %][% ELSE %][% language.rfc4646_subtag | html %][% END %]
                         </dt>
                         [% FOREACH sublanguages_loo IN language.sublanguages_loop %]
                         <dd>
-                            <label for="pref_[% CHUNK.name %]_[% sublanguages_loo.rfc4646_subtag %]">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]([% sublanguages_loo.rfc4646_subtag %])</label>
+                            <label for="pref_[% CHUNK.name | html %]_[% sublanguages_loo.rfc4646_subtag | html %]">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]([% sublanguages_loo.rfc4646_subtag | html %])</label>
                             [% IF ( sublanguages_loo.enabled ) %]
-                            <input value="[% sublanguages_loo.rfc4646_subtag %]" name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]_[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" class="preference preference-checkbox"/>
+                            <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]_[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" class="preference preference-checkbox"/>
                             [% ELSE %]
-                            <input value="[% sublanguages_loo.rfc4646_subtag %]" name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]_[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" class="preference preference-checkbox"/>
+                            <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]_[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" class="preference preference-checkbox"/>
                             [% END %]
                         </dd>
                         [% END %]
                         [% ELSE %]
                         <dt>
-                            <label for="pref_[% CHUNK.name %]_[% language.rfc4646_subtag %]">[% language.native_description %]([% language.rfc4646_subtag %])</label>
+                            <label for="pref_[% CHUNK.name | html %]_[% language.rfc4646_subtag | html %]">[% language.native_description | html %]([% language.rfc4646_subtag | html %])</label>
                             [% IF ( language.group_enabled ) %]
-                            <input value="[% language.rfc4646_subtag %]" name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]_[% language.rfc4646_subtag %]" type="checkbox" checked="checked" class="preference preference-checkbox"/>
+                            <input value="[% language.rfc4646_subtag | html %]" name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]_[% language.rfc4646_subtag | html %]" type="checkbox" checked="checked" class="preference preference-checkbox"/>
                             [% ELSE %]
-                            <input value="[% language.rfc4646_subtag %]" name="pref_[% CHUNK.name %]" id="pref_[% CHUNK.name %]_[% language.rfc4646_subtag %]" type="checkbox" class="preference preference-checkbox"/>
+                            <input value="[% language.rfc4646_subtag | html %]" name="pref_[% CHUNK.name | html %]" id="pref_[% CHUNK.name | html %]_[% language.rfc4646_subtag | html %]" type="checkbox" class="preference preference-checkbox"/>
                             [% END %]
                         </dt>
                         [% END %]
             [% IF ( loop.last ) %]</tbody></table>[% END %]
             [% END %]
         [% END %]
-        <fieldset class="action"><button class="save-all submit" type="submit">Save all [% TAB.tab_title %] preferences</button> <a href="/cgi-bin/koha/admin/preferences.pl" class="force_reload cancel">Cancel</a></fieldset>
+        <fieldset class="action"><button class="save-all submit" type="submit">Save all [% TAB.tab_title | html %] preferences</button> <a href="/cgi-bin/koha/admin/preferences.pl" class="force_reload cancel">Cancel</a></fieldset>
     </form>
     </div>
     [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-    [% Asset.js("lib/jquery/plugins/multiple-select/jquery.multiple.select.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/multiple-select/jquery.multiple.select.js") | $raw %]
     <script type="text/javascript">
         [% UNLESS ( searchfield ) %]$(document).ready(function(){
                 $('#toolbar').fixFloat();
             });
         });
         // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw
-        var to_highlight = "[% searchfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
+        var to_highlight = "[% searchfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
         var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %];
         var MSG_NOTHING_TO_SAVE = _("Nothing to save");
         var MSG_SAVING = _("Saving...");
         var MSG_DATA_NOT_SAVED = _( "Error; your data might not have been saved" );
         var MSG_LOADING = _( "Loading..." );
     </script>
-    <script src="[% interface %]/lib/jquery/plugins/humanmsg.js" type="text/javascript"></script>
-    <script src="[% interface %]/[% theme %]/js/ajax.js" type="text/javascript"></script>
-    <script src="[% interface %]/[% theme %]/js/pages/preferences.js" type="text/javascript"></script>
+    <script src="[% interface | html %]/lib/jquery/plugins/humanmsg.js" type="text/javascript"></script>
+    <script src="[% interface | html %]/[% theme | html %]/js/ajax.js" type="text/javascript"></script>
+    <script src="[% interface | html %]/[% theme | html %]/js/pages/preferences.js" type="text/javascript"></script>
     [%# Add WYSIWYG editor for htmlarea system preferences %]
     [% INCLUDE 'wysiwyg-systempreferences.inc' %]
 [% END %]
index 7542190..5aa3e9b 100644 (file)
@@ -1,14 +1,15 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo;
-[% IF ( add_form ) %][% IF ( searchfield ) %] Printers &rsaquo; Modify printer '[% searchfield %]'[% ELSE %] Printers &rsaquo; New printer[% END %][% END %]
+[% IF ( add_form ) %][% IF ( searchfield ) %] Printers &rsaquo; Modify printer '[% searchfield | html %]'[% ELSE %] Printers &rsaquo; New printer[% END %][% END %]
 [% IF ( add_validate ) %] Printers &rsaquo; Printer added[% END %]
-[% IF ( delete_confirm ) %] Printers &rsaquo; Confirm deletion of printer '[% searchfield %]'[% END %]
+[% IF ( delete_confirm ) %] Printers &rsaquo; Confirm deletion of printer '[% searchfield | html %]'[% END %]
 [% IF ( delete_confirmed ) %] Printers &rsaquo; Printer deleted[% END %]
 [% IF ( else ) %]Printers[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( loop ) %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'datatables.inc' %]
 <script type="text/javascript">
 //<![CDATA[
@@ -29,9 +30,9 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( add_form ) %][% IF ( searchfield ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Modify printer '[% searchfield %]'[% ELSE %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; New printer[% END %][% END %]
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( add_form ) %][% IF ( searchfield ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Modify printer '[% searchfield | html %]'[% ELSE %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; New printer[% END %][% END %]
 [% IF ( add_validate ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Printer added[% END %]
-[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Confirm deletion of printer '[% searchfield %]'[% END %]
+[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Confirm deletion of printer '[% searchfield | html %]'[% END %]
 [% IF ( delete_confirmed ) %] <a href="/cgi-bin/koha/admin/printers.pl">Printers</a> &rsaquo; Printer deleted[% END %]
 [% IF ( else ) %]Printers[% END %]</div>
 
@@ -48,7 +49,7 @@
        [% ELSE %]
                <h1>New printer</h1>
        [% END %]
-        <form action="[% script_name %]" name="Aform" method="post" class="validated">
+        <form action="[% script_name | html %]" name="Aform" method="post" class="validated">
         <input type="hidden" name="op" value="add_validate" />
        [% IF ( searchfield ) %]
                <input type="hidden" name="add" value="0" />
@@ -59,7 +60,7 @@
 <ol>   [% IF ( searchfield ) %]
                <li>
             <span class="label">Printer name: </span>
-                               <input type="hidden" name="printername" id="" value="[% searchfield %]" />[% searchfield %]
+                               <input type="hidden" name="printername" id="" value="[% searchfield | html %]" />[% searchfield | html %]
                </li>
        [% ELSE %]
                <li>
        [% END %]
                <li>
             <label for="printqueue" class="required">Queue: </label>
-            <input type="text" name="printqueue" id="printqueue" size="20" maxlength="20" value="[% printqueue %]"  class="required" required="required" />
+            <input type="text" name="printqueue" id="printqueue" size="20" maxlength="20" value="[% printqueue | html %]"  class="required" required="required" />
             <span class="required">Required</span>
                </li>
                <li>
                        <label for="printtype">Type: </label>
-            <input type="text" name="printtype" id="printtype" size="20" maxlength="20" value="[% printtype %]" />
+            <input type="text" name="printtype" id="printtype" size="20" maxlength="20" value="[% printtype | html %]" />
                </li></ol>
         </fieldset>
         <fieldset class="action"><input type="submit" value="Submit" /> <a class="cancel" href="/cgi-bin/koha/admin/printers.pl">Cancel</a></fieldset>
 
 [% IF ( add_validate ) %]
 <h3>Printer added</h3>
-<form action="[% script_name %]" method="post">
+<form action="[% script_name | html %]" method="post">
        <fieldset class="action"> <input type="submit" value="OK" /></fieldset>
 </form>
 [% END %]
 
 [% IF ( delete_confirm ) %]
     <div class="dialog alert">
-        <h3>Confirm deletion of printer <em>[% searchfield %]</em></h3>
+        <h3>Confirm deletion of printer <em>[% searchfield | html %]</em></h3>
 
         <table>
             <tr>
-                <th scope="row">Printer: </th><td>[% searchfield %]</td>
+                <th scope="row">Printer: </th><td>[% searchfield | html %]</td>
             </tr>
             <tr>
-                <th scope="row">Queue: </th><td>[% printqueue %]</td>
+                <th scope="row">Queue: </th><td>[% printqueue | html %]</td>
             </tr>
             <tr>
-                <th scope="row">Type: </th><td>[% printtype %]</td>
+                <th scope="row">Type: </th><td>[% printtype | html %]</td>
             </tr>
         </table>
 
-        <form action="[% script_name %]" method="post">
+        <form action="[% script_name | html %]" method="post">
             <input type="hidden" name="op" value="delete_confirmed" />
-            <input type="hidden" name="searchfield" value="[% searchfield %]" />
+            <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
         </form>
         <form action="/cgi-bin/koha/admin/printers.pl" method="get">
 [% IF ( delete_confirmed ) %]
     <div class="dialog message">
         <h3>Printer deleted</h3>
-        <form action="[% script_name %]" method="post">
+        <form action="[% script_name | html %]" method="post">
             <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
         </form>
     </div>
 
 <h2>Printers</h2>
        [% IF ( searchfield ) %]
-               You searched for [% searchfield %]</span>
+               You searched for [% searchfield | html %]</span>
        [% END %]
 
 [% IF ( loop ) %]
         <tbody>
                [% FOREACH loo IN loop %]
         <tr>
-                       <td>[% loo.printername %]</td>
-                       <td>[% loo.printqueue %]</td>
-                       <td>[% loo.printtype %]</td>
-            <td class="actions"><a class="btn btn-default btn-xs" href="[% loo.script_name %]?op=add_form&amp;searchfield=[% loo.printername |uri %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="[% loo.script_name %]?op=delete_confirm&amp;searchfield=[% loo.printername |uri %]"><i class="fa fa-trash"></i> Delete</a></td>
+                       <td>[% loo.printername | html %]</td>
+                       <td>[% loo.printqueue | html %]</td>
+                       <td>[% loo.printtype | html %]</td>
+            <td class="actions"><a class="btn btn-default btn-xs" href="[% loo.script_name | html %]?op=add_form&amp;searchfield=[% loo.printername |uri %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="[% loo.script_name | html %]?op=delete_confirm&amp;searchfield=[% loo.printername |uri %]"><i class="fa fa-trash"></i> Delete</a></td>
                </tr>
                [% END %]
         </tbody>
index 1cb3c41..3fdf167 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Search engine configuration</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.tablednd.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.tablednd.js") | $raw %]
 <script type="text/javascript">
     function clean_line( line ) {
         $(line).find('input[type="text"]').val("");
@@ -72,17 +73,17 @@ a.add, a.delete {
     <div class="yui-b">
 
     [% FOR m IN messages %]
-      <div class="dialog [% m.type %]">
+      <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
-          An error occurred when updating mappings ([% m.message %]).
+          An error occurred when updating mappings ([% m.message | html %]).
         [% CASE 'error_on_delete' %]
           An error occurred when deleting the existing mappings. Nothing has been changed!
-          (search field [% m.values.field_name %] with mapping [% m.values.marc_field %].)
+          (search field [% m.values.field_name | html %] with mapping [% m.values.marc_field | html %].)
         [% CASE 'success_on_update' %]
           Mapping updated successfully.
         [% CASE %]
-          [% m.code %]
+          [% m.code | html %]
         [% END %]
       </div>
     [% END %]
@@ -98,9 +99,9 @@ a.add, a.delete {
             [% FOREACH e IN errors %]
                 <li>
                     [% IF ( e.type == "malformed_mapping" ) %]
-                        The value "[% e.value %]" is not supported for mappings
+                        The value "[% e.value | html %]" is not supported for mappings
                     [% ELSIF ( e.type == "no_mapping" ) %]
-                        There is no mapping for the index [% e.value %]
+                        There is no mapping for the index [% e.value | html %]
                     [% END %]
                 </li>
             [% END %]
@@ -133,9 +134,9 @@ a.add, a.delete {
                   [% FOREACH search_field IN all_search_fields %]
                     <tr>
                       <td>
-                        <input type="text" name="search_field_name" value="[% search_field.name %]" />
+                        <input type="text" name="search_field_name" value="[% search_field.name | html %]" />
                       </td>
-                      <td><input type="text" name="search_field_label" value="[% search_field.label %]" />
+                      <td><input type="text" name="search_field_label" value="[% search_field.label | html %]" />
                       <td>
                         <select name="search_field_type">
                           <option value=""></option>
@@ -182,8 +183,8 @@ a.add, a.delete {
               </table>
             </div>
             [% FOREACH index IN indexes %]
-                <div id="mapping_[% index.index_name %]">
-                    <table class="mappings" data-index_name="[% index.index_name%]">
+                <div id="mapping_[% index.index_name | html %]">
+                    <table class="mappings" data-index_name="[% index.index_name | html %]">
                       <thead>
                         <tr class="nodrag nodrop">
                           <th>Search field</th>
@@ -198,9 +199,9 @@ a.add, a.delete {
                         [% FOREACH mapping IN index.mappings %]
                           <tr>
                             <td>
-                              <input type="hidden" name="mapping_index_name" value="[% index.index_name %]" />
-                              <input type="hidden" name="mapping_search_field_name" value="[% mapping.search_field_name %]">
-                              [% mapping.search_field_label %]
+                              <input type="hidden" name="mapping_index_name" value="[% index.index_name | html %]" />
+                              <input type="hidden" name="mapping_search_field_name" value="[% mapping.search_field_name | html %]">
+                              [% mapping.search_field_label | html %]
                             </td>
                             <td>
                               <select name="mapping_sort">
@@ -244,7 +245,7 @@ a.add, a.delete {
                               </select>
                             </td>
                             <td>
-                                <input name="mapping_marc_field" type="text" value="[% mapping.marc_field %]" />
+                                <input name="mapping_marc_field" type="text" value="[% mapping.marc_field | html %]" />
                             </td>
                             <td><a class="btn btn-default btn-xs delete" style="cursor: pointer;"><i class="fa fa-trash"></i> Delete</a></td>
                           </tr>
@@ -253,10 +254,10 @@ a.add, a.delete {
                       <tfoot>
                         <tr class="nodrag nodrop">
                           <td>
-                            <input data-id="mapping_index_name" type="hidden" value="[% index.index_name %]" />
+                            <input data-id="mapping_index_name" type="hidden" value="[% index.index_name | html %]" />
                             <select data-id="mapping_search_field_name">
                              [% FOREACH f IN all_search_fields %]
-                               <option value="[% f.name %]">[% f.name %]</option>
+                               <option value="[% f.name | html %]">[% f.name | html %]</option>
                              [% END %]
                             </select>
                           </td>
index 86226cb..6e9c942 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -19,7 +20,7 @@
     <div class="yui-b">
     <h1 class="parameters">
         [% IF humanbranch %]
-            Defining circulation and fine rules for "[% Branches.GetName( humanbranch ) %]"
+            Defining circulation and fine rules for "[% Branches.GetName( humanbranch ) | html %]"
         [% ELSE %]
             Defining circulation and fine rules for all libraries
         [% END %]
@@ -49,7 +50,7 @@
         [% IF ( definedbranch ) %]
             <form action="/cgi-bin/koha/admin/clone-rules.pl" method="post">
                 <label for="tobranch"><strong>Clone these rules to:</strong></label>
-                <input type="hidden" name="frombranch" value="[% current_branch %]" />
+                <input type="hidden" name="frombranch" value="[% current_branch | html %]" />
                 <select name="tobranch" id="tobranch">
                     [% PROCESS options_for_libraries libraries => Branches.all( unfiltered => 1 ) %]
                 </select>
@@ -59,7 +60,7 @@
 
         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
             <input type="hidden" name="op" value="add" />
-            <input type="hidden" name="branch" value="[% current_branch %]"/>
+            <input type="hidden" name="branch" value="[% current_branch | html %]"/>
             <table id="default-circulation-rules">
             <thead>
             <tr>
             </thead>
             <tbody>
                                [% FOREACH rule IN rules %]
-                                       <tr id="row_[% loop.count %]">
+                                       <tr id="row_[% loop.count | html %]">
                                                        <td>[% IF ( rule.default_humancategorycode ) %]
                                                                        <em>All</em>
                                                                [% ELSE %]
-                                                                       [% rule.humancategorycode %]
+                                                                       [% rule.humancategorycode | html %]
                                                                [% END %]
                                                        </td>
                             <td>[% IF rule.default_translated_description %]
                                                                        <em>All</em>
                                                                [% ELSE %]
-                                                                       [% rule.translated_description %]
+                                                                       [% rule.translated_description | html %]
                                                                [% END %]
                                                        </td>
                                                         <td class="actions">
                                                           <a href="#" class="editrule btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                                                          <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete&amp;itemtype=[% rule.itemtype %]&amp;categorycode=[% rule.categorycode %]&amp;branch=[% rule.current_branch %]"><i class="fa fa-trash"></i> Delete</a>
+                                                          <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete&amp;itemtype=[% rule.itemtype | html %]&amp;categorycode=[% rule.categorycode | html %]&amp;branch=[% rule.current_branch | html %]"><i class="fa fa-trash"></i> Delete</a>
                                                         </td>
 
                                                        <td>[% IF ( rule.unlimited_maxissueqty ) %]
                                                                        <span>Unlimited</span>
                                                                [% ELSE %]
-                                                                       [% rule.maxissueqty %]
+                                                                       [% rule.maxissueqty | html %]
                                                                [% END %]
                                                        </td>
                             <td>[% IF rule.unlimited_maxonsiteissueqty %]
                                     <span>Unlimited</span>
                                 [% ELSE %]
-                                    [% rule.maxonsiteissueqty %]
+                                    [% rule.maxonsiteissueqty | html %]
                                 [% END %]
                             </td>
-                                                       <td>[% rule.issuelength %]</td>
+                                                       <td>[% rule.issuelength | html %]</td>
                                                        <td>
-                                                           [% rule.lengthunit %]
+                                                           [% rule.lengthunit | html %]
                                                        </td>
                             <td>
                               [% IF ( rule.hardduedate ) %]
                                 [% IF ( rule.hardduedatebefore ) %]
-                                  before [% rule.hardduedate %]
+                                  before [% rule.hardduedate | html %]
                                   <input type="hidden" name="hardduedatecomparebackup" value="-1" />
                                 [% ELSIF ( rule.hardduedateexact ) %]
-                                  on [% rule.hardduedate %]
+                                  on [% rule.hardduedate | html %]
                                   <input type="hidden" name="hardduedatecomparebackup" value="0" />
                                 [% ELSIF ( rule.hardduedateafter ) %]
-                                  after [% rule.hardduedate %]
+                                  after [% rule.hardduedate | html %]
                                   <input type="hidden" name="hardduedatecomparebackup" value="1" />
                                 [% END %]
                               [% ELSE %]
                                 <span>None defined</span>
                               [% END %]
                             </td>
-                                                       <td>[% rule.fine %]</td>
-                                                       <td>[% rule.chargeperiod %]</td>
+                                                       <td>[% rule.fine | html %]</td>
+                                                       <td>[% rule.chargeperiod | html %]</td>
                             <td>
                                 [% IF rule.chargeperiod_charge_at %]
                                     <span>Start of interval</span>
                                     <span>End of interval</span>
                                 [% END %]
                             </td>
-                                                       <td>[% rule.firstremind %]</td>
+                                                       <td>[% rule.firstremind | html %]</td>
                             <td>[% rule.overduefinescap FILTER format("%.2f") %]</td>
                             <td>
                                 [% IF rule.cap_fine_to_replacement_price %]
                                     <input type="checkbox" disabled="disabled" />
                                 [% END %]
                             </td>
-                                                       <td>[% rule.finedays %]</td>
-                            <td>[% rule.maxsuspensiondays %]</td>
-                            <td>[% rule.suspension_chargeperiod %]</td>
-                                                       <td>[% rule.renewalsallowed %]</td>
-                            <td>[% rule.renewalperiod %]</td>
-                            <td>[% rule.norenewalbefore %]</td>
+                                                       <td>[% rule.finedays | html %]</td>
+                            <td>[% rule.maxsuspensiondays | html %]</td>
+                            <td>[% rule.suspension_chargeperiod | html %]</td>
+                                                       <td>[% rule.renewalsallowed | html %]</td>
+                            <td>[% rule.renewalperiod | html %]</td>
+                            <td>[% rule.norenewalbefore | html %]</td>
                             <td>
                                 [% IF ( rule.auto_renew ) %]
                                     <span>Yes</span>
                                     <span>No</span>
                                 [% END %]
                             </td>
-                            <td>[% rule.no_auto_renewal_after %]</td>
-                            <td>[% rule.no_auto_renewal_after_hard_limit %]</td>
-                                                       <td>[% rule.reservesallowed %]</td>
-                                                        <td>[% rule.holds_per_record %]</td>
+                            <td>[% rule.no_auto_renewal_after | html %]</td>
+                            <td>[% rule.no_auto_renewal_after_hard_limit | html %]</td>
+                                                       <td>[% rule.reservesallowed | html %]</td>
+                                                        <td>[% rule.holds_per_record | html %]</td>
                                                         <td>
                                                             [% IF rule.onshelfholds == 1 %]
                                                                 <span>Yes</span>
                                                                 <span>Item only</span>
                                                             [% END %]
                                                         </td>
-                                                       <td>[% rule.rentaldiscount %]</td>
+                                                       <td>[% rule.rentaldiscount | html %]</td>
                                                         <td class="actions">
                                                           <a href="#" class="editrule btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                                                          <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete&amp;itemtype=[% rule.itemtype %]&amp;categorycode=[% rule.categorycode %]&amp;branch=[% rule.current_branch %]"><i class="fa fa-trash"></i> Delete</a>
+                                                          <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete&amp;itemtype=[% rule.itemtype | html %]&amp;categorycode=[% rule.categorycode | html %]&amp;branch=[% rule.current_branch | html %]"><i class="fa fa-trash"></i> Delete</a>
                                                         </td>
 
                        </tr>
                         <select name="categorycode" id="categorycode">
                             <option value="*">All</option>
                         [% FOREACH patron_category IN patron_categories%]
-                            <option value="[% patron_category.categorycode %]">[% patron_category.description %]</option>
+                            <option value="[% patron_category.categorycode | html %]">[% patron_category.description | html %]</option>
                         [% END %]
                         </select>
                     </td>
                         <select name="itemtype" id="matrixitemtype" style="width:13em;">
                             <option value="*">All</option>
                         [% FOREACH itemtypeloo IN itemtypeloop %]
-                            <option value="[% itemtypeloo.itemtype %]">[% itemtypeloo.translated_description %]</option>
+                            <option value="[% itemtypeloo.itemtype | html %]">[% itemtypeloo.translated_description | html %]</option>
                         [% END %]
                         </select>
                     </td>
                     <td class="actions">
-                        <input type="hidden" name="branch" value="[% current_branch %]"/>
+                        <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-save"></i> Save</button>
                         <button name="cancel" class="clear_edit btn btn-default btn-xs"><i class="fa fa-undo"></i> Clear</button>
                     </td>
                            <option value="0">Exactly on</option>
                            <option value="1">After</option>
                         </select>
-                        <input type="text" size="10" id="hardduedate" name="hardduedate" value="[% hardduedate %]" class="datepicker" />
+                        <input type="text" size="10" id="hardduedate" name="hardduedate" value="[% hardduedate | html %]" class="datepicker" />
                         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
                     </td>
                     <td><input type="text" name="fine" id="fine" size="4" /></td>
                     </td>
                     <td><input type="text" name="no_auto_renewal_after" id="no_auto_renewal_after" size="3" /></td>
                     <td>
-                        <input type="text" size="10" name="no_auto_renewal_after_hard_limit" id="no_auto_renewal_after_hard_limit" value="[% no_auto_renewal_after_hard_limit %]" class="datepicker"/>
+                        <input type="text" size="10" name="no_auto_renewal_after_hard_limit" id="no_auto_renewal_after_hard_limit" value="[% no_auto_renewal_after_hard_limit | html %]" class="datepicker"/>
                         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
                     </td>
                     <td><input type="text" name="reservesallowed" id="reservesallowed" size="2" /></td>
                     </td>
                     <td><input type="text" name="rentaldiscount" id="rentaldiscount" size="2" /></td>
                     <td class="actions">
-                        <input type="hidden" name="branch" value="[% current_branch %]"/>
+                        <input type="hidden" name="branch" value="[% current_branch | html %]"/>
                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-save"></i> Save</button>
                         <button name="cancel" class="clear_edit btn btn-default btn-xs"><i class="fa fa-undo"></i> Clear</button>
                     </td>
         </form>
     </div>
     <div id="defaults-for-this-library" class="container">
-    <h3>Default checkout, hold and return policy[% IF humanbranch %] for [% Branches.GetName( humanbranch ) %][% END %]</h3>
+    <h3>Default checkout, hold and return policy[% IF humanbranch %] for [% Branches.GetName( humanbranch ) | html %][% END %]</h3>
         <p>You can set a default maximum number of checkouts, hold policy and return policy that will be used if none is defined below for a particular item type or category.</p>
         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
             <input type="hidden" name="op" value="set-branch-defaults" />
-            <input type="hidden" name="branch" value="[% current_branch %]"/>
+            <input type="hidden" name="branch" value="[% current_branch | html %]"/>
             <table>
                 <tr>
                     <th>&nbsp;</th>
                 </tr>
                 <tr>
                     <td><em>Defaults[% UNLESS ( default_rules ) %] (not set)[% END %]</em></td>
-                    <td><input type="text" name="maxissueqty" size="3" value="[% default_maxissueqty %]"/></td>
-                    <td><input type="text" name="maxonsiteissueqty" size="3" value="[% default_maxonsiteissueqty %]"/></td>
+                    <td><input type="text" name="maxissueqty" size="3" value="[% default_maxissueqty | html %]"/></td>
+                    <td><input type="text" name="maxonsiteissueqty" size="3" value="[% default_maxonsiteissueqty | html %]"/></td>
                     <td>
                         <select name="holdallowed">
                             [% IF ( default_holdallowed_any ) %]
                     </td>
                     <td class="actions">
                         <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-save"></i> Save</button>
-                        <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-cat&amp;categorycode=*&amp;branch=[% current_branch %]" id="unset"><i class="fa fa-undo"></i> Unset</a>
+                        <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-cat&amp;categorycode=*&amp;branch=[% current_branch | html %]" id="unset"><i class="fa fa-undo"></i> Unset</a>
                     </td>
                 </tr>
             </table>
     </div>
     [% IF ( show_branch_cat_rule_form ) %]
     <div id="holds-policy-by-patron-category" class="container">
-    <h3>[% IF humanbranch %]Checkout limit by patron category for [% Branches.GetName( humanbranch ) %][% ELSE %]Default checkout limit by patron category[% END %]</h3>
+    <h3>[% IF humanbranch %]Checkout limit by patron category for [% Branches.GetName( humanbranch ) | html %][% ELSE %]Default checkout limit by patron category[% END %]</h3>
         <p>For this library, you can specify the maximum number of loans that
             a patron of a given category can make, regardless of the item type.
         </p>
         </p>
         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
             <input type="hidden" name="op" value="add-branch-cat" />
-            <input type="hidden" name="branch" value="[% current_branch %]"/>
+            <input type="hidden" name="branch" value="[% current_branch | html %]"/>
             <table>
                 <tr>
                     <th>Patron category</th>
                         <td>[% IF ( branch_cat_rule_loo.default_humancategorycode ) %]
                                 <em>Default</em>
                             [% ELSE %]
-                                [% branch_cat_rule_loo.humancategorycode %]
+                                [% branch_cat_rule_loo.humancategorycode | html %]
                             [% END %]
                         </td>
                         <td>[% IF ( branch_cat_rule_loo.unlimited_maxissueqty ) %]
                                 <span>Unlimited</span>
                             [% ELSE %]
-                                [% branch_cat_rule_loo.maxissueqty %]
+                                [% branch_cat_rule_loo.maxissueqty | html %]
                             [% END %]
                         </td>
                         <td>[% IF ( branch_cat_rule_loo.unlimited_maxonsiteissueqty ) %]
                                 <span>Unlimited</span>
                             [% ELSE %]
-                                [% branch_cat_rule_loo.maxonsiteissueqty %]
+                                [% branch_cat_rule_loo.maxonsiteissueqty | html %]
                             [% END %]
                         </td>
 
                         <td class="actions">
-                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-cat&amp;categorycode=[% branch_cat_rule_loo.categorycode %]&amp;branch=[% current_branch %]"><i class="fa fa-trash"></i> Delete</a>
+                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-cat&amp;categorycode=[% branch_cat_rule_loo.categorycode | html %]&amp;branch=[% current_branch | html %]"><i class="fa fa-trash"></i> Delete</a>
                         </td>
                     </tr>
                 [% END %]
                     <td>
                         <select name="categorycode">
                         [% FOREACH patron_category IN patron_categories%]
-                            <option value="[% patron_category.categorycode %]">[% patron_category.description %]</option>
+                            <option value="[% patron_category.categorycode | html %]">[% patron_category.description | html %]</option>
                         [% END %]
                         </select>
                     </td>
   [% IF current_branch == '*' %]
     <h3>Default lost item fee refund on return policy</h3>
   [% ELSE %]
-    <h3>Lost item fee refund on return policy for [% Branches.GetName(current_branch) %]</h3>
+    <h3>Lost item fee refund on return policy for [% Branches.GetName(current_branch) | html %]</h3>
   [% END %]
         <p>Specify the default policy for lost item fees on return.
         </p>
         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
             <input type="hidden" name="op" value="mod-refund-lost-item-fee-rule" />
-            <input type="hidden" name="branch" value="[% current_branch %]" />
+            <input type="hidden" name="branch" value="[% current_branch | html %]" />
             <table>
                 <tr>
                     <th>Refund lost item fee</th>
     </div>
 
     <div id="holds-policy-by-item-type" class="container">
-    <h3>[% IF humanbranch %]Holds policy by item type for [% Branches.GetName( humanbranch ) %][% ELSE %]Default holds policy by item type[% END %]</h3>
+    <h3>[% IF humanbranch %]Holds policy by item type for [% Branches.GetName( humanbranch ) | html %][% ELSE %]Default holds policy by item type[% END %]</h3>
         <p>
             For this library, you can edit rules for given itemtypes, regardless
             of the patron's category.
 
         <form method="post" action="/cgi-bin/koha/admin/smart-rules.pl">
             <input type="hidden" name="op" value="add-branch-item" />
-            <input type="hidden" name="branch" value="[% current_branch %]"/>
+            <input type="hidden" name="branch" value="[% current_branch | html %]"/>
             <table>
                 <tr>
                     <th>Item type</th>
                         <td>[% IF ( branch_item_rule_loo.default_translated_description ) %]
                                 <em>Default</em>
                             [% ELSE %]
-                                [% branch_item_rule_loo.translated_description %]
+                                [% branch_item_rule_loo.translated_description | html %]
                             [% END %]
                         </td>
                         <td>[% IF ( branch_item_rule_loo.holdallowed_any ) %]
                             [% END %]
                         </td>
                         <td class="actions">
-                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-item&amp;itemtype=[% branch_item_rule_loo.itemtype %]&amp;branch=[% current_branch %]"><i class="fa fa-trash"></i> Delete</a>
+                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/admin/smart-rules.pl?op=delete-branch-item&amp;itemtype=[% branch_item_rule_loo.itemtype | html %]&amp;branch=[% current_branch | html %]"><i class="fa fa-trash"></i> Delete</a>
                         </td>
                     </tr>
                 [% END %]
                     <td>
                         <select name="itemtype">
                         [% FOREACH itemtypeloo IN itemtypeloop %]
-                            <option value="[% itemtypeloo.itemtype %]">[% itemtypeloo.translated_description %]</option>
+                            <option value="[% itemtypeloo.itemtype | html %]">[% itemtypeloo.translated_description | html %]</option>
                         [% END %]
                         </select>
                     </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
 
index 4c41178..58c3a25 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
                         <tbody>
                             [% FOREACH p IN providers %]
                                 <tr>
-                                    <td id="name_[% p.id %]">[% p.name %]</td>
-                                    <td id="domain_[% p.id %]">[% p.domain %]</td>
-                                    <td id="patrons_using_[% p.id %]">[% p.patrons_using %]</td>
+                                    <td id="name_[% p.id | html %]">[% p.name | html %]</td>
+                                    <td id="domain_[% p.id | html %]">[% p.domain | html %]</td>
+                                    <td id="patrons_using_[% p.id | html %]">[% p.patrons_using | html %]</td>
                                     <td class="actions">
-                                        <a class="btn btn-default btn-xs edit" href="#" id="edit_[% p.id %]" data-providerid="[% p.id %]">
+                                        <a class="btn btn-default btn-xs edit" href="#" id="edit_[% p.id | html %]" data-providerid="[% p.id | html %]">
                                             <i class="fa fa-pencil"></i> Edit
                                         </a>
-                                        <a class="btn btn-default btn-xs delete" href="#" data-providerid="[% p.id %]" data-patrons_using="[% p.patrons_using %]" id="delete_[% p.id %]">
+                                        <a class="btn btn-default btn-xs delete" href="#" data-providerid="[% p.id | html %]" data-patrons_using="[% p.patrons_using | html %]" id="delete_[% p.id | html %]">
                                             <i class="fa fa-trash"></i> Delete
                                         </a>
                                     </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         var MSG_SMS_PATRONS_USING = _("Are you sure you want to delete %s? %s patron(s) are using it!");
         var MSG_SMS_DELETE_CONFIRM = _("Are you sure you want to delete %s?");
         var LABEL_SMS_ADD_PROVIDER = _("Add an SMS cellular provider");
         var LABEL_SMS_EDIT_PROVIDER = _("Edit provider %s");
     </script>
-    [% Asset.js("js/sms_providers.js") %]
+    [% Asset.js("js/sms_providers.js") | $raw %]
 [% END %]
 [% INCLUDE 'intranet-bottom.inc' %]
index c37d1c2..73caffc 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
                         <ol>
                             <li>
                                 <label for="title">Title: </label>
-                                <input id="title" type="text" value="[% mapping.title %]" />
+                                <input id="title" type="text" value="[% mapping.title | html %]" />
                             </li>
                             <li>
                                 <label for="isbn">ISBN: </label>
-                                <input id="isbn" type="text" value="[% mapping.isbn %]" />
+                                <input id="isbn" type="text" value="[% mapping.isbn | html %]" />
                             </li>
                             <li>
                                 <label for="lccall">LC call number: </label>
-                                <input id="lccall" type="text" value="[% mapping.lccall %]" />
+                                <input id="lccall" type="text" value="[% mapping.lccall | html %]" />
                             </li>
                             <li>
                                 <label for="controlnumber">Control number: </label>
-                                <input id="controlnumber" type="text" value="[% mapping.controlnumber %]" />
+                                <input id="controlnumber" type="text" value="[% mapping.controlnumber | html %]" />
                             </li>
                             <li>
                                 <label for="srchany">Any: </label>
-                                <input id="srchany" type="text" value="[% mapping.srchany %]" />
+                                <input id="srchany" type="text" value="[% mapping.srchany | html %]" />
                             </li>
                         </ol>
                     </div>
                         <ol>
                             <li>
                                 <label for="author">Author: </label>
-                                <input id="author" type="text" value="[% mapping.author %]" />
+                                <input id="author" type="text" value="[% mapping.author | html %]" />
                             </li>
                             <li>
                                 <label for="issn">ISSN: </label>
-                                <input id="issn" type="text" value="[% mapping.issn %]" />
+                                <input id="issn" type="text" value="[% mapping.issn | html %]" />
                             </li>
                             <li>
                                 <label for="subject">Subject: </label>
-                                <input id="subject" type="text" value="[% mapping.subject %]" />
+                                <input id="subject" type="text" value="[% mapping.subject | html %]" />
                             </li>
                             <li>
                                 <label for="dewey">Dewey: </label>
-                                <input id="dewey" type="text" value="[% mapping.dewey %]" />
+                                <input id="dewey" type="text" value="[% mapping.dewey | html %]" />
                             </li>
                             <li>
                                 <label for="stdid">Standard ID: </label>
-                                <input id="stdid" type="text" value="[% mapping.stdid %]" />
+                                <input id="stdid" type="text" value="[% mapping.stdid | html %]" />
                             </li>
                         </ol>
                     </div>
@@ -72,7 +73,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#form01").submit(function(event) {
index 5d1c786..b1999fe 100644 (file)
                         <ol>
                             <li>
                                 <label for="srchany">Keyword (any): </label>
-                                <input id="srchany" type="text" value="[% FILTER html %][% mapping.srchany %][% END %]" />
+                                <input id="srchany" type="text" value="[% FILTER html %][% mapping.srchany | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="nameany">Name (any): </label>
-                                <input id="nameany" type="text" value="[% FILTER html %][% mapping.nameany %][% END %]" />
+                                <input id="nameany" type="text" value="[% FILTER html %][% mapping.nameany | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="authorany">Author (any): </label>
-                                <input id="authorany" type="text" value="[% FILTER html %][% mapping.authorany %][% END %]" />
+                                <input id="authorany" type="text" value="[% FILTER html %][% mapping.authorany | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="authorpersonal">Author (personal): </label>
-                                <input id="authorpersonal" type="text" value="[% FILTER html %][% mapping.authorpersonal %][% END %]" />
+                                <input id="authorpersonal" type="text" value="[% FILTER html %][% mapping.authorpersonal | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="authorcorp">Author (corporate): </label>
-                                <input id="authorcorp" type="text" value="[% FILTER html %][% mapping.authorcorp %][% END %]" />
+                                <input id="authorcorp" type="text" value="[% FILTER html %][% mapping.authorcorp | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="authormeetingcon">Author (meeting/conference): </label>
-                                <input id="authormeetingcon" type="text" value="[% FILTER html %][% mapping.authormeetingcon %][% END %]" />
+                                <input id="authormeetingcon" type="text" value="[% FILTER html %][% mapping.authormeetingcon | html %][% END %]" />
                             </li>
                         </ol>
                     </div>
                         <ol>
                             <li>
                                 <label for="subject">Subject heading: </label>
-                                <input id="subject" type="text" value="[% FILTER html %][% mapping.subject %][% END %]" />
+                                <input id="subject" type="text" value="[% FILTER html %][% mapping.subject | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="subjectsubdiv">Subject sub-division: </label>
-                                <input id="subjectsubdiv" type="text" value="[% FILTER html %][% mapping.subjectsubdiv %][% END %]" />
+                                <input id="subjectsubdiv" type="text" value="[% FILTER html %][% mapping.subjectsubdiv | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="title">Title (any): </label>
-                                <input id="title" type="text" value="[% FILTER html %][% mapping.title %][% END %]" />
+                                <input id="title" type="text" value="[% FILTER html %][% mapping.title | html %][% END %]" />
                             </li>
                             <li>
                                 <label for="uniformtitle">Title (uniform): </label>
-                                <input id="uniformtitle" type="text" value="[% FILTER html %][% mapping.uniformtitle %][% END %]" />
+                                <input id="uniformtitle" type="text" value="[% FILTER html %][% mapping.uniformtitle | html %][% END %]" />
                             </li>
                         </ol>
                     </div>
index c0b1148..7cd8e8d 100644 (file)
@@ -1,19 +1,20 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Administration &rsaquo; [% IF ( add_form ) %] System preferences &rsaquo; [% IF ( modify ) %]Modify system preference '[% searchfield %]'[% ELSE %]Add a system preference[% END %][% END %][% IF ( add_validate ) %] System preferences &rsaquo; Data added[% END %]
-[% IF ( delete_confirm ) %] System preferences &rsaquo; [% searchfield %] &rsaquo; Confirm deletion of parameter '[% searchfield %]'[% END %][% IF ( delete_confirmed ) %] System preferences &rsaquo; Parameter deleted[% END %][% IF ( else ) %]System preferences[% END %]</title>
+<title>Koha &rsaquo; Administration &rsaquo; [% IF ( add_form ) %] System preferences &rsaquo; [% IF ( modify ) %]Modify system preference '[% searchfield | html %]'[% ELSE %]Add a system preference[% END %][% END %][% IF ( add_validate ) %] System preferences &rsaquo; Data added[% END %]
+[% IF ( delete_confirm ) %] System preferences &rsaquo; [% searchfield | html %] &rsaquo; Confirm deletion of parameter '[% searchfield | html %]'[% END %][% IF ( delete_confirmed ) %] System preferences &rsaquo; Parameter deleted[% END %][% IF ( else ) %]System preferences[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="admin_systempreferences" class="admin">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'prefs-admin-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( add_form ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; [% IF ( modify ) %]Modify system preference '[% searchfield %]'[% ELSE %]Add a system preference[% END %][% END %][% IF ( add_validate ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; Data added[% END %]
-[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System Preferences</a> &rsaquo; <a href="/cgi-bin/koha/admin/systempreferences.pl?op=add_form&amp;searchfield=[% searchfield %]">[% searchfield %]</a> &rsaquo; Confirm deletion of parameter '[% searchfield %]'[% END %][% IF ( delete_confirmed ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; Parameter deleted[% END %][% IF ( else ) %]System preferences[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo; [% IF ( add_form ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; [% IF ( modify ) %]Modify system preference '[% searchfield | html %]'[% ELSE %]Add a system preference[% END %][% END %][% IF ( add_validate ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; Data added[% END %]
+[% IF ( delete_confirm ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System Preferences</a> &rsaquo; <a href="/cgi-bin/koha/admin/systempreferences.pl?op=add_form&amp;searchfield=[% searchfield | html %]">[% searchfield | html %]</a> &rsaquo; Confirm deletion of parameter '[% searchfield | html %]'[% END %][% IF ( delete_confirmed ) %] <a href="/cgi-bin/koha/admin/systempreferences.pl">System preferences</a> &rsaquo; Parameter deleted[% END %][% IF ( else ) %]System preferences[% END %]</div>
 
 <div id="doc3" class="yui-t2">
    
 
 [% IF ( add_form ) %]
         [% IF ( type_upload ) %]
-            <form action="[% script_name %]" name="Aform" method="post" enctype="multipart/form-data">
+            <form action="[% script_name | html %]" name="Aform" method="post" enctype="multipart/form-data">
         [% ELSE %]
-            <form action="[% script_name %]" name="Aform" method="post">
+            <form action="[% script_name | html %]" name="Aform" method="post">
         [% END %]
         <fieldset class="rows"><legend>
         [% IF ( modify ) %]Modify
         [% ELSE %]Add
         [% END %] a system preference</legend><ol>
-            <li><label for="explanation">Explanation: </label><input type="text" name="explanation" id="explanation" size="60" value="[% explanation |html %]" /><input type="hidden" name="op" value="add_validate" /></li>
-            <li>[% IF ( searchfield ) %]<span class="label">Variable: </span>[% searchfield %]<input type="hidden" name="variable" value="[% searchfield %]" />
+            <li><label for="explanation">Explanation: </label><input type="text" name="explanation" id="explanation" size="60" value="[% explanation | html %]" /><input type="hidden" name="op" value="add_validate" /></li>
+            <li>[% IF ( searchfield ) %]<span class="label">Variable: </span>[% searchfield | html %]<input type="hidden" name="variable" value="[% searchfield | html %]" />
             [% ELSE %]<label for="variable">Variable: </label><input type="text" name="variable" id="variable" size="60" />[% END %]</li>
             <li><label for="value">Value: </label>
                 [% IF ( type_free ) %]
-                    <textarea id="value" name="value" cols="[% fieldlength %]">[% value |html %]</textarea>
+                    <textarea id="value" name="value" cols="[% fieldlength | html %]">[% value | html %]</textarea>
                 [% ELSIF ( type_upload ) %]
                     <input type="file" name="value" />
                 [% ELSIF ( type_textarea || type_htmlarea ) %]
                     [% IF ( type_htmlarea ) && ( Koha.Preference('UseWYSIWYGinSystemPreferences') ) %]
-                        <textarea class="mce" name="value" id="value" rows="[% rows %]" cols="[% cols %]">[% value |html %]</textarea>
+                        <textarea class="mce" name="value" id="value" rows="[% rows | html %]" cols="[% cols | html %]">[% value | html %]</textarea>
                     [% ELSE %]
-                    <textarea name="value" id="value" rows="[% rows %]" cols="[% cols %]">[% value |html %]</textarea>
+                    <textarea name="value" id="value" rows="[% rows | html %]" cols="[% cols | html %]">[% value | html %]</textarea>
                     [% END %]
                 [% ELSIF ( type_choice ) %]
                     <select name="value" id="value">
                         [% FOREACH option IN options %]
                             [% IF ( option.selected ) %]
-                                <option value="[% option.option %]" selected="selected">
+                                <option value="[% option.option | html %]" selected="selected">
                             [% ELSE %]
-                                <option value="[% option.option %]">
-                            [% END %][% option.option %]</option>
+                                <option value="[% option.option | html %]">
+                            [% END %][% option.option | html %]</option>
                         [% END %]
                     </select>
                 [% END %]
         [% FOREACH languages_loo IN languages_loop %]
         <tr><td>
             [% IF ( languages_loo.plural ) %]
-            [% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]
+            [% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]
             [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]<table><tr><td>
                 [% IF ( sublanguages_loo.sublanguage_current ) %]
-                    <label for="[% sublanguages_loo.rfc4646_subtag %]">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]([% sublanguages_loo.rfc4646_subtag %])
+                    <label for="[% sublanguages_loo.rfc4646_subtag | html %]">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]([% sublanguages_loo.rfc4646_subtag | html %])
                     [% IF ( sublanguages_loo.enabled ) %]
-                        <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                        <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                     [% ELSE %]
-                        <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" />
+                        <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" />
                     [% END %]
                     </label>
 
                 [% ELSE %]
-                    <label for="[% sublanguages_loo.rfc4646_subtag %]">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]([% sublanguages_loo.rfc4646_subtag %])
+                    <label for="[% sublanguages_loo.rfc4646_subtag | html %]">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]([% sublanguages_loo.rfc4646_subtag | html %])
                     [% IF ( sublanguages_loo.enabled ) %]
-                        <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                        <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                     [% ELSE %]
-                        <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" />
+                        <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" />
                     [% END %]
                     </label>
                 [% END %]</td></tr></table>
 
             [% ELSE %]
                 [% IF ( languages_loo.current ) %]
-            <label for="[% languages_loo.rfc4646_subtag %]">[% languages_loo.native_description %]([% languages_loo.rfc4646_subtag %])
+            <label for="[% languages_loo.rfc4646_subtag | html %]">[% languages_loo.native_description | html %]([% languages_loo.rfc4646_subtag | html %])
                 [% IF ( languages_loo.group_enabled ) %]
-                    <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="[% languages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                    <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="[% languages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                 [% ELSE %]
-                    <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="[% languages_loo.rfc4646_subtag %]" type="checkbox" />
+                    <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="[% languages_loo.rfc4646_subtag | html %]" type="checkbox" />
                 [% END %]
                     </label>
                 [% ELSE %]
-            <label for="[% languages_loo.rfc4646_subtag %]">[% languages_loo.native_description %]([% languages_loo.rfc4646_subtag %])
+            <label for="[% languages_loo.rfc4646_subtag | html %]">[% languages_loo.native_description | html %]([% languages_loo.rfc4646_subtag | html %])
                 [% IF ( languages_loo.group_enabled ) %]
-                    <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="[% languages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                    <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="[% languages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                 [% ELSE %]
-                    <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="[% languages_loo.rfc4646_subtag %]" type="checkbox" />
+                    <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="[% languages_loo.rfc4646_subtag | html %]" type="checkbox" />
                 [% END %]
                     </label>
                 [% END %]
         </ol></fieldset>
         <fieldset class="action"><input type="submit" value="Save" /> 
           [% IF ( return_tab ) %]
-            <a class="cancel" href="/cgi-bin/koha/admin/systempreferences.pl?tab=[% return_tab %]">Cancel</a>
+            <a class="cancel" href="/cgi-bin/koha/admin/systempreferences.pl?tab=[% return_tab | html %]">Cancel</a>
           [% ELSE %]
             <a class="cancel" href="/cgi-bin/koha/admin/systempreferences.pl">Cancel</a>
           [% END %]
         </select>
         <li><label for="prefoptions">Variable options:</label>
         <div class="hint">(a choice list for choice (separated by |) or cols|rows for texarea)</div>
-        <input type="text" name="prefoptions" id="prefoptions" value="[% prefoptions %]" size="60" maxlength="80" /></li>
+        <input type="text" name="prefoptions" id="prefoptions" value="[% prefoptions | html %]" size="60" maxlength="80" /></li>
         </ol>
         </fieldset>
         </form>
     [% IF ( add_validate ) %]
         <h3>Data recorded</h3>
         
-        <form action="[% script_name %]" method="post">
+        <form action="[% script_name | html %]" method="post">
         <input type="submit" value="OK" />
         </form>
     [% END %]
     
     [% IF ( delete_confirm ) %]
     <table>
-        <caption>Confirm deletion of [% searchfield %]?</caption>
+        <caption>Confirm deletion of [% searchfield | html %]?</caption>
         <tr>
             <th>Variable name:</th>
-            <td>[% searchfield %]</td>
+            <td>[% searchfield | html %]</td>
         </tr>
         <tr><th>Value: </th><td>
-        [% Tvalue %]
+        [% Tvalue | html %]
         </td></tr></table>
-        <form class="inline" action="[% script_name %]" method="post">
+        <form class="inline" action="[% script_name | html %]" method="post">
         <input type="hidden" name="op" value="delete_confirmed" />
-        <input type="hidden" name="searchfield" value="[% searchfield %]" />
-        <input type="hidden" name="Tvalue" value="[% Tvalue %]" />
+        <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
+        <input type="hidden" name="Tvalue" value="[% Tvalue | html %]" />
         <input type="submit"  value="Yes, delete" /></form>
-        <form class="inline" action="[% script_name %]" method="post"><input type="submit" value="No, do not delete" /></form>
+        <form class="inline" action="[% script_name | html %]" method="post"><input type="submit" value="No, do not delete" /></form>
     [% END %]
     
     [% IF ( delete_confirmed ) %]
         <h3>Data deleted</h3>
-        <form action="[% script_name %]" method="post">
+        <form action="[% script_name | html %]" method="post">
             <input type="submit" value="Back to System Preferences" />
         </form>
     [% END %]
     [% IF ( else ) %]
 
     <div id="toolbar" class="btn-toolbar">
-        <a class="btn btn-default btn-sm" id="newstopword" href="[% script_name %]?op=add_form"><i class="fa fa-plus"></i> New preference</a>
+        <a class="btn btn-default btn-sm" id="newstopword" href="[% script_name | html %]?op=add_form"><i class="fa fa-plus"></i> New preference</a>
     </div>
 
     [% IF ( tab != 'local_use' ) %]
     <tbody>[% FOREACH loo IN loop %]
         <tr>
 
-        <td><strong><a href="[% loo.edit %]">[% loo.variable %]</a></strong></td><td> [% loo.explanation |html %]</td>
+        <td><strong><a href="[% loo.edit | html %]">[% loo.variable | html %]</a></strong></td><td> [% loo.explanation | html %]</td>
         [% IF ( loo.oneline ) %]
         <td class="single-line">
         [% ELSE %]
             <form action="/cgi-bin/koha/admin/systempreferences.pl" method="post">
         [% END %]
                 [% IF ( loo.type_free ) %]
-                <input type="text" name="value" size="[% loo.fieldlength %]" value="[% loo.value |html %]" />
+                <input type="text" name="value" size="[% loo.fieldlength | html %]" value="[% loo.value | html %]" />
                 [% END %]
                 [% IF ( loo.type_upload ) %]
-                <input type="file" name="value" value="[% loo.value |html %]" />
+                <input type="file" name="value" value="[% loo.value | html %]" />
                 [% END %]
                 [% IF ( loo.type_textarea ) || ( loo.type_htmlarea ) %]
                     [% IF ( loo.type_htmlarea ) && ( Koha.Preference('UseWYSIWYGinSystemPreferences') ) %]
-                        <textarea class="mce" name="value" rows="[% loo.rows %]" cols="[% loo.cols %]">[% loo.value |html %]</textarea>
+                        <textarea class="mce" name="value" rows="[% loo.rows | html %]" cols="[% loo.cols | html %]">[% loo.value | html %]</textarea>
                     [% ELSE %]
                         <a class="expand-textarea" style="display: none" href="#">Click to edit</a>
-                        <textarea name="value" rows="[% loo.rows %]" cols="[% loo.cols %]">[% loo.value |html %]</textarea>
+                        <textarea name="value" rows="[% loo.rows | html %]" cols="[% loo.cols | html %]">[% loo.value | html %]</textarea>
                     [% END %]
                 [% END %]
                 [% IF ( loo.type_choice ) %]
                 <select name="value">
                     [% FOREACH option IN loo.options %]
                         [% IF ( option.selected ) %]
-                            <option value="[% option.option %]" selected="selected">
+                            <option value="[% option.option | html %]" selected="selected">
                         [% ELSE %]
-                            <option value="[% option.option %]">
-                        [% END %][% option.option %]</option>
+                            <option value="[% option.option | html %]">
+                        [% END %][% option.option | html %]</option>
                     [% END %]
                 </select>
                 [% END %]
                 [% FOREACH languages_loo IN loo.languages_loop %]
                 <tr><td>
                     [% IF ( languages_loo.plural ) %]
-                    [% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]
+                    [% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]
                     [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]<table><tr><td>
                         [% IF ( sublanguages_loo.sublanguage_current ) %]
-                            <label for="[% sublanguages_loo.rfc4646_subtag %]">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]([% sublanguages_loo.rfc4646_subtag %])
+                            <label for="[% sublanguages_loo.rfc4646_subtag | html %]">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]([% sublanguages_loo.rfc4646_subtag | html %])
                             [% IF ( sublanguages_loo.enabled ) %]
-                                <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                                <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                             [% ELSE %]
-                                <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" />
+                                <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" />
                             [% END %]
                             </label>
 
                         [% ELSE %]
-                            <label for="[% sublanguages_loo.rfc4646_subtag %]">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]([% sublanguages_loo.rfc4646_subtag %])
+                            <label for="[% sublanguages_loo.rfc4646_subtag | html %]">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]([% sublanguages_loo.rfc4646_subtag | html %])
                             [% IF ( sublanguages_loo.enabled ) %]
-                                <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                                <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                             [% ELSE %]
-                                <input value="[% sublanguages_loo.rfc4646_subtag %]" name="value" id="[% sublanguages_loo.rfc4646_subtag %]" type="checkbox" />
+                                <input value="[% sublanguages_loo.rfc4646_subtag | html %]" name="value" id="[% sublanguages_loo.rfc4646_subtag | html %]" type="checkbox" />
                             [% END %]
                             </label>
                         [% END %]</td></tr></table>
 
                     [% ELSE %]
                         [% IF ( languages_loo.current ) %]
-                    <label for="[% languages_loo.rfc4646_subtag %]">[% languages_loo.native_description %]([% languages_loo.rfc4646_subtag %])
+                    <label for="[% languages_loo.rfc4646_subtag | html %]">[% languages_loo.native_description | html %]([% languages_loo.rfc4646_subtag | html %])
                         [% IF ( languages_loo.group_enabled ) %]
-                            <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="opac[% languages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                            <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="opac[% languages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                         [% ELSE %]
-                            <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="opac[% languages_loo.rfc4646_subtag %]" type="checkbox" />
+                            <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="opac[% languages_loo.rfc4646_subtag | html %]" type="checkbox" />
                         [% END %]
                             </label>
                         [% ELSE %]
-                    <label for="[% languages_loo.rfc4646_subtag %]">[% languages_loo.native_description %]([% languages_loo.rfc4646_subtag %])
+                    <label for="[% languages_loo.rfc4646_subtag | html %]">[% languages_loo.native_description | html %]([% languages_loo.rfc4646_subtag | html %])
                         [% IF ( languages_loo.group_enabled ) %]
-                            <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="opac[% languages_loo.rfc4646_subtag %]" type="checkbox" checked="checked" />
+                            <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="opac[% languages_loo.rfc4646_subtag | html %]" type="checkbox" checked="checked" />
                         [% ELSE %]
-                            <input value="[% languages_loo.rfc4646_subtag %]" name="value" id="opac[% languages_loo.rfc4646_subtag %]" type="checkbox" />
+                            <input value="[% languages_loo.rfc4646_subtag | html %]" name="value" id="opac[% languages_loo.rfc4646_subtag | html %]" type="checkbox" />
                         [% END %]
                             </label>
                         [% END %]
                     <label for="value-no" class="yesno">OFF</label>
                 [% END %]
                 <input type="hidden" name="op" value="add_validate" />
-                <input type="hidden" name="variable" value="[% loo.variable %]" />
-                <input type="hidden" name="prefoptions" value="[% loo.prefoptions |html %]" />
-                <input type="hidden" name="preftype" value="[% loo.type %]" />
-                <input type="hidden" name="explanation" value="[% loo.explanation |html %]" />
+                <input type="hidden" name="variable" value="[% loo.variable | html %]" />
+                <input type="hidden" name="prefoptions" value="[% loo.prefoptions | html %]" />
+                <input type="hidden" name="preftype" value="[% loo.type | html %]" />
+                <input type="hidden" name="explanation" value="[% loo.explanation | html %]" />
                 <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-save"></i> Save</button>
             </form>
         </td>
 
-        <td class="actions"><a class="btn btn-default btn-xs" href="[% loo.edit %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="[% loo.delete %]"><i class="fa fa-trash"></i> Delete</a></td>
+        <td class="actions"><a class="btn btn-default btn-xs" href="[% loo.edit | html %]"><i class="fa fa-pencil"></i> Edit</a> <a class="btn btn-default btn-xs" href="[% loo.delete | html %]"><i class="fa fa-trash"></i> Delete</a></td>
     </tr>
     [% END %]</tbody>
     </table>
index 17349ed..fd06e16 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -33,7 +34,7 @@
         <h4>There were problems with your submission</h4>
         <ul>
             [% FOR e IN errors %]
-                <li>Invalid value for [% e %]</li>
+                <li>Invalid value for [% e | html %]</li>
             [% END %]
         </ul>
     </div>[% END %]
                     <tr>
                         <th>From \ To</th>
                         [% FOR b IN Branches.all() %]
-                        <th>[% b.branchname %]</th>
+                        <th>[% b.branchname | html %]</th>
                         [% END %]
                     </tr>
                 [% FOR bf IN branchfromloop %]
                     <tr>
-                        <th>[% bf.name %]</th>
+                        <th>[% bf.name | html %]</th>
                     [% FOR bt IN bf.branchtoloop %]
                         <td>
                         [% IF bt.skip %]
                             &nbsp;
                         [% ELSE %]
                             [% IF bt.disabled %]
-                            <div id="celldiv_[% bt.id %]" class="disabled-transfer">
+                            <div id="celldiv_[% bt.id | html %]" class="disabled-transfer">
                             [% ELSE %]
-                            <div id="celldiv_[% bt.id %]">
+                            <div id="celldiv_[% bt.id | html %]">
                             [% END %]
-                            <div class="enable_cost_input" data-cost-id="[% bt.id %]">[% bt.disabled ? '&nbsp;' : bt.value %]</div>
-                            <input type="hidden" name="cost_[% bt.id %]" value="[% bt.value %]" />
+                            <div class="enable_cost_input" data-cost-id="[% bt.id | html %]">[% bt.disabled ? '&nbsp;' : bt.value | html %]</div>
+                            <input type="hidden" name="cost_[% bt.id | html %]" value="[% bt.value | html %]" />
                             [% IF bt.disabled %]
-                            <input type="hidden" name="disable_[% bt.id %]" value="1" />
+                            <input type="hidden" name="disable_[% bt.id | html %]" value="1" />
                             [% END %]
                             </div>
                         [% END %]
@@ -92,7 +93,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     <script type="text/javascript">
         function check_transport_cost(e) {
             var val = e.value;
index 5819de0..25d5aba 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% USE Koha %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Administration &rsaquo; Koha usage statistics</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("lib/leaflet/leaflet.css") %]
+[% Asset.css("lib/leaflet/leaflet.css") | $raw %]
 </head>
 
 <body id="admin_usage_statistics" class="admin">
@@ -21,7 +22,7 @@
     <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this patron category. Perhaps it already exists.
@@ -38,7 +39,7 @@
         [% CASE 'already_exists' %]
             This patron category already exists.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
                         <option value="">&nbsp;</option>
                         [% FOR country IN countries %]
                             [% IF country == UsageStatsCountry %]
-                                <option value="[% country %]" selected="selected">[% country %]</option>
+                                <option value="[% country | html %]" selected="selected">[% country | html %]</option>
                                 [% SET IsUsageStatsCountryValid = 1 %]
                             [% ELSE %]
-                                <option value="[% country %]">[% country %]</option>
+                                <option value="[% country | html %]">[% country | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                     [% UNLESS IsUsageStatsCountryValid %]
-                        Note: The value of your system preference 'UsageStatsCountry' is not valid ([% UsageStatsCountry %]).
+                        Note: The value of your system preference 'UsageStatsCountry' is not valid ([% UsageStatsCountry | html %]).
                         Please select a valid one.
                     [% END %]
                 </li>
                 </li>
                 <li>
                     <label for="UsageStatsLibraryUrl">Library URL: </label>
-                    <input type="text" name="UsageStatsLibraryUrl" value="[% Koha.Preference('UsageStatsLibraryUrl') %]" id="UsageStatsLibraryUrl" />
+                    <input type="text" name="UsageStatsLibraryUrl" value="[% Koha.Preference('UsageStatsLibraryUrl') | html %]" id="UsageStatsLibraryUrl" />
                 </li>
                 <li>
                     <span class="label">Last update: </span>
                     [% IF UsageStatsLastUpdateTime %]
-                        [% UsageStatsLastUpdateTime %]
+                        [% UsageStatsLastUpdateTime | html %]
                     [% ELSE %]
                         Your data have never been shared
                     [% END %]
                 </li>
                 <li>
                     <label for="UsageStatsGeolocation">Geolocation: </label>
-                    <input id="UsageStatsGeolocation" name="UsageStatsGeolocation" value="[% Koha.Preference('UsageStatsGeolocation') %]" type="text" value="[% Koha.Preference('UsageStatsLibrariesInfo') %]" size="35" readonly="readonly" />
-                    <a href="#" class="change_geolocation" data-branchname="" data-id="UsageStatsGeolocation"><img src="[% interface %]/lib/leaflet/images/marker-icon.png" title="Set geolocation" style="max-height: 2em;" /></a>
+                    <input id="UsageStatsGeolocation" name="UsageStatsGeolocation" value="[% Koha.Preference('UsageStatsGeolocation') | html %]" type="text" value="[% Koha.Preference('UsageStatsLibrariesInfo') | html %]" size="35" readonly="readonly" />
+                    <a href="#" class="change_geolocation" data-branchname="" data-id="UsageStatsGeolocation"><img src="[% interface | html %]/lib/leaflet/images/marker-icon.png" title="Set geolocation" style="max-height: 2em;" /></a>
                 </li>
                 <li>
                     <label for="UsageStatsLibrariesInfo">Libraries informations: </label>
                     <ol>
                         [% FOR l IN libraries %]
                         <li>
-                            <label for="[% l.branchcode %]">[% l.branchname %]: </label>
+                            <label for="[% l.branchcode | html %]">[% l.branchname | html %]: </label>
                             <div style="float:left;">
-                                <div>Country: [% l.branchcountry %]</div>
-                                <div>Url: [% l.branchurl %]</div>
+                                <div>Country: [% l.branchcountry | html %]</div>
+                                <div>Url: [% l.branchurl | html %]</div>
                                 <div>
-                                    Geolocation: <input type="text" id="geolocation_[% l.branchcode %]" name="geolocation_[% l.branchcode %]" value="[% l.geolocation %]" size="35" readonly="readonly" />
-                                    <a href="#" class="change_geolocation" data-branchname="[% l.branchname %]" data-id="geolocation_[% l.branchcode %]"><img src="[% interface %]/lib/leaflet/images/marker-icon.png" title="Set geolocation for [% l.branchname %]" style="max-height: 2em;" /></a>
+                                    Geolocation: <input type="text" id="geolocation_[% l.branchcode | html %]" name="geolocation_[% l.branchcode | html %]" value="[% l.geolocation | html %]" size="35" readonly="readonly" />
+                                    <a href="#" class="change_geolocation" data-branchname="[% l.branchname | html %]" data-id="geolocation_[% l.branchcode | html %]"><img src="[% interface | html %]/lib/leaflet/images/marker-icon.png" title="Set geolocation for [% l.branchname | html %]" style="max-height: 2em;" /></a>
                                 </div>
                             </div>
                         </li>
                     <label for="MyPublicLink">See your public page: </label>
                     [% IF Koha.Preference('UsageStatsPublicID') %]
                         [% SET my_url = 'https://hea.koha-community.org/libraries/' _  Koha.Preference('UsageStatsPublicID') %]
-                        <a href="[% my_url %]">[% my_url %]</a>
+                        <a href="[% my_url | html %]">[% my_url | html %]</a>
                     [% ELSE %]
                         You do not have anything public yet.
                     [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/admin-menu.js") %]
-    <script src="[% interface %]/lib/leaflet/leaflet.js"></script>
+    [% Asset.js("js/admin-menu.js") | $raw %]
+    <script src="[% interface | html %]/lib/leaflet/leaflet.js"></script>
     <script type="text/javascript">
         function positionMap() {
             var tbh = $("#mapid");
 
         // Init the map
         [% IF Koha.Preference('UsageStatsGeolocation') %]
-            var latlng = [ [% Koha.Preference('UsageStatsGeolocation') %] ];
+            var latlng = [ [% Koha.Preference('UsageStatsGeolocation') | html %] ];
             add_to_map( current_elt, latlng );
         [% END %]
         [% FOR l IN libraries %]
-            [% NEXT UNLESS l.geolocation %]
-            add_to_map( { 'text': "[% l.branchname %]", 'id': "geolocation_[% l.branchcode %]" }, [ [% l.geolocation %] ] );
+            [% NEXT | html UNLESS l.geolocation %]
+            add_to_map( { 'text': "[% l.branchname | html %]", 'id': "geolocation_[% l.branchcode | html %]" }, [ [% l.geolocation | html %] ] );
         [% END %]
 
         // On click, update the geolocation and the marker
index 21157ef..dbbd765 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 [% END %]
 
 <title>Koha &rsaquo; Administration &rsaquo; Z39.50/SRU servers
-[% IF op == 'edit' %] &rsaquo; Modify [% PROCESS ServerType %] server [% server.servername %][% END %]
+[% IF op == 'edit' %] &rsaquo; Modify [% PROCESS ServerType %] server [% server.servername | html %][% END %]
 [% IF op ==  'add' %] &rsaquo; New [% PROCESS ServerType %] server[% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
 
 [% IF op == 'list' %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 
 </head>
@@ -28,7 +29,7 @@
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/admin/admin-home.pl">Administration</a> &rsaquo;
 <a href="/cgi-bin/koha/admin/z3950servers.pl">Z39.50/SRU servers</a>
-[% IF op == 'edit' %]&rsaquo; Modify [% PROCESS ServerType %] server [% server.servername %][% END %]
+[% IF op == 'edit' %]&rsaquo; Modify [% PROCESS ServerType %] server [% server.servername | html %][% END %]
 [% IF op ==  'add' %]&rsaquo; New [% PROCESS ServerType %] server[% END %]
 </div>
 
 <div class="yui-b">
 
 [% IF msg_deleted %]
-    <div class="dialog alert">Z39.50/SRU server deleted ([% msg_add %])</div>
+    <div class="dialog alert">Z39.50/SRU server deleted ([% msg_add | html %])</div>
 [% ELSIF msg_updated %]
-    <div class="dialog message">Z39.50/SRU server updated ([% msg_add %])</div>
+    <div class="dialog message">Z39.50/SRU server updated ([% msg_add | html %])</div>
 [% ELSIF msg_added %]
-    <div class="dialog message">Z39.50/SRU server added ([% msg_add %])</div>
+    <div class="dialog message">Z39.50/SRU server added ([% msg_add | html %])</div>
 [% ELSIF msg_notfound %]
-    <div class="dialog alert">Error: Server with id [% msg_add %] not found</div>
+    <div class="dialog alert">Error: Server with id [% msg_add | html %] not found</div>
 [% END %]
 
 [% IF ( add_form ) %]
-    <form action="[% script_name %]" name="Aform" method="post" id="serverentry">
+    <form action="[% script_name | html %]" name="Aform" method="post" id="serverentry">
         <input type="hidden" name="op" value="add_validated" />
-        <input type="hidden" name="servertype" value="[% server.servertype||type||'zed' %]"/>
+        <input type="hidden" name="servertype" value="[% server.servertype||type||'zed' | html %]"/>
         [% IF op == 'edit' %]
             <h1>Modify [% PROCESS ServerType %] server</h1>
-            <input type="hidden" name="id" value="[% server.id %]" />
+            <input type="hidden" name="id" value="[% server.id | html %]" />
         [% ELSE %]
             <h1>New [% PROCESS ServerType %] server</h1>
         [% END %]
             <input type="text" name="servername" id="servername" size="65" maxlength="100" value="[% server.servername | html %]" required="required" /> <span class="required">Required</span>
         </li>
 
-        <li><label for="host" class="required">Hostname: </label> <input type="text" name="host" id="host" size="30" value="[% server.host %]" required="required" /> <span class="required">Required</span>
+        <li><label for="host" class="required">Hostname: </label> <input type="text" name="host" id="host" size="30" value="[% server.host | html %]" required="required" /> <span class="required">Required</span>
             [% IF (server.servertype||type) == 'sru' %]
                 <div class="hint">Includes the domain part, but the path part of the URL should go into Database.</div>
             [% END %]
         </li>
-        <li><label for="port" class="required">Port: </label> <input type="text" name="port" id="port" size="5" value="[% server.port %]" required="required" /> <span class="required">Required</span>
+        <li><label for="port" class="required">Port: </label> <input type="text" name="port" id="port" size="5" value="[% server.port | html %]" required="required" /> <span class="required">Required</span>
         </li>
-        <li><label for="db" class="required">Database: </label> <input type="text" name="db" id="db" value="[% server.db %]" required="required" /> <span class="required">Required</span>
+        <li><label for="db" class="required">Database: </label> <input type="text" name="db" id="db" value="[% server.db | html %]" required="required" /> <span class="required">Required</span>
         </li>
-        <li><label for="userid">Userid: </label> <input type="text" name="userid" id="userid" value="[% server.userid %]" />
+        <li><label for="userid">Userid: </label> <input type="text" name="userid" id="userid" value="[% server.userid | html %]" />
         </li>
-        <li><label for="password">Password: </label> <input type="text" name="password" id="password" value="[% server.password %]" />
+        <li><label for="password">Password: </label> <input type="text" name="password" id="password" value="[% server.password | html %]" />
         </li>
         <li><label for="checked">Preselected (searched by default): </label>
         [% IF ( server.checked ) %]
@@ -83,7 +84,7 @@
             <input type="checkbox" name="checked" id="checked" value="1" />
         [% END %]
         </li>
-        <li><label for="rank">Rank (display order): </label> <input type="text" name="rank" id="rank" size="4" value="[% server.rank %]" />
+        <li><label for="rank">Rank (display order): </label> <input type="text" name="rank" id="rank" size="4" value="[% server.rank | html %]" />
         </li>
 
         <li><label for="syntax">Syntax (z3950 can send<br /> records in various format. Choose one): </label>
         <li><label for="encoding">Encoding (z3950 can send<br /> records in various encodings. Choose one): </label>
         <select name="encoding" id="encoding">
             [% FOREACH enc IN [ 'utf8' 'EUC-KR' 'ISO_5426' 'ISO_6937' 'ISO_8859-1' 'MARC-8' ] %]
-                <option value="[% enc %]">[% enc %]</option>
+                <option value="[% enc | html %]">[% enc | html %]</option>
             [% END %]
         </select>
         </li>
 
         <li><label for="timeout">Timeout (0 its like not set): </label>
-        <input type="text" name="timeout" id="timeout" size="4" value="[% server.timeout %]" /> seconds
+        <input type="text" name="timeout" id="timeout" size="4" value="[% server.timeout | html %]" /> seconds
         </li>
         <li><label for="recordtype">Record type: </label>
         <select name="recordtype" id="recordtype">
         [% IF (server.servertype||type) == 'sru' %]
         <li>
         <label for="sru_options">Additional SRU options: </label>
-        <input type="text" name="sru_options" id="sru_options" size="50" value="[% server.sru_options %]"/>
+        <input type="text" name="sru_options" id="sru_options" size="50" value="[% server.sru_options | html %]"/>
         <div class="hint">Separate options by commas. Example: sru=get,sru_version=1.1. See also http://www.indexdata.com/yaz/doc/zoom.html.</div>
         </li>
         <li>
         <label for="sru_fields">SRU Search fields mapping: </label>
-        <input type="hidden" name="sru_fields" id="sru_fields" value="[% FILTER html %][% server.sru_fields %][% END %]" />
-            <input type="text" name="show_sru_fields" id="show_sru_fields" size="100" value="[% FILTER html %][% server.sru_fields %][% END %]" disabled="disabled" /> <input type="button" id="modify_sru_fields" value="Modify" />
+        <input type="hidden" name="sru_fields" id="sru_fields" value="[% server.sru_fields | html %]" />
+            <input type="text" name="show_sru_fields" id="show_sru_fields" size="100" value="[% server.sru_fields | html %]" disabled="disabled" /> <input type="button" id="modify_sru_fields" value="Modify" />
         </li>
         [% END %]
         <li>
         <label for="add_xslt">XSLT File(s) for transforming results: </label>
-        <input type="text" name="add_xslt" id="add_xslt" size="100" value="[% server.add_xslt %]"/>
+        <input type="text" name="add_xslt" id="add_xslt" size="100" value="[% server.add_xslt | html %]"/>
         <div class="hint">Separate multiple filenames by commas.</div>
         </li>
 
     </div>
     <h3>Z39.50/SRU servers administration</h3>
     [% IF id %]
-        You searched for record [% id %]
+        You searched for record [% id | html %]
     [% ELSIF searchfield %]
-        You searched for [% searchfield |html %]
+        You searched for [% searchfield | html %]
     [% END %]
     <table id="serverst">
         <thead><tr><th>Target</th><th>Hostname/Port</th><th>Database</th><th>Userid</th><th>Password</th><th>Preselected</th><th>Rank</th><th>Syntax</th><th>Encoding</th><th>Timeout</th><th>Record type</th><th></th>
         <tbody>
         [% FOREACH loo IN loop %]
             <tr>
-            <td><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&amp;id=[% loo.id %]">[% loo.servername %]</a></td><td>[% loo.host %]:[% loo.port %]</td><td>[% loo.db %]</td><td>[% loo.userid %]</td><td>[% IF loo.password %]########[% END %]</td><td>[% IF ( loo.checked ) %]Yes[% ELSE %]No[% END %]</td><td>[% loo.rank %]</td>
-            <td>[% loo.syntax %]</td><td>[% loo.encoding %]</td><td>[% loo.timeout %]</td>
+            <td><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&amp;id=[% loo.id | html %]">[% loo.servername | html %]</a></td><td>[% loo.host | html %]:[% loo.port | html %]</td><td>[% loo.db | html %]</td><td>[% loo.userid | html %]</td><td>[% IF loo.password %]########[% END %]</td><td>[% IF ( loo.checked ) %]Yes[% ELSE %]No[% END %]</td><td>[% loo.rank | html %]</td>
+            <td>[% loo.syntax | html %]</td><td>[% loo.encoding | html %]</td><td>[% loo.timeout | html %]</td>
             <td>[% IF ( loo.recordtype == 'biblio' )  %]
                 <span>Bibliographic</span>
                 [% ELSIF ( loo.recordtype == 'authority' ) %]
             </td>
             <td>
                 <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-toggle="dropdown" href="#">
                         Actions <b class="caret"></b>
                     </a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id %]">
-                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&amp;id=[% loo.id %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=add&amp;id=[% loo.id %]"><i class="fa fa-copy"></i> Copy</a></li>
-                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=delete_confirmed&amp;id=[% loo.id %]" class="delete" data-servername="[% loo.servername %]"><i class="fa fa-trash"></i> Delete</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]">
+                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=edit&amp;id=[% loo.id | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=add&amp;id=[% loo.id | html %]"><i class="fa fa-copy"></i> Copy</a></li>
+                        <li><a href="/cgi-bin/koha/admin/z3950servers.pl?op=delete_confirmed&amp;id=[% loo.id | html %]" class="delete" data-servername="[% loo.servername | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                     </ul>
                 </div>
             </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/admin-menu.js") %]
+    [% Asset.js("js/admin-menu.js") | $raw %]
     [% IF op == 'list' %]
         [% INCLUDE 'datatables.inc' %]
     [% END %]
             $(document).ready(function(){
                 // Update selects for syntax, encoding and recordtype
                 [% IF server %]
-                    $("#syntax").val('[% server.syntax %]');
-                    $("#encoding").val('[% server.encoding %]');
-                    $("#recordtype").val('[% server.recordtype %]');
+                    $("#syntax").val('[% server.syntax | html %]');
+                    $("#encoding").val('[% server.encoding | html %]');
+                    $("#recordtype").val('[% server.recordtype | html %]');
                 [% END %]
                 $( "#serverentry" ).validate({
                     rules: {
index d4a2b4e..33006b3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -18,7 +19,7 @@
 
 <div id="login">
 <h1><a href="http://koha-community.org">Koha</a></h1>
-[% IF (Koha.Preference('StaffLoginInstructions')) %]<div id="login_instructions">[% Koha.Preference('StaffLoginInstructions') %]</div>[% END %]
+[% IF (Koha.Preference('StaffLoginInstructions')) %]<div id="login_instructions">[% Koha.Preference('StaffLoginInstructions') | $raw %]</div>[% END %]
 [% IF ( nopermission ) %]
 <div id="login_error">
     <strong>Error:</strong>
 [% IF too_many_login_attempts %]
     <div id="login_error"><strong>Error: </strong>This account has been locked!</div>
     [% IF Koha.Preference('OpacResetPassword') && Koha.Preference('OpacBaseURL') %]
-        <a href="[% Koha.Preference('OpacBaseURL') %]/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
+        <a href="[% Koha.Preference('OpacBaseURL') | html %]/cgi-bin/koha/opac-password-recovery.pl">You must reset your password</a>.
     [% END %]
 [% ELSIF invalid_username_or_password %]
 <div id="login_error"><strong>Error: </strong>Invalid username or password</div>
 [% END %]
 
 <!-- login prompt time-->
-<form action="[% script_name %]" method="post" name="loginform" id="loginform">
+<form action="[% script_name | html %]" method="post" name="loginform" id="loginform">
     <input type="hidden" name="koha_login_context" value="intranet" />
 [% FOREACH INPUT IN INPUTS %]
-    <input type="hidden" name="[% INPUT.name |html %]" value="[% INPUT.value |html %]" />
+    <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
 [% END %]
 <p><label for="userid">Username:</label>
-<input type="text" name="userid" id="userid" class="input focus" value="[% userid %]" size="20" tabindex="1" />
+<input type="text" name="userid" id="userid" class="input focus" value="[% userid | html %]" size="20" tabindex="1" />
 </p>
 <p><label for="password">Password:</label>
 <input type="password" name="password" id="password" class="input" value="" size="20" tabindex="2" />
@@ -67,7 +68,7 @@
         <select name="branch" id="branch" class="input" tabindex="3">
             <option value="">My library</option>
             [% FOREACH l IN Branches.all( unfiltered => 1 ) %]
-                <option value="[% l.branchcode %]">[% l.branchname %]</option>
+                <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
             [% END %]
         </select>
     </p>
 [% END %]
 
 [% IF ( casServerUrl ) %]
-    <p><a href="[% casServerUrl %]">If you have a CAS account, please click here to login</a>.<p>
+    <p><a href="[% casServerUrl | html %]">If you have a CAS account, please click here to login</a>.<p>
 [% END %]
 
 [% IF ( casServersLoop ) %]
     <p>If you have a CAS account, please choose against which one you would like to authenticate:</p>
 <ul>
     [% FOREACH casServer IN casServersLoop %]
-        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
+        <li><a href="[% casServer.value | html %]">[% casServer.name | html %]</a></li>
     [% END %]
 [% END %]
 [% END %]
index 8539ab1..493703b 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var index = "[% index %]";
-        var authtypecode = "[% authtypecode %]";
+        var index = "[% index | html %]";
+        var authtypecode = "[% authtypecode | html %]";
     </script>
-    [% Asset.js("js/auth-finder-search.js") %]
+    [% Asset.js("js/auth-finder-search.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' popup_window = 1 %]
index 1fbfd13..e61faa3 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Authorities &rsaquo; [% IF ( authid ) %]Modify authority #[% authid %] ([% authtypetext %])[% ELSE %]Adding authority ([% authtypetext %])[% END %]</title>
+<title>Koha &rsaquo; Authorities &rsaquo; [% IF ( authid ) %]Modify authority #[% authid | html %] ([% authtypetext | html %])[% ELSE %]Adding authority ([% authtypetext | html %])[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-[% Asset.js("js/cataloging.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+[% Asset.js("js/cataloging.js") | $raw %]
 
 <script type="text/javascript">
 //<![CDATA[
@@ -22,7 +23,7 @@
             if (confirm(_("Please note that this Z39.50 search could replace the current record."))){
                 var strQuery = GetZ3950Terms();
                 if(strQuery){
-                    window.open("/cgi-bin/koha/cataloguing/z3950_auth_search.pl?authid=[% authid %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
+                    window.open("/cgi-bin/koha/cataloguing/z3950_auth_search.pl?authid=[% authid | html %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
                 }
             }
             return false;
@@ -36,8 +37,8 @@ function GetZ3950Terms(){
  var strQuery="&authtypecode="+document.forms['f'].authtypecode.value;
     var mandatories = new Array();
     var mandatories_label = new Array();
-    [% FOREACH BIG_LOO IN BIG_LOOP %][% FOREACH innerloo IN BIG_LOO.innerloop %][% FOREACH subfield_loo IN innerloo.subfield_loop %][% IF ( subfield_loo.z3950_mandatory ) %]mandatories.push("[% subfield_loo.id %]");
-        mandatories_label.push("[% subfield_loo.z3950_mandatory %]");[% END %][% END %][% END %][% END %]
+    [% FOREACH BIG_LOO IN BIG_LOOP %][% FOREACH innerloo IN BIG_LOO.innerloop %][% FOREACH subfield_loo IN innerloo.subfield_loop %][% IF ( subfield_loo.z3950_mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
+        mandatories_label.push("[% subfield_loo.z3950_mandatory | html %]");[% END %][% END %][% END %][% END %]
 
     for(var i=0,len=mandatories.length; i<len ; i++){
         var field_value = document.getElementById(mandatories[i]).value;
@@ -59,12 +60,12 @@ function AreMandatoriesNotOk(){
     [% FOREACH BIG_LOO IN BIG_LOOP %]
        [% FOREACH innerloo IN BIG_LOO.innerloop %]
                        [% IF ( innerloo.mandatory ) %]
-                       mandatoriesfields.push(new Array("[% innerloo.tag %]","[% innerloo.index %][% innerloo.random %]","[% innerloo.index %]"));
+                       mandatoriesfields.push(new Array("[% innerloo.tag | html %]","[% innerloo.index | html %][% innerloo.random | html %]","[% innerloo.index | html %]"));
             [% END %]
                [% FOREACH subfield_loo IN innerloo.subfield_loop %]
-                       [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id %]");
-                    tab.push("[% BIG_LOO.number %]");
-                       label.push("[% subfield_loo.marc_lib |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]");
+                       [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
+                    tab.push("[% BIG_LOO.number | html %]");
+                    label.push("[% subfield_loo.marc_lib.raw |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]");
                        [% END %]
                        [% END %]
                [% END %]
@@ -153,7 +154,7 @@ function confirmnotdup(redirect){
 }
 //]]>
 </script>
-[% Asset.css("css/addbiblio.css") %]
+[% Asset.css("css/addbiblio.css") | $raw %]
 
 [% INCLUDE 'select2.inc' %]
 <script>
@@ -163,7 +164,7 @@ function confirmnotdup(redirect){
 </script>
 
 [% IF ( bidi ) %]
-   [% Asset.css("css/right-to-left.css") %]
+   [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
 </head>
 <body id="auth_authorities" class="auth">
@@ -174,25 +175,25 @@ function confirmnotdup(redirect){
 
 [% INCLUDE 'header.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/authorities/authorities-home.pl">Authorities</a> &rsaquo; [% IF ( authid ) %]Modify authority #[% authid %] ([% authtypetext %])[% ELSE %]Adding authority [% authtypetext %][% END %]  </div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/authorities/authorities-home.pl">Authorities</a> &rsaquo; [% IF ( authid ) %]Modify authority #[% authid | html %] ([% authtypetext | html %])[% ELSE %]Adding authority [% authtypetext | html %][% END %]  </div>
 
 <div class="main container-fluid">
     <div class="row">
         <div class="col-md-8 col-md-offset-2">
 
 [% IF ( authid ) %]
-<h1>Modify authority #[% authid %] [% authtypetext %]</h1>
+<h1>Modify authority #[% authid | html %] [% authtypetext | html %]</h1>
 [% ELSE %]
-<h1>Adding authority [% authtypetext %]</h1>
+<h1>Adding authority [% authtypetext | html %]</h1>
 [% END %]
 
 [% IF ( duplicateauthid ) %]
         <div class="dialog alert">
                 <h3>Duplicate record suspected</h3>
-                <p>Is this a duplicate of <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% duplicateauthid %]" class="popup" onclick="openWindow('/cgi-bin/koha/authorities/detail.pl?authid=[% duplicateauthid %]&amp;popup=1', 'DuplicateAuthority','800','600'); return false;" class="button">[% duplicateauthvalue %]</a> ?</p>
+                <p>Is this a duplicate of <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% duplicateauthid | html %]" class="popup" onclick="openWindow('/cgi-bin/koha/authorities/detail.pl?authid=[% duplicateauthid | html %]&amp;popup=1', 'DuplicateAuthority','800','600'); return false;" class="button">[% duplicateauthvalue | html %]</a> ?</p>
 
                 <form action="authorities.pl" method="get">
-                    <input type="hidden" name="authid" value="[% duplicateauthid %]" />
+                    <input type="hidden" name="authid" value="[% duplicateauthid | html %]" />
                     <button type="submit" class="new"><i class="fa fa-pencil"></i> Yes: Edit existing authority</button>
                 </form>
                 <form action="authorities.pl" method="get">
@@ -205,9 +206,9 @@ function confirmnotdup(redirect){
     <input type="hidden" name="op" value="add" />
     <input type="hidden" name="addfield_field" value="" />
     <input type="hidden" name="repeat_field" value="" />
-    <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
-    <input type="hidden" name="authid" value="[% authid %]" />
-    <input type="hidden" name="index" value="[% index %]" />
+    <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
+    <input type="hidden" name="authid" value="[% authid | html %]" />
+    <input type="hidden" name="index" value="[% index | html %]" />
     <input type="hidden" value="0" id="confirm_not_duplicate" name="confirm_not_duplicate" />
 
     <div id="toolbar" class="btn-toolbar">
@@ -220,89 +221,89 @@ function confirmnotdup(redirect){
 <div id="authoritytabs" class="toptabs numbered">
     <ul>
         [% FOREACH BIG_LOO IN BIG_LOOP %]
-        <li><a href="#tab[% BIG_LOO.number %]XX">[% BIG_LOO.number %]</a></li>
+        <li><a href="#tab[% BIG_LOO.number | html %]XX">[% BIG_LOO.number | html %]</a></li>
         [% END %]
     </ul>
 
 [% FOREACH BIG_LOO IN BIG_LOOP %]
-    <div id="tab[% BIG_LOO.number %]XX">
+    <div id="tab[% BIG_LOO.number | html %]XX">
 
     [% FOREACH innerloo IN BIG_LOO.innerloop %]
     [% IF ( innerloo.tag ) %]
-    <div class="tag clearfix" id="tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]">
-        <div class="tag_title" id="div_indicator_tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]">
+    <div class="tag clearfix" id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
+        <div class="tag_title" id="div_indicator_tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
         [% UNLESS hide_marc %]
             [% IF advancedMARCEditor %]
-                <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib %] - Click to Expand this Tag" onclick="ExpandField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;">[% innerloo.tag %]</a>
+                <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to Expand this Tag" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;">[% innerloo.tag | html %]</a>
             [% ELSE %]
-                <span title="[% innerloo.tag_lib %]">[% innerloo.tag %]</span>
+                <span title="[% innerloo.tag_lib | html %]">[% innerloo.tag | html %]</span>
             [% END %]
                 [% IF ( innerloo.fixedfield ) %]
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
                         style="display:none;"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator1 %]" />
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
                         style="display:none;"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator2 %]" />
+                        value="[% innerloo.indicator2 | html %]" />
                 [% ELSE %]
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator1 %]" />
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator2 %]" />
+                        value="[% innerloo.indicator2 | html %]" />
                 [% END %] -
         [% ELSE %]
                 [% IF ( innerloo.fixedfield ) %]
                     <input type="hidden"
                         tabindex="1"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
-                        value="[% innerloo.indicator1 %]" />
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="hidden"
                         tabindex="1"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
-                        value="[% innerloo.indicator2 %]" />
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
+                        value="[% innerloo.indicator2 | html %]" />
                 [% ELSE %]
                     <input type="hidden"
                         tabindex="1"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
-                        value="[% innerloo.indicator1 %]" />
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="hidden"
                         tabindex="1"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
-                        value="[% innerloo.indicator2 %]" />
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
+                        value="[% innerloo.indicator2 | html %]" />
                 [% END %]
         [% END %]
 
             [% UNLESS advancedMARCEditor %]
-                <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;" title="Click to Expand this Tag">[% innerloo.tag_lib %]</a>
+                <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Click to Expand this Tag">[% innerloo.tag_lib | html %]</a>
             [% END %]
                 <span class="field_controls">
                 [% IF ( innerloo.repeatable ) %]
-                    <a href="#" tabindex="1" class="buttonPlus" onclick="CloneField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]','[% hide_marc %]','[% advancedMARCEditor %]'); return false;" title="Repeat this Tag">
-                        <img src="[% interface %]/[% theme %]/img/repeat-tag.png" alt="Repeat this Tag" />
+                    <a href="#" tabindex="1" class="buttonPlus" onclick="CloneField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]','[% hide_marc | html %]','[% advancedMARCEditor | html %]'); return false;" title="Repeat this Tag">
+                        <img src="[% interface | html %]/[% theme | html %]/img/repeat-tag.png" alt="Repeat this Tag" />
                     </a>
                 [% END %]
-                    <a href="#" tabindex="1" class="buttonMinus" onclick="UnCloneField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;" title="Delete this Tag">
-                        <img src="[% interface %]/[% theme %]/img/delete-tag.png" alt="Delete this Tag" />
+                    <a href="#" tabindex="1" class="buttonMinus" onclick="UnCloneField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Delete this Tag">
+                        <img src="[% interface | html %]/[% theme | html %]/img/delete-tag.png" alt="Delete this Tag" />
                     </a>
                 </span>
 
@@ -310,26 +311,26 @@ function confirmnotdup(redirect){
 
         [% FOREACH subfield_loo IN innerloo.subfield_loop %]
             <!--  One line on the marc editor -->
-            <div class="subfield_line" style="[% subfield_loo.visibility %]" id="subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]">
+            <div class="subfield_line" style="[% subfield_loo.visibility | html %]" id="subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]">
 
                 [% UNLESS advancedMARCEditor %]
-                    [% IF ( subfield_loo.fixedfield ) %]<label for="tag_[% subfield_loo.tag %]_subfield_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]" style="display:none;" class="labelsubfield">
-                    [% ELSE %]<label for="tag_[% subfield_loo.tag %]_subfield_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]" class="labelsubfield">
+                    [% IF ( subfield_loo.fixedfield ) %]<label for="tag_[% subfield_loo.tag | html %]_subfield_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]" style="display:none;" class="labelsubfield">
+                    [% ELSE %]<label for="tag_[% subfield_loo.tag | html %]_subfield_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]" class="labelsubfield">
                     [% END %]
                 [% END %]
                 
                 [% UNLESS hide_marc %]
                 <span class="subfieldcode">
                     [% IF ( subfield_loo.fixedfield ) %]
-                        <img class="buttonUp" style="display:none;" src="[% interface %]/[% theme %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]')" alt="Move Up" title="Move Up" />
+                        <img class="buttonUp" style="display:none;" src="[% interface | html %]/[% theme | html %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]')" alt="Move Up" title="Move Up" />
                     [% ELSE %]
-                        <img class="buttonUp" src="[% interface %]/[% theme %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]')" alt="Move Up" title="Move Up" />
+                        <img class="buttonUp" src="[% interface | html %]/[% theme | html %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]')" alt="Move Up" title="Move Up" />
                     [% END %]
                         <input type="text"
-                            title="[% subfield_loo.marc_lib %]"
+                            title="[% subfield_loo.marc_lib | $raw %]"
                             style=" [% IF ( subfield_loo.fixedfield ) %]display:none; [% END %]border:0;"
-                            name="tag_[% subfield_loo.tag %]_code_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]"
-                            value="[% subfield_loo.subfield %]"
+                            name="tag_[% subfield_loo.tag | html %]_code_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]"
+                            value="[% subfield_loo.subfield | html %]"
                             size="1"
                             maxlength="1"
                             class="flat"
@@ -337,13 +338,13 @@ function confirmnotdup(redirect){
                 </span>
                 [% ELSE %]
                     <input type="hidden"
-                        name="tag_[% subfield_loo.tag %]_code_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]"
-                        value="[% subfield_loo.subfield %]" />
+                        name="tag_[% subfield_loo.tag | html %]_code_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]"
+                        value="[% subfield_loo.subfield | html %]" />
                 [% END %]
 
                 [% UNLESS advancedMARCEditor %]
                     [% IF ( subfield_loo.mandatory ) %]<span class="subfield subfield_mandatory">[% ELSE %]<span class="subfield">[% END %]
-                        [% subfield_loo.marc_lib %]
+                        [% subfield_loo.marc_lib | $raw %]
                         [% IF ( subfield_loo.mandatory ) %]<span class="mandatory_marker" title="This field is mandatory">*</span>[% END %]
                     </span>
                     </label>
@@ -351,43 +352,43 @@ function confirmnotdup(redirect){
                 
                 [% SET mv = subfield_loo.marc_value %]
                 [% IF ( mv.type == 'select' ) %]
-                     <select name="[%- mv.name -%]" tabindex="1" size="1" class="input_marceditor" id="[%- mv.id -%]">
+                     <select name="[%- mv.name | html -%]" tabindex="1" size="1" class="input_marceditor" id="[%- mv.id | html -%]">
                      [% FOREACH aval IN mv.values %]
                          [% IF aval == mv.default %]
-                         <option value="[%- aval -%]" selected="selected">[%- mv.labels.$aval -%]</option>
+                         <option value="[%- aval | html -%]" selected="selected">[%- mv.labels.$aval | html -%]</option>
                          [% ELSE %]
-                         <option value="[%- aval -%]">[%- mv.labels.$aval -%]</option>
+                         <option value="[%- aval | html -%]">[%- mv.labels.$aval | html -%]</option>
                          [% END %]
                      [% END %]
                      </select>
                 [% ELSIF ( mv.type == 'text1' ) %]
-                    <input type="text" id="[%- mv.id -%]" name="[%- mv.id -%]" value="[%- mv.value -%]" class="input_marceditor" tabindex="1" />
-                    <a href="#" class="buttonDot" onclick="openAuth(this.parentNode.getElementsByTagName('input')[1].id,'[%- mv.authtypecode -%]','auth'); return false;" tabindex="1" title="Tag editor">...</a>
+                    <input type="text" id="[%- mv.id | html -%]" name="[%- mv.id | html -%]" value="[%- mv.value | html -%]" class="input_marceditor" tabindex="1" />
+                    <a href="#" class="buttonDot" onclick="openAuth(this.parentNode.getElementsByTagName('input')[1].id,'[%- mv.authtypecode | html -%]','auth'); return false;" tabindex="1" title="Tag editor">...</a>
                 [% ELSIF ( mv.type == 'text2' ) %]
-                    <input type="text" id="[%- mv.id -%]" size="67" maxlength="[%- mv.maxlength -%]" name="[%- mv.name -%]" value="[%- mv.value -%]" class="input_marceditor" />
+                    <input type="text" id="[%- mv.id | html -%]" size="67" maxlength="[%- mv.maxlength | html -%]" name="[%- mv.name | html -%]" value="[%- mv.value | html -%]" class="input_marceditor" />
                     [% IF mv.noclick %]
                         <a href="#" class="buttonDot tag_editor disabled" tabindex="-1" title="No popup">...</a>
                     [% ELSE %]
-                        <a href="#" id="buttonDot_[% mv.id %]" class="buttonDot tag_editor" title="Tag editor">...</a>
+                        <a href="#" id="buttonDot_[% mv.id | html %]" class="buttonDot tag_editor" title="Tag editor">...</a>
                     [% END %]
-                    [% mv.javascript %]
+                    [% mv.javascript | $raw %]
                 [% ELSIF ( mv.type == 'text' ) %]
-                    <input type="text" id="[%- mv.id -%]" name="[%- mv.name -%]" value="[%- mv.value -%]" class="input_marceditor" tabindex="1" size="67" maxlength="[%- mv.maxlength -%]" />
+                    <input type="text" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" value="[%- mv.value | html -%]" class="input_marceditor" tabindex="1" size="67" maxlength="[%- mv.maxlength | html -%]" />
                 [% ELSIF ( mv.type == 'textarea' ) %]
-                    <textarea cols="70" rows="4" id="[%- mv.id -%]" name="[%- mv.name -%]" class="input_marceditor" tabindex="1" size="67" maxlength="[%- mv.maxlength -%]">[%- mv.value -%]</textarea>
+                    <textarea cols="70" rows="4" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" class="input_marceditor" tabindex="1" size="67" maxlength="[%- mv.maxlength | html -%]">[%- mv.value | html -%]</textarea>
                 [% ELSIF ( mv.type == 'hidden' ) %]
-                    <input tabindex="1" type="hidden" id="[%- mv.id -%]" name="[%- mv.name -%]" size="67" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" />
+                    <input tabindex="1" type="hidden" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" size="67" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" />
                 [% ELSIF ( mv.type == 'hidden_simple' ) %]
-                    <input type="hidden" name="[%- mv.name -%]" />
+                    <input type="hidden" name="[%- mv.name | html -%]" />
                 [% END %]
 
                 <span class="subfield_controls">
                 [% IF ( subfield_loo.repeatable ) %]
-                    <a href="#" class="buttonPlus" tabindex="1" onclick="CloneSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]','[% advancedMARCEditor %]'); return false;">
-                        <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                    <a href="#" class="buttonPlus" tabindex="1" onclick="CloneSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]','[% advancedMARCEditor | html %]'); return false;">
+                        <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                     </a>
-                    <a href="#" class="buttonMinus" tabindex="1" onclick="UnCloneField('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]'); return false;">
-                        <img src="[% interface %]/[% theme %]/img/delete-subfield.png" alt="Delete" title="Delete this subfield" />
+                    <a href="#" class="buttonMinus" tabindex="1" onclick="UnCloneField('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]'); return false;">
+                        <img src="[% interface | html %]/[% theme | html %]/img/delete-subfield.png" alt="Delete" title="Delete this subfield" />
                     </a>
                 [% END %]
                 </span>
@@ -406,23 +407,23 @@ function confirmnotdup(redirect){
 
 <div name="hidden" id="hidden" class="tab">
 [% FOREACH hidden_loo IN hidden_loop %]
-    <input type="hidden" name="tag" value="[% hidden_loo.tag %]" />
-    <input type="hidden" name="subfield" value="[% hidden_loo.subfield %]" />
-    <input type="hidden" name="mandatory" value="[% hidden_loo.mandatory %]" />
-    <input type="hidden" name="kohafield" value="[% hidden_loo.kohafield %]" />
-    <input type="hidden" name="tag_mandatory" value="[% hidden_loo.tag_mandatory %]" />
+    <input type="hidden" name="tag" value="[% hidden_loo.tag | html %]" />
+    <input type="hidden" name="subfield" value="[% hidden_loo.subfield | html %]" />
+    <input type="hidden" name="mandatory" value="[% hidden_loo.mandatory | html %]" />
+    <input type="hidden" name="kohafield" value="[% hidden_loo.kohafield | html %]" />
+    <input type="hidden" name="tag_mandatory" value="[% hidden_loo.tag_mandatory | html %]" />
 [% END %]
 </div>
 [% IF ( oldauthnumtagfield ) %]
-    <input type="hidden" name="tag" value="[% oldauthnumtagfield %]" />
-    <input type="hidden" name="subfield" value="[% oldauthnumtagsubfield %]" />
-    <input type="hidden" name="field_value" value="[% authid %]" />
+    <input type="hidden" name="tag" value="[% oldauthnumtagfield | html %]" />
+    <input type="hidden" name="subfield" value="[% oldauthnumtagsubfield | html %]" />
+    <input type="hidden" name="field_value" value="[% authid | html %]" />
     <input type="hidden" name="mandatory" value="0" />
-    <input type="hidden" name="kohafield" value="[% kohafield %]" />
-    <input type="hidden" name="tag_mandatory" value="[% tag_mandatory %]" />
-    <input type="hidden" name="tag" value="[% oldauthtypetagfield %]" />
-    <input type="hidden" name="subfield" value="[% oldauthtypetagsubfield %]" />
-    <input type="hidden" name="field_value" value="[% authtypecode %]" />
+    <input type="hidden" name="kohafield" value="[% kohafield | html %]" />
+    <input type="hidden" name="tag_mandatory" value="[% tag_mandatory | html %]" />
+    <input type="hidden" name="tag" value="[% oldauthtypetagfield | html %]" />
+    <input type="hidden" name="subfield" value="[% oldauthtypetagsubfield | html %]" />
+    <input type="hidden" name="field_value" value="[% authtypecode | html %]" />
 [% END %]
 
 <fieldset class="action">
index f1613e8..2b022d6 100644 (file)
@@ -10,7 +10,7 @@
         <div class="row">
             <div class="col-md-8 col-md-offset-2">
 
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
 
             </div>
         </div>
                 [% ELSE %]
                 var new_line = "
                 [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]‡
-                    [%- SUBFIELD_LOO.marc_subfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r    ') -%]
+                    [%- SUBFIELD_LOO.marc_subfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r    ') | html -%]
                     [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%]
-                        [%- marc_value |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') -%]
+                        [%- marc_value |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html -%]
                     [%- END -%]
-                [%- END -%]‡9[% authid %]";
+                [%- END -%]‡9[% authid | html %]";
                 [% END %]
-                RancorReplaceField( new_line, "[% indicator1 %]", "[% indicator2 %]" );
+                RancorReplaceField( new_line, "[% indicator1 | html %]", "[% indicator2 | html %]" );
             [% ELSE %]
-            var index_start = "[% index %]";
+            var index_start = "[% index | html %]";
             var whichfield;
             try {
                 whichfield = opener.opener.document.getElementById(index_start);
@@ -65,7 +65,7 @@
                 // Try to add as many clones as needed
                 try {
                     for(var i=0; i<nb-subfields.length; i++) {
-                        window.opener.opener.CloneSubfield(subfields[0].getAttribute('id'),'[% advancedMARCEditor %]');
+                        window.opener.opener.CloneSubfield(subfields[0].getAttribute('id'),'[% advancedMARCEditor | html %]');
                     }
                 }
                 catch(err) {
             [% UNLESS ( clear ) %]
                 [% FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP %]
                     SetSubfieldValues(
-                        "[% tag_number |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %][% SUBFIELD_LOO.marc_subfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"
+                        "[% tag_number |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %][% SUBFIELD_LOO.marc_subfield |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"
                     [% FOREACH marc_value IN SUBFIELD_LOO.marc_values %]
-                        ,"[% marc_value |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"
+                        ,"[% marc_value |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"
                     [% END %]
                     );
                 [% END %]
                 var indicators = field_start.getElementsByClassName('indicator flat');
                 [% IF update_ind1 %]
-                    indicators[0].value="[% indicator1 %]";
+                    indicators[0].value="[% indicator1 | html %]";
                 [% END %]
                 [% IF update_ind2 %]
-                    indicators[1].value="[% indicator2 %]";
+                    indicators[1].value="[% indicator2 | html %]";
                 [% END %]
             [% END %]
 
                     if (subfield){subfield.value="" ;}
                 [% ELSE %]
                     if(code.value=='9'){
-                        subfield.value = "[% authid |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                        subfield.value = "[% authid |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         break;
                     }
                 [% END %]
index 2dc44b4..ce45987 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% PROCESS 'authorities.inc' %]
@@ -6,7 +7,7 @@
     [% IF ( unknownauthid ) %]
       Unknown authority record
     [% ELSE %]
-      Details for authority #[% authid %] ([% authtypetext %])
+      Details for authority #[% authid | html %] ([% authtypetext | html %])
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -19,7 +20,7 @@
     [% IF ( unknownauthid ) %]
       Unknown authority record
     [% ELSE %]
-      Details for authority #[% authid %] ([% authtypetext %])
+      Details for authority #[% authid | html %] ([% authtypetext | html %])
     [% END %]
 </div>
 
 
 
 [% IF ( unknownauthid ) %]
-    <div class="dialog message">The authority record you requested does not exist ([% errauthid %]).</div>
+    <div class="dialog message">The authority record you requested does not exist ([% errauthid | html %]).</div>
 [% ELSE %]
-<h1>Authority #[% authid %] ([% authtypetext %])</h1>
+<h1>Authority #[% authid | html %] ([% authtypetext | html %])</h1>
 
 <div id="action">
     [% IF count %]
-        Used in <a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;q=an=[% authid %]">[% count %] record(s)</a>
+        Used in <a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;q=an=[% authid | html %]">[% count | html %] record(s)</a>
     [% ELSE %]
         This authority is not used in any records.
     [% END %]
     <ul>
         [% FOREACH BIG_LOO IN BIG_LOOP %]
             <li>
-                <a href="#tab[% BIG_LOO.number %]XX">[% BIG_LOO.number %]</a>
+                <a href="#tab[% BIG_LOO.number | html %]XX">[% BIG_LOO.number | html %]</a>
             </li>
         [% END %]
     </ul>
 
 [% FOREACH BIG_LOO IN BIG_LOOP %]
-    <div id="tab[% BIG_LOO.number %]XX">
+    <div id="tab[% BIG_LOO.number | html %]XX">
     [% FOREACH innerloo IN BIG_LOO.innerloop %]
         [% IF ( innerloo.tag ) %]
             <div class="tag">
             <div class="tag_title">
-                [% innerloo.tag %]
+                [% innerloo.tag | html %]
             </div>
         [% ELSE %]
             <div class="tag">
         [% FOREACH subfiel IN innerloo.subfield %]
             <p>
                 <label class="labelsubfield">&nbsp;
-                [% UNLESS ( subfiel.hide_marc ) %]<b>[% subfiel.marc_subfield %]</b>[% END %]
-                <span title="[% subfiel.long_desc %]">[% subfiel.short_desc %]</span></label>
-                [% subfiel.marc_value %]
+                [% UNLESS ( subfiel.hide_marc ) %]<b>[% subfiel.marc_subfield | html %]</b>[% END %]
+                <span title="[% subfiel.long_desc | html %]">[% subfiel.short_desc | html %]</span></label>
+                [% subfiel.marc_value | html %]
                 [% IF ( subfiel.link ) %]
-                    <a href="/cgi-bin/koha/catalogue/search.pl?op=do_search&amp;marclist=[% subfiel.link %]&amp;operator==&amp;type=intranet&amp;value=[% subfiel.marc_value |url %]">
-                        <img src="[% interface %]/[% theme %]/images/filefind.png" height="15" title="Search on [% subfiel.marc_value %]">
+                    <a href="/cgi-bin/koha/catalogue/search.pl?op=do_search&amp;marclist=[% subfiel.link | html %]&amp;operator==&amp;type=intranet&amp;value=[% subfiel.marc_value |url %]">
+                        <img src="[% interface | html %]/[% theme | html %]/images/filefind.png" height="15" title="Search on [% subfiel.marc_value | html %]">
                     </a>
                 [% END %]
                 [% IF ( subfiel.authority ) %]
-                    <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% subfiel.authority %]" class="button">Auth</a>
+                    <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% subfiel.authority | html %]" class="button">Auth</a>
                 [% END %]
             </p>
         [% END %]
@@ -97,7 +98,7 @@
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'authorities_js.inc' %]
     [% IF ( displayhierarchy ) %]
-        [% Asset.js("lib/jquery/plugins/jquery.jstree.js") %]
+        [% Asset.js("lib/jquery/plugins/jquery.jstree.js") | $raw %]
     [% END %]
     <script type="text/javascript">
         $(document).ready(function() {
index f9412b0..73816de 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% PROCESS 'merge-record.inc' %]
 [% SET footerjs = 1 %]
@@ -27,7 +28,7 @@ div#result { margin-top: 1em; }
     [% FOREACH error IN errors %]
         <div class="dialog alert">
             [% IF error.code == 'WRONG_COUNT' %]
-                Number of records provided for merging: [% error.value %]. Currently only 2 records can be merged at a time.
+                Number of records provided for merging: [% error.value | html %]. Currently only 2 records can be merged at a time.
             [% ELSIF error.code == 'DESTRUCTIVE_MERGE' %]
                 You cannot merge a record with itself. Please select two different authorities.
             [% ELSIF error.code == 'WRONG_FRAMEWORK' %]
@@ -35,17 +36,17 @@ div#result { margin-top: 1em; }
             [% ELSIF error.code == 'EMPTY_MARC' %]
                 Sorry, but we did not find any MARC tags in the reference record.
             [% ELSIF error.code == 'MISSING_RECORD' %]
-                Sorry, but we did not find a record for number: [% error.value %].
+                Sorry, but we did not find a record for number: [% error.value | html %].
             [% ELSE %]
-                [% error %]
+                [% error | html %]
             [% END %]
         </div>
     [% END %]
 
 [% ELSIF ( result ) %]
 
-        <script type="text/javascript">window.location.href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 %]"</script>
-        <p>The merging was successful. <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 %]">Click here to see the merged record.</a></p>
+        <script type="text/javascript">window.location.href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]"</script>
+        <p>The merging was successful. <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]">Click here to see the merged record.</a></p>
 
 [% ELSIF ( choosereference ) %]
 
@@ -54,27 +55,27 @@ div#result { margin-top: 1em; }
     <fieldset class="rows">
     <legend>Merge reference</legend>
     <ol>
-    <li class="radio"><input type="radio" value="[% recordid1 %]" checked="checked" id="mergereference1" name="mergereference" onclick="changeFramework('[% frameworkcode1 %]')" /><label for="mergereference1">[% title1 %] [% FOREACH subtitl1 IN subtitle1 %] [% subtitl1.subfield %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid1 %][% IF frameworklabel1 %] &mdash; [% frameworklabel1 %][% END %]</a>)</label></li>
-    <li class="radio"><input type="radio" value="[% recordid2 %]" id="mergereference2" name="mergereference" onclick="changeFramework('[% frameworkcode2 %]')" /><label for="mergereference2">[% title2 %] [% FOREACH subtitl2 IN subtitle2 %] [% subtitl2.subfield %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid2 %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid2 %][% IF frameworklabel2 %] &mdash; [% frameworklabel2 %][% END %]</a>)</label></li>
+    <li class="radio"><input type="radio" value="[% recordid1 | html %]" checked="checked" id="mergereference1" name="mergereference" onclick="changeFramework('[% frameworkcode1 | html %]')" /><label for="mergereference1">[% title1 | html %] [% FOREACH subtitl1 IN subtitle1 %] [% subtitl1.subfield | html %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid1 | html %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid1 | html %][% IF frameworklabel1 %] &mdash; [% frameworklabel1 | html %][% END %]</a>)</label></li>
+    <li class="radio"><input type="radio" value="[% recordid2 | html %]" id="mergereference2" name="mergereference" onclick="changeFramework('[% frameworkcode2 | html %]')" /><label for="mergereference2">[% title2 | html %] [% FOREACH subtitl2 IN subtitle2 %] [% subtitl2.subfield | html %][% END %] (<a href="/cgi-bin/koha/authorities/detail.pl?authid=[% recordid2 | html %]" title="MARC" class="preview-merge-reference" target="_blank">[% recordid2 | html %][% IF frameworklabel2 %] &mdash; [% frameworklabel2 | html %][% END %]</a>)</label></li>
 
     [% IF frameworkselect %]
           <li><label for="frameworkcode">Using framework:</label>
                       <select name="frameworkcode" id="frameworkcode">
                                       [% FOREACH frameworkcodeloo IN frameworkselect %]
                                           [% IF frameworkcodeloo.authtypecode == frameworkcode1 %]
-                                              <option value="[% frameworkcodeloo.authtypecode %]" selected="selected">
+                                              <option value="[% frameworkcodeloo.authtypecode | html %]" selected="selected">
                                           [% ELSE %]
-                                              <option value="[% frameworkcodeloo.authtypecode %]">
+                                              <option value="[% frameworkcodeloo.authtypecode | html %]">
                                           [% END %]
-                                           [% frameworkcodeloo.authtypetext %]
+                                           [% frameworkcodeloo.authtypetext | html %]
                                            </option>
                                       [% END %]
                       </select></li>
     [% END %]
 </ol>
 
-    <input type="hidden" name="authid" value="[% recordid1 %]" />
-    <input type="hidden" name="authid" value="[% recordid2 %]" />
+    <input type="hidden" name="authid" value="[% recordid1 | html %]" />
+    <input type="hidden" name="authid" value="[% recordid2 | html %]" />
     <fieldset class="action"><input type="submit" value="Next" /></fieldset>
     </fieldset>
 </form>
@@ -91,10 +92,10 @@ div#result { margin-top: 1em; }
 [% PROCESS mergetarget %]
 </div> <!-- .yui-u -->
 
-<input type="hidden" name="recordid1" value="[% recordid1 %]" />
-<input type="hidden" name="recordid2" value="[% recordid2 %]" />
-<input type="hidden" name="mergereference" value="[% mergereference %]" />
-<input type="hidden" name="frameworkcode" value="[% framework %]" />
+<input type="hidden" name="recordid1" value="[% recordid1 | html %]" />
+<input type="hidden" name="recordid2" value="[% recordid2 | html %]" />
+<input type="hidden" name="mergereference" value="[% mergereference | html %]" />
+<input type="hidden" name="frameworkcode" value="[% framework | html %]" />
 
 <fieldset class="action"><input type="submit" name="merge" value="Merge" /></fieldset>
 </div>
@@ -107,7 +108,7 @@ div#result { margin-top: 1em; }
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'merge-record-strings.inc' %]
     [% INCLUDE 'authorities_js.inc' %]
-    [% Asset.js("js/merge-record.js") %]
+    [% Asset.js("js/merge-record.js") | $raw %]
     [% INCLUDE 'merge-record-strings.inc' %]
     <script type="text/javascript">
     //<![CDATA[
@@ -120,7 +121,7 @@ div#result { margin-top: 1em; }
     $(document).ready(function(){
         // Getting marc structure via ajax
         tagslib = [];
-        $.getJSON("/cgi-bin/koha/authorities/merge_ajax.pl", {frameworkcode : "[% framework %]" }, function(json) {
+        $.getJSON("/cgi-bin/koha/authorities/merge_ajax.pl", {frameworkcode : "[% framework | html %]" }, function(json) {
             tagslib = json;
             rebuild_target($("#tabs"), $("#resultul"));
         });
index 39b06c1..0ba25ac 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% PROCESS 'authorities-search-results.inc' %]
        [% INCLUDE 'auth-finder-search.inc' %]
         [% IF ( total ) %]<div class="resultnumber">
             [% IF ( displayprev ) %]
-                    <a href="auth_finder.pl?startfrom=[% startfromprev %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
+                    <a href="auth_finder.pl?startfrom=[% startfromprev | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
                         &lt;&lt;
                     </a>
                 [% END %]
                 [% FOREACH number IN numbers %]
                     [% IF ( number.highlight ) %]
-                        [% number.number %]
+                        [% number.number | html %]
                     [% ELSE %]
-                        <a href="auth_finder.pl?startfrom=[% number.startfrom %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN number.searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
-                            [% number.number %]</a>
+                        <a href="auth_finder.pl?startfrom=[% number.startfrom | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN number.searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
+                            [% number.number | html %]</a>
                     [% END %]
                 [% END %]
                 [% IF ( displaynext ) %]
-                    <a href="auth_finder.pl?startfrom=[% startfromnext %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
+                    <a href="auth_finder.pl?startfrom=[% startfromnext | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
                         &gt;&gt;</a>
                 [% END %]
             <div>
                 
-                    <p><b>Results [% from %] to [% to %] of [% total %]</b></p>
+                    <p><b>Results [% from | html %] to [% to | html %] of [% total | html %]</b></p>
                 [% ELSE %]
                     
                 
                 [% FOREACH resul IN result %]
                     <tr>
                         <td>[% PROCESS authresult summary=resul.summary %]</td>
-                        <td>[% resul.used %] times</td>
+                        <td>[% resul.used | html %] times</td>
                         <td>
                             [% IF resul.summary && resul.summary.authorized && resul.summary.authorized.size > 1 %]
                                 [% FOREACH authorized IN resul.summary.authorized %]
-                                    <a href="javascript:doauth('[% resul.authid %]', '[% index %]', '[% loop.count %]')" title="[% authorized.heading | html %]">[% loop.count %]</a>
+                                    <a href="javascript:doauth('[% resul.authid | html %]', '[% index | html %]', '[% loop.count | html %]')" title="[% authorized.heading | html %]">[% loop.count | html %]</a>
                                 [% END %]
                           [% ELSE %]
-                                <a class="btn btn-xs btn-default" href="javascript:doauth('[% resul.authid %]', '[% index %]', '')"><i class="fa fa-plus"></i> Choose</a>
+                                <a class="btn btn-xs btn-default" href="javascript:doauth('[% resul.authid | html %]', '[% index | html %]', '')"><i class="fa fa-plus"></i> Choose</a>
                           [% END %]
                         </td>
-                        <td><a class="btn btn-xs btn-default" href="authorities.pl?authid=[% resul.authid %]"><i class="fa fa-pencil"></i> Edit authority</a></td>
+                        <td><a class="btn btn-xs btn-default" href="authorities.pl?authid=[% resul.authid | html %]"><i class="fa fa-pencil"></i> Edit authority</a></td>
                     </tr>
                 [% END %]
             </table>
         </div>
         <div class="resultnumber">
             [% IF ( displayprev ) %]
-                    <a href="auth_finder.pl?startfrom=[% startfromprev %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranetamp;&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
+                    <a href="auth_finder.pl?startfrom=[% startfromprev | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranetamp;&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
                         &lt;&lt;
                     </a>
                 [% END %]
                 [% FOREACH number IN numbers %]
                     [% IF ( number.highlight ) %]
-                        [% number.number %]
+                        [% number.number | html %]
                     [% ELSE %]
-                        <a href="auth_finder.pl?startfrom=[% number.startfrom %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN number.searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
-                            [% number.number %]</a>
+                        <a href="auth_finder.pl?startfrom=[% number.startfrom | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN number.searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
+                            [% number.number | html %]</a>
                     [% END %]
                 [% END %]
                 [% IF ( displaynext ) %]
-                    <a href="auth_finder.pl?startfrom=[% startfromnext %]&amp;authtypecode=[% authtypecode %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term %]=[% searchdat.val %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index %]&amp;tagid=[% tagid %]&amp;orderby=[% orderby %]">
+                    <a href="auth_finder.pl?startfrom=[% startfromnext | html %]&amp;authtypecode=[% authtypecode | html %][% FOREACH searchdat IN searchdata %]&amp;[% searchdat.term | html %]=[% searchdat.val | html %][% END %]&amp;op=do_search&amp;type=intranet&amp;index=[% index | html %]&amp;tagid=[% tagid | html %]&amp;orderby=[% orderby | html %]">
                         &gt;&gt;</a>
                 [% END %]
         </div>[% END %]
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var index = "[% index %]";
-        var authtypecode = "[% authtypecode %]";
+        var index = "[% index | html %]";
+        var authtypecode = "[% authtypecode | html %]";
     </script>
-    [% Asset.js("js/auth-finder-search.js") %]
+    [% Asset.js("js/auth-finder-search.js") | $raw %]
     <script type="text/javascript">
 
         function jumpfull(page){
index 37fe6de..fd36faf 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% SET footerjs = 1 %]
 [% PROCESS 'authorities-search-results.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
 
 <div id="merge_in_progress"></div>
 [% IF ( total ) %]
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 
 <p id="authorities_searchresultlist_current_page_info">
-  Results [% from %] to [% to %] of [% total %]
+  Results [% from | html %] to [% to | html %] of [% total | html %]
 </p>
 
 <div id="authorities_searchresultlist_results">
         [% END %]
       </tr>
     [% FOREACH resul IN result %]
-    <tr data-authid="[% resul.authid %]">
+    <tr data-authid="[% resul.authid | html %]">
       <td>[% PROCESS authresult summary=resul.summary %]</td>
-      <td><a href="detail.pl?authid=[% resul.authid %]">Details</a></td>
+      <td><a href="detail.pl?authid=[% resul.authid | html %]">Details</a></td>
     [% UNLESS ( resul.isEDITORS ) %]
       <td>
       [% IF resul.used > 0 %]
-          <a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;idx=an,phr&amp;q=[% resul.authid %]" class="button">[% resul.used %] record(s)</a>
+          <a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;idx=an,phr&amp;q=[% resul.authid | html %]" class="button">[% resul.used | html %] record(s)</a>
       [% ELSE %]
           0 records
       [% END %]
     [% IF ( CAN_user_editauthorities ) %]
       <td>
       <div class="dropdown">
-        <a class="btn btn-default btn-xs dropdown-toggle" id="authactions[% resul.authid %]" role="button" data-toggle="dropdown" href="#">
+        <a class="btn btn-default btn-xs dropdown-toggle" id="authactions[% resul.authid | html %]" role="button" data-toggle="dropdown" href="#">
         Actions <b class="caret"></b></a>
-        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authactions[% resul.authid %]">
-          <li><a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% resul.authid %]"><i class="fa fa-pencil"></i> Edit</a></li>
+        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="authactions[% resul.authid | html %]">
+          <li><a href="/cgi-bin/koha/authorities/authorities.pl?authid=[% resul.authid | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
           <li><a class="merge_auth" href="#merge"><i class="fa fa-compress"></i> Merge</a></li>
           [% UNLESS ( resul.used ) %]
-            <li><a onclick='return confirm_deletion("[% resul.authid %]")'><i class="fa fa-trash"></i> Delete</a></li>
+            <li><a onclick='return confirm_deletion("[% resul.authid | html %]")'><i class="fa fa-trash"></i> Delete</a></li>
           [% END %]
         </ul>
       </div>
@@ -70,7 +71,7 @@
   </table>
 </div>
 
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 
 [% ELSE %]
   No results found
index 2c411cd..7db0450 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% BLOCK controls %]
                         <div class="btn-group">
                             <a class="btn btn-default btn-sm dropdown-toggle" data-toggle="dropdown" href="#" id="downloadcart"><i class="fa fa-download"></i> Download <span class="caret"></span> </a>
                             <ul class="dropdown-menu">
-                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=iso2709&amp;bib_list=[% bib_list %]">iso2709</a></li>
-                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=ris&amp;bib_list=[% bib_list %]">RIS</a></li>
-                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=bibtex&amp;bib_list=[% bib_list %]">BibTex</a></li>
+                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=iso2709&amp;bib_list=[% bib_list | html %]">iso2709</a></li>
+                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=ris&amp;bib_list=[% bib_list | html %]">RIS</a></li>
+                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=bibtex&amp;bib_list=[% bib_list | html %]">BibTex</a></li>
                             [% FOREACH csv_profile IN csv_profiles %]
-                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=[% csv_profile.export_format_id %]&amp;bib_list=[% bib_list %]">CSV - [% csv_profile.profile %]</a></li>
+                                <li><a href="/cgi-bin/koha/basket/downloadcart.pl?format=[% csv_profile.export_format_id | html %]&amp;bib_list=[% bib_list | html %]">CSV - [% csv_profile.profile | html %]</a></li>
                             [% END %]
                             </ul>
                         </div>
                         <form action="basket.pl" method="get" name="bookbag_form" id="bookbag_form">
                             [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
                                 <h3>
-                                    <input type="checkbox" class="select_record noprint" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]" />
+                                    <input type="checkbox" class="select_record noprint" value="[% BIBLIO_RESULT.biblionumber | html %]" name="bib[% BIBLIO_RESULT.biblionumber | html %]" id="bib[% BIBLIO_RESULT.biblionumber | html %]" />
                                     [% BIBLIO_RESULT.title |html %]
                                     [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %] [% subtitl.subfield | html %][% END %]
-                                    [% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author %][% END %]
+                                    [% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author | html %][% END %]
                                 </h3>
                                 <!-- COinS / Openurl -->
-                                <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition %]&amp;rft.series=[% BIBLIO_RESULT.series %]&amp;rft.genre="></span>
+                                <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author | html %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear | html %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') | html %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place | html %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition | html %]&amp;rft.series=[% BIBLIO_RESULT.series | html %]&amp;rft.genre="></span>
 
                                 <table>
                                     [% IF ( BIBLIO_RESULT.isbn ) %]
                                         <tr>
                                             <th scope="row">ISBN</th>
-                                            <td>[% BIBLIO_RESULT.isbn %]</td>
+                                            <td>[% BIBLIO_RESULT.isbn | html %]</td>
                                         </tr>
                                     [% END %]
 
                                             <th scope="row">Author(s)</th>
                                             <td>
                                                 [% IF ( BIBLIO_RESULT.author ) %]
-                                                    <p>[% BIBLIO_RESULT.author %]</p>
+                                                    <p>[% BIBLIO_RESULT.author | html %]</p>
                                                 [% END %]
                                                 [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
                                                     [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                                                         <p>
                                                             [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                                                                [% MARCAUTHOR_SUBFIELDS_LOO.separator %]
-                                                                [% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                                                                [% MARCAUTHOR_SUBFIELDS_LOO.separator | html %]
+                                                                [% MARCAUTHOR_SUBFIELDS_LOO.value | html %]
                                                             [% END %]
                                                         </p>
                                                     [% END %]
                                     [% IF ( BIBLIO_RESULT.publishercode ) %]
                                         <tr>
                                             <th scope="row">Publisher</th>
-                                            <td>[% BIBLIO_RESULT.place %] [% BIBLIO_RESULT.publishercode %] [% BIBLIO_RESULT.publicationyear %]
+                                            <td>[% BIBLIO_RESULT.place | html %] [% BIBLIO_RESULT.publishercode | html %] [% BIBLIO_RESULT.publicationyear | html %]
                                             </td>
                                         </tr>
                                     [% END %]
                                     [% IF ( BIBLIO_RESULT.pages ) %]
                                         <tr>
                                             <th scope="row">Details</th>
-                                            <td>[% BIBLIO_RESULT.pages %] [% BIBLIO_RESULT.illus %] [% BIBLIO_RESULT.item('size') %]</td>
+                                            <td>[% BIBLIO_RESULT.pages | html %] [% BIBLIO_RESULT.illus | html %] [% BIBLIO_RESULT.item('size') | html %]</td>
                                         </tr>
                                     [% END %]
 
                                     [% IF ( BIBLIO_RESULT.seriestitle ) %]
                                         <tr>
                                             <th scope="row">Collection</th>
-                                            <td> [% BIBLIO_RESULT.seriestitle %]</td>
+                                            <td> [% BIBLIO_RESULT.seriestitle | html %]</td>
                                         </tr>
                                     [% END %]
 
                                                 [% FOREACH MARCSUBJCT IN BIBLIO_RESULT.MARCSUBJCTS %]
                                                     <p>
                                                         [% FOREACH MARCSUBJECT_SUBFIELDS_LOO IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %]
-                                                            [% MARCSUBJECT_SUBFIELDS_LOO.separator %][% MARCSUBJECT_SUBFIELDS_LOO.value %]
+                                                            [% MARCSUBJECT_SUBFIELDS_LOO.separator | html %][% MARCSUBJECT_SUBFIELDS_LOO.value | html %]
                                                         [% END %]
                                                     </p>
                                                 [% END %]
 
                                     [% IF ( BIBLIO_RESULT.copyrightdate ) %]
                                         <tr><th scope="row">Copyright</th>
-                                            <td> [% BIBLIO_RESULT.copyrightdate %]</td>
+                                            <td> [% BIBLIO_RESULT.copyrightdate | html %]</td>
                                         </tr>
                                     [% END %]
 
                                                 [% FOREACH MARCNOTE IN BIBLIO_RESULT.MARCNOTES %]
                                                     <p>
                                                     [% IF MARCNOTE.marcnote.match('^https?://\S+$') %]
-                                                        - <a href="[% MARCNOTE.marcnote %]">[% MARCNOTE.marcnote %]</a>
+                                                        - <a href="[% MARCNOTE.marcnote | html %]">[% MARCNOTE.marcnote | html %]</a>
                                                     [% ELSE %]
-                                                        - [% MARCNOTE.marcnote %]
+                                                        - [% MARCNOTE.marcnote | html %]
                                                     [% END %]
                                                 [% END %]
                                             </td>
                                     [% IF ( BIBLIO_RESULT.unititle ) %]
                                         <tr>
                                             <th scope="row">Unified title</th>
-                                            <td> [% BIBLIO_RESULT.unititle %]</td>
+                                            <td> [% BIBLIO_RESULT.unititle | html %]</td>
                                         </tr>
                                     [% END %]
 
                                     [% IF ( BIBLIO_RESULT.serial ) %]
                                         <tr>
                                             <th scope="row">Serial</th>
-                                            <td>[% BIBLIO_RESULT.serial %]</td>
+                                            <td>[% BIBLIO_RESULT.serial | html %]</td>
                                         </tr>
                                     [% END %]
 
                                     [% IF ( BIBLIO_RESULT.dewey ) %]
                                         <tr>
                                             <th scope="row">Dewey</th>
-                                            <td>[% BIBLIO_RESULT.dewey %]</td>
+                                            <td>[% BIBLIO_RESULT.dewey | html %]</td>
                                         </tr>
                                     [% END %]
 
                                     [% IF ( BIBLIO_RESULT.classification ) %]
                                         <tr>
                                             <th scope="row">Classification</th>
-                                            <td> [% BIBLIO_RESULT.classification %]</td>
+                                            <td> [% BIBLIO_RESULT.classification | html %]</td>
                                         </tr>
                                     [% END %]
 
                                     [% IF ( BIBLIO_RESULT.lccn ) %]
                                         <tr>
                                             <th scope="row">LCCN</th>
-                                            <td> [% BIBLIO_RESULT.lccn %]</td>
+                                            <td> [% BIBLIO_RESULT.lccn | html %]</td>
                                         </tr>
                                     [% END %]
 
                                             <th scope="row">URL(s)</th>
                                             <td>
                                                [% FOREACH MARCurl IN BIBLIO_RESULT.MARCURLS %]
-                                                    [% IF MARCurl.part %]<p>[% MARCurl.part %]</p>[% END %]
-                                                    <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">[% MARCurl.linktext %]</a>
+                                                    [% IF MARCurl.part %]<p>[% MARCurl.part | html %]</p>[% END %]
+                                                    <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]">[% MARCurl.linktext | html %]</a>
                                                     [% IF MARCurl.notes %]
                                                         [% FOREACH note IN MARCurl.notes %]
-                                                            <p>[% note.note %]</p>
+                                                            <p>[% note.note | html %]</p>
                                                         [% END %]
                                                     [% END %]
                                                 [% END %]
                                             [% IF ( BIBLIO_RESULT.ITEM_RESULTS ) %]
                                                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
                                                     <p>
-                                                        [% ITEM_RESULT.branchname %] [% ITEM_RESULT.location_description %]
+                                                        [% ITEM_RESULT.branchname | html %] [% ITEM_RESULT.location_description | html %]
                                                         [% IF ( ITEM_RESULT.itemcallnumber ) %]
-                                                            ([% ITEM_RESULT.itemcallnumber %])
+                                                            ([% ITEM_RESULT.itemcallnumber | html %])
                                                         [% END %]
                                                     </p>
                                                 [% END %]
                                 [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
                                     <tr>
                                         <td class="noprint">
-                                            <input type="checkbox" class="select_record" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]" />
+                                            <input type="checkbox" class="select_record" value="[% BIBLIO_RESULT.biblionumber | html %]" name="bib[% BIBLIO_RESULT.biblionumber | html %]" id="bib[% BIBLIO_RESULT.biblionumber | html %]" />
                                         </td>
                                         <td>
-                                            <a href="[% BIBLIO_RESULT.dest %]?biblionumber=[% BIBLIO_RESULT.biblionumber %]" class="open_title">
+                                            <a href="[% BIBLIO_RESULT.dest | html %]?biblionumber=[% BIBLIO_RESULT.biblionumber | html %]" class="open_title">
                                                 [% BIBLIO_RESULT.title |html %]
                                                 [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %]
                                                     [% subtitl.subfield | html %]
                                                 [% END %]
                                             </a>
-                                            [% BIBLIO_RESULT.author %]
+                                            [% BIBLIO_RESULT.author | html %]
                                             <p>
                                                 [% IF ( BIBLIO_RESULT.publishercode ) %]
-                                                    - [% BIBLIO_RESULT.publishercode %]
+                                                    - [% BIBLIO_RESULT.publishercode | html %]
                                                     [% IF ( BIBLIO_RESULT.place ) %]
-                                                        [% BIBLIO_RESULT.place %]
+                                                        [% BIBLIO_RESULT.place | html %]
                                                     [% END %]
                                                 [% END %]
                                                 [% IF ( BIBLIO_RESULT.pages ) %]
-                                                    - [% BIBLIO_RESULT.pages %]
+                                                    - [% BIBLIO_RESULT.pages | html %]
                                                     [% IF ( BIBLIO_RESULT.item('size') ) %]
-                                                        [% BIBLIO_RESULT.item('size') %]
+                                                        [% BIBLIO_RESULT.item('size') | html %]
                                                     [% END %]
                                                 [% END %]
                                             </p>
                                             [% IF ( BIBLIO_RESULT.notes ) %]
-                                                <p>[% BIBLIO_RESULT.notes %]</p>
+                                                <p>[% BIBLIO_RESULT.notes | html %]</p>
                                             [% END %]
                                             <!-- COinS / Openurl -->
-                                            <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition %]&amp;rft.series=[% BIBLIO_RESULT.series %]&amp;rft.genre="></span>
+                                            <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author | html %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear | html %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') | html %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place | html %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition | html %]&amp;rft.series=[% BIBLIO_RESULT.series | html %]&amp;rft.genre="></span>
                                         </td>
-                                        <td>[% BIBLIO_RESULT.description %]</td>
+                                        <td>[% BIBLIO_RESULT.description | html %]</td>
                                         <td class="callnumbers">
                                             [% IF ( BIBLIO_RESULT.ITEM_RESULTS ) %]
                                                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
                                                     <div>
                                                         <span class="nowrap">
                                                             <strong>
-                                                                <span class="callnumber">[% ITEM_RESULT.itemcallnumber %]</span>
+                                                                <span class="callnumber">[% ITEM_RESULT.itemcallnumber | html %]</span>
                                                             </strong>
-                                                            [% ITEM_RESULT.branchname %]
-                                                            <span class="shelvingloc inline">[% ITEM_RESULT.location_description %]</span>
+                                                            [% ITEM_RESULT.branchname | html %]
+                                                            <span class="shelvingloc inline">[% ITEM_RESULT.location_description | html %]</span>
                                                         </span>
                                                     </div>
                                                 [% END %]
 
     [% INCLUDE js_includes.inc %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/cart.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/cart.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 
     </body>
 </html>
index a343bd8..53ea190 100644 (file)
            <option value="ris">RIS</option>
            <option value="bibtex">BibTex</option>
            [% FOREACH csv_profile IN csv_profiles %]
-           <option value="[% csv_profile.export_format_id %]">CSV - [% csv_profile.profile %]</option>
+           <option value="[% csv_profile.export_format_id | html %]">CSV - [% csv_profile.profile | html %]</option>
            [% END %]
 
        </select></li>
        </ol>
        </fieldset>
        <fieldset class="action">
-       <input type="hidden" name="bib_list" value="[% bib_list %]" />
+       <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
        <input type="submit" name="save" value="Save" /> <a class="cancel close" href="#">Cancel</a>
        </fieldset>
     </form>
index 68e735c..0e6dc2f 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE HtmlToText %]
 [% USE Koha %]
 
@@ -23,26 +24,26 @@ Your cart
 [% FILTER html2text %]
 
     [% IF comment %]
-        <p>[% comment %]</p>
+        <p>[% comment | $raw %]</p>
         <hr/>
     [% END %]
     <ol>
     [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
         <li>
             <span>
-                [% BIBLIO_RESULT.title %]
-                [% IF ( BIBLIO_RESULT.subtitle ) %] [% BIBLIO_RESULT.subtitle %][% END %]
+                [% BIBLIO_RESULT.title | $raw %]
+                [% IF ( BIBLIO_RESULT.subtitle ) %] [% BIBLIO_RESULT.subtitle | $raw %][% END %]
             </span>
 
             <p>
             [% IF ( BIBLIO_RESULT.HASAUTHORS ) %]
-            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author %][% END %]
+            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author | $raw %][% END %]
 
             [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
                 [% IF ( BIBLIO_RESULT.author ) %]; [% END %]
                 [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                     [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                        [% MARCAUTHOR_SUBFIELDS_LOO.separator %][% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                        [% MARCAUTHOR_SUBFIELDS_LOO.separator | $raw %][% MARCAUTHOR_SUBFIELDS_LOO.value | $raw %]
                     [% END %]
                     [% UNLESS ( loop.last ) %];[% END %]
                 [% END %]
@@ -52,81 +53,81 @@ Your cart
 
             [% IF ( BIBLIO_RESULT.ISBN ) %]
             <span>
-                ISBN: [% BIBLIO_RESULT.ISBN %]
+                ISBN: [% BIBLIO_RESULT.ISBN | $raw %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.publishercode %]
             <span>
-                Published by: [% BIBLIO_RESULT.publishercode %]
+                Published by: [% BIBLIO_RESULT.publishercode | $raw %]
                 [% IF ( BIBLIO_RESULT.publicationyear ) %]
-                    in [% BIBLIO_RESULT.publicationyear %]
+                    in [% BIBLIO_RESULT.publicationyear | $raw %]
                 [% END %]
                 [% IF ( BIBLIO_RESULT.pages ) %]
-                    , [% BIBLIO_RESULT.pages %]
+                    , [% BIBLIO_RESULT.pages | $raw %]
                 [% END %]
                 [% IF BIBLIO_RESULT.item('size') %]
-                , [% BIBLIO_RESULT.item('size') %]
+                , [% BIBLIO_RESULT.item('size') | html %]
                 [% END %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.collection %]
             <span>
-                Collection: [% BIBLIO_RESULT.seriestitle %]
+                Collection: [% BIBLIO_RESULT.seriestitle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.subject ) %]
             <span>
-                Subject: [% BIBLIO_RESULT.subject %]
+                Subject: [% BIBLIO_RESULT.subject | $raw %]
             <span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.copyrightdate ) %]
             <span>
-                Copyright year: [% BIBLIO_RESULT.copyrightdate %]
+                Copyright year: [% BIBLIO_RESULT.copyrightdate | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.notes ) %]
             <span>
-                Notes : [% BIBLIO_RESULT.notes %]
+                Notes : [% BIBLIO_RESULT.notes | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.unititle ) %]
             <span>
-                Unified title: [% BIBLIO_RESULT.unititle %]
+                Unified title: [% BIBLIO_RESULT.unititle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.serial ) %]
             <span>
-                Serial: [% BIBLIO_RESULT.serial %]
+                Serial: [% BIBLIO_RESULT.serial | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.dewey ) %]
             <span>
-                Dewey: [% BIBLIO_RESULT.dewey %]
+                Dewey: [% BIBLIO_RESULT.dewey | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.classification ) %]
             <span>
-                Classification: [% BIBLIO_RESULT.classification %]
+                Classification: [% BIBLIO_RESULT.classification | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.lccn ) %]
             <span>
-                LCCN: [% BIBLIO_RESULT.lccn %]
+                LCCN: [% BIBLIO_RESULT.lccn | $raw %]
             </span><br/>
             [% END %]
             [% IF ( BIBLIO_RESULT.url ) %]
             <span>
-                URL: [% BIBLIO_RESULT.url %]
+                URL: [% BIBLIO_RESULT.url | html %]
             </span>
             [% END %]
             </p>
@@ -134,17 +135,17 @@ Your cart
             [% SET OPACBaseURL = Koha.Preference('OPACBaseURL') %]
             [% IF ( OPACBaseURL ) %]
             <p>
-                In online catalog: [% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber %]
+                In online catalog: [% OPACBaseURL | $raw %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber | html %]
             </p>
             [% END %]
             [% IF ( BIBLIO_RESULT.ITEM_RESULTS.size ) %]
             <p>Items:
             <ul>
                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]<li>
-                    [% ITEM_RESULT.branchname %]
-                    [% ITEM_RESULT.location %]
-                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber %])[% END %]
-                    [% ITEM_RESULT.barcode %]
+                    [% ITEM_RESULT.branchname | $raw %]
+                    [% ITEM_RESULT.location | $raw %]
+                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber | $raw %])[% END %]
+                    [% ITEM_RESULT.barcode | $raw %]
                 </li>[% END %]
             </ul>
             </p>
index b78a650..4071e81 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your cart</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your cart</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body style="padding: 1em;" id="cart_sendbasketform" class="cart">
@@ -7,7 +7,7 @@
 
        [% IF ( SENT ) %]
         <h3>Message sent</h3>
-        <p>The cart was sent to: [% email_add |html %]</p>
+        <p>The cart was sent to: [% email_add | html %]</p>
                <p><a class="focus close" href="#">Close window</a></p>
        [% END %]
        [% IF ( error ) %]
@@ -31,8 +31,8 @@
     </ol>
     </fieldset>
     <fieldset class="action"> <input type="submit" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
-    <input type="hidden" name="bib_list" value="[% bib_list %]" />
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+    <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
 </form>
 
 [% END %]</div>
index ddf39a3..11939e9 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-    <title>Print Notices for [% today %]</title>
+    <title>Print Notices for [% today | html %]</title>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
     <style type="text/css">
         <!-- 
         -->
     </style>
     [% IF ( stylesheet ) %]
-    <link rel="stylesheet" type="text/css" href="[% stylesheet %]">
+    <link rel="stylesheet" type="text/css" href="[% stylesheet | html %]">
     [% END %]
 </head>
 <body id="batch_print-notices" class="batch">
     [% FOREACH message IN messages %]
     <div class="message">
-        <pre>[% message.content %]</pre>
+        <pre>[% message.content | html %]</pre>
     </div>
     [% END %]
 </body>
index e292c14..08ff9e5 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -26,7 +27,7 @@
 <div id="doc3" class="yui-t2">
 
 [% IF ( unknownbiblionumber ) %]
-  <div class="dialog message">The record you requested does not exist ([% biblionumber %]).</div>
+  <div class="dialog message">The record you requested does not exist ([% biblionumber | html %]).</div>
 [% ELSE %]
    <div id="bd">
       <div id="yui-main">
        [% INCLUDE 'cat-toolbar.inc' %]
     [% IF ( ocoins ) %]
     <!-- COinS / OpenURL -->
-    <span class="Z3988" title="[% ocoins %]"></span>
+    <span class="Z3988" title="[% ocoins | html %]"></span>
     [% END %]
          <div id="catalogue_ISBDdetail">
-                 [% ISBD %]
+          [% ISBD | $raw %]
          </div>
        </div>
       </div>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     [% INCLUDE 'browser-strings.inc' %]
-    [% Asset.js("js/browser.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
     <script type="text/javascript">
-        var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+        var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
         browser.show();
     </script>
 [% END %]
index 3b7c161..4b0ef79 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
   [% IF ( unknownbiblionumber ) %]
     Unknown record
   [% ELSE %]
-    MARC Details for <i>[% bibliotitle |html %]</i>
+    MARC Details for <i>[% bibliotitle | html %]</i>
   [% END %]
 </div>
 
 <div id="doc3" class="yui-t2">
 
 [% IF ( unknownbiblionumber ) %]
-  <div class="dialog message">The record you requested does not exist ([% biblionumber %]).</div>
+  <div class="dialog message">The record you requested does not exist ([% biblionumber | html %]).</div>
 [% ELSE %]
    <div id="bd">
        <div id="yui-main">
@@ -35,7 +36,7 @@
 [% INCLUDE 'cat-toolbar.inc' %]
 
 [% UNLESS ( popup ) %]
-    <h1>MARC biblio : [% biblionumber %]  ( [% bibliotitle |html %] )</h1>
+    <h1>MARC biblio : [% biblionumber | html %]  ( [% bibliotitle | html %] )</h1>
 
 
 [% END %]
                             <option value="">Default</option>
                             [% FOREACH framework IN frameworks %]
                                 [% IF framework.frameworkcode == frameworkcode %]
-                                    <option value="[% framework.frameworkcode %]" selected="selected">[% framework.frameworktext %]</option>
+                                    <option value="[% framework.frameworkcode | html %]" selected="selected">[% framework.frameworktext | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% framework.frameworkcode %]">[% framework.frameworktext %]</option>
+                                    <option value="[% framework.frameworkcode | html %]">[% framework.frameworktext | html %]</option>
                                 [% END %]
                             [% END %]
             </select> </b></p>
 [% IF ( ocoins ) %]
 <!-- COinS / OpenURL -->
-<span class="Z3988" title="[% ocoins %]"></span>
+<span class="Z3988" title="[% ocoins | html %]"></span>
 [% END %]
 
 
 [% BLOCK show_tab_html %]
-    <div id="[% tab_id %]">
+    <div id="[% tab_id | html %]">
         [% FOREACH tab0X IN tab_data %]
             [% IF ( tab0X.tag ) %]
                 <div class="tag">
                 <div class="tag_title">
-                    <span class="tag_num">[% tab0X.tag %]</span>
+                    <span class="tag_num">[% tab0X.tag | html %]</span>
             [% IF ( tab0X.tag_ind ) %]
-                <span class="tag_ind1">[% tab0X.tag_ind.substr(0, 1) %]</span><span class="tag_ind2">[% tab0X.tag_ind.substr(1, 1) %]</span>
+                <span class="tag_ind1">[% tab0X.tag_ind.substr(0, 1) | html %]</span><span class="tag_ind2">[% tab0X.tag_ind.substr(1, 1) | html %]</span>
             [% END %]
-                    [% IF (tab0X.tag_desc) %]<span class="dashwrapper"> -</span> <span class="tag_desc">[% tab0X.tag_desc %]</span>[% END %]
+                    [% IF (tab0X.tag_desc) %]<span class="dashwrapper"> -</span> <span class="tag_desc">[% tab0X.tag_desc | html %]</span>[% END %]
                 </div>
             [% ELSE %]
                 <div class="tag">
             [% FOREACH subfiel IN tab0X.subfield %]
                 <p class="subfield_line">
                     <span class="subfield-label">&nbsp;
-                    [% UNLESS ( subfiel.hide_marc ) %]<span class="subfield-code">[% subfiel.marc_subfield %]</span>[% END %]
-                    <span class="desc" title="[% subfiel.long_desc %]">[% subfiel.short_desc %]</span></span>
-                    [% IF ( subfiel.is_url ) %]<a href="[% subfiel.marc_value %]">[% subfiel.marc_value |html %]</a>[% ELSE %][% subfiel.marc_value |html %][% END %]
+                    [% UNLESS ( subfiel.hide_marc ) %]<span class="subfield-code">[% subfiel.marc_subfield | html %]</span>[% END %]
+                    <span class="desc" title="[% subfiel.long_desc | html %]">[% subfiel.short_desc | html %]</span></span>
+                    [% IF ( subfiel.is_url ) %]<a href="[% subfiel.marc_value | html %]">[% subfiel.marc_value | html %]</a>[% ELSE %][% subfiel.marc_value | html %][% END %]
                     [% IF ( subfiel.link ) %]
-                        <a href="/cgi-bin/koha/catalogue/search.pl?op=do_search&amp;idx=[% subfiel.link %],phr&amp;type=intranet&amp;q=[% subfiel.marc_value |url %]">
-                            <img src="[% interface %]/[% theme %]/img/filefind.png" height="15" title="Search on [% subfiel.marc_value |html %]" alt="Search on [% subfiel.marc_value |html %]" />
+                        <a href="/cgi-bin/koha/catalogue/search.pl?op=do_search&amp;idx=[% subfiel.link | html %],phr&amp;type=intranet&amp;q=[% subfiel.marc_value |url %]">
+                            <img src="[% interface | html %]/[% theme | html %]/img/filefind.png" height="15" title="Search on [% subfiel.marc_value | html %]" alt="Search on [% subfiel.marc_value | html %]" />
                         </a>
                     [% END %]
                     [% IF ( subfiel.authority ) %]
-                        <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% subfiel.authority %]" class="button">Auth</a>
+                        <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% subfiel.authority | html %]" class="button">Auth</a>
                     [% END %]
                 </p>
             [% END %]
         <table>
                 <tr>
                     [% FOREACH header IN item_header_loop %]
-                        <th>[% header %]</th>
+                        <th>[% header | html %]</th>
                     [% END %]
                 </tr>
                 [% FOREACH item IN item_loop %]
                     <tr>
                         [% FOREACH sf_code IN item_subfield_codes %]
-                            <td>[% item.$sf_code %]</td>
+                            <td>[% item.$sf_code | $raw %]</td>
                         [% END %]
                     </tr>
                 [% END %]
 </div>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     [% INCLUDE 'browser-strings.inc' %]
-    [% Asset.js("js/browser.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
     <script type="text/javascript">
-        var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+        var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
         browser.show();
 
          $(document).ready(function() {
 
         function Changefwk(FwkList) {
             var fwk = FwkList.options[FwkList.selectedIndex].value;
-            window.location = "MARCdetail.pl?biblionumber=[% biblionumber %]&frameworkcode="+fwk;
+            window.location = "MARCdetail.pl?biblionumber=[% biblionumber | html %]&frameworkcode="+fwk;
         }
     </script>
 [% END %]
index 5be1aa5..321edb4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
@@ -37,7 +38,7 @@
         </div>
         [% END %]
         <div class="btn-group">
-            <a href="/cgi-bin/koha/catalogue/search.pl?do=Clear&expanded_options=[% expanded_options %]" class="btn btn-sm btn-link"><i class="fa fa-trash"></i> Clear fields</a>
+            <a href="/cgi-bin/koha/catalogue/search.pl?do=Clear&expanded_options=[% expanded_options | html %]" class="btn btn-sm btn-link"><i class="fa fa-trash"></i> Clear fields</a>
         </div>
     </fieldset>
 </div>
@@ -50,7 +51,7 @@
 <fieldset>
         <legend>Select local databases</legend>
                 [% FOREACH local_servers_loo IN local_servers_loop %]
-[% IF ( local_servers_loo.checked ) %]<input type="checkbox" id="[% local_servers_loo.id %]" name="[% local_servers_loo.name %]" checked="checked" value="[% local_servers_loo.value %]" />[% ELSE %]<input type="checkbox" id="[% local_servers_loo.id %]" name="[% local_servers_loo.name %]" value="[% local_servers_loo.value %]" />[% END %]<label for="[% local_servers_loo.id %]"><img width="16" height="16" alt="[% local_servers_loo.id %]" src="[% themelang %]/img/[% local_servers_loo.icon %]" /> [% local_servers_loo.label %]</label>[% END %]
+[% IF ( local_servers_loo.checked ) %]<input type="checkbox" id="[% local_servers_loo.id | html %]" name="[% local_servers_loo.name | html %]" checked="checked" value="[% local_servers_loo.value | html %]" />[% ELSE %]<input type="checkbox" id="[% local_servers_loo.id | html %]" name="[% local_servers_loo.name | html %]" value="[% local_servers_loo.value | html %]" />[% END %]<label for="[% local_servers_loo.id | html %]"><img width="16" height="16" alt="[% local_servers_loo.id | html %]" src="[% themelang | html %]/img/[% local_servers_loo.icon | html %]" /> [% local_servers_loo.label | html %]</label>[% END %]
 </fieldset>
 <!-- /DATABASES -->
 [% END %]
@@ -60,8 +61,8 @@
 <fieldset id="databases">
     <legend>Select remote databases</legend>
                 [% FOREACH outer_servers_loo IN outer_servers_loop %]
-                [% IF ( outer_servers_loo.checked ) %]<input type="checkbox" id="[% outer_servers_loo.id %]" name="[% outer_servers_loo.name %]" checked="checked" value="[% outer_servers_loo.value %]" />[% ELSE %]<input type="checkbox" id="[% outer_servers_loo.id %]" name="[% outer_servers_loo.name %]" value="[% outer_servers_loo.value %]" />[% END %]
-<label for="[% outer_servers_loo.id %]"><img alt="[% outer_servers_loo.id %]" src="[% themelang %]/images/[% outer_servers_loo.icon %]" />[% outer_servers_loo.label %]</label>
+                [% IF ( outer_servers_loo.checked ) %]<input type="checkbox" id="[% outer_servers_loo.id | html %]" name="[% outer_servers_loo.name | html %]" checked="checked" value="[% outer_servers_loo.value | html %]" />[% ELSE %]<input type="checkbox" id="[% outer_servers_loo.id | html %]" name="[% outer_servers_loo.name | html %]" value="[% outer_servers_loo.value | html %]" />[% END %]
+<label for="[% outer_servers_loo.id | html %]"><img alt="[% outer_servers_loo.id | html %]" src="[% themelang | html %]/images/[% outer_servers_loo.icon | html %]" />[% outer_servers_loo.label | html %]</label>
                 [% END %]
     </fieldset>
 <!-- /REMOTE DATABASES -->
       <div id="advsearches" class="toptabs">
       <ul>
       [% FOREACH advsearchloo IN advancedsearchesloop %]
-        <li id="advsearch-tab-[% advsearchloo.advanced_search_type %]">
-           <a href="#advsearch-[% advsearchloo.advanced_search_type %]">
+        <li id="advsearch-tab-[% advsearchloo.advanced_search_type | html %]">
+           <a href="#advsearch-[% advsearchloo.advanced_search_type | html %]">
            [% IF ( advsearchloo.advanced_search_type == 'itemtypes' ) %]Item type
            [% ELSIF ( advsearchloo.advanced_search_type == 'ccode' ) %]Collection
            [% ELSIF ( advsearchloo.advanced_search_type == 'loc' ) %]Shelving location
       [% END %]
       </ul>
     [% FOREACH advsearchloo IN advancedsearchesloop %]
-    <div id="advsearch-[% advsearchloo.advanced_search_type %]" class="advsearch">
+    <div id="advsearch-[% advsearchloo.advanced_search_type | html %]" class="advsearch">
     <h4>Limit to any of the following:</h4>
     <table>
         <tr>
     [% FOREACH itemtypeloo IN advsearchloo.code_loop %]
-        <td><input type="checkbox" id="[% itemtypeloo.ccl FILTER remove(',') %]-[% itemtypeloo.number %]" name="limit" value="mc-[% itemtypeloo.ccl %]:[% itemtypeloo.code %]"/><label for="[% itemtypeloo.ccl FILTER remove(',') %]-[% itemtypeloo.number %]">[% UNLESS ( noItemTypeImages ) %][% IF ( itemtypeloo.imageurl ) %]<img src="[% itemtypeloo.imageurl %]" alt="[% itemtypeloo.description %]" />[% END %]&nbsp;[% END %]
-        [% itemtypeloo.description %]</label></td>
+        <td><input type="checkbox" id="[% itemtypeloo.ccl FILTER remove(',') | html %]-[% itemtypeloo.number | html %]" name="limit" value="mc-[% itemtypeloo.ccl | html %]:[% itemtypeloo.code | html %]"/><label for="[% itemtypeloo.ccl FILTER remove(',') | html %]-[% itemtypeloo.number | html %]">[% UNLESS ( noItemTypeImages ) %][% IF ( itemtypeloo.imageurl ) %]<img src="[% itemtypeloo.imageurl | html %]" alt="[% itemtypeloo.description | html %]" />[% END %]&nbsp;[% END %]
+        [% itemtypeloo.description | html %]</label></td>
         [% IF ( loop.last ) %]</tr>[% ELSE %][% UNLESS ( loop.count % 5 ) %]</tr><tr>[% END %][% END %]
     [% END %]
     </table>
         <option value="">No limit</option>
                [% FOREACH search_languages_loo IN search_languages_loop %]
                [% IF ( search_languages_loo.selected ) %]
-               <option value="ln,rtrn:[% search_languages_loo.iso639_2_code %]" selected="selected">[% search_languages_loo.language_description %]</option>
+               <option value="ln,rtrn:[% search_languages_loo.iso639_2_code | html %]" selected="selected">[% search_languages_loo.language_description | html %]</option>
                [% ELSE %]
-               <option value="ln,rtrn:[% search_languages_loo.iso639_2_code %]">[% search_languages_loo.language_description %]</option>
+               <option value="ln,rtrn:[% search_languages_loo.iso639_2_code | html %]">[% search_languages_loo.language_description | html %]</option>
                [% END %]
                
                [% END %]
                     <option value=""> -- none -- </option>
                     [% FOREACH sg IN search_groups %]
                         [% UNLESS sg.branchcode %]
-                            <option value="[% sg.id %]">[% sg.title %]</option>
+                            <option value="[% sg.id | html %]">[% sg.title | html %]</option>
                         [% END %]
                     [% END %]
                 </select>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     <script type="text/JavaScript">
         /**
          *  Function add_field();
index e4da23a..0a7d6f4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,18 +7,18 @@
 [% USE Biblio %]
 
 [% IF Koha.Preference('AmazonAssocTag') %]
-    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') %]
+    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') | html %]
 [% ELSE %]
-    [% AmazonAssocTag = '' %]
+    [% AmazonAssocTag = '' | html %]
 [% END %]
 
-[% ShowCourseReserves = 0 %]
+[% ShowCourseReserves = 0 | html %]
 [% IF UseCourseReserves %]
     [% FOREACH item IN itemloop %]
        [% IF item.course_reserves %]
            [% FOREACH r IN item.course_reserves %]
                [% IF r.course.enabled == 'yes' %]
-                   [% ShowCourseReserves = 1 %]
+                   [% ShowCourseReserves = 1 | html %]
                [% END %]
            [% END %]
         [% END %]
   [% IF ( unknownbiblionumber ) %]
     Unknown record
   [% ELSE %]
-    Details for [% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]
+    Details for [% title | html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]
   [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="catalog_detail" class="catalog">
   [% IF ( unknownbiblionumber ) %]
     Unknown record
   [% ELSE %]
-    Details for <i>[% title |html %]  [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</i>
+    Details for <i>[% title | html %]  [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</i>
   [% END %]
 </div>
 
 <div id="doc3" class="yui-t2">
 
 [% IF ( unknownbiblionumber ) %]
-  <div class="dialog message">The record you requested does not exist ([% biblionumber %]).</div>
+  <div class="dialog message">The record you requested does not exist ([% biblionumber | html %]).</div>
 [% ELSE %]
    <div id="bd">
     <div id="yui-main">
@@ -62,7 +63,7 @@
 [% INCLUDE 'cat-toolbar.inc' %]
     [% IF ( ocoins ) %]
         <!-- COinS / OpenURL -->
-        <span class="Z3988" title="[% ocoins %]"></span>
+        <span class="Z3988" title="[% ocoins | html %]"></span>
     [% END %]
 
     [% IF ( AmazonCoverImages  || LocalCoverImages ) %]
     [% END %]
 
     [% IF ( XSLTDetailsDisplay ) %]
-        [% XSLTBloc %]
+        [% XSLTBloc | $raw %]
 
         [% IF shelves.count %]
             <span class="results_summary"><span class="label">Lists that include this title: </span>
             [% FOREACH s IN shelves %]
-                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]">[% s.shelfname %]</a>
+                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]">[% s.shelfname | html %]</a>
                 [% IF ( loop.last ) %][% ELSE %]|[% END %]
             [% END %]
             </span>
                 <span class="results_summary"><span class="label">Tags:</span>
                     [% FOREACH TagLoo IN TagLoop %]
                         [% IF ( CAN_user_tools_moderate_tags ) %]
-                        <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term |url %]">[% TagLoo.term |html %]</a>
+                        <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term |url %]">[% TagLoo.term | html %]</a>
                         [% ELSE %]
-                        [% TagLoo.term |html %]
+                        [% TagLoo.term | html %]
                         [% END %]
-                        <span class="weight">([% TagLoo.weight_total %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]
+                        <span class="weight">([% TagLoo.weight_total | html %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]
                     [% END %]
                     </span>
         [% END %]
-        <span id="catalogue_detail_marc_preview" class="results_summary"><span class="label">MARC Preview:</span> <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblionumber %]&amp;viewas=html" title="MARC" class="previewMARC">Show</a></span>
+        <span id="catalogue_detail_marc_preview" class="results_summary"><span class="label">MARC Preview:</span> <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblionumber | html %]&amp;viewas=html" title="MARC" class="previewMARC">Show</a></span>
 
         [% IF ( holdcount ) %]
             <span class="results_summary">
                 <span class="label">Holds:</span>
                 <span class="number_box">
                     [% IF CAN_user_reserveforothers_place_holds %]
-                        <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber %]">[% holdcount %]</a>
+                        <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber | html %]">[% holdcount | html %]</a>
                     [% ELSE %]
-                        <span>[% holdcount %]</span>
+                        <span>[% holdcount | html %]</span>
                     [% END %]
                 </span>
             </span>
             <span class="results_summary">
                 <span class="label">Article requests:</span>
                 <span class="number_box">
-                    <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% biblionumber %]">[% article_requests_count %]</a>
+                    <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% biblionumber | html %]">[% article_requests_count | html %]</a>
                 </span>
             </span>
         [% END %]
         [% IF ( AmazonCoverImages  || LocalCoverImages ) %]
         </div><div class="yui-u" id="bookcoverimg">
         [% IF ( LocalCoverImages ) %]
-            <div title="[% biblionumber |url %]" class="[% biblionumber %]" id="local-thumbnail-preview"></div>
+            <div title="[% biblionumber |url %]" class="[% biblionumber | html %]" id="local-thumbnail-preview"></div>
         [% END %]
         [% IF ( AmazonCoverImages ) %]
             <div id="amazon-bookcoverimg">
-            <a href="http://www.amazon[% AmazonTld %]/gp/reader/[% normalized_isbn %][% AmazonAssocTag %]#reader-link">
-                <img src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn %].01.MZZZZZZZ.jpg" alt="" />
+            <a href="http://www.amazon[% AmazonTld | html %]/gp/reader/[% normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link">
+                <img src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn | html %].01.MZZZZZZZ.jpg" alt="" />
         </a></div>
         [% END %]
         [% END %]
     [% ELSE %]
 
-    <h3>[% title |html %]</h3>
+    <h3>[% title | html %]</h3>
     [% FOREACH subtitl IN subtitle %]
-       <h4>[% subtitl.subfield %]</h4>
+       <h4>[% subtitl.subfield | html %]</h4>
     [% END %]
-            [% UNLESS ( item_level_itypes ) %]<img src="[% imageurl %]" alt="[% translated_description %]" title="[% translated_description %]">[% END %]
-            [% IF ( unititle ) %]<p>[% unititle |html %]</p>[% END %]
+            [% UNLESS ( item_level_itypes ) %]<img src="[% imageurl | html %]" alt="[% translated_description | html %]" title="[% translated_description | html %]">[% END %]
+            [% IF ( unititle ) %]<p>[% unititle | html %]</p>[% END %]
             [% IF ( author ) %]<p>By <a href="/cgi-bin/koha/catalogue/search.pl?q=au:[% author |url %]">[% author | html %]</a></p>[% END %]
         <ul>
         [% IF ( MARCAUTHORS ) %]
             <li><strong>Additional authors:</strong><ul>
             [% FOREACH MARCAUTHOR IN MARCAUTHORS %]
-                <li>[% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %][% MARCAUTHOR_SUBFIELDS_LOO.separator %]<a title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code %] [% MARCAUTHOR_SUBFIELDS_LOO.value |url %]" href="/cgi-bin/koha/catalogue/search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit %]:[% link_loo.link |url %][% END %]">[% MARCAUTHOR_SUBFIELDS_LOO.value | html %]</a>[% END %]</li>
+                <li>[% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %][% MARCAUTHOR_SUBFIELDS_LOO.separator | html %]<a title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code | html %] [% MARCAUTHOR_SUBFIELDS_LOO.value |url %]" href="/cgi-bin/koha/catalogue/search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit | html %]:[% link_loo.link |url %][% END %]">[% MARCAUTHOR_SUBFIELDS_LOO.value | html %]</a>[% END %]</li>
                 [% END %]
 
         </ul>
         [% END %]
 [% IF ( MARCSERIES ) %]
                <li><strong>Series: </strong><ul>[% FOREACH MARCSERIE IN MARCSERIES %]
-               <li>[% FOREACH MARCSERIES_SUBFIELDS_LOO IN MARCSERIE.MARCSERIES_SUBFIELDS_LOOP %] [% IF ( MARCSERIES_SUBFIELDS_LOO.value ) %]<a href="/cgi-bin/koha/catalogue/search.pl?q=se:[% MARCSERIES_SUBFIELDS_LOO.value |url %]">[% MARCSERIES_SUBFIELDS_LOO.value %]</a>[% END %][% IF ( MARCSERIES_SUBFIELDS_LOO.volumenum ) %]. [% MARCSERIES_SUBFIELDS_LOO.volumenum %][% END %][% END %]</li> 
+               <li>[% FOREACH MARCSERIES_SUBFIELDS_LOO IN MARCSERIE.MARCSERIES_SUBFIELDS_LOOP %] [% IF ( MARCSERIES_SUBFIELDS_LOO.value ) %]<a href="/cgi-bin/koha/catalogue/search.pl?q=se:[% MARCSERIES_SUBFIELDS_LOO.value |url %]">[% MARCSERIES_SUBFIELDS_LOO.value | html %]</a>[% END %][% IF ( MARCSERIES_SUBFIELDS_LOO.volumenum ) %]. [% MARCSERIES_SUBFIELDS_LOO.volumenum | html %][% END %][% END %]</li> 
                [% END %]
                </ul>
                </li>
         [% IF ( publishercode ) %]
     <li><strong>Published by:</strong>
         <a href="/cgi-bin/koha/catalogue/search.pl?q=pb:[% publishercode |url %]">
-            [% publishercode |html %]
-        </a> [% IF ( place ) %]([% place %])[% END %] [% IF ( publicationyear ) %], [% publicationyear %][% END %] [% IF ( editionstatement ) %][% editionstatement %][% END %] [% IF ( editionresponsibility ) %][% editionresponsibility %][% END %]
+            [% publishercode | html %]
+        </a> [% IF ( place ) %]([% place | html %])[% END %] [% IF ( publicationyear ) %], [% publicationyear | html %][% END %] [% IF ( editionstatement ) %][% editionstatement | html %][% END %] [% IF ( editionresponsibility ) %][% editionresponsibility | html %][% END %]
     </li>
     [% END %]
         <li><strong>Description:</strong>
-                [% IF ( pages ) %] [% END %][% pages %] [% IF ( illus ) %][% illus %][% END %]
-                [% IF ( size ) %][% size %][% END %]
+                [% IF ( pages ) %] [% END %][% pages | html %] [% IF ( illus ) %][% illus | html %][% END %]
+                [% IF ( size ) %][% size | html %][% END %]
         </li>
 [% IF ( MARCURLS ) %]<li>
     
     <strong>Online resources:</strong>
     <ul>    [% FOREACH MARCurl IN MARCURLS %]
-               <li>[% IF ( MARCurl.part ) %][% MARCurl.part %]
+               <li>[% IF ( MARCurl.part ) %][% MARCurl.part | html %]
                        <br />[% END %] 
                <!-- here you might do a tmpl_if name="toc" and use greybox or equivalent for table of contents -->
-               <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">[% MARCurl.linktext %]</a>
-                       [% IF ( MARCurl.notes ) %]<ul>[% FOREACH note IN MARCurl.notes %]<li>[% note.note %]</li>[% END %]</ul>[% END %]</li>
+               <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]">[% MARCurl.linktext | html %]</a>
+                       [% IF ( MARCurl.notes ) %]<ul>[% FOREACH note IN MARCurl.notes %]<li>[% note.note | html %]</li>[% END %]</ul>[% END %]</li>
             [% END %]</ul>
 </li>
     [% END %]
 
     [% IF ( OPACBaseURL ) %]
         <li><strong>OPAC view:</strong>
-        <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]" target="_blank">Open in new window</a>
+        <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]" target="_blank">Open in new window</a>
         </li>
     [% END %]
         <li id="catalogue_detail_marc_preview">
             <strong>MARC Preview:</strong>
-            <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblionumber %]" title="MARC" rel="gb_page_center[600,500]">Show</a>
+            <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% biblionumber | html %]" title="MARC" rel="gb_page_center[600,500]">Show</a>
         </li>
         </ul>
         </div>
     [% IF ( AmazonCoverImages  || LocalCoverImages ) %]
         <div class="yui-u" id="bookcoverimg">
         [% IF ( LocalCoverImages ) %]
-            <div title="[% biblionumber |url %]" class="[% biblionumber %]" id="local-thumbnail-preview"></div>
+            <div title="[% biblionumber |url %]" class="[% biblionumber | html %]" id="local-thumbnail-preview"></div>
         [% END %]
         [% IF ( AmazonCoverImages ) %]
             <div id="amazon-bookcoverimg">
-            <a href="http://www.amazon[% AmazonTld %]/gp/reader/[% normalized_isbn %][% AmazonAssocTag %]#reader-link">
-            <img src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn %].01.MZZZZZZZ.jpg" alt="" />
+            <a href="http://www.amazon[% AmazonTld | html %]/gp/reader/[% normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link">
+            <img src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn | html %].01.MZZZZZZZ.jpg" alt="" />
             </a>
         </div>
         [% END %]
             <li><strong>ISBN:</strong><ul>[% FOREACH MARCISBN IN MARCISBNS %]<li>[% MARCISBN | html %]</li>[% END %]</ul></li>
         [% ELSE %]
             [% IF ( normalized_isbn ) %]
-                <li><strong>ISBN:</strong> [% normalized_isbn %]</li>
+                <li><strong>ISBN:</strong> [% normalized_isbn | html %]</li>
             [% END %]
         [% END %]
         [% IF ( issn ) %]
-            <li><strong>ISSN:</strong>[% issn %]</li>
+            <li><strong>ISSN:</strong>[% issn | html %]</li>
         [% END %]
         [% IF ( collectiontitle ) %]
             <li><strong>Collection: </strong>
-                [% collectiontitle %] [% IF ( collectionvolume ) %], [% collectionvolume %][% END %][% IF ( collectionissn ) %] (<strong>ISSN:</strong> [% collectionissn %])[% END %]
+                [% collectiontitle | html %] [% IF ( collectionvolume ) %], [% collectionvolume | html %][% END %][% IF ( collectionissn ) %] (<strong>ISSN:</strong> [% collectionissn | html %])[% END %]
             </li>
         [% END %]
         [% IF ( MARCSUBJCTS ) %]
             <li><strong>Subjects:</strong> 
             <ul>
                 [% FOREACH MARCSUBJCT IN MARCSUBJCTS %]
-                <li>[% FOREACH MARCSUBJECT_SUBFIELDS_LOO IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %] [% MARCSUBJECT_SUBFIELDS_LOO.separator %] <a title="‡[% MARCSUBJECT_SUBFIELDS_LOO.code %] [% MARCSUBJECT_SUBFIELDS_LOO.value %]" href="/cgi-bin/koha/catalogue/search.pl?q=[% FOREACH link_loo IN MARCSUBJECT_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit %]:[% link_loo.link |url %][% END %]">[% MARCSUBJECT_SUBFIELDS_LOO.value |html %]</a>[% END %]</li>
+                <li>[% FOREACH MARCSUBJECT_SUBFIELDS_LOO IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %] [% MARCSUBJECT_SUBFIELDS_LOO.separator | html %] <a title="‡[% MARCSUBJECT_SUBFIELDS_LOO.code | html %] [% MARCSUBJECT_SUBFIELDS_LOO.value | html %]" href="/cgi-bin/koha/catalogue/search.pl?q=[% FOREACH link_loo IN MARCSUBJECT_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit | html %]:[% link_loo.link |url %][% END %]">[% MARCSUBJECT_SUBFIELDS_LOO.value | html %]</a>[% END %]</li>
                 [% END %]
                 </ul>
             </li>
         [% END %]
         [% IF ( copyrightdate ) %]
-            <li><strong>Copyright:</strong> [% copyrightdate %]</li>
+            <li><strong>Copyright:</strong> [% copyrightdate | html %]</li>
         [% END %]
      
         [% IF ( classification ) %]
-            <li><strong>Classification:</strong> [% subclass %][% classification %]</li>
+            <li><strong>Classification:</strong> [% subclass | html %][% classification | html %]</li>
         [% END %]
         [% IF ( dewey ) %]
-            <li><strong>Dewey:</strong> [% dewey %]</li>
+            <li><strong>Dewey:</strong> [% dewey | html %]</li>
         [% END %]
         [% IF ( urlS ) %]
             <li><strong>URL:</strong>
                 [% FOREACH url IN urlS %]
-                    <a href="[% url.url %]">[% url.url %]</a>
+                    <a href="[% url.url | html %]">[% url.url | html %]</a>
                 [% END %]
             </li>
         [% END %]
             <li><strong>Lists that include this title: </strong>
             <ul>
             [% FOREACH s IN shelves %]
-                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]">[% s.shelfname %]</a></li>
+                <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]">[% s.shelfname | html %]</a></li>
             [% END %]
             </ul>
             </li>
                     [% FOREACH TagLoo IN TagLoop %]
                         <li>
                         [% IF ( CAN_user_tools_moderate_tags ) %]
-                        <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term |url %]">[% TagLoo.term |html %]</a>
+                        <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term |url %]">[% TagLoo.term | html %]</a>
                         [% ELSE %]
-                        [% TagLoo.term |html %]
+                        [% TagLoo.term | html %]
                         [% END %]
-                        <span class="weight">([% TagLoo.weight_total %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]</li>
+                        <span class="weight">([% TagLoo.weight_total | html %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]</li>
                     [% END %]
                     </ul></li>
         [% END %]
-            [% IF ( holdcount ) %]<li><strong>Holds:</strong> <span class="number_box"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber %]">[% holdcount %]</a></span></li>[% ELSE %][% END %]
+            [% IF ( holdcount ) %]<li><strong>Holds:</strong> <span class="number_box"><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblionumber | html %]">[% holdcount | html %]</a></span></li>[% ELSE %][% END %]
         </ul>
                [% END %]
 
 <ul>
     [% IF (SeparateHoldings) %]
         <li>
-            <a href="#holdings">[% LoginBranchname %] holdings ([% itemloop.size() || 0 %])</a>
+            <a href="#holdings">[% LoginBranchname | html %] holdings ([% itemloop.size() || 0 | html %])</a>
         </li>
         <li>
-            <a href="#otherholdings">Other holdings ([% otheritemloop.size() || 0 %])</a>
+            <a href="#otherholdings">Other holdings ([% otheritemloop.size() || 0 | html %])</a>
         </li>
     [% ELSE %]
         <li>
-            <a href="#holdings">Holdings ([% itemloop.size() || 0 %])</a>
+            <a href="#holdings">Holdings ([% itemloop.size() || 0 | html %])</a>
         </li>
     [% END %]
 [% IF ( MARCNOTES || notes ) %]<li><a href="#description">Descriptions</a></li>[% END %]
 [% IF ( LocalCoverImages ) %]
     [% IF ( localimages || CAN_user_tools_upload_local_cover_images ) %]
         <li>
-            <a href="#images">Images ([% localimages.size() || 0 %])</a>
+            <a href="#images">Images ([% localimages.size() || 0 | html %])</a>
         </li>
     [% END %]
 [% END %]
 [% END %]
 </ul>
 
-[% items_table_block_iter = 0 %]
+[% items_table_block_iter = 0 | html %]
 [% BLOCK items_table %]
-    [% items_table_block_iter = items_table_block_iter + 1 %]
-    <div class="[% tab %]_table_table_controls">
+    [% items_table_block_iter = items_table_block_iter + 1 | html %]
+    <div class="[% tab | html %]_table_table_controls">
         [% IF (StaffDetailItemSelection) %]
-            | <a href="#" class="SelectAll" data-tab="[% tab %]"><i class="fa fa-check"></i> Select all</a> |
-            <a href="#" class="ClearAll" data-tab="[% tab %]"><i class="fa fa-remove"></i> Clear all</a>
+            | <a href="#" class="SelectAll" data-tab="[% tab | html %]"><i class="fa fa-check"></i> Select all</a> |
+            <a href="#" class="ClearAll" data-tab="[% tab | html %]"><i class="fa fa-remove"></i> Clear all</a>
             <span class="itemselection_actions">
               | Actions:
               [% IF CAN_user_tools_items_batchdel %]
             </span>
         [% END %]
     </div>
-    <table class="items_table" id="[% tab %]_table">
+    <table class="items_table" id="[% tab | html %]_table">
         <thead>
             <tr>
                 [% IF (StaffDetailItemSelection) %]<th class="NoSort"></th>[% END %]
                 <tr>
                 [% IF (StaffDetailItemSelection) %]
                     <td style="text-align:center;vertical-align:middle">
-                        <input type="checkbox" value="[% item.itemnumber %]" name="itemnumber" />
+                        <input type="checkbox" value="[% item.itemnumber | html %]" name="itemnumber" />
                     </td>
                 [% END %]
                     [% IF ( item_level_itypes ) %]
                         <td class="itype">
                             [% IF !noItemTypeImages && item.imageurl %]
-                                <img src="[% item.imageurl %]" alt="[% item.translated_description %]" title="[% item.translated_description %]" />
+                                <img src="[% item.imageurl | html %]" alt="[% item.translated_description | html %]" title="[% item.translated_description | html %]" />
                             [% END %]
-                            [% item.translated_description %]
+                            [% item.translated_description | html %]
                         </td>
                     [% END %]
-                    <td class="location">[% UNLESS ( singlebranchmode ) %][% Branches.GetName( item.branchcode ) %] [% END %]</td>
-                    <td class="homebranch">[% Branches.GetName(item.homebranch) %]<span class="shelvingloc">[% item.location %]</span> </td>
-                    [% IF ( itemdata_ccode ) %]<td>[% item.ccode %]</td>[% END %]
-                    <td class="itemcallnumber">[% IF ( item.itemcallnumber ) %] [% item.itemcallnumber %][% END %]</td>
+                    <td class="location">[% UNLESS ( singlebranchmode ) %][% Branches.GetName( item.branchcode ) | html %] [% END %]</td>
+                    <td class="homebranch">[% Branches.GetName(item.homebranch) | html %]<span class="shelvingloc">[% item.location | html %]</span> </td>
+                    [% IF ( itemdata_ccode ) %]<td>[% item.ccode | html %]</td>[% END %]
+                    <td class="itemcallnumber">[% IF ( item.itemcallnumber ) %] [% item.itemcallnumber | html %][% END %]</td>
                     <td class="status">
 
                         [% IF item.CheckedOutFor %]
                                   [% END %]
                                   [% INCLUDE 'patron-title.inc' patron=item.CheckedOutFor hide_patron_infos_if_needed=1 %]
                                 [% END %]
-                                : due [% item.datedue %]
+                                : due [% item.datedue | html %]
                             </span>
                         [% ELSIF ( item.transfertwhen ) %]
-                            <span class="intransit">In transit from [% Branches.GetName( item.transfertfrom ) %] to [% Branches.GetName( item.transfertto ) %] since [% item.transfertwhen | $KohaDates %]</span>
+                            <span class="intransit">In transit from [% Branches.GetName( item.transfertfrom ) | html %] to [% Branches.GetName( item.transfertto ) | html %] since [% item.transfertwhen | $KohaDates %]</span>
                         [% END %]
 
                         [% IF ( item.itemlost ) %]
                             [% IF itemlostloop %]
                                 [% FOREACH itemlostloo IN itemlostloop %]
                                     [% IF itemlostloo.authorised_value == item.itemlost %]
-                                        <span class="lost">[% itemlostloo.lib %]</span>
+                                        <span class="lost">[% itemlostloo.lib | html %]</span>
                                     [% END %]
                                 [% END %]
                             [% ELSE %]
                             [% IF itemwithdrawnloop %]
                                 [% FOREACH itemwithdrawnloo IN itemwithdrawnloop %]
                                     [% IF itemwithdrawnloo.authorised_value == item.withdrawn %]
-                                        <span class="wdn">[% itemwithdrawnloo.lib %]</span>
+                                        <span class="wdn">[% itemwithdrawnloo.lib | html %]</span>
                                     [% END %]
                                 [% END %]
                             [% ELSE %]
                             [% IF itemdamagedloop %]
                                 [% FOREACH itemdamagedloo IN itemdamagedloop %]
                                     [% IF itemdamagedloo.authorised_value == item.damaged %]
-                                        <span class="dmg">[% itemdamagedloo.lib %]</span>
+                                        <span class="dmg">[% itemdamagedloo.lib | html %]</span>
                                     [% END %]
                                 [% END %]
                             [% ELSE %]
                         [% IF ( item.itemnotforloan || item.notforloan_per_itemtype ) %]
                             Not for loan
                             [% IF ( item.notforloanvalue ) %]
-                                ([% item.notforloanvalue %])
+                                ([% item.notforloanvalue | html %])
                             [% END %]
                         [% END %]
 
                         [% IF ( item.reservedate ) %]
                             [% IF ( item.waitingdate ) %]
-                                Waiting at [% Branches.GetName( item.ExpectedAtLibrary ) %] since [% item.waitingdate | $KohaDates %].
+                                Waiting at [% Branches.GetName( item.ExpectedAtLibrary ) | html %] since [% item.waitingdate | $KohaDates %].
                             [% ELSE %]
-                                Item-level hold (placed [% item.reservedate | $KohaDates %]) for delivery at [% Branches.GetName( item.ExpectedAtLibrary ) %].
+                                Item-level hold (placed [% item.reservedate | $KohaDates %]) for delivery at [% Branches.GetName( item.ExpectedAtLibrary ) | html %].
                             [% END %]
                             [% IF ( canreservefromotherbranches ) %]
                                 Hold for:
                         [% END %]
 
                         [% IF ( item.restricted ) %]
-                            <span class="restricted">([% item.restricted %])</span>
+                            <span class="restricted">([% item.restricted | html %])</span>
                         [% END %]
 
                     </td>
                     <td class="datelastseen">[% item.datelastseen | $KohaDates %]</td>
-                    <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?type=[% item.type %]&amp;itemnumber=[% item.itemnumber %]&amp;biblionumber=[% item.biblionumber %]&amp;bi=[% item.biblioitemnumber %]#item[% item.itemnumber %]">[% item.barcode %]</a></td>
+                    <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?type=[% item.type | html %]&amp;itemnumber=[% item.itemnumber | html %]&amp;biblionumber=[% item.biblionumber | html %]&amp;bi=[% item.biblioitemnumber | html %]#item[% item.itemnumber | html %]">[% item.barcode | html %]</a></td>
                     [% IF ( volinfo ) %]
                         <td class="enumchron">
                             [% IF ( itemdata_enumchron ) %]
                                 [% IF item.enumchron && item.serialseq %]
-                                    <span class="enum">[% item.enumchron %]</span>
+                                    <span class="enum">[% item.enumchron | html %]</span>
                                     [% IF ( item.serialseq && item.enumchron!=item.serialseq ) %]
                                         <span class="sep"> -- </span>
                                         <span class="serialseq">[% item.serialseq | html %]</span>
                         </td>
                     [% END %]
                     [% IF ( itemdata_uri ) %]
-                        <td class="uri"><a href="[% item.uri %]">[% item.uri %]</a></td>
+                        <td class="uri"><a href="[% item.uri | html %]">[% item.uri | html %]</a></td>
                     [% END %]
                     [% IF ( itemdata_copynumber ) %]
-                        <td class="copynumber">[% item.copynumber %]</td>
+                        <td class="copynumber">[% item.copynumber | html %]</td>
                     [% END %]
                     [% IF ( itemdata_stocknumber ) %]
-                        <td class="stocknumber">[% item.stocknumber %]</td>
+                        <td class="stocknumber">[% item.stocknumber | html %]</td>
                     [% END %]
                     [% IF materials %]
-                        <td class="materials"> [% item.materials %] </td>
+                        <td class="materials"> [% item.materials | html %] </td>
                     [% END %]
                     [% IF ( itemdata_itemnotes ) %]
-                        <td><div class="itemnotes">[% item.itemnotes %]</div></td>
+                        <td><div class="itemnotes">[% item.itemnotes | html %]</div></td>
                     [% END %]
                     [% IF itemdata_nonpublicnotes %]
-                        <td class="nonpublicnote">[% item.itemnotes_nonpublic %]</td>
+                        <td class="nonpublicnote">[% item.itemnotes_nonpublic | html %]</td>
                     [% END %]
                     [% IF ( SpineLabelShowPrintOnBibDetails ) %]
-                        <td><a href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=[% item.barcode %]" >Print label</a></td>
+                        <td><a href="/cgi-bin/koha/labels/spinelabel-print.pl?barcode=[% item.barcode | html %]" >Print label</a></td>
                     [% END %]
                     [% IF ( hostrecords ) %]
-                        <td>[% IF ( item.hostbiblionumber) %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.hostbiblionumber %]" >[% item.hosttitle %]</a>[% END %]</td>
+                        <td>[% IF ( item.hostbiblionumber) %]<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.hostbiblionumber | html %]" >[% item.hosttitle | html %]</a>[% END %]</td>
                     [% END %]
                     [% IF ( analyze ) %]
                         <td>
                             [% IF ( item.countanalytics ) %]
-                                <a href="/cgi-bin/koha/catalogue/search.pl?idx=hi&amp;q=[% item.itemnumber %]">[% item.countanalytics %] analytics</a>
+                                <a href="/cgi-bin/koha/catalogue/search.pl?idx=hi&amp;q=[% item.itemnumber | html %]">[% item.countanalytics | html %] analytics</a>
                             [% END %]
                         </td>
                     [% END %]
                     [% IF ( analyze ) %]
-                        <td><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?hostbiblionumber=[% item.biblionumber %]&amp;hostitemnumber=[% item.itemnumber %]">Create analytics</a></td>
+                        <td><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?hostbiblionumber=[% item.biblionumber | html %]&amp;hostitemnumber=[% item.itemnumber | html %]">Create analytics</a></td>
                     [% END %]
 
                 [% IF ShowCourseReserves %]
                             [% FOREACH r IN item.course_reserves %]
                                 [% IF r.course.enabled == 'yes' %]
                                     <p>
-                                      <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% r.course.course_id %]">
-                                         [% r.course.course_name %]
-                                         <!--[% IF r.course.course_number %] [% r.course.course_number %] [% END %]-->
-                                         [% IF r.course.section %] [% r.course.section %] [% END %]
-                                         [% IF r.course.term %] [% AuthorisedValues.GetByCode( 'TERM', r.course.term ) %] [% END %]
+                                      <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% r.course.course_id | html %]">
+                                         [% r.course.course_name | html %]
+                                         <!--[% IF r.course.course_number %] [% r.course.course_number | html %] [% END %]-->
+                                         [% IF r.course.section %] [% r.course.section | html %] [% END %]
+                                         [% IF r.course.term %] [% AuthorisedValues.GetByCode( 'TERM', r.course.term ) | html %] [% END %]
                                       </a>
                                    </p>
                                [% END %]
                 [% IF CAN_user_editcatalogue_edit_items %]
                     <td class="actions">
                         [% UNLESS item.cannot_be_edited %]
-                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&biblionumber=[% item.biblionumber %]&itemnumber=[% item.itemnumber %]#edititem"><i class="fa fa-pencil"></i> Edit</a>
+                            <a class="btn btn-default btn-xs" href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&biblionumber=[% item.biblionumber | html %]&itemnumber=[% item.itemnumber | html %]#edititem"><i class="fa fa-pencil"></i> Edit</a>
                         [% END %]
                     </td>
                 [% END %]
 [% IF ( Koha.Preference('NovelistSelectStaffEnabled') && Koha.Preference('NovelistSelectStaffProfile') && Koha.Preference('NovelistSelectStaffView') == 'above' ) %]
     <span class="results_summary NovelistSelect" style="display:none;">
         <span class="label">Novelist Select: </span>
-        <div data-novelist-novelistselect=[% normalized_isbn %]></div>
+        <div data-novelist-novelistselect=[% normalized_isbn | html %]></div>
     </span>
 [% END %]
 
         [% PROCESS items_table tab="holdings" items=itemloop %]
         [% END %]
                 [% IF ( hiddencount ) %]
-                   <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]&amp;showallitems=1">Show all items ([% hiddencount %] hidden)</a>
+                   <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]&amp;showallitems=1">Show all items ([% hiddencount | html %] hidden)</a>
                 [% END %]              
                [% IF ( debug_display ) %]
                <br /><br />
                <table>
-                       <tr><td>itemdata_enumchron</td><td>[% itemdata_enumchron %]</td></tr>
-                       <tr><td>itemdata_copynumber</td><td>[% itemdata_copynumber %]</td></tr>
-                       <tr><td>serial</td><td>[% serial %]</td></tr>
+                       <tr><td>itemdata_enumchron</td><td>[% itemdata_enumchron | html %]</td></tr>
+                       <tr><td>itemdata_copynumber</td><td>[% itemdata_copynumber | html %]</td></tr>
+                       <tr><td>serial</td><td>[% serial | html %]</td></tr>
                </table>
                 [% END %]
 [% ELSE %]
     [% IF ( ALTERNATEHOLDINGS ) %]
     [% FOREACH ALTERNATEHOLDING IN ALTERNATEHOLDINGS %]
-        <div id="alternateholdings"><span class="holdings_label">Holdings:</span> [% ALTERNATEHOLDING.holding %]</div>
+        <div id="alternateholdings"><span class="holdings_label">Holdings:</span> [% ALTERNATEHOLDING.holding | html %]</div>
     [% END %]
     [% ELSE %]
     <div id="noitems">No physical items for this record</div>
 [% IF ( Koha.Preference('NovelistSelectStaffEnabled') && Koha.Preference('NovelistSelectStaffProfile') && Koha.Preference('NovelistSelectStaffView') == 'below' ) %]
     <span class="results_summary NovelistSelect" style="display:none;">
         <span class="label">Novelist Select: </span>
-        <div data-novelist-novelistselect=[% normalized_isbn %]></div>
+        <div data-novelist-novelistselect=[% normalized_isbn | html %]></div>
     </span>
 [% END %]
     </div>
     [% FOREACH MARCNOTE IN MARCNOTES %]
         <p>
         [% IF MARCNOTE.marcnote.match('^https?://\S+$') %]
-            <a href="[% MARCNOTE.marcnote %]">[% MARCNOTE.marcnote %]</a>
+            <a href="[% MARCNOTE.marcnote | html %]">[% MARCNOTE.marcnote | html %]</a>
         [% ELSE %]
-            [% MARCNOTE.marcnote FILTER html_line_break %]
+            [% MARCNOTE.marcnote FILTER html_line_break | html %]
         [% END %]
         </p>
     [% END %]
 [% ELSE %]
     [% IF ( notes ) %]
-        <p>[% notes %]</p>
+        <p>[% notes | html %]</p>
     [% END %]
 [% END %]
 </div>
 <div class="yui-g">
 <div id="catalogue_detail_subscriptions">
     <h2>This is a serial subscription</h2>
-    <p> (There are [% subscriptionsnumber %] subscriptions associated with this title).</p> 
+    <p> (There are [% subscriptionsnumber | html %] subscriptions associated with this title).</p> 
     [% FOREACH subscription IN subscriptions %]
             [% IF subscription.branchcode %]
-                <h3>At library: [% Branches.GetName(subscription.branchcode) || subscription.branchcode %]</h3>
+                <h3>At library: [% Branches.GetName(subscription.branchcode) || subscription.branchcode | html %]</h3>
             [% END %]
             [% IF ( subscription.closed ) %]<p>This subscription is closed.</p>[% END %]
-            [% IF ( subscription.callnumber ) %]<p>Callnumber: [% subscription.callnumber %] </p>[% END %]
-            [% IF ( subscription.subscriptionnotes ) %]<p>[% subscription.subscriptionnotes FILTER html_line_break %] </p>[% END %]
-            [% IF ( subscription.missinglist ) %]<p>Missing issues: [% subscription.missinglist %] </p>[% END %]
-            [% IF ( subscription.librariannote ) %]<p>([% subscription.librariannote %])</p>[% END %]
+            [% IF ( subscription.callnumber ) %]<p>Callnumber: [% subscription.callnumber | html %] </p>[% END %]
+            [% IF ( subscription.subscriptionnotes ) %]<p>[% subscription.subscriptionnotes FILTER html_line_break | html %] </p>[% END %]
+            [% IF ( subscription.missinglist ) %]<p>Missing issues: [% subscription.missinglist | html %] </p>[% END %]
+            [% IF ( subscription.librariannote ) %]<p>([% subscription.librariannote | html %])</p>[% END %]
             [% IF ( subscription.latestserials ) %]
-            <p> The [% subscription.staffdisplaycount %] latest issues related to this subscription:</p>
+            <p> The [% subscription.staffdisplaycount | html %] latest issues related to this subscription:</p>
             <table>
                 <tr>
                     <th>Issue #</th>
                 </tr>
             [% FOREACH latestserial IN subscription.latestserials %]
                 <tr>
-                    <td>[% latestserial.serialseq %]</td>
-                    <td>[% latestserial.planneddate %]</td>
-                    <td>[% latestserial.publisheddate%]</td>
+                    <td>[% latestserial.serialseq | html %]</td>
+                    <td>[% latestserial.planneddate | html %]</td>
+                    <td>[% latestserial.publisheddate | html %]</td>
                     <td>
                       [% IF ( latestserial.status1 ) %]Expected[% END %]
                       [% IF ( latestserial.status2 ) %]Arrived[% END %]
                       [% IF ( latestserial.status7 ) %]Claimed[% END %]
                       [% IF ( latestserial.status8 ) %]Stopped[% END %]
                     </td>
-                    <td>[% latestserial.notes %]</td>
+                    <td>[% latestserial.notes | html %]</td>
                 </tr>
             [% END %]
             </table>
             [% END %]
-            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid %]">Subscription details</a>
+            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid | html %]">Subscription details</a>
     [% END %]
 </div>
 </div>
           <tr>
             <td>
             [% IF (order.id) %]
-                <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.id %]" title="Vendor detail page">[% order.name %]</a>
+                <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% order.id | html %]" title="Vendor detail page">[% order.name | html %]</a>
             [% END %]
             </td>
             <td>
             [% IF (order.invoiceid) %]
                 [% IF CAN_user_acquisition %]
-                    <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% order.invoiceid %]"
+                    <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% order.invoiceid | html %]"
                        title="Invoice detail page">
-                       [% order.invoicenumber %]</a>
+                       [% order.invoicenumber | html %]</a>
                 [% ELSE %]
-                    [% order.invoicenumber %]
+                    [% order.invoicenumber | html %]
                 [% END %]
             [% END %]
             </td>
             <td>
             [% IF (order.basketgroupid) %]
                 [% IF CAN_user_acquisition_group_manage %]
-                    <a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% order.id %]&basketgroupid=[% order.basketgroupid %]">[% order.groupname %] ([% order.basketgroupid %])</a>
+                    <a href="/cgi-bin/koha/acqui/basketgroup.pl?op=add&booksellerid=[% order.id | html %]&basketgroupid=[% order.basketgroupid | html %]">[% order.groupname | html %] ([% order.basketgroupid | html %])</a>
                 [% ELSE %]
-                    [% order.groupname %] ([% order.basketgroupid %])
+                    [% order.groupname | html %] ([% order.basketgroupid | html %])
                 [% END %]
             [% END %]
             </td>
             <td>[% IF CAN_user_acquisition_order_manage %]
-                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% order.basketno %]">[% order.basketname %] ([% order.basketno %])</a>
+                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% order.basketno | html %]">[% order.basketname | html %] ([% order.basketno | html %])</a>
             [% ELSE %]
-                [% order.basketname %] ([% order.basketno %])
+                [% order.basketname | html %] ([% order.basketno | html %])
             [% END %]</td>
-            <td>[% order.ordernumber %]</td>
-            <td><span title="[% order.creationdate %]">[% order.creationdate | $KohaDates%]</span></td>
-            <td><span title="[% order.datereceived %]">[% order.datereceived | $KohaDates%]</span></td>
+            <td>[% order.ordernumber | html %]</td>
+            <td><span title="[% order.creationdate | html %]">[% order.creationdate | $KohaDates%]</span></td>
+            <td><span title="[% order.datereceived | html %]">[% order.datereceived | $KohaDates%]</span></td>
             <td>
               [% SWITCH order.orderstatus %]
                 [% CASE 'new' %]New
                 [% CASE 'cancelled' %]Cancelled
               [% END %]
             </td>
-            <td>[% order.quantity %]</td>
+            <td>[% order.quantity | html %]</td>
           </tr>
       [% END %]
       </tbody>
 [% IF ( FRBRizeEditions ) %][% IF ( XISBNS ) %]
 <div id="editions"><h4>Editions</h4>
 <table>
-[% FOREACH XISBN IN XISBNS %]<tr>[% IF ( AmazonCoverImages ) %]<td><a href="http://www.amazon.com/gp/reader/[% XISBN.normalized_isbn %][% AmazonAssocTag %]#reader-link"><img src="https://images-na.ssl-images-amazon.com/images/P/[% XISBN.normalized_isbn %].01._AA75_PU_PU-5_.jpg" /></a></td>[% END %]
-[% UNLESS ( item_level_itypes ) %]<td>[% IF ( noItemTypeImages ) %][% XISBN.description %][% ELSE %]<img src="[% XISBN.imageurl %]" alt="[% XISBN.description %]" title="[% XISBN.description %]">[% END %]</td>[% END %]
-<td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% XISBN.biblionumber %]">[% XISBN.title |html %]</a> by [% XISBN.author | html %] &copy;[% XISBN.copyrightdate %]
+[% FOREACH XISBN IN XISBNS %]<tr>[% IF ( AmazonCoverImages ) %]<td><a href="http://www.amazon.com/gp/reader/[% XISBN.normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link"><img src="https://images-na.ssl-images-amazon.com/images/P/[% XISBN.normalized_isbn | html %].01._AA75_PU_PU-5_.jpg" /></a></td>[% END %]
+[% UNLESS ( item_level_itypes ) %]<td>[% IF ( noItemTypeImages ) %][% XISBN.description | html %][% ELSE %]<img src="[% XISBN.imageurl | html %]" alt="[% XISBN.description | html %]" title="[% XISBN.description | html %]">[% END %]</td>[% END %]
+<td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% XISBN.biblionumber | html %]">[% XISBN.title | html %]</a> by [% XISBN.author | html %] &copy;[% XISBN.copyrightdate | html %]
   [% IF ( XISBN.publishercode ) %]
-[% XISBN.publishercode %] [% IF ( XISBN.place ) %]([% XISBN.place %])[% END %] [% IF ( XISBN.publicationyear ) %], [% XISBN.publicationyear %][% END %] [% IF ( XISBN.editionstatement ) %][% XISBN.editionstatement %][% END %] [% IF ( XISBN.editionresponsibility ) %][% XISBN.editionresponsibility %][% END %]
+[% XISBN.publishercode | html %] [% IF ( XISBN.place ) %]([% XISBN.place | html %])[% END %] [% IF ( XISBN.publicationyear ) %], [% XISBN.publicationyear | html %][% END %] [% IF ( XISBN.editionstatement ) %][% XISBN.editionstatement | html %][% END %] [% IF ( XISBN.editionresponsibility ) %][% XISBN.editionresponsibility | html %][% END %]
     [% END %]
-                [% IF ( XISBN.pages ) %] [% END %][% XISBN.pages %] [% IF ( XISBN.illus ) %][% XISBN.illus %][% END %]
-                [% IF ( XISBN.size ) %], [% END %][% XISBN.size %]
+                [% IF ( XISBN.pages ) %] [% END %][% XISBN.pages | html %] [% IF ( XISBN.illus ) %][% XISBN.illus | html %][% END %]
+                [% IF ( XISBN.size ) %], [% END %][% XISBN.size | html %]
 </td>
 
 [% END %]
     <ul class="thumbnails">
 [% FOREACH image IN localimages %]
     [% IF image %]
-        <li id="imagenumber-[% image %]">
-            <a class="thumbnail" href="/cgi-bin/koha/catalogue/imageviewer.pl?biblionumber=[% biblionumber %]&amp;imagenumber=[% image %]">
-                <img alt="remove this image" src="/cgi-bin/koha/catalogue/image.pl?thumbnail=1&amp;imagenumber=[% image %]" />
+        <li id="imagenumber-[% image | html %]">
+            <a class="thumbnail" href="/cgi-bin/koha/catalogue/imageviewer.pl?biblionumber=[% biblionumber | html %]&amp;imagenumber=[% image | html %]">
+                <img alt="remove this image" src="/cgi-bin/koha/catalogue/image.pl?thumbnail=1&amp;imagenumber=[% image | html %]" />
                 [% IF CAN_user_tools_upload_local_cover_images %]
                   <span class="remove" title="remove this image">Delete image</span>
                 [% END %]
 <div id="html5media">
           [% FOREACH HTML5MediaSet IN HTML5MediaSets %]
             <p>
-              <[% HTML5MediaParent %] controls preload=none>
-                <[% HTML5MediaSet.child  %] src="[% HTML5MediaSet.srcblock %]"[% HTML5MediaSet.typeblock %] />
-                [[% HTML5MediaParent %] tag not supported by your browser.]
-              </[% HTML5MediaParent %]>
+              <[% HTML5MediaParent | html %] controls preload=none>
+                <[% HTML5MediaSet.child | html %] src="[% HTML5MediaSet.srcblock | html %]"[% HTML5MediaSet.typeblock | html %] />
+                [[% HTML5MediaParent | html %] tag not supported by your browser.]
+              </[% HTML5MediaParent | html %]>
             </p>
           [% END %]
 </div>
 
 [% IF ( Koha.Preference('NovelistSelectStaffEnabled') && Koha.Preference('NovelistSelectStaffProfile') && Koha.Preference('NovelistSelectStaffView') == 'tab' ) %]
     <div id="NovelistSelect" class="novelistSelect">
-        <div data-novelist-novelistselect=[% normalized_isbn %]></div>
+        <div data-novelist-novelistselect=[% normalized_isbn | html %]></div>
     </div>
 [% END %]
 
         <input type="submit" name="save" value="Download Record" /></td>
   </tr>
   <tr><td>
-    <input type="hidden" name="op" value="export" /><input type="hidden" name="bib" value="[% biblionumber %]" />
+    <input type="hidden" name="op" value="export" /><input type="hidden" name="bib" value="[% biblionumber | html %]" />
   </td></tr>
 </table>
 </form>
         <h3 id="marcPreviewLabel">MARC preview</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     [% INCLUDE 'greybox.inc' %]
     <script type="text/javascript">
         // http://www.oreillynet.com/pub/a/javascript/2003/10/21/amazonhacks.html
                 $('#marcPreview').modal({show:true});
             });
             $("#marcPreview").on("hidden", function(){
-                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
             [% IF ( Koha.Preference('NovelistSelectStaffEnabled') && Koha.Preference('NovelistSelectStaffProfile') && ( normalized_isbn || normalized_upc ) ) %]
                 novSelect.loadContentForQuery({
-                    ClientIdentifier : '[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]',
-                    ISBN : '[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]',
+                    ClientIdentifier : '[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]',
+                    ISBN : '[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]',
                     version : '2.1'
                 },
-                '[% Koha.Preference('NovelistSelectStaffProfile') %]',
-                '[% Koha.Preference('NovelistSelectPassword') %]',
+                '[% Koha.Preference('NovelistSelectStaffProfile') | html %]',
+                '[% Koha.Preference('NovelistSelectPassword') | html %]',
                 function(d){
                     if ( d.length > 0 ){ //If no content
                         $(".NovelistSelect").show();
         });[% END %]
     </script>
     [% IF ( Koha.Preference('NovelistSelectStaffEnabled') && Koha.Preference('NovelistSelectStaffProfile') && ( normalized_isbn || normalized_upc ) ) %]
-        [% Asset.js("https://imageserver.ebscohost.com/novelistselect/ns2init.js") %]
+        [% Asset.js("https://imageserver.ebscohost.com/novelistselect/ns2init.js") | $raw %]
     [% END %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") | $raw %]
     [% INCLUDE 'browser-strings.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("js/browser.js") %]
-    [% Asset.js("js/table_filters.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
+    [% Asset.js("js/table_filters.js") | $raw %]
     <script type="text/javascript">
         var browser;
-        browser = KOHA.browser('[% searchid %]', parseInt(biblionumber, 10));
+        browser = KOHA.browser('[% searchid | html %]', parseInt(biblionumber, 10));
         browser.show();
 
         $(document).ready(function() {
index 99bed91..ef18b46 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Catalog &rsaquo; Details for [% biblio.title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield %][% END %]</title>
+<title>Koha &rsaquo; Catalog &rsaquo; Details for [% biblio.title | html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( LocalCoverImages == 1 ) %]
 <style type="text/css">
@@ -38,7 +39,7 @@ img.thumbnail {
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Images for <i>[% biblio.title |html %]  [% FOREACH subtitl IN subtitle %] [% subtitl.subfield %][% END %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Images for <i>[% biblio.title | html %]  [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</i></div>
 
 <div id="doc3" class="yui-t1">
 
@@ -49,25 +50,25 @@ img.thumbnail {
 
 [% INCLUDE 'cat-toolbar.inc' %]
 
-<h3>Images for <i>[% biblio.title |html %]</i></h3>
-<h4>[% biblio.author %]</h4>
+<h3>Images for <i>[% biblio.title | html %]</i></h3>
+<h4>[% biblio.author | html %]</h4>
 
 [% IF ( LocalCoverImages == 1 ) %]
     [% IF ( images.size > 0 ) %]
         <div class="yui-u first">
         <div id="largeCover">
-            <img id="largeCoverImg" alt="" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% imagenumber %]" />
+            <img id="largeCoverImg" alt="" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% imagenumber | html %]" />
         </div></div>
 
         <div class="yui-u"><div id="thumbnails">
 
             [% FOREACH img IN images %]
                 [% IF img %]
-                <a class="show_cover" data-coverimg="[% img %]" href="/cgi-bin/koha/catalogue/imageviewer.pl?biblionumber=[% biblionumber %]&amp;imagenumber=[% img %]">
+                <a class="show_cover" data-coverimg="[% img | html %]" href="/cgi-bin/koha/catalogue/imageviewer.pl?biblionumber=[% biblionumber | html %]&amp;imagenumber=[% img | html %]">
                     [% IF ( imagenumber == img ) %]
-                        <img class="thumbnail selected" id="[% img %]" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% img %]&amp;thumbnail=1" alt="Thumbnail" />
+                        <img class="thumbnail selected" id="[% img | html %]" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% img | html %]&amp;thumbnail=1" alt="Thumbnail" />
                     [% ELSE %]
-                        <img class="thumbnail" id="[% img %]" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% img %]&amp;thumbnail=1" alt="Thumbnail" />
+                        <img class="thumbnail" id="[% img | html %]" src="/cgi-bin/koha/catalogue/image.pl?imagenumber=[% img | html %]&amp;thumbnail=1" alt="Thumbnail" />
                     [% END %]
                 </a>
                 [% END %]
@@ -91,10 +92,10 @@ img.thumbnail {
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
-            showCover([% imagenumber %]);
+            showCover([% imagenumber | html %]);
             $(".show_cover").on("click",function(e){
                 e.preventDefault();
                 var coverimg = $(this).data("coverimg");
index 8509387..caede4d 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -5,9 +6,9 @@
 [% USE ColumnsSettings %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Catalog &rsaquo; Checkout history for [% biblio.title |html %]</title>
+<title>Koha &rsaquo; Catalog &rsaquo; Checkout history for [% biblio.title | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="catalog_issuehistory" class="catalog">
@@ -15,7 +16,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Checkout history for <i>[% biblio.title |html %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Checkout history for <i>[% biblio.title | html %]</i></div>
 
 <div id="doc3" class="yui-t2">
 
        <div id="yui-main">
        <div class="yui-b">
 
-<h1>Checkout history for [% biblio.title |html %]</h1>
-[% IF biblio.author %]<h3>by [% biblio.author %]</h3>[% END %]
+<h1>Checkout history for [% biblio.title | html %]</h1>
+[% IF biblio.author %]<h3>by [% biblio.author | html %]</h3>[% END %]
 
 [% SET show_patron_column = Koha.Preference('intranetreadinghistory') AND CAN_user_circulate_circulate_remaining_permissions %]
 
 <div class="searchresults">
     [% IF checkouts %]
-        <h4>Checked out [% checkouts.size %] times</h4>
+        <h4>Checked out [% checkouts.size | html %] times</h4>
         <table id="table_issues">
             <thead><tr>
             [% IF show_patron_column %]
                 [% END %]
                 <td>
                     [% IF checkout.item.barcode %] [%# FIXME This test is not mandatory I think %]
-                        <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% checkout.item.biblionumber %]&amp;itemnumber=[% checkout.item.itemnumber %]">[% checkout.item.barcode %]</a>
+                        <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% checkout.item.biblionumber | html %]&amp;itemnumber=[% checkout.item.itemnumber | html %]">[% checkout.item.barcode | html %]</a>
                     [% ELSE %]
                         &nbsp;
                     [% END %]</td>
                 <td>[% IF checkout.branchcode %]
-                        [% Branches.GetName( checkout.branchcode ) %]
+                        [% Branches.GetName( checkout.branchcode ) | html %]
                     [% ELSE %]
                         &nbsp;
                     [% END %]</td>
                 <td>[% IF checkout.renewals %]
-                        Yes[% IF checkout.lastreneweddate %], <small>last on: [% checkout.lastreneweddate |$KohaDates with_hours => 1  %]</small>
+                        Yes[% IF checkout.lastreneweddate %], <small>last on: [% checkout.lastreneweddate |$KohaDates with_hours => 1 | html %]</small>
                             [% END %]
                     [% ELSE %]
                         No
                     [% END %]</td>
                 <td>[% IF checkout.issuedate %]
-                        <span title="[% checkout.issuedate %]">[% checkout.issuedate |$KohaDates with_hours => 1  %]</span>
+                        <span title="[% checkout.issuedate | html %]">[% checkout.issuedate |$KohaDates with_hours => 1 | html %]</span>
                     [% ELSE %]
                         <span title="0000-00-00"></span>
                     [% END %]</td>
                 <td>[% IF checkout.date_due %]
-                        <span title="[% checkout.date_due %]">[% checkout.date_due |$KohaDates with_hours => 1  %]</span>
+                        <span title="[% checkout.date_due | html %]">[% checkout.date_due |$KohaDates with_hours => 1 | html %]</span>
                     [% ELSE %]
                         <span title="0000-00-00"></span>
                     [% END %]</td>
                 <td>[% IF checkout.returndate %]
-                        <span title="[% checkout.returndate %]">[% checkout.returndate |$KohaDates with_hours => 1  %]</span>
+                        <span title="[% checkout.returndate | html %]">[% checkout.returndate |$KohaDates with_hours => 1 | html %]</span>
                     [% ELSE %]
                         <span title="Checked out"><small>Checked out</small></span>
                     [% END %]</td>
@@ -87,7 +88,7 @@
                </table>
     [% ELSE %]
         <div class="dialog message"><p>
-        <b>[% biblio.title |html %][% IF biblio.author %], by [% biblio.author %][% END %]</b> has never been checked out.</p></div>
+        <b>[% biblio.title | html %][% IF biblio.author %], by [% biblio.author | html %][% END %]</b> has never been checked out.</p></div>
 
     [% END %]
 </div>
index ee130b6..a39f6e4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE JSON.Escape %]
 
 
 [% BLOCK form_field_select %]
   <div class="form-field form-field-select">
-    <label class="form-field-label" for="[% name %]">[% INCLUDE form_label label=name %]</label>
-    <select id="[% name %]_op" name="[% name %]_op">
+    <label class="form-field-label" for="[% name | html %]">[% INCLUDE form_label label=name %]</label>
+    <select id="[% name | html %]_op" name="[% name | html %]_op">
       <option value="=">is</option>
       <option value="!=" >is not</option>
     </select>
-    <select id="[% name %]" name="[% name %]" multiple="multiple" size="[% options.size < 4 ? options.size + 1 : 4 %]">
+    <select id="[% name | html %]" name="[% name | html %]" multiple="multiple" size="[% options.size < 4 ? options.size + 1 : 4 | html %]">
       <option value="" selected="selected">
         [% IF (empty_option) %][% INCLUDE form_label label=empty_option %][% ELSE %]<span>All</span>[% END %]
       </option>
       [% FOREACH option IN options %]
-        <option value="[% option.value %]">[% option.label %]</option>
+        <option value="[% option.value | html %]">[% option.label | html %]</option>
       [% END %]
     </select>
   </div>
 [% END %]
 
 [% BLOCK form_field_select_option %]
-  <option value="[% value %]">[% INCLUDE form_label label=value %]</option>
+  <option value="[% value | html %]">[% INCLUDE form_label label=value %]</option>
 [% END %]
 
 [% BLOCK form_field_select_text %]
       [% IF items_search_fields.size %]
         <optgroup label="Custom search fields">
           [% FOREACH field IN items_search_fields %]
-            [% marcfield = field.tagfield %]
+            [% marcfield = field.tagfield | html %]
             [% IF field.tagsubfield %]
-              [% marcfield = marcfield _ '$' _ field.tagsubfield %]
+              [% marcfield = marcfield _ '$' _ field.tagsubfield | html %]
             [% END %]
-            <option value="marc:[% marcfield %]" data-authorised-values-category="[% field.authorised_values_category %]">[% field.label %] ([% marcfield %])</option>
+            <option value="marc:[% marcfield | html %]" data-authorised-values-category="[% field.authorised_values_category | html %]">[% field.label | html %] ([% marcfield | html %])</option>
           [% END %]
         </optgroup>
       [% END %]
 [% BLOCK form_field_radio_yes_no %]
   <div class="form-field">
     <label class="form-field-label">[% INCLUDE form_label label=name %]:</label>
-    <input type="radio" name="[% name %]" id="[% name %]_indifferent" value="" checked="checked"/>
-    <label for="[% name %]_indifferent">Ignore</label>
-    <input type="radio" name="[% name %]" id="[% name %]_yes" value="yes" />
-    <label for="[% name %]_yes">Yes</label>
-    <input type="radio" name="[% name %]" id="[% name %]_no" value="no" />
-    <label for="[% name %]_no">No</label>
+    <input type="radio" name="[% name | html %]" id="[% name | html %]_indifferent" value="" checked="checked"/>
+    <label for="[% name | html %]_indifferent">Ignore</label>
+    <input type="radio" name="[% name | html %]" id="[% name | html %]_yes" value="yes" />
+    <label for="[% name | html %]_yes">Yes</label>
+    <input type="radio" name="[% name | html %]" id="[% name | html %]_no" value="no" />
+    <label for="[% name | html %]_no">No</label>
   </div>
 [% END %]
 
 [% INCLUDE 'doc-head-open.inc' %]
   <title>Koha &rsaquo; Catalog &rsaquo; Item search</title>
   [% INCLUDE 'doc-head-close.inc' %]
-  [% Asset.css("css/itemsearchform.css") %]
-  [% Asset.css("css/datatables.css") %]
+  [% Asset.css("css/itemsearchform.css") | $raw %]
+  [% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="catalog_itemsearch" class="catalog">
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     <script type="text/javascript">
-        var authorised_values = [% authorised_values_json %];
+        var authorised_values = [% authorised_values_json | html %];
 
         function loadAuthorisedValuesSelect(select) {
             var selected = select.find('option:selected');
                     { 'type': 'text' },
                     { 'type': 'text' },
                     [% IF ccodes.size %]
-                        { 'type': 'select', 'values': [% ccodes.json %] },
+                        { 'type': 'select', 'values': [% ccodes.json | html %] },
                     [% ELSE %]
                         null,
                     [% END %]
                     { 'type': 'text' },
                     { 'type': 'text' },
-                    { 'type': 'select', 'values': [% branches.json %] },
-                    { 'type': 'select', 'values': [% branches.json %] },
+                    { 'type': 'select', 'values': [% branches.json | html %] },
+                    { 'type': 'select', 'values': [% branches.json | html %] },
                     [% IF locations.size %]
-                        { 'type': 'select', 'values': [% locations.json %] },
+                        { 'type': 'select', 'values': [% locations.json | html %] },
                     [% ELSE %]
                         null,
                     [% END %]
                     { 'type': 'text' },
                     [% IF notforloans.size %]
-                        { 'type': 'select', 'values': [% notforloans.json %] },
+                        { 'type': 'select', 'values': [% notforloans.json | html %] },
                     [% ELSE %]
                         null,
                     [% END %]
index 4bc2add..3c7b17d 100644 (file)
@@ -1,7 +1,7 @@
 {
-  "sEcho": [% sEcho %],
-  "iTotalRecords": [% total_rows %],
-  "iTotalDisplayRecords": [% total_rows %],
+  "sEcho": [% sEcho | html %],
+  "iTotalRecords": [% total_rows | html %],
+  "iTotalDisplayRecords": [% total_rows | html %],
   "aaData": [
   [%- FOREACH item IN results -%]
     [%- INCLUDE 'catalogue/itemsearch_item.json.inc' item = item -%]
index e3b472b..8aa9f9a 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -30,7 +31,7 @@
        <div id="doc3" class="yui-t2">
 
        [% IF ( unknownbiblionumber ) %]
-         <div class="dialog message">The record you requested does not exist ([% biblionumber %]).</div>
+         <div class="dialog message">The record you requested does not exist ([% biblionumber | html %]).</div>
        [% ELSE %]
 
                <div id="bd">
                                        [% INCLUDE 'cat-toolbar.inc' %]
 
                                        [% UNLESS ( popup ) %]
-                        <h1>Labeled MARC biblio : [% biblionumber %]  ( [% bibliotitle | html %] )</h1>
+                        <h1>Labeled MARC biblio : [% biblionumber | html %]  ( [% bibliotitle | html %] )</h1>
                                        [% END %]
                     <p><b>With framework:
                     <select name="Frameworks" id="Frameworks" size="1" onchange="Changefwk(this);">
                         <option value="">Default</option>
                         [% FOREACH framework IN frameworks %]
                         [% IF framework.frameworkcode == frameworkcode %]
-                            <option value="[% framework.frameworkcode %]" selected="selected">[% framework.frameworktext %]</option>
+                            <option value="[% framework.frameworkcode | html %]" selected="selected">[% framework.frameworktext | html %]</option>
                         [% ELSE %]
-                            <option value="[% framework.frameworkcode %]">[% framework.frameworktext %]</option>
+                            <option value="[% framework.frameworkcode | html %]">[% framework.frameworktext | html %]</option>
                         [% END %]
                         [% END %]
                     </select>
@@ -59,8 +60,8 @@
                                                <table class="labeledmarc-table">
                                                        [% FOREACH marc_dat IN marc_data %]
                                                                <tr>
-                                                                       <td class="labeledmarc-label">[% marc_dat.label %]</td>
-                                                                       <td class="labeledmarc-value">[% marc_dat.value %]</td>
+                                                                       <td class="labeledmarc-label">[% marc_dat.label | html %]</td>
+                                                                       <td class="labeledmarc-value">[% marc_dat.value | html %]</td>
                                                                </tr>
                                                        [% END %]
                                                </table>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     [% INCLUDE 'browser-strings.inc' %]
-    [% Asset.js("js/browser.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
     <script type="text/javascript">
     //<![CDATA[
-        var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+        var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
         browser.show();
         $(document).ready(function() {
             $("#Frameworks").on("change",function(){
@@ -92,7 +93,7 @@
         function Changefwk(FwkList)
         {
             var fwk = FwkList.options[FwkList.selectedIndex].value;
-            window.location = "labeledMARCdetail.pl?biblionumber=[% biblionumber %]&frameworkcode="+fwk;
+            window.location = "labeledMARCdetail.pl?biblionumber=[% biblionumber | html %]&frameworkcode="+fwk;
         }
     //]]>
     </script>
index 026e14f..119bd11 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Item details for <i>[% title |html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield|html %][% END %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>  &rsaquo; Item details for <i>[% title | html %] [% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</i></div>
 
 <div id="doc3" class="yui-t2">
 
 
 <div id="catalogue_detail_biblio">
 
-    <h2>[% title |html %]</h2>
-    [% IF ( subtitle ) %]<h4>[% FOREACH subtitl IN subtitle %] [% subtitl.subfield|html %][% END %]</h4>[% END %]
+    <h2>[% title | html %]</h2>
+    [% IF ( subtitle ) %]<h4>[% FOREACH subtitl IN subtitle %] [% subtitl.subfield | html %][% END %]</h4>[% END %]
     [% IF ( author ) %]<h4>by [% author | html %]</h4>[% END %]
     <ol class="bibliodetails">
-        <li><span class="label">Biblionumber:</span> [% biblionumber %]&nbsp;</li>
+        <li><span class="label">Biblionumber:</span> [% biblionumber | html %]&nbsp;</li>
         [% UNLESS ( item_level_itypes ) %]
-        <li><span class="label">Item type:</span> [% itemtypename %]&nbsp;</li>
+        <li><span class="label">Item type:</span> [% itemtypename | html %]&nbsp;</li>
         [% END %]
-        [% IF ( rentalcharge ) %]<li><span class="label">Rental charge:</span>[% rentalcharge %]&nbsp;</li>[% END %]
+        [% IF ( rentalcharge ) %]<li><span class="label">Rental charge:</span>[% rentalcharge | html %]&nbsp;</li>[% END %]
         <li><span class="label">ISBN:</span> [% isbn | html %]&nbsp;</li>
-        <li><span class="label">Publisher:</span>[% place %] [% publishercode |html %] [% publicationyear %]&nbsp;</li>
-        [% IF ( volumeddesc ) %]<li><span class="label">Volume:</span> [% volumeddesc %]</li>[% END %]
-        <li><span class="label">Physical details:</span> [% pages %] [% illus %] [% size %]&nbsp;</li>
-        [% IF ( bnotes ) %]<li><span class="label">Notes:</span> [% bnotes %]</li>[% END %]
-        <li><span class="label">No. of items:</span> [% count %]&nbsp;[% IF ( hiddencount ) %]total ([% showncount %] shown / [% hiddencount %] hidden) 
-<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblionumber %]&amp;showallitems=1">Show all items</a>[% END %]</li>
+        <li><span class="label">Publisher:</span>[% place | html %] [% publishercode | html %] [% publicationyear | html %]&nbsp;</li>
+        [% IF ( volumeddesc ) %]<li><span class="label">Volume:</span> [% volumeddesc | html %]</li>[% END %]
+        <li><span class="label">Physical details:</span> [% pages | html %] [% illus | html %] [% size | html %]&nbsp;</li>
+        [% IF ( bnotes ) %]<li><span class="label">Notes:</span> [% bnotes | html %]</li>[% END %]
+        <li><span class="label">No. of items:</span> [% count | html %]&nbsp;[% IF ( hiddencount ) %]total ([% showncount | html %] shown / [% hiddencount | html %] hidden) 
+<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblionumber | html %]&amp;showallitems=1">Show all items</a>[% END %]</li>
     </ol>
 
     <br clear="all" />
     [% IF ( ONLY_ONE ) %]
-        <div class="dialog message">You are only viewing one item.  <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblionumber %]&amp;bi=[% biblioitemnumber %]#item[% itemnumber %]">View All</a></div>
+        <div class="dialog message">You are only viewing one item.  <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblionumber | html %]&amp;bi=[% biblioitemnumber | html %]#item[% itemnumber | html %]">View All</a></div>
     [% END %]
     [% FOREACH ITEM_DAT IN ITEM_DATA %]
     <div class="yui-g">
-        <h3 id="item[% ITEM_DAT.itemnumber %]">Barcode [% ITEM_DAT.barcode %]  [% IF ( ITEM_DAT.notforloantext ) %][% ITEM_DAT.notforloantext %] [% END %]</h3>
+        <h3 id="item[% ITEM_DAT.itemnumber | html %]">Barcode [% ITEM_DAT.barcode | html %]  [% IF ( ITEM_DAT.notforloantext ) %][% ITEM_DAT.notforloantext | html %] [% END %]</h3>
         <div class="listgroup"><h4>Item information [% IF ( CAN_user_editcatalogue_edit_catalogue ) %][% UNLESS ( ITEM_DAT.nomod ) %]
          [% IF ( CAN_user_editcatalogue_edit_items ) %]
-         <a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% ITEM_DAT.biblionumber %]&amp;itemnumber=[% ITEM_DAT.itemnumber %]">[Edit Item]</a>
+         <a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% ITEM_DAT.biblionumber | html %]&amp;itemnumber=[% ITEM_DAT.itemnumber | html %]">[Edit Item]</a>
          [% END %]
          [% END %][% END %]</h4>
             <ol class="bibliodetails">
-            <li><span class="label">Home library:</span> [% Branches.GetName( ITEM_DAT.homebranch ) %]&nbsp;</li>
+            <li><span class="label">Home library:</span> [% Branches.GetName( ITEM_DAT.homebranch ) | html %]&nbsp;</li>
            [% IF ( item_level_itypes ) %]
-            <li><span class="label">Item type:</span> [% ITEM_DAT.itype %]&nbsp;</li>
+            <li><span class="label">Item type:</span> [% ITEM_DAT.itype | html %]&nbsp;</li>
            [% END %]
-            [% IF ( ITEM_DAT.collection ) %]<li><span class="label">Collection:</span> [% ITEM_DAT.collection %]</li> [% END %]
-            <li><span class="label">Item callnumber:</span> [% ITEM_DAT.itemcallnumber %]&nbsp;</li>
-            [% IF ( ITEM_DAT.displaycopy ) %]<li><span class="label">Copy number:</span> [% ITEM_DAT.copyvol %]&nbsp;</li> [% END %]
-            [% IF ( ITEM_DAT.replacementprice ) %]<li><span class="label">Replacement price:</span> [% ITEM_DAT.replacementprice %]&nbsp;</li> [% END %]
-           [% IF ITEM_DAT.materials %]<li><span class="label">Materials specified:</span> [% ITEM_DAT.materials %] </li> [% END %]
+            [% IF ( ITEM_DAT.collection ) %]<li><span class="label">Collection:</span> [% ITEM_DAT.collection | html %]</li> [% END %]
+            <li><span class="label">Item callnumber:</span> [% ITEM_DAT.itemcallnumber | html %]&nbsp;</li>
+            [% IF ( ITEM_DAT.displaycopy ) %]<li><span class="label">Copy number:</span> [% ITEM_DAT.copyvol | html %]&nbsp;</li> [% END %]
+            [% IF ( ITEM_DAT.replacementprice ) %]<li><span class="label">Replacement price:</span> [% ITEM_DAT.replacementprice | html %]&nbsp;</li> [% END %]
+           [% IF ITEM_DAT.materials %]<li><span class="label">Materials specified:</span> [% ITEM_DAT.materials | html %] </li> [% END %]
             </ol></div>
            <div class="listgroup"><h4>Statuses [% IF ( ITEM_DAT.status_advisory ) %](
-                [% IF ( ITEM_DAT.notforloantext ) %][% ITEM_DAT.notforloantext %] [% END %]
+                [% IF ( ITEM_DAT.notforloantext ) %][% ITEM_DAT.notforloantext | html %] [% END %]
                 [% IF ( ITEM_DAT.itemlost ) %]Lost[% END %]
                 [% IF ( ITEM_DAT.damaged ) %]Damaged[% END %]
                 [% IF ( ITEM_DAT.withdrawn ) %]Withdrawn[% END %]
             )[% END %]</h4>
 
             <ol class="bibliodetails">
-            <li><span class="label">Current location:</span> [% Branches.GetName( ITEM_DAT.holdingbranch ) %]&nbsp;</li>
+            <li><span class="label">Current location:</span> [% Branches.GetName( ITEM_DAT.holdingbranch ) | html %]&nbsp;</li>
             <li><span class="label">Checkout status:</span>
             [% IF ( ITEM_DAT.issue ) %]Checked out to
                 [% INCLUDE 'patron-title.inc' patron => ITEM_DAT.patron hide_patron_infos_if_needed=1 %]
                 [% END %]
             [% END %]
             &nbsp;</li>
-            <li><span class="label">Current renewals:</span> [% ITEM_DAT.renewals %]&nbsp;</li>
+            <li><span class="label">Current renewals:</span> [% ITEM_DAT.renewals | html %]&nbsp;</li>
             [% IF itemlostloop %]
                 <li><span class="label">Lost status:</span>
                     [% IF ( CAN_user_circulate ) %]
                         <form action="updateitem.pl" method="post">
-                        <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber %]" />
-                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber %]" />
-                        <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber %]" />
+                        <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
+                        <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                         <select name="itemlost" >
                                     <option value="">Choose</option>
                         [% FOREACH itemlostloo IN itemlostloop %]
                             [% IF itemlostloo.authorised_value == ITEM_DAT.itemlost %]
-                                    <option value="[% itemlostloo.authorised_value %]" selected="selected">[% itemlostloo.lib %]</option>
+                                    <option value="[% itemlostloo.authorised_value | html %]" selected="selected">[% itemlostloo.lib | html %]</option>
                             [% ELSE %]
-                                    <option value="[% itemlostloo.authorised_value %]">[% itemlostloo.lib %]</option>
+                                    <option value="[% itemlostloo.authorised_value | html %]">[% itemlostloo.lib | html %]</option>
                             [% END %]
                         [% END %]
                         </select>
-                        <input type="hidden" name="withdrawn" value="[% ITEM_DAT.withdrawn %]" />
-                        <input type="hidden" name="damaged" value="[% ITEM_DAT.damaged %]" />
+                        <input type="hidden" name="withdrawn" value="[% ITEM_DAT.withdrawn | html %]" />
+                        <input type="hidden" name="damaged" value="[% ITEM_DAT.damaged | html %]" />
                         <input type="submit" name="submit" class="submit" value="Set status" /></form>
                     [% ELSE %]
                         [% FOREACH itemlostloo IN itemlostloop %]
                             [% IF ( itemlostloo.selected ) %]
-                                [% itemlostloo.lib %]
+                                [% itemlostloo.lib | html %]
                             [% END %]
                         [% END %]
                         &nbsp;
             <li><span class="label">Damaged status:</span>
                 [% IF ( CAN_user_circulate ) %]
                     <form action="updateitem.pl" method="post">
-                    <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber %]" />
-                    <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber %]" />
-                    <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber %]" />
+                    <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                    <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
+                    <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                     <select name="damaged" >
                     <option value="">Choose</option>
             [% FOREACH itemdamagedloo IN itemdamagedloop %]
                 [% IF itemdamagedloo.authorised_value == ITEM_DAT.damaged %]
-                    <option value="[% itemdamagedloo.authorised_value %]" selected="selected">[% itemdamagedloo.lib %]</option>
+                    <option value="[% itemdamagedloo.authorised_value | html %]" selected="selected">[% itemdamagedloo.lib | html %]</option>
                 [% ELSE %]
-                    <option value="[% itemdamagedloo.authorised_value %]">[% itemdamagedloo.lib %]</option>
+                    <option value="[% itemdamagedloo.authorised_value | html %]">[% itemdamagedloo.lib | html %]</option>
                 [% END %]
             [% END %]
                     </select>
-                    <input type="hidden" name="withdrawn" value="[% ITEM_DAT.withdrawn %]" />
-                    <input type="hidden" name="itemlost" value="[% ITEM_DAT.itemlost %]" />
+                    <input type="hidden" name="withdrawn" value="[% ITEM_DAT.withdrawn | html %]" />
+                    <input type="hidden" name="itemlost" value="[% ITEM_DAT.itemlost | html %]" />
                     <input type="submit" name="submit" class="submit" value="Set status" /></form>
                 [% ELSE %]
                     [% FOREACH itemdamagedloo IN itemdamagedloop %]
                         [% IF ( itemdamagedloo.selected ) %]
-                            [% itemdamagedloo.lib %]
+                            [% itemdamagedloo.lib | html %]
                         [% END %]
                     [% END %]
                     &nbsp;
                 <li><span class="label">Withdrawn status:</span>
                     [% IF ( CAN_user_circulate ) %]
                         <form action="updateitem.pl" method="post">
-                            <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber %]" />
-                            <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber %]" />
-                            <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber %]" />
+                            <input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                            <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" />
+                            <input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
                             <select name="withdrawn" >
                                 <option value="">Choose</option>
                                 [% FOREACH itemwithdrawn IN itemwithdrawnloop %]
                                     [% IF itemwithdrawn.authorised_value == ITEM_DAT.withdrawn %]
-                                        <option value="[% itemwithdrawn.authorised_value %]" selected="selected">[% itemwithdrawn.lib %]</option>
+                                        <option value="[% itemwithdrawn.authorised_value | html %]" selected="selected">[% itemwithdrawn.lib | html %]</option>
                                     [% ELSE %]
-                                        <option value="[% itemwithdrawn.authorised_value %]">[% itemwithdrawn.lib %]</option>
+                                        <option value="[% itemwithdrawn.authorised_value | html %]">[% itemwithdrawn.lib | html %]</option>
                                     [% END %]
                                 [% END %]
                             </select>
-                            <input type="hidden" name="itemlost" value="[% ITEM_DAT.itemlost %]" />
-                            <input type="hidden" name="damaged" value="[% ITEM_DAT.damaged %]" />
+                            <input type="hidden" name="itemlost" value="[% ITEM_DAT.itemlost | html %]" />
+                            <input type="hidden" name="damaged" value="[% ITEM_DAT.damaged | html %]" />
                             <input type="submit" name="submit" class="submit" value="Set status" /></form>
                     [% ELSE %]
                         [% FOREACH itemwithdrawn IN itemwithdrawnloop %]
                             [% IF itemwithdrawn.authorised_value == ITEM_DAT.withdrawn %]
-                                [% itemwithdrawn.lib %]
+                                [% itemwithdrawn.lib | html %]
                             [% END %]
                         [% END %]
                         &nbsp;
             [% IF ITEM_DAT.basketno %]
                 <li><span class="label">Order date:</span>
                     [% IF ( CAN_user_acquisition_order_manage ) %]
-                        <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% ITEM_DAT.basketno %]">[% ITEM_DAT.orderdate | $KohaDates %]</a>
+                        <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% ITEM_DAT.basketno | html %]">[% ITEM_DAT.orderdate | $KohaDates %]</a>
                     [% ELSE %]
                         [% ITEM_DAT.orderdate | $KohaDates %]
                     [% END %]
                  </li>
                 <li><span class="label">Vendor:</span>
-                    [% ITEM_DAT.vendor %]
+                    [% ITEM_DAT.vendor | html %]
                 </li>
             [% END %]
 
             [% IF ITEM_DAT.dateaccessioned %]
                 <li><span class="label">Accession date:</span>
                     [% IF ( CAN_user_acquisition_order_receive && ITEM_DAT.invoiceid ) %]
-                        <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% ITEM_DAT.invoiceid %]">[% ITEM_DAT.dateaccessioned | $KohaDates %]</a>
+                        <a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% ITEM_DAT.invoiceid | html %]">[% ITEM_DAT.dateaccessioned | $KohaDates %]</a>
                     [% ELSE %]
                         [% ITEM_DAT.dateaccessioned | $KohaDates %]
                     [% END %]
             [% END %]
             [% IF ( ITEM_DAT.invoicenumber ) %]
                 <li><span class="label">Invoice number:</span>
-                    [% ITEM_DAT.invoicenumber %]
+                    [% ITEM_DAT.invoicenumber | html %]
                 </li>
             [% END %]
 
-                <li><span class="label">Total checkouts:</span>[% IF ( ITEM_DAT.issues ) %][% ITEM_DAT.issues %][% ELSE %]0[% END %]  (<a href="/cgi-bin/koha/circ/bookcount.pl?&amp;biblionumber=[% ITEM_DAT.biblionumber %]&amp;itm=[% ITEM_DAT.itemnumber %]">View item's checkout history</a>)</li>
+                <li><span class="label">Total checkouts:</span>[% IF ( ITEM_DAT.issues ) %][% ITEM_DAT.issues | html %][% ELSE %]0[% END %]  (<a href="/cgi-bin/koha/circ/bookcount.pl?&amp;biblionumber=[% ITEM_DAT.biblionumber | html %]&amp;itm=[% ITEM_DAT.itemnumber | html %]">View item's checkout history</a>)</li>
 
                 <li><span class="label">Last seen:</span>[% IF ( ITEM_DAT.datelastseen ) %][% ITEM_DAT.datelastseen | $KohaDates %] [%END %]&nbsp;</li>
                 <li><span class="label">Last borrowed:</span>[% IF (ITEM_DAT.datelastborrowed ) %][% ITEM_DAT.datelastborrowed | $KohaDates %][% END %]&nbsp;</li>
                 [% IF Koha.Preference('StoreLastBorrower') && ITEM_DAT.object.last_returned_by %]
-                    <li><span class="label">Last returned by:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.object.last_returned_by.borrowernumber %]">[% ITEM_DAT.object.last_returned_by.cardnumber %]</a>&nbsp;</li>
+                    <li><span class="label">Last returned by:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.object.last_returned_by.borrowernumber | html %]">[% ITEM_DAT.object.last_returned_by.cardnumber | html %]</a>&nbsp;</li>
                 [% END %]
-                [% IF ( ITEM_DAT.card0 ) %]<li><span class="label">Last borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower0 %]">[% ITEM_DAT.card0 %]</a>&nbsp;</li>[% END %]
-                [% IF ( ITEM_DAT.card1 ) %]<li><span class="label">Previous borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower1 %]">[% ITEM_DAT.card1 %]</a>&nbsp;</li>[% END %]
-                [% IF ( ITEM_DAT.card2 ) %]<li><span class="label">Previous borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower2 %]">[% ITEM_DAT.card2 %]</a>&nbsp;</li>[% END %]
-                [% IF ( ITEM_DAT.paidfor ) %]<li><span class="label">Paid for?:</span> [% ITEM_DAT.paidfor %]&nbsp;</li>[% END %]
+                [% IF ( ITEM_DAT.card0 ) %]<li><span class="label">Last borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower0 | html %]">[% ITEM_DAT.card0 | html %]</a>&nbsp;</li>[% END %]
+                [% IF ( ITEM_DAT.card1 ) %]<li><span class="label">Previous borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower1 | html %]">[% ITEM_DAT.card1 | html %]</a>&nbsp;</li>[% END %]
+                [% IF ( ITEM_DAT.card2 ) %]<li><span class="label">Previous borrower:</span> <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% ITEM_DAT.borrower2 | html %]">[% ITEM_DAT.card2 | html %]</a>&nbsp;</li>[% END %]
+                [% IF ( ITEM_DAT.paidfor ) %]<li><span class="label">Paid for?:</span> [% ITEM_DAT.paidfor | html %]&nbsp;</li>[% END %]
 
-                [% IF ( ITEM_DAT.enumchron ) %]<li><span class="label">Serial enumeration:</span> [% ITEM_DAT.enumchron %]&nbsp;</li>[% END %]
+                [% IF ( ITEM_DAT.enumchron ) %]<li><span class="label">Serial enumeration:</span> [% ITEM_DAT.enumchron | html %]&nbsp;</li>[% END %]
 
                 <li>
                     <span class="label">Public note:</span>
                     [% IF ( CAN_user_editcatalogue_edit_items ) %]
-                    <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber %]" />
-                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber %]" />
-                        <textarea name="itemnotes" rows="2" cols="30">[% ITEM_DAT.itemnotes %]</textarea><input type="submit" name="submit" class="submit" value="Update" />
+                    <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
+                        <textarea name="itemnotes" rows="2" cols="30">[% ITEM_DAT.itemnotes | html %]</textarea><input type="submit" name="submit" class="submit" value="Update" />
                     </form>
                     [% ELSE %]
-                        [% ITEM_DAT.itemnotes %]
+                        [% ITEM_DAT.itemnotes | html %]
                         &nbsp;
                     [% END %]
                 </li>
                 <li>
                     <span class="label">Non-public note:</span>
                     [% IF ( CAN_user_editcatalogue_edit_items ) %]
-                    <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber %]" />
-                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber %]" />
-                        <textarea name="itemnotes_nonpublic" rows="2" cols="30">[% ITEM_DAT.itemnotes_nonpublic %]</textarea><input type="submit" name="submit" class="submit" value="Update" />
+                    <form class="inline" action="updateitem.pl" method="post"><input type="hidden" name="biblionumber" value="[% ITEM_DAT.biblionumber | html %]" />
+                        <input type="hidden" name="biblioitemnumber" value="[% ITEM_DAT.biblioitemnumber | html %]" /><input type="hidden" name="itemnumber" value="[% ITEM_DAT.itemnumber | html %]" />
+                        <textarea name="itemnotes_nonpublic" rows="2" cols="30">[% ITEM_DAT.itemnotes_nonpublic | html %]</textarea><input type="submit" name="submit" class="submit" value="Update" />
                     </form>
                     [% ELSE %]
-                        [% ITEM_DAT.itemnotes_nonpublic %]
+                        [% ITEM_DAT.itemnotes_nonpublic | html %]
                         &nbsp;
                     [% END %]
                 </li>
 </div>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'catalog-strings.inc' %]
-    [% Asset.js("js/catalog.js") %]
+    [% Asset.js("js/catalog.js") | $raw %]
     [% INCLUDE 'browser-strings.inc' %]
-    [% Asset.js("js/browser.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
     <script type="text/javascript">
-        var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+        var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
         browser.show();
     </script>
 [% END %]
index 0b7c63d..7024546 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Biblio %]
@@ -25,7 +26,7 @@
 <div id="breadcrumbs">
          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
 &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>
-&rsaquo; Search [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]
+&rsaquo; Search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]
 </div>
 
 <div id="doc3" class="yui-t1">
@@ -43,7 +44,7 @@
             <ul style="list-style: none;">
             [% FOREACH SPELL_SUGGES IN SPELL_SUGGEST %]
             <li>
-                <a href="/cgi-bin/koha/catalogue/search.pl?q=[% SPELL_SUGGES.spsuggestion %]">[% SPELL_SUGGES.spsuggestion %]</a>
+                <a href="/cgi-bin/koha/catalogue/search.pl?q=[% SPELL_SUGGES.spsuggestion | html %]">[% SPELL_SUGGES.spsuggestion | html %]</a>
             </li>
             [% END %]
             </ul>
@@ -53,7 +54,7 @@
     [% IF ( total ) %]
 
         <h3>
-            [% total %] result(s) found [% IF ( query_desc ) %]for <span class="results_query_desc">'[% query_desc |html %]'</span>[% END %][% IF limit_desc  %]&nbsp;with limit(s): <span class="results_limit_desc">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %].
+            [% total | html %] result(s) found [% IF ( query_desc ) %]for <span class="results_query_desc">'[% query_desc | html %]'</span>[% END %][% IF limit_desc  %]&nbsp;with limit(s): <span class="results_limit_desc">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName | html %] Catalog[% END %].
         </h3>
 
         <div id="searchheader">
                             [% FOREACH s IN add_to_some_private_shelves %]
                                 [% IF shelfnumber != s.shelfnumber %]
                                     <li>
-                                        <a href="#" class="addtolist" data-shelfnumber="[% s.shelfnumber %]">[% s.shelfname |html %]</a>
+                                        <a href="#" class="addtolist" data-shelfnumber="[% s.shelfnumber | html %]">[% s.shelfname | html %]</a>
                                     </li>
                                     [% SET number_of_private_shelves = number_of_private_shelves + 1 %]
-                                    [% IF number_of_private_shelves == 10 %][% LAST %][% END %]
+                                    [% IF number_of_private_shelves == 10 %][% LAST | html %][% END %]
                                 [% END %]
                             [% END %]
                         [% END %]
                             [% FOREACH s IN add_to_some_public_shelves %]
                                 [% IF shelfnumber != s.shelfnumber %]
                                     <li>
-                                        <a href="#" data-shelfnumber="[% s.shelfnumber %]" class="addtolist">[% s.shelfname |html %]</a>
+                                        <a href="#" data-shelfnumber="[% s.shelfnumber | html %]" class="addtolist">[% s.shelfname | html %]</a>
                                     </li>
                                     [% SET number_of_public_shelves = number_of_public_shelves + 1 %]
-                                    [% IF number_of_public_shelves == 10 %][% LAST %][% END %]
+                                    [% IF number_of_public_shelves == 10 %][% LAST | html %][% END %]
                                 [% END %]
                             [% END %]
                         [% END %]
                         </button>
                         <ul class="dropdown-menu">
                             <li><a href="#" class="placehold">Place hold</a></li>
-                            <li><a href="#" class="placeholdfor">Place hold for [% holdfor_firstname %] [% holdfor_surname %] ([% holdfor_cardnumber %])</a></li>
+                            <li><a href="#" class="placeholdfor">Place hold for [% holdfor_firstname | html %] [% holdfor_surname | html %] ([% holdfor_cardnumber | html %])</a></li>
                             <li class="divider"></li>
-                            <li><a href="#" id="forgetholdfor">Forget  [% holdfor_firstname %] [% holdfor_surname %] ([% holdfor_cardnumber %])</a></li>
+                            <li><a href="#" id="forgetholdfor">Forget  [% holdfor_firstname | html %] [% holdfor_surname | html %] ([% holdfor_cardnumber | html %])</a></li>
                         </ul>
                     </div>
                 [% ELSE %]
             [% IF ( searchdesc ) %]
                 [% BLOCK sort_search_query ~%]
                     [%~ FOREACH QUERY_INPUT IN QUERY_INPUTS ~%]
-                        &amp;[% QUERY_INPUT.input_name |html %]=[% QUERY_INPUT.input_value |html %]
+                        &amp;[% QUERY_INPUT.input_name | html %]=[% QUERY_INPUT.input_value | html %]
                     [%~ END ~%]
                     [%~ FOREACH LIMIT_INPUT IN LIMIT_INPUTS ~%]
-                        &amp;[% LIMIT_INPUT.input_name |html %]=[% LIMIT_INPUT.input_value |html %]
+                        &amp;[% LIMIT_INPUT.input_name | html %]=[% LIMIT_INPUT.input_value | html %]
                     [%~ END ~%]
                 [%~ END %]
             [% END %]
             <h3>No results found</h3>
         [% IF ( searchdesc ) %]
             <p>
-                No results match your search [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc |html %]'</span>[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s): <span style="font-weight: bold;">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName %] Catalog[% END %].
+                No results match your search [% IF ( query_desc ) %]for <span style="font-weight: bold;">'[% query_desc | html %]'</span>[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s): <span style="font-weight: bold;">'[% limit_desc | html %]'</span>[% END %][% IF ( LibraryName ) %] in [% LibraryName | html %] Catalog[% END %].
             </p>
         [% ELSE %]
             <p>You did not specify any search criteria.</p>
     [% END %]
 
     [% IF ( query_error ) %]
-        <div class="dialog alert"><p><strong>Error:</strong> [% query_error %]</p></div>
+        <div class="dialog alert"><p><strong>Error:</strong> [% query_error | html %]</p></div>
     [% END %]
 
     <!-- Search Results Table -->
                 [% FOREACH SEARCH_RESULT IN SEARCH_RESULTS %]
                     <tr>
                         <td>
-                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=[% scan_index_to_use %]&amp;q=[% SEARCH_RESULT.scan_use |url %]&quot;[% SEARCH_RESULT.title %]&quot;">[% SEARCH_RESULT.title |html %]</a>
+                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=[% scan_index_to_use | html %]&amp;q=[% SEARCH_RESULT.scan_use |url %]&quot;[% SEARCH_RESULT.title | html %]&quot;">[% SEARCH_RESULT.title | html %]</a>
                         </td>
                         <td>
-                            [% SEARCH_RESULT.author %]
+                            [% SEARCH_RESULT.author | html %]
                         </td>
                     </tr>
                 [% END %]
                 <form action="/cgi-bin/koha/catalogue/search.pl" method="get" name="bookbag_form" id="bookbag_form">
                 [% IF ( searchdesc ) %]
                 [% FOREACH QUERY_INPUT IN QUERY_INPUTS %]
-                <input type="hidden" name="[% QUERY_INPUT.input_name |html %]" value="[% QUERY_INPUT.input_value |html %]"/>
+                <input type="hidden" name="[% QUERY_INPUT.input_name | html %]" value="[% QUERY_INPUT.input_value | html %]"/>
                 [% END %]
                 [% FOREACH LIMIT_INPUT IN LIMIT_INPUTS %]
-                <input type="hidden" name="[% LIMIT_INPUT.input_name |html %]" value="[% LIMIT_INPUT.input_value |html %]"/>
+                <input type="hidden" name="[% LIMIT_INPUT.input_name | html %]" value="[% LIMIT_INPUT.input_value | html %]"/>
                 [% END %]
                 [% END %]
 
                             [% IF ( AmazonCoverImages || LocalCoverImages ) %]
                                 <td>
                                     [% IF ( LocalCoverImages) %]
-                                        <a class="p1" href="/cgi-bin/koha/catalogue/[% DetailPage %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
-                                        <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.biblionumber %]" id="local-thumbnail[% loop.count %]"></span>
+                                        <a class="p1" href="/cgi-bin/koha/catalogue/[% DetailPage | html %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
+                                        <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.biblionumber | html %]" id="local-thumbnail[% loop.count | html %]"></span>
                                         </a>
                                     [% END %]
                                     [% IF ( AmazonCoverImages ) %]
                                         [% IF ( SEARCH_RESULT.normalized_isbn ) %]
-                                            <a class="p1" href="/cgi-bin/koha/catalogue/[% DetailPage %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
-                                            <img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />
+                                            <a class="p1" href="/cgi-bin/koha/catalogue/[% DetailPage | html %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
+                                            <img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />
                                         [% ELSIF ( !LocalCoverImages ) %]
-                                            <a class="p1 no-amazon-cover" href="/cgi-bin/koha/catalogue/[% DetailPage %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
+                                            <a class="p1 no-amazon-cover" href="/cgi-bin/koha/catalogue/[% DetailPage | html %]?biblionumber=[% SEARCH_RESULT.biblionumber |url %]">
                                             <img src="https://images-na.ssl-images-amazon.com/images/G/01/x-site/icons/no-img-sm.gif" alt="" class="thumbnail" />
                                         [% END %]
                                         </a>
                                 </td>
                             [% END %]
                             <td>
-                                <input type="checkbox" class="selection" id="bib[% SEARCH_RESULT.biblionumber %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber %]" style="display:none" />
+                                <input type="checkbox" class="selection" id="bib[% SEARCH_RESULT.biblionumber | html %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber | html %]" style="display:none" />
                             </td>
                             <td>
 
                                 [% UNLESS ( item_level_itypes ) %]
                                     <div class="result-biblio-itemtype">
                                         [% IF !noItemTypeImages && SEARCH_RESULT.imageurl %]
-                                            <img src="[% SEARCH_RESULT.imageurl %]" alt="[% SEARCH_RESULT.description %]" />
+                                            <img src="[% SEARCH_RESULT.imageurl | html %]" alt="[% SEARCH_RESULT.description | html %]" />
                                         [% END %]
-                                        [% SEARCH_RESULT.description %]
+                                        [% SEARCH_RESULT.description | html %]
                                     </div>
                                 [% END %]
 
                            [% IF ( SEARCH_RESULT.XSLTResultsRecord ) %]
-                [% SEARCH_RESULT.result_number %].
-                               [% SEARCH_RESULT.XSLTResultsRecord %]
+                [% SEARCH_RESULT.result_number | html %].
+                [% SEARCH_RESULT.XSLTResultsRecord | $raw %]
                            [% ELSE %]
-                                <p>[% SEARCH_RESULT.result_number %].
-                                 [% biblionumber = SEARCH_RESULT.biblionumber %]
+                                <p>[% SEARCH_RESULT.result_number | html %].
+                                 [% biblionumber = SEARCH_RESULT.biblionumber | html %]
 
                                [% INCLUDE 'biblio-default-view.inc' %]
-                                            <b>[% IF ( SEARCH_RESULT.title ) %][% SEARCH_RESULT.title |html %][% ELSE %]No title[% END %]</b>
+                                            <b>[% IF ( SEARCH_RESULT.title ) %][% SEARCH_RESULT.title | html %][% ELSE %]No title[% END %]</b>
                                             </a>
-                                        [% FOREACH subtitl IN SEARCH_RESULT.subtitle %], [% subtitl.subfield %][% END %]
-                                        [% IF ( SEARCH_RESULT.seriestitle ) %][% SEARCH_RESULT.seriestitle %][% END %]
-                                        [% IF ( SEARCH_RESULT.volume ) %][% SEARCH_RESULT.volume %][% END %] [% IF ( SEARCH_RESULT.volumeddesc ) %], [% SEARCH_RESULT.volumeddesc %][% END %]
+                                        [% FOREACH subtitl IN SEARCH_RESULT.subtitle %], [% subtitl.subfield | html %][% END %]
+                                        [% IF ( SEARCH_RESULT.seriestitle ) %][% SEARCH_RESULT.seriestitle | html %][% END %]
+                                        [% IF ( SEARCH_RESULT.volume ) %][% SEARCH_RESULT.volume | html %][% END %] [% IF ( SEARCH_RESULT.volumeddesc ) %], [% SEARCH_RESULT.volumeddesc | html %][% END %]
                                 </p>
                                 [% IF ( SEARCH_RESULT.summary ) %]
                                         [% IF ( SEARCH_RESULT.author ) %]
-                                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=au&amp;q=[% SEARCH_RESULT.author |url %]" title="Search for this Author">[% SEARCH_RESULT.author %]</a>
+                                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=au&amp;q=[% SEARCH_RESULT.author |url %]" title="Search for this Author">[% SEARCH_RESULT.author | html %]</a>
                                         [% ELSE %]
                                             &nbsp;
                                         [% END %]
-                                    <p>[% SEARCH_RESULT.summary %]</p>
+                                    <p>[% SEARCH_RESULT.summary | html %]</p>
                                 [% ELSE %]
                                     <p>
                                         [% IF ( SEARCH_RESULT.author ) %]
-                                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=au&amp;q=[% SEARCH_RESULT.author |url %]" title="Search for this Author">[% SEARCH_RESULT.author %]</a>
+                                            <a href="/cgi-bin/koha/catalogue/search.pl?idx=au&amp;q=[% SEARCH_RESULT.author |url %]" title="Search for this Author">[% SEARCH_RESULT.author | html %]</a>
                                         [% ELSE %]
                                             &nbsp;
                                         [% END %]
                                         Description:
-                                        <span class="results_imprint">[% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place %] [% END %]
-                                        [% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode %][% END %] [% IF ( SEARCH_RESULT.publicationyear ) %] [% SEARCH_RESULT.publicationyear %] [% ELSIF ( SEARCH_RESULT.copyrightdate ) %] [% SEARCH_RESULT.copyrightdate %][% END %]</span>
-                                                                               [% IF ( SEARCH_RESULT.edition ) %]<span class="results_edition">Edition: [% SEARCH_RESULT.edition %]</span>[% END %]
-                                        <span class="results_physicaldesc">[% IF ( SEARCH_RESULT.pages ) %]: [% SEARCH_RESULT.pages %][% END %]
-                                        [% IF ( SEARCH_RESULT.size ) %] ; [% SEARCH_RESULT.size %][% END %]</span> [% IF ( SEARCH_RESULT.isbn ) %]<span class="results_isbn">ISBN: [% SEARCH_RESULT.isbn | replace('\s\|', ', ')%]</span>[% END %]
-                                        <span class="results_itemtype">[% SEARCH_RESULT.description %]</span>
-                                        [% IF ( SEARCH_RESULT.timestamp ) %] <i>(modified on [% SEARCH_RESULT.timestamp %])</i>[% END %]
-                                        [% IF ( SEARCH_RESULT.cn_class ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% SEARCH_RESULT.cn_class |uri %]%22">[% SEARCH_RESULT.cn_class %]</a>][% END %]
+                                        <span class="results_imprint">[% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place | html %] [% END %]
+                                        [% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode | html %][% END %] [% IF ( SEARCH_RESULT.publicationyear ) %] [% SEARCH_RESULT.publicationyear | html %] [% ELSIF ( SEARCH_RESULT.copyrightdate ) %] [% SEARCH_RESULT.copyrightdate | html %][% END %]</span>
+                                                                               [% IF ( SEARCH_RESULT.edition ) %]<span class="results_edition">Edition: [% SEARCH_RESULT.edition | html %]</span>[% END %]
+                                        <span class="results_physicaldesc">[% IF ( SEARCH_RESULT.pages ) %]: [% SEARCH_RESULT.pages | html %][% END %]
+                                        [% IF ( SEARCH_RESULT.size ) %] ; [% SEARCH_RESULT.size | html %][% END %]</span> [% IF ( SEARCH_RESULT.isbn ) %]<span class="results_isbn">ISBN: [% SEARCH_RESULT.isbn | replace('\s\|', ', ') | html %]</span>[% END %]
+                                        <span class="results_itemtype">[% SEARCH_RESULT.description | html %]</span>
+                                        [% IF ( SEARCH_RESULT.timestamp ) %] <i>(modified on [% SEARCH_RESULT.timestamp | html %])</i>[% END %]
+                                        [% IF ( SEARCH_RESULT.cn_class ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% SEARCH_RESULT.cn_class |uri %]%22">[% SEARCH_RESULT.cn_class | html %]</a>][% END %]
                                     </p>
-                                    [% IF ( SEARCH_RESULT.searchhighlightblob ) %]<p class="searchhighlightblob">[% SEARCH_RESULT.searchhighlightblob %]</p>[% END %]
+                                    [% IF ( SEARCH_RESULT.searchhighlightblob ) %]<p class="searchhighlightblob">[% SEARCH_RESULT.searchhighlightblob | html %]</p>[% END %]
 
                                 [% END %]
                                 [% END %]
                                 <span class="noholdstext">No holds allowed</span>
                             [% ELSE %]
                                 [% IF CAN_user_reserveforothers_place_holds %]
-                                    <a id="reserve_[% SEARCH_RESULT.biblionumber %]" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Holds ([% Biblio.HoldsCount( SEARCH_RESULT.biblionumber ) %])</a>
-                                    [% IF ( holdfor ) %] <span class="holdforlink">| <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]&amp;findborrower=[% holdfor_cardnumber %]">Place hold for [% holdfor_firstname %] [% holdfor_surname %] ([% holdfor_cardnumber %])</a></span>[% END %]
+                                    <a id="reserve_[% SEARCH_RESULT.biblionumber | html %]" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Holds ([% Biblio.HoldsCount( SEARCH_RESULT.biblionumber ) | html %])</a>
+                                    [% IF ( holdfor ) %] <span class="holdforlink">| <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]&amp;findborrower=[% holdfor_cardnumber | html %]">Place hold for [% holdfor_firstname | html %] [% holdfor_surname | html %] ([% holdfor_cardnumber | html %])</a></span>[% END %]
                                 [% ELSE %]
-                                    Holds ([% Biblio.HoldsCount( SEARCH_RESULT.biblionumber ) %])
+                                    Holds ([% Biblio.HoldsCount( SEARCH_RESULT.biblionumber ) | html %])
                                 [% END %]
                             [% END %]
 
                                 [% IF Koha.Preference('intranetbookbag') == 1 %]
                                     [% IF ( SEARCH_RESULT.incart ) %]
-                                        | <a class="addtocart" id="cart[% SEARCH_RESULT.biblionumber %]" href="#">In your cart</a> <a class="cartRemove" id="cartR[% SEARCH_RESULT.biblionumber %]" href="#">(remove)</a>
+                                        | <a class="addtocart" id="cart[% SEARCH_RESULT.biblionumber | html %]" href="#">In your cart</a> <a class="cartRemove" id="cartR[% SEARCH_RESULT.biblionumber | html %]" href="#">(remove)</a>
                                     [% ELSE %]
-                                        | <a class="addtocart" id="cart[% SEARCH_RESULT.biblionumber %]" href="#">Add to cart</a> <a style="display:none;" class="cartRemove" id="cartR[% SEARCH_RESULT.biblionumber %]" href="#">(remove)</a>
+                                        | <a class="addtocart" id="cart[% SEARCH_RESULT.biblionumber | html %]" href="#">Add to cart</a> <a style="display:none;" class="cartRemove" id="cartR[% SEARCH_RESULT.biblionumber | html %]" href="#">(remove)</a>
                                     [% END %]
                                 [% END # / IF intranetbookbag %]
 
                           [% IF Koha.Preference('ArticleRequests') %]
-                              | <a id="requst_article_[% SEARCH_RESULT.biblionumber %]" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Request article</a>
+                              | <a id="requst_article_[% SEARCH_RESULT.biblionumber | html %]" href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Request article</a>
                           [% END %]
 
                           [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
-                          | <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Edit record</a>
+                          | <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Edit record</a>
                           [% END %]
                           [% IF ( CAN_user_editcatalogue_edit_items ) %]
-                          | <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Edit items</a>
+                          | <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Edit items</a>
                           [% END %]
 
                           [% IF ( OPACBaseURL ) %]
                               <span class="view-in-opac">
-                                | <a href="[% Koha.Preference('OPACBaseURL') %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]" target="_blank">OPAC view</a>
+                                | <a href="[% Koha.Preference('OPACBaseURL') | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]" target="_blank">OPAC view</a>
                               </span>
                           [% END %]
 
                                                 <span class="blocker inaccurate-item-statuses" title="Item statuses may be inaccurate. Please view the record details for accurate item statuses">
                                             [% END %]
 
-                                            [% SEARCH_RESULT.items_count %] [% IF ( SEARCH_RESULT.itemsplural ) %]items[% ELSE %]item[% END %][% IF ( SEARCH_RESULT.availablecount ) %], [% SEARCH_RESULT.availablecount %] available:[% ELSE %], None available[% END %]
+                                            [% SEARCH_RESULT.items_count | html %] [% IF ( SEARCH_RESULT.itemsplural ) %]items[% ELSE %]item[% END %][% IF ( SEARCH_RESULT.availablecount ) %], [% SEARCH_RESULT.availablecount | html %] available:[% ELSE %], None available[% END %]
 
                                             [% IF MaxSearchResultsItemsPerRecordStatusCheck && SEARCH_RESULT.items_count > MaxSearchResultsItemsPerRecordStatusCheck %]
                                                 </span>
 
                                         [% IF item_level_itypes && !noItemTypeImages && available_items_loo.imageurl %]
                                         <li style="list-style: none; list-style-type: none;">
-                                          <img src="[% available_items_loo.imageurl %]" title="[% available_items_loo.description %]" alt="[% available_items_loo.description %]" />
+                                          <img src="[% available_items_loo.imageurl | html %]" title="[% available_items_loo.description | html %]" alt="[% available_items_loo.description | html %]" />
                                         [% ELSE %]
                                         <li>
                                         [% END %]
-                                        [% IF ( available_items_loo.branchname ) %][% available_items_loo.branchname %][% END %]
-                                        [% IF ( available_items_loo.location ) %][% available_items_loo.location %][% END %]
-                                        [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% available_items_loo.itemcallnumber |uri %]%22">[% available_items_loo.itemcallnumber %]</a>][% END %]
-                                        ([% available_items_loo.count %])
+                                        [% IF ( available_items_loo.branchname ) %][% available_items_loo.branchname | html %][% END %]
+                                        [% IF ( available_items_loo.location ) %][% available_items_loo.location | html %][% END %]
+                                        [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% available_items_loo.itemcallnumber |uri %]%22">[% available_items_loo.itemcallnumber | html %]</a>][% END %]
+                                        ([% available_items_loo.count | html %])
                                         [% IF item_level_itypes && available_items_loo.description %]
-                                        <br/>[% available_items_loo.description %]
+                                        <br/>[% available_items_loo.description | html %]
                                         [% END %]
                                         </li>
                                     [% END %]
                                     [% END %]
 
                                    [% IF ( SEARCH_RESULT.onloancount ) %]
-                                   <span class="status">[% SEARCH_RESULT.onloancount %] on loan:</span>
+                                   <span class="status">[% SEARCH_RESULT.onloancount | html %] on loan:</span>
                                     <ul>
                                     [% FOREACH onloan_items_loo IN SEARCH_RESULT.onloan_items_loop %]
                                         [% IF item_level_itypes && !noItemTypeImages && onloan_items_loo.imageurl %]
                                         <li style="list-style: none; list-style-type: none;">
-                                          <img src="[% onloan_items_loo.imageurl %]" title="[% onloan_items_loo.description %]" alt="[% onloan_items_loo.description %]" />
+                                          <img src="[% onloan_items_loo.imageurl | html %]" title="[% onloan_items_loo.description | html %]" alt="[% onloan_items_loo.description | html %]" />
                                         [% ELSE %]
                                         <li>
                                         [% END %]
-                                        [% IF ( onloan_items_loo.branchname ) %][% onloan_items_loo.branchname %][% END %]
-                                        [% IF ( onloan_items_loo.location ) %][% onloan_items_loo.location %][% END %]
-                                        [% IF ( onloan_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% onloan_items_loo.itemcallnumber |uri %]%22">[% onloan_items_loo.itemcallnumber %]</a>][% END %]
-                                        ([% onloan_items_loo.count %][% IF ( onloan_items_loo.longoverdue ) %], [% onloan_items_loo.longoverdue %] long overdue[% END %]) date due: [% onloan_items_loo.due_date | $KohaDates %]
+                                        [% IF ( onloan_items_loo.branchname ) %][% onloan_items_loo.branchname | html %][% END %]
+                                        [% IF ( onloan_items_loo.location ) %][% onloan_items_loo.location | html %][% END %]
+                                        [% IF ( onloan_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% onloan_items_loo.itemcallnumber |uri %]%22">[% onloan_items_loo.itemcallnumber | html %]</a>][% END %]
+                                        ([% onloan_items_loo.count | html %][% IF ( onloan_items_loo.longoverdue ) %], [% onloan_items_loo.longoverdue | html %] long overdue[% END %]) date due: [% onloan_items_loo.due_date | $KohaDates %]
                                         [% IF item_level_itypes && onloan_items_loo.description %]
-                                        <br/>[% onloan_items_loo.description %]
+                                        <br/>[% onloan_items_loo.description | html %]
                                         [% END %]
                                         </li>
                                     [% END %]
                                     [% END %]
 
                                     [% IF ( SEARCH_RESULT.othercount ) %]
-                                    <span class="unavailable">[% SEARCH_RESULT.othercount %] unavailable:</span>
+                                    <span class="unavailable">[% SEARCH_RESULT.othercount | html %] unavailable:</span>
                                     <ul>
                                     [% FOREACH other_items_loo IN SEARCH_RESULT.other_items_loop %]
                                         [% IF item_level_itypes && !noItemTypeImages && other_items_loo.imageurl %]
                                         <li style="list-style: none; list-style-type: none;">
-                                          <img src="[% other_items_loo.imageurl %]" title="[% other_items_loo.description %]" alt="[% other_items_loo.description %]" />
+                                          <img src="[% other_items_loo.imageurl | html %]" title="[% other_items_loo.description | html %]" alt="[% other_items_loo.description | html %]" />
                                         [% ELSE %]
                                         <li>
                                         [% END %]
-                                        [% IF ( other_items_loo.branchname ) %][% other_items_loo.branchname %][% END %]
-                                        [% IF ( other_items_loo.location ) %][% other_items_loo.location %][% END %]
-                                        [% IF ( other_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% other_items_loo.itemcallnumber |uri %]%22">[% other_items_loo.itemcallnumber %]</a>][% END %]
-                                        [% IF ( other_items_loo.withdrawn ) %]([% AuthorisedValues.GetByCode( 'WITHDRAWN', other_items_loo.withdrawn ) %])[% END %]
-                                        [% IF ( other_items_loo.itemlost ) %]([% AuthorisedValues.GetByCode( 'LOST', other_items_loo.itemlost ) %])[% END %]
-                                        [% IF ( other_items_loo.damaged ) %]([% AuthorisedValues.GetByCode( 'DAMAGED', other_items_loo.damaged ) %])[% END %]
+                                        [% IF ( other_items_loo.branchname ) %][% other_items_loo.branchname | html %][% END %]
+                                        [% IF ( other_items_loo.location ) %][% other_items_loo.location | html %][% END %]
+                                        [% IF ( other_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% other_items_loo.itemcallnumber |uri %]%22">[% other_items_loo.itemcallnumber | html %]</a>][% END %]
+                                        [% IF ( other_items_loo.withdrawn ) %]([% AuthorisedValues.GetByCode( 'WITHDRAWN', other_items_loo.withdrawn ) | html %])[% END %]
+                                        [% IF ( other_items_loo.itemlost ) %]([% AuthorisedValues.GetByCode( 'LOST', other_items_loo.itemlost ) | html %])[% END %]
+                                        [% IF ( other_items_loo.damaged ) %]([% AuthorisedValues.GetByCode( 'DAMAGED', other_items_loo.damaged ) | html %])[% END %]
                                         [% IF ( other_items_loo.intransit ) %](In transit)[% END %]
                                         [% IF ( other_items_loo.onhold ) %](On hold)[% END %]
-                                        [% IF ( other_items_loo.notforloan ) %][% other_items_loo.notforloan %][% END %]
-                                        ([% other_items_loo.count %])
+                                        [% IF ( other_items_loo.notforloan ) %][% other_items_loo.notforloan | html %][% END %]
+                                        ([% other_items_loo.count | html %])
                                         [% IF item_level_itypes && other_items_loo.description %]
-                                        <br/>[% other_items_loo.description %]
+                                        <br/>[% other_items_loo.description | html %]
                                         [% END %]
                                         </li>
                                     [% END %]
                                     <strong id="altholdings_heading">Other holdings:</strong>
                                     <ul>
                                     [% FOREACH ALTERNATEHOLDING IN SEARCH_RESULT.ALTERNATEHOLDINGS %]
-                                    <li id="alternateholdings">[% ALTERNATEHOLDING.holding %]</li>
+                                    <li id="alternateholdings">[% ALTERNATEHOLDING.holding | html %]</li>
                                     [% END %]
                                     </ul>
                                     [% ELSE %]
 [% FOREACH outer_sup_results_loo IN outer_sup_results_loop %]
 <!-- <div class="yui-b"> -->
     [% IF ( outer_sup_results_loo.inner_sup_results_loop ) %]
-        [% outer_sup_results_loo.servername %]
+        [% outer_sup_results_loo.servername | html %]
         [% FOREACH inner_sup_results_loo IN outer_sup_results_loo.inner_sup_results_loop %]
-        <div><a href="/cgi-bin/koha/catalogue/search.pl?[% inner_sup_results_loo.query_cgi %][% inner_sup_results_loo.limit_cgi |html %][% inner_sup_results_loo.sort_by %][% inner_sup_results_loo.link %]">[% inner_sup_results_loo.title |html %]</a></div>
+        <div><a href="/cgi-bin/koha/catalogue/search.pl?[% inner_sup_results_loo.query_cgi | html %][% inner_sup_results_loo.limit_cgi | html %][% inner_sup_results_loo.sort_by | html %][% inner_sup_results_loo.link | html %]">[% inner_sup_results_loo.title | html %]</a></div>
         [% END %]
     [% END %]
 <!-- </div> -->
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'browser-strings.inc' %]
-    [% Asset.js("js/browser.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/browser.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         var MSG_NO_ITEM_SELECTED = _("Nothing is selected.");
         var MSG_NON_RESERVES_SELECTED = _("One or more selected items cannot be placed on hold.");
             [% IF (SEARCH_RESULTS) %]
                 var newresults = [
                     [%- FOREACH result IN SEARCH_RESULTS -%]
-                        [%- result.biblionumber %],
+                        [%- result.biblionumber | html %],
                     [%- END -%]
                 ];
-                var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
-                browser.create([% SEARCH_RESULTS.first.result_number %], '[% query_cgi %]', '[% limit_cgi | uri %]','[% sort_cgi | uri %]',
-                       newresults, '[% total %]');
+                var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
+                browser.create([% SEARCH_RESULTS.first.result_number | html %], '[% query_cgi | html %]', '[% limit_cgi | uri %]','[% sort_cgi | uri %]',
+                       newresults, '[% total | html %]');
             [% END %]
 
             [% IF (gotoPage && gotoNumber) %]
                 [% IF (gotoNumber == 'first') %]
-                    window.location = '/cgi-bin/koha/catalogue/[% gotoPage %]?biblionumber=' + [% SEARCH_RESULTS.first.biblionumber %] + '&searchid=[% searchid %]';
+                    window.location = '/cgi-bin/koha/catalogue/[% gotoPage | html %]?biblionumber=' + [% SEARCH_RESULTS.first.biblionumber | html %] + '&searchid=[% searchid | html %]';
                 [% ELSIF (gotoNumber == 'last') %]
-                    window.location = '/cgi-bin/koha/catalogue/[% gotoPage %]?biblionumber=' + [% SEARCH_RESULTS.last.biblionumber %] + '&searchid=[% searchid %]';
+                    window.location = '/cgi-bin/koha/catalogue/[% gotoPage | html %]?biblionumber=' + [% SEARCH_RESULTS.last.biblionumber | html %] + '&searchid=[% searchid | html %]';
                 [% END %]
             [% END %]
 
                 var x;
                 for (x in q_array) {
                     q_array[x] = q_array[x].toLowerCase();
-                    var myStopwords = "[% Koha.Preference('NotHighlightedWords') %]".toLowerCase().split('|');
+                    var myStopwords = "[% Koha.Preference('NotHighlightedWords') | html %]".toLowerCase().split('|');
                     if ( (q_array[x].length > 0) && ($.inArray(q_array[x], myStopwords) == -1) ) {
                         toHighlight.highlight(q_array[x]);
                     }
         function browse_selection () {
             var bibnums = getContextBiblioNumbers();
             if ( bibnums && bibnums.length > 0 ) {
-                var browser = KOHA.browser('', parseInt('[% biblionumber %]', 10));
-                browser.create(1, '[% query_cgi %]', '[% limit_cgi | uri %]','[% sort_cgi | uri %]', bibnums, bibnums.length);
+                var browser = KOHA.browser('', parseInt('[% biblionumber | html %]', 10));
+                browser.create(1, '[% query_cgi | html %]', '[% limit_cgi | uri %]','[% sort_cgi | uri %]', bibnums, bibnums.length);
                 window.location = '/cgi-bin/koha/catalogue/detail.pl?biblionumber=' + bibnums[0] + '&searchid='+browser.searchid;
             } else {
                 alert(MSG_NO_ITEM_SELECTED);
         function PopupZ3950() {
             var strQuery = GetZ3950Terms();
             if(strQuery){
-                window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
+                window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber | html %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
             }
         }
         /* provide Z3950 search points */
         }
 
         function holdForPatron() {
-            $("#holdFor").val("[% holdfor_cardnumber %]");
+            $("#holdFor").val("[% holdfor_cardnumber | html %]");
             placeHold();
         }
     </script>
index ba8b175..f82f1a3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -5,7 +6,7 @@
 [% USE KohaDates %]
 <title>Koha &rsaquo; Catalog &rsaquo; Search history</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="catalogue_search-history" class="catalogue">
                 <tbody>
                 [% FOREACH s IN current_biblio_searches %]
                   <tr>
-                    <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                    <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                    <td><a href="/cgi-bin/koha/catalogue/search.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                    <td>[% s.total %]</td>
+                    <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                    <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                    <td><a href="/cgi-bin/koha/catalogue/search.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                    <td>[% s.total | html %]</td>
                   </tr>
                 [% END %]
                 </tbody>
                 <tbody>
                 [% FOREACH s IN previous_biblio_searches %]
                   <tr>
-                    <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                    <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                    <td><a href="/cgi-bin/koha/catalogue/search.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                    <td>[% s.total %]</td>
+                    <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                    <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                    <td><a href="/cgi-bin/koha/catalogue/search.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                    <td>[% s.total | html %]</td>
                   </tr>
                 [% END %]
                 </tbody>
                 <tbody>
                 [% FOREACH s IN current_authority_searches %]
                   <tr>
-                    <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                    <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                    <td><a href="/cgi-bin/koha/authorities/authorities-home.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                    <td>[% s.total %]</td>
+                    <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                    <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                    <td><a href="/cgi-bin/koha/authorities/authorities-home.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                    <td>[% s.total | html %]</td>
                   </tr>
                 [% END %]
                 </tbody>
                 <tbody>
                 [% FOREACH s IN previous_authority_searches %]
                   <tr>
-                    <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                    <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                    <td><a href="/cgi-bin/koha/authorities/authorities-home.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                    <td>[% s.total %]</td>
+                    <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                    <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                    <td><a href="/cgi-bin/koha/authorities/authorities-home.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                    <td>[% s.total | html %]</td>
                   </tr>
                 [% END %]
                 </tbody>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
     //<![CDATA[
     $(document).ready(function() {
index 609c392..acf6e92 100644 (file)
@@ -4,7 +4,7 @@
 </head>
 <body id="catalog_showmarc" class="catalog">
 <div id="main" style="direction: ltr;">
-<pre>[% MARC_FORMATTED %] </pre>
+<pre>[% MARC_FORMATTED | html %] </pre>
 </div>
 </body>
 </html>
index f8bf448..7eb4402 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Cataloging &rsaquo; [% IF ( biblionumber ) %]Editing [% title |html %] (Record number [% biblionumber %])[% ELSE %]Add MARC record[% END %]</title>
+<title>Koha &rsaquo; Cataloging &rsaquo; [% IF ( biblionumber ) %]Editing [% title | html %] (Record number [% biblionumber | html %])[% ELSE %]Add MARC record[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-[% Asset.js("js/cataloging.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+[% Asset.js("js/cataloging.js") | $raw %]
 [% INCLUDE 'browser-strings.inc' %]
-[% Asset.js("js/browser.js") %]
+[% Asset.js("js/browser.js") | $raw %]
 <script type="text/javascript">
 //<![CDATA[
-    var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+    var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
     browser.show();
 
     $(window).load(function(){
                });
 
         [% IF tab %]
-          $('#addbibliotabs').selectTabByID("#[% tab %]");
+          $('#addbibliotabs').selectTabByID("#[% tab | html %]");
         [% END %]
 
         $('#toolbar').fixFloat();
 
         /* check cookie to hide/show marcdocs*/
-        if($.cookie("marcdocs_[% borrowernumber %]") == 'hide'){
+        if($.cookie("marcdocs_[% borrowernumber | html %]") == 'hide'){
             toggleMARCdocLinks(false);
         } else {
             toggleMARCdocLinks(true);
         }
 
         $("#marcDocsSelect").click(function(){
-            if($.cookie("marcdocs_[% borrowernumber %]") == 'hide'){
+            if($.cookie("marcdocs_[% borrowernumber | html %]") == 'hide'){
                 toggleMARCdocLinks(true);
             } else {
                 toggleMARCdocLinks(false);
@@ -48,7 +49,7 @@
         });
 
         /* check cookie to hide/show marc tags*/
-        var marctags_cookie = $.cookie("marctags_[% borrowernumber %]");
+        var marctags_cookie = $.cookie("marctags_[% borrowernumber | html %]");
         if( marctags_cookie == 'hide'){
             toggleMARCTagLinks(false);
         } else if( marctags_cookie == 'show'){
@@ -62,7 +63,7 @@
         }
 
         $("#marcTagsSelect").click(function(){
-            if( $.cookie("marctags_[% borrowernumber %]") == 'hide'){
+            if( $.cookie("marctags_[% borrowernumber | html %]") == 'hide'){
                 toggleMARCTagLinks(true)
             } else {
                 toggleMARCTagLinks(false);
         });
 
         $( '#switcheditor' ).click( function() {
-            var breedingid = [% breedingid || "null" %];
+            var breedingid = [% breedingid || "null" | html %];
 
             if ( !confirm( breedingid ? _("This record cannot be transferred to the advanced editor. Continue?") : _("Any changes will not be saved. Continue?") ) ) return false;
 
-            $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber %]', 'advanced', { expires: 365, path: '/' } );
+            $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/' } );
 
-            var biblionumber = [% biblionumber || "null" %];
+            var biblionumber = [% biblionumber || "null" | html %];
 
             if ( biblionumber ) {
                 window.location = '/cgi-bin/koha/cataloguing/editor.pl#catalog/' + biblionumber;
@@ -158,16 +159,16 @@ function Dopop(link,i) {
 function PopupZ3950() {
     var strQuery = GetZ3950Terms();
        if(strQuery){
-        window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
+        window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber | html %]"+strQuery,"z3950search",'width=740,height=450,location=yes,toolbar=no,scrollbars=yes,resize=yes');
     } 
 }
 
 function PopupMARCFieldDoc(field) {
     [% IF Koha.Preference('marcfielddocurl') %]
-        var docurl = "[% Koha.Preference('marcfielddocurl').replace('"','&quot;') %]";
-        docurl = docurl.replace("{MARC}", "[% marcflavour %]");
+        var docurl = "[% Koha.Preference('marcfielddocurl').replace('"','&quot;') | html %]";
+        docurl = docurl.replace("{MARC}", "[% marcflavour | html %]");
         docurl = docurl.replace("{FIELD}", ""+field);
-        docurl = docurl.replace("{LANG}", "[% lang %]");
+        docurl = docurl.replace("{LANG}", "[% lang | html %]");
         window.open(docurl);
     [% ELSIF ( marcflavour == 'MARC21' ) %]
         _MARC21FieldDoc(field);
@@ -213,11 +214,11 @@ function _UNIMARCFieldDoc(field) {
 function toggleMARCdocLinks(flag){
     if( flag === true ){
         $(".marcdocs").show();
-        $.cookie("marcdocs_[% borrowernumber %]",'show', { path: "/", expires: 365 });
+        $.cookie("marcdocs_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
         $("#marcDocsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
     } else {
         $(".marcdocs").hide();
-        $.cookie("marcdocs_[% borrowernumber %]",'hide', { path: "/", expires: 365 });
+        $.cookie("marcdocs_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
         $("#marcDocsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
     }
 }
@@ -226,12 +227,12 @@ function toggleMARCTagLinks(flag){
     if( flag === true ){
         $(".tagnum").show();
         $(".subfieldcode").show();
-        $.cookie("marctags_[% borrowernumber %]",'show', { path: "/", expires: 365 });
+        $.cookie("marctags_[% borrowernumber | html %]",'show', { path: "/", expires: 365 });
         $("#marcTagsSelect i").addClass('fa-check-square-o').removeClass('fa-square-o');
     } else {
         $(".tagnum").hide();
         $(".subfieldcode").hide();
-        $.cookie("marctags_[% borrowernumber %]",'hide', { path: "/", expires: 365 });
+        $.cookie("marctags_[% borrowernumber | html %]",'hide', { path: "/", expires: 365 });
         $("#marcTagsSelect i").removeClass('fa-check-square-o').addClass('fa-square-o');
     }
 }
@@ -249,12 +250,12 @@ function AreMandatoriesNotOk(){
     [% FOREACH BIG_LOO IN BIG_LOOP %]
        [% FOREACH innerloo IN BIG_LOO.innerloop %]
                [% IF ( innerloo.mandatory ) %]
-               mandatoriesfields.push(new Array("[% innerloo.tag %]","[% innerloo.index %][% innerloo.random %]","[% innerloo.index %]"));
+               mandatoriesfields.push(new Array("[% innerloo.tag | html %]","[% innerloo.index | html %][% innerloo.random | html %]","[% innerloo.index | html %]"));
                [% END %]
                [% FOREACH subfield_loo IN innerloo.subfield_loop %]
-                       [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id %]");
-                       tab.push("[% BIG_LOO.number %]");
-                       label.push("[% subfield_loo.marc_lib %]");
+                       [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
+                       tab.push("[% BIG_LOO.number | html %]");
+                    label.push("[% subfield_loo.marc_lib | $raw %]");
                 [% END %]
             [% END %]
         [% END %]
@@ -368,8 +369,8 @@ function GetZ3950Terms(){
     var strQuery = "&frameworkcode=" + frameworkcode;
     var mandatories = new Array();
     var mandatories_label = new Array();
-    [% FOREACH BIG_LOO IN BIG_LOOP %][% FOREACH innerloo IN BIG_LOO.innerloop %][% FOREACH subfield_loo IN innerloo.subfield_loop %][% IF ( subfield_loo.z3950_mandatory ) %]mandatories.push("[% subfield_loo.id %]");
-        mandatories_label.push("[% subfield_loo.z3950_mandatory %]");[% END %][% END %][% END %][% END %]
+    [% FOREACH BIG_LOO IN BIG_LOOP %][% FOREACH innerloo IN BIG_LOO.innerloop %][% FOREACH subfield_loo IN innerloo.subfield_loop %][% IF ( subfield_loo.z3950_mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
+        mandatories_label.push("[% subfield_loo.z3950_mandatory | html %]");[% END %][% END %][% END %][% END %]
     
     for(var i=0,len=mandatories.length; i<len ; i++){
         var field_value = document.getElementById(mandatories[i]).value;
@@ -382,15 +383,15 @@ function GetZ3950Terms(){
 
 function Changefwk() {
     var f = document.f;
-    f.op.value = "[% op %]";
-    f.biblionumber.value = "[% biblionumberdata %]";
+    f.op.value = "[% op | html %]";
+    f.biblionumber.value = "[% biblionumberdata | html %]";
     f.changed_framework.value = "changed";
     f.submit();
 }
 
 //]]>
 </script>
-[% Asset.css("css/addbiblio.css") %]
+[% Asset.css("css/addbiblio.css") | $raw %]
 
 [% INCLUDE 'select2.inc' %]
 <script>
@@ -400,7 +401,7 @@ function Changefwk() {
 </script>
 
 [% IF ( bidi ) %]
-   [% Asset.css("css/right-to-left.css") %]
+   [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
 </head>
 <body id="cat_addbiblio" class="cat">
@@ -411,7 +412,7 @@ function Changefwk() {
 
 [% INCLUDE 'header.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; [% IF ( biblionumber ) %]Editing <em>[% title |html %]</em> (Record number [% biblionumber %])[% ELSE %]Add MARC record[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; [% IF ( biblionumber ) %]Editing <em>[% title | html %]</em> (Record number [% biblionumber | html %])[% ELSE %]Add MARC record[% END %]</div>
 
 <div id="doc" class="yui-t7">
 
@@ -420,7 +421,7 @@ function Changefwk() {
         <div class="yui-g">
 
 <h1>
-[% IF ( biblionumber ) %]Editing <em>[% title |html %]</em> (Record number [% biblionumber %])
+[% IF ( biblionumber ) %]Editing <em>[% title | html %]</em> (Record number [% biblionumber | html %])
 [% ELSE %]Add MARC record [% IF (circborrowernumber) %]<em>(fast cataloging)</em>[% END %]
 [% END %]
 </h1>
@@ -430,12 +431,12 @@ function Changefwk() {
         [% IF ( duplicatebiblionumber ) %]
                     <div class="dialog alert">
                         <h3>Duplicate record suspected</h3>
-                        <p>Is this a duplicate of <a class="popup" href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% duplicatebiblionumber %]" onclick="openWindow('/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% duplicatebiblionumber %]&amp;popup=1', 'DuplicateBiblio','800','600'); return false;">[% duplicatetitle %]</a> ?</p>
+                        <p>Is this a duplicate of <a class="popup" href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% duplicatebiblionumber | html %]" onclick="openWindow('/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% duplicatebiblionumber | html %]&amp;popup=1', 'DuplicateBiblio','800','600'); return false;">[% duplicatetitle | html %]</a> ?</p>
                         [% IF ( CAN_user_editcatalogue_edit_items ) %]<form action="/cgi-bin/koha/cataloguing/additem.pl" method="get">
-                                                    <input type="hidden" name="biblionumber" value="[% duplicatebiblionumber %]" />
+                                                    <input type="hidden" name="biblionumber" value="[% duplicatebiblionumber | html %]" />
                                                     <button type="submit" class="new"><i class="fa fa-fw fa-pencil"></i> Yes, edit existing items</button>
                                                 </form>[% ELSE %]<form action="/cgi-bin/koha/catalogue/detail.pl" method="get">
-                                                    <input type="hidden" name="biblionumber" value="[% duplicatebiblionumber %]" />
+                                                    <input type="hidden" name="biblionumber" value="[% duplicatebiblionumber | html %]" />
                                                     <input type="submit" value="Yes: View existing items" />
                                                 </form>[% END %]
                         <form action="/cgi-bin/koha/cataloguing/addbiblio.pl" method="get">
@@ -447,8 +448,8 @@ function Changefwk() {
 
 [% IF ( done ) %]
     <script type="text/javascript">
-        opener.document.forms['f'].biblionumber.value=[% biblionumber %];
-        opener.document.forms['f'].title.value='[% title |html %]';
+        opener.document.forms['f'].biblionumber.value=[% biblionumber | html %];
+        opener.document.forms['f'].title.value='[% title | html %]';
         window.close();
     </script>
 [% ELSE %]
@@ -513,13 +514,13 @@ function Changefwk() {
             </li>
             [% FOREACH framework IN frameworks%]
                 <li>
-                    <a href="#" class="change-framework" data-frameworkcode="[% framework.frameworkcode %]">
+                    <a href="#" class="change-framework" data-frameworkcode="[% framework.frameworkcode | html %]">
                         [% IF framework.frameworkcode == frameworkcode %]
                             <i class="fa fa-fw fa-check"></i>
                         [% ELSE %]
                             <i class="fa fa-fw">&nbsp;</i>
                         [% END %]
-                        [% framework.frameworktext %]
+                        [% framework.frameworktext | html %]
                     </a>
                 </li>
             [% END %]
@@ -561,76 +562,76 @@ function Changefwk() {
         <input type="hidden" name="mode" value="popup" />
 [% END %]
         <input type="hidden" name="op" value="addbiblio" />
-        <input type="hidden" id="frameworkcode" name="frameworkcode" value="[% frameworkcode %]" />
-        <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
-        <input type="hidden" name="breedingid" value="[% breedingid %]" />
+        <input type="hidden" id="frameworkcode" name="frameworkcode" value="[% frameworkcode | html %]" />
+        <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+        <input type="hidden" name="breedingid" value="[% breedingid | html %]" />
         <input type="hidden" name="changed_framework" value="" />
 
 <div id="addbibliotabs" class="toptabs numbered">
     <ul>
         [% FOREACH BIG_LOO IN BIG_LOOP %]
-        <li><a href="#tab[% BIG_LOO.number %]XX">[% BIG_LOO.number %]</a></li>
+        <li><a href="#tab[% BIG_LOO.number | html %]XX">[% BIG_LOO.number | html %]</a></li>
         [% END %]
     </ul>
 
 [% FOREACH BIG_LOO IN BIG_LOOP %]
-    <div id="tab[% BIG_LOO.number %]XX">
+    <div id="tab[% BIG_LOO.number | html %]XX">
     
     [% FOREACH innerloo IN BIG_LOO.innerloop %]
     [% IF ( innerloo.tag ) %]
-    <div class="tag" id="tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]">
-        <div class="tag_title" id="div_indicator_tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]">
+    <div class="tag" id="tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
+        <div class="tag_title" id="div_indicator_tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]">
             [% IF advancedMARCEditor %]
-                <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib %] - Click to Expand this Tag" onclick="ExpandField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;">[% innerloo.tag %]</a>
+                <a href="#" tabindex="1" class="tagnum" title="[% innerloo.tag_lib | html %] - Click to Expand this Tag" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;">[% innerloo.tag | html %]</a>
             [% ELSE %]
-                <span class="tagnum" title="[% innerloo.tag_lib %]">[% innerloo.tag %]</span>
-                [% IF marcflavour != 'NORMARC' %]<a href="#" class="marcdocs" onclick="PopupMARCFieldDoc('[% innerloo.tag %]'); return false;">&nbsp;?</a>[% END %]
+                <span class="tagnum" title="[% innerloo.tag_lib | html %]">[% innerloo.tag | html %]</span>
+                [% IF marcflavour != 'NORMARC' %]<a href="#" class="marcdocs" onclick="PopupMARCFieldDoc('[% innerloo.tag | html %]'); return false;">&nbsp;?</a>[% END %]
             [% END %]
                 [% IF ( innerloo.fixedfield ) %]
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
                         style="display:none;"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator1 %]" />
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
                         style="display:none;"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator2 %]" />
+                        value="[% innerloo.indicator2 | html %]" />
                 [% ELSE %]
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
-                        name="tag_[% innerloo.tag %]_indicator1_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator1_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator1 %]" />
+                        value="[% innerloo.indicator1 | html %]" />
                     <input type="text"
                         tabindex="1"
                         class="indicator flat"
-                        name="tag_[% innerloo.tag %]_indicator2_[% innerloo.index %][% innerloo.random %]"
+                        name="tag_[% innerloo.tag | html %]_indicator2_[% innerloo.index | html %][% innerloo.random | html %]"
                         size="1"
                         maxlength="1"
-                        value="[% innerloo.indicator2 %]" />
+                        value="[% innerloo.indicator2 | html %]" />
                 [% END %] -
 
             [% UNLESS advancedMARCEditor %]
-                <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;" title="Click to Expand this Tag">[% innerloo.tag_lib %]</a>
+                <a href="#" tabindex="1" class="expandfield" onclick="ExpandField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Click to Expand this Tag">[% innerloo.tag_lib | html %]</a>
             [% END %]
                 <span class="field_controls">
                 [% IF ( innerloo.repeatable ) %]
-                    <a href="#" tabindex="1" class="buttonPlus" onclick="CloneField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]','0','[% advancedMARCEditor %]'); return false;" title="Repeat this Tag">
-                        <img src="[% interface %]/[% theme %]/img/repeat-tag.png" alt="Repeat this Tag" />
+                    <a href="#" tabindex="1" class="buttonPlus" onclick="CloneField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]','0','[% advancedMARCEditor | html %]'); return false;" title="Repeat this Tag">
+                        <img src="[% interface | html %]/[% theme | html %]/img/repeat-tag.png" alt="Repeat this Tag" />
                     </a>
                 [% END %]
-                    <a href="#" tabindex="1" class="buttonMinus" onclick="UnCloneField('tag_[% innerloo.tag %]_[% innerloo.index %][% innerloo.random %]'); return false;" title="Delete this Tag">
-                        <img src="[% interface %]/[% theme %]/img/delete-tag.png" alt="Delete this Tag" />
+                    <a href="#" tabindex="1" class="buttonMinus" onclick="UnCloneField('tag_[% innerloo.tag | html %]_[% innerloo.index | html %][% innerloo.random | html %]'); return false;" title="Delete this Tag">
+                        <img src="[% interface | html %]/[% theme | html %]/img/delete-tag.png" alt="Delete this Tag" />
                     </a>
                 </span>
 
@@ -638,25 +639,25 @@ function Changefwk() {
 
         [% FOREACH subfield_loo IN innerloo.subfield_loop %]
             <!--  One line on the marc editor -->
-            <div class="subfield_line" style="[% subfield_loo.visibility %]" id="subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]">
+            <div class="subfield_line" style="[% subfield_loo.visibility | html %]" id="subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]">
 
                 [% UNLESS advancedMARCEditor %]
-                    [% IF ( subfield_loo.fixedfield ) %]<label for="tag_[% subfield_loo.tag %]_subfield_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]" style="display:none;" class="labelsubfield">
-                    [% ELSE %]<label for="tag_[% subfield_loo.tag %]_subfield_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]" class="labelsubfield">
+                    [% IF ( subfield_loo.fixedfield ) %]<label for="tag_[% subfield_loo.tag | html %]_subfield_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]" style="display:none;" class="labelsubfield">
+                    [% ELSE %]<label for="tag_[% subfield_loo.tag | html %]_subfield_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]" class="labelsubfield">
                     [% END %]
                 [% END %]
 
                 <span class="subfieldcode">
                     [% IF ( subfield_loo.fixedfield ) %]
-                        <img class="buttonUp" style="display:none;" src="[% interface %]/[% theme %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]')" alt="Move Up" title="Move Up" />
+                        <img class="buttonUp" style="display:none;" src="[% interface | html %]/[% theme | html %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]')" alt="Move Up" title="Move Up" />
                     [% ELSE %]
-                        <img class="buttonUp" src="[% interface %]/[% theme %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]')" alt="Move Up" title="Move Up" />
+                        <img class="buttonUp" src="[% interface | html %]/[% theme | html %]/img/up.png" onclick="upSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]')" alt="Move Up" title="Move Up" />
                     [% END %]
                         <input type="text"
-                            title="[% subfield_loo.marc_lib %]"
+                            title="[% subfield_loo.marc_lib | $raw %]"
                             style=" [% IF ( subfield_loo.fixedfield ) %]display:none; [% END %]border:0;"
-                            name="tag_[% subfield_loo.tag %]_code_[% subfield_loo.subfield %]_[% subfield_loo.index %]_[% subfield_loo.index_subfield %]"
-                            value="[% subfield_loo.subfield %]"
+                            name="tag_[% subfield_loo.tag | html %]_code_[% subfield_loo.subfield | html %]_[% subfield_loo.index | html %]_[% subfield_loo.index_subfield | html %]"
+                            value="[% subfield_loo.subfield | html %]"
                             size="1"
                             maxlength="1"
                             class="flat"
@@ -665,7 +666,7 @@ function Changefwk() {
 
                 [% UNLESS advancedMARCEditor %]
                     [% IF ( subfield_loo.mandatory ) %]<span class="subfield subfield_mandatory">[% ELSE %]<span class="subfield">[% END %]
-                        [% subfield_loo.marc_lib %]
+                        [% subfield_loo.marc_lib | $raw %]
                         [% IF ( subfield_loo.mandatory ) %]<span class="mandatory_marker" title="This field is mandatory">*</span>[% END %]
                     </span>
                     </label>
@@ -674,34 +675,34 @@ function Changefwk() {
                 [% SET mv = subfield_loo.marc_value %]
                 [% IF ( mv.type == 'text' ) %]
                     [% IF ( mv.readonly == 1 ) %]
-                    <input type="text" id="[%- mv.id -%]" name="[%- mv.name -%]" value="[%- mv.value -%]" class="input_marceditor readonly" tabindex="1" size="[%- mv.size -%]" maxlength="[%- mv.maxlength -%]" readonly="readonly" />
+                    <input type="text" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" value="[%- mv.value | html -%]" class="input_marceditor readonly" tabindex="1" size="[%- mv.size | html -%]" maxlength="[%- mv.maxlength | html -%]" readonly="readonly" />
                     [% ELSE %]
-                    <input type="text" id="[%- mv.id -%]" name="[%- mv.name -%]" value="[%- mv.value -%]" class="input_marceditor" tabindex="1" size="[%- mv.size -%]" maxlength="[%- mv.maxlength -%]" />
+                    <input type="text" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" value="[%- mv.value | html -%]" class="input_marceditor" tabindex="1" size="[%- mv.size | html -%]" maxlength="[%- mv.maxlength | html -%]" />
                     [% END %]
                     [% IF ( mv.authtype ) %]
-                    <span class="subfield_controls"><a href="#" class="buttonDot tag_editor" onclick="openAuth(this.parentNode.parentNode.getElementsByTagName('input')[1].id,'[%- mv.authtype -%]','biblio'); return false;" tabindex="1" title="Tag editor">Tag editor</a></span>
+                    <span class="subfield_controls"><a href="#" class="buttonDot tag_editor" onclick="openAuth(this.parentNode.parentNode.getElementsByTagName('input')[1].id,'[%- mv.authtype | html -%]','biblio'); return false;" tabindex="1" title="Tag editor">Tag editor</a></span>
                     [% END %]
                 [% ELSIF ( mv.type == 'text_complex' ) %]
-                    <input type="text" id="[%- mv.id -%]" name="[%- mv.name -%]" value="[%- mv.value -%]" class="input_marceditor framework_plugin" tabindex="1" size="[%- mv.size -%]" maxlength="[%- mv.maxlength -%]" />
+                    <input type="text" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" value="[%- mv.value | html -%]" class="input_marceditor framework_plugin" tabindex="1" size="[%- mv.size | html -%]" maxlength="[%- mv.maxlength | html -%]" />
                     <span class="subfield_controls">
                         [% IF mv.noclick %]
                             <a href="#" class="buttonDot tag_editor disabled" tabindex="-1" title="No popup"></a>
                         [% ELSE %]
-                            <a href="#" id="buttonDot_[% mv.id %]" class="buttonDot tag_editor framework_plugin" tabindex="1" title="Tag editor">Tag editor</a>
+                            <a href="#" id="buttonDot_[% mv.id | html %]" class="buttonDot tag_editor framework_plugin" tabindex="1" title="Tag editor">Tag editor</a>
                         [% END %]
                     </span>
-                    [% mv.javascript %]
+                    [% mv.javascript | $raw %]
                 [% ELSIF ( mv.type == 'hidden' ) %]
-                    <input tabindex="1" type="hidden" id="[%- mv.id -%]" name="[%- mv.name -%]" size="[%- mv.size -%]" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" />
+                    <input tabindex="1" type="hidden" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" size="[%- mv.size | html -%]" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" />
                 [% ELSIF ( mv.type == 'textarea' ) %]
-                    <textarea cols="70" rows="4" id="[%- mv.id -%]" name="[%- mv.name -%]" class="input_marceditor" tabindex="1">[%- mv.value -%]</textarea>
+                    <textarea cols="70" rows="4" id="[%- mv.id | html -%]" name="[%- mv.name | html -%]" class="input_marceditor" tabindex="1">[%- mv.value | html -%]</textarea>
                 [% ELSIF ( mv.type == 'select' ) %]
-                    <select name="[%- mv.name -%]" tabindex="1" size="1" class="input_marceditor" id="[%- mv.id -%]">
+                    <select name="[%- mv.name | html -%]" tabindex="1" size="1" class="input_marceditor" id="[%- mv.id | html -%]">
                     [% FOREACH aval IN mv.values %]
                         [% IF aval == mv.default %]
-                        <option value="[%- aval -%]" selected="selected">[%- mv.labels.$aval -%]</option>
+                        <option value="[%- aval | html -%]" selected="selected">[%- mv.labels.$aval | html -%]</option>
                         [% ELSE %]
-                        <option value="[%- aval -%]">[%- mv.labels.$aval -%]</option>
+                        <option value="[%- aval | html -%]">[%- mv.labels.$aval | html -%]</option>
                         [% END %]
                     [% END %]
                     </select>
@@ -709,11 +710,11 @@ function Changefwk() {
                 
                 <span class="subfield_controls">
                 [% IF ( subfield_loo.repeatable ) %]
-                    <a href="#" class="buttonPlus" tabindex="1" onclick="CloneSubfield('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]','[% advancedMARCEditor %]'); return false;">
-                        <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                    <a href="#" class="buttonPlus" tabindex="1" onclick="CloneSubfield('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]','[% advancedMARCEditor | html %]'); return false;">
+                        <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                     </a>
-                    <a href="#" class="buttonMinus" tabindex="1" onclick="UnCloneField('subfield[% subfield_loo.tag %][% subfield_loo.subfield %][% subfield_loo.random %]'); return false;">
-                        <img src="[% interface %]/[% theme %]/img/delete-subfield.png" alt="Delete" title="Delete this subfield" />
+                    <a href="#" class="buttonMinus" tabindex="1" onclick="UnCloneField('subfield[% subfield_loo.tag | html %][% subfield_loo.subfield | html %][% subfield_loo.random | html %]'); return false;">
+                        <img src="[% interface | html %]/[% theme | html %]/img/delete-subfield.png" alt="Delete" title="Delete this subfield" />
                     </a>
                 [% END %]
                 </span>
@@ -731,11 +732,11 @@ function Changefwk() {
 </div><!-- tabs -->
 
 [%# Fields for fast cataloging %]
-<input type="hidden" name="barcode" value="[% barcode %]" />
-<input type="hidden" name="branch" value="[% branch %]" />
-<input type="hidden" name="circborrowernumber" value="[% circborrowernumber %]" />
-<input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-<input type="hidden" name="duedatespec" value="[% duedatespec %]" />
+<input type="hidden" name="barcode" value="[% barcode | html %]" />
+<input type="hidden" name="branch" value="[% branch | html %]" />
+<input type="hidden" name="circborrowernumber" value="[% circborrowernumber | html %]" />
+<input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+<input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
 [%# End of fields for fast cataloging %]
 
 </form>
index fd2d8ba..ce3bf76 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -26,7 +27,7 @@
             <ul class="dropdown-menu">
                 <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=">Default framework</a></li>
                 [% FOREACH framework IN frameworks %]
-                    <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=[% framework.frameworkcode %]">[% framework.frameworktext %]</a></li>
+                    <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=[% framework.frameworkcode | html %]">[% framework.frameworktext | html %]</a></li>
                 [% END %]
             </ul>
         </div>
@@ -39,7 +40,7 @@
             <ul class="dropdown-menu">
                 <li id="" class="z3950searchFw"><a href="#">Default framework</a></li>
                 [% FOREACH framework IN frameworks %]
-                <li id="[% framework.frameworkcode %]" class="z3950searchFw"><a href="#">[% framework.frameworktext %]</a></li>
+                <li id="[% framework.frameworkcode | html %]" class="z3950searchFw"><a href="#">[% framework.frameworktext | html %]</a></li>
                 [% END %]
             </ul>
         </div>
 
 [% IF ( total ) %]
 <div>
-    [% total %] result(s) found in catalog,
-    <a href="#searchresult-breeding">[% breeding_count %] result(s) found in reservoir</a>
+    [% total | html %] result(s) found in catalog,
+    <a href="#searchresult-breeding">[% breeding_count | html %] result(s) found in reservoir</a>
 </div>
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 <div class="searchresults">
     <table>
         <tr>
         </tr>
       [% FOREACH resultsloo IN resultsloop %]
         <tr>
-            <td><input type="checkbox" class="selection" id="bib[% resultsloo.biblionumber %]" name="biblionumber" value="[% resultsloo.biblionumber %]" /></td>
+            <td><input type="checkbox" class="selection" id="bib[% resultsloo.biblionumber | html %]" name="biblionumber" value="[% resultsloo.biblionumber | html %]" /></td>
             <td>
                 <p>
-                    <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% resultsloo.biblionumber %]">[% resultsloo.title |html %]</a>
-                [% FOREACH subtitl IN resultsloo.subtitle %][% subtitl.subfield %][% END %]</p>
+                    <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% resultsloo.biblionumber | html %]">[% resultsloo.title | html %]</a>
+                [% FOREACH subtitl IN resultsloo.subtitle %][% subtitl.subfield | html %][% END %]</p>
                 [% IF ( resultsloo.summary ) %]
-                    <p>[% resultsloo.summary %]</p>
+                    <p>[% resultsloo.summary | html %]</p>
                 [% ELSE %]
                     <p>
                         [% IF ( resultsloo.author ) %]
-                            [% resultsloo.author %]
+                            [% resultsloo.author | html %]
                         [% ELSE %]
                             &nbsp;
                         [% END %]
-               [% IF ( resultsloo.isbn ) %] - [% resultsloo.isbn %] [% END %]
-                        [% IF ( resultsloo.publicationyear ) %] - [% resultsloo.publicationyear %][% END %]
-                        [% IF ( resultsloo.publishercode ) %]- [% resultsloo.publishercode %][% END %]
-                        [% IF ( resultsloo.copyrightdate ) %] - [% resultsloo.copyrightdate %][% END %]
-                        [% IF ( resultsloo.edition ) %]Edition: [% resultsloo.edition %][% END %]
-                        [% IF ( resultsloo.place ) %] ; [% resultsloo.place %][% END %]
-                        [% IF ( resultsloo.pages ) %] - [% resultsloo.pages %][% END %]
-                        [% IF ( resultsloo.item('size') ) %] ; [% resultsloo.item('size') %][% END %]
-                        [% IF ( resultsloo.timestamp ) %] <i>(modified on [% resultsloo.timestamp %])</i>[% END %]
+               [% IF ( resultsloo.isbn ) %] - [% resultsloo.isbn | html %] [% END %]
+                        [% IF ( resultsloo.publicationyear ) %] - [% resultsloo.publicationyear | html %][% END %]
+                        [% IF ( resultsloo.publishercode ) %]- [% resultsloo.publishercode | html %][% END %]
+                        [% IF ( resultsloo.copyrightdate ) %] - [% resultsloo.copyrightdate | html %][% END %]
+                        [% IF ( resultsloo.edition ) %]Edition: [% resultsloo.edition | html %][% END %]
+                        [% IF ( resultsloo.place ) %] ; [% resultsloo.place | html %][% END %]
+                        [% IF ( resultsloo.pages ) %] - [% resultsloo.pages | html %][% END %]
+                        [% IF ( resultsloo.item('size') ) %] ; [% resultsloo.item('size') | html %][% END %]
+                        [% IF ( resultsloo.timestamp ) %] <i>(modified on [% resultsloo.timestamp | html %])</i>[% END %]
                     </p>
                 [% END %]
                 </td>
                     [% IF ( resultsloo.available_items_loop ) %]
                         <span class="available">
                         [% FOREACH items_loo IN resultsloo.available_items_loop %]
-                            [% items_loo.count %] [% items_loo.branchname %]
+                            [% items_loo.count | html %] [% items_loo.branchname | html %]
                             <i>
-                        [% IF ( items_loo.location ) %][% items_loo.location %][% END %]
-                        [% IF ( items_loo.itemcallnumber ) %][% items_loo.itemcallnumber %][% END %]
+                        [% IF ( items_loo.location ) %][% items_loo.location | html %][% END %]
+                        [% IF ( items_loo.itemcallnumber ) %][% items_loo.itemcallnumber | html %][% END %]
                             [% IF ( items_loo.classification ) %]
                             <a href="/cgi-bin/koha/catalogue/search.pl?q=callnum:[% items_loo.classification |url %]">
-                                [% items_loo.classification %]
+                                [% items_loo.classification | html %]
                             </a>
                         [% END %]
                         </i>
                         </span>
                     [% END %]
                     <span class="unavailable">
-                        [% IF ( resultsloo.onloancount ) %] Checked out ([% resultsloo.onloancount %]),<br /> [% END %]
-                        [% IF ( resultsloo.withdrawncount ) %] Withdrawn ([% resultsloo.withdrawncount %]),<br /> [% END %]
-                        [% IF ( resultsloo.itemlostcount ) %] Lost ([% resultsloo.itemlostcount %])<br />[% END %]
-                        [% IF ( resultsloo.orderedcount ) %] On order ([% resultsloo.orderedcount %])<br/>[% END %]
-                        [% IF ( resultsloo.notforloancount ) %] Not for loan ([% resultsloo.notforloancount %])[% END %]
+                        [% IF ( resultsloo.onloancount ) %] Checked out ([% resultsloo.onloancount | html %]),<br /> [% END %]
+                        [% IF ( resultsloo.withdrawncount ) %] Withdrawn ([% resultsloo.withdrawncount | html %]),<br /> [% END %]
+                        [% IF ( resultsloo.itemlostcount ) %] Lost ([% resultsloo.itemlostcount | html %])<br />[% END %]
+                        [% IF ( resultsloo.orderedcount ) %] On order ([% resultsloo.orderedcount | html %])<br/>[% END %]
+                        [% IF ( resultsloo.notforloancount ) %] Not for loan ([% resultsloo.notforloancount | html %])[% END %]
                     </span>
                 </td>
                 <td>
                   <div class="dropup">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% resultsloo.biblionumber %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% resultsloo.biblionumber | html %]" role="button" data-toggle="dropdown" href="#">
                       Actions <b class="caret"></b>
                     </a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% resultsloo.biblionumber %]">
-                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% resultsloo.biblionumber %]" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
-                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% resultsloo.biblionumber %]" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
-                      [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]<li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% resultsloo.biblionumber %]"><i class="fa fa-pencil"></i> Edit biblio</a></li>[% END %]
-                      [% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% resultsloo.biblionumber %]"><i class="fa fa-plus"></i> Add/Edit items</a></li>[% END %]
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% resultsloo.biblionumber | html %]">
+                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% resultsloo.biblionumber | html %]" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
+                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;id=[% resultsloo.biblionumber | html %]" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
+                      [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]<li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% resultsloo.biblionumber | html %]"><i class="fa fa-pencil"></i> Edit biblio</a></li>[% END %]
+                      [% IF ( CAN_user_editcatalogue_edit_items ) %]<li><a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% resultsloo.biblionumber | html %]"><i class="fa fa-plus"></i> Add/Edit items</a></li>[% END %]
                     </ul>
                   </div>
                 </td>
     [% IF ( query ) %]
         [% IF ( error ) %]<div class="dialog alert">[% END %]<b>No results found</b>
         [% IF ( error ) %]
-            Error: <span class="error">[% error %]</span></div>
+            Error: <span class="error">[% error | html %]</span></div>
         [% END %]
     [% END %]
 [% END %]
             </tr>
             [% FOREACH breeding_loo IN breeding_loop %]
                <tr>
-                <td>[% breeding_loo.title |html %]
-                [% breeding_loo.author %]</td>
-                <td>[% breeding_loo.isbn %]</td>
-                <td>[% breeding_loo.copyrightdate %]</td>
-                <td>[% breeding_loo.edition %]</td>
-                <td>[% breeding_loo.file %]</td>
+                <td>[% breeding_loo.title | html %]
+                [% breeding_loo.author | html %]</td>
+                <td>[% breeding_loo.isbn | html %]</td>
+                <td>[% breeding_loo.copyrightdate | html %]</td>
+                <td>[% breeding_loo.edition | html %]</td>
+                <td>[% breeding_loo.file | html %]</td>
                 <td>
                   <div class="dropup">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="reservoirsearchactions[% breeding_loo.id %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="reservoirsearchactions[% breeding_loo.id | html %]" role="button" data-toggle="dropdown" href="#">
                       Actions <b class="caret"></b>
                     </a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reservoirsearchactions[% breeding_loo.id %]">
-                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.id %]" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
-                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.id %]" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reservoirsearchactions[% breeding_loo.id | html %]">
+                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.id | html %]" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
+                      <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.id | html %]" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
                       [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
-                        <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?breedingid=[% breeding_loo.id %]"><i class="fa fa-plus"></i> Add biblio</a></li>
+                        <li><a href="/cgi-bin/koha/cataloguing/addbiblio.pl?breedingid=[% breeding_loo.id | html %]"><i class="fa fa-plus"></i> Add biblio</a></li>
                       [% END %]
                     </ul>
                   </div>
         <h3 id="dataPreviewLabel">Preview</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
             });
 
             $("#useadvanced").click(function(){
-                $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber %]', 'advanced', { expires: 365, path: '/' } );
+                $.cookie( 'catalogue_editor_[% logged_in_user.borrowernumber | html %]', 'advanced', { expires: 365, path: '/' } );
                 return true;
             });
 
             });
             $("#dataPreview").on("hidden", function(){
                 $("#dataPreviewLabel").html("");
-                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
 
          });
         function PopupZ3950(fw) {
             var strQuery = GetZ3950Terms(fw);
             if(strQuery){
-                window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber %]"+strQuery,"z3950search",'width=800,height=500,location=yes,toolbar=no,scrollbars=yes,resize=yes');
+                window.open("/cgi-bin/koha/cataloguing/z3950_search.pl?biblionumber=[% biblionumber | html %]"+strQuery,"z3950search",'width=800,height=500,location=yes,toolbar=no,scrollbars=yes,resize=yes');
             }
         }
         /* provide Z3950 search points */
index 6b86b21..38e8fcd 100644 (file)
@@ -1,19 +1,20 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE ColumnsSettings %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Cataloging &rsaquo; [% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %]) &rsaquo; Items</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Cataloging &rsaquo; [% title | html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber | html %]) &rsaquo; Items</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 [% INCLUDE 'datatables.inc' %]
-[% Asset.js("js/cataloging.js") %]
+[% Asset.js("js/cataloging.js") | $raw %]
 [% INCLUDE 'columns_settings.inc' %]
 [% INCLUDE 'browser-strings.inc' %]
-[% Asset.js("js/browser.js") %]
+[% Asset.js("js/browser.js") | $raw %]
 <script type="text/javascript">
 //<![CDATA[
-    var browser = KOHA.browser('[% searchid %]', parseInt('[% biblionumber %]', 10));
+    var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10));
     browser.show();
 
 $(document).ready(function(){
@@ -35,9 +36,9 @@ $(document).ready(function(){
                     var rowid = $(this).parent().attr("id");
                     num_rowid = rowid.replace("row","");
                     $(".linktools").remove();
-                    var edit_link = $('<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&frameworkcode=[% frameworkcode %]&biblionumber=[% biblionumber %]&itemnumber='+num_rowid+'&searchid=[% searchid %]#edititem"></a>');
+                    var edit_link = $('<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&frameworkcode=[% frameworkcode | html %]&biblionumber=[% biblionumber | html %]&itemnumber='+num_rowid+'&searchid=[% searchid | html %]#edititem"></a>');
                     $(edit_link).text(_("Edit item"));
-                    var delete_link = $('<a href="/cgi-bin/koha/cataloguing/additem.pl?op=delitem&frameworkcode=[% frameworkcode %]&biblionumber=[% biblionumber %]&itemnumber='+num_rowid+'&searchid=[% searchid %]"></a>');
+                    var delete_link = $('<a href="/cgi-bin/koha/cataloguing/additem.pl?op=delitem&frameworkcode=[% frameworkcode | html %]&biblionumber=[% biblionumber | html %]&itemnumber='+num_rowid+'&searchid=[% searchid | html %]"></a>');
                     $(delete_link).text(_("Delete item"));
                     $(delete_link).on('click', function(e) {
                         return confirm_deletion();
@@ -51,11 +52,11 @@ $(document).ready(function(){
 
     $("#addnewitem").click(function(){
         if ( confirm(_("Are you sure you want to add a new item? Any changes made on this page will be lost.")) ){
-            window.location.href = "/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]";
+            window.location.href = "/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber | html %]";
         }
     });
 
-    var columns_settings = [% ColumnsSettings.GetColumns( 'cataloguing', 'additem', 'itemst', 'json' ) %]
+    var columns_settings = [% ColumnsSettings.GetColumns( 'cataloguing', 'additem', 'itemst', 'json' ) | $raw %]
     // Skip the first column
     columns_settings.unshift( { cannot_be_toggled: "1" } );
 
@@ -130,7 +131,7 @@ function confirm_deletion() {
 
 //]]>
 </script>
-[% Asset.css("css/addbiblio.css") %]
+[% Asset.css("css/addbiblio.css") | $raw %]
 
 [% INCLUDE 'select2.inc' %]
 <script type="text/javascript">
@@ -140,7 +141,7 @@ function confirm_deletion() {
 </script>
 
 [% IF ( bidi ) %]
-   [% Asset.css("css/right-to-left.css") %]
+   [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
 </head>
 <body id="cat_additem" class="cat">
@@ -150,8 +151,8 @@ function confirm_deletion() {
 <div id="breadcrumbs">
           <a href="/cgi-bin/koha/mainpage.pl">Home</a>
  &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>
- &rsaquo; Edit <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber %]">[% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %])</a>
- &rsaquo; <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber %]">Items</a>
+ &rsaquo; Edit <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% biblionumber | html %]">[% title | html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber | html %])</a>
+ &rsaquo; <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% biblionumber | html %]">Items</a>
 </div>
 
 <div id="doc3" class="yui-t7">
@@ -159,14 +160,14 @@ function confirm_deletion() {
    <div id="bd">
        <div id="yui-main">
 
-<h1>Items for [% title |html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber %])</h1>
+<h1>Items for [% title | html %] [% IF ( author ) %] by [% author | html %][% END %] (Record #[% biblionumber | html %])</h1>
 
 [% IF ( barcode_not_unique ) %]<div class="dialog alert"><strong>Error saving item</strong>: Barcode must be unique.</div>[% END %]
 [% IF ( no_next_barcode ) %]<div class="dialog alert"><strong>Error saving items</strong>: Unable to automatically determine values for barcodes. No item has been inserted.</div>[% END %]
 [% IF ( book_on_loan ) %]<div class="dialog alert"><strong>Cannot delete</strong>: item is checked out.</div>[% END %]
 [% IF ( book_reserved ) %]<div class="dialogalert"><strong>Cannot delete</strong>: item has a waiting hold.</div>[% END %]
 [% IF ( not_same_branch ) %]<div class="dialog alert"><strong>Cannot delete</strong>: The items do not belong to your library.</div>[% END %]
-[% IF ( linked_analytics ) %]<div class="dialog alert"><strong>Cannot delete</strong>: item has linked <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]&amp;analyze=1">analytics.</a>.</div>[% END %]
+[% IF ( linked_analytics ) %]<div class="dialog alert"><strong>Cannot delete</strong>: item has linked <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]&amp;analyze=1">analytics.</a>.</div>[% END %]
 
 <div id="cataloguing_additem_itemlist">
     [% IF ( item_loop ) %]
@@ -177,11 +178,11 @@ function confirm_deletion() {
                 <th>&nbsp;</th>
                 [% FOREACH item_header IN item_header_loop %]
                     [% IF item_header.column_name %]
-                        <th data-colname="[% item_header.column_name %]">
+                        <th data-colname="[% item_header.column_name | html %]">
                     [% ELSE %]
                         <th>
                     [% END %]
-                        [% item_header.header_value %]
+                        [% item_header.header_value | html %]
                     </th>
                 [% END %]
             </tr>
@@ -190,15 +191,15 @@ function confirm_deletion() {
                 [% FOREACH item_loo IN item_loop %]
                     [% IF ( item_loo.itemnumber == itemnumber) %]
                         [% IF item_loo.nomod %]
-                           <tr id="row[% item_loo.itemnumber %]" class="active">
+                           <tr id="row[% item_loo.itemnumber | html %]" class="active">
                         [% ELSE %]
-                            <tr id="row[% item_loo.itemnumber %]" class="active editable">
+                            <tr id="row[% item_loo.itemnumber | html %]" class="active editable">
                         [% END %]
                     [% ELSE %]
                         [% IF item_loo.nomod %]
-                           <tr id="row[% item_loo.itemnumber %]">
+                           <tr id="row[% item_loo.itemnumber | html %]">
                         [% ELSE %]
-                            <tr id="row[% item_loo.itemnumber %]" class="editable">
+                            <tr id="row[% item_loo.itemnumber | html %]" class="editable">
                         [% END %]
                     [% END %]
                     [% IF ( item_loo.nomod ) %]
@@ -206,32 +207,32 @@ function confirm_deletion() {
                     [% ELSE %]
                       <td>
                           <div class="dropdown">
-                          <a class="btn btn-default btn-xs dropdown-toggle" id="itemactions[% item_loo.itemnumber %]" role="button" data-toggle="dropdown" href="#">
+                          <a class="btn btn-default btn-xs dropdown-toggle" id="itemactions[% item_loo.itemnumber | html %]" role="button" data-toggle="dropdown" href="#">
                               Actions <b class="caret"></b>
                           </a>
-                          <ul class="dropdown-menu" role="menu" aria-labelledby="itemactions[% item_loo.itemnumber %]">
+                          <ul class="dropdown-menu" role="menu" aria-labelledby="itemactions[% item_loo.itemnumber | html %]">
 
                         [% IF ( item_loo.hostitemflag ) %]
-                              <li><a href="additem.pl?op=edititem&amp;biblionumber=[% item_loo.hostbiblionumber %]&amp;itemnumber=[% item_loo.itemnumber %]#edititem">Edit in host</a> &nbsp; <a class="delete" href="/cgi-bin/koha/cataloguing/additem.pl?op=delinkitem&amp;biblionumber=[% biblionumber %]&amp;hostitemnumber=[% item_loo.itemnumber %]&amp;searchid=[% searchid %]">Delink</a></li>
+                              <li><a href="additem.pl?op=edititem&amp;biblionumber=[% item_loo.hostbiblionumber | html %]&amp;itemnumber=[% item_loo.itemnumber | html %]#edititem">Edit in host</a> &nbsp; <a class="delete" href="/cgi-bin/koha/cataloguing/additem.pl?op=delinkitem&amp;biblionumber=[% biblionumber | html %]&amp;hostitemnumber=[% item_loo.itemnumber | html %]&amp;searchid=[% searchid | html %]">Delink</a></li>
                         [% ELSE %]
-                              <li><a href="additem.pl?op=edititem&amp;biblionumber=[% biblionumber %]&amp;itemnumber=[% item_loo.itemnumber %]&amp;searchid=[% searchid %]#edititem">Edit</a></li>
-                              <li><a href="additem.pl?op=dupeitem&amp;biblionumber=[% biblionumber %]&amp;itemnumber=[% item_loo.itemnumber %]&amp;searchid=[% searchid %]#additema">Duplicate</a></li>
-                              <li class="print_label"><a href="/cgi-bin/koha/labels/label-edit-batch.pl?op=add&amp;number_type=itemnumber&amp;number_list=[% item_loo.itemnumber %]" target="_blank" >Print Label</a></li>
+                              <li><a href="additem.pl?op=edititem&amp;biblionumber=[% biblionumber | html %]&amp;itemnumber=[% item_loo.itemnumber | html %]&amp;searchid=[% searchid | html %]#edititem">Edit</a></li>
+                              <li><a href="additem.pl?op=dupeitem&amp;biblionumber=[% biblionumber | html %]&amp;itemnumber=[% item_loo.itemnumber | html %]&amp;searchid=[% searchid | html %]#additema">Duplicate</a></li>
+                              <li class="print_label"><a href="/cgi-bin/koha/labels/label-edit-batch.pl?op=add&amp;number_type=itemnumber&amp;number_list=[% item_loo.itemnumber | html %]" target="_blank" >Print Label</a></li>
                           [% IF ( item_loo.countanalytics ) %]
                               <li><a href="/cgi-bin/koha/catalogue/search.pl?idx=hi&amp;q=% item_loo.itemnumber %]">View analytics</a></li>
                           [% ELSE %]
-                              <li><a class="delete" href="/cgi-bin/koha/cataloguing/additem.pl?op=delitem&amp;biblionumber=[% biblionumber %]&amp;itemnumber=[% item_loo.itemnumber %]&amp;searchid=[% searchid %]" onclick="return confirm_deletion();">Delete</a></li>
+                              <li><a class="delete" href="/cgi-bin/koha/cataloguing/additem.pl?op=delitem&amp;biblionumber=[% biblionumber | html %]&amp;itemnumber=[% item_loo.itemnumber | html %]&amp;searchid=[% searchid | html %]" onclick="return confirm_deletion();">Delete</a></li>
                           [% END %]
                         [% END %]
                             [% IF ( OPACBaseURL ) %]
-                                <li class="view-in-opac"><a target="_blank" href="[% Koha.Preference('OPACBaseURL') %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]">OPAC view</a></li>
+                                <li class="view-in-opac"><a target="_blank" href="[% Koha.Preference('OPACBaseURL') | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">OPAC view</a></li>
                             [% END %]
                           </ul>
                           </div>
                       </td>
                     [% END %]
                 [% FOREACH item_valu IN item_loo.item_value %]
-                    <td>[% item_valu.field |html %]</td>
+                    <td>[% item_valu.field | html %]</td>
                 [% END %]
                 </tr>
                 [% END %]
@@ -247,83 +248,83 @@ function confirm_deletion() {
 <div class="yui-u">
 <div id="cataloguing_additem_newitem">
     <form id="f" method="post" action="/cgi-bin/koha/cataloguing/additem.pl" name="f">
-    <input type="hidden" name="op" value="[% op %]" />
+    <input type="hidden" name="op" value="[% op | html %]" />
     [% IF (popup) %]
         <input type="hidden" name="popup" value="1" />
     [% END %]
-    <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+    <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     [% IF ( opisadd ) %]
         <h2 id="additema">Add item [% IF (circborrowernumber) %]<em>(fast cataloging)</em>[% END %]</h2>
     [% ELSE %]
-        <h2 id="edititem">Edit Item #[% itemnumber %][% IF ( barcode ) %] / Barcode [% barcode %][% END %]</h2>
+        <h2 id="edititem">Edit Item #[% itemnumber | html %][% IF ( barcode ) %] / Barcode [% barcode | html %][% END %]</h2>
     [% END %]
        <fieldset class="rows">
        <ol>
         [% FOREACH ite IN item %]
-               <li><div class="subfield_line" style="[% ite.visibility %]" id="subfield[% ite.tag %][% ite.subfield %][% ite.random %]">
+               <li><div class="subfield_line" style="[% ite.visibility | html %]" id="subfield[% ite.tag | html %][% ite.subfield | html %][% ite.random | html %]">
                 [% IF ( ite.mandatory ) %]
-               <label class="required">[% ite.subfield %] - [% ite.marc_lib %]</label>
+               <label class="required">[% ite.subfield | html %] - [% ite.marc_lib | $raw %]</label>
                [% ELSE %]
-               <label>[% ite.subfield %] - [% ite.marc_lib %]</label>
+               <label>[% ite.subfield | html %] - [% ite.marc_lib | $raw %]</label>
                [% END %]
 
                 [% SET mv = ite.marc_value %]
                 [% IF ( mv.type == 'hidden' ) %]
-                    <input type="hidden" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]">
+                    <input type="hidden" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]">
                 [% ELSIF ( mv.type == 'select' ) %]
                     [% IF ( mv.readonly ) %]
-                        <select name="field_value" id="[%- mv.id -%]" size="1" class="input_marceditor" readonly="readonly" disabled="disabled">
+                        <select name="field_value" id="[%- mv.id | html -%]" size="1" class="input_marceditor" readonly="readonly" disabled="disabled">
                     [% ELSE %]
-                        <select name="field_value" id="[%- mv.id -%]" size="1" class="input_marceditor">
+                        <select name="field_value" id="[%- mv.id | html -%]" size="1" class="input_marceditor">
                     [% END %]
                     [% FOREACH aval IN mv.values %]
                         [% IF aval == mv.default %]
-                        <option value="[%- aval -%]" selected="selected">[%- mv.labels.$aval -%]</option>
+                        <option value="[%- aval | html -%]" selected="selected">[%- mv.labels.$aval | html -%]</option>
                         [% ELSE %]
-                        <option value="[%- aval -%]">[%- mv.labels.$aval -%]</option>
+                        <option value="[%- aval | html -%]">[%- mv.labels.$aval | html -%]</option>
                         [% END %]
                     [% END %]
                     </select>
                 [% ELSIF ( mv.type == 'text_auth' ) %]
                     [% IF mv.readonly %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" readonly="readonly" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" readonly="readonly" />
                     [% ELSE %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" />
                         [% SET dopop = "Dopop('/cgi-bin/koha/authorities/auth_finder.pl?authtypecode=\"${mv.authtypecode}\"&index=${mv.id}','${mv.id}')" %]
-                        <a href="#" class="buttonDot"  onclick="[%- dopop -%]; return false;" title="Tag editor">...</a>
+                        <a href="#" class="buttonDot"  onclick="[%- dopop | html -%]; return false;" title="Tag editor">...</a>
                     [% END %]
                 [% ELSIF ( mv.type == 'text_plugin' ) %]
                     [% IF mv.readonly %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" readonly="readonly" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" readonly="readonly" />
                     [% ELSE %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" />
                         [% IF ( mv.nopopup ) %]
-                            <a href="#" id="buttonDot_[%- mv.id -%]" class="[%- mv.class -%]" title="No popup">...</a>
+                            <a href="#" id="buttonDot_[%- mv.id | html -%]" class="[%- mv.class | html -%]" title="No popup">...</a>
                         [% ELSE  %]
-                            <a href="#" id="buttonDot_[%- mv.id -%]" class="[%- mv.class -%]" title="Tag editor">...</a>
+                            <a href="#" id="buttonDot_[%- mv.id | html -%]" class="[%- mv.class | html -%]" title="Tag editor">...</a>
                         [% END %]
-                        [%- mv.javascript -%]
+                        [%- mv.javascript.raw -%]
                     [% END %]
                 [% ELSIF ( mv.type == 'text' ) %]
                     [% IF mv.readonly %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" readonly="readonly" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" readonly="readonly" />
                     [% ELSE %]
-                        <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength -%]" value="[%- mv.value -%]" />
+                        <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="[%- mv.maxlength | html -%]" value="[%- mv.value | html -%]" />
                     [% END %]
                 [% ELSIF ( mv.type == 'textarea' ) %]
                     [% IF mv.readonly %]
-                        <textarea id="[%- mv.id -%]" name="field_value" class="input_marceditor" rows="5" cols="64" readonly="readonly" >[% mv.value %]</textarea>
+                        <textarea id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" rows="5" cols="64" readonly="readonly" >[% mv.value | html %]</textarea>
                     [% ELSE %]
-                        <textarea id="[%- mv.id -%]" name="field_value" class="input_marceditor" rows="5" cols="64" >[% mv.value %]</textarea>
+                        <textarea id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" rows="5" cols="64" >[% mv.value | html %]</textarea>
                     [% END %]
                 [% END %]
 
-                <input type="hidden" name="tag"       value="[% ite.tag %]" />
-                <input type="hidden" name="subfield"  value="[% ite.subfield %]" />
-                <input type="hidden" name="mandatory" value="[% ite.mandatory %]" />
+                <input type="hidden" name="tag"       value="[% ite.tag | html %]" />
+                <input type="hidden" name="subfield"  value="[% ite.subfield | html %]" />
+                <input type="hidden" name="mandatory" value="[% ite.mandatory | html %]" />
                 [% IF ( ite.repeatable ) %]
                     <a href="#" class="buttonPlus" onclick="CloneItemSubfield(this.parentNode); return false;">
-                        <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                     </a>
                 [% END %]
                 [% IF ( ite.mandatory ) %] <span class="required">Required</span>[% END %]
@@ -333,7 +334,7 @@ function confirm_deletion() {
     </fieldset>
     <input type="hidden" name="indicator" value=" " />
     <input type="hidden" name="indicator" value=" " />
-    <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
+    <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
 
 <fieldset class="action">    [% IF ( opisadd ) %]
     <input type="submit" name="phony_submit" value="phony_submit" id="phony_submit" style="display:none;" onclick="return false;" />
@@ -356,19 +357,19 @@ function confirm_deletion() {
     </fieldset>
 
     [% ELSE %]
-    <input type="hidden" name="tag" value="[% itemtagfield %]" />
-    <input type="hidden" name="subfield" value="[% itemtagsubfield %]" />
-    <input type="hidden" name="field_value" value="[% itemnumber %]" />
+    <input type="hidden" name="tag" value="[% itemtagfield | html %]" />
+    <input type="hidden" name="subfield" value="[% itemtagsubfield | html %]" />
+    <input type="hidden" name="field_value" value="[% itemnumber | html %]" />
     <input type="submit" value="Save changes" onclick="return Check(this.form)">
     <input type="button" id="addnewitem" value="Add a new item">
-    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">Cancel</a>
+    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">Cancel</a>
     [% END %]</fieldset>
     
     [%# Fields for fast cataloging %]
-    <input type="hidden" name="circborrowernumber" value="[% circborrowernumber %]" />
-    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-    <input type="hidden" name="barcode" value="[% barcode %]" />
-    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
+    <input type="hidden" name="circborrowernumber" value="[% circborrowernumber | html %]" />
+    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+    <input type="hidden" name="barcode" value="[% barcode | html %]" />
+    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
     [%# End fields for fast cataloging %]
 
 
index 8abcdc5..b282489 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Cataloging &rsaquo; Editor</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/cateditor.css") %]
-[% Asset.css("css/datatables.css") %]
-[% Asset.css("lib/codemirror/codemirror.css") %]
-[% Asset.css("css/humanmsg.css") %]
-[% Asset.js("js/cataloging.js") %]
-[% Asset.js("lib/jquery/plugins/humanmsg.js") %]
+[% Asset.css("css/cateditor.css") | $raw %]
+[% Asset.css("css/datatables.css") | $raw %]
+[% Asset.css("lib/codemirror/codemirror.css") | $raw %]
+[% Asset.css("css/humanmsg.css") | $raw %]
+[% Asset.js("js/cataloging.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %]
 [% IF ( bidi ) %]
-   [% Asset.css("css/right-to-left.css") %]
+   [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
 </head>
 <body id="cat_addbiblio" class="cat">
index 98ad4d1..6fc19a5 100644 (file)
@@ -5,7 +5,7 @@
 <body id="catalog_linkitem" class="catalog">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; Link a host item to <i>[% bibliotitle |html %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; Link a host item to <i>[% bibliotitle | html %]</i></div>
 
 <div class="container-fluid">
     <div class="row">
     </div>
     <form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
        <input type="submit" value="OK" />
-       <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+       <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     </form>
 [% ELSE %]
     [% IF ( success ) %]
-    <div class="dialog message">The item has successfully been linked to <i>[% bibliotitle |html %]</i>.</div>
+    <div class="dialog message">The item has successfully been linked to <i>[% bibliotitle | html %]</i>.</div>
        <form action="/cgi-bin/koha/catalogue/MARCdetail.pl" method="post">
            <input type="submit" value="OK" />
-           <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+           <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
        </form>
     [% ELSE %]
        [% IF ( missingparameter ) %]
                    <input type="text" name="biblionumber" id="biblionumber" class="focus" size="14" /> 
            </fieldset>
            [% ELSE %]
-           <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
+           <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
            [% END %]
 
            [% IF ( missingbarcode ) %]
            <fieldset id="barcode_fieldset">
-               <label for="barcode_fieldset">Select the host item to link[% IF ( bibliotitle ) %] to <i>[% bibliotitle |html %]</i>[% END %]</label>
+        <label for="barcode_fieldset">Select the host item to link[% IF ( bibliotitle ) %] to <i>[% bibliotitle | html %]</i>[% END %]</label>
                    <div class="hint">Enter item barcode:</div>
                    <input type="text" name="barcode" id="barcode" class="barcode focus" size="14" /> 
            </fieldset>
            [% ELSE %]
-           <input type="hidden" name="barcode" id="barcode" value="[% barcode %]" />
+           <input type="hidden" name="barcode" id="barcode" value="[% barcode | html %]" />
            [% END %]
 
            <input type="submit" value="Select" />
index c94d88d..a1f8482 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% PROCESS 'merge-record.inc' %]
@@ -30,9 +31,9 @@ div#result { margin-top: 1em; }
        [% FOREACH error IN errors %]
            <div class="dialog alert">
                 [% IF error.code == 'CANNOT_MOVE' %]
-                    The following items could not be moved from the old record to the new one: [% error.value %]
+                    The following items could not be moved from the old record to the new one: [% error.value | html %]
                 [% ELSE %]
-                    [% error %]
+                    [% error | html %]
                 [% END %]
                 <br />
                 Therefore, the record to be merged has not been deleted.
@@ -40,21 +41,21 @@ div#result { margin-top: 1em; }
        [% END %]
 
     [% ELSE %]
-        <p>The merge was successful. <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% ref_biblionumber %]">Click here to see the merged record.</a></p>
+        <p>The merge was successful. <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% ref_biblionumber | html %]">Click here to see the merged record.</a></p>
         <h3>Report</h3>
         <table>
             <thead>
                 <tr>
                     <th>Biblionumber</th>
                     [% FOREACH key IN report_header.keys.sort %]
-                        [% tag = key.substr(0, 3) %]
-                        [% code = key.substr(3, 1) %]
+                        [% tag = key.substr(0, 3) | html %]
+                        [% code = key.substr(3, 1) | html %]
                         [% IF code == '@' %]
-                            [% header = tag %]
+                            [% header = tag | html %]
                         [% ELSE %]
-                            [% header = tag _ '$' _ code %]
+                            [% header = tag _ '$' _ code | html %]
                         [% END %]
-                        <th>[% header %]</th>
+                        <th>[% header | html %]</th>
                     [% END %]
                 </tr>
             </thead>
@@ -62,17 +63,17 @@ div#result { margin-top: 1em; }
                 [% FOREACH record IN report_records %]
                     <tr>
                         <td>
-                            [% record.biblionumber %]
+                            [% record.biblionumber | html %]
                             [% IF loop.first %]
                                 (record kept)
                             [% END %]
                         </td>
                         [% FOREACH key IN report_header.keys.sort %]
                             <td>
-                                [% values = record.fields.$key %]
+                                [% values = record.fields.$key | html %]
                                 [% IF values %]
                                     [% FOREACH value IN record.fields.$key %]
-                                        [% value %]
+                                        [% value | html %]
                                         [% UNLESS loop.last %]<br />[% END %]
                                     [% END %]
                                 [% END %]
@@ -95,16 +96,16 @@ div#result { margin-top: 1em; }
         [% FOREACH record IN records %]
             <li class="radio">
                 [% IF loop.first %]
-                    <input type="radio" value="[% record.biblionumber %]" checked="checked" id="ref_biblionumber[% record.biblionumber %]" name="ref_biblionumber" onclick="changeFramework('[% record.frameworkcode %]')" />
+                    <input type="radio" value="[% record.biblionumber | html %]" checked="checked" id="ref_biblionumber[% record.biblionumber | html %]" name="ref_biblionumber" onclick="changeFramework('[% record.frameworkcode | html %]')" />
                 [% ELSE %]
-                    <input type="radio" value="[% record.biblionumber %]" id="ref_biblionumber[% record.biblionumber %]" name="ref_biblionumber" onclick="changeFramework('[% record.frameworkcode %]')" />
+                    <input type="radio" value="[% record.biblionumber | html %]" id="ref_biblionumber[% record.biblionumber | html %]" name="ref_biblionumber" onclick="changeFramework('[% record.frameworkcode | html %]')" />
                 [% END %]
-                <label for="ref_biblionumber[% record.biblionumber %]">
-                    [% record.data.title %]
+                <label for="ref_biblionumber[% record.biblionumber | html %]">
+                    [% record.data.title | html %]
                     [% FOREACH subtitle IN record.subtitles %]
-                        [% subtitle.subfield %]
+                        [% subtitle.subfield | html %]
                     [% END %]
-                    ([% record.biblionumber %]) <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% record.biblionumber %]" class="previewData">View MARC</a>
+                    ([% record.biblionumber | html %]) <a href="/cgi-bin/koha/catalogue/showmarc.pl?id=[% record.biblionumber | html %]" class="previewData">View MARC</a>
                 </label>
             </li>
         [% END %]
@@ -114,14 +115,14 @@ div#result { margin-top: 1em; }
                 <select name="frameworkcode" id="frameworkcode">
                     <option value="">Default</option>
                     [% FOREACH framework IN frameworks %]
-                        <option value="[% framework.frameworkcode %]">[% framework.frameworktext %]</option>
+                        <option value="[% framework.frameworkcode | html %]">[% framework.frameworktext | html %]</option>
                     [% END %]
                 </select>
             </li>
     </ol>
 
     [% FOREACH record IN records %]
-        <input type="hidden" name="biblionumber" value="[% record.biblionumber %]" />
+        <input type="hidden" name="biblionumber" value="[% record.biblionumber | html %]" />
     [% END %]
     <fieldset class="action">
         <input type="submit" value="Next" />
@@ -137,7 +138,7 @@ div#result { margin-top: 1em; }
         <h3 id="dataPreviewLabel">Preview</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
@@ -150,7 +151,7 @@ div#result { margin-top: 1em; }
 [% IF ( errors.size ) %]
     <div class="dialog alert">
         [% FOREACH error IN errors %]
-            <p>[% error %]</p>
+            <p>[% error | html %]</p>
         [% END %]
     </div>
 [% ELSE %]
@@ -164,16 +165,16 @@ div#result { margin-top: 1em; }
 [% PROCESS mergetarget %]
 </div> <!-- .yui-u -->
 
-<input type="hidden" name="ref_biblionumber" value="[% ref_biblionumber %]" />
+<input type="hidden" name="ref_biblionumber" value="[% ref_biblionumber | html %]" />
 [% FOREACH record IN records %]
-    <input type="hidden" name="biblionumber" value="[% record.recordid %]" />
+    <input type="hidden" name="biblionumber" value="[% record.recordid | html %]" />
 [% END %]
-<input type="hidden" name="frameworkcode" value="[% framework %]" />
+<input type="hidden" name="frameworkcode" value="[% framework | html %]" />
 
 <fieldset class="action">
     <input type="submit" name="merge" value="Merge" />
     <label for="report_fields">Fields to display in report:</label>
-    <input type="text" name="report_fields" id="report_fields" value="[% MergeReportFields %]" />
+    <input type="text" name="report_fields" id="report_fields" value="[% MergeReportFields | html %]" />
     <span class="hint">(Example: "001,245ab,600")
 </fieldset>
 </div>
@@ -187,7 +188,7 @@ div#result { margin-top: 1em; }
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/merge-record.js") %]
+    [% Asset.js("js/merge-record.js") | $raw %]
     [% INCLUDE 'merge-record-strings.inc' %]
     <script type="text/javascript">
         [% UNLESS (result) %]
@@ -206,7 +207,7 @@ div#result { margin-top: 1em; }
                 });
                 $("#dataPreview").on("hidden", function(){
                     $("#dataPreviewLabel").html("");
-                    $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                    $("#dataPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
                 });
             });
           [% ELSE %]
@@ -278,7 +279,7 @@ div#result { margin-top: 1em; }
 
         $(document).ready(function(){
             tagslib = [];
-            $.getJSON("/cgi-bin/koha/cataloguing/merge_ajax.pl", {frameworkcode : "[% framework %]" }, function(json) {
+            $.getJSON("/cgi-bin/koha/cataloguing/merge_ajax.pl", {frameworkcode : "[% framework | html %]" }, function(json) {
               tagslib = json;
               rebuild_target($("#tabs"), $("#resultul"));
             });
@@ -288,8 +289,8 @@ div#result { margin-top: 1em; }
 
             // Check all checkboxes in first tab, and uncheck all others to avoid
             // inconsistencies from a page refresh.
-            $('#tabs div#tabrecord[% ref_biblionumber %]').find('input[type="checkbox"]').prop('checked', true);
-            $('#tabs > div:not("#tabrecord[% ref_biblionumber %]")').find('input[type="checkbox"]').prop('checked', false);
+            $('#tabs div#tabrecord[% ref_biblionumber | html %]').find('input[type="checkbox"]').prop('checked', true);
+            $('#tabs > div:not("#tabrecord[% ref_biblionumber | html %]")').find('input[type="checkbox"]').prop('checked', false);
 
             //Set focus to cataloging search
             $("input[name=q]:eq(0)").focus();
index 3e2f10e..cfff592 100644 (file)
@@ -1,11 +1,11 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Attach an item to [% bibliotitle |html %]</title>
+<title>Attach an item to [% bibliotitle | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="catalog_moveitem" class="catalog">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; Attach an item to <i>[% bibliotitle |html %][% IF ( itemsloo.subtitle ) %][% itemsloo.subtitle %][% END %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a>  &rsaquo; Attach an item to <i>[% bibliotitle | html %][% IF ( itemsloo.subtitle ) %][% itemsloo.subtitle | html %][% END %]</i></div>
 <div id="doc" class="yui-t7">
 
 [% BLOCK actions %]
 
 [% BLOCK fail %]
         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
-                                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
                         </form>
-                                <form method="get" action="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber %]">
+                                <form method="get" action="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber | html %]">
         <button type="submit" class="new"><i class="fa fa-fw fa-plus"></i> Try again with a different barcode</button>
-                                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
                         </form>
 [% END %]
 
 
        [% ELSE %]
            [% IF ( success ) %]
-                       <div class="dialog message">The item has successfully been attached to [% INCLUDE 'biblio-default-view.inc' %]<i>[% bibliotitle |html %]</i></a>.
+            <div class="dialog message">The item has successfully been attached to [% INCLUDE 'biblio-default-view.inc' %]<i>[% bibliotitle | html %]</i></a>.
                        <p>
                        [% INCLUDE actions %]
                     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
-                                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
                         </form>
-                                <form method="get" action="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber %]"/>
+                                <form method="get" action="/cgi-bin/koha/cataloguing/moveitem.pl?biblionumber=[% biblionumber | html %]"/>
                     <button type="submit" class="new"><i class="fa fa-fw fa-plus"></i> Attach another item</button>
-                                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
                         </form>
                        </p>
                        </div>
                    <fieldset class="action"><input type="submit" value="Submit" /></fieldset>
            </fieldset>
            [% ELSE %]
-           <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
+           <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
            [% END %]
 
                [% IF ( missingbarcode ) %]
-               <h3>Attach an item[% IF ( bibliotitle ) %] to <i>[% bibliotitle |html %]</i>[% END %]</h3>
+        <h3>Attach an item[% IF ( bibliotitle ) %] to <i>[% bibliotitle | html %]</i>[% END %]</h3>
            <fieldset id="barcode_fieldset">
                <label for="barcode">Enter the barcode of the item to attach:</label>
                    <p class="hint">The item you select will be moved to the target record.</p>
@@ -83,7 +83,7 @@
                    <fieldset class="action"><input type="submit" value="Submit" /></fieldset>
            </fieldset>
            [% ELSE %]
-           <input type="hidden" name="barcode" id="barcode" value="[% barcode %]" />
+           <input type="hidden" name="barcode" id="barcode" value="[% barcode | html %]" />
            [% END %]
 
        </form>
index 0451c26..70064c8 100644 (file)
@@ -9,10 +9,10 @@
 <h1>EXAMPLE plugin</h1>
 <p>Hi, you are looking at the result of launching the EXAMPLE plugin.</p>
 <p>I received this from you:</p>
-<input type="text" id="received" value="[% result %]" disabled />
+<input type="text" id="received" value="[% result | html %]" disabled />
 <p/>
 <p>I will pass back what you type here, if you press OK.</p>
-<input type="text" id="return" value="[% result %]" />
+<input type="text" id="return" value="[% result | html %]" />
 <p>
     <input type="button" value="OK"  onclick="submitMyForm();" />
     <a href="#" class="cancel close">Cancel</a>
@@ -28,7 +28,7 @@
     // The following function just puts back the value of the input #return
     // into the caller's field, referenced by index. And closes the popup.
     function submitMyForm() {
-        $(window.opener.document).find('#[% index %]').val($('#return').val() );
+        $(window.opener.document).find('#[% index | html %]').val($('#return').val() );
         window.close();
     }
 //]]>
index 0f242ec..89c5a9c 100644 (file)
@@ -17,7 +17,7 @@
 <div>
     <form method="get" action="cn_browser.pl">
     <label for="searchcn">Search call number:</label>
-    <input type="text" id="cn_browser_input" name="q" value="[% q %]" />
+    <input type="text" id="cn_browser_input" name="q" value="[% q | html %]" />
     <input id="cn_browser_submit" type="submit" value="Search" />
     </form>
 </div>
     <tbody>
 [% FOREACH cn_loo IN cn_loop %]
     <tr>
-    <td style="background:[% cn_loo.background %];">[% cn_loo.itemcallnumber %]</td>
-    <td style="background:[% cn_loo.background %];">
-        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cn_loo.biblionumber %]">
-            [% cn_loo.title %] [% cn_loo.subtitle %] [% cn_loo.subtitle2 %]
+    <td style="background:[% cn_loo.background | html %];">[% cn_loo.itemcallnumber | html %]</td>
+    <td style="background:[% cn_loo.background | html %];">
+        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cn_loo.biblionumber | html %]">
+            [% cn_loo.title | html %] [% cn_loo.subtitle | html %] [% cn_loo.subtitle2 | html %]
             [% IF ( cn_loo.author ) %]
-                <span>by</span> [% cn_loo.author %]
+                <span>by</span> [% cn_loo.author | html %]
             [% END %]
         </a>
     </td>
-    <td style="background:[% cn_loo.background %];">[% cn_loo.branchname %]</td>
+    <td style="background:[% cn_loo.background | html %];">[% cn_loo.branchname | html %]</td>
     </tr>
 [% END %]
     </tbody>
index bb46c89..e5a7e09 100644 (file)
 <div id="macles" class="toptabs numbered">
     [% IF ( BIGLOOP ) %]<ul>
     [% FOREACH BIGLOO IN BIGLOOP %]
-        <li><a href="#tab[% BIGLOO.number %]XX">[% BIGLOO.number %]</a></li>
+        <li><a href="#tab[% BIGLOO.number | html %]XX">[% BIGLOO.number | html %]</a></li>
     [% END %]
     </ul>[% END %]
     <!-- RESET PAGINATION -->
     [% FOREACH BIGLOO IN BIGLOOP %]
     [% IF ( BIGLOO.number ) %]
-        <div id="tab[% BIGLOO.number %]XX">
+        <div id="tab[% BIGLOO.number | html %]XX">
     [% ELSE %]
-        <div id="tab[% BIGLOO.number %]XX">
+        <div id="tab[% BIGLOO.number | html %]XX">
     [% END %]
-            <h2> [% BIGLOO.hdr_tab %]</h2>
+            <h2> [% BIGLOO.hdr_tab | html %]</h2>
             <a href="#" class="button" onclick="add_macles('630');">Envoyer</a>
             <!-- <input type="submit" class="button" value="Envoyer" /> -->
             <a class="button" href="" onclick="load_macles(630);">R&eacute;initialiser</a>
-            <a class="button" href="javascript:uncheck_tab([% BIGLOO.number %])">d&eacute;selectionner onglet</a>
+            <a class="button" href="javascript:uncheck_tab([% BIGLOO.number | html %])">d&eacute;selectionner onglet</a>
             <input type="reset" class="button" value="déselectionner tout" />
             [% IF ( BIGLOO.Table ) %]
             <table>
                 <tr>
                 <th>Espace\Temps</th>
                 [% FOREACH col_hd IN BIGLOO.col_hdr %]
-                    <th scope="col" id="[% col_hd.colvalue %]">  [% col_hd.collib |html %] <br /><input type="checkbox" name="[% col_hd.colvalue %]" onclick="check_col('[% col_hd.colvalue %]')" />
+                    <th scope="col" id="[% col_hd.colvalue | html %]">  [% col_hd.collib | html %] <br /><input type="checkbox" name="[% col_hd.colvalue | html %]" onclick="check_col('[% col_hd.colvalue | html %]')" />
                     </th>
                 [% END %]
                 </tr>
                 [% FOREACH line IN BIGLOO.lines %]
                 <tr>
-                    <th scope="row" id="[% line.rowvalue %]">  [% line.rowlib |html %] <br /><input type="checkbox" name="[% line.rowvalue %]" onclick="check_row('[% line.rowvalue %]')" />
+                    <th scope="row" id="[% line.rowvalue | html %]">  [% line.rowlib | html %] <br /><input type="checkbox" name="[% line.rowvalue | html %]" onclick="check_row('[% line.rowvalue | html %]')" />
                     </th>
                     [% FOREACH cell IN line.cells %]
-                    <td headers="[% cell.rowvalue %] [% cell.colvalue %]">
-                    [% BLOCK spantitle %][% FOREACH lib IN cell.libs %][% lib.lib |html %] - [% END %][% END %]
+                    <td headers="[% cell.rowvalue | html %] [% cell.colvalue | html %]">
+                    [% BLOCK spantitle %][% FOREACH lib IN cell.libs %][% lib.lib | html %] - [% END %][% END %]
                     <span title="[% INCLUDE spantitle %]">
-                    [% cell.celvalue %] <br /><input type="checkbox" name="[% cell.celvalue %]" value="[% cell.celvalue %]" />
+                    [% cell.celvalue | html %] <br /><input type="checkbox" name="[% cell.celvalue | html %]" value="[% cell.celvalue | html %]" />
                     </span>
                     </td>
                     [% END %]
             [% IF ( BIGLOO.Lists ) %]
             <h2>s&eacute;lection au moyen d'une liste de descripteurs</h2>
             [% FOREACH List IN BIGLOO.Lists %]
-                <h3>[% List.lib %]</h3>
+                <h3>[% List.lib | html %]</h3>
                 [% FOREACH liblis IN List.liblist %]
-                <a href="#[% liblis.listvalue %]" onclick="check_multiple([% liblis.listvalue %])"> [% liblis.listlib |html %]</a><br />
+                <a href="#[% liblis.listvalue | html %]" onclick="check_multiple([% liblis.listvalue | html %])"> [% liblis.listlib | html %]</a><br />
                 [% END %]
             [% END %]
             [% END %]
             [% UNLESS ( BIGLOO.Table ) %]
             <!-- Listes simples :Onglets 0 et 9-->
             [% FOREACH line IN BIGLOO.lines %]
-                <h3>[% line.rowvalue |html %]&nbsp;-&nbsp;[% line.rowlib |html %]&nbsp;<input type="checkbox" name="[% line.rowvalue %]" onclick="check_row('[% line.rowvalue %]')" /></h3>
+                <h3>[% line.rowvalue | html %]&nbsp;-&nbsp;[% line.rowlib | html %]&nbsp;<input type="checkbox" name="[% line.rowvalue | html %]" onclick="check_row('[% line.rowvalue | html %]')" /></h3>
                 [% FOREACH cell IN line.cells %]
-                <p>[% cell.celvalue |html %]&nbsp;-&nbsp;[% FOREACH lib IN cell.libs %]
-                        [% lib.lib |html %] &nbsp;
+                <p>[% cell.celvalue | html %]&nbsp;-&nbsp;[% FOREACH lib IN cell.libs %]
+                        [% lib.lib | html %] &nbsp;
                     [% END %]
-                    <input type="checkbox" name="[% cell.celvalue %]" value="[% cell.celvalue %]" />
+                    <input type="checkbox" name="[% cell.celvalue | html %]" value="[% cell.celvalue | html %]" />
                 </p>
                 [% END %]
             [% END %]
@@ -131,10 +131,10 @@ function add_macles(myvalue)
       mycountMACLESgen++;
     }
   }
-  if (mycountMACLESgen==1){opener.document.f.[% index %].value = tab[0];
+  if (mycountMACLESgen==1){opener.document.f.[% index | html %].value = tab[0];
   } else {
     var mytags=opener.document.getElementsByTagName("input");
-    var index_string="[% index %]";
+    var index_string="[% index | html %]";
     index_string=index_string.substr(0,index_string.lastIndexOf("_"));  
     index_string=index_string.substr(0,index_string.lastIndexOf("_"));
     index_string=index_string+".*";    
@@ -228,7 +228,7 @@ function check_row(row)
 function load_macles()
 {
   document.forms.f_pop.reset;
-  var mystart="[% index %]";
+  var mystart="[% index | html %]";
   mystart=mystart.substr(0,mystart.lastIndexOf("_"));  
   mystart=mystart.substr(0,mystart.lastIndexOf("_"));
   mystart=mystart+".*";    
index 524687a..f9cfaae 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
     <tr id="tr_result">
     </tr>
 </table>
-<h4 id="h4_result">&quot;[% result %]&quot;</h4>
+<h4 id="h4_result">&quot;[% result | html %]&quot;</h4>
 
 <form name="f_pop" id="f_pop" onsubmit="report()" action="">
 <input type="hidden" name="plugin_name" value="marc21_field_006.pl" />
-<input type="hidden" id="[% index %]" name="index" value="[% index %]" />
-<input type="hidden" id="result" name="result" value="[% result %]" />
+<input type="hidden" id="[% index | html %]" name="index" value="[% index | html %]" />
+<input type="hidden" id="result" name="result" value="[% result | html %]" />
 <table id="table_material_types">
     <tr id="tr_material_types">
         <td><label for="material_type" title="Select a type of material to specify the variable values">Type of material</label></td>
@@ -32,7 +33,7 @@
 </form>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/xmlControlfield.js") %]
+    [% Asset.js("js/xmlControlfield.js") | $raw %]
     <script type="text/javascript">
         var objXmlControlField;
         var tr_result;
 
         function loadXmlValues(){
             [% IF ( errorXml ) %]
-            alert("[% errorXml %]");
+            alert("[% errorXml | html %]");
             [% ELSE %]
             var form = document.f_pop;
             h4_result = document.getElementById("h4_result");
             tr_result = document.getElementById("tr_result");
-            objXmlControlField = new xmlControlField('[% tagfield %]', 'f_pop', document.getElementById('material_type'), document.getElementById('table_material_types'), 'h4_result', 'tr_result', '', '[% themelang %]', '[% marcflavour %]');
+            objXmlControlField = new xmlControlField('[% tagfield | html %]', 'f_pop', document.getElementById('material_type'), document.getElementById('table_material_types'), 'h4_result', 'tr_result', '', '[% themelang | html %]', '[% marcflavour | html %]');
             [% IF ( material_configuration ) %]
-            objXmlControlField.idMaterial = "[% material_configuration %]";
+            objXmlControlField.idMaterial = "[% material_configuration | html %]";
             [% END %]
             objXmlControlField.loadXmlValues();
             renderResult(tr_result, (form.result.value != "")?form.result.value:returnValueParam("result"));
@@ -64,7 +65,7 @@
 
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.getElementById("result").value;
             self.close();
             return false;
index 320293d..b0e3fe8 100644 (file)
@@ -4,7 +4,7 @@
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
-<body id="cat_marc21_field_007" class="cat" style="padding:1em;" onload="RedrawChoices('[% f0 %]');">
+<body id="cat_marc21_field_007" class="cat" style="padding:1em;" onload="RedrawChoices('[% f0 | html %]');">
 <h3>007 Physical description fixed field--General information</h3>
 <form id="f_pop" onsubmit="report()" action="">
 <input type="hidden" name="plugin_name" value="marc21_field_007.pl" />
@@ -97,7 +97,7 @@
 <script type="text/javascript">
     function report() {
         var doc = opener.document;
-        var field = doc.getElementById("[% index %]");
+        var field = doc.getElementById("[% index | html %]");
         var tmpstr = document.getElementById("MatTypeList").value;
         var i = 1;
         do {
                     '</label> <br /><I>' +
                     _("(if exact bit depth known, enter; <br />otherwise use pulldown)") +
                     '</i></td> \
-                                <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 %][% f7 %][% f8 %]" />- <label for="f6pulldown">' +
+                                <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 | html %][% f7 | html %][% f8 | html %]" />- <label for="f6pulldown">' +
                     _("Exact bit depth 001-999") +
                     '</label> \
                                  <select id="f6pulldown" name="f6pulldown" onchange="editER_fld6(this.options[selectedIndex].value)"> \
                     '</label> <br /><I>' +
                     _("(three digits, pad with zero as needed, <br />or ||| for no attempt to code)") +
                     '</i></td> \
-                                <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 %][% f7 %][% f8 %]"> - 001-999</input> \
+                                <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 | html %][% f7 | html %][% f8 | html %]"> - 001-999</input> \
                                 </td> \
                                </td> \
                               <tr> \
                     '</label><br /><I>' +
                     _("(YYYYMM; use up to 6 - for unknown <br />or | for no attempt to code)") +
                     '</i></td> \
-                                <td><input type="text" size=6 name="f17" id = "f17" value="[% f17 %][% f18 %][% f19 %][% f20 %][% f21 %][% f22 %]">- ' +
+                                <td><input type="text" size=6 name="f17" id = "f17" value="[% f17 | html %][% f18 | html %][% f19 | html %][% f20 | html %][% f21 | html %][% f22 | html %]">- ' +
                     _("Date") +
                     '</input> \
                                 </td> \
index d28c2c1..bd9a95b 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -12,7 +13,7 @@
     <tr id="tr_result">
     </tr>
 </table>
-<h4 id="h4_result">&quot;[% result %]&quot;</h4>
+<h4 id="h4_result">&quot;[% result | html %]&quot;</h4>
 
 <form name="f_pop" id="f_pop" onsubmit="report()" action="">
     <div id="toolbar">
@@ -25,8 +26,8 @@
     </div>
 
 <input type="hidden" name="plugin_name" value="marc21_field_008.pl" />
-<input type="hidden" id="[% index %]" name="index" value="[% index %]" />
-<input type="hidden" name="result" id="result" value="[% result %]" />
+<input type="hidden" id="[% index | html %]" name="index" value="[% index | html %]" />
+<input type="hidden" name="result" id="result" value="[% result | html %]" />
 <table id="table_material_types">
     <tr id="tr_material_types">
         <td><label for="material_type" title="Select a type of material to specify the variable values">Type of Material</label></td>
@@ -41,8 +42,8 @@
 </form>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-    [% Asset.js("js/xmlControlfield.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+    [% Asset.js("js/xmlControlfield.js") | $raw %]
     <script>
         $(document).ready(function(){
             $('#toolbar').fixFloat();
 
         function loadXmlValues(){
             [% IF ( errorXml ) %]
-                alert("[% errorXml %]");
+                alert("[% errorXml | html %]");
             [% ELSE %]
                 var form = document.f_pop;
                 h4_result = document.getElementById("h4_result");
                 tr_result = document.getElementById("tr_result");
-                objXmlControlField = new xmlControlField('[% tagfield %]', 'f_pop', document.getElementById('material_type'), document.getElementById('table_material_types'), 'h4_result', 'tr_result', '', '[% themelang %]', '[% marcflavour %]');
+                objXmlControlField = new xmlControlField('[% tagfield | html %]', 'f_pop', document.getElementById('material_type'), document.getElementById('table_material_types'), 'h4_result', 'tr_result', '', '[% themelang | html %]', '[% marcflavour | html %]');
                 [%# If material type configuration is found using the leader, use that type when rendering. Otherwise, the default of BKS will be used %]
                 [% IF ( material_configuration ) %]
-                    objXmlControlField.idMaterial = "[% material_configuration %]";
+                    objXmlControlField.idMaterial = "[% material_configuration | html %]";
                 [% END %]
                 objXmlControlField.loadXmlValues();
                 renderResult(tr_result, (form.result.value != "")?form.result.value:returnValueParam("result"));
@@ -82,7 +83,7 @@
 
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.getElementById("result").value;
             self.close();
             return false;
index e80c679..12f86de 100644 (file)
@@ -8,11 +8,11 @@
 <h3> 008 Fixed-length data elements</h3>
 <form name="f_pop" onsubmit="report()" action="">
 <input type="hidden" name="plugin_name" value="marc21_field_008_authorities.pl" />
-<input name="f1" value="[% f1 %]" type="hidden" />
+<input name="f1" value="[% f1 | html %]" type="hidden" />
 <table>
        <tr>
                <td>00-05- Date entered on file</td>
-               <td>[% f1 %]</td>
+               <td>[% f1 | html %]</td>
        </tr>
        <tr>
                <td><label for="f6">06- Direct or indirect geographic subdivision</label></td>
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =
             document.f_pop.f1.value +
index e65f2aa..2dcb4b4 100644 (file)
@@ -8,11 +8,11 @@
 <h3> 008 Fixed-length data elements</h3>
 <form name="f_pop" onsubmit="report()" action="">
 <input type="hidden" name="plugin_name" value="marc21_field_008_classifications.pl" />
-<input name="f1" value="[% f1 %]" type="hidden" />
+<input name="f1" value="[% f1 | html %]" type="hidden" />
 <table>
     <tr>
         <td>00-05- Date entered on file</td>
-        <td>[% f1 %]</td>
+        <td>[% f1 | html %]</td>
     </tr>
     <tr>
         <td><label for="f6">06- Kind of record</label></td>
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =
                 document.f_pop.f1.value +
                 document.f_pop.f6.value +
index de5c453..74833e7 100644 (file)
     <script type="text/javascript">
         function report() {
                 var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =
                 '     '+
                 document.f_pop.f5.value +
index 682720f..9443192 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =
             '     '+
             document.f_pop.f5.value +
index 0b498d5..4b71b80 100644 (file)
@@ -19,8 +19,8 @@
 
                      <p>
                             <input type="hidden" name="plugin_name" value="marc21_linking_section.pl" />
-                           <input type="hidden" name="index" value="[% index %]" />
-                               <input type="hidden" name="result" value="marc12 field 7 [% index %]" />
+                           <input type="hidden" name="index" value="[% index | html %]" />
+                               <input type="hidden" name="result" value="marc12 field 7 [% index | html %]" />
                                <input type="hidden" name="op" value="do_search" />
                             <label class="label100" for="searchbox">Any word</label>
                                <input type="text" name="search" id="searchbox" size="35" /><br />
@@ -28,7 +28,7 @@
                                <select name="itype" id="itypeloop">
                            <option value="" selected="selected">All Item Types</option>
                                [% FOREACH itypeloo IN itypeloop %]
-                             <option value="[% itypeloo.itemtype %]">[% itypeloo.description %]</option>
+                             <option value="[% itypeloo.itemtype | html %]">[% itypeloo.description | html %]</option>
                               [% END %]
                               </select>
                       </p>
 
            <h2>Search results</h2>
                 <div id="MARC21_Linking_section__resultnumber">
-                        <p>[% IF ( displayprev ) %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;startfrom=[% startfromprev %]&amp;search=[% search %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">&lt;&lt; Previous</a>[% END %]
+                        <p>[% IF ( displayprev ) %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromprev | html %]&amp;search=[% search | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">&lt;&lt; Previous</a>[% END %]
                               [% FOREACH number IN numbers %]
-                                [% IF ( number.highlight ) %] <span class="highlight">[% number.number %]</span>
-                                [% ELSE %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;startfrom=[% number.startfrom %]&amp;search=[% number.search |url %]&amp;resultsperpage=[% number.resultsperpage %]&amp;type=intranet&amp;op=do_search">[% number.number %]</a>
+                                [% IF ( number.highlight ) %] <span class="highlight">[% number.number | html %]</span>
+                                [% ELSE %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;startfrom=[% number.startfrom | html %]&amp;search=[% number.search |url %]&amp;resultsperpage=[% number.resultsperpage | html %]&amp;type=intranet&amp;op=do_search">[% number.number | html %]</a>
                                 [% END %]
                                 [% END %]
                                 [% IF ( displaynext ) %]
-                                  <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;startfrom=[% startfromnext %]&amp;search=[% search %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">Next&gt;&gt;</a>
+                                  <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromnext | html %]&amp;search=[% search | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">Next&gt;&gt;</a>
                                 [% END %]</p>
                   <p class="resultcount">
-                          [% IF ( total ) %]Results [% from %] to [% to %] of [% total %]
+                          [% IF ( total ) %]Results [% from | html %] to [% to | html %] of [% total | html %]
                           [% ELSE %]No results found
                           [% END %]</p></div>
             <div id="resultlist">
                                     [% IF ( resul.even ) %]<td class="hilighted">
                                     [% ELSE %]<td>[% END %]
                                                             [% IF ( resul.MARC_ON ) %]
-                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/MARCdetail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title |html %]</a>
+                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/MARCdetail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title | html %]</a>
                                                             [% ELSE %]
-                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title |html %]</a>
+                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title | html %]</a>
                                                             [% END %]
-                                                    <p>[% resul.author %]
-                                                    [% IF ( resul.publishercode ) %]- [% resul.publishercode %][% END %]
-                                                    [% IF ( resul.place ) %] ; [% resul.place %][% END %]
-                                                    [% IF ( resul.pages ) %] - [% resul.pages %][% END %]
-                                                    [% IF ( resul.notes ) %] : [% resul.notes %][% END %]
-                                                    [% IF ( resul.size ) %] ; [% resul.size %][% END %]
+                                                    <p>[% resul.author | html %]
+                                                    [% IF ( resul.publishercode ) %]- [% resul.publishercode | html %][% END %]
+                                                    [% IF ( resul.place ) %] ; [% resul.place | html %][% END %]
+                                                    [% IF ( resul.pages ) %] - [% resul.pages | html %][% END %]
+                                                    [% IF ( resul.notes ) %] : [% resul.notes | html %][% END %]
+                                                    [% IF ( resul.size ) %] ; [% resul.size | html %][% END %]
                                             </p>
                                   </td>
 
                                  <td>
                       [% IF ( resul.biblionumber ) %]
-                                             <a href="javascript:jumpfull('/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;biblionumber=[% resul.biblionumber %]&amp;type=intranet&amp;op=fillinput')">Choose</a>
+                                             <a href="javascript:jumpfull('/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;biblionumber=[% resul.biblionumber | html %]&amp;type=intranet&amp;op=fillinput')">Choose</a>
                       [% ELSE %]
-                                             <a href="javascript:jumpfull('/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;type=intranet&amp;op=fillinput')">Clear field</a>
+                                             <a href="javascript:jumpfull('/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;type=intranet&amp;op=fillinput')">Clear field</a>
                       [% END %]
                                    </td>
                           </tr>
@@ -97,7 +97,7 @@
          <div id="resultnumber">
                         <p>
                             [% IF ( displayprev ) %]
-                               <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;amp;index=[% index %]&amp;amp;startfrom=[% startfromprev %]&amp;amp;search=[% search |url %]&amp;amp;resultsperpage=[% resultsperpage %]&amp;amp;type=intranet&amp;amp;op=do_search">
+                               <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;amp;index=[% index | html %]&amp;amp;startfrom=[% startfromprev | html %]&amp;amp;search=[% search |url %]&amp;amp;resultsperpage=[% resultsperpage | html %]&amp;amp;type=intranet&amp;amp;op=do_search">
                                      &lt;&lt; Previous
                               </a>
                            [% END %]
                              [% FOREACH number IN numbers %]
                                         [% IF ( number.highlight ) %]
                                           <span class="highlight">
-                                                       [% number.number %]
+                                                       [% number.number | html %]
                                             </span>
                                         [% ELSE %]
-                                             <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;startfrom=[% number.startfrom %]&amp;search=[% number.search %]&amp;resultsperpage=[% number.resultsperpage %]&amp;type=intranet&amp;op=do_search">
-                                                 [% number.number %]
+                                             <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;startfrom=[% number.startfrom | html %]&amp;search=[% number.search | html %]&amp;resultsperpage=[% number.resultsperpage | html %]&amp;type=intranet&amp;op=do_search">
+                                                 [% number.number | html %]
                                             </a>
                                    [% END %]
                               [% END %]
 
                              [% IF ( displaynext ) %]
-                               <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index %]&amp;startfrom=[% startfromnext %]&amp;search=[% search %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">
+                               <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=marc21_linking_section.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromnext | html %]&amp;search=[% search | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">
                                   Next&gt;&gt;
                            </a>
                            [% END %]
         <script type="text/javascript">
             function go() {
 
-                var index_start = "[% index %]";
+                var index_start = "[% index | html %]";
                 var whichfield;
                 try {
                     whichfield = opener.opener.document.getElementById(index_start);
                         var subfield = subfields[i + 1];
 
                         if (code.value == '9') {
-                            subfield.value = "[% subfield_value_9 %]";
+                            subfield.value = "[% subfield_value_9 | html %]";
                         }
                         if (code.value == '0') {
-                            subfield.value = "[% subfield_value_0 %]";
+                            subfield.value = "[% subfield_value_0 | html %]";
                         }
                         if (code.value == 'a') {
-                            subfield.value = "[% subfield_value_a %]";
+                            subfield.value = "[% subfield_value_a | html %]";
                         }
                         if (code.value == 'c') {
-                            subfield.value = "[% subfield_value_c %]";
+                            subfield.value = "[% subfield_value_c | html %]";
                         }
                         if (code.value == 'd') {
-                            subfield.value = "[% subfield_value_d %]";
+                            subfield.value = "[% subfield_value_d | html %]";
                         }
                         if (code.value == 'e') {
-                            subfield.value = "[% subfield_value_e %]";
+                            subfield.value = "[% subfield_value_e | html %]";
                         }
                         if (code.value == 'h') {
-                            subfield.value = "[% subfield_value_h %]";
+                            subfield.value = "[% subfield_value_h | html %]";
                         }
                         if (code.value == 'i') {
-                            subfield.value = "[% subfield_value_i %]";
+                            subfield.value = "[% subfield_value_i | html %]";
                         }
                         if (code.value == 'p') {
-                            subfield.value = "[% subfield_value_p %]";
+                            subfield.value = "[% subfield_value_p | html %]";
                         }
                         if (code.value == 't') {
-                            subfield.value = "[% subfield_value_t %]";
+                            subfield.value = "[% subfield_value_t | html %]";
                         }
                         if (code.value == 'u') {
-                            subfield.value = "[% subfield_value_u %]";
+                            subfield.value = "[% subfield_value_u | html %]";
                         }
                         if (code.value == 'v') {
-                            subfield.value = "[% subfield_value_v %]";
+                            subfield.value = "[% subfield_value_v | html %]";
                         }
                         if (code.value == 'w') {
-                            subfield.value = "[% subfield_value_w %]";
+                            subfield.value = "[% subfield_value_w | html %]";
                         }
                         if (code.value == 'x') {
-                            subfield.value = "[% subfield_value_x %]";
+                            subfield.value = "[% subfield_value_x | html %]";
                         }
                         if (code.value == 'y') {
-                            subfield.value = "[% subfield_value_y %]";
+                            subfield.value = "[% subfield_value_y | html %]";
                         }
                         if (code.value == 'z') {
-                            subfield.value = "[% subfield_value_z %]";
+                            subfield.value = "[% subfield_value_z | html %]";
                         }
                     }
                 }
index 503af7a..3eea363 100644 (file)
@@ -2,7 +2,7 @@
 <title>Koha &rsaquo; Cataloging &rsaquo; 007 feltbygger</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
-<body id="cat_normarc_field_007" class="cat" style="padding:1em;" onload="RedrawChoices('[% f0 %]');">
+<body id="cat_normarc_field_007" class="cat" style="padding:1em;" onload="RedrawChoices('[% f0 | html %]');">
 <h3>007 Fysisk beskrivelse av dokumentet</h3>
 <form id="f_pop" onsubmit="report()">
 <input type="hidden" name="plugin_name" value="normarc_field_007.pl" />
@@ -73,7 +73,7 @@
 //<![CDATA[
 function report() {
             var doc   = opener.document; 
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             var tmpstr = document.getElementById("MatTypeList").value;
             var i=1;
             do{
@@ -1223,7 +1223,7 @@ function RedrawChoices(typ){
                            </td> \
                           <tr> \
                            <td><label for="f6">06-08 Reduksjonsskala - Nøyaktig angivelse</label> <br /><I>(Skalaen oppgis med tre sifre, f.eks. 015, 048). En strek brukes for ukjente sifre (f.eks. 03-, 1--). Bruk ||| dersom info ikke er oppgitt.)</i></td> \
-                               <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 %][% f7 %][% f8 %]"> - 001-999</input> \
+                               <td><input type="text" size=3 name="f6" id = "f6" value="[% f6 | html %][% f7 | html %][% f8 | html %]"> - 001-999</input> \
                             </td> \
                            </td> \
                           <tr> \
@@ -2343,7 +2343,7 @@ function RedrawChoices(typ){
                           </tr> \
                           <tr> \
                            <td><label for="f17">17-22 Dato for siste inspeksjon av filmen</label><br /><I>(Registreres med 6 siffer i formen Ã¥Ã¥Ã¥Ã¥mm. Hvis deler av datoen ikke er kjent, erstattes hvert ukjent siffer med en strek (-).)</i></td> \
-                               <td><input type="text" size=6 name="f17" id = "f17" value="[% f17 %][% f18 %][% f19 %][% f20 %][% f21 %][% f22 %]"> Dato</input> \
+                               <td><input type="text" size=6 name="f17" id = "f17" value="[% f17 | html %][% f18 | html %][% f19 | html %][% f20 | html %][% f21 | html %][% f22 | html %]"> Dato</input> \
                             </td> \
                            </td> \
                         </table>';  
index 14101b1..72038a0 100644 (file)
@@ -54,7 +54,7 @@
 
        <tr>
                <td>00-05 Registreringsdato</td>
-               <td><input type="text" name="f1" maxlength="6" size="7" value="[% f1 %]" /></td>
+               <td><input type="text" name="f1" maxlength="6" size="7" value="[% f1 | html %]" /></td>
        </tr>
        <tr>
                <!-- 06 Type of date / Publication status -->
        <tr>
                <td><label for="f710">07-10 Ã…rstall 1</label></td>
                <td>
-                       <input type="text" name="f710" id="f710" size="4" maxlength="4" value="[% f710 %]"/>
+                       <input type="text" name="f710" id="f710" size="4" maxlength="4" value="[% f710 | html %]"/>
                </td>
        </tr>
        <tr>
     <td><label for="f1114">11-14 Ã…rstall 2</label></td>
     <td>
-      <input type="text" name="f1114" id="f1114" size="4" maxlength="4" value="[% f1114 %]"/>
+      <input type="text" name="f1114" id="f1114" size="4" maxlength="4" value="[% f1114 | html %]"/>
                </td>
   </tr>
 
        <tr>
       <td><label for="f1517">15-17 Utgivelsesland</label> (Se <a href="http://www.nb.no/baser/landekoder/">NORMARC-koder for land</a>)</td>
       <td>
-              <input type="text" name="f1517" id="f1517" size="3"  maxlength="3" value="[% f1517 %]"/> <!-- Default is set by the DefaultLanguageField008 syspref -->
+              <input type="text" name="f1517" id="f1517" size="3"  maxlength="3" value="[% f1517 | html %]"/> <!-- Default is set by the DefaultLanguageField008 syspref -->
       </td>
         </tr>
                                
        <tr>
                 <td><label for="f3537">35-37 SprÃ¥k</label> (Se <a href="http://www.nb.no/baser/sprakkoder/">NORMARC-koder for sprÃ¥k</a>)</td>
                 <td>
-                        <input type="text" name="f3537" id="f3537" size="4"  maxlength="4" value="[% f3537 %]"/>
+                        <input type="text" name="f3537" id="f3537" size="4"  maxlength="4" value="[% f3537 | html %]"/>
                 </td>
         </tr>
        <tr>
@@ -4482,7 +4482,7 @@ function pad4(s) {
 
 function report() {
             var doc   = opener.document; 
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = 
                        document.f_pop.f1.value+
                        document.f_pop.f6.value+
index a99d78e..866ba15 100644 (file)
 //<![CDATA[
 function report() {
             var doc   = opener.document; 
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
         
             field.value = 
                        '     '+
index 12a394f..bcf5ad5 100644 (file)
@@ -10,7 +10,7 @@
 <table>
     <tr>
         <td><label for="f1">Date entered on file</label></td>
-        <td><input type="text" name="f1" id="f1" maxlength="8" size="9" value="[% f1 %]" /></td>
+        <td><input type="text" name="f1" id="f1" maxlength="8" size="9" value="[% f1 | html %]" /></td>
     </tr>
     <tr>
         <td><label for="f2">Type of publication date: Publication dates 1 and 2</label></td>
@@ -100,11 +100,11 @@ year</option>
     </tr>
     <tr>
         <td><label for="f3">Publication date 1</label></td>
-        <td><input type="text" name="f3" id="f3" maxlength="4" size="5" value="[% f3 %]" /></td>
+        <td><input type="text" name="f3" id="f3" maxlength="4" size="5" value="[% f3 | html %]" /></td>
     </tr>
     <tr>
     <td><label for="f4">Publication Date 2</label></td>
-    <td><input type="text" name="f4" id="f4" maxlength="4" size="5" value="[% f4 %]" /></td>
+    <td><input type="text" name="f4" id="f4" maxlength="4" size="5" value="[% f4 | html %]" /></td>
     </tr>
     <tr>
         <td><label for="f5">Target audience code</label></td>
@@ -390,7 +390,7 @@ level)</option>
 
     <tr>
     <td><label for="f10">Language of cataloguing (mandatory)</label></td>
-    <td><input type="text" name="f10" id="f10" maxlength="3" size="4" value="[% f10 %]" /></td>
+    <td><input type="text" name="f10" id="f10" maxlength="3" size="4" value="[% f10 | html %]" /></td>
     </tr>
 
     <tr>
@@ -578,7 +578,7 @@ languages and obsolete typography)</option>
     <tr>
         <td><label for="f14">Additional character sets</label></td>
         <td>
-            <input type="text" name="f14" id="f14" maxlength="4" size="5" value="[% f14 %]" />
+            <input type="text" name="f14" id="f14" maxlength="4" size="5" value="[% f14 | html %]" />
         </td>
     </tr>
 
@@ -690,7 +690,7 @@ languages and obsolete typography)</option>
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             document.f_pop.f1.value=document.f_pop.f1.value+'        ';
             document.f_pop.f3.value=document.f_pop.f3.value+'    ';
index a13ab33..d812eee 100644 (file)
@@ -10,7 +10,7 @@
 <table>
     <tr>
         <td><label for="f1">Date entered on file</label></td>
-        <td><input type="text" name="f1" id="f1" maxlength="8" size="9" value="[% f1 %]" /></td>
+        <td><input type="text" name="f1" id="f1" maxlength="8" size="9" value="[% f1 | html %]" /></td>
     </tr>
     <tr>
         <td><label for="f2">States of authority heading code</label></td>
@@ -37,7 +37,7 @@
 
     <tr>
     <td><label for="f3">Language of cataloguing (mandatory)</label></td>
-    <td><input type="text" name="f3" id="f3" maxlength="3" size="4" value="[% f3 %]" /></td>
+    <td><input type="text" name="f3" id="f3" maxlength="3" size="4" value="[% f3 | html %]" /></td>
     </tr>
 
     <tr>
@@ -225,7 +225,7 @@ languages and obsolete typography)</option>
     <tr>
         <td><label for="f7">Additional character sets</label></td>
         <td>
-            <input type="text" name="f7" id="f7" maxlength="4" size="5" value="[% f7 %]" />
+            <input type="text" name="f7" id="f7" maxlength="4" size="5" value="[% f7 | html %]" />
         </td>
     </tr>
 
@@ -355,7 +355,7 @@ languages and obsolete typography)</option>
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             document.f_pop.f1.value=document.f_pop.f1.value+'        ';
             document.f_pop.f3.value=document.f_pop.f3.value+'   ';
index 5511ef4..af3d62d 100644 (file)
     <script type="text/javascript">
         function report() {
                 var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
 
                 field.value = document.f_pop.f1.value + document.f_pop.f2.value +document.f_pop.f3.value +document.f_pop.f4.value +document.f_pop.f5.value +document.f_pop.f6.value +document.f_pop.f7.value +document.f_pop.f8.value +document.f_pop.f9.value +document.f_pop.f10.value +document.f_pop.f11.value +document.f_pop.f12.value +document.f_pop.f13.value;
                 window.close();
index a418529..10a2845 100644 (file)
@@ -90,7 +90,7 @@ supplement)</option>
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value = document.f_pop.f1.value;
             self.close();
index a8ea826..f7c655d 100644 (file)
         </tr>
    <tr>
                 <td><label for="f5">Nature of contents code</label></td>
-                <td><input type="text" name="f5" id="f5" maxlength="3" size="4" value="[% f5 %]" /></td>
+                <td><input type="text" name="f5" id="f5" maxlength="3" size="4" value="[% f5 | html %]" /></td>
 
        </tr>
        <tr>
             document.f_pop.f5.value=document.f_pop.f5.value+'   ';
             document.f_pop.f5.value=document.f_pop.f5.value.substring(0,3);
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value +document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value;
             self.close();
             return false;
index 7a8091b..df4ea4e 100644 (file)
@@ -40,7 +40,7 @@
 
    <tr>
                            <td><label for="f2">Length</label></td>
-                           <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                           <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 
        </tr>
 
             document.f_pop.f2.value=document.f_pop.f2.value.substring(0,3);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value +document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value+document.f_pop.f10.value+document.f_pop.f11.value+document.f_pop.f12.value+document.f_pop.f13.value+document.f_pop.f14.value+document.f_pop.f15.value+document.f_pop.f16.value+document.f_pop.f17.value+document.f_pop.f18.value;
             self.close();
index 80c0105..bb113c0 100644 (file)
 
                <tr>
                 <td>Film inspection date</td>
-                <td><label for="f10">Year</label> <input type="text" name="f10" id="f10" maxlength="4" size="5" value="[% f10 %]" /> <label for="f11">Month</label> <input type="text" name="f11" id="f11" maxlength="2" size="3" value="[% f11 %]" /></td>
+                <td><label for="f10">Year</label> <input type="text" name="f10" id="f10" maxlength="4" size="5" value="[% f10 | html %]" /> <label for="f11">Month</label> <input type="text" name="f11" id="f11" maxlength="2" size="3" value="[% f11 | html %]" /></td>
         </tr>
        </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
                 document.f_pop.f11.value=document.f_pop.f11.value.substring(0,2);
 
             var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value +document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value+document.f_pop.f10.value+document.f_pop.f11.value;
             self.close();
             return false;
index 9ddc3f1..a3aa313 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value +document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value+document.f_pop.f10.value+document.f_pop.f11.value;
             self.close();
             return false;
index 7acceaf..f2b4ec3 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value +document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value;
             self.close();
             return false;
index 98be444..df84a6e 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value + document.f_pop.f2.value +document.f_pop.f3.value +document.f_pop.f4.value +document.f_pop.f5.value +document.f_pop.f6.value +document.f_pop.f7.value +document.f_pop.f8.value +document.f_pop.f9.value +document.f_pop.f10.value;
             self.close();
             return false;
index 0514923..26ec46b 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value + document.f_pop.f2.value +document.f_pop.f3.value +document.f_pop.f4.value +document.f_pop.f5.value +document.f_pop.f6.value +document.f_pop.f7.value +document.f_pop.f8.value;
             self.close();
index cdeaea5..bf6fbcc 100644 (file)
@@ -51,7 +51,7 @@
                        </select>
                </td></tr>
                <tr>            <td><label for="f3">Spectral bands : 01 to 99 = number of bands, xx = not applicable</label></td>
-                  <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" />
+                  <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" />
                </td></tr>
 <tr>
                <td><label for="f4">Quality of image</label></td>
 
             document.f_pop.f3.value=document.f_pop.f3.value.substring(0,2);
             var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value + document.f_pop.f2.value +document.f_pop.f3.value +document.f_pop.f4.value +document.f_pop.f5.value +document.f_pop.f6.value +document.f_pop.f7.value;
             self.close();
             return false;
index 6e61d04..0dc37d0 100644 (file)
                 </tr>
                 <tr>
                 <td><label for="f2">Year</label></td>
-                  <td><input type="text" name="f2" id="f2" maxlength="4" size="5" value="[% f2 %]" />
+                  <td><input type="text" name="f2" id="f2" maxlength="4" size="5" value="[% f2 | html %]" />
                </td>
 
                <td><label for="f3">Month</label></td>
-                        <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                        <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
                <td><label for="f4">Day</label></td>
-                        <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                        <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
                <td><label for="f5">Time</label></td>
-                        <td><input type="text" name="f5" id="f5" maxlength="2" size="3" value="[% f5 %]" /></td>
+                        <td><input type="text" name="f5" id="f5" maxlength="2" size="3" value="[% f5 | html %]" /></td>
                </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -55,7 +55,7 @@
             document.f_pop.f5.value=document.f_pop.f5.value.substring(0,2);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value + document.f_pop.f2.value +document.f_pop.f3.value +document.f_pop.f4.value +document.f_pop.f5.value ;
             window.close();
index b48869e..36cd768 100644 (file)
@@ -36,7 +36,7 @@
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value;
             self.close();
             return false;
index 54cb77f..dc968c3 100644 (file)
                </td></tr>
 
 <tr>          <td><label for="f2">Degree (complete with 0):</label></td>
-                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f3">Minute (complete with 0):</label></td>
-                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f4">Second (complete with 0):</label></td>
-                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -59,7 +59,7 @@
             document.f_pop.f4.value=document.f_pop.f4.value.substring(0,2);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value;
             window.close();
             return false;
index ea2cf43..e1c346a 100644 (file)
                </td></tr>
 
 <tr>          <td><label for="f2">Degree (complete with 0):</label></td>
-                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f3">Minute (complete with 0):</label></td>
-                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f4">Second (complete with 0):</label></td>
-                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -59,7 +59,7 @@
             document.f_pop.f4.value=document.f_pop.f4.value.substring(0,2);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value;
             window.close();
index bb0d414..a8263b9 100644 (file)
                </td></tr>
 
 <tr>          <td><label for="f2">Degree (complete with 0):</label></td>
-                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f3">Minute (complete with 0):</label></td>
-                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f4">Second (complete with 0):</label></td>
-                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -59,7 +59,7 @@
             document.f_pop.f4.value=document.f_pop.f4.value.substring(0,2);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value;
             window.close();
index d256865..4414072 100644 (file)
                </td></tr>
 
 <tr>          <td><label for="f2">Degree (complete with 0):</label></td>
-                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f3">Minute (complete with 0):</label></td>
-                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f4">Second (complete with 0):</label></td>
-                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -59,7 +59,7 @@
             document.f_pop.f4.value=document.f_pop.f4.value.substring(0,2);
 
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value;
             window.close();
index 41381a4..9bc3054 100644 (file)
         </td></tr>
 
 <tr>          <td><label for="f2">Degree (complete with 0):</label></td>
-                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 %]" /></td>
+                         <td><input type="text" name="f2" id="f2" maxlength="3" size="4" value="[% f2 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f3">Minute (complete with 0):</label></td>
-                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 %]" /></td>
+                         <td><input type="text" name="f3" id="f3" maxlength="2" size="3" value="[% f3 | html %]" /></td>
 </tr>
 <tr>          <td><label for="f4">Second (complete with 0):</label></td>
-                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 %]" /></td>
+                         <td><input type="text" name="f4" id="f4" maxlength="2" size="3" value="[% f4 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -48,7 +48,7 @@
             var f4= "00" + document.f_pop.f4.value;
             f4 = f4.substring(f4.length-2);
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value+ f2 + f3 + f4;
             window.close();
             return false;
index 9c42aef..5c824cb 100644 (file)
@@ -37,7 +37,7 @@
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value = document.f_pop.f1.value;
             self.close();
@@ -46,4 +46,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 6d3e5d1..54b7c90 100644 (file)
@@ -78,7 +78,7 @@
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value;
             self.close();
@@ -87,4 +87,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index c820078..c826dcf 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index a2b5eeb..e7ef1b3 100644 (file)
@@ -37,7 +37,7 @@
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value;
             window.close();
             return false;
@@ -45,4 +45,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 44261c1..611f79a 100644 (file)
@@ -38,7 +38,7 @@
     <script type="text/javascript">
         function report() {
             var doc     = opener.document;
-                var field   = doc.getElementById("[% index %]");
+                var field   = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value;
             window.close();
             return false;
@@ -46,4 +46,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 2a6aab2..aad141c 100644 (file)
     <script type="text/javascript">
         function report() {
                 var doc   = opener.document;
-                var field = doc.getElementById("[% index %]");
+                var field = doc.getElementById("[% index | html %]");
                 field.value =  document.f_pop.f1.value;
             self.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index effdf26..d19031d 100644 (file)
@@ -73,7 +73,7 @@
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value;
             window.close();
             return false;
@@ -81,4 +81,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 10056b9..e66c64e 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value+document.f_pop.f2.value;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index feea0b1..d9cb372 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value;
             window.close();
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 253c899..36ae907 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value+document.f_pop.f10.value+document.f_pop.f11.value+document.f_pop.f12.value+document.f_pop.f13.value+document.f_pop.f14.value+document.f_pop.f15.value ;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 075c633..e67ae40 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value = document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value ;
             self.close();
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 5e8adc2..4dc7aef 100644 (file)
 <tr>          <td><label for="f1">Hours:</label></td>
                          <td><input type="text" name="f1" id="f1" maxlength="2"
                          size="3"
-                   value="[% f1 %]" /></td>
+                   value="[% f1 | html %]" /></td>
           <td><label for="f2">Minutes:</label></td>
                          <td><input type="text" name="f2" id="f2" maxlength="2"
                          size="3"
-                   value="[% f2 %]" /></td>
+                   value="[% f2 | html %]" /></td>
           <td><label for="f3">Seconds:</label></td>
                          <td><input type="text" name="f3" id="f3" maxlength="2"
                          size="3"
-                   value="[% f3 %]" /></td>
+                   value="[% f3 | html %]" /></td>
 </tr>
 </table>
 <fieldset class="action"><input type="button" value="OK" onclick="report();" /> <a href="#" class="cancel close">Cancel</a></fieldset>
@@ -38,7 +38,7 @@
             document.f_pop.f3.value=document.f_pop.f3.value.substring(0,2);
 
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value = document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value;
             self.close();
@@ -47,4 +47,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index bba00eb..8930ad1 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index e92cbb6..5ebcff0 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f1.value;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index d5aa78d..5900494 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value;
             window.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index b486896..138435d 100644 (file)
     <tr>
                 <td><label for="f5">Specific reduction ratio</label></td>
                 <td><input type="text" name="f5" id="f5" maxlength="3" size="4" 
-value="[% f5 %]" /></td>
+value="[% f5 | html %]" /></td>
         </tr>
 
        <tr>
@@ -330,12 +330,12 @@ value="[% f5 %]" /></td>
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             document.f_pop.f5.value=document.f_pop.f5.value+'   ';
             document.f_pop.f5.value=document.f_pop.f5.value.substring(0,3);
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value ;
             window.close();
             return false;
@@ -343,4 +343,4 @@ value="[% f5 %]" /></td>
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index cd106f7..e1a73ab 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  document.f_pop.f1.value;
             window.close();
@@ -73,4 +73,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index c1eaf92..33df179 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value+document.f_pop.f9.value+document.f_pop.f10.value+document.f_pop.f11.value+document.f_pop.f12.value+document.f_pop.f13.value+document.f_pop.f14.value+document.f_pop.f15.value+document.f_pop.f16.value+document.f_pop.f17.value+document.f_pop.f18.value+document.f_pop.f19.value+document.f_pop.f20.value+document.f_pop.f21.value;
             self.close();
             return false;
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 6b1d6d2..a4a3252 100644 (file)
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var dateformat = "[% Koha.Preference('dateformat') %]";
+        var dateformat = "[% Koha.Preference('dateformat') | html %]";
         function report() {
             var doc = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value = document.f_pop.f1.value+document.f_pop.f2.value+document.f_pop.f3.value+document.f_pop.f4.value+document.f_pop.f5.value+document.f_pop.f6.value+document.f_pop.f7.value+document.f_pop.f8.value;
             self.close();
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 31797ad..c4970e5 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% PROCESS 'authorities-search-results.inc' %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
             <input type="hidden" name="plugin_name" value="unimarc_field_210c.pl" />
             <input type="hidden" name="op" value="do_search" />
             <input type="hidden" name="type" value="intranet" />
-            <input type="hidden" name="nbstatements" value="[% nbstatements %]" />
-            <input type="hidden" name="index" value="[% index %]" />
+            <input type="hidden" name="nbstatements" value="[% nbstatements | html %]" />
+            <input type="hidden" name="index" value="[% index | html %]" />
             <input type="hidden" name="authtypecode" value="EDITORS" />
-            <input type="hidden" name="q" value="[% index %]" />
+            <input type="hidden" name="q" value="[% index | html %]" />
             <input type="hidden" name="marclist" value="all" />
             <input type="hidden" name="and_or" value="and" />
             <input type="hidden" name="excluding" value="" />
@@ -32,7 +33,7 @@
                                    <option value="start">starts with</option>
                                    <option value="is">is exactly</option>
                                </select>
-                    <input type="text" id="value" name="value" value="[% resultstring %]" />
+                    <input type="text" id="value" name="value" value="[% resultstring | html %]" />
                     </li>
                 </ol>
                 </fieldset>
             [% IF ( total ) %]
             <h3>Authority search results</h3>
             <div class="pages">
-                          [% pagination_bar %]      
+                          [% pagination_bar | $raw %]
                         </div>[% END %]
             <p>
                 [% IF ( total ) %]
-                    &nbsp;<b>Results [% from %] to [% to %] of [% total %]</b><br /><br />
+                    &nbsp;<b>Results [% from | html %] to [% to | html %] of [% total | html %]</b><br /><br />
                 [% ELSE %]
                     &nbsp; No results found<br />
                 [% END %]
                 [% FOREACH resul IN result %]
                     <tr>
                         <td>[% PROCESS authresult summary=resul.summary %]</td>
-                        <td>[% resul.used %] times</td>
+                        <td>[% resul.used | html %] times</td>
                         <td>
                 [% IF ( resul.to_report ) %]
-                            <a href="javascript:report('[% resul.to_report |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]')"><img alt="choose" src="[% interface %]/[% theme %]/images/arrow.gif" width="32" /></a>
+                            <a href="javascript:report('[% resul.to_report |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]')"><img alt="choose" src="[% interface | html %]/[% theme | html %]/images/arrow.gif" width="32" /></a>
                 [% END %]
                         </td>
                     </tr>
@@ -76,7 +77,7 @@
 [% END %]
 
             [% IF ( total ) %]<div class="pages">
-                          [% pagination_bar %]      
+                          [% pagination_bar | $raw %]
                         </div>
             [% END %]
 
@@ -84,7 +85,7 @@
     <script type="text/javascript">
         function report(summary){
             var doc   = opener.document;
-            var field = doc.getElementById('[% index %]');
+            var field = doc.getElementById('[% index | html %]');
 
             field.value = summary;
             self.close();
@@ -92,4 +93,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 76b3ffc..c989fec 100644 (file)
@@ -28,7 +28,7 @@
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value =  document.f_pop.findvalue.value;
 
             window.close();
@@ -56,4 +56,4 @@
     </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 68a2ff2..efa16fc 100644 (file)
@@ -13,9 +13,9 @@
                 <select name="f1" id="f1" size="1">
                 [% FOREACH value IN collection.values %]
                   [% IF ( value == collection.default ) %]
-                    <option value="[% value %]" selected="selected">[% value %]</option>
+                    <option value="[% value | html %]" selected="selected">[% value | html %]</option>
                   [% ELSE %]
-                    <option value="[% value %]">[% value %]</option>
+                    <option value="[% value | html %]">[% value | html %]</option>
                   [% END %]
                 [% END %]
                 </select>
@@ -31,7 +31,7 @@
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
             field.value = document.f_pop.f2.value || document.f_pop.f1.value;
             window.close();
             return false;
index c86d9c9..f00576b 100644 (file)
@@ -41,7 +41,7 @@
             };
 
             $('form').submit(function() {
-                var field = opener.document.getElementById("[% index %]");
+                var field = opener.document.getElementById("[% index | html %]");
                 field.value = $('#findvalue').val();
 
                 window.close();
index 95e70ab..8f613ad 100644 (file)
@@ -15,8 +15,8 @@
        
                        <p>
                                <input type="hidden" name="plugin_name" value="unimarc_field_4XX.pl" />
-                               <input type="hidden" name="index" value="[% index %]" /> 
-                               <input type="hidden" name="result" value="unimarc field 4 [% index %]" />
+                               <input type="hidden" name="index" value="[% index | html %]" /> 
+                               <input type="hidden" name="result" value="unimarc field 4 [% index | html %]" />
                                <input type="hidden" name="op" value="do_search" />
                                <label class="label100" for="searchbox">Any word</label>
                                <input type="text" name="search" id="searchbox" size="35" /><br />
@@ -24,7 +24,7 @@
                                <select name="itype" id="itypeloop">
                 <option value="">All item types</option>
                                [% FOREACH itypeloo IN itypeloop %]
-                <option value="[% itypeloo.itemtype %]">[% itypeloo.description |html %]</option>
+                <option value="[% itypeloo.itemtype | html %]">[% itypeloo.description | html %]</option>
                                [% END %]
                                </select>
                        </p>
 
                <h2>Search results</h2>
                <div id="UNIMARC_Field_4XX_resultnumber">
-            <p>[% IF ( displayprev ) %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;startfrom=[% startfromprev %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">&lt;&lt; Previous</a>[% END %]
+            <p>[% IF ( displayprev ) %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromprev | html %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">&lt;&lt; Previous</a>[% END %]
                                [% FOREACH number IN numbers %]
-                                [% IF ( number.highlight ) %] <span class="highlight">[% number.number %]</span>
-                                [% ELSE %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;startfrom=[% number.startfrom %]&amp;search=[% number.search |uri %]&amp;resultsperpage=[% number.resultsperpage %]&amp;type=intranet&amp;op=do_search">[% number.number %]</a>
+                                [% IF ( number.highlight ) %] <span class="highlight">[% number.number | html %]</span>
+                                [% ELSE %] <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;startfrom=[% number.startfrom | html %]&amp;search=[% number.search |uri %]&amp;resultsperpage=[% number.resultsperpage | html %]&amp;type=intranet&amp;op=do_search">[% number.number | html %]</a>
                                 [% END %]
                                 [% END %]
                                 [% IF ( displaynext ) %]
-                                  <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;startfrom=[% startfromnext %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">Next&gt;&gt;</a>
+                                  <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromnext | html %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">Next&gt;&gt;</a>
                                 [% END %]</p>
                        <p class="resultcount">
-                          [% IF ( total ) %]Results [% from %] to [% to %] of [% total %]
+                          [% IF ( total ) %]Results [% from | html %] to [% to | html %] of [% total | html %]
                           [% ELSE %]No results found
                           [% END %]</p></div>
                <div id="resultlist">
                                     [% IF ( resul.even ) %]<td class="hilighted">
                                     [% ELSE %]<td>[% END %]
                                                             [% IF ( resul.MARC_ON ) %]
-                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/MARCdetail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title |html %]</a>
+                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/MARCdetail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.title | html %]</a>
                                                             [% ELSE %]
-                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.fulltitle |html %]</a>[% END %]
-                                                    <p>[% resul.author |html %]
-                                                    [% IF ( resul.publishercode ) %]- [% resul.publishercode |html %][% END %]
-                                                    [% IF ( resul.place ) %] ; [% resul.place |html %][% END %]
-                                                    [% IF ( resul.pages ) %] - [% resul.pages |html %][% END %]
-                                                    [% IF ( resul.notes ) %] : [% resul.notes |html %][% END %]
-                                                    [% IF ( resul.item('size') ) %] ; [% resul.item('size') |html %][% END %]
+                                                                    <a class="transparent resultlist" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% resul.biblionumber |url %]">[% resul.fulltitle | html %]</a>[% END %]
+                                                    <p>[% resul.author | html %]
+                                                    [% IF ( resul.publishercode ) %]- [% resul.publishercode | html %][% END %]
+                                                    [% IF ( resul.place ) %] ; [% resul.place | html %][% END %]
+                                                    [% IF ( resul.pages ) %] - [% resul.pages | html %][% END %]
+                                                    [% IF ( resul.notes ) %] : [% resul.notes | html %][% END %]
+                                                    [% IF ( resul.item('size') ) %] ; [% resul.item('size') | html %][% END %]
                                             </p>
                                        </td>
                     [% IF ( resul.even ) %]<td align="center" class="hilighted">
                     [% ELSE %]<td align="center">[% END %]
-                        [% resul.totitem |html %]
+                        [% resul.totitem | html %]
                                        </td>
                     [% IF ( resul.even ) %]<td class="hilighted">
                     [% ELSE %]<td>[% END %]
-                        [% resul.CN |html %]
+                        [% resul.CN | html %]
                                        </td>
                                        <td>
                       [% IF ( resul.biblionumber ) %]
-                          <a href="#" class="btn btn-default btn-xs redirect_link" data-url="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;biblionumber=[% resul.biblionumber %]&amp;type=intranet&amp;op=fillinput">Choose</a>
+                          <a href="#" class="btn btn-default btn-xs redirect_link" data-url="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;biblionumber=[% resul.biblionumber | html %]&amp;type=intranet&amp;op=fillinput">Choose</a>
                       [% ELSE %]
-                          <a href="#" class="btn btn-default btn-xs redirect_link" data-url="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;type=intranet&amp;op=fillinput">Clear field</a>
+                          <a href="#" class="btn btn-default btn-xs redirect_link" data-url="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;type=intranet&amp;op=fillinput">Clear field</a>
                       [% END %]
                                        </td>
                                </tr>
                <div id="resultnumber">
                        <p>
                                [% IF ( displayprev ) %]
-                <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;amp;index=[% index %]&amp;amp;startfrom=[% startfromprev %]&amp;amp;search=[% search |uri %]&amp;amp;resultsperpage=[% resultsperpage %]&amp;amp;type=intranet&amp;amp;op=do_search">
+                <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;amp;index=[% index | html %]&amp;amp;startfrom=[% startfromprev | html %]&amp;amp;search=[% search |uri %]&amp;amp;resultsperpage=[% resultsperpage | html %]&amp;amp;type=intranet&amp;amp;op=do_search">
                                        &lt;&lt; Previous
                                </a>
                                [% END %]
                                [% FOREACH number IN numbers %]
                                        [% IF ( number.highlight ) %]
                                                <span class="highlight">
-                                                       [% number.number %]
+                                                       [% number.number | html %]
                                                </span>
                                        [% ELSE %]
-                        <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;startfrom=[% number.startfrom %]&amp;search=[% number.search |uri %]&amp;resultsperpage=[% number.resultsperpage %]&amp;type=intranet&amp;op=do_search">
-                                                       [% number.number %]
+                        <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;startfrom=[% number.startfrom | html %]&amp;search=[% number.search |uri %]&amp;resultsperpage=[% number.resultsperpage | html %]&amp;type=intranet&amp;op=do_search">
+                                                       [% number.number | html %]
                                                </a>
                                        [% END %]
                                [% END %]
 
                                [% IF ( displaynext ) %]
-                <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index %]&amp;startfrom=[% startfromnext %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage %]&amp;type=intranet&amp;op=do_search">
+                <a class="resultnumber" href="/cgi-bin/koha/cataloguing/plugin_launcher.pl?plugin_name=unimarc_field_4XX.pl&amp;index=[% index | html %]&amp;startfrom=[% startfromnext | html %]&amp;search=[% search |uri %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=intranet&amp;op=do_search">
                                        Next&gt;&gt;
                                </a>
                                [% END %]
     [% IF ( fillinput ) %]
         <script>
             function go() {
-                var index_start = "[% index %]";
+                var index_start = "[% index | html %]";
                 var whichfield;
                 try {
                     whichfield = opener.opener.document.getElementById(index_start);
                         var subfield = subfields[i+1];
 
                         if(code.value == '9'){
-                                subfield.value = "[% subfield_value_9 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_9 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == '0'){
-                                subfield.value = "[% subfield_value_0 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_0 |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'a'){
-                                subfield.value = "[% subfield_value_a |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_a |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'c'){
-                                subfield.value = "[% subfield_value_c |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_c |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'd'){
-                                subfield.value = "[% subfield_value_d |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_d |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'e'){
-                                subfield.value = "[% subfield_value_e |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_e |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'h'){
-                                subfield.value = "[% subfield_value_h |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_h |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'i'){
-                                subfield.value = "[% subfield_value_i |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_i |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'l'){
-                                subfield.value = "[% subfield_value_l |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_l |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'n'){
-                                subfield.value = "[% subfield_value_n |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_n |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'o'){
-                                subfield.value = "[% subfield_value_o |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_o |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'p'){
-                                subfield.value = "[% subfield_value_p |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_p |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 't'){
-                                subfield.value = "[% subfield_value_t |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_t |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'u'){
-                                subfield.value = "[% subfield_value_u |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_u |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'v'){
-                                subfield.value = "[% subfield_value_v |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_v |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'x'){
-                                subfield.value = "[% subfield_value_x |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_x |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                         if(code.value == 'y'){
-                                subfield.value = "[% subfield_value_y |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+                                subfield.value = "[% subfield_value_y |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
                         }
                     }
                 }
     [% END %]
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index e426ac8..196d1e1 100644 (file)
                <form name="f" method="get" action="../authorities/auth_finder.pl">
             <input type="hidden" name="op" value="do_search" />
             <input type="hidden" name="type" value="intranet" />
-            <input type="hidden" name="nbstatements" value="[% nbstatements %]" />
-            <input type="hidden" name="index" value="[% index %]" />
+            <input type="hidden" name="nbstatements" value="[% nbstatements | html %]" />
+            <input type="hidden" name="index" value="[% index | html %]" />
                 <fieldset class="rows"><ol><li>
                     <span class="label">Authority type</span>
-                    [% authtypecode %]
-                    <input type="hidden" name="authtypecode" value="[% authtypecode %]" />
+                    [% authtypecode | html %]
+                    <input type="hidden" name="authtypecode" value="[% authtypecode | html %]" />
                 </li>
                 <li>
                     <label for="mainmainentry">Main entry ($a only)</label>
@@ -30,7 +30,7 @@
                         <option value="start">starts with</option>
                         <option value="is">is exactly</option>
                     </select>
-                    <input type="text" name="value_mainstr" value="[% value_mainstr |html %]" />
+                    <input type="text" name="value_mainstr" value="[% value_mainstr | html %]" />
                 </li>
                 <li>
                     <label for="mainentry">Main entry</label>
@@ -42,7 +42,7 @@
                         <option value="start">starts with</option>
                         <option value="is">is exactly</option>
                     </select>
-                    <input type="text" name="value_main" value="[% value_main |html %]" />
+                    <input type="text" name="value_main" value="[% value_main | html %]" />
                 </li>
                 <li>
                     <label for="marclist">Anywhere</label>
@@ -54,7 +54,7 @@
                         <option value="start">starts with</option>
                         <option value="is">is exactly</option>
                     </select>
-                    <input type="text" name="value_any" value="[% value_any |html %]" />
+                    <input type="text" name="value_any" value="[% value_any | html %]" />
                 </li>
                 <li>
                     <label for="orderby">Sort by </label>
index 948b143..8e1c957 100644 (file)
         function report() {
             x = document.f_pop.f1.value.split(' - ');
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  x[0];
-            if ([% index2 %] > 0) {
-                opener.document.f.field_value[[% index2 %]].value= x[1];
+            if ([% index2 | html %] > 0) {
+                opener.document.f.field_value[[% index2 | html %]].value= x[1];
             }
             self.close();
             return false;
index aaa477c..a6a5865 100644 (file)
     <script type="text/javascript">
         function report() {
             var doc   = opener.document;
-            var field = doc.getElementById("[% index %]");
+            var field = doc.getElementById("[% index | html %]");
 
             field.value =  '     '+document.f_pop.f5.value +
             document.f_pop.f6.value+ document.f_pop.f7.value+
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
-
index 5bc8f9d..7a4a279 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -7,7 +8,7 @@
     <title>Koha &rsaquo; Z39.50 authority search results</title>
     [% END %]
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     #marcPreview { width : 90%; top: 5%; } .modal-body { max-height: 380px; } .modal-header { padding: 0 14px; } @media (max-width: 767px) { #marcPreview { margin: 0; width : auto; } }
 </style>
@@ -19,7 +20,7 @@
         <h2>Z39.50 authority search points</h2>
         <form method="post" action="z3950_auth_search.pl" name="f" class="checkboxed">
         <input type="hidden" name="op" id="op" value="do_search" />
-        <input type="hidden" name="authid" value="[% authid %]" />
+        <input type="hidden" name="authid" value="[% authid | html %]" />
             <div class="row">
             <div class="col-xs-6">
                 <fieldset class="rows">
                     [% FOREACH serverloo IN serverloop %]
                         <p>
                         [% IF ( serverloo.checked ) %]
-                            <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" checked="checked" />
+                            <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" checked="checked" />
                         [% ELSE %]
-                            <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" />
+                            <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" />
                         [% END %]
-                        <label for="z3950_[% serverloo.id %]">[% serverloo.servername %]</label>
+                        <label for="z3950_[% serverloo.id | html %]">[% serverloo.servername | html %]</label>
                         </p>
                     [% END %]
                     </div>
     </tr></thead>
     <tbody>[% FOREACH breeding_loo IN breeding_loop %]
         [% IF ( breeding_loo.breedingid ) %]
-        <tr id="row[% breeding_loo.breedingid %]">
-            <td>[% breeding_loo.server %]</td>
-            <td>[% breeding_loo.heading %]</td>
-            <td>[% breeding_loo.heading_code %]</td>
+        <tr id="row[% breeding_loo.breedingid | html %]">
+            <td>[% breeding_loo.server | html %]</td>
+            <td>[% breeding_loo.heading | html %]</td>
+            <td>[% breeding_loo.heading_code | html %]</td>
             <td class="actions">
                 <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% breeding_loo.breedingid %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% breeding_loo.breedingid | html %]" role="button" data-toggle="dropdown" href="#">
                       Actions <b class="caret"></b>
                     </a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% breeding_loo.breedingid %]">
-                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid %]" class="previewMARC"><i class="fa fa-eye"></i> MARC preview</a></li>
-                        <li><a href="#" class="import_record" data-breedingid="[% breeding_loo.breedingid %]" data-heading_code="[% breeding_loo.heading_code %]" data-authid="[% breeding_loo.authid %]"><i class="fa fa-download"></i> Import</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% breeding_loo.breedingid | html %]">
+                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid | html %]" class="previewMARC"><i class="fa fa-eye"></i> MARC preview</a></li>
+                        <li><a href="#" class="import_record" data-breedingid="[% breeding_loo.breedingid | html %]" data-heading_code="[% breeding_loo.heading_code | html %]" data-authid="[% breeding_loo.authid | html %]"><i class="fa fa-download"></i> Import</a></li>
                     </ul>
                 </div>
             </td>
             <h3 id="marcPreviewLabel">MARC preview</h3>
         </div>
         <div class="modal-body">
-            <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+            <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
         </div>
         </div>
         </div>
 
     <form method="post" action="z3950_auth_search.pl" id="page_form" name="page_form" class="checkboxed">
         <input type="hidden" name="op" id="op" value="do_search" />
-        <input type="hidden" name="current_page" id="current_page" value="[% current_page %]" />
-        <input type="hidden" id="nameany"  name="nameany" value="[% nameany %]" />
-        <input type="hidden" id="authorany"  name="authorany" value="[% authorany %]" />
-        <input type="hidden" id="authorcorp"  name="authorcorp" value="[% authorcorp %]" />
-        <input type="hidden" id="authorpersonal"  name="authorpersonal" value="[% authorpersonal %]" />
-        <input type="hidden" id="authormeetingcon"  name="authormeetingcon" value="[% authormeetingcon %]" />
-        <input type="hidden" id="title"  name="title" value="[% title %]" />
-        <input type="hidden" id="uniformtitle"  name="uniformtitle" value="[% uniformtitle %]" />
-        <input type="hidden" id="subject" name="subject" value="[% subject %]" />
-        <input type="hidden" id="subjectsubdiv" name="subjectsubdiv" value="[% subjectsubdiv %]" />
-        <input type="hidden" id="heading"  name="heading" value="[% heading %]" />
-        <input type="hidden" id="srchany" name="srchany" value="[% srchany %]" />
-        <input type="hidden" name="authid" value="[% authid %]" />
+        <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
+        <input type="hidden" id="nameany"  name="nameany" value="[% nameany | html %]" />
+        <input type="hidden" id="authorany"  name="authorany" value="[% authorany | html %]" />
+        <input type="hidden" id="authorcorp"  name="authorcorp" value="[% authorcorp | html %]" />
+        <input type="hidden" id="authorpersonal"  name="authorpersonal" value="[% authorpersonal | html %]" />
+        <input type="hidden" id="authormeetingcon"  name="authormeetingcon" value="[% authormeetingcon | html %]" />
+        <input type="hidden" id="title"  name="title" value="[% title | html %]" />
+        <input type="hidden" id="uniformtitle"  name="uniformtitle" value="[% uniformtitle | html %]" />
+        <input type="hidden" id="subject" name="subject" value="[% subject | html %]" />
+        <input type="hidden" id="subjectsubdiv" name="subjectsubdiv" value="[% subjectsubdiv | html %]" />
+        <input type="hidden" id="heading"  name="heading" value="[% heading | html %]" />
+        <input type="hidden" id="srchany" name="srchany" value="[% srchany | html %]" />
+        <input type="hidden" name="authid" value="[% authid | html %]" />
 
         [% FOREACH server IN servers %]
-        <input type="hidden" name="id" id="z3950_[% server.id %]" value="[% server.id %]" />
+        <input type="hidden" name="id" id="z3950_[% server.id | html %]" value="[% server.id | html %]" />
         [% END %]
 
         [% IF ( show_prevbutton ) %]
-            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        Page [% current_page %] / [% total_pages %]
+        Page [% current_page | html %] / [% total_pages | html %]
         [% IF ( show_nextbutton ) %]
-            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
+        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page | html %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
     </form>
 
-<p><form method="get" action="/cgi-bin/koha/cataloguing/z3950_auth_search.pl"><input type="hidden" name="authid" value="[% authid %]" /><input type="submit" value="Try another search"/></form></p>
+<p><form method="get" action="/cgi-bin/koha/cataloguing/z3950_auth_search.pl"><input type="hidden" name="authid" value="[% authid | html %]" /><input type="submit" value="Try another search"/></form></p>
     [% ELSE %]
         [% IF ( errconn ) %]
             <div class="dialog alert">
                 <ul>
                 [% FOREACH errcon IN errconn %]
-                    [% IF ( errcon.error == '10000' ) %]<li>Connection failed to [% errcon.server %]</li>
-                    [% ELSIF ( errcon.error == '10007' ) %]<li>Connection timeout to [% errcon.server %]</li>[% END %]
+                    [% IF ( errcon.error == '10000' ) %]<li>Connection failed to [% errcon.server | html %]</li>
+                    [% ELSIF ( errcon.error == '10007' ) %]<li>Connection timeout to [% errcon.server | html %]</li>[% END %]
                 [% END %]
                 </ul>
             </div>
          [% END %]
    <div class="dialog message">Nothing found.</div>
-    <p><form method="get" action="/cgi-bin/koha/cataloguing/z3950_auth_search.pl"><input type="hidden" name="authid" value="[% authid %]" /><input type="submit" value="Try another search"/></form></p>
+    <p><form method="get" action="/cgi-bin/koha/cataloguing/z3950_auth_search.pl"><input type="hidden" name="authid" value="[% authid | html %]" /><input type="submit" value="Try another search"/></form></p>
     [% END %]
 
 [% END %]
 
-[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending %] servers to search</h3>[% END %]
+[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending | html %] servers to search</h3>[% END %]
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
         });
     </script>
     [% INCLUDE 'z3950_search.inc' %]
-    [% Asset.js("js/z3950_search.js") %]
+    [% Asset.js("js/z3950_search.js") | $raw %]
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index 3e22aca..b52a283 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Z39.50/SRU search results</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
 #dataPreview { width : 90%; top: 5%; } .modal-body { max-height: 380px; } .modal-header { padding: 0 14px; } @media (max-width: 767px) { #dataPreview { margin: 0; width : auto; } }
 </style>
@@ -22,7 +23,7 @@
         <ol>
         <li><label for="isbn">ISBN: </label> <input type="text" id="isbn" name="isbn" value="[% isbn | html %]" class="focus" /></li>
         <li><label for="issn">ISSN: </label> <input type="text" id="issn" name="issn" value="[% issn | html %]" /></li>
-        <li><label for="title">Title: </label> <input type="text" id="title"  name="title" value="[% title |html %]" /></li>
+        <li><label for="title">Title: </label> <input type="text" id="title"  name="title" value="[% title | html %]" /></li>
         <li><label for="author">Author: </label> <input type="text" id="author" name="author" value="[% author | html %]" /></li>
         <li><label for="subject">Subject heading: </label> <input type="text" id="subject" name="subject" value="" /></li>
         <li><label for="srchany">Keyword (any): </label> <input type="text" id="srchany" name="srchany" value="" /></li>
     [% FOREACH serverloo IN serverloop %]
         <p> 
             [% IF ( serverloo.checked ) %]
-                <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" checked="checked" />
+                <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" checked="checked" />
             [% ELSE %]
-                <input type="checkbox" name="id" id="z3950_[% serverloo.id %]" value="[% serverloo.id %]" />
+                <input type="checkbox" name="id" id="z3950_[% serverloo.id | html %]" value="[% serverloo.id | html %]" />
             [% END %]
-            <label for="z3950_[% serverloo.id %]">[% serverloo.servername %]</label>
+            <label for="z3950_[% serverloo.id | html %]">[% serverloo.servername | html %]</label>
 
         </p>
     [% END %]
             <div class="dialog alert">
                 <ul>
                 [% FOREACH errcon IN errconn %]
-                    [% IF ( errcon.error == '10000' ) %]<li>Connection failed to [% errcon.server %]</li>
-                    [% ELSIF ( errcon.error == '10007' ) %]<li>Connection timeout to [% errcon.server %]</li>
-                    [% ELSIF errcon.error.match( '^XSLTH' ) %]<li>[% errcon.server %] record [% errcon.seq %]: [% PROCESS 'xslt-handler.inc' code=errcon.error %]</li>
-                    [% ELSE %]<li>[% errcon.server %] record [% errcon.seq %]: [% errcon.error %]</li>
+                    [% IF ( errcon.error == '10000' ) %]<li>Connection failed to [% errcon.server | html %]</li>
+                    [% ELSIF ( errcon.error == '10007' ) %]<li>Connection timeout to [% errcon.server | html %]</li>
+                    [% ELSIF errcon.error.match( '^XSLTH' ) %]<li>[% errcon.server | html %] record [% errcon.seq | html %]: [% PROCESS 'xslt-handler.inc' code=errcon.error %]</li>
+                    [% ELSE %]<li>[% errcon.server | html %] record [% errcon.seq | html %]: [% errcon.error | html %]</li>
                     [% END %]
                 [% END %]
                 </ul>
     <tbody>[% FOREACH breeding_loo IN breeding_loop %]
         [% IF ( breeding_loo.breedingid ) %]
 
-           <tr id="row[% breeding_loo.breedingid %]">
-            <td>[% breeding_loo.server %]</td>
-            <td>[% breeding_loo.title |html %]</td>
-            <td>[% breeding_loo.author %]</td>
-            <td>[% breeding_loo.date %]</td>
-            <td>[% breeding_loo.edition %]</td>
-            <td>[% breeding_loo.isbn %]</td>
-            <td>[% breeding_loo.lccn %]</td>
+           <tr id="row[% breeding_loo.breedingid | html %]">
+            <td>[% breeding_loo.server | html %]</td>
+            <td>[% breeding_loo.title | html %]</td>
+            <td>[% breeding_loo.author | html %]</td>
+            <td>[% breeding_loo.date | html %]</td>
+            <td>[% breeding_loo.edition | html %]</td>
+            <td>[% breeding_loo.isbn | html %]</td>
+            <td>[% breeding_loo.lccn | html %]</td>
 
             <td>
                 <div class="dropdown">
-                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% breeding_loo.breedingid %]" role="button" data-toggle="dropdown" href="#">
+                    <a class="btn btn-default btn-xs dropdown-toggle" id="cataloguesearchactions[% breeding_loo.breedingid | html %]" role="button" data-toggle="dropdown" href="#">
                       Actions <b class="caret"></b>
                     </a>
-                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% breeding_loo.breedingid %]">
-                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid %]" title="MARC" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
-                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid %]" title="Card" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
-                        <li><a href="#" class="import_record" data-breedingid="[% breeding_loo.breedingid %]" data-biblionumber="[% breeding_loo.biblionumber %]" data-frameworkcode="[% frameworkcode | uri %]"><i class="fa fa-download"></i> Import</a></li>
+                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="cataloguesearchactions[% breeding_loo.breedingid | html %]">
+                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?importid=[% breeding_loo.breedingid | html %]" title="MARC" class="previewData"><i class="fa fa-eye"></i> MARC preview</a></li>
+                        <li><a href="/cgi-bin/koha/catalogue/showmarc.pl?viewas=card&amp;importid=[% breeding_loo.breedingid | html %]" title="Card" class="previewData"><i class="fa fa-eye"></i> Card preview</a></li>
+                        <li><a href="#" class="import_record" data-breedingid="[% breeding_loo.breedingid | html %]" data-biblionumber="[% breeding_loo.biblionumber | html %]" data-frameworkcode="[% frameworkcode | uri %]"><i class="fa fa-download"></i> Import</a></li>
                     </ul>
                 </div>
             </td>
         <h3 id="dataPreviewLabel">Preview</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     </div>
     </div>
 
     <form method="post" action="z3950_search.pl" id="page_form" name="page_form" class="checkboxed">
         <input type="hidden" name="op" id="op" value="do_search" />
-        <input type="hidden" name="current_page" id="current_page" value="[% current_page %]" />
+        <input type="hidden" name="current_page" id="current_page" value="[% current_page | html %]" />
         <input type="hidden" id="title"  name="title" value="[% title | html %]" />
         <input type="hidden" id="isbn" name="isbn" value="[% isbn | html %]" />
         <input type="hidden" id="lccall" name="lccall" value="[% lccall | html %]" />
         <input type="hidden" name="frameworkcode" value="[% frameworkcode | html %]" />
 
         [% FOREACH server IN servers %]
-        <input type="hidden" name="id" id="z3950_[% server.id %]" value="[% server.id %]" />
+        <input type="hidden" name="id" id="z3950_[% server.id | html %]" value="[% server.id | html %]" />
         [% END %]
 
         [% IF ( show_prevbutton ) %]
-            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_prev" value="Previous page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        Page [% current_page %] / [% total_pages %]
+        Page [% current_page | html %] / [% total_pages | html %]
         [% IF ( show_nextbutton ) %]
-            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page %]" />
+            <input type="button" name="changepage_next" value="Next page" data-currentpage="[% current_page | html %]" />
         [% END %]
-        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
+        <br />Go to page : <input id="goto_page" name="goto_page" value="[% current_page | html %]" size="4" /><input type="submit" name="changepage_goto" value="Go" />
     </form>
 
     [% ELSE %]
 
 </div>
 </div>
-[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending %] servers to search</h3>[% END %]
+[% IF ( numberpending ) %]<h3 align="center">Still [% numberpending | html %] servers to search</h3>[% END %]
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("js/z3950_search.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("js/z3950_search.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
index 8a2a073..4401043 100644 (file)
 </head>
 
 [% BLOCK actions %]
-    <div id="[% menuid %]" class="dropdown">
+    <div id="[% menuid | html %]" class="dropdown">
         <a class="btn btn-default btn-xs dropdown-toggle ar-actions" role="button" data-toggle="dropdown" href="#">
             Actions <b class="caret"></b>
         </a>
 
-        <ul class="dropdown-menu [% pull_right %]" role="menu" aria-labelledby="[% aria_menu %]">
+        <ul class="dropdown-menu [% pull_right | html %]" role="menu" aria-labelledby="[% aria_menu | html %]">
             <li>
-                <a class="ar-process-request" href="#" onclick="HandleMulti( Process, [% id_arg %], $(this) ); return false;">
+                <a class="ar-process-request" href="#" onclick="HandleMulti( Process, [% id_arg | html %], $(this) ); return false;">
                     <i class="fa fa-cog"></i>
                     Process request
                 </a>
 
-                <a class="ar-complete-request" href="#" onclick="HandleMulti( Complete, [% id_arg %], $(this) ); return false;">
+                <a class="ar-complete-request" href="#" onclick="HandleMulti( Complete, [% id_arg | html %], $(this) ); return false;">
                     <i class="fa fa-check-circle"></i>
                     Complete request
                 </a>
 
-                <a class="ar-cancel-request" href="#" onclick="HandleMulti( Cancel, [% id_arg %], $(this) ); return false;">
+                <a class="ar-cancel-request" href="#" onclick="HandleMulti( Cancel, [% id_arg | html %], $(this) ); return false;">
                     <i class="fa fa-minus-circle"></i>
                     Cancel request
                 </a>
 
                 [% IF id_arg %][%# TODO: Does not work with multi-select %]
-                <a class="ar-print-request" href="#" onclick="HandleMulti( PrintSlip, [% id_arg %], $(this) ); return false;">
+                <a class="ar-print-request" href="#" onclick="HandleMulti( PrintSlip, [% id_arg | html %], $(this) ); return false;">
                     <i class="fa fa-print"></i>
                     Print slip
                 </a>
@@ -66,9 +66,9 @@
                         <option value="">All libraries</option>
                         [% FOREACH b IN Branches.all( only_from_group => 1 ) %]
                             [% IF b.branchcode == branchcode %]
-                                <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                                <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                             [% ELSE %]
-                                <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                     <ul>
                         <li>
                             <a href="#article-requests-pending">
-                                Pending (<span id="ar_pending_count">[% article_requests_pending.count %]</span>)
+                                Pending (<span id="ar_pending_count">[% article_requests_pending.count | html %]</span>)
                             </a>
                         </li>
 
                         <li>
                             <a href="#article-requests-processing">
-                                Processing (<span id="ar_processing_count">[% article_requests_processing.count %]</span>)
+                                Processing (<span id="ar_processing_count">[% article_requests_processing.count | html %]</span>)
                             </a>
                         </li>
                     </ul>
 
                                 [% FOREACH ar IN article_requests_pending %]
                                     <tr class="ar-row ar-pending">
-                                        <td><input type="checkbox" reqid="[% ar.id %]"/></td>
+                                        <td><input type="checkbox" reqid="[% ar.id | html %]"/></td>
                                         <td class="ar-title">
                                             <p>
-                                                <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% ar.biblionumber %]">
+                                                <a href="/cgi-bin/koha/circ/request-article.pl?biblionumber=[% ar.biblionumber | html %]">
                                                     <strong>[% ar.biblio.title | html %]</strong>
-                                                    [% FOREACH s IN itemsloo.subtitle %] [% s %][% END %]
+                                                    [% FOREACH s IN itemsloo.subtitle %] [% s | html %][% END %]
                                                 </a>
                                             </p>
 
                                             <p>
-                                                <div class="ar-biblionumber content_hidden">[% ar.biblionumber %]</div>
-                                                <div class="ar-author">[% ar.biblio.author %]</div>
+                                                <div class="ar-biblionumber content_hidden">[% ar.biblionumber | html %]</div>
+                                                <div class="ar-author">[% ar.biblio.author | html %]</div>
                                                 <div class="ar-pubdata">
-                                                    [% ar.biblio.biblioitem.publishercode %]
+                                                    [% ar.biblio.biblioitem.publishercode | html %]
 
                                                     [% IF ar.biblio.biblioitem.publicationyear %]
-                                                        [% ar.biblio.biblioitem.publicationyear %]
+                                                        [% ar.biblio.biblioitem.publicationyear | html %]
                                                     [% ELSIF ar.biblio.copyrightdate %]
-                                                        [% ar.biblio.copyrightdate %]
+                                                        [% ar.biblio.copyrightdate | html %]
                                                     [% END %]
 
                                                     [% IF ar.biblio.biblioitem.pages %]
-                                                        : [% ar.biblio.biblioitem.pages %]
+                                                        : [% ar.biblio.biblioitem.pages | html %]
                                                     [% END %]
 
-                                                    [%  r.biblio.biblioitem.size %]
+                                                    [% r.biblio.biblioitem.size | html %]
 
                                                     [% IF ar.biblio.biblioitem.isbn %]
-                                                        ISBN: [% ar.biblio.biblioitem.isbn %]
+                                                        ISBN: [% ar.biblio.biblioitem.isbn | html %]
                                                     [% END %]
                                                 </div>
                                             </p>
                                         </td>
                                         <td class="ar-request">
-                                            [% IF ar.title %]        <p><strong>Title:</strong>        [% ar.title %]        </p> [% END %]
-                                            [% IF ar.author %]       <p><strong>Author:</strong>       [% ar.author %]       </p> [% END %]
-                                            [% IF ar.volume %]       <p><strong>Volume:</strong>       [% ar.volume %]       </p> [% END %]
-                                            [% IF ar.issue %]        <p><strong>Issue:</strong>        [% ar.issue %]        </p> [% END %]
-                                            [% IF ar.date %]         <p><strong>Date:</strong>         [% ar.date %]         </p> [% END %]
-                                            [% IF ar.pages %]        <p><strong>Pages:</strong>        [% ar.pages %]        </p> [% END %]
-                                            [% IF ar.chapters %]     <p><strong>Chapters:</strong>     [% ar.chapters %]     </p> [% END %]
-                                            [% IF ar.patron_notes %] <p><strong>Patron notes:</strong> [% ar.patron_notes %] </p> [% END %]
+                                            [% IF ar.title %]        <p><strong>Title:</strong>        [% ar.title | html %]        </p> [% END %]
+                                            [% IF ar.author %]       <p><strong>Author:</strong>       [% ar.author | html %]       </p> [% END %]
+                                            [% IF ar.volume %]       <p><strong>Volume:</strong>       [% ar.volume | html %]       </p> [% END %]
+                                            [% IF ar.issue %]        <p><strong>Issue:</strong>        [% ar.issue | html %]        </p> [% END %]
+                                            [% IF ar.date %]         <p><strong>Date:</strong>         [% ar.date | html %]         </p> [% END %]
+                                            [% IF ar.pages %]        <p><strong>Pages:</strong>        [% ar.pages | html %]        </p> [% END %]
+                                            [% IF ar.chapters %]     <p><strong>Chapters:</strong>     [% ar.chapters | html %]     </p> [% END %]
+                                            [% IF ar.patron_notes %] <p><strong>Patron notes:</strong> [% ar.patron_notes | html %] </p> [% END %]
                                         </td>
-                                        <td class="ar-collection">[% AuthorisedValues.GetByCode( 'CCODE', ar.item.ccode ) %]</td>
-                                        <td class="ar-itemtype">[% ItemTypes.GetDescription( ar.item.effective_itemtype ) %]</td>
+                                        <td class="ar-collection">[% AuthorisedValues.GetByCode( 'CCODE', ar.item.ccode ) | html %]</td>
+                                        <td class="ar-itemtype">[% ItemTypes.GetDescription( ar.item.effective_itemtype ) | html %]</td>
                                         <td class="ar-callnumber">
                                             [% IF ar.item.location %]
-                                                <em>[% AuthorisedValues.GetByCode( 'LOC', ar.item.location ) %]</em>
+                                                <em>[% AuthorisedValues.GetByCode( 'LOC', ar.item.location ) | html %]</em>
                                             [% END %]
 
-                                            [% ar.item.itemcallnumber %]
+                                            [% ar.item.itemcallnumber | html %]
                                         </td>
-                                        <td class="ar-copynumber">[% ar.item.copynumber %]</td>
-                                        <td class="ar-enumchron">[% ar.item.enumchron %]</td>
-                                        <td class="ar-barcode">[% ar.item.barcode %]</td>
+                                        <td class="ar-copynumber">[% ar.item.copynumber | html %]</td>
+                                        <td class="ar-enumchron">[% ar.item.enumchron | html %]</td>
+                                        <td class="ar-barcode">[% ar.item.barcode | html %]</td>
                                         <td class="ar-patron">
                                             <p>
-                                                <a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% ar.borrower.cardnumber %]">
-                                                    [% ar.borrower.surname %][% IF ar.borrower.firstname %], [% ar.borrower.firstname %][% END %] ([% ar.borrower.cardnumber %])
+                                                <a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% ar.borrower.cardnumber | html %]">
+                                                    [% ar.borrower.surname | html %][% IF ar.borrower.firstname %], [% ar.borrower.firstname | html %][% END %] ([% ar.borrower.cardnumber | html %])
                                                 </a>
                                             </p>
 
-                                            <p>[% ar.borrower.phone %]</p>
+                                            <p>[% ar.borrower.phone | html %]</p>
                                         </td>
-                                        <td class="ar-date"><span title="[% ar.created_on %]">[% ar.created_on | $KohaDates %]</span></td>
+                                        <td class="ar-date"><span title="[% ar.created_on | html %]">[% ar.created_on | $KohaDates %]</span></td>
                                         <td class="ar-actions">
                                         <div class="dropdown">
                                             [% PROCESS actions menuid = "row" _ ar.id id_arg=ar.id pull_right='pull-right' aria_menu='ar-actions' %]
 
                                 [% FOREACH ar IN article_requests_processing %]
                                     <tr class="ar-row ar-processing">
-                                        <td><input type="checkbox" reqid="[% ar.id %]"/></td>
+                                        <td><input type="checkbox" reqid="[% ar.id | html %]"/></td>
                                         <td class="ar-title">
                                             <p>
-                                                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ar.biblionumber %]">
+                                                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ar.biblionumber | html %]">
                                                     <strong>[% ar.biblio.title | html %]</strong>
-                                                    [% FOREACH s IN itemsloo.subtitle %] [% s %][% END %]
+                                                    [% FOREACH s IN itemsloo.subtitle %] [% s | html %][% END %]
                                                 </a>
                                             </p>
 
                                             <p>
-                                                <div class="ar-biblionumber content_hidden">[% ar.biblionumber %]</div>
-                                                <div class="ar-author">[% ar.biblio.author %]</div>
+                                                <div class="ar-biblionumber content_hidden">[% ar.biblionumber | html %]</div>
+                                                <div class="ar-author">[% ar.biblio.author | html %]</div>
                                                 <div class="ar-pubdata">
-                                                    [% ar.biblio.biblioitem.publishercode %]
+                                                    [% ar.biblio.biblioitem.publishercode | html %]
 
                                                     [% IF ar.biblio.biblioitem.publicationyear %]
-                                                        [% ar.biblio.biblioitem.publicationyear %]
+                                                        [% ar.biblio.biblioitem.publicationyear | html %]
                                                     [% ELSIF ar.biblio.copyrightdate %]
-                                                        [% ar.biblio.copyrightdate %]
+                                                        [% ar.biblio.copyrightdate | html %]
                                                     [% END %]
 
                                                     [% IF ar.biblio.biblioitem.pages %]
-                                                        : [% ar.biblio.biblioitem.pages %]
+                                                        : [% ar.biblio.biblioitem.pages | html %]
                                                     [% END %]
 
-                                                    [%  r.biblio.biblioitem.size %]
+                                                    [% r.biblio.biblioitem.size | html %]
 
                                                     [% IF ar.biblio.biblioitem.isbn %]
-                                                        ISBN: [% ar.biblio.biblioitem.isbn %]
+                                                        ISBN: [% ar.biblio.biblioitem.isbn | html %]
                                                     [% END %]
                                                 </div>
                                             </p>
                                         </td>
                                         <td class="ar-request">
-                                            [% IF ar.title %]        <p><strong>Title:</strong>        [% ar.title %]        </p> [% END %]
-                                            [% IF ar.author %]       <p><strong>Author:</strong>       [% ar.author %]       </p> [% END %]
-                                            [% IF ar.volume %]       <p><strong>Volume:</strong>       [% ar.volume %]       </p> [% END %]
-                                            [% IF ar.issue %]        <p><strong>Issue:</strong>        [% ar.issue %]        </p> [% END %]
-                                            [% IF ar.date %]         <p><strong>Date:</strong>         [% ar.date %]         </p> [% END %]
-                                            [% IF ar.pages %]        <p><strong>Pages:</strong>        [% ar.pages %]        </p> [% END %]
-                                            [% IF ar.chapters %]     <p><strong>Chapters:</strong>     [% ar.chapters %]     </p> [% END %]
-                                            [% IF ar.patron_notes %] <p><strong>Patron notes:</strong> [% ar.patron_notes %] </p> [% END %]
+                                            [% IF ar.title %]        <p><strong>Title:</strong>        [% ar.title | html %]        </p> [% END %]
+                                            [% IF ar.author %]       <p><strong>Author:</strong>       [% ar.author | html %]       </p> [% END %]
+                                            [% IF ar.volume %]       <p><strong>Volume:</strong>       [% ar.volume | html %]       </p> [% END %]
+                                            [% IF ar.issue %]        <p><strong>Issue:</strong>        [% ar.issue | html %]        </p> [% END %]
+                                            [% IF ar.date %]         <p><strong>Date:</strong>         [% ar.date | html %]         </p> [% END %]
+                                            [% IF ar.pages %]        <p><strong>Pages:</strong>        [% ar.pages | html %]        </p> [% END %]
+                                            [% IF ar.chapters %]     <p><strong>Chapters:</strong>     [% ar.chapters | html %]     </p> [% END %]
+                                            [% IF ar.patron_notes %] <p><strong>Patron notes:</strong> [% ar.patron_notes | html %] </p> [% END %]
                                         </td>
-                                        <td class="ar-collection">[% AuthorisedValues.GetByCode( 'CCODE', ar.item.ccode ) %]</td>
-                                        <td class="ar-itemtype">[% ItemTypes.GetDescription( ar.item.effective_itemtype ) %]</td>
+                                        <td class="ar-collection">[% AuthorisedValues.GetByCode( 'CCODE', ar.item.ccode ) | html %]</td>
+                                        <td class="ar-itemtype">[% ItemTypes.GetDescription( ar.item.effective_itemtype ) | html %]</td>
                                         <td class="ar-callnumber">
                                             [% IF ar.item.location %]
-                                                <em>[% AuthorisedValues.GetByCode( 'LOC', ar.item.location ) %]</em>
+                                                <em>[% AuthorisedValues.GetByCode( 'LOC', ar.item.location ) | html %]</em>
                                             [% END %]
 
-                                            [% ar.item.itemcallnumber %]
+                                            [% ar.item.itemcallnumber | html %]
                                         </td>
-                                        <td class="ar-copynumber">[% ar.item.copynumber %]</td>
-                                        <td class="ar-enumchron">[% ar.item.enumchron %]</td>
-                                        <td class="ar-barcode">[% ar.item.barcode %]</td>
+                                        <td class="ar-copynumber">[% ar.item.copynumber | html %]</td>
+                                        <td class="ar-enumchron">[% ar.item.enumchron | html %]</td>
+                                        <td class="ar-barcode">[% ar.item.barcode | html %]</td>
                                         <td class="ar-patron">
                                             <p>
-                                                <a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% ar.borrower.cardnumber %]">
-                                                    [% ar.borrower.surname %][% IF ar.borrower.firstname %], [% ar.borrower.firstname %][% END %] ([% ar.borrower.cardnumber %])
+                                                <a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% ar.borrower.cardnumber | html %]">
+                                                    [% ar.borrower.surname | html %][% IF ar.borrower.firstname %], [% ar.borrower.firstname | html %][% END %] ([% ar.borrower.cardnumber | html %])
                                                 </a>
                                             </p>
 
-                                            <p>[% ar.borrower.phone %]</p>
+                                            <p>[% ar.borrower.phone | html %]</p>
                                         </td>
-                                        <td class="ar-date"><span title="[% ar.created_on %]">[% ar.created_on | $KohaDates %]</span></td>
+                                        <td class="ar-date"><span title="[% ar.created_on | html %]">[% ar.created_on | $KohaDates %]</span></td>
                                         <td class="ar-actions">
                                         <div class="dropdown">
                                             [% PROCESS actions menuid="table_" _ ar.id id_arg=ar.id pull_right='pull-right' aria_menu='ar-actions' %]
                 return;
             }
 
-            a.closest('td').prepend('<img src="[% interface %]/[% theme %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
+            a.closest('td').prepend('<img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
             $.ajax({
                 type: "POST",
                 url: '/cgi-bin/koha/svc/article_request',
             table_row.find('.ar-process-request').remove();
             table_row.find('input[type="checkbox"]').prop('checked', false);
 
-            a.closest('td').prepend('<img src="[% interface %]/[% theme %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
+            a.closest('td').prepend('<img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
             $.ajax({
                 type: "POST",
                 url: '/cgi-bin/koha/svc/article_request',
         }
 
         function Complete( id, a ) {
-            a.closest('td').prepend('<img src="[% interface %]/[% theme %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
+            a.closest('td').prepend('<img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif"/>').find('div.dropdown').hide();
             $.ajax({
                 type: "POST",
                 url: '/cgi-bin/koha/svc/article_request',
index 9ed1a66..51060d6 100644 (file)
@@ -2,7 +2,7 @@
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Circulation &rsaquo; Circulation statistics for [% title |html %]</title>
+<title>Koha &rsaquo; Circulation &rsaquo; Circulation statistics for [% title | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 
 [% INCLUDE 'blocking_errors.inc' %]
 <h2>[% title |html %] [% IF ( author ) %] by [% author |html %][% END %]</h2>
-<h3>Barcode [% barcode %]</h3>
+<h3>Barcode [% barcode | html %]</h3>
 <table>
         <tr><th>Home library</th><th>Current library</th><th>Date arrived<br />at current library </th><th>Number of checkouts<br />since last transfer</th></tr>
 
-        <tr><td>[% Branches.GetName( homebranch ) %]</td>
-            <td>[% Branches.GetName( holdingbranch ) %]</td>
+        <tr><td>[% Branches.GetName( homebranch ) | html %]</td>
+            <td>[% Branches.GetName( holdingbranch ) | html %]</td>
             <td>[% IF ( lastdate ) %][% lastdate | $KohaDates %][% ELSE %]Item has no transfer record[% END %]</td>
-            <td>[% count %]</td>
+            <td>[% count | html %]</td>
         </tr>
 </table>
 <table>
     [% ELSE %]
         <tr>
     [% END %]
-            <td>[% library.branchname %]</td>
-            <td>[% library.issues %]</td>
+            <td>[% library.branchname | html %]</td>
+            <td>[% library.issues | html %]</td>
             <td>[% IF library.seen %]
-                    [% library.seen | $KohaDates with_hours => 1 %]
+                    [% library.seen | $KohaDates with_hours => 1 | html %]
                 [% ELSE %]
                     <span>Never</span>
                 [% END %]
index f217d72..8994f47 100644 (file)
@@ -1,14 +1,14 @@
 [% USE Branches %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Circulation &rsaquo; Overdues at [% LoginBranchname %]</title>
+<title>Koha &rsaquo; Circulation &rsaquo; Overdues at [% LoginBranchname | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="circ_branchoverdues" class="circ">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'circ-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a> &rsaquo; Overdues at [% LoginBranchname %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a> &rsaquo; Overdues at [% LoginBranchname | html %]</div>
 
 [% IF Koha.Preference('CircSidebar') %]<div id="doc3" class="yui-t2">[% ELSE %]<div id="doc" class="yui-t7">[% END %]
 
        <div class="yui-g">
 
 
-<h1>Circulation: Overdues at [% LoginBranchname %]</h1>
+<h1>Circulation: Overdues at [% LoginBranchname | html %]</h1>
 
 <form name="selectlocation" action="branchoverdues.pl" method="post">
     <label for="location">Shelving location selected: </label><select id="location" name="location">
         <option value="">All shelving locations</option>
         [% FOREACH locationsloo IN locationsloop %]
-            [% IF ( locationsloo.selected ) %]<option value="[% locationsloo.authorised_value %]" selected="selected">[% locationsloo.lib %]</option>[% ELSE %]<option value="[% locationsloo.authorised_value %]">[% locationsloo.lib %]</option>[% END %]
+            [% IF ( locationsloo.selected ) %]<option value="[% locationsloo.authorised_value | html %]" selected="selected">[% locationsloo.lib | html %]</option>[% ELSE %]<option value="[% locationsloo.authorised_value | html %]">[% locationsloo.lib | html %]</option>[% END %]
         [% END %]
     </select>
     <input type="submit" name="location" class="submit" value="OK" />
             [% FOREACH overduesloo IN overduesloop %]
                 <tr>
                     <td>
-                        [% overduesloo.date_due %]
+                        [% overduesloo.date_due | html %]
                     </td>
                     <td>
-                    [% INCLUDE 'biblio-default-view.inc' biblionumber = overduesloo.biblionumber %][% overduesloo.title |html %] [% IF ( overduesloo.subtitle ) %][% overduesloo.subtitle %][% END %]</a> [% IF ( overduesloo.author ) %] by [% overduesloo.author %][% END %]
+                    [% INCLUDE 'biblio-default-view.inc' biblionumber = overduesloo.biblionumber %][% overduesloo.title | html %] [% IF ( overduesloo.subtitle ) %][% overduesloo.subtitle | html %][% END %]</a> [% IF ( overduesloo.author ) %] by [% overduesloo.author | html %][% END %]
 
-                            <br />Barcode : [% overduesloo.barcode %]
+                            <br />Barcode : [% overduesloo.barcode | html %]
                     </td>
                     <td>
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% overduesloo.borrowernumber %]">[% overduesloo.borrowersurname %], [% overduesloo.borrowerfirstname %]</a>
-                        <br />[% overduesloo.cardnumber %]
-                        <br />[% overduesloo.borrowerphone %]<br />
-                    [% IF ( overduesloo.borroweremail ) %]<a href="mailto:[% overduesloo.borroweremail %]?subject=Overdue: [% overduesloo.title |html %]">
-                    [% overduesloo.borroweremail %]</a>[% END %]
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% overduesloo.borrowernumber | html %]">[% overduesloo.borrowersurname | html %], [% overduesloo.borrowerfirstname | html %]</a>
+                        <br />[% overduesloo.cardnumber | html %]
+                        <br />[% overduesloo.borrowerphone | html %]<br />
+                    [% IF ( overduesloo.borroweremail ) %]<a href="mailto:[% overduesloo.borroweremail | html %]?subject=Overdue: [% overduesloo.title | html %]">
+                    [% overduesloo.borroweremail | html %]</a>[% END %]
                     </td>
-                    <td>[% Branches.GetName( overduesloo.homebranch ) %] [% overduesloo.itemcallnumber %]
+                    <td>[% Branches.GetName( overduesloo.homebranch ) | html %] [% overduesloo.itemcallnumber | html %]
                     </td>
                 </tr>
             [% END %]
                     <tr>
                         <td>
                             <p>
-                            [% todayoverduesloo.date_due %]
+                            [% todayoverduesloo.date_due | html %]
                             </p>
                         </td>
                         <td>
                             <p>
-                                <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% todayoverduesloo.biblionumber %]">[% todayoverduesloo.title |html %]</a>
-                                &nbsp; (<b>[% todayoverduesloo.description %]</b>)
-                                <br />Barcode : [% todayoverduesloo.barcode %]
+                                <a href="/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=[% todayoverduesloo.biblionumber | html %]">[% todayoverduesloo.title | html %]</a>
+                                &nbsp; (<b>[% todayoverduesloo.description | html %]</b>)
+                                <br />Barcode : [% todayoverduesloo.barcode | html %]
                             </p>
                         </td>
                         <td>
-                            <p><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% todayoverduesloo.borrowernumber %]">[% todayoverduesloo.borrowersurname %] &nbsp; [% todayoverduesloo.borrowerfirstname %]</a>
-                            <br />[% todayoverduesloo.cardnumber %]<br />
-                            <br />[% todayoverduesloo.borrowerphone %]<br />
-                        [% IF ( todayoverduesloo.borroweremail ) %]<a href="mailto:[% todayoverduesloo.borroweremail %]?subject=Overdue: [% todayoverduesloo.title |html %]">
-                        [% todayoverduesloo.borroweremail %]</a>[% END %]
+                            <p><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% todayoverduesloo.borrowernumber | html %]">[% todayoverduesloo.borrowersurname | html %] &nbsp; [% todayoverduesloo.borrowerfirstname | html %]</a>
+                            <br />[% todayoverduesloo.cardnumber | html %]<br />
+                            <br />[% todayoverduesloo.borrowerphone | html %]<br />
+                        [% IF ( todayoverduesloo.borroweremail ) %]<a href="mailto:[% todayoverduesloo.borroweremail | html %]?subject=Overdue: [% todayoverduesloo.title | html %]">
+                        [% todayoverduesloo.borroweremail | html %]</a>[% END %]
                             </p>
                         </td>
-                        <td><p>[% Branches.GetName( todayoverduesloo.homebranch ) %] [% todayoverduesloo.itemcallnumber %]</p>
+                        <td><p>[% Branches.GetName( todayoverduesloo.homebranch ) | html %] [% todayoverduesloo.itemcallnumber | html %]</p>
                         </td>
                         <td>
-                        <a href="branchoverdues.pl?action=remove&amp;borrowernumber=[% todayoverduesloo.borrowernumber %]&amp;itemnumber=[% todayoverduesloo.itemnumber %]&amp;method=phone&amp;location=[% todayoverduesloo.location %]">Cancel notification</a>
+                        <a href="branchoverdues.pl?action=remove&amp;borrowernumber=[% todayoverduesloo.borrowernumber | html %]&amp;itemnumber=[% todayoverduesloo.itemnumber | html %]&amp;method=phone&amp;location=[% todayoverduesloo.location | html %]">Cancel notification</a>
                         </td>
                     </tr>
                 [% END %]
index 451f252..adc3cf1 100644 (file)
     <table>
         <caption>
             [% IF ( reserved ) %]
-                Reserve found for [% name %] (<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">[% borrowernumber %]</a>).
+                Reserve found for [% name | html %] (<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">[% borrowernumber | html %]</a>).
             [% END %]
             [% IF ( waiting ) %]
-                Item is marked waiting at [% branchname %] for [% name %] (<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">[% borrowernumber %]</a>).
+                Item is marked waiting at [% branchname | html %] for [% name | html %] (<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">[% borrowernumber | html %]</a>).
             [% END %]
         </caption>
         <tr>
             <th>
-                [% IF ( reserved ) %]Set reserve to waiting and transfer book to [% branchname %]: [% END %]
+                [% IF ( reserved ) %]Set reserve to waiting and transfer book to [% branchname | html %]: [% END %]
                 [% IF ( waiting ) %]Cancel reservation and then attempt transfer: [% END %]
             </th>
             <td>
                 <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
                     [% FOREACH trsfitemloo IN trsfitemloop %]
-                        <input type="hidden" name="bc-[% trsfitemloo.counter %]" value="[% trsfitemloo.barcode %]" />
-                        <input type="hidden" name="fb-[% trsfitemloo.counter %]" value="[% trsfitemloo.frombrcd %]" />
-                        <input type="hidden" name="tb-[% trsfitemloo.counter %]" value="[% trsfitemloo.tobrcd %]" />
+                        <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.barcode | html %]" />
+                        <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
+                        <input type="hidden" name="tb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.tobrcd | html %]" />
                     [% END %]
-                    <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
-                    <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+                    <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
+                    <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                     [% IF ( waiting ) %]
                         <input type="hidden" name="barcode" value="[% barcode | html %]" />
                         <input type="hidden" name="request" value="KillWaiting" />
                     <td>
                         <form method="post" name="mainform" id="mainform" action="branchtransfers.pl">
                             [% FOREACH trsfitemloo IN trsfitemloop %]
-                                <input type="hidden" name="bc-[% trsfitemloo.counter %]" value="[% trsfitemloo.barcode %]" />
-                                <input type="hidden" name="fb-[% trsfitemloo.counter %]" value="[% trsfitemloo.frombrcd %]" />
-                                <input type="hidden" name="tb-[% trsfitemloo.counter %]" value="[% trsfitemloo.tobrcd %]" />
+                                <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.barcode | html %]" />
+                                <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
+                                <input type="hidden" name="tb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.tobrcd | html %]" />
                             [% END %]
-                            <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
-                            <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
-                            <input type="hidden" name="tobranchcd" value="[% tobranchcd %]" />
+                            <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+                            <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
+                            <input type="hidden" name="tobranchcd" value="[% tobranchcd | html %]" />
                             <input type="hidden" name="barcode" value="[% barcode | html %]" />
                             <input type="hidden" name="request" value="KillReserved" />
                             <input type="submit" value="Cancel" />
                     <th>Ignore and return to transfers: </th>
                         <td>
                             <form method="post" name="mainform" id="mainform" action="branchtransfers.pl" />
-                                <input type="hidden" name="tobranchcd" value="[% tobranchcd %]" />
+                                <input type="hidden" name="tobranchcd" value="[% tobranchcd | html %]" />
                                 <input type="hidden" name="barcode" />
                                 [% FOREACH trsfitemloo IN trsfitemloop %]
-                                    <input type="hidden" name="bc-[% trsfitemloo.counter %]" value="[% trsfitemloo.barcode %]" />
-                                    <input type="hidden" name="fb-[% trsfitemloo.counter %]" value="[% trsfitemloo.frombrcd %]" />
-                                    <input type="hidden" name="tb-[% trsfitemloo.counter %]" value="[% trsfitemloo.tobrcd %]" />
+                                    <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.barcode | html %]" />
+                                    <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
+                                    <input type="hidden" name="tb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.tobrcd | html %]" />
                                 [% END %]
                                 <input type="submit" value="Ignore" />
                             </form>
@@ -98,7 +98,7 @@
                              <li>Reserve cancelled</li>
                          [% END %]
                          [% IF ( setwaiting ) %]
-                             <li>Item should now be waiting at library: [% reqbrchname %]</li>
+                             <li>Item should now be waiting at library: [% reqbrchname | html %]</li>
                          [% END %]
                          </ul>
                     </div>
                                   <li>No Item with barcode: [% errmsgloo.msg | html %]</li>
                               [% END %]
                               [% IF ( errmsgloo.errispermanent ) %]
-                                  <li>Please return item to home library: [% Branches.GetName( errmsgloo.msg ) %]</li>
+                                  <li>Please return item to home library: [% Branches.GetName( errmsgloo.msg ) | html %]</li>
                               [% END %]
                               [% IF ( errmsgloo.errnotallowed ) %]
                                   <li>Transfer is not allowed for:
                                       <ol>
                                           [% IF ( Koha.Preference('BranchTransferLimitsType') == 'itemtype' ) %]
-                                              <li>Item type: <b>[% ItemTypes.GetDescription( errmsgloo.code ) %]</b></li>
+                                              <li>Item type: <b>[% ItemTypes.GetDescription( errmsgloo.code ) | html %]</b></li>
                                           [% ELSE %]
-                                              <li>Collection code: <b>[% AuthorisedValues.GetByCode( 'CCODE', errmsgloo.code ) %]</b></li>
+                                              <li>Collection code: <b>[% AuthorisedValues.GetByCode( 'CCODE', errmsgloo.code ) | html %]</b></li>
                                           [% END %]
-                                          <li>Destination library: <b>[% Branches.GetName( errmsgloo.tbr ) %]</b></li>
+                                          <li>Destination library: <b>[% Branches.GetName( errmsgloo.tbr ) | html %]</b></li>
                                       </ol>
                                   </li>
                               [% END %]
                                   <li>Item is already at destination library.</li>
                               [% END %]
                               [% IF ( errmsgloo.errwasreturned ) %]
-                                  <li>Item was on loan to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% errmsgloo.patron.borrowernumber %]">
-                                  [% errmsgloo.patron.firstname %] [% errmsgloo.patron.surname %]
-                                  ([% errmsgloo.patron.cardnumber %])</a> and has been returned.</li>
+                                  <li>Item was on loan to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% errmsgloo.patron.borrowernumber | html %]">
+                                  [% errmsgloo.patron.firstname | html %] [% errmsgloo.patron.surname | html %]
+                                  ([% errmsgloo.patron.cardnumber | html %])</a> and has been returned.</li>
                               [% END %]
                           [% END %]
                           </ul>
             </li>
                        </ol>
         </fieldset>
-        <input type="hidden" name="tobranchcd" value="[% tobrancd %]" />
+        <input type="hidden" name="tobranchcd" value="[% tobrancd | html %]" />
         [% FOREACH trsfitemloo IN trsfitemloop %]
-            <input type="hidden" name="bc-[% trsfitemloo.counter %]" value="[% trsfitemloo.barcode %]" />
-            <input type="hidden" name="fb-[% trsfitemloo.counter %]" value="[% trsfitemloo.frombrcd %]" />
-            <input type="hidden" name="tb-[% trsfitemloo.counter %]" value="[% trsfitemloo.tobrcd %]" />
+            <input type="hidden" name="bc-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.barcode | html %]" />
+            <input type="hidden" name="fb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.frombrcd | html %]" />
+            <input type="hidden" name="tb-[% trsfitemloo.counter | html %]" value="[% trsfitemloo.tobrcd | html %]" />
         [% END %]
     </form>
 </div>
             </tr>
             [% FOREACH trsfitemloo IN trsfitemloop %]
                 <tr>
-                    <td class="tf-title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% trsfitemloo.biblionumber %]">[% trsfitemloo.title |html %]</a></td>
-                    <td class="tf-author">[% trsfitemloo.author %]</td>
-                    <td class="tf-barcode"><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% trsfitemloo.biblionumber %]&amp;itemnumber=[% trsfitemloo.itemnumber %]#item[% trsfitemloo.itemnumber %]">[% trsfitemloo.barcode %]</a></td>
-                    <td class="tf-location">[% trsfitemloo.location %]</td>
-                    <td class="tf-itemcallnumber">[% trsfitemloo.itemcallnumber %]</td>
-                    <td class="tf-itemtype">[% ItemTypes.GetDescription( trsfitemloo.itemtype ) %]</td>
-                    <td class="tf-ccode">[% AuthorisedValues.GetByCode( 'CCODE', trsfitemloo.ccode ) %]</td>
-                    <td class="tf-destination">[% Branches.GetName( trsfitemloo.tobrcd ) %]</td>
+                    <td class="tf-title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% trsfitemloo.biblionumber | html %]">[% trsfitemloo.title | html %]</a></td>
+                    <td class="tf-author">[% trsfitemloo.author | html %]</td>
+                    <td class="tf-barcode"><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% trsfitemloo.biblionumber | html %]&amp;itemnumber=[% trsfitemloo.itemnumber | html %]#item[% trsfitemloo.itemnumber | html %]">[% trsfitemloo.barcode | html %]</a></td>
+                    <td class="tf-location">[% trsfitemloo.location | html %]</td>
+                    <td class="tf-itemcallnumber">[% trsfitemloo.itemcallnumber | html %]</td>
+                    <td class="tf-itemtype">[% ItemTypes.GetDescription( trsfitemloo.itemtype ) | html %]</td>
+                    <td class="tf-ccode">[% AuthorisedValues.GetByCode( 'CCODE', trsfitemloo.ccode ) | html %]</td>
+                    <td class="tf-destination">[% Branches.GetName( trsfitemloo.tobrcd ) | html %]</td>
                 </tr>
             [% END %]
         </table>
index 4b99a49..1e80832 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
             [% IF ( selected_count ) %]
                 <div class="dialog message">
                     [% IF ( action == 'seen' ) %]
-                        <span>[% selected_count %] note(s) marked as seen.</span>
+                        <span>[% selected_count | html %] note(s) marked as seen.</span>
                     [% ELSIF ( action == 'notseen' ) %]
-                        <span>[% selected_count %] note(s) marked as not seen.</span>
+                        <span>[% selected_count | html %] note(s) marked as not seen.</span>
                     [% ELSE %]
-                        <span>Failed to change the status of [% selected_count %] item(s).</span>
+                        <span>Failed to change the status of [% selected_count | html %] item(s).</span>
                     [% END %]
                 </div>
             [% END %]
                         <tbody>
                             [% FOREACH note IN notes %]
                                 <tr>
-                                    <td><input type="checkbox" name="issue_ids" value="[% note.issue_id %]"></td>
-                                    <td>[% note.item.biblio.title %] - [% note.item.biblio.author %] (<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% note.item.biblionumber %]">[% note.item.barcode %]</a>)</td>
+                                    <td><input type="checkbox" name="issue_ids" value="[% note.issue_id | html %]"></td>
+                                    <td>[% note.item.biblio.title | html %] - [% note.item.biblio.author | html %] (<a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% note.item.biblionumber | html %]">[% note.item.barcode | html %]</a>)</td>
                                     <td>[% note.note | html %]</td>
-                                    <td><span title="[% note.notedate %]">[% note.notedate | $KohaDates %]</span></td>
+                                    <td><span title="[% note.notedate | html %]">[% note.notedate | $KohaDates %]</span></td>
                                     <td>[% INCLUDE 'patron-title.inc' patron => note.patron hide_patron_infos_if_needed=1 %]</td>
-                                    <td class="seen[% note.noteseen %]">
+                                    <td class="seen[% note.noteseen | html %]">
                                         [% IF ( note.noteseen == 0 ) %]
-                                            <span id="status_[% note.issue_id %]">Not seen</span>
+                                            <span id="status_[% note.issue_id | html %]">Not seen</span>
                                         [% ELSIF ( note.noteseen == 1 ) %]
-                                            <span id="status_[% note.issue_id %]">Seen</span>
+                                            <span id="status_[% note.issue_id | html %]">Seen</span>
                                         [% END %]
                                     </td>
                                     <td class="actions">
                                         [% IF ( note.noteseen == 1 ) %]
-                                            <button name="seen" data-issue_id="[% note.issue_id %]" class="seen btn btn-default btn-xs" disabled="disabled"><i class="fa fa-eye"></i> Mark seen</button> <button name="notseen" data-issue_id="[% note.issue_id %]" class="notseen btn btn-default btn-xs"><i class="fa fa-eye-slash"></i> Mark not seen</button>
+                                            <button name="seen" data-issue_id="[% note.issue_id | html %]" class="seen btn btn-default btn-xs" disabled="disabled"><i class="fa fa-eye"></i> Mark seen</button> <button name="notseen" data-issue_id="[% note.issue_id | html %]" class="notseen btn btn-default btn-xs"><i class="fa fa-eye-slash"></i> Mark not seen</button>
                                         [% ELSIF ( note.noteseen == 0 ) %]
-                                            <button name="seen" data-issue_id="[% note.issue_id %]" class="seen btn btn-default btn-xs"><i class="fa fa-eye"></i> Mark seen</button> <button name="notseen" data-issue_id="[% note.issue_id %]" class="notseen btn btn-default btn-xs" disabled="disabled"><i class="fa fa-eye-slash"></i> Mark not seen</button>
+                                            <button name="seen" data-issue_id="[% note.issue_id | html %]" class="seen btn btn-default btn-xs"><i class="fa fa-eye"></i> Mark seen</button> <button name="notseen" data-issue_id="[% note.issue_id | html %]" class="notseen btn btn-default btn-xs" disabled="disabled"><i class="fa fa-eye-slash"></i> Mark not seen</button>
                                         [% END %]
                                     </td>
                                 </tr>
index 0ba1d43..6c30223 100644 (file)
         </div>
         <div class="row" id="intranet-circulation-home-html">
             <div class="col-md-12">
-                [% Koha.Preference('IntranetCirculationHomeHTML') %]
+                [% Koha.Preference('IntranetCirculationHomeHTML') | html %]
             </div>
         </div>
         <div class="row" id="offline-circulation">
                     </div>
                     <div class="col-sm-5 col-md-3">
                     <p><a href="https://github.com/bywatersolutions/koha-offline-circulation/releases"><i class="fa fa-window-maximize"></i> Get desktop application</a></p>
-                    <p><a href="https://addons.mozilla.org/[% lang %]/firefox/addon/koct/"><i class="fa fa-firefox"></i> Get Firefox add-on</a></p>
+                    <p><a href="https://addons.mozilla.org/[% lang | html %]/firefox/addon/koct/"><i class="fa fa-firefox"></i> Get Firefox add-on</a></p>
                     </div>
             </div>
         </div>
index 136602c..6cdc633 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -16,7 +17,7 @@
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_circulation" class="circ">
 
 [% IF additional_materials %]
     <div id="materials" class="dialog message">Note about the accompanying materials: <br />
-    [% additional_materials %]
+    [% additional_materials | html %]
     </div>
 [% END %]
 
 [% IF ( alert.ITEM_LOST ) %]
-    <div class="dialog message">This item has been lost with a status of "[% alert.ITEM_LOST %]".</div>
+    <div class="dialog message">This item has been lost with a status of "[% alert.ITEM_LOST | html %]".</div>
 [% END %]
 
 [% IF ( alert.OTHER_CHARGES ) %]
-    <div class="dialog message">The patron has unpaid charges for holds, rentals etc of [% alert.OTHER_CHARGES %]</div>
+    <div class="dialog message">The patron has unpaid charges for holds, rentals etc of [% alert.OTHER_CHARGES | html %]</div>
 [% END %]
 
 [% IF alert.HIGHHOLDS %]
-    <div class="dialog message">High demand item. <b>Loan period was not shortened due to override.</b> Shortened due date would have been [% alert.HIGHHOLDS.returndate %] ([% alert.HIGHHOLDS.duration %] days).</div>
+    <div class="dialog message">High demand item. <b>Loan period was not shortened due to override.</b> Shortened due date would have been [% alert.HIGHHOLDS.returndate | html %] ([% alert.HIGHHOLDS.duration | html %] days).</div>
 [% END %]
 
 [% IF ( nopermission ) %]
@@ -90,7 +91,7 @@
 
 <ul>
 [%IF ( AGE_RESTRICTION ) %]
-    <li>Age restriction [% AGE_RESTRICTION %].
+    <li>Age restriction [% AGE_RESTRICTION | html %].
       [% IF CAN_user_circulate_force_checkout %]
         Check out anyway?
       [% END %]
 [% END %]
 
 [% IF ( DEBT ) %]
-    <li>The patron has a debt of [% DEBT | $Price %].</li>
+    <li>The patron has a debt of [% DEBT | $Price | html %].</li>
 [% END %]
 
 [% IF ( DEBT_GUARANTEES ) %]
-    <li>The patron's guarantees collectively have a debt of [% DEBT_GUARANTEES | $Price %].</li>
+    <li>The patron's guarantees collectively have a debt of [% DEBT_GUARANTEES | $Price | html %].</li>
 [% END %]
 
 [% IF ( RENTALCHARGE && RENTALCHARGE > 0 ) %]
-    <li>Rental charge for this item: [% RENTALCHARGE %]</li>
+    <li>Rental charge for this item: [% RENTALCHARGE | html %]</li>
 [% END %]
 
 [% IF ( RENEW_ISSUE ) %]
-    <li>Item <i>[% getTitleMessageIteminfo %]</i> ([% getBarcodeMessageIteminfo %]) is currently checked out to this patron.  Renew?</li>
+    <li>Item <i>[% getTitleMessageIteminfo | html %]</i> ([% getBarcodeMessageIteminfo | html %]) is currently checked out to this patron.  Renew?</li>
 [% END %]
 
 [% IF ( RESERVE_WAITING ) %]
-    <li>Item <i>[% getTitleMessageIteminfo %]</i> ([% getBarcodeMessageIteminfo %]) has been waiting for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% resborrowernumber %]">[% resfirstname %] [% ressurname %]</a> ([% rescardnumber %]) at [% Branches.GetName( resbranchcode ) %] since [% reswaitingdate | $KohaDates %]</li>
+    <li>Item <i>[% getTitleMessageIteminfo | html %]</i> ([% getBarcodeMessageIteminfo | html %]) has been waiting for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% resborrowernumber | html %]">[% resfirstname | html %] [% ressurname | html %]</a> ([% rescardnumber | html %]) at [% Branches.GetName( resbranchcode ) | html %] since [% reswaitingdate | $KohaDates %]</li>
 [% END %]
 
 [% IF ( RESERVED ) %]
-    <li>Item <i>[% getTitleMessageIteminfo %]</i> ([% getBarcodeMessageIteminfo %]) has been on hold for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% resborrowernumber %]">[% resfirstname %] [% ressurname %]</a> ([% rescardnumber %]) at [% Branches.GetName( resbranchcode ) %] since [% resreservedate | $KohaDates %]</li>
+    <li>Item <i>[% getTitleMessageIteminfo | html %]</i> ([% getBarcodeMessageIteminfo | html %]) has been on hold for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% resborrowernumber | html %]">[% resfirstname | html %] [% ressurname | html %]</a> ([% rescardnumber | html %]) at [% Branches.GetName( resbranchcode ) | html %] since [% resreservedate | $KohaDates %]</li>
 [% END %]
 
 [% IF ( ISSUED_TO_ANOTHER ) %]
-    <li>Item <i>[% getTitleMessageIteminfo %]</i> ([% getBarcodeMessageIteminfo %]) is checked out to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% issued_borrowernumber %]">[% issued_firstname %] [% issued_surname %]</a> ([% issued_cardnumber %]).
+    <li>Item <i>[% getTitleMessageIteminfo | html %]</i> ([% getBarcodeMessageIteminfo | html %]) is checked out to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% issued_borrowernumber | html %]">[% issued_firstname | html %] [% issued_surname | html %]</a> ([% issued_cardnumber | html %]).
       [% IF CAN_user_circulate_force_checkout %]
         Check in and check out?
       [% END %]
 [% END %]
 
 [% IF TOO_MANY and TOO_MANY == 'TOO_MANY_CHECKOUTS' %]
-    <li>Too many checked out. [% current_loan_count %] checked out, only [% max_loans_allowed %] are allowed.</li>
+    <li>Too many checked out. [% current_loan_count | html %] checked out, only [% max_loans_allowed | html %] are allowed.</li>
 [% END %]
 
 [% IF TOO_MANY and TOO_MANY == 'TOO_MANY_ONSITE_CHECKOUTS' %]
-    <li>Too many on-site checked out. [% current_loan_count %] on-site checked out, only [% max_loans_allowed %] are allowed.</li>
+    <li>Too many on-site checked out. [% current_loan_count | html %] on-site checked out, only [% max_loans_allowed | html %] are allowed.</li>
 [% END %]
 
 [% IF ( BORRNOTSAMEBRANCH ) %]
-    <li>This patron is from a different library ([% Branches.GetName( BORRNOTSAMEBRANCH ) %])</li>
+    <li>This patron is from a different library ([% Branches.GetName( BORRNOTSAMEBRANCH ) | html %])</li>
 [% END %]
 
 [% IF ( PATRON_CANT ) %]
     [% IF ( itemtype_notforloan ) %]
         Item type is normally not for loan.
     [% ELSIF ( item_notforloan ) %]
-        [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, item_notforloan, 0 ) %]
-        Item is normally not for loan [% IF (item_notforloan_lib) %]([% item_notforloan_lib %])[% END %].
+        [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, item_notforloan, 0 ) | html %]
+        Item is normally not for loan [% IF (item_notforloan_lib) %]([% item_notforloan_lib | html %])[% END %].
     [% END %]
       [% IF CAN_user_circulate_force_checkout %]
         Check out anyway?
 [% END %]
 
 [% IF ( ITEM_LOST ) %]
-    <li>This item has been lost with a status of "[% ITEM_LOST %]".
+    <li>This item has been lost with a status of "[% ITEM_LOST | html %]".
       [% IF CAN_user_circulate_force_checkout %]
         Check out anyway?
       [% END %]
 [% END %]
 
 [% IF HIGHHOLDS %]
-    <li>High demand item. Loan period shortened to [% HIGHHOLDS.duration %] days (due [% HIGHHOLDS.returndate %]). Check out anyway?</li>
+    <li>High demand item. Loan period shortened to [% HIGHHOLDS.duration | html %] days (due [% HIGHHOLDS.returndate | html %]). Check out anyway?</li>
 [% END %]
 
 [% IF PREVISSUE %]
-    <li>Patron has previously checked out this title: <b>[% biblio.title %] [% IF biblio.author %] by [% biblio.author %][% END %]</b>. Check out anyway?</li>
+    <li>Patron has previously checked out this title: <b>[% biblio.title | html %] [% IF biblio.author %] by [% biblio.author | html %][% END %]</b>. Check out anyway?</li>
 [% END %]
 
 [% IF BIBLIO_ALREADY_ISSUED %]
 </p>
 [% END %]
 
-    <input type="hidden" name="barcode" value="[% barcode |html %]" />
-    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+    <input type="hidden" name="barcode" value="[% barcode | html %]" />
+    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="issueconfirmed" value="1" />
-    <input type="hidden" name="override_high_holds" value="[% override_high_holds %]"/>
+    <input type="hidden" name="override_high_holds" value="[% override_high_holds | html %]"/>
     [% IF ( DEBT ) %]<input type="hidden" name="debt_confirmed" value="1" />[% END %]
     [% IF ( INVALID_DATE ) %]
     <p>
-    <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec %]" />
+    <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec | html %]" />
     <label for="duedatespec">Due date</label>
     </p>
     [% ELSE %]
-    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
+    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
     [% END %]
-    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-    <input type="hidden" name="branch" value="[% branch %]" />
+    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+    <input type="hidden" name="branch" value="[% branch | html %]" />
     [% IF ( RENEW_ISSUE ) %]
     <button type="submit" class="approve" accesskey="y"><i class="fa fa-check"></i> Yes, renew (Y)</button>
     [% ELSE %]
     <button type="submit" class="approve" accesskey="y"><i class="fa fa-check"></i> Yes, check out (Y)</button>
     [% END %]
-    <input type="hidden" name="onsite_checkout" value="[% onsite_checkout %]" />
-    <input type="hidden" name="auto_renew" value="[% auto_renew %]" />
+    <input type="hidden" name="onsite_checkout" value="[% onsite_checkout | html %]" />
+    <input type="hidden" name="auto_renew" value="[% auto_renew | html %]" />
 </form>
 [% END %]
 
 [% IF ( RESERVED ) %]
 <form method="get" action="/cgi-bin/koha/circ/circulation.pl">
     <input type="hidden" name="restoreduedatespec" />
-    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
-    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-    <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber %]&amp;biblionumber=[% itembiblionumber %]&amp;itemnumber=[% item.itemnumber %]&amp;op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button>
+    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
+    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+    <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | html %]&amp;biblionumber=[% itembiblionumber | html %]&amp;itemnumber=[% item.itemnumber | html %]&amp;op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button>
 </form>
 [% END %]
 
 [% IF ( RESERVE_WAITING ) %]
 <form method="get" action="/cgi-bin/koha/circ/circulation.pl">
     <input type="hidden" name="restoreduedatespec" />
-    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
-    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-    <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber %]&amp;biblionumber=[% itembiblionumber %]&amp;itemnumber=[% item.itemnumber %]&amp;op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button>
+    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
+    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+    <button class="print" type="submit" onclick="Dopop('hold-transfer-slip.pl?borrowernumber=[% reserveborrowernumber | html %]&amp;biblionumber=[% itembiblionumber | html %]&amp;itemnumber=[% item.itemnumber | html %]&amp;op=slip');this.form.submit();"><i class="fa fa-print"></i> Don't check out and print slip (P)</button>
 </form>
 [% END %]
 
 <form method="get" action="/cgi-bin/koha/circ/circulation.pl">
     [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %]
-    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
+    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
     <input type="hidden" name="restoreduedatespec" />
-    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
+    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
     [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %]
         [% IF ( RENEW_ISSUE ) %]
         <button type="submit" class="deny" accesskey="n"><i class="fa fa-times"></i> No, don't renew (N)</button>
 
 [% IF ( RESERVED || ISSUED_TO_ANOTHER ) && (CAN_user_reserveforothers_place_holds ) %]
     [% UNLESS noissues %]
-        <button type="submit" onclick="window.location.href='/cgi-bin/koha/reserve/request.pl?biblionumber=[% itembiblionumber %]&borrowernumber=[% patron.borrowernumber %]'"><i class="fa fa-sticky-note-o"></i> Cancel checkout and place a hold for [% INCLUDE 'patron-title.inc' %]</button>
+        <button type="submit" onclick="window.location.href='/cgi-bin/koha/reserve/request.pl?biblionumber=[% itembiblionumber | html %]&borrowernumber=[% patron.borrowernumber | html %]'"><i class="fa fa-sticky-note-o"></i> Cancel checkout and place a hold for [% INCLUDE 'patron-title.inc' %]</button>
     [% END %]
 [% END %]
 </div></div>
         [% END %]
 
         [% IF ( INVALID_DATE ) %]
-            <li>The due date &quot;[% INVALID_DATE %]&quot; is invalid</li>
+            <li>The due date &quot;[% INVALID_DATE | html %]&quot; is invalid</li>
         [% END %]
 
         [% IF ( UNKNOWN_BARCODE ) %]
-            <li>The barcode was not found: <span class="ex">[% barcode |html %]</span>
+            <li>The barcode was not found: <span class="ex">[% barcode | html %]</span>
 
                 <div>
                     [% IF ( FALLBACK ) %]
 
                     [% IF ( fast_cataloging ) %]
                         [% IF ( CAN_user_editcatalogue_fast_cataloging ) %]
-                            <a class="approve" href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=FA&amp;barcode=[% barcode |uri %]&amp;circborrowernumber=[% patron.borrowernumber %]&amp;branch=[% branch %]&amp;duedatespec=[% duedatespec %]&amp;stickyduedate=[% stickyduedate %]"><i class="fa fa-plus"></i> Add record using fast cataloging</a>
+                            <a class="approve" href="/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=FA&amp;barcode=[% barcode |uri %]&amp;circborrowernumber=[% patron.borrowernumber | html %]&amp;branch=[% branch | html %]&amp;duedatespec=[% duedatespec | html %]&amp;stickyduedate=[% stickyduedate | html %]"><i class="fa fa-plus"></i> Add record using fast cataloging</a>
                         [% END %]
                     [% END %]
                 </div>
             [% IF ( itemtype_notforloan ) %]
                 Item type not for loan.
             [% ELSIF ( item_notforloan ) %]
-                [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, item_notforloan, 0 ) %]
-                Item not for loan [% IF (item_notforloan_lib) %]([% item_notforloan_lib %])[% END %].
+                [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, item_notforloan, 0 ) | html %]
+                Item not for loan [% IF (item_notforloan_lib) %]([% item_notforloan_lib | html %])[% END %].
             [% END %]
             </li>
         [% END %]
         [% END %]
 
         [%IF ( AGE_RESTRICTION ) %]
-            <li>Age restriction [% AGE_RESTRICTION %].</li>
+            <li>Age restriction [% AGE_RESTRICTION | html %].</li>
         [% END %]
 
         [% IF ( EXPIRED ) %]
         [% END %]
 
         [% IF ( TOO_MANY ) %]
-            <li>Too many checked out. [% current_loan_count %] checked out, only [% max_loans_allowed %] are allowed.</li>
+            <li>Too many checked out. [% current_loan_count | html %] checked out, only [% max_loans_allowed | html %] are allowed.</li>
         [% END %]
 
         [% IF ( ITEMNOTSAMEBRANCH ) %]
-            <li>This item belongs to [% Branches.GetName( itemhomebranch ) %] and cannot be checked out from this location.</li>
+            <li>This item belongs to [% Branches.GetName( itemhomebranch ) | html %] and cannot be checked out from this location.</li>
         [% END %]
 
         [% IF RETURN_IMPOSSIBLE %]
-            <li>This item must be returned to [% Branches.GetName( branch_to_return ) %].</li>
+            <li>This item must be returned to [% Branches.GetName( branch_to_return ) | html %].</li>
         [% END %]
 
         [% IF ( USERBLOCKEDWITHENDDATE ) %]
                                     [% FOREACH book IN options %]
                                         <tr>
                                             <td>
-                                                <a class="popup" target="_blank" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% book.biblionumber %]">[% book.title %]</a>
-                                                [% book.barcode %]
+                                                <a class="popup" target="_blank" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% book.biblionumber | html %]">[% book.title | html %]</a>
+                                                [% book.barcode | html %]
                                             </td>
                                             <td>
                                                 <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off">
                                                         <input type="hidden" name="forceallow" value="1">
                                                     [% END %]
                                                     <input type="hidden" name="restoreduedatespec" />
-                                                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-                                                    <input type="hidden" name="duedatespec" value="[% duedatespec %]" />
-                                                    <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" />
-                                                    <input type="hidden" name="branch" value="[% branch %]" />
-                                                    <input type="hidden" name="barcode" value="[% book.barcode %]" />
+                                                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                                                    <input type="hidden" name="duedatespec" value="[% duedatespec | html %]" />
+                                                    <input type="hidden" name="stickyduedate" value="[% stickyduedate | html %]" />
+                                                    <input type="hidden" name="branch" value="[% branch | html %]" />
+                                                    <input type="hidden" name="barcode" value="[% book.barcode | html %]" />
                                                     <button class="btn btn-default btn-xs" type="submit" name="x"><i class="fa fa-check"></i> Check out</button>
                                                 </form>
                                             </td>
@@ -537,7 +538,7 @@ No patron matched <span class="ex">[% message | html %]</span>
                 <div id="specify-due-date" class="checkout-setting">
                     <div class="hint">Specify due date [% INCLUDE 'date-format.inc' %]: </div>
                     [% IF ( duedatespec ) %]
-                        <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec %]" />
+                        <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec | html %]" />
                     [% ELSE %]
                         <input type="text" size="13" id="duedatespec" name="duedatespec" value="" />
                     [% END %]
@@ -598,17 +599,17 @@ No patron matched <span class="ex">[% message | html %]</span>
 
     </div> <!-- /.checkout-settings -->
 
-          <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-          <input type="hidden" name="branch" value="[% branch %]" />
+          <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+          <input type="hidden" name="branch" value="[% branch | html %]" />
           <input type="hidden" name="print" value="maybe" />
-          <input type="hidden" name="debt_confirmed" value="[% debt_confirmed %]" />
+          <input type="hidden" name="debt_confirmed" value="[% debt_confirmed | html %]" />
                 [% IF ( CHARGES ) %]
                         <input type="hidden" name="charges" value="yes" />
                 [% END %]
 </fieldset>
 [% IF ( issue ) %]
     <div class="lastchecked">
-        <p><strong>Checked out: </strong>[% issue.item.biblioitemnumber.biblionumber.title %] ([% issue.item.barcode %]). Due on [% issue.date_due | $KohaDates %]</p>
+        <p><strong>Checked out: </strong>[% issue.item.biblioitemnumber.biblionumber.title | html %] ([% issue.item.barcode | html %]). Due on [% issue.date_due | $KohaDates %]</p>
     </div>
 [% END %]
 </form></div>
@@ -655,7 +656,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
                        [% IF ( warndeparture ) %]
                        <li><span class="circ-hlt">Expiration:</span> Patron's card will expire soon.
-            Patron's card expires on [% expiry | $KohaDates %] <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber %]&amp;destination=circ&amp;reregistration=y">Renew</a> or <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber %]&amp;categorycode=[% categorycode %]">Edit Details</a>
+            Patron's card expires on [% expiry | $KohaDates %] <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;destination=circ&amp;reregistration=y">Renew</a> or <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;categorycode=[% categorycode | html %]">Edit Details</a>
 
                        </li>
                        [% END %]
@@ -668,7 +669,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
                        [% IF ( expired ) %]
                        <li><span class="circ-hlt">Expiration:</span> Patron's card has expired.
-            [% IF ( expiry ) %]Patron's card expired on [% expiry | $KohaDates %][% END %] <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber %]&amp;destination=circ&amp;reregistration=y">Renew</a> or <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber %]&amp;categorycode=[% categorycode %]">Edit Details</a>
+            [% IF ( expiry ) %]Patron's card expired on [% expiry | $KohaDates %][% END %] <a href="/cgi-bin/koha/members/setstatus.pl?borrowernumber=[% patron.borrowernumber | html %]&amp;destination=circ&amp;reregistration=y">Renew</a> or <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;categorycode=[% categorycode | html %]">Edit Details</a>
 
                        </li>
                        [% END %]
@@ -691,18 +692,18 @@ No patron matched <span class="ex">[% message | html %]</span>
 
                    [% IF ( debarredcomment ) %]
                        with the explanation: <br/><i>
-                          [% IF debarredcomment.search('OVERDUES_PROCESS') %]
-                              Restriction added by overdues process [% debarredcomment.remove('OVERDUES_PROCESS ') | html_line_break %]
-                          [% ELSE %]
-                              [% debarredcomment | html_line_break %]
-                          [% END %]
-                    </i>
+                       [% IF debarredcomment.search('OVERDUES_PROCESS') %]
+                           Restriction added by overdues process [% debarredcomment.remove('OVERDUES_PROCESS ').raw | html_line_break %]
+                       [% ELSE %]
+                           [% debarredcomment.raw | html_line_break %]
+                       [% END %]
+                       </i>
                    [% END %]
                    <br/>
                    <a class="btn btn-default btn-sm" href="#reldebarments" onclick="$('#debarments-tab-link').click()"><i class="fa fa-ban"></i> View restrictions</a>
                     [% IF (noissues && patron && CAN_user_circulate_force_checkout) %]
                         <span class="override_debarment">
-                            <a href="/cgi-bin/koha/circ/circulation.pl?forceallow=1&amp;borrowernumber=[% patron.borrowernumber %]" class="btn btn-default btn-sm">Override restriction temporarily</a>
+                            <a href="/cgi-bin/koha/circ/circulation.pl?forceallow=1&amp;borrowernumber=[% patron.borrowernumber | html %]" class="btn btn-default btn-sm">Override restriction temporarily</a>
                         </span>
                     [% END %]
                </li>
@@ -717,7 +718,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
             [% IF ( charges_guarantees ) %]
                 <li>
-                    <span class="circ-hlt">Fees &amp; Charges:</span> Patron's guarantees collectively owe [% chargesamount_guarantees | $Price %].
+                    <span class="circ-hlt">Fees &amp; Charges:</span> Patron's guarantees collectively owe [% chargesamount_guarantees | $Price | html %].
                         [% IF noissues %]
                             <span class="circ-hlt">Checkouts are BLOCKED because fine balance is OVER THE LIMIT.</span>
                         [% END %]
@@ -727,7 +728,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
             [% IF ( credits ) %]
                 <li>
-                    <span class="circ-hlt">Credits:</span> Patron has a credit[% IF ( creditsamount ) %] of [% creditsamount | $Price %][% END %]
+                    <span class="circ-hlt">Credits:</span> Patron has a credit[% IF ( creditsamount ) %] of [% creditsamount | $Price | html %][% END %]
                 </li>
             [% END %]
 
@@ -740,10 +741,10 @@ No patron matched <span class="ex">[% message | html %]</span>
                     [% FOREACH w IN WaitingHolds %]
                         <ul>
                             <li>
-                                <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% w.biblio.biblionumber %]">[% w.biblio.title | html %]</a>
-                                ([% ItemTypes.GetDescription( w.item.effective_itemtype ) %]),
+                                <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% w.biblio.biblionumber | html %]">[% w.biblio.title | html %]</a>
+                                ([% ItemTypes.GetDescription( w.item.effective_itemtype ) | html %]),
                                 [% IF ( w.biblio.author ) %] by [% w.biblio.author | html %] [% END %]
-                                [% IF ( w.item.itemcallnumber ) %] [[% w.item.itemcallnumber %]] [% END %]
+                                [% IF ( w.item.itemcallnumber ) %] [[% w.item.itemcallnumber | html %]] [% END %]
                                 Hold placed on [% w.reservedate | $KohaDates %].
 
                                 <br/>
@@ -760,7 +761,7 @@ No patron matched <span class="ex">[% message | html %]</span>
        [% IF ( notes ) %]
                        <div id="circnotes" class="circmessage">
                        <h4>Notes:</h4>
-            <p><span class="circ-hlt">[% notesmsg %]</span></p>
+            <p><span class="circ-hlt">[% notesmsg | html %]</span></p>
                        </div>
 
 
@@ -777,14 +778,14 @@ No patron matched <span class="ex">[% message | html %]</span>
                         <span>
                     [% END %]
                         [% message.message_date | $KohaDates %]
-                        [% Branches.GetName( message.branchcode ) %]
+                        [% Branches.GetName( message.branchcode ) | html %]
                         [% IF message.manager_id %]
-                            ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.manager_id %]">[% message.get_column('manager_firstname') %] [% message.get_column('manager_surname') %]</a> )
+                            ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.manager_id | html %]">[% message.get_column('manager_firstname') | html %] [% message.get_column('manager_surname') | html %]</a> )
                         [% END %]
                         <i>"[% message.message | html %]"</i>
                     </span>
                     [% IF message.branchcode == branch OR Koha.Preference('AllowAllMessageDeletion') %]
-                        <a class="btn btn-link btn-sm" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% message.message_id %]&amp;borrowernumber=[% message.borrowernumber %]" onclick="return confirm(MSG_CONFIRM_DELETE_MESSAGE);"><i class="fa fa-trash"></i> Delete</a>
+                        <a class="btn btn-link btn-sm" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% message.message_id | html %]&amp;borrowernumber=[% message.borrowernumber | html %]" onclick="return confirm(MSG_CONFIRM_DELETE_MESSAGE);"><i class="fa fa-trash"></i> Delete</a>
                     [% END %]
                 </li>
             [% END %]
@@ -800,7 +801,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 <ul>
     <li>
         [% IF ( issuecount ) %]
-            <a href="#checkouts">[% issuecount %] Checkout(s)</a>
+            <a href="#checkouts">[% issuecount | html %] Checkout(s)</a>
         [% ELSE %]
             <a href="#checkouts">0 Checkouts</a>
         [% END %]
@@ -812,7 +813,7 @@ No patron matched <span class="ex">[% message | html %]</span>
 
     <li>
         [% IF ( holds_count ) %]
-            <a href="#reserves" id="holds-tab">[% holds_count %] Hold(s)</a>
+            <a href="#reserves" id="holds-tab">[% holds_count | html %] Hold(s)</a>
         [% ELSE %]
             <a href="#reserves" id="holds-tab">0 Holds</a>
         [% END %]
@@ -820,18 +821,18 @@ No patron matched <span class="ex">[% message | html %]</span>
 
     [% IF Koha.Preference('ArticleRequests') %]
         <li>
-            <a href="#article-requests" id="article-requests-tab"> [% patron.article_requests_current.count %] Article requests</a>
+            <a href="#article-requests" id="article-requests-tab"> [% patron.article_requests_current.count | html %] Article requests</a>
         </li>
     [% END %]
 
-    <li><a id="debarments-tab-link" href="#reldebarments">[% debarments.count %] Restrictions</a></li>
+    <li><a id="debarments-tab-link" href="#reldebarments">[% debarments.count | html %] Restrictions</a></li>
 
     [% SET enrollments = patron.get_club_enrollments(1) %]
     [% SET enrollable  = patron.get_enrollable_clubs(0,1) %]
     [% IF CAN_user_clubs && ( enrollable.count || enrollments.count ) %]
         <li>
             <a id="clubs-tab-link" href="#clubs-tab">
-                Clubs ([% enrollments.count %]/[% enrollable.count %])
+                Clubs ([% enrollments.count | html %]/[% enrollable.count | html %])
             </a>
         </li>
     [% END %]
@@ -902,7 +903,7 @@ No patron matched <span class="ex">[% message | html %]</span>
     <fieldset class="action">
         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
             <input type="hidden" name="from" value="circ" />
-            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
             <input type="submit" value="Suspend all holds" />
 
             [% IF Koha.Preference('AutoResumeSuspendedHolds') %]
@@ -916,7 +917,7 @@ No patron matched <span class="ex">[% message | html %]</span>
     <fieldset class="action">
         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
             <input type="hidden" name="from" value="circ" />
-            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
             <input type="hidden" name="suspend" value="0" />
             <input type="submit" value="Resume all suspended holds" />
        </form>
@@ -976,37 +977,37 @@ No patron matched <span class="ex">[% message | html %]</span>
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") | $raw %]
     [% INCLUDE 'timepicker.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.rowGrouping.js") %]
-    [% Asset.js("js/pages/circulation.js") %]
-    [% Asset.js("js/checkouts.js") %]
-    [% Asset.js("js/holds.js") %]
-    [% Asset.js("js/circ-patron-search-results.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.rowGrouping.js") | $raw %]
+    [% Asset.js("js/pages/circulation.js") | $raw %]
+    [% Asset.js("js/checkouts.js") | $raw %]
+    [% Asset.js("js/holds.js") | $raw %]
+    [% Asset.js("js/circ-patron-search-results.js") | $raw %]
     <script type="text/javascript">
         /* Set some variable needed in circulation.js */
         var MSG_DT_LOADING_RECORDS = _("Loading... you may continue scanning.");
-        var interface = "[% interface %]";
-        var theme = "[% theme %]";
-        var borrowernumber = "[% patron.borrowernumber %]";
-        var branchcode = "[% branch %]";
-        var exports_enabled = "[% Koha.Preference('ExportCircHistory') %]";
-        var AllowRenewalLimitOverride = [% (CAN_user_circulate_override_renewals && Koha.Preference('AllowRenewalLimitOverride') )? 1: 0 %];
-        var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 %];
+        var interface = "[% interface | html %]";
+        var theme = "[% theme | html %]";
+        var borrowernumber = "[% patron.borrowernumber | html %]";
+        var branchcode = "[% branch | html %]";
+        var exports_enabled = "[% Koha.Preference('ExportCircHistory') | html %]";
+        var AllowRenewalLimitOverride = [% (CAN_user_circulate_override_renewals && Koha.Preference('AllowRenewalLimitOverride') )? 1: 0 | html %];
+        var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 | html %];
         var script = "circulation";
         var relatives_borrowernumbers = new Array();
         [% FOREACH b IN relatives_borrowernumbers %]
-            relatives_borrowernumbers.push("[% b %]");
+            relatives_borrowernumbers.push("[% b | html %]");
         [% END %]
 
         var MSG_EXPORT_SELECT_CHECKOUTS = _("You must select checkout(s) to export");
         var MSG_CONFIRM_DELETE_MESSAGE = _("Are you sure you want to delete this message? This cannot be undone.");
 
-        columns_settings = [% ColumnsSettings.GetColumns( 'circ', 'circulation', 'issues-table', 'json' ) %]
+        columns_settings = [% ColumnsSettings.GetColumns( 'circ', 'circulation', 'issues-table', 'json' ).raw %]
 
         [% IF borrowernumber and patron %]
-            if($.cookie("holdfor") != [% patron.borrowernumber %]){
+            if($.cookie("holdfor") != [% patron.borrowernumber | html %]){
                 $.removeCookie("holdfor", { path: '/' });
             }
         [% ELSE %]
@@ -1018,7 +1019,7 @@ No patron matched <span class="ex">[% message | html %]</span>
         // On-site checkout
         function toggle_onsite_checkout(){
             if ( $("#onsite_checkout").prop('checked') ) {
-                $("#duedatespec").val("[% todaysdate | $KohaDates with_hours => 1%]")
+                $("#duedatespec").val("[% todaysdate | $KohaDates with_hours => 1 | html %]")
                 [% IF !Koha.Preference('SpecifyDueDate') %]
                     $("#duedatespec").datetimepicker('destroy');
                 [% END %]
@@ -1053,7 +1054,7 @@ No patron matched <span class="ex">[% message | html %]</span>
             if ( $('#clubs-tab').length ) {
                 $('#clubs-tab-link').on('click', function() {
                     $('#clubs-tab').text(_("Loading..."));
-                    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% patron.borrowernumber %]');
+                    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% patron.borrowernumber | html %]');
                 });
             }
 
@@ -1061,7 +1062,7 @@ No patron matched <span class="ex">[% message | html %]</span>
                 // listen submit to trigger qslip on empty checkout
                 $('#mainform').bind('submit',function() {
                     if ($('#barcode').val() == '') {
-                        return printx_window( '[% CircAutoPrintQuickSlip %]' );
+                        return printx_window( '[% CircAutoPrintQuickSlip | html %]' );
                     }
                 });
             [% END %]
@@ -1079,11 +1080,11 @@ No patron matched <span class="ex">[% message | html %]</span>
 
             [% IF HIGHHOLDS %]
                 [% IF !override_high_holds %]
-                    $("input[name=duedatespec]:hidden").val('[% HIGHHOLDS.returndate %]');
-                    if ('[% duedatespec %]' === '') {
+                    $("input[name=duedatespec]:hidden").val('[% HIGHHOLDS.returndate | html %]');
+                    if ('[% duedatespec | html %]' === '') {
                         $("input[name=restoreduedatespec]:hidden").val('highholds_empty');
                     } else {
-                        $("input[name=restoreduedatespec]:hidden").val('[% duedatespec %]');
+                        $("input[name=restoreduedatespec]:hidden").val('[% duedatespec | html %]');
                     }
                 [% END %]
 
@@ -1096,7 +1097,7 @@ No patron matched <span class="ex">[% message | html %]</span>
         });
     </script>
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 7bfcd00..37b34ad 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE KohaDates %]
@@ -12,7 +13,7 @@
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_circulation_batch_checkouts" class="circ">
@@ -49,7 +50,7 @@
     [% END %]
     [% IF charges_guarantees %]
         <li>
-            <span class="circ-hlt">Fees &amp; Charges:</span> Patron's guarantees collectively owe [% chargesamount_guarantees | $Price %].
+            <span class="circ-hlt">Fees &amp; Charges:</span> Patron's guarantees collectively owe [% chargesamount_guarantees | $Price | html %].
         </li>
         <li>
             <span class="circ-hlt">Checkouts are BLOCKED because fine balance is OVER THE LIMIT.</span>
@@ -77,8 +78,8 @@
       </fieldset>
       <input type="hidden" name="op" value="show" />
       <fieldset class="action">
-        <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-        <input type="hidden" name="branch" value="[% branch %]" />
+        <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+        <input type="hidden" name="branch" value="[% branch | html %]" />
         <input type="hidden" name="batch" value="1" />
         <input type="submit" value="Check out" class="button" />
       </fieldset>
@@ -90,7 +91,7 @@
     <h3>Batch checkout confirmation [% IF patron %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] [% END %]</h3>
     <form method="post" action="/cgi-bin/koha/circ/circulation.pl" id="mainform" name="mainform" autocomplete="off">
   [% ELSE %]
-    <h3>Batch checkout information [% IF patron.borrowernumber %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] |[% batch %]|[% END %]</h3>
+    <h3>Batch checkout information [% IF patron.borrowernumber %] for [% INCLUDE 'patron-title.inc' invert_name = 1 %] |[% batch | html %]|[% END %]</h3>
   [% END %]
     <table id="checkout_infos">
       <thead>
             [% IF confirmation_needed && CAN_user_circulate_force_checkout %]
               <td>
                 [% IF checkout_info.NEEDSCONFIRMATION %]
-                  <input type="checkbox" name="barcodes" value="[% checkout_info.barcode %]" checked="checked" />
+                  <input type="checkbox" name="barcodes" value="[% checkout_info.barcode | html %]" checked="checked" />
                 [% END %]
               </td>
             [% END %]
-            <td>[% checkout_info.barcode %]</td>
+            <td>[% checkout_info.barcode | html %]</td>
             <td>
-              <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% checkout_info.biblio.biblionumber %]&amp;type=intra"><strong>[% checkout_info.biblio.title |html %][% FOREACH subtitle IN checkout_info.biblio.subtitles %] [% subtitle.subfield %][% END %]</strong></a>[% IF checkout_info.biblio.author %], by [% checkout_info.biblio.author %][% END %][% IF ( checkout_info.item.itemnotes ) %]- <span class="circ-hlt">[% checkout_info.item.itemnotes %]</span>[% END %] <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% checkout_info.biblio.biblionumber %]&amp;itemnumber=[% checkout_info.item.itemnumber %]#item[% checkout_info.item.itemnumber %]">[% checkout_info.item.barcode %]</a>
+              <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% checkout_info.biblio.biblionumber | html %]&amp;type=intra"><strong>[% checkout_info.biblio.title | html %][% FOREACH subtitle IN checkout_info.biblio.subtitles %] [% subtitle.subfield | html %][% END %]</strong></a>[% IF checkout_info.biblio.author %], by [% checkout_info.biblio.author | html %][% END %][% IF ( checkout_info.item.itemnotes ) %]- <span class="circ-hlt">[% checkout_info.item.itemnotes | html %]</span>[% END %] <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% checkout_info.biblio.biblionumber | html %]&amp;itemnumber=[% checkout_info.item.itemnumber | html %]#item[% checkout_info.item.itemnumber | html %]">[% checkout_info.item.barcode | html %]</a>
             </td>
             <td>
               [% IF checkout_info.NEEDSCONFIRMATION %]
                 <ul class="fa-ul warn">
                   [% IF checkout_info.AGE_RESTRICTION %]
-                      <li><i class="fa fa-li fa-warning"></i>Age restriction [% checkout_info.AGE_RESTRICTION %].</li>
+                      <li><i class="fa fa-li fa-warning"></i>Age restriction [% checkout_info.AGE_RESTRICTION | html %].</li>
                   [% END %]
                   [% IF checkout_info.RENEW_ISSUE %]
                       <li><i class="fa fa-li fa-warning"></i>This item is currently checked out to this patron. Renew?</li>
                       <li><i class="fa fa-li fa-warning"></i>Too many checked out.</li>
                   [% END %]
                   [% IF checkout_info.BORRNOTSAMEBRANCH %]
-                      <li><i class="fa fa-li fa-warning"></i>This patron is from a different library ([% Branches.GetName( checkout_info.BORRNOTSAMEBRANCH ) %]).</li>
+                      <li><i class="fa fa-li fa-warning"></i>This patron is from a different library ([% Branches.GetName( checkout_info.BORRNOTSAMEBRANCH ) | html %]).</li>
                   [% END %]
                   [% IF checkout_ino.PATRON_CANT %]
                       <li><i class="fa fa-li fa-warning"></i>This patron can't check out this item per library circulation policy.</li>
                     [% IF checkout_info.itemtype_notforloan %]
                         <li><i class="fa fa-li fa-warning"></i>Item type is normally not for loan.</li>
                     [% ELSIF checkout_info.item_notforloan %]
-                      [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, checkout_info.item_notforloan, 0 ) %]
-                        <li><i class="fa fa-li fa-warning"></i>Item is normally not for loan [% IF item_notforloan_lib %]([% item_notforloan_lib %])[% END %].</li>
+                      [% item_notforloan_lib = AuthorisedValues.GetByCode( authvalcode_notforloan, checkout_info.item_notforloan, 0 ) | html %]
+                        <li><i class="fa fa-li fa-warning"></i>Item is normally not for loan [% IF item_notforloan_lib %]([% item_notforloan_lib | html %])[% END %].</li>
                     [% END %]
                   [% END %]
                   [% IF checkout_info.USERBLOCKEDOVERDUE %]
-                      <li><i class="fa fa-li fa-warning"></i>Patron has [% checkout_info.USERBLOCKEDOVERDUE %] overdue item(s).</li>
+                      <li><i class="fa fa-li fa-warning"></i>Patron has [% checkout_info.USERBLOCKEDOVERDUE | html %] overdue item(s).</li>
                   [% END %]
                   [% IF checkout_info.ITEM_LOST %]
-                      <li><i class="fa fa-li fa-warning"></i>This item has been lost with a status of "[% checkout_info.ITEM_LOST %]."</li>
+                      <li><i class="fa fa-li fa-warning"></i>This item has been lost with a status of "[% checkout_info.ITEM_LOST | html %]."</li>
                   [% END %]
                   [% IF checkout_info.HIGHHOLDS %]
-                      <li><i class="fa fa-li fa-warning"></i>High demand item. Loan period shortened to [% checkout_info.HIGHHOLDS.duration %] days (due [% checkout_info.HIGHHOLDS.returndate %]).</li>
+                      <li><i class="fa fa-li fa-warning"></i>High demand item. Loan period shortened to [% checkout_info.HIGHHOLDS.duration | html %] days (due [% checkout_info.HIGHHOLDS.returndate | html %]).</li>
                   [% END %]
                   [% IF checkout_info.HIGHHOLDS %] <!-- FIXME -->
                       <script type="text/javascript">
                           $(document).ready(function() {
-                              $("input[name=duedatespec]:hidden").val('[% checkout_info.HIGHHOLDS.returndate %]');
+                              $("input[name=duedatespec]:hidden").val('[% checkout_info.HIGHHOLDS.returndate | html %]');
                           });
                       </script>
                   [% END %]
               [% IF checkout_info.alert.ITEM_LOST || checkout_info.alert.OTHER_CHARGES %]
                 <ul class="info">
                   [% IF checkout_info.alert.ITEM_LOST %]
-                      <li>This item has been lost with a status of "[% checkout_info.alert.ITEM_LOST %]."</li>
+                      <li>This item has been lost with a status of "[% checkout_info.alert.ITEM_LOST | html %]."</li>
                   [% END %]
                   [% IF checkout_info.alert.OTHER_CHARGES %]
-                      <li>The patron has unpaid charges for holds, rentals etc of [% checkout_info.alert.OTHER_CHARGES %].</li>
+                      <li>The patron has unpaid charges for holds, rentals etc of [% checkout_info.alert.OTHER_CHARGES | html %].</li>
                   [% END %]
                 </ul>
               [% END %]
                     [% IF checkout_info.itemtype_notforloan %]
                        <li><i class="fa fa-li fa-exclamation"></i>Item type not for loan.</li>
                     [% ELSIF checkout_info.item_notforloan %]
-                      [% item_notforloan_lib = AuthorisedValues.GetByCode( checkout_info.authvalcode_notforloan, checkout_info.item_notforloan, 0 ) %]
-                        <li><i class="fa fa-li fa-exclamation"></i>Item not for loan [% IF checkout_info.item_notforloan_lib %]([% checkout_info.item_notforloan_lib %])[% END %].</li>
+                      [% item_notforloan_lib = AuthorisedValues.GetByCode( checkout_info.authvalcode_notforloan, checkout_info.item_notforloan, 0 ) | html %]
+                        <li><i class="fa fa-li fa-exclamation"></i>Item not for loan [% IF checkout_info.item_notforloan_lib %]([% checkout_info.item_notforloan_lib | html %])[% END %].</li>
                     [% END %]
                   [% END %]
                   [% IF checkout_info.WTHDRAWN %]
                       <li><i class="fa fa-li fa-exclamation"></i>Patron's card is expired.</li>
                   [% END %]
                   [% IF checkout_info.ITEMNOTSAMEBRANCH %]
-                      <li><i class="fa fa-li fa-exclamation"></i>This item belongs to [% Branches.GetName( checkout_info.itemhomebranch ) %] and cannot be checked out from this location.</li>
+                      <li><i class="fa fa-li fa-exclamation"></i>This item belongs to [% Branches.GetName( checkout_info.itemhomebranch ) | html %] and cannot be checked out from this location.</li>
                   [% END %]
                   [% IF checkout_info.USERBLOCKEDREMAINING %]
-                      <li><i class="fa fa-li fa-exclamation"></i>Patron has had overdue items and is blocked for [% checkout_info.USERBLOCKEDREMAINING %] day(s).</li>
+                      <li><i class="fa fa-li fa-exclamation"></i>Patron has had overdue items and is blocked for [% checkout_info.USERBLOCKEDREMAINING | html %] day(s).</li>
                   [% END %]
                   [% IF checkout_info.USERBLOCKEDOVERDUE %]
                       <li><i class="fa fa-li fa-exclamation"></i>Checkouts are BLOCKED because patron has overdue items.</li>
                       <li><i class="fa fa-li fa-exclamation"></i>Too many checked out.</li>
                   [% END %]
                   [% IF checkout_info.UNKNOWN_BARCODE %]
-                      <li><i class="fa fa-li fa-exclamation"></i>The barcode was not found [% checkout_info.barcode |html %].</li>
+                      <li><i class="fa fa-li fa-exclamation"></i>The barcode was not found [% checkout_info.barcode | html %].</li>
                   [% END %]
                   [% IF checkout_info.DEBT %]
-                      <li><i class="fa fa-li fa-exclamation"></i>The patron has a debt of [% checkout_info.DEBT | $Price %].</li> <!-- Need debt_confirmed -->
+                      <li><i class="fa fa-li fa-exclamation"></i>The patron has a debt of [% checkout_info.DEBT | $Price | html %].</li> <!-- Need debt_confirmed -->
                   [% END %]
                 </p>
               [% END %]
     [% IF confirmation_needed && CAN_user_circulate_force_checkout %]
         <fieldset>
             <legend>Please confirm checkout</legend>
-      <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+      <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
       <input type="hidden" name="issueconfirmed" value="1" />
       <input type="hidden" name="debt_confirmed" value="1" />
-      <input type="hidden" name="branch" value="[% branch %]" />
+      <input type="hidden" name="branch" value="[% branch | html %]" />
       <input type="hidden" name="batch" value="1" />
       <input type="submit" id="checkoutrenew" class="approve" value="Checkout or renew" />
         </fieldset>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") | $raw %]
     <script type="text/javascript">
 
         $(document).ready(function() {
         });
     </script>
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 27dfd71..e5f9a9b 100644 (file)
@@ -1,35 +1,35 @@
 CACHE MANIFEST
-# [% cookie %]
+# [% cookie | html %]
 
 # Explicitly cached 'master entries'.
 CACHE:
 /cgi-bin/koha/circ/offline.pl
-[% interface %]/lib/bootstrap/bootstrap.min.css
-[% interface %]/lib/bootstrap/bootstrap-theme.min.css
-[% interface %]/lib/bootstrap/bootstrap.min.js
-[% interface %]/lib/jquery/images/ui-icons_222222_256x240.png
-[% interface %]/lib/jquery/images/ui-icons_454545_256x240.png
-[% interface %]/lib/jquery/jquery-ui-1.11.4.min.css
-[% interface %]/lib/jquery/jquery-ui-1.11.4.min.js
-[% interface %]/lib/jquery/jquery-2.2.3.min.js
-[% interface %]/lib/jquery/jquery-migrate-1.3.0.min.js
-[% interface %]/lib/jquery/plugins/jquery.cookie.min.js
-[% interface %]/lib/jquery/plugins/jquery.highlight-3.js
-[% interface %]/lib/shortcut/shortcut.js
-[% interface %]/lib/jquery/plugins/jquery.indexeddb.js
-[% interface %]/lib/jquery/plugins/jquery.validate.min.js
-[% interface %]/[% theme %]/css/print.css
-[% interface %]/[% theme %]/css/staff-global.css
-[% interface %]/[% theme %]/js/basket.js
-[% interface %]/[% theme %]/js/offlinecirc.js
-[% interface %]/[% theme %]/js/staff-global.js
-[% interface %]/lib/jquery/plugins/jquery-ui-timepicker-addon.min.js
-[% themelang %]/lib/yui/reset-fonts-grids.css
-[% interface %]/prog/img/cart-small.gif
-[% interface %]/prog/img/koha-logo-medium.png
-[% interface %]/prog/img/loading.gif
-[% interface %]/prog/sound/beep.ogg
-[% interface %]/prog/sound/critical.ogg
+[% interface | html %]/lib/bootstrap/bootstrap.min.css
+[% interface | html %]/lib/bootstrap/bootstrap-theme.min.css
+[% interface | html %]/lib/bootstrap/bootstrap.min.js
+[% interface | html %]/lib/jquery/images/ui-icons_222222_256x240.png
+[% interface | html %]/lib/jquery/images/ui-icons_454545_256x240.png
+[% interface | html %]/lib/jquery/jquery-ui-1.11.4.min.css
+[% interface | html %]/lib/jquery/jquery-ui-1.11.4.min.js
+[% interface | html %]/lib/jquery/jquery-2.2.3.min.js
+[% interface | html %]/lib/jquery/jquery-migrate-1.3.0.min.js
+[% interface | html %]/lib/jquery/plugins/jquery.cookie.min.js
+[% interface | html %]/lib/jquery/plugins/jquery.highlight-3.js
+[% interface | html %]/lib/shortcut/shortcut.js
+[% interface | html %]/lib/jquery/plugins/jquery.indexeddb.js
+[% interface | html %]/lib/jquery/plugins/jquery.validate.min.js
+[% interface | html %]/[% theme | html %]/css/print.css
+[% interface | html %]/[% theme | html %]/css/staff-global.css
+[% interface | html %]/[% theme | html %]/js/basket.js
+[% interface | html %]/[% theme | html %]/js/offlinecirc.js
+[% interface | html %]/[% theme | html %]/js/staff-global.js
+[% interface | html %]/lib/jquery/plugins/jquery-ui-timepicker-addon.min.js
+[% themelang | html %]/lib/yui/reset-fonts-grids.css
+[% interface | html %]/prog/img/cart-small.gif
+[% interface | html %]/prog/img/koha-logo-medium.png
+[% interface | html %]/prog/img/loading.gif
+[% interface | html %]/prog/sound/beep.ogg
+[% interface | html %]/prog/sound/critical.ogg
 
 # Resources that require the user to be online.
 NETWORK:
index fd701ca..be7c326 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 <!DOCTYPE html>
 [% IF (AllowOfflineCirculation) %]
 [% SET manifestattr = 'manifest="/cgi-bin/koha/circ/offline-mf.pl"' %]
 [% END %]
-[% IF ( bidi && AllowOfflineCirculation ) %]<html lang="[% lang %]" dir="[% bidi %]" manifest="/cgi-bin/koha/circ/offline-mf.pl">
-[% ELSIF ( bidi ) %]<html lang="[% lang %]" dir="[% bidi %]">
-[% ELSIF ( AllowOfflineCirculation ) %]<html lang="[% lang %]" manifest="/cgi-bin/koha/circ/offline-mf.pl">
-[% ELSE %]<html lang="[% lang %]">[% END %]
+[% IF ( bidi && AllowOfflineCirculation ) %]<html lang="[% lang | html %]" dir="[% bidi | html %]" manifest="/cgi-bin/koha/circ/offline-mf.pl">
+[% ELSIF ( bidi ) %]<html lang="[% lang | html %]" dir="[% bidi | html %]">
+[% ELSIF ( AllowOfflineCirculation ) %]<html lang="[% lang | html %]" manifest="/cgi-bin/koha/circ/offline-mf.pl">
+[% ELSE %]<html lang="[% lang | html %]">[% END %]
 <head>
 <title>Koha &rsaquo; Circulation</title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -26,8 +27,8 @@
 
     <div id="bd">
         <div id="yui-main">
-            <audio id="alert_sound" src="[% interface %]/prog/sound/critical.ogg" preload="auto"></audio>
-            <audio id="success_sound" src="[% interface %]/prog/sound/beep.ogg" preload="auto"></audio>
+            <audio id="alert_sound" src="[% interface | html %]/prog/sound/critical.ogg" preload="auto"></audio>
+            <audio id="success_sound" src="[% interface | html %]/prog/sound/beep.ogg" preload="auto"></audio>
 
             <div id="alerts" class="yui-b">
             </div>
 
                             <div class="date-select">
                                 <div class="hint">Specify due date [% INCLUDE 'date-format.inc' %]: </div>
-                                <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec %]" />
+                                <input type="text" size="13" id="duedatespec" name="duedatespec" value="[% duedatespec | html %]" />
                                 <label for="stickyduedate"> Remember for session:</label>
                                 <input type="checkbox" id="stickyduedate" onclick="this.form.barcode.focus();" name="stickyduedate" checked="checked" />
                                 <input type="button" class="action" id="cleardate" value="Clear" name="cleardate" onclick="this.checked = false; this.form.duedatespec.value = ''; this.form.stickyduedate.checked = false; this.form.barcode.focus(); return false;" />
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.indexeddb.js") %]
-    [% Asset.js("js/offlinecirc.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.indexeddb.js") | $raw %]
+    [% Asset.js("js/offlinecirc.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") | $raw %]
     [% INCLUDE 'timepicker.inc' %]
     <script type="text/javascript">
         var ALERT_SUCCESSFUL_CHECKIN = _("Checked in item.");
         }
 
         function synchronize() {
-            kohadb.saveSetting("userid", "[% loggedinusername %]");
-            kohadb.saveSetting("branchcode", "[% LoginBranchcode %]");
+            kohadb.saveSetting("userid", "[% loggedinusername | html %]");
+            kohadb.saveSetting("branchcode", "[% LoginBranchcode | html %]");
             showSyncInfo();
             [% UNLESS (AllowOfflineCirculation) %]
                 reloadRecords();
                 if (new Date(patron.dateexpiry) < new Date()) {
                     alerts.push(ALERT_PATRON_EXPIRED.format($.datepicker.formatDate(dateformat, new Date(patron.dateexpiry))));
                 }
-                if (parseInt(patron.fine) > [% maxoutstanding %]) {
+                if (parseInt(patron.fine) > [% maxoutstanding | html %]) {
                     alerts.push(ALERT_PATRON_FINE_OVER_LIMIT.format(patron.fine));
                 } else if (parseInt(patron.fine) > 0) {
                     alerts.push(ALERT_PATRON_FINE.format(patron.fine));
index 70e24ae..5d3f618 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -7,7 +8,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Pending on-site checkouts</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_stats" class="circ">
                 <tr>
                   <td>
                     [% IF item.is_overdue %]<span class="overdue">[% END %]
-                    <span title="[% item.date_due %]">[% item.date_due | $KohaDates %]</span>
+                    <span title="[% item.date_due | html %]">[% item.date_due | $KohaDates %]</span>
                     [% IF item.is_overdue %]</span>[% END %]
                   </td>
                   <td>
-                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% item.borrowernumber %]">[%item.firstname %] [% item.surname %]</a>
+                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% item.borrowernumber | html %]">[% item.firstname | html %] [% item.surname | html %]</a>
                   </td>
                   <td>
-                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblionumber %]"><strong>[% item.title |html %]</strong></a>[% IF ( item.author ) %], by [% item.author %][% END %][% IF ( item.itemnotes ) %]- <span class="circ-hlt">[% item.itemnotes %]</span>[% END %]
+                    <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblionumber | html %]"><strong>[% item.title | html %]</strong></a>[% IF ( item.author ) %], by [% item.author | html %][% END %][% IF ( item.itemnotes ) %]- <span class="circ-hlt">[% item.itemnotes | html %]</span>[% END %]
                   </td>
-                  <td>[% item.itemcallnumber %]</td>
+                  <td>[% item.itemcallnumber | html %]</td>
                   <td>
-                    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% item.biblionumber %]&amp;itemnumber=[% item.itemnumber %]#item[% item.itemnumber %]">[% item.barcode %]</a>
+                    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% item.biblionumber | html %]&amp;itemnumber=[% item.itemnumber | html %]#item[% item.itemnumber | html %]">[% item.barcode | html %]</a>
                   </td>
-                  <td>[% Branches.GetName(item.branchcode) %]</td>
-                  <td>[% AuthorisedValues.GetByCode( 'LOC', item.location )%]</td>
+                  <td>[% Branches.GetName(item.branchcode) | html %]</td>
+                  <td>[% AuthorisedValues.GetByCode( 'LOC', item.location ) | html %]</td>
                 </tr>
               [% END %]
             </tbody>
index 12966ed..872faf9 100644 (file)
@@ -1,11 +1,12 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [%- USE Branches -%]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Circulation &rsaquo; Items overdue as of [% todaysdate %]</title>
+<title>Koha &rsaquo; Circulation &rsaquo; Items overdue as of [% todaysdate | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     .sql {display:none;}
 </style>
@@ -15,7 +16,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'circ-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a> &rsaquo; Overdues as of [% todaysdate %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a> &rsaquo; Overdues as of [% todaysdate | html %]</div>
 
 <div id="doc3" class="yui-t2">
 
 
 [% IF ( overdueloop ) %]
 
-  <h2>[% nnoverdue %] [% IF ( noverdue_is_plural ) %]Items[% ELSE %]Item[% END %] overdue as of [% todaysdate %][% IF ( isfiltered ) %] <span style="font-size:70%;">(Filtered. <a href="/cgi-bin/koha/circ/overdue.pl">Reset filter</a>)</span>[% END %]</h2>
+  <h2>[% nnoverdue | html %] [% IF ( noverdue_is_plural ) %]Items[% ELSE %]Item[% END %] overdue as of [% todaysdate | html %][% IF ( isfiltered ) %] <span style="font-size:70%;">(Filtered. <a href="/cgi-bin/koha/circ/overdue.pl">Reset filter</a>)</span>[% END %]</h2>
 
   <p>
     [% IF ( isfiltered ) %]
-      <a href="overdue.pl?op=csv&amp;[% csv_param_string |html %]">Download file of displayed overdues</a>
+      <a href="overdue.pl?op=csv&amp;[% csv_param_string | html %]">Download file of displayed overdues</a>
     [% ELSE %]
       <a href="overdue.pl?op=csv">Download file of all overdues</a>
     [% END %]
   </p>
 
-  <div class="sql"><pre>[% sql |html %]</pre></div>
+  <div class="sql"><pre>[% sql | html %]</pre></div>
   <div class="searchresults">
     <table id="overduest">
       <thead>
       <tbody>
       [% FOREACH overdueloo IN overdueloop %]
         <tr>
-          <td><span title="[% overdueloo.duedate %]">[% overdueloo.duedate | $KohaDates %]</span></td>
+          <td><span title="[% overdueloo.duedate | html %]">[% overdueloo.duedate | $KohaDates %]</span></td>
           <td>
             [% INCLUDE 'patron-title.inc' patron=overdueloo.patron hide_patron_infos_if_needed=1 link_to="circulation_reserves" %]
             [% IF logged_in_user.can_see_patron_infos( overdueloo.patron ) %]
-                [% IF ( overdueloo.email ) %][<a href="mailto:[% overdueloo.email %]?subject=[% INCLUDE subject %] [% overdueloo.title |html %]">email</a>][% END %]
-                [% IF ( overdueloo.phone ) %]([% overdueloo.phone %])[% ELSIF ( overdueloo.mobile ) %]([% overdueloo.mobile %])[% ELSIF ( overdueloo.phonepro ) %]([% overdueloo.phonepro %])[% END %]</td>
+                [% IF ( overdueloo.email ) %][<a href="mailto:[% overdueloo.email | html %]?subject=[% INCLUDE subject %] [% overdueloo.title | html %]">email</a>][% END %]
+                [% IF ( overdueloo.phone ) %]([% overdueloo.phone | html %])[% ELSIF ( overdueloo.mobile ) %]([% overdueloo.mobile | html %])[% ELSIF ( overdueloo.phonepro ) %]([% overdueloo.phonepro | html %])[% END %]</td>
             [% END %]
-          <td>[% IF overdueloo.branchcode %][% Branches.GetName( overdueloo.branchcode ) %][% END %]</td>
-          <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = overdueloo.biblionumber %][% overdueloo.title |html %]  [% overdueloo.subtitle %]</a> [% IF ( overdueloo.author ) %], by [% overdueloo.author %][% END %][% IF ( overdueloo.enumchron ) %], [% overdueloo.enumchron %][% END %]</td>
-          <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% overdueloo.biblionumber %]&amp;itemnumber=[% overdueloo.itemnum %]#item[% overdueloo.itemnum %]">[% overdueloo.barcode %]</a></td>
-          <td>[% overdueloo.itemcallnumber %]</td>
-          <td>[% overdueloo.replacementprice %]</td>
+          <td>[% IF overdueloo.branchcode %][% Branches.GetName( overdueloo.branchcode ) | html %][% END %]</td>
+          <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = overdueloo.biblionumber %][% overdueloo.title | html %]  [% overdueloo.subtitle | html %]</a> [% IF ( overdueloo.author ) %], by [% overdueloo.author | html %][% END %][% IF ( overdueloo.enumchron ) %], [% overdueloo.enumchron | html %][% END %]</td>
+          <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% overdueloo.biblionumber | html %]&amp;itemnumber=[% overdueloo.itemnum | html %]#item[% overdueloo.itemnum | html %]">[% overdueloo.barcode | html %]</a></td>
+          <td>[% overdueloo.itemcallnumber | html %]</td>
+          <td>[% overdueloo.replacementprice | html %]</td>
         </tr>
       [% END %]
       </tbody>
     </li>
     </ol></fieldset>
     <ol>
-    <li><label>Name or cardnumber:</label><input type="text" name="borname" value="[% borname |html %]" /></li>
+    <li><label>Name or cardnumber:</label><input type="text" name="borname" value="[% borname | html %]" /></li>
     <li><label>Patron category:</label><select name="borcat" id="borcat"><option value="">Any</option>
       [% FOREACH borcatloo IN borcatloop %]
-        [% IF ( borcatloo.selected ) %]<option value="[% borcatloo.value |html %]" selected="selected">[% borcatloo.catname %]</option>[% ELSE %]<option value="[% borcatloo.value |html %]">[% borcatloo.catname %]</option>[% END %]
+        [% IF ( borcatloo.selected ) %]<option value="[% borcatloo.value | html %]" selected="selected">[% borcatloo.catname | html %]</option>[% ELSE %]<option value="[% borcatloo.value | html %]">[% borcatloo.catname | html %]</option>[% END %]
       [% END %]
       </select>
     </li>
        [% FOREACH patron_attr_filter_loo IN patron_attr_filter_loop %]
                <!-- domid cgivalue ismany isclone ordinal code description repeatable authorised_value_category -->
                <li>
-                       <label>[% patron_attr_filter_loo.description %]:</label>
+                       <label>[% patron_attr_filter_loo.description | html %]:</label>
             [% IF ( patron_attr_filter_loo.authorised_value_category ) %]
-                <script type="text/javascript" x-code="[% patron_attr_filter_loo.code |html %]">create_auto_completion_responder([% patron_attr_filter_loo.domid %],"[% patron_attr_filter_loo.code |html %]");</script>
-                               <span id="pattrodue-getready-[% patron_attr_filter_loo.domid %]">
+                <script type="text/javascript" x-code="[% patron_attr_filter_loo.code | html %]">create_auto_completion_responder([% patron_attr_filter_loo.domid | html %],"[% patron_attr_filter_loo.code | html %]");</script>
+                               <span id="pattrodue-getready-[% patron_attr_filter_loo.domid | html %]">
                                                <div class="pattrodue-autocomplete">
-                                                       <input autocomplete="off" id="pattrodue-input-[% patron_attr_filter_loo.domid %]" name="patron_attr_filter_[% patron_attr_filter_loo.code |html %]" value="[% patron_attr_filter_loo.cgivalue |html %]"  class="pattrodue-input" type="text" />
+                            <input autocomplete="off" id="pattrodue-input-[% patron_attr_filter_loo.domid | html %]" name="patron_attr_filter_[% patron_attr_filter_loo.code | html %]" value="[% patron_attr_filter_loo.cgivalue | html %]"  class="pattrodue-input" type="text" />
                                                </div>
                                </span>
                        [% ELSE %]
-                               <input type="text" name="patron_attr_filter_[% patron_attr_filter_loo.code |html %]" value="[% patron_attr_filter_loo.cgivalue |html %]"/>
+                <input type="text" name="patron_attr_filter_[% patron_attr_filter_loo.code | html %]" value="[% patron_attr_filter_loo.cgivalue | html %]"/>
                        [% END %]
                        [% IF ( patron_attr_filter_loo.repeatable ) %]
                 <a href="#" onclick="clone_parent(this); return false;">Add</a>
 
     <li><label>Item type:</label><select name="itemtype" id="itemtype"><option value="">Any</option>
       [% FOREACH itemtypeloo IN itemtypeloop %][% IF ( itemtypeloo.selected ) %]
-        <option value="[% itemtypeloo.value |html %]" selected="selected">[% itemtypeloo.itemtypename %]</option>[% ELSE %]
-        <option value="[% itemtypeloo.value |html %]">[% itemtypeloo.itemtypename %]</option>[% END %]
+        <option value="[% itemtypeloo.value | html %]" selected="selected">[% itemtypeloo.itemtypename | html %]</option>[% ELSE %]
+        <option value="[% itemtypeloo.value | html %]">[% itemtypeloo.itemtypename | html %]</option>[% END %]
       [% END %]
       </select>
     </li>
index fe97911..137deea 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -9,7 +10,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Holds to pull</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_pendingreserves" class="circ">
@@ -25,7 +26,7 @@
     <div id="yui-main">
     <div class="yui-b">
         [% FOR m IN messages %]
-            <div class="dialog [% m.type %]">
+            <div class="dialog [% m.type | html %]">
                 [% SWITCH m.code %]
                 [% CASE 'letter_enqueued' %]
                     <span>The notice has been correctly enqueued.</span>
@@ -38,7 +39,7 @@
                 [% CASE 'hold_placed_at_biblio_level' %]
                     <span>The hold has been placed on biblio level. It is not possible to determine the item to mark as lost.</span>
                 [% CASE %]
-                    [% m.code %]
+                    [% m.code | html %]
                 [% END %]
             </div>
         [% END %]
         [% FOREACH reserveloo IN reserveloop %]
         <tr>
         [% IF ( reserveloo.borrowernumber ) %]
-            <td><p><b>[% reserveloo.pullcount %]</b></p></td>
-            <td>[% reserveloo.count %]</td>
-            <td>[% reserveloo.rcount %]</td>
-            <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reserveloo.borrowernumber %]">[% reserveloo.firstname %] [%reserveloo.surname %]</a></td>
+            <td><p><b>[% reserveloo.pullcount | html %]</b></p></td>
+            <td>[% reserveloo.count | html %]</td>
+            <td>[% reserveloo.rcount | html %]</td>
+            <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reserveloo.borrowernumber | html %]">[% reserveloo.firstname | html %] [% reserveloo.surname | html %]</a></td>
             <td>
             <p>
                 [% INCLUDE 'biblio-default-view.inc' biblionumber = reserveloo.biblionumber %]
-                [% reserveloo.title |html %] [% FOREACH s IN reserveloo.subtitle %] [% s %][% END %]</a></p>
-                [% IF ( reserveloo.author ) %]<p> by [% reserveloo.author %]</p>[% END %]
+                [% reserveloo.title | html %] [% FOREACH s IN reserveloo.subtitle %] [% s | html %][% END %]</a></p>
+                [% IF ( reserveloo.author ) %]<p> by [% reserveloo.author | html %]</p>[% END %]
             </td>
         [% ELSE %]
             <td>"</td>
         [% END %]
         <td>
             [% FOREACH holdingbranch IN reserveloo.holdingbranches %]
-                [% Branches.GetName ( holdingbranch ) %]
+                [% Branches.GetName ( holdingbranch ) | html %]
             [% END %]
         </td>
-        <td><p>[% reserveloo.itemcallnumber %]</p></td>
-        <td><p>[% reserveloo.copyno %]</p></td>
-        <td><p>[% reserveloo.enumchron %]</p></td>
+        <td><p>[% reserveloo.itemcallnumber | html %]</p></td>
+        <td><p>[% reserveloo.copyno | html %]</p></td>
+        <td><p>[% reserveloo.enumchron | html %]</p></td>
         <td>
         [% FOREACH itemType IN reserveloo.itemTypes %]
-            [% ItemTypes.GetDescription( itemType ) %]
+            [% ItemTypes.GetDescription( itemType ) | html %]
         [% END %]
         </td>
         <td>
         [% FOREACH loc IN reserveloo.locations %]
-            [% AuthorisedValues.GetByCode('LOC', loc) %]
+            [% AuthorisedValues.GetByCode('LOC', loc) | html %]
         [% END %]
         </td>
         <td>
-            <span title="[% reserveloo.reservedate %]">[% reserveloo.reservedate | $KohaDates %] in [% Branches.GetName ( reserveloo.branch ) %]</span>
+            <span title="[% reserveloo.reservedate | html %]">[% reserveloo.reservedate | $KohaDates %] in [% Branches.GetName ( reserveloo.branch ) | html %]</span>
         </td>
         <td>
             <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
                 <input type="hidden" name="op" value="cancel_reserve" />
-                <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id %]" />
+                <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id | html %]" />
                 [% IF reserveloo.holdingbranch != reserveloo.homebranch %]
-                    <input type="submit" value="Cancel hold and return to : [% Branches.GetName( reserveloo.homebranch ) %]" />
+                    <input type="submit" value="Cancel hold and return to : [% Branches.GetName( reserveloo.homebranch ) | html %]" />
                 [% ELSE %]
                     <input type="submit" value="Cancel hold" />
                 [% END %]
         [% IF Koha.Preference('CanMarkHoldsToPullAsLost') != 'do_not_allow' %]
             [% IF reserveloo.itemnumber %]
                 <form name="cancelReserve" action="/cgi-bin/koha/circ/pendingreserves.pl" method="post">
-                    <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id %]" />
+                    <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id | html %]" />
                     [% IF Koha.Preference('CanMarkHoldsToPullAsLost') == 'allow' %]
                         <input type="hidden" name="op" value="mark_as_lost" />
                         <input type="submit" value="Mark item as lost" />
 </ol>
 
 [% IF ( HoldsToPullEndDate ) %]
-    <p><i>(Inclusive, default is [% HoldsToPullStartDate %] days ago to [% HoldsToPullEndDate %] days ahead. Set other date ranges as needed.)</i></p>
+    <p><i>(Inclusive, default is [% HoldsToPullStartDate | html %] days ago to [% HoldsToPullEndDate | html %] days ahead. Set other date ranges as needed.)</i></p>
 [% ELSE %]
-    <p><i>(Inclusive, default is [% HoldsToPullStartDate %] days ago to today. Set other date ranges as needed.)</i></p>
+    <p><i>(Inclusive, default is [% HoldsToPullStartDate | html %] days ago to today. Set other date ranges as needed.)</i></p>
 [% END %]
 
 <fieldset class="action"><input type="submit" name="run_report" value="Submit" class="submit"/></fieldset>
     [% INCLUDE 'columns_settings.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
-          var columns_settings = [% ColumnsSettings.GetColumns('circ', 'holds', 'holds-to-pull', 'json') %];
+          var columns_settings = [% ColumnsSettings.GetColumns('circ', 'holds', 'holds-to-pull', 'json').raw %];
           var holdst = KohaTable("holdst", {
             "aoColumnDefs": [
                 { "sType": "anti-the", "aTargets" : [ "anti-the" ] },
index f73771d..c9935fb 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -6,16 +7,16 @@
 [% ELSIF ( caller == 'transfer' ) %]
 <title>Koha &rsaquo; Circulation &rsaquo; Transfers print receipt</title>
 [% ELSIF ( caller == 'members' ) %]
-<title>Koha &rsaquo; Patrons &rsaquo; Print receipt for [% borrowernumber %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; Print receipt for [% borrowernumber | html %]</title>
 [% ELSIF ( title ) %][%# FIXME title is never defined %]
-<title>Koha &rsaquo; Patrons &rsaquo; [% title %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; [% title | html %]</title>
 [% END %]
 [% INCLUDE 'doc-head-close.inc' %]
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("css/print.css") %]
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("css/print.css") | $raw %]
 [% IF ( Koha.Preference('SlipCSS') ) %]
-<link rel="stylesheet" type="text/css" href="[% Koha.Preference('SlipCSS') %]" />
+<link rel="stylesheet" type="text/css" href="[% Koha.Preference('SlipCSS') | $raw %]" />
 [% END %]
 
 [% INCLUDE 'slip-print.inc' #printThenClose %]
 
 [% IF plain %]
 <pre>
-[% IF ( slip ) %][% slip %][% ELSE %]No slip template found[% END %]
+[% IF ( slip ) %][% slip | html %][% ELSE %]No slip template found[% END %]
 </pre>
 [% ELSE %]
-[% IF ( slip ) %][% slip %][% ELSE %]No slip template found[% END %]
+[% IF ( slip ) %][% slip | $raw %][% ELSE %]No slip template found[% END %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index d4397e0..11c3eca 100644 (file)
@@ -3,7 +3,7 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 
-<title>Koha &rsaquo; Circulation &rsaquo; Renew [% title |html %]</title>
+<title>Koha &rsaquo; Circulation &rsaquo; Renew [% title | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 
                             [% ELSIF error == "no_checkout" %]
 
-                                <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblio.biblionumber %]">[% item.biblio.title %] [% item.biblioitem.subtitle %]</a> ( <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% item.itemnumber %]&amp;biblionumber=[% item.biblio.biblionumber %]&amp;bi=[% item.biblioitemnumber.biblioitemnumber %]#item[% item.itemnumber %]">[% item.barcode %]</a> ) is not checked out to a patron.</p>
+                                <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblio.biblionumber | html %]">[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %]</a> ( <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% item.itemnumber | html %]&amp;biblionumber=[% item.biblio.biblionumber | html %]&amp;bi=[% item.biblioitemnumber.biblioitemnumber | html %]#item[% item.itemnumber | html %]">[% item.barcode | html %]</a> ) is not checked out to a patron.</p>
 
                             [% ELSIF error == "too_many" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) has been renewed the maximum number of times by [% borrower.firstname %] [% borrower.surname %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber %]"> [% borrower.cardnumber %] </a> )</p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) has been renewed the maximum number of times by [% borrower.firstname | html %] [% borrower.surname | html %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber | html %]"> [% borrower.cardnumber | html %] </a> )</p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
                                     </form>
 
                             [% ELSIF error == "too_soon" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) cannot be renewed before [% soonestrenewdate | $KohaDates %]. </p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) cannot be renewed before [% soonestrenewdate | $KohaDates %]. </p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
                                     </form>
 
                             [% ELSIF error == "auto_too_soon" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) has been scheduled for automatic renewal and cannot be renewed before [% soonestrenewdate | $KohaDates %]. </p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) has been scheduled for automatic renewal and cannot be renewed before [% soonestrenewdate | $KohaDates %]. </p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
                                     </form>
 
                             [% ELSIF error == "auto_too_late" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) has been scheduled for automatic renewal and cannot be renewed anymore since [% latestautorenewdate | $KohaDates %]. </p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) has been scheduled for automatic renewal and cannot be renewed anymore since [% latestautorenewdate | $KohaDates %]. </p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
                                     </form>
 
                             [% ELSIF error == "auto_account_expired" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) has been scheduled for automatic renewal and cannot be renewed because the patron's account is expired</p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) has been scheduled for automatic renewal and cannot be renewed because the patron's account is expired</p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <input type="submit" class="approve" value="Override and renew" />
                                     </form>
 
                             [% ELSIF error == "auto_renew" or error == "auto_too_much_oweing" %]
 
-                                <p>[% item.biblio.title %] [% item.biblioitem.subtitle %] ( [% item.barcode %] ) has been scheduled for automatic renewal. </p>
+                                <p>[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %] ( [% item.barcode | html %] ) has been scheduled for automatic renewal. </p>
 
                                 [% IF Koha.Preference('AllowRenewalLimitOverride') %]
                                     <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                        <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                        <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                         <input type="hidden" name="override_limit" value="1" />
                                         <button type="submit" class="approve"><i class="fa fa-check"></i> Override limit and renew</button>
                                     </form>
                                 <p>This item is on hold for another patron.</p>
 
                                 <form method="post" action="/cgi-bin/koha/circ/renew.pl">
-                                    <input type="hidden" name="barcode" value="[% item.barcode %]"/>
+                                    <input type="hidden" name="barcode" value="[% item.barcode | html %]"/>
                                     <input type="hidden" name="override_limit" value="1" />
                                     <input type="hidden" name="override_holds" value="1" />
                                     <button type="submit" class="approve"><i class="fa fa-check"></i> Override and renew</button>
 
                             [% ELSIF error == "patron_restricted" %]
 
-                                <p>[% borrower.firstname %] [% borrower.surname %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber %]"> [% borrower.cardnumber %] </a> ) is currently restricted.</p>
+                                <p>[% borrower.firstname | html %] [% borrower.surname | html %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber | html %]"> [% borrower.cardnumber | html %] </a> ) is currently restricted.</p>
 
                             [% ELSE %]
 
-                                [% error %]
+                                [% error | html %]
 
                             [% END %]
 
                     <div class="dialog message">
                         <h3>Item renewed:</h3>
                         <p>
-                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblio.biblionumber %]">[% item.biblio.title %] [% item.biblioitem.subtitle %]</a>
-                            ( <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% item.itemnumber %]&amp;biblionumber=[% item.biblio.biblionumber %]&amp;bi=[% item.biblioitemnumber.biblioitemnumber %]#item[% item.itemnumber %]">[% item.barcode %]</a> )
+                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblio.biblionumber | html %]">[% item.biblio.title | html %] [% item.biblioitem.subtitle | html %]</a>
+                            ( <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% item.itemnumber | html %]&amp;biblionumber=[% item.biblio.biblionumber | html %]&amp;bi=[% item.biblioitemnumber.biblioitemnumber | html %]#item[% item.itemnumber | html %]">[% item.barcode | html %]</a> )
                             renewed for
-                            [% borrower.firstname %] [% borrower.surname %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber %]"> [% borrower.cardnumber %] </a> )
+                            [% borrower.firstname | html %] [% borrower.surname | html %] ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber | html %]"> [% borrower.cardnumber | html %] </a> )
                             now due on [% date_due | $KohaDates %]
                         </p>
                     </div>
index 375b653..f777243 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -8,7 +9,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Request article</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_request-article" class="circ">
@@ -21,7 +22,7 @@
         <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a>
         [% UNLESS blocking_error %]
         &rsaquo;
-        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">[% biblio.title | html %]</a>
+        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">[% biblio.title | html %]</a>
         &rsaquo;
         Request article
         [% END %]
@@ -33,7 +34,7 @@
             <div id="yui-main">
                 <div class="yui-b">
 
-                    <h1>Request article from <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.id %]">[% biblio.title | html %]</a></h1>
+                    <h1>Request article from <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.id | html %]">[% biblio.title | html %]</a></h1>
                     [% IF no_patrons_found %]
                         <div class="dialog alert">
                             <h3>Patron not found</h3>
                                     <tbody>
                                         [% FOREACH patron IN patrons %]
                                             <tr>
-                                                <td><input type="radio" name="patron_id" value="[% patron.borrowernumber %]"/></td>
-                                                <td>[% patron.surname %], [% patron.firstname %]</td>
-                                                <td>[% patron.cardnumber %]</td>
-                                                <td>[% patron.categorycode %]</td>
-                                                <td>[% patron.branchcode %]</td>
-                                                <td>[% patron.address %]</td>
+                                                <td><input type="radio" name="patron_id" value="[% patron.borrowernumber | html %]"/></td>
+                                                <td>[% patron.surname | html %], [% patron.firstname | html %]</td>
+                                                <td>[% patron.cardnumber | html %]</td>
+                                                <td>[% patron.categorycode | html %]</td>
+                                                <td>[% patron.branchcode | html %]</td>
+                                                <td>[% patron.address | html %]</td>
                                             </tr>
                                         [% END %]
                                     </tbody>
                                 </table>
-                                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
                                 <fieldset class="action"><input type="submit" value="Select" /></fieldset>
                             </fieldset>
                         </form>
@@ -77,7 +78,7 @@
                                 <div class="hint">Enter patron card number or partial name:</div>
                                 <input type="text" size="40" id="patron" class="focus" name="patron_cardnumber" />
                                 <input type="submit" value="Search" />
-                                <input type="hidden" name="biblionumber" value="[% biblio.id %]" />
+                                <input type="hidden" name="biblionumber" value="[% biblio.id | html %]" />
                             </fieldset>
                         </form>
                     [% ELSE %]
 
                             <form id="place-article-request" method="post" action="/cgi-bin/koha/circ/request-article.pl">
                                 <input type="hidden" name="action" value="create" />
-                                <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber %]" />
-                                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.id %]" />
+                                <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
+                                <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.id | html %]" />
 
                                 <fieldset class="rows">
-                                    <legend>Place article request from [% biblio.title %] for [% patron.firstname %] [% patron.surname %] ( [% patron.cardnumber %] )</legend>
+                                    <legend>Place article request from [% biblio.title | html %] for [% patron.firstname | html %] [% patron.surname | html %] ( [% patron.cardnumber | html %] )</legend>
                                     <p/>
                                     <ul>
                                         <li>
                                             <select name="branchcode" id="branchcode">
                                                 [% FOREACH b IN Branches.all %]
                                                     [% IF b.branchcode == Branches.GetLoggedInBranchcode %]
-                                                        <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                                                        <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                                                     [% ELSE %]
-                                                        <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                                        <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                                                     [% END %]
                                                 [% END %]
                                             </select>
                                                         <td>
                                                             [% IF article_request_type == 'item_only' && !checked %]
                                                                 [% SET checked = 1 %]
-                                                                <input type="radio" name="itemnumber" value="[% item.itemnumber %]" checked="checked" />
+                                                                <input type="radio" name="itemnumber" value="[% item.itemnumber | html %]" checked="checked" />
                                                             [% ELSE %]
-                                                                <input type="radio" name="itemnumber" value="[% item.itemnumber %]" />
+                                                                <input type="radio" name="itemnumber" value="[% item.itemnumber | html %]" />
                                                             [% END %]
                                                         </td>
                                                         <td>
-                                                            [% ItemTypes.GetDescription( item.itype ) %]
+                                                            [% ItemTypes.GetDescription( item.itype ) | html %]
                                                         </td>
                                                         <td>
-                                                            [% item.barcode %]
+                                                            [% item.barcode | html %]
                                                         </td>
                                                         <td>
-                                                            [% Branches.GetName( item.homebranch ) %]
+                                                            [% Branches.GetName( item.homebranch ) | html %]
                                                         </td>
                                                         <td>
-                                                            [% item.itemcallnumber %]
+                                                            [% item.itemcallnumber | html %]
                                                         </td>
                                                         <td>
-                                                            [% item.enumchron %]
+                                                            [% item.enumchron | html %]
                                                         </td>
                                                     </tr>
                                                 [% END %]
                                 [% FOREACH ar IN biblio.article_requests_current %]
                                     <tr>
                                         <td>[% ar.created_on | $KohaDates %]</td>
-                                        <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% ar.borrowernumber %]">[% ar.borrower.firstname %] [% ar.borrower.surname %]</a></td>
-                                        <td>[% ar.title %]</td>
-                                        <td>[% ar.author %]</td>
-                                        <td>[% ar.volume %]</td>
-                                        <td>[% ar.issue %]</td>
-                                        <td>[% ar.date %]</td>
-                                        <td>[% ar.pages %]</td>
-                                        <td>[% ar.chapters %]</td>
-                                        <td>[% ar.patron_notes %]</td>
+                                        <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% ar.borrowernumber | html %]">[% ar.borrower.firstname | html %] [% ar.borrower.surname | html %]</a></td>
+                                        <td>[% ar.title | html %]</td>
+                                        <td>[% ar.author | html %]</td>
+                                        <td>[% ar.volume | html %]</td>
+                                        <td>[% ar.issue | html %]</td>
+                                        <td>[% ar.date | html %]</td>
+                                        <td>[% ar.pages | html %]</td>
+                                        <td>[% ar.chapters | html %]</td>
+                                        <td>[% ar.patron_notes | html %]</td>
                                         <td>
                                             [% IF ar.item %]
-                                                <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% ar.itemnumber %]&biblionumber=[% ar.biblionumber %]">[% ar.item.barcode %]</a>
+                                                <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% ar.itemnumber | html %]&biblionumber=[% ar.biblionumber | html %]">[% ar.item.barcode | html %]</a>
                                             [% END %]
                                         </td>
                                         <td>
                                             [% END %]
                                         </td>
                                         <td>
-                                            <i id="update-processing-[% ar.id %]" class="fa fa-cog fa-spin hidden"></i>
-                                            <select name="branchcode" id="branchcode-[% ar.id %]" class="ar-update-branchcode">
+                                            <i id="update-processing-[% ar.id | html %]" class="fa fa-cog fa-spin hidden"></i>
+                                            <select name="branchcode" id="branchcode-[% ar.id | html %]" class="ar-update-branchcode">
                                                 [% FOREACH b IN Branches.all %]
                                                     [% IF b.branchcode == ar.branchcode %]
-                                                        <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                                                        <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                                                     [% ELSE %]
-                                                        <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                                        <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                                                     [% END %]
                                                 [% END %]
                                             </select>
                                         </td>
                                         <td>
-                                            <a title="Cancel article request" href="#" id="cancel-[% ar.id %]" class="ar-cancel-request">
-                                                <i id="cancel-processing-spinner-[% ar.id %]" class="fa fa-cog fa-spin hide"></i>
-                                                <i id="cancel-processing-[% ar.id %]" class="fa fa-times fa-lg" style="color:red"></i>
+                                            <a title="Cancel article request" href="#" id="cancel-[% ar.id | html %]" class="ar-cancel-request">
+                                                <i id="cancel-processing-spinner-[% ar.id | html %]" class="fa fa-cog fa-spin hide"></i>
+                                                <i id="cancel-processing-[% ar.id | html %]" class="fa fa-times fa-lg" style="color:red"></i>
                                             </a>
                                         </td>
                                     </tr>
index 3c35d86..ecd444c 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE AuthorisedValues %]
@@ -7,12 +8,12 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Hold ratios</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     .sql { display: none; }
     .ulined { text-decoration: underline; }
     .ratiolimit { color: blue; cursor: pointer; }
-    #holdst ul li {  list-style: outside url("[% interface %]/[% theme %]/img/item-bullet.gif") disc; }
+    #holdst ul li {  list-style: outside url("[% interface | html %]/[% theme | html %]/img/item-bullet.gif") disc; }
 </style>
 </head>
 
@@ -29,8 +30,8 @@
 <h1>Hold ratios to calculate items needed</h1>
    <h3>Calculated on [% todaysdate | $KohaDates %]. From [% from | $KohaDates %]
     to [% to | $KohaDates %]</h3>
-<p>These items have a hold ratio &ge; [% ratio %].</p>
-<div class="sql">[% sql %]</div>
+<p>These items have a hold ratio &ge; [% ratio | html %].</p>
+<div class="sql">[% sql | html %]</div>
 
 [% IF ( reserveloop ) %]
     <table id="holdst">
       <tbody>
       [% FOREACH reserveloo IN reserveloop %]
         <tr>
-            <td><p>[% reserveloo.reservecount %]</p></td>
-            <td><p>[% reserveloo.itemcount %]</p></td>
-            <td><p class="ratiolimit">[% reserveloo.thisratio %]</p></td>
-            <td> [% INCLUDE 'biblio-default-view.inc' biblionumber = reserveloo.biblionumber %][% reserveloo.title |html %] [% IF ( reserveloo.subtitle ) %][% FOREACH subtitl IN reserveloo.subtitle %][% subtitl.subfield %][% END %][% END %]</a>[% IF ( reserveloo.author ) %] by [% reserveloo.author %][% END %]
+            <td><p>[% reserveloo.reservecount | html %]</p></td>
+            <td><p>[% reserveloo.itemcount | html %]</p></td>
+            <td><p class="ratiolimit">[% reserveloo.thisratio | html %]</p></td>
+            <td> [% INCLUDE 'biblio-default-view.inc' biblionumber = reserveloo.biblionumber %][% reserveloo.title | html %] [% IF ( reserveloo.subtitle ) %][% FOREACH subtitl IN reserveloo.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a>[% IF ( reserveloo.author ) %] by [% reserveloo.author | html %][% END %]
             </td>
             <td>
                   <ul>
                       [% FOREACH homebranch IN reserveloo.homebranch_list %]
-                          <li>[% Branches.GetName ( homebranch ) %]</li>
+                          <li>[% Branches.GetName ( homebranch ) | html %]</li>
                       [% END %]
                   </ul>
             </td>
             <td>
                   <ul>
                       [% FOREACH holdingbranch IN reserveloo.holdingbranch_list %]
-                          <li>[% Branches.GetName ( holdingbranch ) %]</li>
+                          <li>[% Branches.GetName ( holdingbranch ) | html %]</li>
                       [% END %]
                   </ul>
             </td>
             <td>
                   <ul>
                       [% FOREACH location IN reserveloo.location %]
-                          <li>[% AuthorisedValues.GetByCode( 'LOC', location )%]</li>
+                          <li>[% AuthorisedValues.GetByCode( 'LOC', location ) | html %]</li>
                       [% END %]
                   </ul>
             </td>
             <td>
                   <ul>
                       [% FOREACH itype IN reserveloo.itype %]
-                          <li>[% ItemTypes.GetDescription( itype ) %]</li>
+                          <li>[% ItemTypes.GetDescription( itype ) | html %]</li>
                       [% END %]
                   </ul>
             </td>
             <td>
                   <ul>
                       [% FOREACH listcall IN reserveloo.listcall %]
-                          <li>[% listcall %]</li>
+                          <li>[% listcall | html %]</li>
                       [% END %]
                   </ul>
             </td>
-            <td>[% IF ( reserveloo.thisratio_atleast1 ) %]<p>[% IF ( CAN_user_acquisition && basketno && booksellerid ) %]<!-- [% reserveloo.ratiocalc %] --><a href="/cgi-bin/koha/acqui/neworderempty.pl?biblionumber=[% reserveloo.biblionumber %]&amp;booksellerid=[% booksellerid %]&amp;basketno=[% basketno %]&amp;rr_quantity_to_order=[% reserveloo.ratiocalc %]">[% END %]<b>[% reserveloo.ratiocalc %] to order</b>[% IF ( CAN_user_acquisition && basketno && booksellerid ) %]</a>[% END %]
-            [% IF ( reserveloo.pendingorders ) %]<br><b>[% reserveloo.pendingorders %] pending</b>[% END %]</p>[% END %]</td>
+            <td>[% IF ( reserveloo.thisratio_atleast1 ) %]<p>[% IF ( CAN_user_acquisition && basketno && booksellerid ) %]<!-- [% reserveloo.ratiocalc | html %] --><a href="/cgi-bin/koha/acqui/neworderempty.pl?biblionumber=[% reserveloo.biblionumber | html %]&amp;booksellerid=[% booksellerid | html %]&amp;basketno=[% basketno | html %]&amp;rr_quantity_to_order=[% reserveloo.ratiocalc | html %]">[% END %]<b>[% reserveloo.ratiocalc | html %] to order</b>[% IF ( CAN_user_acquisition && basketno && booksellerid ) %]</a>[% END %]
+            [% IF ( reserveloo.pendingorders ) %]<br><b>[% reserveloo.pendingorders | html %] pending</b>[% END %]</p>[% END %]</td>
         </tr>
       [% END %]
       </tbody>
 <ol>
     <li>
         <label for="ratio">Hold ratio:</label>
-        <input type="text" size="5" id="ratio" name="ratio" value="[% ratio %]" />
+        <input type="text" size="5" id="ratio" name="ratio" value="[% ratio | html %]" />
     <li>
 
     <li>
 <fieldset class="action"><input type="submit" value="Go" class="submit"/></fieldset>
 </fieldset>
 [% IF ( CAN_user_acquisition && basketno && booksellerid ) %]
-<input type="hidden" name="booksellerid" value="[% booksellerid %]" />
-<input type="hidden" name="basketno" value="[% basketno %]" />
+<input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
+<input type="hidden" name="basketno" value="[% basketno | html %]" />
 [% END %]
 </form>
 
index 051d66a..fd712f7 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -31,8 +32,8 @@
 [% END %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Circulation &rsaquo; Check in [% title |html %]</title>
-[% Asset.css("css/datatables.css") %]
+<title>Koha &rsaquo; Circulation &rsaquo; Check in [% title | html %]</title>
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 
 [% IF additional_materials %]
     <div class="dialog message" id="materials">Note about the accompanying materials: <br />
-    [% additional_materials %]
+    [% additional_materials | html %]
     </div>
 [% END %]
 
 [% IF ( collectionItemNeedsTransferred ) %]
  <div id="rotating-collection" class="dialog message">
-        <h3>Please transfer item to: [% Branches.GetName( collectionBranch ) %]</h3>
-            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
+        <h3>Please transfer item to: [% Branches.GetName( collectionBranch ) | html %]</h3>
+            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
             <p>This item is part of a rotating collection.</p>
-            <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber %]&amp;branchcode=[% collectionBranch %]&amp;op=slip"><i class="fa fa-print"></i> Print slip</button></p>
+            <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&amp;branchcode=[% collectionBranch | html %]&amp;op=slip"><i class="fa fa-print"></i> Print slip</button></p>
 </div>
 [% END %]
 
@@ -77,7 +78,7 @@
     <div class="dialog message">
         <h1>Patron note</h1>
         <p>[% issue.notedate | $KohaDates %]</p>
-        <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% itembiblionumber %]"> [% title |html %]</a> [% author %]</p>
+        <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% itembiblionumber | html %]"> [% title | html %]</a> [% author | html %]</p>
         <p>[% issue.note | html %]</p>
     </div>
 [% END %]
 <!-- Patron has fines -->
 [% IF ( fines ) %]
     <div class="dialog alert">
-        <h3>Patron has outstanding fines of [% fines %].</h3>
-        <p><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% fineborrowernumber %]">Make payment</a>.</p>
+        <h3>Patron has outstanding fines of [% fines | html %].</h3>
+        <p><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% fineborrowernumber | html %]">Make payment</a>.</p>
     </div>
 [% END %]
 
 <!-- Patron has waiting holds -->
 [% IF ( waiting_holds ) %]
     <div id="awaiting-pickup" class="dialog message">
-        <h3>[% holdsfirstname %] [% holdssurname %] has [% waiting_holds %] hold(s) waiting for pickup.</h3>
-        <p><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% holdsborrowernumber %]">Check out to this patron</a>.</p>
+        <h3>[% holdsfirstname | html %] [% holdssurname | html %] has [% waiting_holds | html %] hold(s) waiting for pickup.</h3>
+        <p><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% holdsborrowernumber | html %]">Check out to this patron</a>.</p>
     </div>
 [% END %]
 
 [% IF return_date_was_overriden && Borrowers.IsDebarred( borrower ) %]
     <div id="restricted_backdated" class="dialog message">
         <h3>
-            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">
-                [% patron.firstname %] [% patron.surname %]
+            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">
+                [% patron.firstname | html %] [% patron.surname | html %]
             </a>
             is restricted. Please verify this patron should still be restricted.
         </h3>
 
 [% IF ( wrongbranch ) %]
     <div class="dialog alert"><h3>Cannot check in</h3>
-        <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
+        <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
         </p><strong>NOT CHECKED IN</strong></p>
-        <p>This item must be checked in at following library: <strong>[% Branches.GetName( rightbranch ) %]</strong></p>
+        <p>This item must be checked in at following library: <strong>[% Branches.GetName( rightbranch ) | html %]</strong></p>
     </div>
 [% END %]
 
 [% IF ( WrongTransfer ) %]
     <div id="return2" class="dialog message">
         <!-- WrongTransfer -->
-        <h3>Please return item to: [% Branches.GetName( TransferWaitingAt ) %]</h3>
-            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
-        <button type="submit" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber %]&amp;&amp;branchcode=[% TransferWaitingAt %]&amp;op=slip"><i class="fa fa-print"></i> Print transfer slip</button>
-        <button class="deny" type="submit" onclick="window.location.href='/cgi-bin/koha/circ/returns.pl?itemnumber=[% itemnumber %]&amp;canceltransfer=1'"><i class="fa fa-times"></i> Cancel transfer</button>
+        <h3>Please return item to: [% Branches.GetName( TransferWaitingAt ) | html %]</h3>
+            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
+        <button type="submit" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&amp;&amp;branchcode=[% TransferWaitingAt | html %]&amp;op=slip"><i class="fa fa-print"></i> Print transfer slip</button>
+        <button class="deny" type="submit" onclick="window.location.href='/cgi-bin/koha/circ/returns.pl?itemnumber=[% itemnumber | html %]&amp;canceltransfer=1'"><i class="fa fa-times"></i> Cancel transfer</button>
 [% IF ( patron.cardnumber ) %]<h5>Hold for:</h5>
         <ul>
-            <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">
-            [% patron.surname %], [% patron.firstname %]</a> ([% patron.cardnumber %]) <span class="patron-category"> - [% patron.category.description %]</span> </li>
+            <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">
+            [% patron.surname | html %], [% patron.firstname | html %]</a> ([% patron.cardnumber | html %]) <span class="patron-category"> - [% patron.category.description | html %]</span> </li>
             [% INCLUDE display_holdpatron_address %]
-            [% IF ( patron.phone ) %]<li>[% patron.phone %]</li>[% END %]
-            [% IF ( patron.email ) %]<li><a id="boremail" href="mailto:[% patron.email %]">[% patron.email %]</a></li>[% END %]
+            [% IF ( patron.phone ) %]<li>[% patron.phone | html %]</li>[% END %]
+            [% IF ( patron.email ) %]<li><a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a></li>[% END %]
         </ul>
 
     <form method="post" action="returns.pl" class="confirm">
-            <input type="hidden" name="WT-itemNumber" value="[% WrongTransferItem %]" />
-            <input type="hidden" name="WT-waitingAt" value="[% TransferWaitingAt %]" />
-            <input type="hidden" name="WT-From" value="[% wtransfertFrom %]" />
+            <input type="hidden" name="WT-itemNumber" value="[% WrongTransferItem | html %]" />
+            <input type="hidden" name="WT-waitingAt" value="[% TransferWaitingAt | html %]" />
+            <input type="hidden" name="WT-From" value="[% wtransfertFrom | html %]" />
             <button type="submit" class="approve"><i class="fa fa-check"></i> Confirm</button>
             <input type="hidden" name="print_slip" value="0" />
-            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-            <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+            <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
             <button type="submit" class="print" onclick="this.form.print_slip.value = 1; this.form.submit();"><i class="fa fa-print"></i> Print slip and confirm</button>
-        <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-        <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+        <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+        <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
     </form>
     [% END %]</div>
 [% END %]
                     <h3>
                         Hold found (item is already waiting):
                         <br/>
-                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">
-                            [% itembarcode |html %]: [% title |html %]
+                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">
+                            [% itembarcode | html %]: [% title | html %]
                         </a>
                     </h3>
                 </div>
 
                 <div class="modal-body">
                     [% IF ( reservenotes ) %]
-                        <h4>Notes: [% reservenotes %]</h4>
+                        <h4>Notes: [% reservenotes | html %]</h4>
                     [% END %]
 
                     <h4>Hold for:</h4>
                     <ul>
                     <li>
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.surname %], [% patron.firstname %]</a> ([% patron.cardnumber %])
-                        <span class="patron-category"> - [% patron.category.description %]</span>
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.surname | html %], [% patron.firstname | html %]</a> ([% patron.cardnumber | html %])
+                        <span class="patron-category"> - [% patron.category.description | html %]</span>
                     </li>
                     [% INCLUDE display_holdpatron_address %]
                     [% IF ( patron.phone ) %]
-                        <li> [% patron.phone %]</li>
+                        <li> [% patron.phone | html %]</li>
                     [% END %]
 
                     [% IF ( patron.email ) %]
-                        <li><a id="boremail" href="mailto:[% patron.email %]">[% patron.email %]</a></li>
+                        <li><a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a></li>
                     [% END %]
 
                     [% IF ( patron.debarred ) %]
                     </ul>
 
                     [% IF ( transfertodo ) %]
-                        <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) %]</h4>
+                        <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) | html %]</h4>
                     [% ELSE %]
-                        <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) %]</h4>
+                        <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) | html %]</h4>
                     [% END %]
 
                     [% FOREACH inputloo IN inputloop %]
-                        <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-                        <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-                        <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+                        <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+                        <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+                        <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
                     [% END %]
 
-                    <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
-                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-                    <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
-                    <input type="hidden" name="reserve_id" value="[% reserve_id %]" />
-                    <input type="hidden" name="diffBranch" value="[% destbranch %]" />
-                    <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
-                    <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
-                    <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire %]" />
-
-                    <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-                    <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+                    <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                    <input type="hidden" name="biblionumber" value="[% itembiblionumber | html %]" />
+                    <input type="hidden" name="reserve_id" value="[% reserve_id | html %]" />
+                    <input type="hidden" name="diffBranch" value="[% destbranch | html %]" />
+                    <input type="hidden" name="exemptfine" value="[% exemptfine | html %]" />
+                    <input type="hidden" name="dropboxmode" value="[% dropboxmode | html %]" />
+                    <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire | html %]" />
+
+                    <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+                    <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
                 </div>
 
                 <div class="modal-footer">
                <!-- diffbranch -->
         <div id="transfer-needed" class="dialog message audio-alert-action">
             <h3>Hold needing transfer found</h3>
-                <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
+                <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
                 <h4>Hold for: </h4>
                     <ul>
-                        <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.surname %], [% patron.firstname %]</a> ([% patron.cardnumber %]) <span class="patron-category"> - [% patron.category.description %]</span> </li>
+                        <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.surname | html %], [% patron.firstname | html %]</a> ([% patron.cardnumber | html %]) <span class="patron-category"> - [% patron.category.description | html %]</span> </li>
                         [% INCLUDE display_holdpatron_address %]
-                        [% IF ( patron.phone ) %]<li>[% patron.phone %]</li>[% END %]
-                        [% IF ( patron.email ) %]<li>[% IF ( transfertodo ) %][% patron.email %][% ELSE %]<a id="boremail" href="mailto:[% patron.email %]">[% patron.email %]</a>[% END %]</li>[% END %]
+                        [% IF ( patron.phone ) %]<li>[% patron.phone | html %]</li>[% END %]
+                        [% IF ( patron.email ) %]<li>[% IF ( transfertodo ) %][% patron.email | html %][% ELSE %]<a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a>[% END %]</li>[% END %]
 [% IF ( patron.debarred ) %]<li class="error">Patron is RESTRICTED</li>[% END %]
 [% IF ( patron.gonenoaddress ) %]<li class="error">Patron's address is in doubt</li>[% END %]
                     </ul>
         [% IF ( transfertodo ) %]
-            <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) %]</h4>
+            <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) | html %]</h4>
         [% ELSE %]
-            <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) %]</h4>
+            <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) | html %]</h4>
         [% END %]
 
         <form method="post" action="returns.pl" class="confirm">
             <button type="submit" class="approve"><i class="fa fa-check"></i> Confirm</button>
             <input type="hidden" name="print_slip" value="0" />
-            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-            <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
+            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+            <input type="hidden" name="biblionumber" value="[% itembiblionumber | html %]" />
             <button type="submit" class="print" onclick="this.form.print_slip.value = 1; this.form.submit();"><i class="fa fa-print"></i> Print slip and continue</button>
             [% FOREACH inputloo IN inputloop %]
-                <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-                <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-                <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+                <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+                <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+                <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
             [% END %]
-            <input type="hidden" name="diffBranch" value="[% destbranch %]" />
-            <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
-            <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
-            <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire %]" />
+            <input type="hidden" name="diffBranch" value="[% destbranch | html %]" />
+            <input type="hidden" name="exemptfine" value="[% exemptfine | html %]" />
+            <input type="hidden" name="dropboxmode" value="[% dropboxmode | html %]" />
+            <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire | html %]" />
             <input type="hidden" name="barcode" value="0" />
 
-            <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-            <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+            <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+            <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
         </form>
                </div>
     [% END %]
     [% IF ( transfer ) %]
     <!-- transfer: item with no reservation, must be returned according to home library circulation rules -->
         <div id="return1" class="dialog message audio-alert-action">
-            <h3>Please return item to: [% Branches.GetName( returnbranch ) %]</h3>
-            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
-            <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber %]&amp;branchcode=[% returnbranch %]&amp;op=slip"><i class="fa fa-print"></i> Print slip</button></p>
+            <h3>Please return item to: [% Branches.GetName( returnbranch ) | html %]</h3>
+            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
+            <p><button type="button" class="openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&amp;branchcode=[% returnbranch | html %]&amp;op=slip"><i class="fa fa-print"></i> Print slip</button></p>
         </div>
     [% END %]
 
     [% IF ( needstransfer ) %]
        <!-- needstransfer -->
-    <div id="item-transfer" class="dialog message audio-alert-action"><h3> This item needs to be transferred to [% Branches.GetName( returnbranch ) %]</h3>
+    <div id="item-transfer" class="dialog message audio-alert-action"><h3> This item needs to be transferred to [% Branches.GetName( returnbranch ) | html %]</h3>
     Transfer now?<br />
     <form method="post" action="returns.pl" name="mainform" id="mainform">
     [% IF itemnumber %]
-        <button type="submit" name="dotransfer" value="Yes" class="print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber %]&amp;&amp;branchcode=[% returnbranch %]&amp;op=slip"><i class="fa fa-print"></i> Yes, print slip</button>
+        <button type="submit" name="dotransfer" value="Yes" class="print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | html %]&amp;&amp;branchcode=[% returnbranch | html %]&amp;op=slip"><i class="fa fa-print"></i> Yes, print slip</button>
     [% END %]
     <button type="submit" name="dotransfer" value="Yes" class="submit"><i class="fa fa-check"></i> Yes</button>
     <button type="submit" name="notransfer" value="No" class="submit"><i class="fa fa-times"></i> No</button>
-    <input type="hidden" name="tobranch" value="[% returnbranch %]" />
-       <input type="hidden" name="transferitem" value="[% itemnumber %]" />
-        <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
-        <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
-        <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire %]" />
+    <input type="hidden" name="tobranch" value="[% returnbranch | html %]" />
+       <input type="hidden" name="transferitem" value="[% itemnumber | html %]" />
+        <input type="hidden" name="exemptfine" value="[% exemptfine | html %]" />
+        <input type="hidden" name="dropboxmode" value="[% dropboxmode | html %]" />
+        <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire | html %]" />
        [% FOREACH inputloo IN inputloop %]
-       <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-       <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-       <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+       <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+       <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+       <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
        [% END %]
        <input type="hidden" name="barcode" value="0" />
-        <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-        <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+        <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+        <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
        </form>   </div>
     [% END %]
 
        <!-- diffbranch -->
         <h3 class="audio-alert-action">Item consigned:</h3>
         <table>
-        <caption><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% title |html %]</a></caption>
+        <caption><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% title | html %]</a></caption>
         <tr>
             <th>Hold for:</th>
             <td>[% INCLUDE 'patron-title.inc' patron=patron %]</td>
         <form method="post" action="returns.pl"><input type="submit" value="OK" />
             [% FOREACH inputloo IN inputloop %]
                 [% UNLESS ( inputloo.first ) %]
-                    <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-                    <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-                    <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+                    <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+                    <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+                    <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
                 [% END %]
             [% END %]
 
-            <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-            <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+            <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+            <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
 
             <input type="hidden" name="barcode" value="0" />
         </form>
                     <h3>
                         Hold found:
                         <br/>
-                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">
-                            [% itembarcode |html %]: [% title |html %]
+                        <a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">
+                            [% itembarcode | html %]: [% title | html %]
                         </a>
                 </div>
 
                 <div class="modal-body">
                     [% IF ( reservenotes ) %]
-                        <h4>Notes: [% reservenotes %]</h4>
+                        <h4>Notes: [% reservenotes | html %]</h4>
                     [% END %]
                     <h5>Hold for:</h5>
                         <li>
                             [% INCLUDE 'patron-title.inc' patron=patron %]
-                            <span class="patron-category"> - [% patron.category.description %]</span>
+                            <span class="patron-category"> - [% patron.category.description | html %]</span>
                         </li>
 
                         [% INCLUDE display_holdpatron_address %]
 
                         [% IF ( patron.phone ) %]
-                            <li>[% patron.phone  %]</li>
+                            <li>[% patron.phone | html %]</li>
                         [% END %]
 
                         [% IF ( patron.email ) %]
                             <li>
                                 [% IF ( transfertodo ) %]
-                                    [% patron.email %]
+                                    [% patron.email | html %]
                                 [% ELSE %]
-                                    <a id="boremail" href="mailto:[% patron.email %]">[% patron.email %]</a>
+                                    <a id="boremail" href="mailto:[% patron.email | html %]">[% patron.email | html %]</a>
                                 [% END %]
                             </li>
                         [% END %]
                         [% END %]
 
                     [% IF ( transfertodo ) %]
-                        <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) %]</h4>
+                        <h4><strong>Transfer to:</strong> [% Branches.GetName( destbranch ) | html %]</h4>
                     [% ELSE %]
-                        <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) %]</h4>
+                        <h4><strong>Hold at</strong> [% Branches.GetName( destbranch ) | html %]</h4>
                     [% END %]
 
                     <input type="hidden" name="print_slip" value="0" />
 
 
                     [% FOREACH inputloo IN inputloop %]
-                        <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-                        <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-                        <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+                        <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+                        <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+                        <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
                     [% END %]
 
-                    <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
-                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
-                    <input type="hidden" name="biblionumber" value="[% itembiblionumber %]" />
-                    <input type="hidden" name="reserve_id" value="[% reserve_id %]" />
-                    <input type="hidden" name="diffBranch" value="[% destbranch %]" />
-                    <input type="hidden" name="exemptfine" value="[% exemptfine %]" />
-                    <input type="hidden" name="dropboxmode" value="[% dropboxmode %]" />
-                    <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire %]" />
-                    <input type="hidden" name="return_date_override" value="[% return_date_override %]" />
-                    <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember %]" />
+                    <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
+                    <input type="hidden" name="biblionumber" value="[% itembiblionumber | html %]" />
+                    <input type="hidden" name="reserve_id" value="[% reserve_id | html %]" />
+                    <input type="hidden" name="diffBranch" value="[% destbranch | html %]" />
+                    <input type="hidden" name="exemptfine" value="[% exemptfine | html %]" />
+                    <input type="hidden" name="dropboxmode" value="[% dropboxmode | html %]" />
+                    <input type="hidden" name="forgivemanualholdsexpire" value="[% forgivemanualholdsexpire | html %]" />
+                    <input type="hidden" name="return_date_override" value="[% return_date_override | html %]" />
+                    <input type="hidden" name="return_date_override_remember" value="[% return_date_override_remember | html %]" />
                 </div>
 
                 <div class="modal-footer">
     <div class="dialog alert audio-alert-warning">
         <h3>Check in message</h3>
         [% IF itembiblionumber %]
-            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber %]">[% itembarcode |html %]: [% title |html %]</a></p>
+            <p><a href="/cgi-bin/koha/catalogue/detail.pl?type=intra&amp;biblionumber=[% itembiblionumber | html %]">[% itembarcode | html %]: [% title | html %]</a></p>
         [% END %]
         [% FOREACH errmsgloo IN errmsgloop %]
             [% IF ( errmsgloo.NotForLoanStatusUpdated ) %]
                     Not for loan status updated.
                     <br />Old value:
                     [% IF errmsgloo.NotForLoanStatusUpdated.from %]
-                        [% AuthorisedValues.GetByCode( 'NOT_LOAN', errmsgloo.NotForLoanStatusUpdated.from ) %].
+                        [% AuthorisedValues.GetByCode( 'NOT_LOAN', errmsgloo.NotForLoanStatusUpdated.from ) | html %].
                     [% ELSE %]
                         Available for loan.
                     [% END %]
                     <br />New value:
                     [% IF errmsgloo.NotForLoanStatusUpdated.to %]
-                        [% AuthorisedValues.GetByCode( 'NOT_LOAN', errmsgloo.NotForLoanStatusUpdated.to ) %].
+                        [% AuthorisedValues.GetByCode( 'NOT_LOAN', errmsgloo.NotForLoanStatusUpdated.to ) | html %].
                     [% ELSE %]
                         Available for loan.
                     [% END %]
                 <p class="problem">No item with barcode: [% errmsgloo.msg | html %]</p>
             [% END %]
             [% IF ( errmsgloo.ispermanent ) %]
-                <p class="problem">Please return item to: [% Branches.GetName( errmsgloo.msg ) %]</p>
+                <p class="problem">Please return item to: [% Branches.GetName( errmsgloo.msg ) | html %]</p>
             [% END %]
             [% IF ( errmsgloo.notissued ) %]
                 <p class="problem">Not checked out.</p>
                <p class="problem">Item is withdrawn.</p>
             [% END %]
             [% IF ( errmsgloo.debarred ) %]
-                <p class="problem"><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% errmsgloo.debarborrowernumber %]">[% errmsgloo.debarname %]([% errmsgloo.debarcardnumber %])</a> is now debarred until [% errmsgloo.debarred | $KohaDates %].</p>
+                <p class="problem"><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% errmsgloo.debarborrowernumber | html %]">[% errmsgloo.debarname | html %]([% errmsgloo.debarcardnumber | html %])</a> is now debarred until [% errmsgloo.debarred | $KohaDates %].</p>
             [% END %]
             [% IF ( errmsgloo.prevdebarred ) %]
                 <p class="problem"><b>Reminder: </b>Patron was earlier restricted until [% errmsgloo.prevdebarred | $KohaDates %].</p>
         <p>Fines are not charged for manually cancelled holds.</p>
     </div>
     <div id="dropboxmode" class="dialog message" style="display:none;">
-        <p>Book drop mode.  (Effective checkin date is [% dropboxdate %] ).</p>
+        <p>Book drop mode.  (Effective checkin date is [% dropboxdate | html %] ).</p>
     </div>
 </div>
 <div class="yui-g">
                 <div class="date-select" id="return_date_override_fields">
                     <div class="hint">Specify return date [% INCLUDE 'date-format.inc' %]: </div>
 
-                    <input type="text" size="13" id="return_date_override" name="return_date_override" value="[% return_date_override %]" />
+                    <input type="text" size="13" id="return_date_override" name="return_date_override" value="[% return_date_override | html %]" />
 
                     <label for="return_date_override_remember"> Remember for next check in:</label>
                     [% IF ( return_date_override_remember ) %]
             </div>
         [% END %]
             [% FOREACH inputloo IN inputloop %]
-                <input type="hidden" name="ri-[% inputloo.counter %]" value="[% inputloo.barcode %]" />
-                <input type="hidden" name="dd-[% inputloo.counter %]" value="[% inputloo.duedate %]" />
-                <input type="hidden" name="bn-[% inputloo.counter %]" value="[% inputloo.borrowernumber %]" />
+                <input type="hidden" name="ri-[% inputloo.counter | html %]" value="[% inputloo.barcode | html %]" />
+                <input type="hidden" name="dd-[% inputloo.counter | html %]" value="[% inputloo.duedate | html %]" />
+                <input type="hidden" name="bn-[% inputloo.counter | html %]" value="[% inputloo.borrowernumber | html %]" />
             [% END %]
 
 
             <tr>
             <td class="ci-duedate">[% IF ( riloo.duedate ) %]
                     [% IF ( riloo.return_overdue ) %]
-                        <span class="overdue">[% riloo.duedate %] (overdue)</span>
-                    [% ELSE %][% riloo.duedate %]
+                        <span class="overdue">[% riloo.duedate | html %] (overdue)</span>
+                    [% ELSE %][% riloo.duedate | html %]
                     [% END %]
                 [% ELSE %]Not checked out
                 [% END %]
             </td>
-            <td class="ci-title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% riloo.itembiblionumber %]">
-                    [% riloo.itemtitle |html %]
+            <td class="ci-title"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% riloo.itembiblionumber | html %]">
+                    [% riloo.itemtitle | html %]
                 </a>
                 [% IF ( riloo.enumchron ) %]
                     <br/>
-                    <span class="item_enumeration" style="white-space: nowrap;">[% riloo.enumchron %]</span>
+                    <span class="item_enumeration" style="white-space: nowrap;">[% riloo.enumchron | html %]</span>
                 [% END %]
             </td>
-            <td class="ci-author">[% riloo.itemauthor %]</td>
-            <td class="ci-barcode"><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% riloo.itembiblionumber %]&amp;itemnumber=[% riloo.itemnumber %]#item[% riloo.itemnumber %]">[% riloo.barcode %]</a></td>
-            <td class="ci-homelibrary">[% Branches.GetName( riloo.homebranch ) %]</td>
-            <td class="ci-holdinglibrary">[% Branches.GetName( riloo.holdingbranch ) %]</td>
-            <td class="ci-shelvinglocation">[% riloo.location %]</td>
-            <td class="ci-callnumber">[% riloo.itemcallnumber %]</td>
+            <td class="ci-author">[% riloo.itemauthor | html %]</td>
+            <td class="ci-barcode"><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% riloo.itembiblionumber | html %]&amp;itemnumber=[% riloo.itemnumber | html %]#item[% riloo.itemnumber | html %]">[% riloo.barcode | html %]</a></td>
+            <td class="ci-homelibrary">[% Branches.GetName( riloo.homebranch ) | html %]</td>
+            <td class="ci-holdinglibrary">[% Branches.GetName( riloo.holdingbranch ) | html %]</td>
+            <td class="ci-shelvinglocation">[% riloo.location | html %]</td>
+            <td class="ci-callnumber">[% riloo.itemcallnumber | html %]</td>
             <td class="ci-dateaccessioned">[% riloo.dateaccessioned | $KohaDates %]</td>
-            <td class="ci-type">[% ItemTypes.GetDescription( riloo.itemtype ) %] [% AuthorisedValues.GetByCode('CCODE', riloo.ccode) %]</td>
+            <td class="ci-type">[% ItemTypes.GetDescription( riloo.itemtype ) | html %] [% AuthorisedValues.GetByCode('CCODE', riloo.ccode) | html %]</td>
             <td class="ci-patron">[% IF ( riloo.duedate ) %]
-                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% riloo.patron.borrowernumber %]">
-                    [% riloo.patron.surname %], [% riloo.patron.firstname %] ([% riloo.patron.category.description %])
+                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% riloo.patron.borrowernumber | html %]">
+                    [% riloo.patron.surname | html %], [% riloo.patron.firstname | html %] ([% riloo.patron.category.description | html %])
                 </a>
                 [% IF riloo.borissuescount %]
                     <span class="results_summary nowrap">
                         <span class="label">Checkouts:</span>
                         <span class="number_box">
-                            <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% riloo.patron.borrowernumber %]">[% riloo.borissuescount %]</a>
+                            <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% riloo.patron.borrowernumber | html %]">[% riloo.borissuescount | html %]</a>
                         </span>
                     </span>
                 [% END %]
             [% ELSE %]Not checked out[% END %]</td>
             <td class="ci-note">
-                [% IF ( riloo.patron.borrowernotes ) %]<p><span class="circ-hlt patron-note">[% riloo.patron.borrowernotes %]</p></span>[% END %]
-                [% IF ( riloo.itemnote ) %]<p><span class="circ-hlt item-note-public">[% riloo.itemnote %]</p></span>[% END %]
-                [% IF ( riloo.itemnotes_nonpublic ) %]<p><span class="circ-hlt item-note-nonpublic">[% riloo.itemnotes_nonpublic %]</p></span>[% END %]
+                [% IF ( riloo.patron.borrowernotes ) %]<p><span class="circ-hlt patron-note">[% riloo.patron.borrowernotes | html %]</p></span>[% END %]
+                [% IF ( riloo.itemnote ) %]<p><span class="circ-hlt item-note-public">[% riloo.itemnote | html %]</p></span>[% END %]
+                [% IF ( riloo.itemnotes_nonpublic ) %]<p><span class="circ-hlt item-note-nonpublic">[% riloo.itemnotes_nonpublic | html %]</p></span>[% END %]
             </td>
            </tr>
         [% END %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") | $raw %]
     [% INCLUDE 'timepicker.inc' %]
 
     <script type="text/javascript">
             $(".modal").on('hidden.bs.modal', function (e) { $("#barcode").focus(); });
 
             [% IF print_slip %]
-                Dopop('hold-transfer-slip.pl?borrowernumber=[% borrowernumber %]&amp;biblionumber=[% biblionumber %]&amp;itemnumber=[% itemnumber %]');
+                Dopop('hold-transfer-slip.pl?borrowernumber=[% borrowernumber | html %]&amp;biblionumber=[% biblionumber | html %]&amp;itemnumber=[% itemnumber | html %]');
             [% END %]
 
-            var columns_settings = [% ColumnsSettings.GetColumns( 'circ', 'returns', 'checkedintable', 'json' ) %]
+            var columns_settings = [% ColumnsSettings.GetColumns( 'circ', 'returns', 'checkedintable', 'json' ) | $raw %]
             var returns_table = KohaTable("checkedintable", {
                     "bFilter":false,
                     "bPaginate":false,
index 220e5b0..3b113f2 100644 (file)
 Updated:<ul>
     [% FOREACH update IN updated %]
     [% IF ( update.updated_branch ) %]
-        <li>Library: [% update.old_branch or "?" %] &rArr; [% update.LoginBranchcode or "?" %]</li>
+        <li>Library: [% update.old_branch or "?" | html %] &rArr; [% update.LoginBranchcode or "?" | html %]</li>
     [% ELSIF ( update.updated_printer ) %]
-      <!-- FIXME:  <li>Printer: [% update.old_printer or "?" %] &rArr; [% update.new_printer or "?" %]</li> -->
+      <!-- FIXME:  <li>Printer: [% update.old_printer or "?" | html %] &rArr; [% update.new_printer or "?" | html %]</li> -->
     [% ELSE %]
         <li>ERROR - unknown</li>
     [% END %]
     [% END %]
     </ul>
-<form method="post" action="[% referer or "/cgi-bin/koha/circ/circulation.pl" |html %]">
+<form method="post" action="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]">
     <div class="noshow">
         [% FOREACH recycle_loo IN recycle_loop %]
-        <input type="text" name="[% recycle_loo.param %]" value="[% recycle_loo.value |html %]" />
+        <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
         [% END %]
     </div>
     <button type="submit">Continue</button>
@@ -65,9 +65,9 @@ Updated:<ul>
         <select name="printer" id="printer">
             [% FOREACH printerloo IN printerloop %]
                 [% IF ( printerloo.selected ) %]
-                    <option value="[% printerloo.value %]" selected="selected">[% printerloo.name %]</option>
+                    <option value="[% printerloo.value | html %]" selected="selected">[% printerloo.name | html %]</option>
                 [% ELSE %]
-                    <option value="[% printerloo.value %]">[% printerloo.name %]</option>
+                    <option value="[% printerloo.value | html %]">[% printerloo.name | html %]</option>
                 [% END %]
             [% END %]
         </select></li>
@@ -80,9 +80,9 @@ Updated:<ul>
 </fieldset>
 <div class="noshow">
     [% FOREACH recycle_loo IN recycle_loop %]
-    <input type="text" name="[% recycle_loo.param %]" value="[% recycle_loo.value |html %]" />
+    <input type="text" name="[% recycle_loo.param | html %]" value="[% recycle_loo.value | html %]" />
     [% END %]
-    <input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/circ/circulation.pl" |html %]" />
+    <input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/circ/circulation.pl" %]" />
 </div>
 </form>
 <!-- /updated -->
index 3afff19..8e819c2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Transfers to receive</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_transferstoreceive" class="circ">
         <h1>Transfers made to your library as of [% show_date | $KohaDates %]</h1>
        [% IF ( branchesloop ) %]
         <p>Your library is the destination for the following transfer(s)</p>
-               [% IF ( latetransfers ) %]<p>Transfers are <span class="error">considered late</span> after [% TransfersMaxDaysWarning %] days.</p>[% END %]
+               [% IF ( latetransfers ) %]<p>Transfers are <span class="error">considered late</span> after [% TransfersMaxDaysWarning | html %] days.</p>[% END %]
         <div id="resultlist">
         [% FOREACH branchesloo IN branchesloop %]
             [% IF ( branchesloo.branchcode ) %]
-            <table style="width: 100%" id="transferst[% branchesloo.branchcode %]">
-            <caption>Coming from [% branchesloo.branchname %]</caption>
+            <table style="width: 100%" id="transferst[% branchesloo.branchcode | html %]">
+            <caption>Coming from [% branchesloo.branchname | html %]</caption>
             <thead><tr>
                 <th class="title-string">Date of transfer</th>
                 <th class="anti-the">Title</th>
                 [% ELSE %]
                 <tr>
                 [% END %]
-                    <td><p><span title="[% reser.datetransfer %]">[% reser.datetransfer | $KohaDates %]</span></p> [% IF ( reser.messcompa ) %]<span class="error">Transfer is [% reser.diff %] days late</span>[% END %]</td>
+                    <td><p><span title="[% reser.datetransfer | html %]">[% reser.datetransfer | $KohaDates %]</span></p> [% IF ( reser.messcompa ) %]<span class="error">Transfer is [% reser.diff | html %] days late</span>[% END %]</td>
                     <td>
-                        [% INCLUDE 'biblio-default-view.inc' biblionumber = reser.biblionumber %][% reser.title |html %] [% IF ( reser.subtitle ) %] [% FOREACH subtitl IN reser.subtitle %][% subtitl.subfield %][% END %][% END %]</a> [% IF ( reser.author ) %]by [% reser.author %][% END %]
-                            [% IF ( reser.itemtype ) %] (<b>[% reser.itemtype %]</b>)[% END %]
-                            <br />Barcode: [% reser.barcode %]
+                        [% INCLUDE 'biblio-default-view.inc' biblionumber = reser.biblionumber %][% reser.title | html %] [% IF ( reser.subtitle ) %] [% FOREACH subtitl IN reser.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a> [% IF ( reser.author ) %]by [% reser.author | html %][% END %]
+                            [% IF ( reser.itemtype ) %] (<b>[% reser.itemtype | html %]</b>)[% END %]
+                            <br />Barcode: [% reser.barcode | html %]
                     </td>
                     <td>[% IF ( reser.patron ) %]
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reser.patron.borrowernumber %]">
-                            [% reser.patron.surname %][%IF ( reser.patron.firstname ) %], [% reser.patron.firstname %][% END %]
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reser.patron.borrowernumber | html %]">
+                            [% reser.patron.surname | html %][%IF ( reser.patron.firstname ) %], [% reser.patron.firstname | html %][% END %]
                         </a>
-                        [% IF ( reser.patron.phone ) %]<br />[% reser.patron.phone %][% END %]
+                        [% IF ( reser.patron.phone ) %]<br />[% reser.patron.phone | html %][% END %]
                             [% IF ( reser.patron.first_valid_email_address ) %]
                                 <br />
                                 [% BLOCK subject %]Hold:[% END %]
-                                <a href="mailto:[% reser.patron.first_valid_email_address %]?subject=[% INCLUDE subject %] [% reser.title |html %]">
-                                    [% reser.patron.first_valid_email_address %]
+                                <a href="mailto:[% reser.patron.first_valid_email_address | html %]?subject=[% INCLUDE subject %] [% reser.title | html %]">
+                                    [% reser.patron.first_valid_email_address | html %]
                                 </a>
                             [% END %]
                         [% ELSE %]
                         <p>None</p>
                     [% END %]
                     </td>
-                    <td>[% IF reser.homebranch %][% Branches.GetName( reser.homebranch ) %][% END %]</td>
-                    <td>[% reser.itemcallnumber %]</td>
-                    <td class="actions"><a href="/cgi-bin/koha/circ/returns.pl?itemnumber=[% reser.itemnumber %]&amp;canceltransfer=1&amp;dest=ttr" class="btn btn-default btn-xs"><i class="fa fa-times"></i> Cancel transfer</a></td>
+                    <td>[% IF reser.homebranch %][% Branches.GetName( reser.homebranch ) | html %][% END %]</td>
+                    <td>[% reser.itemcallnumber | html %]</td>
+                    <td class="actions"><a href="/cgi-bin/koha/circ/returns.pl?itemnumber=[% reser.itemnumber | html %]&amp;canceltransfer=1&amp;dest=ttr" class="btn btn-default btn-xs"><i class="fa fa-times"></i> Cancel transfer</a></td>
                 </tr>
             [% END %]</tbody>
             </table>
@@ -95,7 +96,7 @@
     <script type="text/javascript">
         $(document).ready(function() {
             [% FOREACH branchesloo IN branchesloop %]
-            $("#transferst[% branchesloo.branchcode %]").dataTable($.extend(true, {}, dataTablesDefaults, {
+            $("#transferst[% branchesloo.branchcode | html %]").dataTable($.extend(true, {}, dataTablesDefaults, {
                 "aoColumnDefs": [
                     { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
                     { "sType": "anti-the", "aTargets" : [ "anti-the" ] },
index e8a3670..e8d2588 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -11,7 +12,7 @@
 <title>Koha &rsaquo; Circulation &rsaquo; Holds queue</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css"> p { margin-top: 0; }</style>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_view_holdsqueue" class="circ">
@@ -35,8 +36,8 @@
 
 [% IF ( run_report ) %]
     [% IF ( total ) %]
-        <div class="results">[% total %] items found for
-            [% IF ( branchlimit ) %][% Branches.GetName( branchlimit ) %][% ELSE %]All libraries[% END %]
+        <div class="results">[% total | html %] items found for
+            [% IF ( branchlimit ) %][% Branches.GetName( branchlimit ) | html %][% ELSE %]All libraries[% END %]
         </div>
     [% ELSE %]
         <div class="dialog message">No items found.</div>
      <tbody>[% FOREACH itemsloo IN itemsloop %]
         <tr>
             <td class="hq-title">
-                <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% itemsloo.biblionumber %]"><strong>[% itemsloo.title | html %]</strong> [% FOREACH s IN itemsloo.subtitle %] [% s %][% END %]</a></p>
+                <p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% itemsloo.biblionumber | html %]"><strong>[% itemsloo.title | html %]</strong> [% FOREACH s IN itemsloo.subtitle %] [% s | html %][% END %]</a></p>
                 <p>
-                    <div class="hq-biblionumber content_hidden">[% itemsloo.biblionumber %]</div>
-                    <div class="hq-author">[% itemsloo.author %]</div>
+                    <div class="hq-biblionumber content_hidden">[% itemsloo.biblionumber | html %]</div>
+                    <div class="hq-author">[% itemsloo.author | html %]</div>
                     <div class="hq-pubdata">
-                        [% IF ( itemsloo.publishercode ) %][% itemsloo.publishercode %][% END %]
+                        [% IF ( itemsloo.publishercode ) %][% itemsloo.publishercode | html %][% END %]
 
                         [% IF ( itemsloo.publicationyear ) %]
-                            , [% itemsloo.publicationyear %]
+                            , [% itemsloo.publicationyear | html %]
                         [% ELSIF ( itemsloo.copyrightdate ) %]
-                            , [% itemsloo.copyrightdate %]
+                            , [% itemsloo.copyrightdate | html %]
                         [% END %]
 
-                        [% IF ( itemsloo.pages ) %]: [% itemsloo.pages %] [% END %]
+                        [% IF ( itemsloo.pages ) %]: [% itemsloo.pages | html %] [% END %]
 
-                        [% IF ( itemsloo.item('size') ) %][% itemsloo.item('size') %][% END %]
+                        [% IF ( itemsloo.item('size') ) %][% itemsloo.item('size') | html %][% END %]
 
-                        [% IF ( itemsloo.isbn ) %]ISBN: [% itemsloo.isbn %][% END %]
+                        [% IF ( itemsloo.isbn ) %]ISBN: [% itemsloo.isbn | html %][% END %]
                     </div>
                 </p>
             </td>
-            <td class="hq-collection">[% AuthorisedValues.GetByCode( 'CCODE', itemsloo.ccode ) %]</td>
-            <td class="hq-itemtype">[% ItemTypes.GetDescription( itemsloo.itype ) %]</td>
-            <td class="hq-callnumber">[% IF ( itemsloo.location ) %]<em>[% AuthorisedValues.GetByCode( 'LOC', itemsloo.location ) %]</em> [% END %][% itemsloo.itemcallnumber %]</td>
-            <td class="hq-copynumber">[% itemsloo.copynumber %]</td>
-            <td class="hq-enumchron">[% itemsloo.enumchron %]</td>
+            <td class="hq-collection">[% AuthorisedValues.GetByCode( 'CCODE', itemsloo.ccode ) | html %]</td>
+            <td class="hq-itemtype">[% ItemTypes.GetDescription( itemsloo.itype ) | html %]</td>
+            <td class="hq-callnumber">[% IF ( itemsloo.location ) %]<em>[% AuthorisedValues.GetByCode( 'LOC', itemsloo.location ) | html %]</em> [% END %][% itemsloo.itemcallnumber | html %]</td>
+            <td class="hq-copynumber">[% itemsloo.copynumber | html %]</td>
+            <td class="hq-enumchron">[% itemsloo.enumchron | html %]</td>
             <td class="hq-barcode">
                 [% IF ( itemsloo.item_level_request ) %]
-                    <em>Only item:</em> <strong>[% itemsloo.barcode %]</strong>
+                    <em>Only item:</em> <strong>[% itemsloo.barcode | html %]</strong>
                 [% ELSE %]
-                    <strong>[% itemsloo.barcode %]</strong> <em>or any available</em>
+                    <strong>[% itemsloo.barcode | html %]</strong> <em>or any available</em>
                 [% END %]
             </td>
             <td class="hq-patron">
                   [% INCLUDE 'patron-title.inc' patron=itemsloo.patron hide_patron_infos_if_needed=1 link_to="circulation_reserves" %]
               </p>
               [% UNLESS Koha.Preference('HidePatronName') %]
-                 <p>[% itemsloo.patron.phone %]</p>
+                 <p>[% itemsloo.patron.phone | html %]</p>
               [% END %]
             </td>
-            <td class="hq-sendto">[% Branches.GetName( itemsloo.pickbranch ) %]</td>
-            <td class="hq-date"><span title="[% itemsloo.reservedate %]">[% itemsloo.reservedate | $KohaDates %]</span></td>
-            <td class="hq-notes">[% itemsloo.notes %]</td>
+            <td class="hq-sendto">[% Branches.GetName( itemsloo.pickbranch ) | html %]</td>
+            <td class="hq-date"><span title="[% itemsloo.reservedate | html %]">[% itemsloo.reservedate | $KohaDates %]</span></td>
+            <td class="hq-notes">[% itemsloo.notes | html %]</td>
         </tr>
     [% END %]</tbody>
     </table>
             };
             $('#holdst thead input').on('change keyup keydown', filterColumn);
 
-            var columns_settings = [% ColumnsSettings.GetColumns('circ', 'view_holdsqueue', 'holds-table', 'json') %];
+            var columns_settings = [% ColumnsSettings.GetColumns('circ', 'view_holdsqueue', 'holds-table', 'json').raw %];
             var holdst = KohaTable("holdst", {
                 "aaSorting": [[ 3, "asc" ]],
                 "aoColumns": [
index 87434da..8c44294 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Circulation &rsaquo; Holds awaiting pickup</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_waitingreserves" class="circ">
@@ -27,7 +28,7 @@
 
         <h2>Holds awaiting pickup for your library on: [% show_date | $KohaDates %]
             [% IF ( all_branches_link ) %]
-            <span style="margin-left:20px"><a href="[% all_branches_link %]">
+            <span style="margin-left:20px"><a href="[% all_branches_link | html %]">
             View all libraries</a></span>
             [% END %]
         </h2>
         [% FOREACH cancel_result %]
             [% IF ( messagetransfert ) %]
                 <div class="dialog message">
-                    <h2>This item is on hold for pick-up at [% Branches.GetName( branchname ) %]</h2>
-                    <p><strong>[% nextreservtitle %]</strong> is on hold for <strong> [% nextreservsurname %], [% nextreservfirstname %]</strong>.
+                    <h2>This item is on hold for pick-up at [% Branches.GetName( branchname ) | html %]</h2>
+                    <p><strong>[% nextreservtitle | html %]</strong> is on hold for <strong> [% nextreservsurname | html %], [% nextreservfirstname | html %]</strong>.
                     Please retain this item and check it in to process the hold.
                     </p>
-                    <form name="cancelReservewithtransfert" action="waitingreserves.pl#[% tab %]" method="post">
+                    <form name="cancelReservewithtransfert" action="waitingreserves.pl#[% tab | html %]" method="post">
                         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                     </form>
                 </div>
             [% IF ( waiting ) %]
                 <div class="dialog message">
                     <h2>This item is on hold for pick-up at your library</h2>
-                    <p><strong>[% nextreservtitle %]</strong> is on hold for <strong>[% nextreservsurname %], [% nextreservfirstname %]</strong>.
+                    <p><strong>[% nextreservtitle | html %]</strong> is on hold for <strong>[% nextreservsurname | html %], [% nextreservfirstname | html %]</strong>.
                     Please retain this item and check it in to process the hold.
                     </p>
-                    <form name="cancelReservewithwaiting" action="waitingreserves.pl#[% tab %]" method="post">
+                    <form name="cancelReservewithwaiting" action="waitingreserves.pl#[% tab | html %]" method="post">
                         <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> OK</button>
                     </form>
                 </div>
     [% ELSE %]
         <div id="resultlist" class="toptabs">
             <ul>
-                <li><a href="#holdswaiting">Holds waiting: [% reservecount %]</a></li>
+                <li><a href="#holdswaiting">Holds waiting: [% reservecount | html %]</a></li>
                 <li>
                     <a href="#holdsover">
-                        Holds waiting over [% ReservesMaxPickUpDelay %] days: [% overcount %]
+                        Holds waiting over [% ReservesMaxPickUpDelay | html %] days: [% overcount | html %]
                     </a>
                 </li>
             </ul>
                </tr></thead>
                <tbody>[% FOREACH reserveloo IN reserveloop %]
                 <tr>
-                    <td><span title="[% reserveloo.waitingdate %]">[% reserveloo.waitingdate | $KohaDates %]</span></td>
-                    <td><span title="[% reserveloo.reservedate %]">[% reserveloo.reservedate | $KohaDates %]</span></td>
+                    <td><span title="[% reserveloo.waitingdate | html %]">[% reserveloo.waitingdate | $KohaDates %]</span></td>
+                    <td><span title="[% reserveloo.reservedate | html %]">[% reserveloo.reservedate | $KohaDates %]</span></td>
                     <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = reserveloo.biblionumber %]
-                        [% reserveloo.title |html %] [% FOREACH subtitl IN reserveloo.subtitle %] [% subtitl.subfield %][% END %]
+                        [% reserveloo.title | html %] [% FOREACH subtitl IN reserveloo.subtitle %] [% subtitl.subfield | html %][% END %]
                         </a>
-                            [% UNLESS ( item_level_itypes ) %][% IF ( reserveloo.itemtype ) %]&nbsp; (<b>[% reserveloo.itemtype %]</b>)[% END %][% END %]
-                            <br />Barcode: [% reserveloo.barcode %]
+                            [% UNLESS ( item_level_itypes ) %][% IF ( reserveloo.itemtype ) %]&nbsp; (<b>[% reserveloo.itemtype | html %]</b>)[% END %][% END %]
+                            <br />Barcode: [% reserveloo.barcode | html %]
                     </td>
-                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reserveloo.patron.borrowernumber %]">[% reserveloo.patron.surname%], [% reserveloo.patron.firstname %]</a>
-                        [% IF ( reserveloo.patron.phone ) %]<br />[% reserveloo.patron.phone %][% END %]
-                        [% IF ( reserveloo.patron.first_valid_email_address ) %]<br /><a href="mailto:[% reserveloo.patron.first_valid_email_address %]?subject=Hold waiting: [% reserveloo.title %]">
-                        [% reserveloo.patron.first_valid_email_address %]</a>[% END %]
+                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% reserveloo.patron.borrowernumber | html %]">[% reserveloo.patron.surname | html %], [% reserveloo.patron.firstname | html %]</a>
+                        [% IF ( reserveloo.patron.phone ) %]<br />[% reserveloo.patron.phone | html %][% END %]
+                        [% IF ( reserveloo.patron.first_valid_email_address ) %]<br /><a href="mailto:[% reserveloo.patron.first_valid_email_address | html %]?subject=Hold waiting: [% reserveloo.title | html %]">
+                        [% reserveloo.patron.first_valid_email_address | html %]</a>[% END %]
                     </td>
-                    <td>[% Branches.GetName( reserveloo.homebranch ) %]</td>
-                    <td>[% Branches.GetName( reserveloo.holdingbranch ) %]</td>
-                    <td>[% reserveloo.itemcallnumber %]</td>
-                    <td>[% reserveloo.copynumber %]</td>
-                    <td>[% reserveloo.enumchron %]</td>
+                    <td>[% Branches.GetName( reserveloo.homebranch ) | html %]</td>
+                    <td>[% Branches.GetName( reserveloo.holdingbranch ) | html %]</td>
+                    <td>[% reserveloo.itemcallnumber | html %]</td>
+                    <td>[% reserveloo.copynumber | html %]</td>
+                    <td>[% reserveloo.enumchron | html %]</td>
                     <td>
                         <form name="cancelReserve" action="waitingreserves.pl" method="post">
-                            <input type="hidden" name="borrowernumber" value="[% reserveloo.borrowernum %]" />
-                            <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber %]" />
-                            <input type="hidden" name="fbr" value="[% reserveloo.holdingbranch %]" />
-                            <input type="hidden" name="tbr" value="[% reserveloo.homebranch %]" />
+                            <input type="hidden" name="borrowernumber" value="[% reserveloo.borrowernum | html %]" />
+                            <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber | html %]" />
+                            <input type="hidden" name="fbr" value="[% reserveloo.holdingbranch | html %]" />
+                            <input type="hidden" name="tbr" value="[% reserveloo.homebranch | html %]" />
                             <input type="hidden" name="tab" value="holdswaiting">
                             [% IF ( reserveloo.dotransfer ) %]
-                            <input type="submit" value="Cancel hold and return to : [% Branches.GetName( reserveloo.homebranch ) %]" />
+                            <input type="submit" value="Cancel hold and return to : [% Branches.GetName( reserveloo.homebranch ) | html %]" />
                             [% ELSE %]
                             <input type="submit" value="Cancel hold" />
                             [% END %]
         [% END %]
         </div>
         <div id="holdsover">
-                [% IF ( ReservesMaxPickUpDelay ) %]<p>Holds listed here have been awaiting pickup for more than [% ReservesMaxPickUpDelay %] days.</p>[% END %]
+                [% IF ( ReservesMaxPickUpDelay ) %]<p>Holds listed here have been awaiting pickup for more than [% ReservesMaxPickUpDelay | html %] days.</p>[% END %]
                [% IF ( overloop ) %]
                <form name="cancelAllReserve" action="waitingreserves.pl" method="post">
                    <input type="hidden" name="cancelall" value="1" />
-                   <input type="hidden" name="allbranches" value="[% allbranches %]" />
+                   <input type="hidden" name="allbranches" value="[% allbranches | html %]" />
                    <input type="hidden" name="tab" value="holdsover">
                    [% IF TransferWhenCancelAllWaitingHolds %]
                        <input type="submit" value="Cancel and Transfer all" />
                </tr></thead>
                <tbody>[% FOREACH overloo IN overloop %]
                     <tr>
-                        <td><span title="[% overloo.waitingdate %]">[% overloo.waitingdate | $KohaDates %]</span></td>
-                        <td><span title="[% overloo.reservedate %]">[% overloo.reservedate | $KohaDates %]</span></td>
-                        <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = overloo.biblionumber %][% overloo.title |html %]
-                            [% FOREACH subtitl IN overloo.subtitle %] [% subtitl.subfield %][% END %]
+                        <td><span title="[% overloo.waitingdate | html %]">[% overloo.waitingdate | $KohaDates %]</span></td>
+                        <td><span title="[% overloo.reservedate | html %]">[% overloo.reservedate | $KohaDates %]</span></td>
+                        <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = overloo.biblionumber %][% overloo.title | html %]
+                            [% FOREACH subtitl IN overloo.subtitle %] [% subtitl.subfield | html %][% END %]
                         </a>
-                            [% UNLESS ( item_level_itypes ) %][% IF ( overloo.itemtype ) %]&nbsp; (<b>[% overloo.itemtype %]</b>)[% END %][% END %]
-                        <br />Barcode: [% overloo.barcode %]
+                            [% UNLESS ( item_level_itypes ) %][% IF ( overloo.itemtype ) %]&nbsp; (<b>[% overloo.itemtype | html %]</b>)[% END %][% END %]
+                        <br />Barcode: [% overloo.barcode | html %]
                     </td>
-                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% overloo.patron.borrowernumber %]">[% overloo.patron.surname %], [% overloo.patron.firstname %]</a><br />[% overloo.patron.phone %]<br />
-                        [% IF ( overloo.patron.first_valid_email_address ) %]<a href="mailto:[% overloo.patron.first_valid_email_address %]?subject=Reservation: [% overloo.title |url %]">
-        [% overloo.patron.first_valid_email_address %]</a>[% END %]
+                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% overloo.patron.borrowernumber | html %]">[% overloo.patron.surname | html %], [% overloo.patron.firstname | html %]</a><br />[% overloo.patron.phone | html %]<br />
+                        [% IF ( overloo.patron.first_valid_email_address ) %]<a href="mailto:[% overloo.patron.first_valid_email_address | html %]?subject=Reservation: [% overloo.title |url %]">
+        [% overloo.patron.first_valid_email_address | html %]</a>[% END %]
                     </td>
-                    <td>[% Branches.GetName( overloo.homebranch ) %]</td>
-                    <td>[% Branches.GetName( overloo.holdingbranch ) %]</td>
-                    <td>[% overloo.itemcallnumber %]</td>
-                    <td>[% overloo.copynumber %]</td>
-                    <td>[% overloo.enumchron %]</td>
+                    <td>[% Branches.GetName( overloo.homebranch ) | html %]</td>
+                    <td>[% Branches.GetName( overloo.holdingbranch ) | html %]</td>
+                    <td>[% overloo.itemcallnumber | html %]</td>
+                    <td>[% overloo.copynumber | html %]</td>
+                    <td>[% overloo.enumchron | html %]</td>
                     <td><form name="cancelReserve" action="waitingreserves.pl" method="post">
-                            <input type="hidden" name="borrowernumber" value="[% overloo.borrowernum %]" />
-                            <input type="hidden" name="itemnumber" value="[% overloo.itemnumber %]" />
-                            <input type="hidden" name="fbr" value="[% overloo.holdingbranch %]" />
-                            <input type="hidden" name="tbr" value="[% overloo.homebranch %]" />
+                            <input type="hidden" name="borrowernumber" value="[% overloo.borrowernum | html %]" />
+                            <input type="hidden" name="itemnumber" value="[% overloo.itemnumber | html %]" />
+                            <input type="hidden" name="fbr" value="[% overloo.holdingbranch | html %]" />
+                            <input type="hidden" name="tbr" value="[% overloo.homebranch | html %]" />
                             <input type="hidden" name="tab" value="holdsover">
                             [% IF ( overloo.dotransfer ) %]
-                            <input type="submit" value="Cancel hold and return to : [% Branches.GetName( overloo.homebranch ) %]" />
+                            <input type="submit" value="Cancel hold and return to : [% Branches.GetName( overloo.homebranch ) | html %]" />
                             [% ELSE %]
                             <input type="submit" value="Cancel hold" />
                             [% END %]
index d0d7268..d6843d3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Patron clubs &rsaquo; Club enrollments</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="club_enrollments" class="clubs">
@@ -18,7 +19,7 @@
    <div id="bd">
         <div id="yui-main">
             <div class="yui-b">
-                <h1>Club enrollments for <i>[% club.name %]</i></h1>
+                <h1>Club enrollments for <i>[% club.name | html %]</i></h1>
 
                 <table id="enrollments-table">
                     <thead>
                             [% SET p = e.patron %]
                             <tr>
                                 <td>
-                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% p.id %]">[% p.surname %], [% p.firstname %]</a>
+                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% p.id | html %]">[% p.surname | html %], [% p.firstname | html %]</a>
                                 </td>
                                 <td>
-                                    [% p.cardnumber %]
+                                    [% p.cardnumber | html %]
                                 </td>
                             </tr>
                         [% END %]
@@ -52,7 +53,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             eTable = $('#enrollments-table').dataTable($.extend(true, {}, dataTablesDefaults, {
index 170a56b..0179c81 100644 (file)
@@ -6,9 +6,9 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Patron clubs &rsaquo;
     [% IF club %]
-        Modify club [% club.name %]
+        Modify club [% club.name | html %]
     [% ELSE %]
-        Create a new [% club_template.name %] club
+        Create a new [% club_template.name | html %] club
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -19,9 +19,9 @@
 [% INCLUDE 'cat-search.inc' %]
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="clubs.pl">Patron clubs</a> &rsaquo;
     [% IF club %]
-        Modify club <i>[% club.name %]</i>
+        Modify club <i>[% club.name | html %]</i>
     [% ELSE %]
-        Create a new <i>[% club_template.name %]</i> club
+        Create a new <i>[% club_template.name | html %]</i> club
     [% END %]
 </div>
 
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
-                <input type="hidden" name="id" value="[% club.id %]" />
-                <input type="hidden" name="club_template_id" value="[% club_template.id %]" />
+                <input type="hidden" name="id" value="[% club.id | html %]" />
+                <input type="hidden" name="club_template_id" value="[% club_template.id | html %]" />
 
                 <fieldset class="rows">
 
                     <legend>
                         [% IF club %]
-                            Modify club <i>[% club.name %]</i>
+                            Modify club <i>[% club.name | html %]</i>
                         [% ELSE %]
-                            Create a new <i>[% club_template.name %]</i> club
+                            Create a new <i>[% club_template.name | html %]</i> club
                         [% END %]
                     </legend>
 
                     <ol>
                         <li>
                             <label class="required" for="club-name">Name:</label>
-                            <input id="club-name" name="name" type="text" value="[% club.name %]" required="required"/>
+                            <input id="club-name" name="name" type="text" value="[% club.name | html %]" required="required"/>
                             <span class="required">Required</span>
                         </li>
 
                         <li>
                             <label for="club-template-name">Description:</label>
-                            <input id="club-template-name" name="description" type="text" value="[% club.description %]" size="40" />
+                            <input id="club-template-name" name="description" type="text" value="[% club.description | html %]" size="40" />
                         </li>
 
                         <li>
                         [% IF club %]
                             [% FOREACH f IN club.club_fields %]
                                 <li>
-                                    <input type="hidden" name="club_template_field_id" value="[% f.club_template_field.id %]" />
-                                    <input type="hidden" name="club_field_id" value="[% f.id %]" />
+                                    <input type="hidden" name="club_template_field_id" value="[% f.club_template_field.id | html %]" />
+                                    <input type="hidden" name="club_field_id" value="[% f.id | html %]" />
 
-                                    <label for="club_field_[% f.club_template_field_id %]">[% f.club_template_field.name %]</label>
+                                    <label for="club_field_[% f.club_template_field_id | html %]">[% f.club_template_field.name | html %]</label>
                                     [% IF f.club_template_field.authorised_value_category %]
-                                        <select name="club_field" id="club_field_[% f.club_template_field_id %]">
+                                        <select name="club_field" id="club_field_[% f.club_template_field_id | html %]">
                                             [% FOREACH a IN AuthorisedValues.Get( f.club_template_field.authorised_value_category ) %]
                                                 [% IF a.authorised_value == f.value %]
-                                                    <option value="[% a.authorised_value %]" selected="selected">[% a.lib %]</option>
+                                                    <option value="[% a.authorised_value | html %]" selected="selected">[% a.lib | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% a.authorised_value %]">[% a.lib %]</option>
+                                                    <option value="[% a.authorised_value | html %]">[% a.lib | html %]</option>
                                                 [% END %]
                                             [% END %]
                                         </select>
                                     [% ELSE %]
-                                        <input type="text" name="club_field" id="club_field_[% f.club_template_field_id %]" value="[% f.value %]" size="40" />
+                                        <input type="text" name="club_field" id="club_field_[% f.club_template_field_id | html %]" value="[% f.value | html %]" size="40" />
                                     [% END %]
                                 </li>
                             [% END %]
                         [% ELSE %]
                             [% FOREACH f IN club_template.club_template_fields %]
                                 <li>
-                                    <input type="hidden" name="club_template_field_id" value="[% f.id %]" />
+                                    <input type="hidden" name="club_template_field_id" value="[% f.id | html %]" />
 
-                                    <label for="club_template_field_[% f.id %]">[% f.name %]</label>
+                                    <label for="club_template_field_[% f.id | html %]">[% f.name | html %]</label>
                                     [% IF f.authorised_value_category %]
-                                        <select name="club_field" id="club_template_field_[% f.id %]">
+                                        <select name="club_field" id="club_template_field_[% f.id | html %]">
                                             [% FOREACH a IN AuthorisedValues.Get( f.authorised_value_category ) %]
-                                                <option value="[% a.authorised_value %]">[% a.lib %]</option>
+                                                <option value="[% a.authorised_value | html %]">[% a.lib | html %]</option>
                                             [% END %]
                                         </select>
                                     [% ELSE %]
-                                        <input type="text" name="club_field" id="club_template_field_[% f.id %]" size="40" />
+                                        <input type="text" name="club_field" id="club_template_field_[% f.id | html %]" size="40" />
                                     [% END %]
                                 </li>
                             [% END %]
index 895ac37..05ac3ea 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -7,7 +8,7 @@
 <title>Koha &rsaquo; Tools &rsaquo; Patron clubs</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="clubs_clubs" class="clubs">
                 [% IF club_template %]
                     <div class="dialog message">
                         [% IF stored == 'updated' %]
-                            <p>Club template <i>[% club_template.name %]</i> was updated.</p>
+                            <p>Club template <i>[% club_template.name | html %]</i> was updated.</p>
                         [% ELSE %]
-                            <p>Club template <i>[% club_template.name %]</i> was saved.</p>
+                            <p>Club template <i>[% club_template.name | html %]</i> was saved.</p>
                         [% END %]
                     </div>
                 [% ELSIF club %]
                     <div class="dialog message">
                         [% IF stored == 'updated' %]
-                            <p>Club <i>[% club.name %]</i> was updated.</p>
+                            <p>Club <i>[% club.name | html %]</i> was updated.</p>
                         [% ELSE %]
-                            <p>Club <i>[% club.name %]</i> was saved.</p>
+                            <p>Club <i>[% club.name | html %]</i> was saved.</p>
                         [% END %]
                     </div>
                 [% END %]
@@ -64,8 +65,8 @@
                         <tbody>
                             [% FOREACH t IN club_templates %]
                                 <tr>
-                                    <td>[% t.name %]</td>
-                                    <td>[% t.description %]</td>
+                                    <td>[% t.name | html %]</td>
+                                    <td>[% t.description | html %]</td>
                                     <td>
                                         [% IF t.is_enrollable_from_opac %]
                                             Yes
                                             No
                                         [% END %]
                                     </td>
-                                    <td>[% Branches.GetName( t.branchcode ) %]</td>
+                                    <td>[% Branches.GetName( t.branchcode ) | html %]</td>
                                     <td class="actions">
                                         [% IF CAN_user_clubs_edit_templates %]
-                                            <a class="btn btn-xs btn-default" style="white-space:nowrap"  href="/cgi-bin/koha/clubs/templates-add-modify.pl?id=[% t.id %]">
+                                            <a class="btn btn-xs btn-default" style="white-space:nowrap"  href="/cgi-bin/koha/clubs/templates-add-modify.pl?id=[% t.id | html %]">
                                                 <i class="fa fa-pencil"></i> Edit
                                             </a>
-                                            <a class="btn btn-xs btn-default" href="#" onclick='ConfirmDeleteTemplate([% t.id %], "[% t.name | html %]", $(this) ); return false;'>
+                                            <a class="btn btn-xs btn-default" href="#" onclick='ConfirmDeleteTemplate([% t.id | html %], "[% t.name | html %]", $(this) ); return false;'>
                                                 <i class="fa fa-trash"></i> Delete
                                             </a>
                                         [% END %]
                             [% END %]
                             <ul class="dropdown-menu">
                                 [% FOREACH t IN club_templates %]
-                                    <li><a href="/cgi-bin/koha/clubs/clubs-add-modify.pl?club_template_id=[% t.id %]">[% t.name %]</a></li>
+                                    <li><a href="/cgi-bin/koha/clubs/clubs-add-modify.pl?club_template_id=[% t.id | html %]">[% t.name | html %]</a></li>
                                 [% END %]
                             </ul>
                         </div>
                         <tbody>
                             [% FOREACH c IN clubs %]
                                 <tr>
-                                    <td>[% c.name %]</td>
-                                    <td>[% c.club_template.name %]</td>
-                                    <td>[% c.description %]</td>
+                                    <td>[% c.name | html %]</td>
+                                    <td>[% c.club_template.name | html %]</td>
+                                    <td>[% c.description | html %]</td>
                                     <td>
                                         [% IF c.club_template.is_enrollable_from_opac %]
                                             Yes
                                             No
                                         [% END %]
                                     </td>
-                                    <td>[% Branches.GetName( c.branchcode ) %]</td>
+                                    <td>[% Branches.GetName( c.branchcode ) | html %]</td>
                                     <td>
                                         [% IF c.date_start %]
                                             [% c.date_start | $KohaDates %]
                                         [% END %]
                                     </td>
                                     <td>
-                                        [% c.club_enrollments.count %]
+                                        [% c.club_enrollments.count | html %]
                                     </td>
                                     <td class="actions">
                                         <div class="dropdown">
-                                            <a class="btn btn-default btn-xs dropdown-toggle" id="clubactions[% c.id %]" role="button" data-toggle="dropdown" href="#">
+                                            <a class="btn btn-default btn-xs dropdown-toggle" id="clubactions[% c.id | html %]" role="button" data-toggle="dropdown" href="#">
                                                 Actions <b class="caret"></b>
                                             </a>
-                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="clubactions[% c.id %]">
+                                            <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="clubactions[% c.id | html %]">
                                                 [% IF ( c.club_enrollments.count ) %]
                                                     <li>
-                                                        <a href="club-enrollments.pl?id=[% c.id %]">
+                                                        <a href="club-enrollments.pl?id=[% c.id | html %]">
                                                             <i class="fa fa-list-ul"></i> Enrollments
                                                         </a>
                                                     </li>
                                                 [% ELSE %]
                                                     <li class="disabled">
-                                                        <a href="club-enrollments.pl?id=[% c.id %]">
+                                                        <a href="club-enrollments.pl?id=[% c.id | html %]">
                                                             <i class="fa fa-list-ul"></i> Enrollments
                                                         </a>
                                                     </li>
                                                 [% END %]
                                                 [% IF CAN_user_clubs_edit_clubs %]
                                                     <li>
-                                                        <a href="clubs-add-modify.pl?id=[% c.id %]">
+                                                        <a href="clubs-add-modify.pl?id=[% c.id | html %]">
                                                             <i class="fa fa-pencil"></i> Edit
                                                         </a>
                                                     </li>
                                                     <li>
-                                                        <a href="#" onclick='ConfirmDeleteClub([% c.id %], "[% c.name | html %]", $(this) ); return false;'>
+                                                        <a href="#" onclick='ConfirmDeleteClub([% c.id | html %], "[% c.name | html %]", $(this) ); return false;'>
                                                             <i class="fa fa-trash"></i> Delete
                                                         </a>
                                                     </li>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             tTable = $('#club-templates-table').dataTable($.extend(true, {}, dataTablesDefaults, {
index 5862422..94dca4f 100644 (file)
         <tbody>
             [% FOREACH e IN enrollments %]
                 <tr>
-                    <td>[% e.club.name %]</td>
-                    <td>[% e.club.description %]</td>
+                    <td>[% e.club.name | html %]</td>
+                    <td>[% e.club.description | html %]</td>
                     <td>[% e.date_enrolled | $KohaDates %]</td>
                     [% IF CAN_user_clubs_enroll %]
                         <td>
-                            <button class="btn btn-xs btn-default" onclick="cancelEnrollment( [% e.id %] )">
+                            <button class="btn btn-xs btn-default" onclick="cancelEnrollment( [% e.id | html %] )">
                                 <i class="fa fa-remove"></i> Cancel enrollment
                             </button>
                         </td>
         <tbody>
             [% FOREACH c IN clubs %]
                 <tr>
-                    <td>[% c.name %]</td>
-                    <td>[% c.description %]</td>
+                    <td>[% c.name | html %]</td>
+                    <td>[% c.description | html %]</td>
                     [% IF CAN_user_clubs_enroll %]
                         <td class="action">
-                            <button class="btn btn-xs btn-default" onclick="loadEnrollmentForm([% c.id %])">
+                            <button class="btn btn-xs btn-default" onclick="loadEnrollmentForm([% c.id | html %])">
                                 <i class="fa fa-plus"></i> Enroll
                             </button>
                         </td>
@@ -67,7 +67,7 @@
 <script type="text/javascript">
 function loadEnrollmentForm( id ) {
     $("body").css("cursor", "progress");
-    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-enroll.pl?borrowernumber=[% borrowernumber %]&id=' + id, function() {
+    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-enroll.pl?borrowernumber=[% borrowernumber | html %]&id=' + id, function() {
         $("body").css("cursor", "default");
     });
 
@@ -82,7 +82,7 @@ function cancelEnrollment( id ) {
         data: { id: id },
         success: function( data ) {
             if ( data.success ) {
-                $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]', function() {
+                $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
index db3d544..350e81c 100644 (file)
@@ -2,28 +2,28 @@
 [% SET AuthorisedValuesCategories = AuthorisedValues.GetCategories %]
 
 <h3>
-    Enroll in <i>[% club.name %]</i>
+    Enroll in <i>[% club.name | html %]</i>
 </h3>
 
 <div class="container">
     <form id="patron-enrollment-form">
-        <input type="hidden" name="id" value="[% club.id %]" />
-        <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+        <input type="hidden" name="id" value="[% club.id | html %]" />
+        <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
         <fieldset class="rows">
             <ol>
                 [% FOREACH f IN club.club_template.club_template_enrollment_fields %]
                     <li>
-                        <label>[% f.name %]</label>
+                        <label>[% f.name | html %]</label>
                         [% IF f.authorised_value_category %]
-                            <select name="[% f.id %]">
+                            <select name="[% f.id | html %]">
                                 [% FOREACH a IN AuthorisedValues.Get( f.authorised_value_category ) %]
-                                    <option value="[% a.authorised_value %]">[% a.lib %]</option>
+                                    <option value="[% a.authorised_value | html %]">[% a.lib | html %]</option>
                                 [% END %]
                             </select>
                         [% ELSE %]
-                            <input type="text" name="[% f.id %]" />
+                            <input type="text" name="[% f.id | html %]" />
                         [% END %]
-                        <span class="hint">[% f.description %]</span>
+                        <span class="hint">[% f.description | html %]</span>
                     </li>
                 [% END %]
 
@@ -45,7 +45,7 @@ function addEnrollment() {
         data: $( "#patron-enrollment-form" ).serialize(),
         success: function( data ) {
             if ( data.success ) {
-                $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]&id=[% club.id %]', function() {
+                $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
@@ -59,7 +59,7 @@ function addEnrollment() {
 
 function showClubs() {
     $("body").css("cursor", "progress");
-    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]&id=[% club.id %]', function() {
+    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
         $("body").css("cursor", "default");
     });
 }
index efb8cce..2040c07 100644 (file)
@@ -3,7 +3,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Patron clubs &rsaquo;
     [% IF club_template %]
-        Modify club template [% club_template.name %]
+        Modify club template [% club_template.name | html %]
     [% ELSE %]
         Create a new club template
     [% END %]
@@ -22,7 +22,7 @@
 [% INCLUDE 'cat-search.inc' %]
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="clubs.pl">Patron clubs</a> &rsaquo;
     [% IF club_template %]
-        Modify club template <i>[% club_template.name %]</i>
+        Modify club template <i>[% club_template.name | html %]</i>
     [% ELSE %]
         Create a new club template
     [% END %]
         <div class="col-md-8 col-md-offset-2">
 
             <form method="post" class="validated">
-                <input type="hidden" name="id" value="[% club_template.id %]" />
+                <input type="hidden" name="id" value="[% club_template.id | html %]" />
 
                 <h2>
                     [% IF club_template %]
-                        Modify club template <i>[% club_template.name %]</i>
+                        Modify club template <i>[% club_template.name | html %]</i>
                     [% ELSE %]
                         Create a new club template
                     [% END %]
                     <ol>
                         <li>
                             <label class="required" for="name">Name:</label>
-                            <input id="club-template-name" name="name" type="text" value="[% club_template.name %]" required="required"/>
+                            <input id="club-template-name" name="name" type="text" value="[% club_template.name | html %]" required="required"/>
                             <span class="required">Required</span>
                         </li>
 
                         <li>
                             <label for="club-template-description">Description:</label>
-                            <input id="club-template-description" name="description" type="text" value="[% club_template.description %]" />
+                            <input id="club-template-description" name="description" type="text" value="[% club_template.description | html %]" />
                         </li>
 
                         <li>
                         [% FOREACH f IN club_template.club_template_fields %]
                             <div class="club-field">
                                 <ol class="clearfix">
-                                    <input type="hidden" name="club_template_field_id" value="[% f.id %]" />
+                                    <input type="hidden" name="club_template_field_id" value="[% f.id | html %]" />
                                     <li>
-                                        <label for="field-name-[% f.id %]">Name:</label>
-                                        <input name="club_template_field_name" id="field-name-[% f.id %]" value="[% f.name %]" />
+                                        <label for="field-name-[% f.id | html %]">Name:</label>
+                                        <input name="club_template_field_name" id="field-name-[% f.id | html %]" value="[% f.name | html %]" />
                                     </li>
 
                                     <li>
-                                        <label for="field-description-[% f.id %]">Description:</label>
-                                        <input name="club_template_field_description" id="field-description-[% f.id %]" value="[% f.description %]" />
+                                        <label for="field-description-[% f.id | html %]">Description:</label>
+                                        <input name="club_template_field_description" id="field-description-[% f.id | html %]" value="[% f.description | html %]" />
                                     </li>
 
                                     <li>
-                                        <label for="field-authorised-value-category-[% f.id %]">Authorised value category:</label>
-                                        <select name="club_template_field_authorised_value_category" id="field-authorised-value-category-[% f.id %]">
+                                        <label for="field-authorised-value-category-[% f.id | html %]">Authorised value category:</label>
+                                        <select name="club_template_field_authorised_value_category" id="field-authorised-value-category-[% f.id | html %]">
                                             <option value=""></option>
                                             [% PROCESS options_for_authorised_value_categories authorised_value_categories => AuthorisedValues.GetCategories( selected => f.authorised_value_category) %]
                                         </select>
                                     </li>
 
                                     <li>
-                                        <label for="field-delete-[% f.id %]">Delete field:</label>
-                                        <input type="checkbox" name="club_template_field_delete" id="field-delete-[% f.id %]" value="[% f.id %]" />
+                                        <label for="field-delete-[% f.id | html %]">Delete field:</label>
+                                        <input type="checkbox" name="club_template_field_delete" id="field-delete-[% f.id | html %]" value="[% f.id | html %]" />
                                     </li>
                                 </ol>
                             </div>
                                         <strong>Enrollment field</strong>
                                     </li>
                                     <li>
-                                        <input type="hidden" name="club_template_enrollment_field_id" value="[% f.id %]" />
-                                        <label for="enrollment-field-name-[% f.id %]">Name:</label>
-                                        <input name="club_template_enrollment_field_name" id="enrollment-field-name-[% f.id %]" value="[% f.name %]" size="40" />
+                                        <input type="hidden" name="club_template_enrollment_field_id" value="[% f.id | html %]" />
+                                        <label for="enrollment-field-name-[% f.id | html %]">Name:</label>
+                                        <input name="club_template_enrollment_field_name" id="enrollment-field-name-[% f.id | html %]" value="[% f.name | html %]" size="40" />
                                     </li>
 
                                     <li>
-                                        <label for="enrollment-field-description-[% f.id %]">Description:</label>
-                                        <input name="club_template_enrollment_field_description" id="enrollment-field-description-[% f.id %]" value="[% f.description %]" size="40" />
+                                        <label for="enrollment-field-description-[% f.id | html %]">Description:</label>
+                                        <input name="club_template_enrollment_field_description" id="enrollment-field-description-[% f.id | html %]" value="[% f.description | html %]" size="40" />
                                     </li>
 
                                     <li>
-                                        <label for="enrollment-field-authorised-value-category-[% f.id %]">Authorised value category:</label>
-                                        <select name="club_template_enrollment_field_authorised_value_category" id="enrollment-field-authorised-value-category-[% f.id %]">
+                                        <label for="enrollment-field-authorised-value-category-[% f.id | html %]">Authorised value category:</label>
+                                        <select name="club_template_enrollment_field_authorised_value_category" id="enrollment-field-authorised-value-category-[% f.id | html %]">
                                             <option value=""></option>
                                             [% PROCESS options_for_authorised_value_categories authorised_value_categories => AuthorisedValues.GetCategories( selected => f.authorised_value_category) %]
                                         </select>
                                     </li>
 
                                     <li>
-                                        <label for="enrollment-field-delete-[% f.id %]">Delete field:</label>
-                                        <input type="checkbox" name="club_template_enrollment_field_delete" id="enrollment-field-delete-[% f.id %]" value="[% f.id %]" />
+                                        <label for="enrollment-field-delete-[% f.id | html %]">Delete field:</label>
+                                        <input type="checkbox" name="club_template_enrollment_field_delete" id="enrollment-field-delete-[% f.id | html %]" value="[% f.id | html %]" />
                                     </li>
                                 </ol>
                             </div>
                 </fieldset>
 
                 <fieldset class="action">
-                    <input type="hidden" name="id" value="[% club_template.id %]" />
+                    <input type="hidden" name="id" value="[% club_template.id | html %]" />
                     <input type="submit" value="Save" />
                     <a href="clubs.pl" class="cancel">Cancel</a>
                 </fieldset>
index a1b4ad8..44773bb 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patron search</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="common_patron_search" class="common">
                 <ol>
                     <li>
                         <label for="searchmember_filter">Search:</label>
-                        <input type="text" id="searchmember_filter" value="[% searchmember %]"/>
+                        <input type="text" id="searchmember_filter" value="[% searchmember | html %]"/>
                     </li>
                     <li>
                         <label for="categorycode_filter">Category:</label>
                         <select id="categorycode_filter">
                             <option value="">Any</option>
                             [% FOREACH category IN categories %]
-                                <option value="[% category.categorycode %]">[% category.description %]</option>
+                                <option value="[% category.categorycode | html %]">[% category.description | html %]</option>
                             [% END %]
                         </select>
                     </li>
@@ -37,7 +38,7 @@
                                 <option value="">Any</option>
                             [% END %]
                             [% FOREACH l IN libraries %]
-                                <option value="[% l.branchcode %]">[% l.branchname %]</option>
+                                <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
                             [% END %]
                         </select>
                     </li>
@@ -55,7 +56,7 @@
         <div class="browse">
             Browse by last name:
             [% FOREACH letter IN alphabet.split(' ') %]
-                <a href="#" class="filterByLetter">[% letter %]</a>
+                <a href="#" class="filterByLetter">[% letter | html %]</a>
             [% END %]
         </div>
 
                         'value': 'branches.branchname'
                     },{
                         'name': 'template_path',
-                        'value': '[% json_template %]',
+                        'value': '[% json_template | html %]',
                     },{
                         'name': 'selection_type',
-                        'value': '[% selection_type %]',
+                        'value': '[% selection_type | html %]',
                     }
                     [% IF patrons_with_acq_perm_only %]
                     ,{
                         [% ELSIF column == 'address' %]
                             { 'mDataProp': 'dt_address', 'bSortable': false }
                         [% ELSE %]
-                            { 'mDataProp': 'dt_[% column %]' }
+                            { 'mDataProp': 'dt_[% column | html %]' }
                         [% END %]
                         [% UNLESS loop.last %],[% END %]
                     [% END %]
                     'bPaginate': false,
                 [% ELSE %]
                     'sPaginationType': 'full_numbers',
-                    "iDisplayLength": [% Koha.Preference('PatronsPerPage') %],
+                    "iDisplayLength": [% Koha.Preference('PatronsPerPage') | html %],
                 [% END %]
-                'aaSorting': [[[% aaSorting || 0 %], 'asc']],
+                'aaSorting': [[[% aaSorting || 0 | html %], 'asc']],
                 'bFilter': false,
                 'bProcessing': true,
             }));
index 7cdc9af..24c1cac 100644 (file)
@@ -7,7 +7,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Add reserves for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]">[% course.course_name %]</a></i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Add reserves for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]">[% course.course_name | html %]</a></i></div>
 
 <div class="main container-fluid">
     <div class="row">
 
         [% IF ERROR_ITEM_NOT_FOUND %]
             [% IF UNKNOWN_BARCODE %]
-                <div class="dialog alert">No item found with barcode [% UNKNOWN_BARCODE %]</div>
+                <div class="dialog alert">No item found with barcode [% UNKNOWN_BARCODE | html %]</div>
             [% ELSE %]
                  <div class="dialog alert">No item found</div>
             [% END %]
         [% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
-            <input type="hidden" name="course_id" value="[% course.course_id %]" />
+            <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
             <input type="hidden" name="action" value="lookup" />
 
             <fieldset class="rows">
@@ -38,7 +38,7 @@
             <fieldset class="action">
                 <input type="submit" value="Submit" class="submit" />
 
-                <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]" class="cancel">Cancel</a>
+                <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]" class="cancel">Cancel</a>
             </fieldset>
         </form>
     </div>
index 9389d57..02a531c 100644 (file)
@@ -9,27 +9,27 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Reserve <i><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.title %]</a></i> for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]">[% course.course_name %]</a></i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Reserve <i><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.title | html %]</a></i> for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]">[% course.course_name | html %]</a></i></div>
 
 <div class="main container-fluid">
     <div class="row">
         <div class="col-md-8 col-md-offset-2">
 
         [% IF course_reserve %]<div class="dialog message" id="already_on_reserve_this">This course already has this item on reserve.</div>[% END %]
-        [% IF course_item %]<div class="dialog message" id="already_on_reserve">Number of courses reserving this item: [% course_item.course_reserves.size %]</div>[% END %]
+        [% IF course_item %]<div class="dialog message" id="already_on_reserve">Number of courses reserving this item: [% course_item.course_reserves.size | html %]</div>[% END %]
 
         <form method="post" action="/cgi-bin/koha/course_reserves/add_items.pl">
-            <input type="hidden" name="course_id" value="[% course.course_id %]" />
-            <input type="hidden" name="return" value="[% return %]" />
+            <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
+            <input type="hidden" name="return" value="[% return | html %]" />
             <input type="hidden" name="action" value="add" />
 
             <fieldset class="rows">
-                <legend>Add <i>[% biblio.title %]</i> to <i>[% course.course_name %]</i></legend>
+                <legend>Add <i>[% biblio.title | html %]</i> to <i>[% course.course_name | html %]</i></legend>
                 <ol>
                     <li>
                         <span class="label">Barcode:</span>
-                        <span id="barcode">[% item.barcode %]</span>
-                        <input type="hidden" name="itemnumber" value="[% item.itemnumber %]" />
+                        <span id="barcode">[% item.barcode | html %]</span>
+                        <input type="hidden" name="itemnumber" value="[% item.itemnumber | html %]" />
                     </li>
 
                     [% IF item_level_itypes %]
@@ -40,9 +40,9 @@
 
                             [% FOREACH it IN itypes %]
                                 [% IF course_item.itype && ( ( course.enabled == 'yes' && it.itemtype == item.itype ) || ( course.enabled == 'no' && it.itemtype == course_item.itype ) ) %]
-                                    <option value="[% it.itemtype %]" selected="selected">[% it.description %]</option>
+                                    <option value="[% it.itemtype | html %]" selected="selected">[% it.description | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% it.itemtype %]">[% it.description %]</option>
+                                    <option value="[% it.itemtype | html %]">[% it.description | html %]</option>
                                 [% END %]
                             [% END %]
                         </select>
@@ -56,9 +56,9 @@
 
                             [% FOREACH c IN ccodes %]
                                 [% IF course_item.ccode && ( ( course.enabled == 'yes' && c.authorised_value == item.ccode ) || ( course.enabled == 'no' && c.authorised_value == course_item.ccode ) ) %]
-                                    <option value="[% c.authorised_value %]" selected="selected">[% c.lib %]</option>
+                                    <option value="[% c.authorised_value | html %]" selected="selected">[% c.lib | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% c.authorised_value %]">[% c.lib %]</option>
+                                    <option value="[% c.authorised_value | html %]">[% c.lib | html %]</option>
                                 [% END %]
                             [% END %]
                         </select>
@@ -71,9 +71,9 @@
 
                             [% FOREACH s IN locations %]
                                 [% IF course_item.location && ( ( course.enabled == 'yes' && s.authorised_value == item.location ) || ( course.enabled == 'no' && s.authorised_value == course_item.location ) ) %]
-                                    <option value="[% s.authorised_value %]" selected="selected">[% s.lib %]</option>
+                                    <option value="[% s.authorised_value | html %]" selected="selected">[% s.lib | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% s.authorised_value %]">[% s.lib %]</option>
+                                    <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
                                 [% END %]
                             [% END %]
                         </select>
@@ -85,9 +85,9 @@
                             <option value="">LEAVE UNCHANGED</option>
                             [% FOREACH b IN Branches.all() %]
                                 [% IF course_item.holdingbranch && ( ( course.enabled == 'yes' && b.branchcode == item.holdingbranch ) || ( course.enabled == 'no' && b.branchcode == course_item.holdingbranch ) ) %]
-                                    <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                                    <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                                 [% ELSE %]
-                                    <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                    <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                                 [% END %]
                             [% END %]
                         </select>
 
                     <li>
                         <label for="staff_note">Staff note:</label>
-                        <textarea name="staff_note" id="staff_note">[% course_reserve.staff_note %]</textarea>
+                        <textarea name="staff_note" id="staff_note">[% course_reserve.staff_note | html %]</textarea>
                     </li>
 
                     <li>
                         <label for="public_note">Public note:</label>
-                        <textarea name="public_note" id="public_note">[% course_reserve.public_note %]</textarea>
+                        <textarea name="public_note" id="public_note">[% course_reserve.public_note | html %]</textarea>
                     </li>
 
                 </ol>
             <fieldset class="action">
                 <input type="submit" id="submit" value="Save" class="submit focus" />
 
-                <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]" class="cancel">Cancel</a>
+                <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]" class="cancel">Cancel</a>
             </fieldset>
         </form>
     </div>
index 7326485..bc1fa9c 100644 (file)
@@ -11,7 +11,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Add reserves for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]">[% course.course_name %]</a></i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Add reserves for <i><a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]">[% course.course_name | html %]</a></i></div>
 
 <div class="main container-fluid">
     <div class="row">
@@ -22,7 +22,7 @@
 
         [% IF action == 'display_form' %]
             <form method="post" action="/cgi-bin/koha/course_reserves/batch_add_items.pl">
-                <input type="hidden" name="course_id" value="[% course.course_id %]" />
+                <input type="hidden" name="course_id" value="[% course.course_id | html %]" />
                 <input type="hidden" name="action" value="add" />
 
                 <fieldset class="rows">
@@ -39,7 +39,7 @@
                                 <option value="">LEAVE UNCHANGED</option>
 
                                 [% FOREACH it IN ItemTypes.Get() %]
-                                    <option value="[% it.itemtype %]">[% it.description %]</option>
+                                    <option value="[% it.itemtype | html %]">[% it.description | html %]</option>
                                 [% END %]
                             </select>
                         </li>
@@ -50,7 +50,7 @@
                             <select id="ccode" name="ccode">
                                 <option value="">LEAVE UNCHANGED</option>
                                 [% FOREACH c IN AuthorisedValues.Get('CCODE') %]
-                                    <option value="[% c.authorised_value %]">[% c.lib %]</option>
+                                    <option value="[% c.authorised_value | html %]">[% c.lib | html %]</option>
                                 [% END %]
                             </select>
                         </li>
@@ -60,7 +60,7 @@
                             <select id="location" name="location">
                                 <option value="">LEAVE UNCHANGED</option>
                                 [% FOREACH s IN AuthorisedValues.Get('LOC') %]
-                                    <option value="[% s.authorised_value %]">[% s.lib %]</option>
+                                    <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
                                 [% END %]
                             </select>
                         </li>
                             <select id="holdingbranch" name="holdingbranch">
                                 <option value="">LEAVE UNCHANGED</option>
                                 [% FOREACH b IN Branches.all() %]
-                                    <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                    <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                                 [% END %]
                             </select>
                         </li>
 
                         <li>
                             <label for="staff_note">Staff note:</label>
-                            <textarea name="staff_note" id="staff_note">[% course_reserve.staff_note %]</textarea>
+                            <textarea name="staff_note" id="staff_note">[% course_reserve.staff_note | html %]</textarea>
                         </li>
 
                         <li>
                             <label for="public_note">Public note:</label>
-                            <textarea name="public_note" id="public_note">[% course_reserve.public_note %]</textarea>
+                            <textarea name="public_note" id="public_note">[% course_reserve.public_note | html %]</textarea>
                         </li>
                     </ol>
                 </fieldset>
@@ -94,7 +94,7 @@
                 <fieldset class="action">
                     <input type="submit" value="Submit" class="submit" />
 
-                    <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id %]" class="cancel">Cancel</a>
+                    <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course.course_id | html %]" class="cancel">Cancel</a>
                 </fieldset>
             </form>
         [% END %]
                 <p>The following items were added or updated:</p>
                 <ul>
                     [% FOREACH i IN items_added %]
-                        <li>[% i.biblio.title %] ( [% i.barcode %] )</li>
+                        <li>[% i.biblio.title | html %] ( [% i.barcode | html %] )</li>
                     [% END %]
                 </ul>
             [% ELSE %]
                 <p>The following invalid barcodes were skipped:</p>
                 <ul>
                     [% FOREACH b IN invalid_barcodes %]
-                        <li>[% b %]</li>
+                        <li>[% b | html %]</li>
                     [% END %]
                 </ul>
             [% END %]
 
             <p>
-                <a class='btn btn-default' href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course_id %]">View course</a>
+                <a class='btn btn-default' href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course_id | html %]">View course</a>
             </p>
         [% END %]
     </div>
index 7799a9c..f43eb90 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE ItemTypes %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Course reserves &rsaquo; Course details for [% course.course_name %]</title>
+<title>Koha &rsaquo; Course reserves &rsaquo; Course details for [% course.course_name | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="courses_course_details" class="course">
@@ -15,7 +16,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Course details for <i>[% course.course_name %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; Course details for <i>[% course.course_name | html %]</i></div>
 
     <div class="main container-fluid">
         <div class="row">
             [% IF CAN_user_coursereserves_add_reserves OR CAN_user_coursereserves_manage_courses OR CAN_user_coursereserves_manage_courses %]
             <div id="toolbar">
                 [% IF CAN_user_coursereserves_add_reserves %]
-                    <a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/add_items.pl?course_id=[% course.course_id %]"><i class="fa fa-plus"></i> Add reserves</a>
-                    <a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/batch_add_items.pl?course_id=[% course.course_id %]"><i class="fa fa-plus"></i> Batch add reserves</a>
+                    <a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/add_items.pl?course_id=[% course.course_id | html %]"><i class="fa fa-plus"></i> Add reserves</a>
+                    <a class="btn btn-default btn-sm" id="add_items" href="/cgi-bin/koha/course_reserves/batch_add_items.pl?course_id=[% course.course_id | html %]"><i class="fa fa-plus"></i> Batch add reserves</a>
                 [% END %]
                 [% IF ( CAN_user_coursereserves_manage_courses ) %]
-                    <a class="btn btn-default btn-sm" id="edit_course" href="/cgi-bin/koha/course_reserves/course.pl?course_id=[% course.course_id %]"><i class="fa fa-pencil"></i> Edit course</a>
+                    <a class="btn btn-default btn-sm" id="edit_course" href="/cgi-bin/koha/course_reserves/course.pl?course_id=[% course.course_id | html %]"><i class="fa fa-pencil"></i> Edit course</a>
                 [% END %]
                 [% IF ( CAN_user_coursereserves_manage_courses ) %]
-                    <a class="btn btn-default btn-sm" id="delete_course" href="/cgi-bin/koha/course_reserves/mod_course.pl?course_id=[% course.course_id %]&amp;action=del"><i class="fa fa-trash"></i> Delete course</a>
+                    <a class="btn btn-default btn-sm" id="delete_course" href="/cgi-bin/koha/course_reserves/mod_course.pl?course_id=[% course.course_id | html %]&amp;action=del"><i class="fa fa-trash"></i> Delete course</a>
                 [% END %]
             </div><!-- /toolbar -->
             [% END %]
 
             <div class="rows">
               <ol>
-                <li><span class="label">Course name</span> [% course.course_name %]</li>
-                <li><span class="label">Term</span> [% AuthorisedValues.GetByCode( 'TERM', course.term ) %]</li>
-                <li><span class="label">Department</span> [% AuthorisedValues.GetByCode( 'DEPARTMENT', course.department ) %]</li>
-                <li><span class="label">Course number</span> [% course.course_number %]</li>
-                <li><span class="label">Section</span> [% course.section %]</li>
-                <li><span class="label">Instructors</span> [% FOREACH i IN course.instructors %]<div class="instructor"><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% i.borrowernumber %]">[% i.firstname %] [% i.surname %]</a></div>[% END %]</li>
-                <li><span class="label">Staff note</span> [% course.staff_note %]</li>
-                <li><span class="label">Public note</span> [% course.public_note %]</li>
-                <li><span class="label">Student count</span> [% course.students_count %]</li>
+                <li><span class="label">Course name</span> [% course.course_name | html %]</li>
+                <li><span class="label">Term</span> [% AuthorisedValues.GetByCode( 'TERM', course.term ) | html %]</li>
+                <li><span class="label">Department</span> [% AuthorisedValues.GetByCode( 'DEPARTMENT', course.department ) | html %]</li>
+                <li><span class="label">Course number</span> [% course.course_number | html %]</li>
+                <li><span class="label">Section</span> [% course.section | html %]</li>
+                <li><span class="label">Instructors</span> [% FOREACH i IN course.instructors %]<div class="instructor"><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% i.borrowernumber | html %]">[% i.firstname | html %] [% i.surname | html %]</a></div>[% END %]</li>
+                <li><span class="label">Staff note</span> [% course.staff_note | html %]</li>
+                <li><span class="label">Public note</span> [% course.public_note | html %]</li>
+                <li><span class="label">Student count</span> [% course.students_count | html %]</li>
                 <li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li>
               </ol>
             </div>
                 <tbody>
                     [% FOREACH cr IN course_reserves %]
                         <tr>
-                            <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cr.biblio.biblionumber %]">[% cr.biblio.title %]</a></td>
-                            <td>[% cr.biblio.author %]</td>
-                            <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% cr.item.itemnumber %]&amp;biblionumber=[% cr.biblio.biblionumber %]&amp;bi=[% cr.biblioitem.biblioitemnumber %]">[% cr.item.barcode %]</a></td>
-                            <td>[% cr.item.itemcallnumber %]</td>
+                            <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% cr.biblio.biblionumber | html %]">[% cr.biblio.title | html %]</a></td>
+                            <td>[% cr.biblio.author | html %]</td>
+                            <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% cr.item.itemnumber | html %]&amp;biblionumber=[% cr.biblio.biblionumber | html %]&amp;bi=[% cr.biblioitem.biblioitemnumber | html %]">[% cr.item.barcode | html %]</a></td>
+                            <td>[% cr.item.itemcallnumber | html %]</td>
                             [% IF item_level_itypes %]
                             <td>
                                 [% IF cr.course_item.itype %]
                                     [% IF cr.course_item.enabled == 'yes' %]
-                                        [% ItemTypes.GetDescription( cr.item.itype ) %]
+                                        [% ItemTypes.GetDescription( cr.item.itype ) | html %]
                                     [% ELSE %]
-                                        [% ItemTypes.GetDescription( cr.course_item.itype ) %]
+                                        [% ItemTypes.GetDescription( cr.course_item.itype ) | html %]
                                     [% END %]
                                 [% ELSE %]
                                      <i>Unchanged</i>
                                      [% IF cr.item.itype %]
-                                         ([% ItemTypes.GetDescription( cr.item.itype ) %])
+                                         ([% ItemTypes.GetDescription( cr.item.itype ) | html %])
                                      [% END %]
                                 [% END %]
                             </td>
                             <td>
                                  [% IF cr.course_item.ccode %]
                                      [% IF cr.course_item.enabled == 'yes' %]
-                                          [% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) %]
+                                          [% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) | html %]
                                      [% ELSE %]
-                                         [% AuthorisedValues.GetByCode( 'CCODE', cr.course_item.ccode ) %]
+                                         [% AuthorisedValues.GetByCode( 'CCODE', cr.course_item.ccode ) | html %]
                                      [% END %]
                                  [% ELSE %]
                                      <i>Unchanged</i>
                                      [% IF cr.item.ccode %]
-                                         ([% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) %])
+                                         ([% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) | html %])
                                      [% END %]
                                  [% END %]
                             </td>
                             <td>
                                 [% IF cr.course_item.location %]
                                      [% IF cr.course_item.enabled == 'yes' %]
-                                         [% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) %]
+                                         [% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) | html %]
                                     [% ELSE %]
-                                        [% AuthorisedValues.GetByCode( 'LOC', cr.course_item.location ) %]
+                                        [% AuthorisedValues.GetByCode( 'LOC', cr.course_item.location ) | html %]
                                     [% END %]
                                 [% ELSE %]
                                     <i>Unchanged</i>
                                     [% IF cr.item.location %]
-                                        ([% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) %])
+                                        ([% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) | html %])
                                     [% END %]
                                 [% END %]
                             </td>
                             <td>
                                 [% IF cr.course_item.holdingbranch %]
                                     [% IF cr.course_item.enabled == 'yes' %]
-                                        [% Branches.GetName( cr.item.holdingbranch ) %]
+                                        [% Branches.GetName( cr.item.holdingbranch ) | html %]
                                     [% ELSE %]
-                                        [% Branches.GetName( cr.course_item.holdingbranch ) %]
+                                        [% Branches.GetName( cr.course_item.holdingbranch ) | html %]
                                     [% END %]
                                 [% ELSE %]
                                     <i>Unchanged</i>
                                     [% IF cr.item.holdingbranch %]
-                                        ([% Branches.GetName( cr.item.holdingbranch ) %])
+                                        ([% Branches.GetName( cr.item.holdingbranch ) | html %])
                                     [% END %]
                                 [% END %]
                             </td>
                             <td>[% IF (cr.staff_note) %]
-                                    [% cr.staff_note %]
+                                    [% cr.staff_note | html %]
                                 [% ELSIF (cr.item.itemnotes_nonpublic) %]
-                                    [% cr.item.itemnotes_nonpublic %]
+                                    [% cr.item.itemnotes_nonpublic | html %]
                                 [% END %]
                             </td>
                             <td>[% IF (cr.public_note) %]
-                                    [% cr.public_note %]
+                                    [% cr.public_note | html %]
                                 [% ELSIF (cr.item.itemnotes) %]
-                                    [% cr.item.itemnotes %]
+                                    [% cr.item.itemnotes | html %]
                                 [% END %]
                             </td>
 
                             <td>
                                 [% IF (cr.item.uri) %]
-                                    <a href="[% cr.item.uri %]">Item URI</a>
+                                    <a href="[% cr.item.uri | html %]">Item URI</a>
                                 [% ELSIF (cr.biblioitem.url) %]
-                                    <a href="[% cr.biblioitem.url %]">Record URL</a>
+                                    <a href="[% cr.biblioitem.url | html %]">Record URL</a>
                                 [% END %]
                             </td>
 
                                 [% FOREACH c IN cr.courses %]
                                     [% UNLESS cr.course_id == c.course_id %]
                                         <p>
-                                            <a href="course-details.pl?course_id=[% c.course_id %]">
-                                                [% c.course_name %]
-                                                [% IF c.section %] [% c.section %] [% END %]
-                                                [% IF c.term %] [% AuthorisedValues.GetByCode( 'TERM', c.term ) %] [% END %]
+                                            <a href="course-details.pl?course_id=[% c.course_id | html %]">
+                                                [% c.course_name | html %]
+                                                [% IF c.section %] [% c.section | html %] [% END %]
+                                                [% IF c.term %] [% AuthorisedValues.GetByCode( 'TERM', c.term ) | html %] [% END %]
                                             </a>
                                         </p>
                                     [% END %]
                             [% IF CAN_user_coursereserves_add_reserves || CAN_user_coursereserves_delete_reserves %]
                                 <td class="actions">
                                     [% IF CAN_user_coursereserves_add_reserves %]
-                                        <a class="btn btn-default btn-xs" href="add_items.pl?course_id=[% course.course_id %]&amp;itemnumber=[% cr.item.itemnumber %]&amp;action=lookup&amp;return=[% course.course_id %]"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="add_items.pl?course_id=[% course.course_id | html %]&amp;itemnumber=[% cr.item.itemnumber | html %]&amp;action=lookup&amp;return=[% course.course_id | html %]"><i class="fa fa-pencil"></i> Edit</a>
                                     [% END %]
 
                                     [% IF CAN_user_coursereserves_delete_reserves %]
                                         [% IF cr.item.onloan %]
                                             <a class="btn btn-default btn-xs disabled checkedout delete_item" href="#" data-toggle="tooltip" data-placement="left" title="This item is checked out">
                                         [% ELSE %]
-                                            <a class="btn btn-default btn-xs delete_item" href="course-details.pl?course_id=[% course.course_id %]&amp;action=del_reserve&amp;cr_id=[% cr.cr_id %]">
+                                            <a class="btn btn-default btn-xs delete_item" href="course-details.pl?course_id=[% course.course_id | html %]&amp;action=del_reserve&amp;cr_id=[% cr.cr_id | html %]">
                                         [% END %]
                                         <i class="fa fa-trash"></i> Remove</a>
                                     [% END %]
             $("#delete_course").click(function(){
                 [% SET count = course_reserves.size || 0 %]
                 [% IF count == 1 %]
-                    return confirmDelete(_("Are you sure you want to delete this course? There is %s attached item.").format([% count %]) );
+                    return confirmDelete(_("Are you sure you want to delete this course? There is %s attached item.").format([% count | html %]) );
                 [% ELSIF count > 1 %]
-                    return confirmDelete(_("Are you sure you want to delete this course? There are %s attached items.").format([% count %]) );
+                    return confirmDelete(_("Are you sure you want to delete this course? There are %s attached items.").format([% count | html %]) );
                 [% ELSE %]
                     return confirmDelete(_("Are you sure you want to delete this course?"));
                 [% END %]
index 2a8528b..b1887b6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
@@ -5,7 +6,7 @@
 <title>Koha &rsaquo; Course reserves</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="courses_course_reserves" class="course">
                         <tbody>
                             [% FOREACH c IN courses %]
                                 <tr>
-                                    <td><a href="course-details.pl?course_id=[% c.course_id %]">[% c.course_name %]</a></td>
-                                    <td>[% AuthorisedValues.GetByCode( 'DEPARTMENT', c.department ) %]</td>
-                                    <td>[% c.course_number %]</td>
-                                    <td>[% c.section %]</td>
-                                    <td>[% AuthorisedValues.GetByCode( 'TERM' c.term ) %]</td>
+                                    <td><a href="course-details.pl?course_id=[% c.course_id | html %]">[% c.course_name | html %]</a></td>
+                                    <td>[% AuthorisedValues.GetByCode( 'DEPARTMENT', c.department ) | html %]</td>
+                                    <td>[% c.course_number | html %]</td>
+                                    <td>[% c.section | html %]</td>
+                                    <td>[% AuthorisedValues.GetByCode( 'TERM' c.term ) | html %]</td>
                                     <td>
                                         [% FOREACH i IN c.instructors %]
-                                            <div class="instructor"><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% i.borrowernumber %]">[% i.firstname %] [% i.surname %]</a></div>
+                                            <div class="instructor"><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% i.borrowernumber | html %]">[% i.firstname | html %] [% i.surname | html %]</a></div>
                                         [% END %]
                                     </td>
-                                    <td>[% c.staff_note %]</td>
-                                    <td>[% c.public_note %]</td>
-                                    <td>[% c.students_count %]</td>
+                                    <td>[% c.staff_note | html %]</td>
+                                    <td>[% c.public_note | html %]</td>
+                                    <td>[% c.students_count | html %]</td>
                                     <td>
                                         [% IF c.enabled == 'yes' %]
                                             Yes
index a0978c9..e2f25b4 100644 (file)
@@ -1,6 +1,6 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Course reserves &rsaquo; [% IF course_name %] Edit [% course_name %] [% ELSE %] New course [% END %]</title>
+<title>Koha &rsaquo; Course reserves &rsaquo; [% IF course_name %] Edit [% course_name | html %] [% ELSE %] New course [% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -9,7 +9,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; [% IF course_name %] Edit <i>[% course_name %]</i> [% ELSE %] New course [% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/course_reserves/course-reserves.pl">Course reserves</a> &rsaquo; [% IF course_name %] Edit <i>[% course_name | html %]</i> [% ELSE %] New course [% END %]</div>
 
 [% IF ( departments ) %]
 
@@ -18,7 +18,7 @@
             <div class="col-md-8 col-md-offset-2">
 
             <form method="post" action="/cgi-bin/koha/course_reserves/mod_course.pl" class="validated">
-                [% IF course_id %]<input type="hidden" name="course_id" value="[% course_id %]" />[% END %]
+                [% IF course_id %]<input type="hidden" name="course_id" value="[% course_id | html %]" />[% END %]
                 <fieldset class="rows">
                     <legend>[% IF course_id %]Edit course[% ELSE %]Create course[% END %]</legend>
                     <ol>
@@ -29,9 +29,9 @@
 
                                 [% FOREACH d IN departments %]
                                     [% IF d.authorised_value == department %]
-                                        <option value="[% d.authorised_value %]" selected="selected">[% d.lib %]</option>
+                                        <option value="[% d.authorised_value | html %]" selected="selected">[% d.lib | html %]</option>
                                     [% ELSE %]
-                                        <option value="[% d.authorised_value %]">[% d.lib %]</option>
+                                        <option value="[% d.authorised_value | html %]">[% d.lib | html %]</option>
                                     [% END %]
                                 [% END %]
                             </select>
 
                         <li>
                             <label class="required" for="course_number">Course number:</label>
-                            <input id="course_number" name="course_number" type="text" value="[% course_number %]" required="required" class="required" />
+                            <input id="course_number" name="course_number" type="text" value="[% course_number | html %]" required="required" class="required" />
                             <span class="required">Required</span>
                         </li>
 
                         <li>
                             <label for="section">Section:</label>
-                            <input id="section" name="section" type="text" value="[% section %]"/>
+                            <input id="section" name="section" type="text" value="[% section | html %]"/>
                         </li>
 
                         <li>
                             <label class="required" for="course_name">Course name:</label>
-                            <input id="course_name" name="course_name" type="text" value="[% course_name %]" required="required" class="required" />
+                            <input id="course_name" name="course_name" type="text" value="[% course_name | html %]" required="required" class="required" />
                             <span class="required">Required</span>
                         </li>
 
@@ -63,9 +63,9 @@
 
                                     [% FOREACH t IN terms %]
                                         [% IF t.authorised_value == term %]
-                                            <option value="[% t.authorised_value %]" selected="selected">[% t.lib %]</option>
+                                            <option value="[% t.authorised_value | html %]" selected="selected">[% t.lib | html %]</option>
                                         [% ELSE %]
-                                            <option value="[% t.authorised_value %]">[% t.lib %]</option>
+                                            <option value="[% t.authorised_value | html %]">[% t.lib | html %]</option>
                                         [% END %]
                                     [% END %]
                                 </select>
@@ -79,8 +79,8 @@
                             <span class="label">Instructors:</span>
 
                             <fieldset id="course_instructors">
-                                 <div id="instructors">[% FOREACH i IN instructors %]<div id="borrower_[% i.cardnumber %]">[% i.surname %], [% i.firstname %] ( <a href="#" class="removeInstructor"> Remove </a> )
-                                             <input type='hidden' name='instructors' value='[% i.cardnumber %]' /></div>[% END %]</div>
+                                 <div id="instructors">[% FOREACH i IN instructors %]<div id="borrower_[% i.cardnumber | html %]">[% i.surname | html %], [% i.firstname | html %] ( <a href="#" class="removeInstructor"> Remove </a> )
+                                             <input type='hidden' name='instructors' value='[% i.cardnumber | html %]' /></div>[% END %]</div>
                             </fieldset>
 
                             <fieldset>
                             </fieldset>
                         <li>
                             <label for="staff_note">Staff note:</label>
-                            <textarea name="staff_note" id="staff_note">[% staff_note %]</textarea>
+                            <textarea name="staff_note" id="staff_note">[% staff_note | html %]</textarea>
                         </li>
 
                         <li>
                             <label for="public_note">Public note:</label>
-                            <textarea name="public_note" id="public_note">[% public_note %]</textarea>
+                            <textarea name="public_note" id="public_note">[% public_note | html %]</textarea>
                         </li>
 
                         <li>
                             <label for="students_count">Number of students:</label>
-                            <input id="students_count" name="students_count" type="text" value="[% students_count %]" />
+                            <input id="students_count" name="students_count" type="text" value="[% students_count | html %]" />
                         </li>
 
                         <li>
                     <input type="submit" value="Save" class="submit" />
 
                     [% IF course_id %]
-                        <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course_id %]" class="cancel">Cancel</a>
+                        <a href="/cgi-bin/koha/course_reserves/course-details.pl?course_id=[% course_id | html %]" class="cancel">Cancel</a>
                     [% ELSE %]
                         <a href="/cgi-bin/koha/course_reserves/course-reserves.pl" class="cancel">Cancel</a>
                     [% END %]
index 4d1619c..5cbed4e 100644 (file)
@@ -1,13 +1,13 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Error [% errno %]</title>
+<title>Koha &rsaquo; Error [% errno | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
-<body id="err_[% errno %]" class="err">
+<body id="err_[% errno | html %]" class="err">
 
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; Error [% errno %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; Error [% errno | html %]</div>
 
 <div id="doc" class="yui-t7">
 
@@ -15,7 +15,7 @@
         <div id="yui-main">
         <div class="yui-b"><div class="yui-g">
     <h1>An error has occurred!</h1>
-    <h2><em>Error [% errno %]</em></h2>
+    <h2><em>Error [% errno | html %]</em></h2>
         <h3>This message may have been caused by any of the following reasons:</h3>
         <ul style="padding-bottom: 0.5em;">
             <li>You made use of an external link to an item that is no longer available</li>
@@ -26,7 +26,7 @@
         <h3>What's next?</h3>
         <ul style="margin-bottom: 1em; padding-bottom: 1em; border-bottom: 1px solid #CCC;">
             <li>Use top menu bar to navigate to another part of Koha.</li>
-            <li>To report a broken link or any other issue, please contact the Koha Administrator. <a href="mailto:[% admin %]">Send email</a></li>
+            <li>To report a broken link or any other issue, please contact the Koha Administrator. <a href="mailto:[% admin | html %]">Send email</a></li>
     </ul>
 </div>
 
index e9d2de5..5323b2b 100644 (file)
@@ -35,6 +35,6 @@
 
 <p>This tab provides a summary of Koha's release and development history.</p>
 
-<p><strong>See the full documentation for the About page in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/plugins.html#about-koha">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the About page in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/plugins.html#about-koha">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0e7f066..7fa6b67 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>First, set your Acquisitions System Preferences and Acquisitions Administration to match your library's workflow.</p>
 
-<p><strong>See the full documentation for Acquisitions in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Acquisitions in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a885a55..60a81ef 100644 (file)
@@ -19,6 +19,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 097fbcd..6fbeb14 100644 (file)
 
 <p>Clicking 'Print' below your order will generate a PDF for printing, which will have all of your library information followed by the items in your order.</p>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index c9903ec..dfb97c1 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>A basket group is simply a group of baskets. In some libraries, you have several staff members who create baskets, and, at the end of a period of time, someone then groups them together to send to the vendor in bulk. That said, it is possible to have one basket in a basket group if that's the workflow used in your library.</p>
 
-<p><strong>See the full documentation for Basket Groups in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket-group">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Basket Groups in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket-group">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7e850fd..f0a72e5 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>After creating your basket, you can edit the name of the basket, the billing place, delivery place, the notes and the contract you're ordering against.</p>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index cf2019e..31187ab 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>Clicking Advanced Search to the right of the search button will give you all of the order search options available.</p>
 
-<p><strong>See the full documentation for Acquisitions Searching in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#acquisition-searches">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Acquisitions Searching in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#acquisition-searches">manual</a> (online).</strong></p>
        
 [% INCLUDE 'help-bottom.inc' %]
index 7be0db5..1baea7c 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>A log of all messages sent and received via EDIFACT can be found under EDIFACT Messages.</p>
 
-<p><strong>See the full documentation for EDIFACT messages in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#edifact-messages">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for EDIFACT messages in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#edifact-messages">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index cf2019e..31187ab 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>Clicking Advanced Search to the right of the search button will give you all of the order search options available.</p>
 
-<p><strong>See the full documentation for Acquisitions Searching in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#acquisition-searches">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Acquisitions Searching in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#acquisition-searches">manual</a> (online).</strong></p>
        
 [% INCLUDE 'help-bottom.inc' %]
index fa69d63..53ca275 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>From the results you can click the 'Details' link to see the full invoice or 'Close' to note that the invoice is closed/paid for.</p>
 
-<p><strong>See the full documentation for Invoices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#invoices">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Invoices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#invoices">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index fa69d63..53ca275 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>From the results you can click the 'Details' link to see the full invoice or 'Close' to note that the invoice is closed/paid for.</p>
 
-<p><strong>See the full documentation for Invoices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#invoices">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Invoices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#invoices">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 94dd723..3a0a32c 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>There is a default acquisitions claim letter. If you would rather use a different one, you can create that in the notices module and choose it from the menu above the list of late items.</p>
 
-<p><strong>See the full documentation for Claims and Late Orders in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#claims-late-orders">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Claims and Late Orders in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#claims-late-orders">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index e624728..1f53a26 100644 (file)
@@ -9,6 +9,6 @@
        <li>All of the details associated with the item will already be listed under 'Catalog details'</li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index c50d31b..f384a15 100644 (file)
@@ -8,6 +8,6 @@
     <li>You will be presented with an empty form to fill in all of the necessary details about the item.</li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 288f324..4a305de 100644 (file)
@@ -12,6 +12,6 @@
     <li>Clicking 'Order' will bring the subscription info in to the order form without an 'Add item' section since you are just ordering a subscription and an item isn't needed</li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2f59f89..49fb0f0 100644 (file)
@@ -14,6 +14,6 @@
     <li>Orders added to the basket in this way will notify the patron via email that their suggestion has been ordered and will update the patron's 'My purchase suggestions' page in the OPAC.</li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 322ffbb..1b26711 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>You will also see that the item is received and/or cancelled if you view the basket.</p>
 
-<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 322ffbb..1b26711 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>You will also see that the item is received and/or cancelled if you view the basket.</p>
 
-<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 322ffbb..1b26711 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>You will also see that the item is received and/or cancelled if you view the basket.</p>
 
-<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Receiving Orders in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#receiving-orders">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 89e4d21..0e91a23 100644 (file)
@@ -51,6 +51,6 @@
 
 <p>If the vendor has no baskets attached to it, a 'Delete' button will also be visible, allowing the vendor to be deleted.</p>
 
-<p><strong>See the full documentation for managing Vendors in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#vendors">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for managing Vendors in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#vendors">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6ad846d..21ea51b 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>The Uncertain Prices page is independent of the basket. It is linked to the vendor so you will see all items on order with uncertain prices for that vendor.</p>
 
-<p><strong>See the full documentation for Uncertain prices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Uncertain prices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0ba6965..e595b26 100644 (file)
@@ -14,6 +14,6 @@
     <li>In the order form that pops up, you will not be able to edit the catalog details</li>
 </ul>
 
-<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Ordering in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#create-a-basket">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6a9229b..0cff143 100644 (file)
@@ -30,6 +30,6 @@
 
 <p>This list of parameters includes functionalities that didn't fit in any other category.  These items are optional and may not need to be altered, depending on your library's needs.</p>
 
-<p><strong>See the full documentation for system Administration in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for system Administration in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index f431105..135c42f 100644 (file)
@@ -83,6 +83,6 @@
 
 <p>Wait until the 'Report after moving unreceived orders from budget X to Y' displays. This will list the order numbers which have been impacted (grouped by fund) and detail if the unreceived order was moved or if there was a problem. For example, if the new budget does not contain a fund with the same name as the previous budget, the order will not be moved.</p>
 
-<p><strong>See the full documentation for Budgets in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#budgets">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Budgets in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#budgets">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 99d0d3c..dee5de2 100644 (file)
@@ -37,6 +37,6 @@
 
 <p>Funds with children will show with a small arrow to the left. Clicking that will show you the children funds.</p>
 
-<p><strong>See the full documentation for Funds in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#funds">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Funds in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#funds">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 17ef81f..d639fc8 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>It will also be an option when creating a basket.</p>
 
-<p><strong>See the full documentation for Vendor Contracts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#vendor-contracts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Vendor Contracts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#vendor-contracts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 1c5b26d..00f6aee 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>Once your changes are made, click the 'Save' button. If you would like to export your data as a CSV file you can do so by entering a file name in the 'Output to a file named' field and clicking the 'Output' button.</p>
 
-<p><strong>See the full documentation for Budget Planning in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#budget-planning">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Budget Planning in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#budget-planning">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 63ac7d2..6a7cce8 100644 (file)
@@ -63,6 +63,6 @@
     <li>To save your changes, click the 'Save Changes' button at the top of the screen.</li>
 </ul>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 338ef9a..dd1d38b 100644 (file)
@@ -19,6 +19,6 @@
 
 <p>To the right of the new field is a link to 'Subfields.' You will need to add subfields before this tag will appear in your MARC editor.</p>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d48eef2..c7d798f 100644 (file)
@@ -89,6 +89,6 @@
 </ul>
 </ul>
 
-<p><strong>See the full documentation for Authorized Values in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#authorized-values">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorized Values in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#authorized-values">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 396abb9..eb610ce 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>Koha comes with many of the necessary Authority frameworks already installed.</p>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#authority-types">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 545dcc9..ec4a4a7 100644 (file)
 
 <p>Once your import is complete you will be brought to the framework edit tool where you can make any changes you need to the framework you imported.<p>
 
-<p><strong>See the full documentation for Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 3be5997..ff50a49 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>In the above example, Centerville library will allow patrons to return items from all libraries except Liberty and Franklin to their library.</p>
 
-<p><strong>See the full documentation for Library Transfer Limits in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#library-transfer-limits">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Library Transfer Limits in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#library-transfer-limits">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b0ea4fe..759965b 100644 (file)
@@ -77,6 +77,6 @@
 
 <p>Properties are then applied to libraries via the add or edit library form.</p>
 
-<p><strong>See the full documentation for Libraries &amp; Groups in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#libraries-&-groups">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Libraries &amp; Groups in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#libraries-&-groups">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a5ff232..7c8a589 100644 (file)
@@ -88,6 +88,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Patron Categories in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#patron-categories">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Categories in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#patron-categories">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 4fcd6e9..e063c25 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>If you change your MARC Bibliographic framework it's recommended that you run this tool to test for errors in your definition.</p>
 
-<p><strong>See the full documentation for the MARC Bibliographic Framework Test in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#marc-bibliographic-framework-test">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the MARC Bibliographic Framework Test in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#marc-bibliographic-framework-test">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 19f4cf2..76786a4 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>This will allow for easy entry of local cities into the patron record without risking the potential for typos or mistaken zip/postal codes.</p>
 
-<p><strong>See the full documentation for Cities and Towns in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#cities-and-towns">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Cities and Towns in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#cities-and-towns">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 184a0ae..1a4da29 100644 (file)
@@ -53,6 +53,6 @@
        <li>Choose an appropriate filing routine - dewey, generic or lcc</li>
 </ul>
 
-<p><strong>See the full documentation for Classification Sources in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#classification-sources">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Classification Sources in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#classification-sources">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 4239d45..f048e59 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>You can also toggle columns using the 'Show/Hide Columns' button in the top right of the page you altered the columns for.</p>
 
-<p><strong>See the full documentation for Columns settings in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#column-settings">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Columns settings in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#column-settings">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ac69549..5fbe108 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>The active currency is the main currency you use in your library. Your active currency will have a check mark in the 'Active' column. If you don't have an active currency you will see an error message telling you to choose an active currency.</p>
 
-<p><strong>See the full documentation for Currencies and Exchange Rates in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#currencies-and-exchange-rates">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Currencies and Exchange Rates in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#currencies-and-exchange-rates">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 8efb343..2f3a633 100644 (file)
@@ -17,6 +17,6 @@
 
 <p>If you want one plugin to take priority over another you simply drag it above the other.</p>
 
-<p><strong>See the full documentation for the Did you mean? feature in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#did-you-mean?">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Did you mean? feature in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#did-you-mean?">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 35cb2bd..ccf1a36 100644 (file)
@@ -4,7 +4,7 @@
 
 <p>From here you can set up the information needed to connect to your acquisitions vendors</p>
 
-<p style="color: #990000;">Note: Before you begin, you must set up at least one <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#add-a-vendor">Vendor in Acquisitions</a>.</p>
+<p style="color: #990000;">Note: Before you begin, you must set up at least one <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#add-a-vendor">Vendor in Acquisitions</a>.</p>
 
 <p>To add account information, click the 'New account' button.</p>
 
@@ -12,6 +12,6 @@
 
 <p>Each vendor will have one account.</p>
 
-<p><strong>See the full documentation for EDI accounts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#edi-accounts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for EDI accounts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#edi-accounts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 426c4e8..3ef7c9d 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>In the form that appears, enter the information provided by your vendor.</p>
 
-<p><strong>See the full documentation for Library EANs in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#library-eans">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Library EANs in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#library-eans">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0fb54a8..62f29fa 100644 (file)
@@ -20,6 +20,6 @@
 
 <p>Future developments will include additional keyword assigned fields.</p>
 
-<p><strong>See the full documentation for Keyword to MARC Mapping in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#keywords-to-marc-mapping">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Keyword to MARC Mapping in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#keywords-to-marc-mapping">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 3e14c4d..141aa5f 100644 (file)
@@ -19,6 +19,6 @@
     <li>By default all item types and all patrons are notified of check ins and check outs. To change this, click on the item type/patron category combination that you would like to stop notices for.</li>
 </ul>
 
-<p><strong>See the full documentation for Item Circulation Alerts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#item-circulation-alerts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Item Circulation Alerts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#item-circulation-alerts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 32b0d58..ba71913 100644 (file)
@@ -20,6 +20,6 @@
 
 <p>Once your new field is added it will be visible at the top of this page and on the item search page</p>
 
-<p><strong>See the full documentation for Item search fields in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#item-search-fields">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Item search fields in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#item-search-fields">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 53db4b9..aeb93d7 100644 (file)
@@ -57,6 +57,6 @@
 
 <p>You will not be able to delete item types that are being used by items within your system.</p>
 
-<p><strong>See the full documentation for Item Types in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#item-types">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Item Types in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#item-types">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index c0f87d6..c10b1e2 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>The tool now supports multiple mappings too for one Koha field. As an example, you can connect copyrightdate to 260$c as well as 264$c (the RDA equivalent). Since a record normally only contains only one of them, this one value will be found in copyrightdate. (Multiple values would be saved, separated by vertical bars.) Note that you cannot add/remove mappings for biblionumber, biblioitemnumber or itemnumber. You are not recommended to change them.</p>
 
-<p><strong>See the full documentation for Koha to MARC Mapping in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#koha-to-marc-mapping">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Koha to MARC Mapping in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#koha-to-marc-mapping">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 032b5a5..d7f979f 100644 (file)
    <li>To save your changes simply click the 'Save Changes' button at the top of the screen</li>
 </ul>
 
-<p><strong>See the full documentation for MARC Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for MARC Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6cc4c99..02af1d2 100644 (file)
@@ -20,6 +20,6 @@
 
 <p>To the right of the new field is a link to 'Subfields,' you will need to add subfields before this tag will appear in your MARC editor. The process of entering the settings for the new subfield is the same as those found in the editing subfields in frameworks section of the manual.</p>
 
-<p><strong>See the full documentation for MARC Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for MARC Frameworks in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#marc-bibliographic-frameworks">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 078ac68..5d89149 100644 (file)
@@ -46,6 +46,6 @@
    <li>Required Match checks: none (remove the blank one)</li>
 </ul>
 
-<p><strong>See the full documentation for Record Matching Rules in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#record-matching-rules">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Record Matching Rules in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#record-matching-rules">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index afd998e..16fd5a1 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>And it is case sensitive : a record having 999$9 = 'xxx' will not belong to a set where condition is 999$9 = 'XXX'.</p>
 
-<p><strong>See the full documentation for OAI Sets in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#oai-sets-configuration">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for OAI Sets in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#oai-sets-configuration">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 33f102c..d363a59 100644 (file)
@@ -29,6 +29,6 @@
 
 <p>Once you have configured all your sets, you have to build the sets. This is done by calling the script misc/migration_tools/build_oai_sets.pl.</p>
 
-<p><strong>See the full documentation for OAI Sets in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#oai-sets-configuration">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for OAI Sets in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#oai-sets-configuration">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 158910a..8e56c65 100644 (file)
@@ -71,6 +71,6 @@
 
 <p>You will be unable to delete an attribute if it's in use.</p>
 
-<p><strong>See the full documentation for Patron Attribute Types in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#patron-attribute-types">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Attribute Types in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#patron-attribute-types">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0b574fb..63520f2 100644 (file)
@@ -32,6 +32,6 @@
     <li><strong>Web Services:</strong> includes preferences related to services like OAI-PMH.</li>
 </ul>
        
-<p><strong>See the full documentation for System Preferences in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/systempreferences.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for System Preferences in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/systempreferences.html">manual</a> (online).</strong></p>
        
 [% INCLUDE 'help-bottom.inc' %]
index 0bf2d6c..aa5f8d0 100644 (file)
     <li>Item floats: The item will not be transferred from the library it was checked in at, instead it will remain there until transferred manually or checked in at another library</li>
 </ul>
 
-<p><strong>See the full documentation for Circulation and Fine Rules in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#circulation-and-fine-rules">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Circulation and Fine Rules in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#circulation-and-fine-rules">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 201ab7a..27c043f 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>Always contains <i>Version</i> preference, <strong>please do not change it manually.</strong>
 
-<p><strong>See the full documentation for System Preferences in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/systempreferences.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for System Preferences in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/systempreferences.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 793f17a..2ba8b36 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>After entering in your cost, hit 'Enter' on your keyboard or click the 'Save' button at the bottom of the matrix to save your changes.</p>
 
-<p><strong>See the full documentation for the Transport Cost Matrix in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#transport-cost-matrix">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Transport Cost Matrix in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#transport-cost-matrix">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d7578b7..9c73637 100644 (file)
@@ -99,6 +99,6 @@
        <li>LIBRARY OF CONGRESS NAME AUTHORITIES lx2.loc.gov:210 NAF</li>
        <li>LIBRARY OF CONGRESS SUBJECT AUTHORITIES lx2.loc.gov:210 SAF</li>
 </ul>
-<p><strong>See the full documentation for Z39.50/SRU Servers in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#z39.50/sru-servers">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Z39.50/SRU Servers in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#z39.50/sru-servers">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 5c57b3a..d8389a9 100644 (file)
@@ -14,7 +14,7 @@
 
 <p>If the authority has See Alsos in it you will see those broken out on the search results, clicking the linked headings will run a search for that heading instead.</p>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
 
 
 [% INCLUDE 'help-bottom.inc' %]
index 96f4cbd..579942a 100644 (file)
@@ -26,6 +26,6 @@
 
 <p>To delete an authority record you first must make sure it's not linked to any bibliographic records. If it is not used by any bibliographic records a 'Delete' link will appear to the right of the record on the search results and as a button that appears after clicking on the summary of the authority record.</p>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index f866957..910e571 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>If the authority has See Alsos in it you will see those broken out on the search results, clicking the linked headings will run a search for that heading instead.</p>
 
-<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#authorities">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 53df109..7a641ac 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>Once you have completed your selections click the 'merge' button. The primary record will now contain the data you chose for it and the second record will be deleted.</p>
 
-<p><strong>See the full documentation for Merging authorities in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#merging-authorities">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Merging authorities in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#merging-authorities">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 9412e2e..890f39b 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>In Koha the bibliographic record contains the main information related to the material. This includes things like the title, author, ISBN, etc. This information is stored in Koha in Marc (different flavors of Marc are supported in Koha). Once this information is saved, items or holdings can be attached.</p>
 
-<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#bibliographic-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#bibliographic-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 69e5dc8..bd5e0bb 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>Below the 'History' heading is a link to 'View item's checkout history,' clicking that will open up the item's history which will look slightly different from the bibliographic record's history page.</p>
 
-<p><strong>See the full documentation for Item Checkout History in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#item-specific-circulation-history">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Item Checkout History in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#item-specific-circulation-history">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index fce411b..bf1e6be 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>Using the search form that is presented you can find a list of specific items that can be output to the screen or to a CSV file. If your results are printed to the screen you will have the option to narrow your search further using filters at the top.</p>
 
-<p><strong>See the full documentation for Searching in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/searching.html#item-searching">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Searching in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/searching.html#item-searching">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ff07926..0311370 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>Below the 'History' heading is a link to 'View item's checkout history,' clicking that will open up the item's history which will look slightly different from the bibliographic record's history page.</p>
 
-<p><strong>See the full documentation for Item Records in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#item-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Item Records in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#item-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index cb16913..5cc8aba 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>From this page you will see your bibliographic search history and your authority search history.</p>
 
-<p><strong>See the full documentation for Search History in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/plugins.html#search-history">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Search History in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/plugins.html#search-history">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6377891..74297ec 100644 (file)
@@ -78,6 +78,6 @@
 <li>ctype:w Law reports and digests</li>
 <li>ctype:z Treaties</li></ul>
 
-<p><strong>See the full documentation for Searching in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/searching.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Searching in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/searching.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 200be06..58dbc94 100644 (file)
@@ -90,6 +90,6 @@
 
 <p>If you would like to merge together multiple records you can do that via the lists tool or from the cataloging search results.</p>
 
-<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#bibliographic-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#bibliographic-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 62a3f8c..e2c5235 100644 (file)
@@ -30,6 +30,6 @@
 
 <p>Once you've opened a blank framework or imported a record via Z39.50/SRU you will be presented with the form to continue cataloging</p>
 
-<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Cataloging in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7c7a1b1..c31b635 100644 (file)
@@ -74,6 +74,6 @@
 
 <p>Finally you can use the batch delete tool to delete a batch of items.</p>
 
-<p><strong>See the full documentation for Adding/Editing Items in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#item-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Adding/Editing Items in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#item-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b409b2d..a446cec 100644 (file)
@@ -27,6 +27,6 @@
 
 <p>You can also see the analytics attached to this record by clicking the 'Show Analytic' link towards the top of the record in the normal view.</p>
 
-<p><strong>See the full documentation for Analytics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#adding-analytic-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Analytics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#adding-analytic-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7d2c396..3862162 100644 (file)
@@ -19,6 +19,6 @@ Important
 
 <p>Note: If you would like you can also use the Lists tool for merging records together.</p>
 
-<p><strong>See the full documentation for Merging Items in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#merging-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Merging Items in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#merging-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index c0579bd..1b8b2f4 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>If you want to move all items to a new record creating only one bibliographic record you can use the 'Merge records' tool instead.</p>
 
-<p><strong>See the full documentation for Moving Items in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/cataloging.html#moving-items">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Moving Items in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/cataloging.html#moving-items">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index fc9df36..64453be 100644 (file)
@@ -8,6 +8,6 @@
 
 <p style="color: #990000">Important: If you do not charge fines and/or don't have the fines cron job running you will see no data on this report.</p>
 
-<p><strong>See the full documentation for Overdues with Fines in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#overdues-with-fines">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Overdues with Fines in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#overdues-with-fines">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 1fcea97..e44224b 100644 (file)
@@ -21,6 +21,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Transfers in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#transfers">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Transfers in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#transfers">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 86dff34..3bead92 100644 (file)
@@ -21,6 +21,6 @@
 
 <p style="background-color: #ffe599">Tip: Mac users use the OPTION button in place of ALT</p>
 
-<p><strong>See the full documentation for Circulation in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Circulation in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6877e59..06c8f42 100644 (file)
 
 <p>Circulation messages meant for the patron will appear when they log into the OPAC.</p>
 
-<p><strong>See the full documentation for Checking Out in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#check-out-(issuing)">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Checking Out in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#check-out-(issuing)">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b0b2c9a..985d8b5 100644 (file)
@@ -32,6 +32,6 @@
 
 <p>After the files are uploaded you can click 'View pending offline circulation actions' on the right to process the actions.</p>
 
-<p><strong>See the full documentation for Offline Circulation in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#offline-circulation-in-koha">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Offline Circulation in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#offline-circulation-in-koha">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 41e18a0..de5aa1f 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>This will list the due date (overdues in red), who has the item, item information and what library the item is at.</p>
 
-<p><strong>See the full documentation for Pending on-site checkouts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#pending-on-site-checkouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Pending on-site checkouts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#pending-on-site-checkouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index bbc5264..3f57f02 100644 (file)
@@ -11,6 +11,6 @@
        <li style="background-color: #ffe599">Tip: Large libraries can choose to filter the report before it runs by setting the FilterBeforeOverdueReport system preference to 'Require'.</li>
 </ul>
 
-<p><strong>See the full documentation for Overdues in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#overdues">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Overdues in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#overdues">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index c7e993a..daa12c9 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>You can limit the results you see by using the Refine box on the left side of the page</p>
 
-<p><strong>See the full documentation for Holds to Pull in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#holds-to-pull">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Holds to Pull in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#holds-to-pull">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 4a68991..746ebca 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>If the barcode is not found or the item is not actually checked out you will be presented with an error. Otherwise the item is renewed and you will receive a confirmation message.</p>
 
-<p><strong>See the full documentation for Renewing in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#renewing">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Renewing in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#renewing">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index fede98f..7d4310d 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>Hold ratios help with collection development. Using this report you will be able to see how many of your patrons have holds on items and whether you should buy more. By default it will be set to the library needing 3 items per hold that has been placed. The report will tell you how many additional items need to be purchased to meet this quota.</p>
 
-<p><strong>See the full documentation for Hold Ratios in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#hold-ratios">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Hold Ratios in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#hold-ratios">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 5071321..0ab2332 100644 (file)
@@ -74,6 +74,6 @@
 
 <p>From here you can check the item out to the patron at the desk and cancel the hold for the patron.</p>
 
-<p><strong>See the full documentation for Checking In in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#check-in-returning">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Checking In in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#check-in-returning">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2d23c8c..8c35b49 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>Once you have saved your changes you new library will appear in the top right.</p>
 
-<p><strong>See the full documentation for Setting your Library in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#set-library">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Setting your Library in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#set-library">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 716a5a3..132b01b 100644 (file)
@@ -8,6 +8,6 @@
 
 <p style="color: #990000">Important: An item is considered late based on the number of days you have entered in the TransfersMaxDaysWarning system preference.</p>
 
-<p><strong>See the full documentation for Transfers to Receive in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#transfers-to-receive">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Transfers to Receive in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#transfers-to-receive">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6f97e75..00d872e 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>Leaving StaticHoldsQueueWeight empty is contraindicated at this time. Doing so will cause the build_holds_queue script to ignore RandomizeHoldsQueueWeight, causing the script to request hold fulfillment not randomly, but by alphabetical order.</p>
 
-<p><strong>See the full documentation for the Holds Queue in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#holds-queue">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Holds Queue in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#holds-queue">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 4e4153a..635b622 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>Items that have been on the hold shelf longer than you normally allow (based on the ReservesMaxPickUpDelay preference value) will appear on the 'Holds Over' tab, they will not automatically be cancelled unless you have set the cron job to do that for you, but you can cancel all holds using the button at the top of the list.</p>
 
-<p><strong>See the full documentation for Holds Awaiting Pickup in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#holds-awaiting-pickup">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Holds Awaiting Pickup in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#holds-awaiting-pickup">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a58b28a..d364635 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>After you are done scanning the barcodes to add to the course you can see them on the course page.</p>
 
-<p><strong>See the full documentation for adding items to Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for adding items to Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 5d7722c..80db037 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>The details page will show you the items you have on reserve for your course. From here you can add/remove items and edit the course.</p>
 
-<p><strong>See the full documentation for Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b7a4ea3..8a813d3 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>You may also want to create new item types, collection codes and/or shelving locations to make it clear that the items are on reserve to your patrons. You will also want to be sure to confirm that your circulation and fine rules are right for your new item types (whether they be hourly or daily loans).</p>
 
-<p><strong>See the full documentation for Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/course_reserves.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 91149ba..744e7ac 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>Once your course is saved it will show on the main course reserves page and be searchable by any field in the course.</p>
 
-<p><strong>See the full documentation for adding Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/course_reserves.html#adding-courses">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for adding Course reserves in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/course_reserves.html#adding-courses">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index f447d54..4f9529f 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Online help</title>
-[% Asset.js("lib/tiny_mce/tiny_mce.js") %]
+[% Asset.js("lib/tiny_mce/tiny_mce.js") | $raw %]
 <script type="text/javascript">//<![CDATA[
-tinyMCE.baseURL = "[% interface %]/lib/tiny_mce";
+tinyMCE.baseURL = "[% interface | html %]/lib/tiny_mce";
 tinyMCE.init({
        mode : "textareas",
         theme : "advanced",
-    content_css : "[% interface %]/[% theme %]/css/tinymce.css",
+    content_css : "[% interface | html %]/[% theme | html %]/css/tinymce.css",
     plugins : "table,save,advhr,advlink,searchreplace,print,contextmenu",
         theme_advanced_disable : "underline,strikethrough,styleselect,image",
        theme_advanced_buttons1_add_before : "save,|",
@@ -24,21 +25,19 @@ tinyMCE.init({
 //]]>
 </script>
 [% INCLUDE intranetstylesheet.inc %]
-[% Asset.css("css/help.css") %]
+[% Asset.css("css/help.css") | $raw %]
 </head>
 <body id="help_edithelp" class="help">
        <h1>Online Help</h1>
 [% IF ( error ) %]
-<h5>[% error %]</h5>
+<h5>[% error | html %]</h5>
 [% END %]
 <form action="/cgi-bin/koha/edithelp.pl" method="post">
-<input type="hidden" name="referer" value="[% referer %]" />
-<input type="hidden" name="type" value="[% type %]" />
-<textarea name="help" cols="60" rows="20">[% help %]</textarea>
+<input type="hidden" name="referer" value="[% referer | html %]" />
+<input type="hidden" name="type" value="[% type | html %]" />
+<textarea name="help" cols="60" rows="20">[% help | html %]</textarea>
 <fieldset class="action"><input type="submit" name="submit" class="submit" value="Submit" /> <a class="cancel" href="#" onclick="history.back(); return false;">Cancel</a></fieldset>
 </form>
        
 </body>
 </html>
-
-
index 1e42a62..fd1716d 100644 (file)
@@ -22,6 +22,6 @@
 
 <p>After saving your file, simply print to the blank labels you have in your library.</p>
 
-<p><strong>See the full documentation for Label Batches in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Batches in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6aafb22..3bc7442 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>After saving, your layouts will appear on the 'Manage Layouts' page.</p>
 
-<p><strong>See the full documentation for Label Layouts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Layouts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2d1837e..8d6cac8 100644 (file)
@@ -28,6 +28,6 @@
 
 <p>Once you have saved your new profile, you can return to the list of templates and choose to edit the template that this profile is for.</p>
 
-<p><strong>See the full documentation for Label Profiles in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Profiles in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 805c127..a23c534 100644 (file)
@@ -30,6 +30,6 @@
 
 <p>After saving, your templates will appear on the 'Manage Templates' page.</p>
 
-<p><strong>See the full documentation for Label Templates in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Templates in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 26acab4..069e0fd 100644 (file)
@@ -41,6 +41,6 @@
 
 <p>Batches are made up of the barcodes you would like to print. Once in this tool you can search for the item records you would like to print out labels for.</p>
 
-<p><strong>See the full documentation for the Label Creator in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#label-creator">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Label Creator in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#label-creator">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index dfefeeb..52dd410 100644 (file)
@@ -14,7 +14,7 @@
 
 <p>After saving, your layouts will appear on the 'Manage Layouts' page.</p>
 
-<p><strong>See the full documentation for Label Layouts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Layouts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
 
 <h2>Templates</h2>
 
@@ -46,7 +46,7 @@
 
 <p>After saving, your templates will appear on the 'Manage Templates' page.</p>
 
-<p><strong>See the full documentation for Label Templates in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Templates in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
 
 <h2>Profiles</h2>
 
@@ -76,7 +76,7 @@
 
 <p>Once you have saved your new profile, you can return to the list of templates and choose to edit the template that this profile is for.</p>
 
-<p><strong>See the full documentation for Label Profiles in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Profiles in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
 
 <h2>Batches</h2>
 
 
 <p>After saving your file, simply print to the blank labels you have in your library.</p>
 
-<p><strong>See the full documentation for Label Batches in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Label Batches in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ccd0368..dccb9c6 100644 (file)
@@ -6,11 +6,11 @@
 
 <ul>
        <li>Define the fields you want to print on the spine label in the SpineLabelFormat system preference</li>
-    <li>Format your label printing by editing spinelabel.css found in [% interface %]/[% theme %]/css/</li>
+    <li>Format your label printing by editing spinelabel.css found in [% interface | html %]/[% theme | html %]/css/</li>
 </ul>
 
 <p>To use this tool you simply need the barcode for the book you'd like to print the spine label for.</p>
 
-<p><strong>See the full documentation for Quick Spine Label Creator in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#quick-spine-label-creator">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Quick Spine Label Creator in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#quick-spine-label-creator">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ff2d1e2..5543e19 100644 (file)
@@ -23,8 +23,8 @@
 
 <p><strong>IMPORTANT:</strong> Your online help will be overwritten by the new Help when there is an upgrade. If you want to keep a copy of your online help, you should instruct your System Administrator to upgrade the Online Help directory in the Koha file tree.</p>
 
-<p>The online help directory is: <pre>[% themelang %]/modules/help</pre></p>
+<p>The online help directory is: <pre>[% themelang | html %]/modules/help</pre></p>
 
-<p><strong>See the full documentation for Koha in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Koha in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0cc0ab1..eed45bb 100644 (file)
@@ -19,6 +19,6 @@
 
 <p>To the right of each account line there is a print link. Clicking that link will print an invoice for the line item that includes the date and description of the line item along with the total outstanding on the account.</p>
 
-<p><strong>See the full documentation for Patron Fines in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#fines">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Fines in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#fines">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 91648ff..ed11819 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>Once the letter is generated you will have a PDF to download</p>
 
-<p><strong>See the full documentation for the Patron discharges in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#patron-discharges">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron discharges in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#patron-discharges">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ca519a0..176e0df 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>All files that are uploaded will appear above a form where additional files can be uploaded from.</p>
 
-<p><strong>See the full documentation for Patron Files in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#files">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Files in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#files">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 830ea26..c00c431 100644 (file)
@@ -11,6 +11,6 @@
        <li>In the amount field, do not enter currency symbols, only numbers and decimals</li>
 </ul>
 
-<p><strong>See the full documentation for Creating Manual Credits in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#creating-manual-credits">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Creating Manual Credits in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#creating-manual-credits">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 63b646c..670a030 100644 (file)
@@ -14,6 +14,6 @@
        <li>In the amount field, do not enter currency symbols, only numbers and decimals</li>
 </ul>
 
-<p><strong>See the full documentation for Creating Manual Invoices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#creating-manual-invoices">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Creating Manual Invoices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#creating-manual-invoices">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 41c8127..e5b0c58 100644 (file)
 </li>
 </ul>
 
-<p><strong>See the full documentation for Patron Permissions in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#patron-permissions">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Permissions in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#patron-permissions">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 213d677..0380a19 100644 (file)
@@ -11,6 +11,6 @@
 
 <p>The default minimum password length is 3 characters long.  To change this value, update your system preferences.</p>
 
-<p><strong>See the full documentation for Editing Patrons in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#editing-patrons">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Editing Patrons in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#editing-patrons">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b3a23a4..481a345 100644 (file)
@@ -60,6 +60,6 @@
 
 <p>You can also browse through the patron records by clicking on the linked letters across the top.</p>
 
-<p><strong>See the full documentation for Patron Search in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#patron-search">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Search in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#patron-search">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 252217a..35db294 100644 (file)
@@ -86,6 +86,6 @@
 
 <p style="color: #990000">Remember to assign your staff secure usernames and passwords since these will be used to log into the staff client.</p>
 
-<p><strong>See the full documentation for Adding Patrons in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#add-a-new-patron">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Adding Patrons in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#add-a-new-patron">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index aa28ba7..7a26f45 100644 (file)
@@ -62,6 +62,6 @@
 
 <p>You can also browse through the patron records by clicking on the linked letters across the top.</p>
 
-<p><strong>See the full documentation for the Patrons module in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patrons module in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html">manual</a> (online).</strong></p>
        
 [% INCLUDE 'help-bottom.inc' %]
index 79ad891..32d5108 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>From here you can 'Approve' and apply the changes to the patron record, 'Delete' and remove the changes or 'Ignore' and keep the changes pending to review later.</p>
 
-<p><strong>See the full documentation for Updating patron records in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#managing-patron-self-edits">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Updating patron records in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#managing-patron-self-edits">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d88102f..71d2fde 100644 (file)
        <li>You will be brought to your new patron</li>
 </ul>
 
-<p><strong>See the full documentation for the Patron Details in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#patron-information">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Details in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#patron-information">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index f6967b7..633a55e 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>Clicking on the message title will expand the view to show you the full text of the message that was sent.</p>
 
-<p><strong>See the full documentation for Patron Notices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#notices">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Notices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#notices">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0679785..13886ef 100644 (file)
@@ -57,6 +57,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Paying Fines in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#pay/reverse-fines">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Paying Fines in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#pay/reverse-fines">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0679785..13886ef 100644 (file)
@@ -57,6 +57,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Paying Fines in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#pay/reverse-fines">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Paying Fines in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#pay/reverse-fines">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2de7889..ead5c18 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>Learn more about Purchase suggestions in the Acquisitions chapter of the manual.</p>
 
-<p><strong>See the full documentation for the Patron's Purchase Suggestions in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#purchase-suggestions">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron's Purchase Suggestions in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#purchase-suggestions">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b92f7e9..0065865 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>This will generate a text file with one barcode per line.</p>
 
-<p><strong>See the full documentation for Circulation History in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#circulation-history">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Circulation History in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#circulation-history">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b1ef42e..e6d4137 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>On this tab you will be able to see and edit all of the routing lists that this patron is on.</p>
 
-<p><strong>See the full documentation for Patron routing lists in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#routing-lists">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron routing lists in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#routing-lists">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a71b468..d0cf866 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>Depending on what you set for the values of your StatisticsFields system preference, you can see statistics for one patron's circulation actions.</p>
 
-<p><strong>See the full documentation for Patron Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/patrons.html#statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/patrons.html#statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index e8e69e4..443a7d0 100644 (file)
@@ -2,10 +2,10 @@
        
 <h1>Online help</h1>
 
-<p>Sorry, there is no help available for this topic, please refer to the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/">Koha [% helpVersion %] manual</a> (online).</p>
+<p>Sorry, there is no help available for this topic, please refer to the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/">Koha [% helpVersion | html %] manual</a> (online).</p>
 
 <form action="/cgi-bin/koha/edithelp.pl" method="post">
-       <input type="hidden" name="referer" value="[% referer %]" />
+       <input type="hidden" name="referer" value="[% referer | html %]" />
        <input type="hidden" name="type" value="addnew" />
        <input type="submit" name="submit" class="submit" value="Add help" />
 </form>
index be1a307..e3b24f7 100644 (file)
@@ -20,6 +20,6 @@
     <li>Once finished you will have a summary of all of your transactions</li>
 </ul>
 
-<p><strong>See the full documentation for Offline Circulation in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#offline-circulation-utilities">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Offline Circulation in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#offline-circulation-utilities">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 995fe60..3e91a92 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>You can also tend to pending circulation actions by going to Circulation > Pending offline circulation actions.</p>
 
-<p><strong>See the full documentation for Uploading the Offline Circulation File in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#upload-offline-circ-file">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Uploading the Offline Circulation File in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#upload-offline-circ-file">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index bba8901..2789257 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>Once you have all of the patrons you would like to add you can click the 'Update' button to save them to the list.</p>
 
-<p><strong>See the full documentation for Patron Lists in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#patron-lists">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Lists in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#patron-lists">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 9b7e0fb..ed8e856 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>To add a new batch, you want to click on the 'Batches' button at the top of your page and choose 'New Batch'</p>
 
-<p><strong>See the full documentation for the Patron Card Batches in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Batches in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batches">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index eb4ca0c..fe07616 100644 (file)
@@ -31,6 +31,6 @@
 
 <p>After saving, your layouts will appear on the 'Manage Layouts' page.</p>
 
-<p><strong>See the full documentation for the Patron Card Layouts in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Layouts in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#layouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7b54484..bc4c320 100644 (file)
@@ -28,6 +28,6 @@
 
 <p>Once you have saved your new profile, you can return to the list of templates and choose to edit the template that this profile is for.</p>
 
-<p><strong>See the full documentation for the Patron Card Profiles in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Profiles in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#profiles">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ad01b31..e129a5b 100644 (file)
@@ -25,6 +25,6 @@ After saving, your templates will appear on the 'Manage Templates' page.</li>
 </li>
 </ul>
 
-<p><strong>See the full documentation for the Patron Card Templates in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Templates in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#templates">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 8dd2f4f..789a7b5 100644 (file)
@@ -17,6 +17,6 @@
 
 <p>The developers of the Patron Card Creator module hope you will find this an extremely useful tool. You are encouraged to submit any enhancement requests as well as any bugs via Koha Project Bugzilla.</p>
 
-<p><strong>See the full documentation for the Patron Card Creator in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#patron-card-creator">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Creator in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#patron-card-creator">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2553774..efbe348 100644 (file)
@@ -20,6 +20,6 @@
 
 <p>To replace an image, delete it, upload a new file and give it the same image name.</p>
 
-<p><strong>See the full documentation for Managing Images in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#manage-images">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Managing Images in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#manage-images">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index baa73d0..0aea6a6 100644 (file)
@@ -17,6 +17,6 @@
 
 <p>A batch is a collection of patrons for whom you want to generate cards.</p>
 
-<p><strong>See the full documentation for the Patron Card Creator in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#patron-card-creator">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Card Creator in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#patron-card-creator">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 1f715ac..d5c7d31 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>The plugin system needs to be turned on by a system administrator and should only managed by those who understand Perl and the way data connects within Koha.</p>
 
-<p><strong>See the full documentation for the Plugin System in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/plugins.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Plugin System in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/plugins.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 76d9431..2310e06 100644 (file)
@@ -6,6 +6,6 @@
 
 <p style="color: #990000;">Important: Only install plugins from trusted sources.</p>
 
-<p><strong>See the full documentation for the Plugin system in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/plugins.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Plugin system in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/plugins.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 477e270..3908fe5 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>Choosing amount will change your results to appear as the sum of the amounts spent.</p>
 
-<p><strong>See the full documentation for Acquisitions Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#acquisitions-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Acquisitions Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#acquisitions-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 803651d..c060d71 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Patrons with the most Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#patrons-with-the-most-checkouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patrons with the most Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#patrons-with-the-most-checkouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b1709d6..17b0425 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Patrons with no Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#patrons-with-no-checkouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patrons with no Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#patrons-with-no-checkouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 46b1ce1..4a1ff5e 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>Based on your selections, you may see some query information above your results table. You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for Patron Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#patron-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#patron-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index fecad38..01215f4 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Most Circulation Items report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#most-circulated-items">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Most Circulation Items report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#most-circulated-items">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ad67588..028a5f3 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Items with no Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#items-with-no-checkouts">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Items with no Checkouts report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#items-with-no-checkouts">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 490e067..7341bcc 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for Catalog Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#catalog-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Catalog Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#catalog-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 81156fa..2939679 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>Then when generating reports on the module you created the value for you will see an option to limit by the definition at the bottom of the usual filters.</p>
 
-<p><strong>See the full documentation for the Reports Dictionary in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#report-dictionary">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Reports Dictionary in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#report-dictionary">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 03e1522..4ab9336 100644 (file)
        <li>8 = Stopped</li>
 </ul>
 
-<p><strong>See the full documentation for Custom Reports in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#custom-reports">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Custom Reports in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#custom-reports">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0fc656a..00eb619 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Average Loan Time report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#average-loan-time">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Average Loan Time report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#average-loan-time">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d871b33..b27b476 100644 (file)
@@ -19,6 +19,6 @@
        <li>For a single day, an example would be: 11/15/2009 to 11/16/2009 to find what circulated on the 15th</li>
 </ul>
 
-<p><strong>See the full documentation for Circulation Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#circulation-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Circulation Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#circulation-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a38a986..324e722 100644 (file)
@@ -16,6 +16,6 @@
                </ul>
        </div>  
 
-<p><strong>See the full documentation for the Lost Items report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#lost-items">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Lost Items report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#lost-items">manual</a> (online).</strong></p>
        
 [% INCLUDE 'help-bottom.inc' %]
index 74ef806..d97b9f4 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for the Catalog by Item type report in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#catalog-by-item-type">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Catalog by Item type report in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#catalog-by-item-type">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b2f5afc..51d6a3e 100644 (file)
@@ -19,6 +19,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Reports in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Reports in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index db53c1d..c24035f 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for Holds Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#holds-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Holds Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#holds-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 35688dc..675fae9 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>You can also choose to export to a file that you can manipulate to your needs.</p>
 
-<p><strong>See the full documentation for Serials Statistics in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/reports.html#serials-statistics">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serials Statistics in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/reports.html#serials-statistics">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7224437..eb5f921 100644 (file)
@@ -60,6 +60,6 @@
 
 <p>If a patron asks to have their hold suspended you can do so by clicking the Suspend button to far right. If the patron gives you a date for the items to become unsuspended you can enter that in the date box and click the 'Update hold(s)' button to save your changes.</p>
 
-<p><strong>See the full documentation for Holds in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/circulation.html#holds">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Holds in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/circulation.html#holds">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2183168..2953546 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>You can also review and unapprove comments you have approved in the past by choosing the 'Approved comments' tab</p>
 
-<p><strong>See the full documentation for Comments in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#comments">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Comments in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#comments">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index be676b7..33d1812 100644 (file)
@@ -4,7 +4,7 @@
 
 <p>Rotating Collections is a tool for managing collections of materials that frequently get shifted from library to library. It adds the ability to store not only an item's home library and current location, but also information about where it is supposed to be transferred to next to ensure that all items in the collection are sent to the correct library. When an item in a rotating collection is checked in, library staff are notified that the item is part of a rotating collection and which branch it should be sent to if it is not at the correct one.</p>
 
-<p style="color: #990000"><strong>Important:</strong> <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/administration.html#automaticitemreturn">AutomaticItemReturn</a> (system preference) must be set to "Don't automatically transfer items to their home library when they are returned" for Rotating Collections to function properly.</p>
+<p style="color: #990000"><strong>Important:</strong> <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/administration.html#automaticitemreturn">AutomaticItemReturn</a> (system preference) must be set to "Don't automatically transfer items to their home library when they are returned" for Rotating Collections to function properly.</p>
 
 <ul>
     </li>To create a new rotating collection, click the "New Collection" button, fill in the Title and Description, and click Submit. Once submitted you'll see "Collection Name added successfully"; click "Return to rotating collections home" to return to the main Rotating Collections management page (or click Rotating Collections in the sidebar).</li>
@@ -32,6 +32,6 @@
 
 <p>If an item in a rotating collection is checked in at a library other than the one it is supposed to be transferred to, a notification will appear notifying library staff that the item is part of a rotating collection, also letting them know where the item needs to be sent.</p>
 
-<p><strong>See the full documentation for Rotating Collections in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#rotating-collections">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Rotating Collections in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#rotating-collections">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 8171ec2..c9dac83 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>In your results you will see all subscriptions that will expire before the date you entered. From there you can choose to view the subscription further or renew it in one click.</P>
 
-<p><strong>See the full documentation for Checking Serial Expiration in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#check-serial-expiration">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Checking Serial Expiration in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#check-serial-expiration">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 39818a2..1edf861 100644 (file)
@@ -12,6 +12,6 @@
 
 <p>From the list of late issues you can choose which ones you want to send a claim email to by clicking the checkbox to the left of late issue, choosing the notice template to use and clicking the 'Send notification' button.</p>
 
-<p><strong>See the full documentation for Serial Claims in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#claim-late-serials">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serial Claims in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#claim-late-serials">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d8497ac..e6592c6 100644 (file)
@@ -18,6 +18,6 @@
 
 <p>To see a list of all of the routing lists a specific patron is on visit the Routing Lists tab on their patron record.</p>
 
-<p><strong>See the full documentation for Routing Lists in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#create-a-routing-list">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Routing Lists in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#create-a-routing-list">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 14709de..bf7abca 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>If you are adding multiple issues at once or if the latest expected issue is late, you can click the 'Generate Next' button to generate the next issue based on the subscription pattern.</p>
 
-<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7d8f4eb..e19a57c 100644 (file)
@@ -24,6 +24,6 @@
 
 <p>Clicking this button will generate the next issue for you and mark the previously expected issue as 'Late' automatically. You can then check the 'Edit' box to the right of each issue and edit the status on multiple issues at once.</p>
 
-<p><strong>See the full documentation for Receiving a Serial in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#receive-issues">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Receiving a Serial in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#receive-issues">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 1b83e14..e014987 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>You can search for existing subscriptions by using the search box at the top of the page. You can search for any part of the serial title or ISSN.</p>
 
-<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ffacfd4..361cf40 100644 (file)
@@ -102,6 +102,6 @@ Once that data is filled in you can click 'Next' to enter the prediction pattern
 
 <p>Click 'Save Subscription' to save the information you have entered.</p>
 
-<p><strong>See the full documentation for Adding a Subscription in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#add-a-subscription">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Adding a Subscription in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#add-a-subscription">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 4f72f4a..363f6c3 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>From here you can edit your subscription, renew it and/or receive issues.</p>
 
-<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serials in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6c17d62..b190b55 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>From this page you can view all of the existing frequencies in your system and create new ones.</p>
 
-<p><strong>See the full documentation for Serial Frequencies in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#manage-serial-frequencies">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serial Frequencies in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#manage-serial-frequencies">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2af51eb..3fe0283 100644 (file)
@@ -8,6 +8,6 @@
 
 <p>It will also allow you to create a new numbering pattern without first adding a subscription. To add a new pattern click 'New numbering pattern' at the top of the list of patterns.</p>
 
-<p><strong>See the full documentation for Serial Numbering Patterns in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/serials.html#manage-serial-numbering-patterns">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Serial Numbering Patterns in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/serials.html#manage-serial-numbering-patterns">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 84a025e..e635221 100644 (file)
@@ -38,6 +38,6 @@
 
 <p><strong>Customization:</strong> You can create additional custom suggestion statuses by creating new authorized values of the category SUGGEST_STATUS.</p>
 
-<p><strong>See the full documentation for Purchase Suggestions in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/acquisitions.html#managing-suggestions">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Purchase Suggestions in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/acquisitions.html#managing-suggestions">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 270a72d..00adfad 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>To remove a tag from a specific title, simply click the 'Remove tag' button to the right of the title.</p>
 
-<p><strong>See the full documentation for Tag Moderation in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#tag-moderation">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Tag Moderation in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#tag-moderation">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 70e430a..468fc45 100644 (file)
@@ -20,6 +20,6 @@
 
 <p>To check terms against the approved and rejected lists (and possibly against the dictionary you have assigned for tag moderation) simply enter the term into the search box on the bottom right of the screen to see the status of the term.</p>
 
-<p><strong>See the full documentation for Tag Moderation in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#tag-moderation">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Tag Moderation in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#tag-moderation">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 49654e8..2802ee2 100644 (file)
@@ -30,6 +30,6 @@
 
 <p>If the items can be deleted they will be and you will be presented with a confirmation of your deletion.</p>
 
-<p><strong>See the full documentation for <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batch-item-modification">Batch Item Modifications</a> and <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batch-item-deletion">Batch Item Deletions</a> in the manual (online).</strong></p>
+<p><strong>See the full documentation for <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batch-item-modification">Batch Item Modifications</a> and <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batch-item-deletion">Batch Item Deletions</a> in the manual (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 0ea11b5..ff20499 100644 (file)
@@ -10,6 +10,6 @@
 
 <p>Check the records you want to delete and click the 'Delete selected records' button to finish the process.</p>
 
-<p><strong>See the full documentation for Batch Delete Records in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batch-record-deletion">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Batch Delete Records in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batch-record-deletion">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d217496..bae08f7 100644 (file)
@@ -25,6 +25,6 @@
 
 <p>Once you're sure everything is the way you want you can click the 'Modify selected records' button and your records will be modified.</p>
 
-<p><strong>See the full documentation for Batch Record Modification in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batch-record-modification">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Batch Record Modification in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batch-record-modification">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 3bc9b36..36fa06b 100644 (file)
@@ -21,6 +21,6 @@
        <li>Clicking 'Finish' will delete or anonymize your data</li>
 </ul>
 
-<p><strong>See the full documentation for Anonymizing Patrons in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#patrons-anonymize-bulk-delete">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Anonymizing Patrons in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#patrons-anonymize-bulk-delete">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b2f5420..599be17 100644 (file)
 }
 </pre>
 <p>The indicators can be accessible using the 'indicator' key.</p>
-<p>Example: [% fields.245.0.indicator.1 %] is the indicator 1 for the first 245 field.</p>
+<p>Example: [% fields.245.0.indicator.1 | html %] is the indicator 1 for the first 245 field.</p>
 
 <p>Some examples:</p>
 <ul>
   <li>Display all 245$a and 245$c into the same column:
     <p>
     [% FOREACH field IN fields.245 %]
-        [% field.a.join(' ') %] [% field.c.join(' ') %]
+        [% field.a.join(' ') | html %] [% field.c.join(' ') | html %]
     [% END %]
     </p>
   </li>
   <li>Display 650$a if indicator 2 for 650 is set
     <p>
-    Subject=[% FOREACH field IN fields.650 %][% IF field.indicator.2 %][% field.a.0 %][% END %][% END %]
+    Subject=[% FOREACH field IN fields.650 %][% IF field.indicator.2 %][% field.a.0 | html %][% END %][% END %]
     </p>
   </li>
   <li>Display the language from the control field 008
     <p>
-    Language=[% fields.008.0.substr( 28, 3 ) %]
+    Language=[% fields.008.0.substr( 28, 3 ) | html %]
     </p>
   </li>
   <li>Display the first subfield a for first field 245 if indicator 1 for field 100 is set
     <p>
-    Title=[% IF fields.100.0.indicator.1 %][% fields.245.0.a.0 %][% END %]
+    Title=[% IF fields.100.0.indicator.1 %][% fields.245.0.a.0 | html %][% END %]
     </p>
   </li>
 </ul>
 <p>Note that the authorized values won't be replaced by their descriptions.</p>
 [- TAGS default -]
 
-<p><strong>See the full documentation for CSV Profiles in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#csv-profiles">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for CSV Profiles in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#csv-profiles">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index e8fb6e4..335bbd9 100644 (file)
@@ -61,6 +61,6 @@
     <li>Click 'Export authority records'</li>
 </ul>
 
-<p><strong>See the full documentation for Exporting MARC Records in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#export-bibliographic-records">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Exporting MARC Records in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#export-bibliographic-records">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index e390227..cc10cee 100644 (file)
@@ -65,6 +65,6 @@
 
 <p>When adding or editing events you can get additional help by clicking on the question mark next to various different options on the form</p>
 
-<p><strong>See the full documentation for the Calendar in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#calendar">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Calendar in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#calendar">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 2bda1d5..e7c98ff 100644 (file)
@@ -55,6 +55,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for Patron Import in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#patron-import">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Patron Import in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#patron-import">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 6288c6f..fd95551 100644 (file)
@@ -16,6 +16,6 @@
 
 <p>Choose the text file and the date you want to mark all times as seen and click 'Submit.'</p>
 
-<p><strong>See the full documentation for Inventory in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#inventory-stocktaking">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Inventory in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#inventory-stocktaking">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 534e335..b2f9ed4 100644 (file)
@@ -24,6 +24,6 @@
         <li>The system preference 'NewsAuthorDisplay' can be used to hide or show the author for news item.</li>
 </ul>
 
-<p><strong>See the full documentation for News in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#news">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for News in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#news">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 29ed6ec..e50e45d 100644 (file)
@@ -292,6 +292,6 @@ Barcode: &lt;&lt;items.barcode&gt;&gt; , Checkout date:
 </li>
 </ul>
 
-<p><strong>See the full documentation for Notices in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#notices-slips">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Notices in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#notices-slips">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 80433a6..9237078 100644 (file)
@@ -41,6 +41,6 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for the Managing Staged MARC Records in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#staged-marc-record-management">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Managing Staged MARC Records in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#staged-marc-record-management">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 57c0cd9..bc0626c 100644 (file)
@@ -58,6 +58,6 @@
 
 <p>Once your template is saved you will be able to pick it when using the Stage MARC Records for Import tool.</p>
 
-<p><strong>See the full documentation for MARC Modification Templates in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#marc-modification-templates">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for MARC Modification Templates in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#marc-modification-templates">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 269d0c2..29cdd6f 100644 (file)
@@ -14,6 +14,6 @@
 
 <p>Once you have made the changes you want, you can click 'Save' and Koha will present you with the changed patron records.</p>
 
-<p><strong>See the full documentation for Batch Patron Modification in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#batch-patron-modification">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Batch Patron Modification in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#batch-patron-modification">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 5b239dc..6654b6a 100644 (file)
@@ -45,6 +45,6 @@
 
 <p>Sincerely, Library Staff</p>
 
-<p><strong>See the full documentation for the Overdue Notice/Status Triggers in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#overdue-notice-status-triggers">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Overdue Notice/Status Triggers in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#overdue-notice-status-triggers">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 5347d5b..f39852a 100644 (file)
@@ -20,6 +20,6 @@
 
 <p style="color:#990000;">Important: There is a limit of 520K on the size of the picture uploaded and it is recommended that the image be 200x300 pixels, but smaller images will work as well.</p>
 
-<p><strong>See the full documentation for the Patron Image Uploader in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#upload-patron-images">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Patron Image Uploader in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#upload-patron-images">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index d3793e5..7289099 100644 (file)
@@ -40,6 +40,6 @@
     </ol>
 </ol>
 
-<p><strong>See the full documentation for the Quote of the Day Uploader in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#import-quotes">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Quote of the Day Uploader in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#import-quotes">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index f3404b9..4a95c9f 100644 (file)
@@ -38,6 +38,6 @@
     </ol>
 </ol>
 
-<p><strong>See the full documentation for the Quote of the Day Editor in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#quote-of-the-day-(qotd)-editor">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Quote of the Day Editor in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#quote-of-the-day-(qotd)-editor">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 37e4812..1c6483e 100644 (file)
@@ -23,6 +23,6 @@
 
 <p>Task scheduler will not work if the user the web server runs as doesn't have the permission to use it. To find out if the right user has the permissions necessary, check /etc/at.allow to see what users are in it. If you don't have that file, check etc/at.deny. If at.deny exists but is blank, then every user can use it. Talk to your system admin about adding the user to the right place to make the task scheduler work.</p>
 
-<p><strong>See the full documentation for the Task Scheduler in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#task-scheduler">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Task Scheduler in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#task-scheduler">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 7af7419..5c34b27 100644 (file)
@@ -35,7 +35,7 @@
 </li>
 </ul>
 
-<p><strong>See the full documentation for the MARC Import in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#stage-marc-records-for-import">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the MARC Import in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#stage-marc-records-for-import">manual</a> (online).</strong></p>
 
 
 [% INCLUDE 'help-bottom.inc' %]
index 2968dc6..79de790 100644 (file)
@@ -4,6 +4,6 @@
 
 <p>Tools in Koha all perform some sort of action. Often many of the items listed under Tools in Koha are referred to as 'Reports' in other library management systems.</p>
 
-<p><strong>See the full documentation for Tools in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Tools in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index 30ecdac..d1d326c 100644 (file)
@@ -40,6 +40,6 @@
 
 <p>In the OPAC the cover images will also appear in the images tab, as well as next to the title and on the search results.</p>
 
-<p><strong>See the full documentation for Uploading Cover Images in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#upload-local-cover-image">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Uploading Cover Images in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#upload-local-cover-image">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index ac9b165..de7d41f 100644 (file)
@@ -6,6 +6,6 @@
 
 <p>Choosing different combinations of menu options will produce the log file for that query.</p>
 
-<p><strong>See the full documentation for the Log Viewer in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/tools.html#log-viewer">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for the Log Viewer in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/tools.html#log-viewer">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index a2f5789..35e6240 100644 (file)
@@ -62,6 +62,6 @@
 
 <p style="color: rgb(153, 0, 0);">Important: It is important to rebuild your zebra index immediately after merging records. If a search is performed for a record which has been deleted Koha will present the patrons with an error in the OPAC.</p>
 
-<p><strong>See the full documentation for Lists in the <a href="http://koha-community.org/manual/[% helpVersion %]/en/html/lists.html#lists">manual</a> (online).</strong></p>
+<p><strong>See the full documentation for Lists in the <a href="http://koha-community.org/manual/[% helpVersion | html %]/en/html/lists.html#lists">manual</a> (online).</strong></p>
 
 [% INCLUDE 'help-bottom.inc' %]
index b869b5f..8bc9268 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE Koha %]
@@ -6,8 +7,8 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; ILL requests  &rsaquo;</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'datatables.inc' %]
 <script type="text/javascript">
     //<![CDATA[
                     <!-- Dispatch on Status -->
                     <p>We encountered an error:</p>
                     <p>
-                      <pre>[% whole.message %] ([% whole.status %])</pre>
+                      <pre>[% whole.message | html %] ([% whole.status | html %])</pre>
                     </p>
                 [% END %]
 
                     [% IF whole.stage == 'copyrightclearance' %]
                         <div>
                             <p>
-                                [% Koha.Preference('ILLModuleCopyrightClearance') %]
+                                [% Koha.Preference('ILLModuleCopyrightClearance') | $raw %]
                             </p>
-                            <a href="?method=create&stage=copyrightclearance&backend=[% whole.value.backend %]"
+                            <a href="?method=create&stage=copyrightclearance&backend=[% whole.value.backend | html %]"
                                class="btn btn-sm btn-default btn-group"><i class="fa fa-check">Yes</i></a>
                             <a href="/cgi-bin/koha/ill/ill-requests.pl"
                                class="btn btn-sm btn-default btn-group"><i class="fa fa-times">No</i></a>
                                         <label for="partners" class="required">Select partner libraries:</label>
                                         <select size="5" multiple="true" id="partners" name="partners" required="required">
                                             [% FOREACH partner IN whole.value.partners %]
-                                                <option value=[% partner.email %]>
+                                                <option value=[% partner.email | html %]>
                                                     [% partner.branchcode _ " - " _ partner.surname %]
                                                 </option>
                                             [% END %]
                                     </li>
                                     <li>
                                         <label for="subject" class="required">Subject Line</label>
-                                        <input type="text" name="subject" id="subject" type="text" value="[% whole.value.draft.subject %]" required="required" />
+                                        <input type="text" name="subject" id="subject" type="text" value="[% whole.value.draft.subject | html %]" required="required" />
                                     </li>
                                     <li>
                                         <label for="body" class="required">Email text:</label>
-                                        <textarea name="body" id="body" rows="20" cols="80" required="required">[% whole.value.draft.body %]</textarea>
+                                        <textarea name="body" id="body" rows="20" cols="80" required="required">[% whole.value.draft.body | html %]</textarea>
                                     </li>
                                 </ol>
                                 <input type="hidden" value="generic_confirm" name="method">
                                 <input type="hidden" value="draft" name="stage">
-                                <input type="hidden" value="[% request.illrequest_id %]" name="illrequest_id">
+                                <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
                             </fieldset>
                             <fieldset class="action">
                                 <input type="submit" class="btn btn-default" value="Send email"/>
-                                <span><a href="[% ill_url %]" title="Return to request details">Cancel</a></span>
+                                <span><a href="[% ill_url | html %]" title="Return to request details">Cancel</a></span>
                             </fieldset>
                         </form>
                     [% ELSE %]
                             <legend>Interlibrary loan request details</legend>
                             <p>No partners have been defined yet. Please create appropriate patron records (by default ILLLIBS category).</p>
                             <p>Be sure to provide email addresses for these patrons.</p>
-                            <p><span><a href="[% ill_url %]" title="Return to request details">Cancel</a></span></p>
+                            <p><span><a href="[% ill_url | html %]" title="Return to request details">Cancel</a></span></p>
                         </fieldset>
                     [% END %]
                 <!-- generic_confirm ends here -->
                             <ol>
                                 <li class="borrowernumber">
                                     <label for="borrowernumber">Patron ID:</label>
-                                    <input name="borrowernumber" id="borrowernumber" type="text" value="[% request.borrowernumber %]">
+                                    <input name="borrowernumber" id="borrowernumber" type="text" value="[% request.borrowernumber | html %]">
                                 </li>
                                 <li class="biblio_id">
                                     <label for="biblio_id" class="biblio_id">Biblio ID:</label>
-                                    <input name="biblio_id" id="biblio_id" type="text" value="[% request.biblio_id %]">
+                                    <input name="biblio_id" id="biblio_id" type="text" value="[% request.biblio_id | html %]">
                                 </li>
                                 <li class="branchcode">
                                     <label for="library" class="branchcode">Library:</label>
                                 </li>
                                 <li class="status">
                                     <label class="status">Status:</label>
-                                    [% stat = request.status %]
-                                    [% request.capabilities.$stat.name %]
+                                    [% stat = request.status | html %]
+                                    [% request.capabilities.$stat.name | html %]
                                 </li>
                                 <li class="updated">
                                     <label class="updated">Last updated:</label>
-                                    [% request.updated | $KohaDates with_hours => 1 %]
+                                    [% request.updated | $KohaDates with_hours => 1 | html %]
                                 </li>
                                 <li class="medium">
                                     <label class="medium">Request type:</label>
-                                    [% request.medium %]
+                                    [% request.medium | html %]
                                 </li>
                                 <li class="cost">
                                     <label class="cost">Cost:</label>
-                                    [% request.cost || 'N/A' %]
+                                    [% request.cost || 'N/A' | html %]
                                 </li>
                                 <li class="req_id">
                                     <label class="req_id">Request number:</label>
-                                    [% request.id_prefix _ request.illrequest_id %]
+                                    [% request.id_prefix _ request.illrequest_id | html %]
                                 </li>
                                 <li class="notesstaff">
                                     <label for="notesstaff" class="notesstaff">Staff notes:</label>
-                                    <textarea name="notesstaff" id="notesstaff" rows="5">[% request.notesstaff %]</textarea>
+                                    <textarea name="notesstaff" id="notesstaff" rows="5">[% request.notesstaff | html %]</textarea>
                                 </li>
                                 <li class="notesopac">
                                     <label for="notesopac" class="notesopac">Opac notes:</label>
                         <fieldset class="action">
                             <input type="hidden" value="edit_action" name="method">
                             <input type="hidden" value="form" name="stage">
-                            <input type="hidden" value="[% request.illrequest_id %]" name="illrequest_id">
+                            <input type="hidden" value="[% request.illrequest_id | html %]" name="illrequest_id">
                             <input type="submit" value="Submit">
-                            <a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl?method=illview&amp;illrequest_id=[% request.id %]">Cancel</a>
+                            <a class="cancel" href="/cgi-bin/koha/ill/ill-requests.pl?method=illview&amp;illrequest_id=[% request.id | html %]">Cancel</a>
                         </fieldset>
                     </form>
 
                         <form action="/cgi-bin/koha/ill/ill-requests.pl" method="post">
                             <input type="hidden" name="method" value="delete" />
                             <input type="hidden" name="confirmed" value="1" />
-                            <input type="hidden" name="illrequest_id" value="[% request.id %]" />
+                            <input type="hidden" name="illrequest_id" value="[% request.id | html %]" />
                             <button type="submit" class="btn btn-default btn-sm approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
                         </form>
-                        <a class="btn btn-default btn-sm deny" href="/cgi-bin/koha/ill/ill-requests.pl?method=illview&amp;illrequest_id=[% request.id %]"><i class="fa fa-fw fa-remove"></i>No, do not delete</a>
+                        <a class="btn btn-default btn-sm deny" href="/cgi-bin/koha/ill/ill-requests.pl?method=illview&amp;illrequest_id=[% request.id | html %]"><i class="fa fa-fw fa-remove"></i>No, do not delete</a>
                     </div>
 
                 [% ELSIF query_type == 'illview' %]
-                    [% actions = request.available_actions %]
-                    [% capabilities = request.capabilities %]
-                    [% req_status = request.status %]
+                    [% actions = request.available_actions | html %]
+                    [% capabilities = request.capabilities | html %]
+                    [% req_status = request.status | html %]
                     <h1>Manage ILL request</h1>
                     <div id="toolbar" class="btn-toolbar">
-                        <a title="Edit request" id="ill-toolbar-btn-edit-action" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=edit_action&amp;illrequest_id=[% request.illrequest_id %]">
+                        <a title="Edit request" id="ill-toolbar-btn-edit-action" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=edit_action&amp;illrequest_id=[% request.illrequest_id | html %]">
                         <span class="fa fa-pencil"></span>
                         Edit request
                         </a>
                         [% FOREACH action IN actions %]
                             [% IF action.method != 0 %]
-                                <a title="[% action.ui_method_name %]" id="ill-toolbar-btn-[% action.id | lower %]" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=[% action.method %]&amp;illrequest_id=[% request.illrequest_id %]">
-                                <span class="fa [% action.ui_method_icon %]"></span>
-                                [% action.ui_method_name %]
+                                <a title="[% action.ui_method_name | html %]" id="ill-toolbar-btn-[% action.id | lower | html %]" class="btn btn-sm btn-default" href="/cgi-bin/koha/ill/ill-requests.pl?method=[% action.method | html %]&amp;illrequest_id=[% request.illrequest_id | html %]">
+                                <span class="fa [% action.ui_method_icon | html %]"></span>
+                                [% action.ui_method_name | html %]
                                 </a>
                             [% END %]
                         [% END %]
                             <div class="rows">
                                 <div class="orderid">
                                     <span class="label orderid">Order ID:</span>
-                                    [% request.orderid || "N/A" %]
+                                    [% request.orderid || "N/A" | html %]
                                 </div>
                                 <div class="borrowernumber">
                                     <span class="label borrowernumber">Patron:</span>
                                     [% borrowerlink = "/cgi-bin/koha/members/moremember.pl" _ "?borrowernumber=" _ request.patron.borrowernumber %]
-                                    <a href="[% borrowerlink %]" title="View borrower details">
-                                    [% request.patron.firstname _ " " _ request.patron.surname _ " [" _ request.patron.cardnumber _ "]" %]
+                                    <a href="[% borrowerlink | html %]" title="View borrower details">
+                                    [% request.patron.firstname _ " " _ request.patron.surname _ " [" _ request.patron.cardnumber _ "]" | html %]
                                     </a>
                                 </div>
 
                                 <div class="biblio_id">
                                     <span class="label biblio_id">Biblio ID:</span>
-                                    [% request.biblio_id || "N/A" %]
+                                    [% request.biblio_id || "N/A" | html %]
                                 </div>
                                 <div class="branchcode">
                                     <span class="label branchcode">Library:</span>
-                                    [% Branches.GetName(request.branchcode) %]
+                                    [% Branches.GetName(request.branchcode) | html %]
                                 </div>
                                 <div class="status">
                                     <span class="label status">Status:</span>
-                                    [% capabilities.$req_status.name %]
+                                    [% capabilities.$req_status.name | html %]
                                 </div>
                                 <div class="updated">
                                     <span class="label updated">Last updated:</span>
-                                    [% request.updated | $KohaDates with_hours => 1 %]
+                                    [% request.updated | $KohaDates with_hours => 1 | html %]
                                 </div>
                                 <div class="medium">
                                     <span class="label medium">Request type:</span>
-                                    [% request.medium %]
+                                    [% request.medium | html %]
                                 </div>
                                 <div class="cost">
                                     <span class="label cost">Cost:</span>
-                                    [% request.cost || "N/A" %]
+                                    [% request.cost || "N/A" | html %]
                                 </div>
                                 <div class="req_id">
                                     <span class="label req_id">Request number:</span>
-                                    [% request.id_prefix _ request.illrequest_id %]
+                                    [% request.id_prefix _ request.illrequest_id | html %]
                                 </div>
                                 <div class="notesstaff">
                                     <span class="label notes_staff">Staff notes:</span>
-                                    <pre>[% request.notesstaff %]</pre>
+                                    <pre>[% request.notesstaff | html %]</pre>
                                 </div>
                                 <div class="notesopac">
                                     <span class="label notes_opac">Notes:</span>
                                 </div>
                             </div>
                             <div class="rows">
-                                <h4>Details from supplier ([% request.backend %])</h4>
+                                <h4>Details from supplier ([% request.backend | html %])</h4>
                                 [% FOREACH meta IN request.metadata %]
-                                    <div class="requestmeta-[% meta.key %]">
-                                        <span class="label">[% meta.key %]:</span>
-                                        [% meta.value %]
+                                    <div class="requestmeta-[% meta.key | html %]">
+                                        <span class="label">[% meta.key | html %]:</span>
+                                        [% meta.value | html %]
                                     </div>
                                 [% END %]
                             </div>
                                 <div class="modal-body">
                                     <div id="requestattributes">
                                         [% FOREACH attr IN request.illrequestattributes %]
-                                        <div class="requestattr-[% attr.type %]">
-                                            <span class="label">[% attr.type %]:</span>
-                                            [% attr.value %]
+                                        <div class="requestattr-[% attr.type | html %]">
+                                            <span class="label">[% attr.type | html %]:</span>
+                                            [% attr.value | html %]
                                         </div>
                                             [% END %]
                                     </div>
index 41d2494..30d5a61 100644 (file)
                 [% END %]
 
                 [% IF ( loginprompt ) %]
-                    <h2>Welcome to the Koha [%- Koha.Version.release -%] web installer</h2>
+                    <h2>Welcome to the Koha [%- Koha.Version.release | html -%] web installer</h2>
 
                     <p>Before we begin, please verify you have the correct credentials to continue. Please log in with the username and password given to you by your systems administrator and located in your <code>koha-conf.xml</code> configuration file.</p>
 
-                    <form action="[% url %]" method="post" id="mainform">
+                    <form action="[% url | html %]" method="post" id="mainform">
                         [% FOREACH INPUT IN INPUTS %]
-                            <input type="hidden" name="[% INPUT.name |html %]" value="[% INPUT.value |html %]" />
+                            <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
                         [% END %]
 
                         <fieldset>
@@ -48,7 +48,7 @@
 
                             <div class="form-group">
                                 <label>Username:</label>
-                                <input type="text" class="form-control" name="userid" id="userid" value="[% userid %]" size="20" tabindex="1" />
+                                <input type="text" class="form-control" name="userid" id="userid" value="[% userid | html %]" size="20" tabindex="1" />
                             </div>
                             <div class="form-group">
                                 <label>Password:</label>
index 806f28e..120b45d 100644 (file)
                             [% IF ( installer_languages_loop ) %]
                                 [% FOREACH installer_languages_loo IN installer_languages_loop %]
                                     [% IF ( installer_languages_loo.plural ) %]
-                                        <optgroup label="[% installer_languages_loo.language %]">
+                                        <optgroup label="[% installer_languages_loo.language | html %]">
                                             [% FOREACH sublanguages_loo IN installer_languages_loo.sublanguages_loop %]
-                                                <option value="[% sublanguages_loo.rfc4646_subtag %]">[% IF ( sublanguages_loo.native_description ) %][% sublanguages_loo.native_description %][% ELSE %][% sublanguages_loo.rfc4646_subtag %][% END %]</option>
+                                                <option value="[% sublanguages_loo.rfc4646_subtag | html %]">[% IF ( sublanguages_loo.native_description ) %][% sublanguages_loo.native_description | html %][% ELSE %][% sublanguages_loo.rfc4646_subtag | html %][% END %]</option>
                                             [% END %]
                                         </optgroup>
                                     [% ELSE %]
-                                        <option value="[% installer_languages_loo.rfc4646_subtag %]">[% IF ( installer_languages_loo.native_description ) %][% installer_languages_loo.native_description %][% ELSE %][% installer_languages_loo.rfc4646_subtag %][% END %]</option>
+                                        <option value="[% installer_languages_loo.rfc4646_subtag | html %]">[% IF ( installer_languages_loo.native_description ) %][% installer_languages_loo.native_description | html %][% ELSE %][% installer_languages_loo.rfc4646_subtag | html %][% END %]</option>
                                     [% END %]
                                 [% END %]
                             [% END %]
@@ -57,9 +57,9 @@
                         <p>Some Perl modules are missing. <span class="label label-danger">Important: </span>Required modules must be installed before you may continue.<br />
                         <ul>
                             [% FOREACH missing_module IN missing_modules %]
-                                <li><strong>[% missing_module.name %]</strong> [% IF ( missing_module.require ) %]<span class="label label-danger">Required</span>[% END %]
-                                    <br /> Version: [% missing_module.version %]
-                                    <br /> Usage: [% missing_module.usage %]
+                                <li><strong>[% missing_module.name | html %]</strong> [% IF ( missing_module.require ) %]<span class="label label-danger">Required</span>[% END %]
+                                    <br /> Version: [% missing_module.version | html %]
+                                    <br /> Usage: [% missing_module.usage | html %]
                                 </li>
                             [% END %]
                         </ul>
index 22936a6..f2c64c8 100644 (file)
                 <h2>Web installer &rsaquo; Database settings</h2>
                 <h3>Database settings:</h3>
                 <ul>
-                    <li><em>Database type: </em> [%- dbms | $HtmlTags tag=>'code' -%]</li>
-                    <li><em>Database name: </em> [%- dbname | $HtmlTags tag=>'code' -%]</li>
-                    <li><em>Database host: </em> [%- hostname | $HtmlTags tag=>'code'-%]</li>
-                    <li><em>Database port: </em> [%- port| $HtmlTags tag=>'code' -%] (probably okay if blank)</li>
-                    <li><em>Database user: </em> [%- user | $HtmlTags tag=>'code' -%]</li>
+                    <li><em>Database type: </em> [%- dbms | $HtmlTags tag=>'code' | html -%]</li>
+                    <li><em>Database name: </em> [%- dbname | $HtmlTags tag=>'code' | html -%]</li>
+                    <li><em>Database host: </em> [%- hostname | $HtmlTags tag=>'code' | html -%]</li>
+                    <li><em>Database port: </em> [%- port| $HtmlTags tag=>'code' | html -%] (probably okay if blank)</li>
+                    <li><em>Database user: </em> [%- user | $HtmlTags tag=>'code' | html -%]</li>
                 </ul>
 
                 [% IF ( dbconnection ) %]
                             <div class="alert alert-success" role="alert"><p>Connection established.</p></div>
                             [% IF ( checkdatabasecreated ) %]
                                 <ul>
-                                    <li>Database [% dbname | $HtmlTags tag=>'code'%] exists.</li>
+                                    <li>Database [% dbname | $HtmlTags tag=>'code' | html %] exists.</li>
                                 [% IF ( checkgrantaccess ) %]
-                                    <li>User [% user | $HtmlTags tag=>'code' %]  has all required privileges on database [% dbname | $HtmlTags tag=>'code' %].</li>
+                                    <li>User [% user | $HtmlTags tag=>'code' | html %]  has all required privileges on database [% dbname | $HtmlTags tag=>'code' | html %].</li>
                                     </ul>
                                 [% ELSE %]
                                     </ul>
-                                    <p class="error">User [% user | $HtmlTags tag=>'code' %] doesn't have enough privilege on database [% dbname | $HtmlTags tag=>'code'%].</p>
-                                    <p class="tip">Ask for or make a change in the user's privileges. User [% user | $HtmlTags tag=>'code' %] must have USAGE, INSERT, UPDATE, DELETE, DROP and CREATE privileges on database [% dbname | $HtmlTags tag=>'code' %].</p>
+                                    <p class="error">User [% user | $HtmlTags tag=>'code' | html %] doesn't have enough privilege on database [% dbname | $HtmlTags tag=>'code' | html %].</p>
+                                    <p class="tip">Ask for or make a change in the user's privileges. User [% user | $HtmlTags tag=>'code' | html %] must have USAGE, INSERT, UPDATE, DELETE, DROP and CREATE privileges on database [% dbname | $HtmlTags tag=>'code' | html %].</p>
                                     <p>Need help? See manual for [% IF ( mysql ) %]
                                             <a href="http://dev.mysql.com/doc/refman/4.1/en/grant.html">MySQL</a>
                                         [% ELSE %]
                                     </p>
                                 [% END %]
                             [% ELSE %]
-                                <div class="alert alert-danger" role="alert"><p>No database named [% dbname | $HtmlTags tag=>'code' %] detected.</p></div>
+                                <div class="alert alert-danger" role="alert"><p>No database named [% dbname | $HtmlTags tag=>'code' | html %] detected.</p></div>
                                 <p>Please create the database before continuing.</p>
                             [% END %]
                         [% ELSE %]
-                            <div class="alert alert-warning" role="alert">[% error %] : [% message %]</div>
+                            <div class="alert alert-warning" role="alert">[% error | html %] : [% message | html %]</div>
                             <div class="tip">
                                 <ul>
                                     <li>Check that your database is running.</li>
                                     <li>Check your database settings in [% 'koha-conf.xml' | $HtmlTags Tag=>'code' %].</li>
-                                    <li>Check the hostname setting in [% INCLUDE txt_kohaconf_xml %]. Some database servers require [% '127.0.0.1' | $HtmlTags tag=>'code' %] rather than [% 'localhost' | $HtmlTags tag=>'code' %].</li>
+                                    <li>Check the hostname setting in [% INCLUDE txt_kohaconf_xml %]. Some database servers require [% '127.0.0.1' | $HtmlTags tag=>'code' | html %] rather than [% 'localhost' | $HtmlTags tag=>'code' | html %].</li>
                                 </ul>
                             </div>
                             <p>Please correct these errors. <a href="/cgi-bin/koha/installer/install.pl">Then start the installer again.</a>
index 0657946..402bebd 100644 (file)
@@ -34,7 +34,7 @@
 
 [% IF ( finish ) %]
     [%- metacontent= '10; url=/cgi-bin/koha/installer/onboarding.pl' -%]
-    <meta http-equiv="refresh" content="[% metacontent %]">
+    <meta http-equiv="refresh" content="[% metacontent | html %]">
 [% END %]
 [% INCLUDE 'installer-doc-head-close.inc' %]
 </head>
                         [% FOREACH flavourloo IN flavourloop %]
                             [% IF ( flavourloo.label == "Unimarc") %]
                                  <p>
-                                     <label><input type="radio" name="marcflavour" value="[% flavourloo.code %]" /> [% flavourloo.label %]</label>
+                                     <label><input type="radio" name="marcflavour" value="[% flavourloo.code | html %]" /> [% flavourloo.label | html %]</label>
                                  </p>
                             [% ELSE %]
                                  <p>
-                                     <label><input type="radio" name="marcflavour" value="[% flavourloo.code %]" checked="checked" /> [% flavourloo.label %]</label>
+                                     <label><input type="radio" name="marcflavour" value="[% flavourloo.code | html %]" checked="checked" /> [% flavourloo.label | html %]</label>
                                  </p>
                             [% END %]
                         [% END %]
                         <input type="hidden" name="step" value="3" />
                         <input type="hidden" name="op" value="addframeworks" />
                         [% IF ( frameworksloop ) %]
-                            <h3>MARC frameworks: [% marcflavour %]</h3>
+                            <h3>MARC frameworks: [% marcflavour | html %]</h3>
                             [% IF ( en_marc_frameworks ) %]
                                 <h4><span class="error">No MARC frameworks are available for your language.
                                 Defaulting to the frameworks supplied for English (en)<span></h4>
                             [% END %]
                             [% FOREACH frameworksloo IN frameworksloop %]
-                                <h4>[% frameworksloo.label %]</h4>
+                                <h4>[% frameworksloo.label | html %]</h4>
 
                                 <div class="checkboxes">
 
                                     <p>
-                                        <a class="selectall [% frameworksloo.label FILTER lower %]" href="#">Select all</a>
-                                        <a class="deselectall [% frameworksloo.label FILTER lower %]" href="#">Select none</a>
+                                        <a class="selectall [% frameworksloo.label FILTER lower | html %]" href="#">Select all</a>
+                                        <a class="deselectall [% frameworksloo.label FILTER lower | html %]" href="#">Select none</a>
                                     </p>
 
                                     [% FOREACH framework IN frameworksloo.frameworks %]
                                         <div class="checkbox">
                                             <label>
                                                 [% IF ( framework.checked ) %]
-                                                    <input type="checkbox" name="framework" value="[% framework.fwkfile %]" id ="[%framework.fwkname%]" checked="checked" />
+                                                    <input type="checkbox" name="framework" value="[% framework.fwkfile | html %]" id ="[% framework.fwkname | html %]" checked="checked" />
                                                 [% ELSE %]
-                                                    <input type="checkbox" name="framework" value="[% framework.fwkfile %]" id ="[%framework.fwkname%]" />
+                                                    <input type="checkbox" name="framework" value="[% framework.fwkfile | html %]" id ="[% framework.fwkname | html %]" />
                                                 [% END %]
-                                                [% framework.fwkdescription %]
-                                                <em>([% framework.fwkname %])</em>
+                                                [% framework.fwkdescription | html %]
+                                                <em>([% framework.fwkname | html %])</em>
                                             </label>
                                         </div>
                                         <hr />
                         [% END %]
 
                         [% FOREACH levelloo IN levelloop %]
-                            <h4>[% levelloo.label %]</h4>
+                            <h4>[% levelloo.label | html %]</h4>
 
                             <div class="checkboxes">
 
                                 <p>
-                                    <a class="selectall [% levelloo.label FILTER lower %]" href="#">Select all</a>
-                                    <a class="deselectall [% levelloo.label FILTER lower %]" href="#">Select none</a>
+                                    <a class="selectall [% levelloo.label FILTER lower | html %]" href="#">Select all</a>
+                                    <a class="deselectall [% levelloo.label FILTER lower | html %]" href="#">Select none</a>
                                 </p>
 
                                 [% FOREACH framework IN levelloo.frameworks %]
                                     <div class="checkbox">
-                                        <label for="[% framework.fwkname %]">
+                                        <label for="[% framework.fwkname | html %]">
                                             [% IF ( framework.checked ) %]
-                                                <input type="checkbox" name="framework" value="[%framework.fwkfile %]" id="[%framework.fwkname%]" checked="checked" />
+                                                <input type="checkbox" name="framework" value="[% framework.fwkfile | html %]" id="[% framework.fwkname | html %]" checked="checked" />
                                             [% ELSE %]
-                                                <input type="checkbox" name="framework" value="[%framework.fwkfile %]" id="[%framework.fwkname%]" />
+                                                <input type="checkbox" name="framework" value="[% framework.fwkfile | html %]" id="[% framework.fwkname | html %]" />
                                             [% END %]
-                                            [% framework.fwkdescription %]
-                                            <em>([% framework.fwkname %])</em>
+                                            [% framework.fwkdescription | html %]
+                                            <em>([% framework.fwkname | html %])</em>
                                         </label>
                                     </div> <!-- /div.checkbox -->
                                 [% END # / FOREACH framework %]
                         [% ELSIF lis.level == 'mysql' %]
                             <h3>MySQL data added</h3>
                         [% ELSE %]
-                            <h3>[% lis.level FILTER ucfirst %] data added</h3>
+                            <h3>[% lis.level FILTER ucfirst | html %] data added</h3>
                         [% END %]
                         <ul>
                             [% FOREACH fwklis IN lis.fwklist %]
                             <li>
-                                [% fwklis.fwkname %]
-                                [% IF ( fwklis.error ) %]<p class="bg-danger">[% fwklis.error %]</p>[% END %]
+                                [% fwklis.fwkname | html %]
+                                [% IF ( fwklis.error ) %]<p class="bg-danger">[% fwklis.error | html %]</p>[% END %]
                             </li>
                             [% END %]
                         </ul>
                 [% IF ( importdatastructure ) %]
                     [% IF ( error ) %]
                         <p>The following error occurred while importing the database structure:</p>
-                        <div class="alert alert-warning"><p>[% error %] </p></div>
+                        <div class="alert alert-warning"><p>[% error | html %] </p></div>
                         <p>Please contact your system administrator</p>
                     [% ELSE %]
                         <h2>Web installer &rsaquo; Success</h2>
                 [% IF ( default ) %]
                     [% IF ( upgrading ) %]
                         <h2>Web installer &rsaquo; Update database</h2>
-                        <p>We are upgrading from Koha [% dbversion %] to [% kohaversion %]</p>
+                        <p>We are upgrading from Koha [% dbversion | html %] to [% kohaversion | html %]</p>
                         <p><a href="install.pl?step=3&amp;op=updatestructure" class="btn btn-primary">Update your database</a></p>
                     [% ELSE %]
                         <h2>Web installer &rsaquo; Install basic configuration settings</h2>
                         <p>Update report :</p>
                         <ul>
                             [% FOREACH update_repor IN update_report %]
-                                <li>[% update_repor.line |html %]</li>
+                                <li>[% update_repor.line | html %]</li>
                             [% END %]
                         </ul>
                     [% END %]
                         <p>Update errors :</p>
                         <ul>
                             [% FOREACH update_error IN update_errors %]
-                                <li class="update_error">[% update_error.line |html %]</li>
+                                <li class="update_error">[% update_error.line | html %]</li>
                             [% END %]
                         </ul>
                     [% END %]
index 210cc6e..d6d2022 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha staff client</title>
-[% Asset.css("css/mainpage.css") %]
+[% Asset.css("css/mainpage.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="main_intranet-main" class="intranet-main">
                         <h3><span class="news_title">News</span></h3>
                         [% SET newsdisp = Koha.Preference('NewsAuthorDisplay') %]
                         [% FOREACH koha_new IN koha_news %]
-                            <div class="newsitem" id="news[% koha_new.idnew %]"><h4>[% koha_new.title %]</h4>
-                                <div class="newsbody">[% koha_new.content %]</div>
-                                <p class="newsfooter"> Posted on [% koha_new.newdate %][% IF( ( newsdisp == 'staff' || newsdisp == 'both' ) && koha_new.borrowernumber ) %] by <span class="newsauthor_title">[% koha_new.author_title %] </span>[% koha_new.author_firstname %] [% koha_new.author_surname %]<br />[% END %]
+                            <div class="newsitem" id="news[% koha_new.idnew | html %]"><h4>[% koha_new.title | html %]</h4>
+                                <div class="newsbody">[% koha_new.content | $raw %]</div>
+                                <p class="newsfooter"> Posted on [% koha_new.newdate | html %][% IF( ( newsdisp == 'staff' || newsdisp == 'both' ) && koha_new.borrowernumber ) %] by <span class="newsauthor_title">[% koha_new.author_title | html %] </span>[% koha_new.author_firstname | html %] [% koha_new.author_surname | html %]<br />[% END %]
                                     [% IF ( CAN_user_tools ) %]
-                                        <a href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;id=[% koha_new.idnew %]">Edit</a>
-                                         | <a class="news_delete" href="/cgi-bin/koha/tools/koha-news.pl?op=del&amp;ids=[% koha_new.idnew %]">Delete</a>
+                                        <a href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;id=[% koha_new.idnew | html %]">Edit</a>
+                                         | <a class="news_delete" href="/cgi-bin/koha/tools/koha-news.pl?op=del&amp;ids=[% koha_new.idnew | html %]">Delete</a>
                                          | <a href="/cgi-bin/koha/tools/koha-news.pl?op=add_form">New</a>
                                     [% END %]
                                 </p>
                                 <div class="pending-info" id="article_requests_pending">
 
                                     <a href="/cgi-bin/koha/circ/article-requests.pl">Article requests</a>:
-                                    <span class="pending-number-link">[% pending_article_requests %]</span>
+                                    <span class="pending-number-link">[% pending_article_requests | html %]</span>
                                 </div>
                                 [% END %]
 
                                 <div class="pending-info" id="suggestions_pending">
 
                                     <a href="/cgi-bin/koha/suggestion/suggestion.pl#ASKED">Suggestions pending approval</a>:
-                                    <span class="pending-number-link">[% pendingsuggestions %]</span>
+                                    <span class="pending-number-link">[% pendingsuggestions | html %]</span>
                                 </div>
                                 [% END %]
 
                                 [% IF ( CAN_user_tools_moderate_comments  && pendingcomments ) %]
                                 <div class="pending-info" id="comments_pending">
                                     <a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments pending approval</a>:
-                                    <span class="pending-number-link">[% pendingcomments %]</span>
+                                    <span class="pending-number-link">[% pendingcomments | html %]</span>
                                 </div>
                                 [% END %]
 
                                 [% IF ( CAN_user_tools_moderate_tags && pendingtags ) %]
                                 <div class="pending-info" id="tags_pending">
                                     <a href="/cgi-bin/koha/tags/review.pl">Tags pending approval</a>:
-                                    <span class="pending-number-link">[% pendingtags %]</span>
+                                    <span class="pending-number-link">[% pendingtags | html %]</span>
                                 </div>
                                 [% END %]
 
                                 [% IF ( CAN_user_borrowers_edit_borrowers && pending_borrower_modifications ) %]
                                 <div class="pending-info" id="patron_updates_pending">
                                     <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
-                                    <span class="pending-number-link">[% pending_borrower_modifications %]</span>
+                                    <span class="pending-number-link">[% pending_borrower_modifications | html %]</span>
                                 </div>
                                 [% END %]
 
                                 [% IF CAN_user_borrowers_edit_borrowers && pending_discharge_requests %]
                                 <div class="pending-info" id="patron_discharges_pending">
                                     <a href="/cgi-bin/koha/members/discharges.pl">Discharge requests pending</a>:
-                                    <span class="pending-number-link">[% pending_discharge_requests %]</span>
+                                    <span class="pending-number-link">[% pending_discharge_requests | html %]</span>
                                 </div>
                                 [% END %]
 
                                 [% IF Koha.Preference('AllowCheckoutNotes') && CAN_user_circulate_manage_checkout_notes && pending_checkout_notes.count %]
                                     <div class="pending-info" id="checkout_notes_pending">
                                         <a href="/cgi-bin/koha/circ/checkout-notes.pl">Checkout notes pending</a>:
-                                        <span class="pending-number-link">[% pending_checkout_notes.count %]</span>
+                                        <span class="pending-number-link">[% pending_checkout_notes.count | html %]</span>
                                     </div>
                                 [% END %]
 
                         <div class="col-sm-12">
                             <div id="area-userblock">
                                 <div class="user-info">
-                                    [% IntranetmainUserblock %]
+                                    [% IntranetmainUserblock | $raw %]
                                 </div>
                             </div>
                         </div>
index 131f085..7082b27 100644 (file)
                <h2>Search on</h2>
                <p>
                        <label for="category">Name or ISSN: </label>
-                       [% category %]
+                       [% category | html %]
                </p>
                <p>
                        <label for="index">Search value: </label>
-                       <input type="text" name="value" value="[% value %]" />
-                       <input type="hidden" name="authtypecode" value="[% category %]" />
+                       <input type="text" name="value" value="[% value | html %]" />
+                       <input type="hidden" name="authtypecode" value="[% category | html %]" />
                        <input type="hidden" name="marclist" value="" />
                        <input type="hidden" name="and_or" value="and" />
                        <input type="hidden" name="excluding" value="" />
                        <input type="hidden" name="operator" value="contains" />
-                       <input type="hidden" id="index" name="index" value="[% index %]" />
+                       <input type="hidden" id="index" name="index" value="[% index | html %]" />
                </p>
                <p>
                        <input type="submit" value="Start search" class="submit" />
index 3422d3a..a68da33 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE ItemTypes %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Batches &rsaquo; [% IF batch_id %]Edit ([% batch_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Batches &rsaquo; [% IF batch_id %]Edit ([% batch_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="labels_label-edit-batch" class="tools labels" onload="dofocus();">
@@ -16,7 +17,7 @@
         <a href="/cgi-bin/koha/labels/label-home.pl">Label creator</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-manage.pl?label_element=batch">Batches</a> &rsaquo;
         [% IF batch_id %]
-            Edit ([% batch_id %])
+            Edit ([% batch_id | html %])
         [% ELSE %]
             New
         [% END %]
                             [% BLOCK xlate_errtype %]
                             [%    SWITCH errtype %]
                             [%       CASE 'ITEM_NOT_REMOVED' %]
-                            <span>Item(s) not removed from batch [% batch_id %].</span>
+                            <span>Item(s) not removed from batch [% batch_id | html %].</span>
                             [%       CASE 'BATCH_NOT_DELETED' %]
-                            <span>Batch [% batch_id %] was not deleted.</span>
+                            <span>Batch [% batch_id | html %] was not deleted.</span>
                             [%       CASE 'ITEM_NOT_ADDED' %]
-                            <span>Item(s) not added to batch [% batch_id %].</span>
+                            <span>Item(s) not added to batch [% batch_id | html %].</span>
                             [%       CASE 'BRANCH_NOT_SET' %]
                             <span>Library is not set, please set your library before adding items to a batch.</span>
                             [%       CASE 'BATCH_NOT_DEDUP' %]
-                            <span>Batch [% batch_id %] not fully de-duplicated.</span>
+                            <span>Batch [% batch_id | html %] not fully de-duplicated.</span>
                             [%       CASE %]
-                            <span>Unknown error type [% errtype %].</span>
+                            <span>Unknown error type [% errtype | html %].</span>
                             [%    END %]
                             [% END %]
                             <div class="dialog alert">
                             </div>
                         [% ELSIF ( duplicate_message ) %]
                             <div class="dialog message">
-                                <strong>Duplicate item(s) removed from batch number [% batch_id %]: [% duplicate_count %]</strong>
+                                <strong>Duplicate item(s) removed from batch number [% batch_id | html %]: [% duplicate_count | html %]</strong>
                             </div>
                         [% END %]
 
                         <div id="manage-label-batches">
-                            <div class="hint">Current library: [% LoginBranchname %]</div>
+                            <div class="hint">Current library: [% LoginBranchname | html %]</div>
                             <form name="add_by_number" action="/cgi-bin/koha/labels/label-edit-batch.pl" method="post">
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li>
                                         <input type="hidden" name="op" value="add" />
-                                        <input type="hidden" name="batch_id" value="[% batch_id %]" />
+                                        <input type="hidden" name="batch_id" value="[% batch_id | html %]" />
                                     </li>
                                     <li>
                                         <input type="radio" name="number_type" id="barcode_enter" value="barcode" checked />
@@ -89,7 +90,7 @@
                             </div>
                             [% IF ( table_loop ) %]
                                 <form name="items" class="checkboxed">
-                                    <h2>Items in batch number [% batch_id %]</h2>
+                                    <h2>Items in batch number [% batch_id | html %]</h2>
                                     <table id="batcht">
                                         [% FOREACH table_loo IN table_loop %]
                                             [% IF ( table_loo.header_fields ) %]
                                                                 [% CASE "Select" -%]
                                                                     <th>Select</th>
                                                                 [% CASE %]
-                                                                    <th>[% header_field.field_label %]</th>
+                                                                    <th>[% header_field.field_label | html %]</th>
                                                             [% END -%]
                                                         [% END %]
                                                     </tr>
                                                             [% IF ( text_field.select_field ) %]
                                                                 <td>
                                                                     <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/labels/label-edit-batch.pl?op=remove&amp;batch_id=[% batch_id |url %]&amp;label_id=[% text_field.field_value |url %]"><i class="fa fa-trash"></i> Delete</a>
-                                                                    <a class="btn btn-default btn-xs export" href="#" data-batch-id="[% batch_id %]" data-label-id="[% text_field.field_value |html %]"><i class="fa fa-share-square-o"></i> Export</a>
+                                                                    <a class="btn btn-default btn-xs export" href="#" data-batch-id="[% batch_id | html %]" data-label-id="[% text_field.field_value | html %]"><i class="fa fa-share-square-o"></i> Export</a>
                                                                 </td>
-                                                                <td><input type="checkbox" name="action" value="[% text_field.field_value %]"></td>
+                                                                <td><input type="checkbox" name="action" value="[% text_field.field_value | html %]"></td>
                                                             [% ELSE %]
                                                                 <td>
                                                                     [% IF ( text_field.field_name == '_item_type_tbl' ) %]
-                                                                        [% ItemTypes.GetDescription( text_field.field_value ) %]
+                                                                        [% ItemTypes.GetDescription( text_field.field_value ) | html %]
                                                                     [% ELSE %]
-                                                                        [% text_field.field_value %]
+                                                                        [% text_field.field_value | html %]
                                                                     [% END %]
                                                                 </td>
                                                             [% END %]
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'greybox.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script>
         function DeleteConfirm() {
-            var msg = _("Are you sure you want to delete batch %s?").format("[% batch_id %]");
+            var msg = _("Are you sure you want to delete batch %s?").format("[% batch_id | html %]");
             var answer = confirm(msg);
             if (answer) {
-                window.location = "/cgi-bin/koha/labels/label-manage.pl?op=delete&amp;label_element=batch&amp;element_id=[% batch_id %]";
+                window.location = "/cgi-bin/koha/labels/label-manage.pl?op=delete&amp;label_element=batch&amp;element_id=[% batch_id | html %]";
             }
             else {
                 return; // abort delete
             }
             var answer = confirm(msg);
             if (answer) {
-                window.location = "/cgi-bin/koha/labels/label-edit-batch.pl?op=remove&amp;batch_id=[% batch_id %]&amp;" + getstr;
+                window.location = "/cgi-bin/koha/labels/label-edit-batch.pl?op=remove&amp;batch_id=[% batch_id | html %]&amp;" + getstr;
             } else {
                 return; // abort delete
             }
         function Add() {
             var number_list = document.getElementById("number_list");
             if (number_list.value == '') {
-                window.open("/cgi-bin/koha/labels/label-item-search.pl?batch_id=[% batch_id %]&amp;type=labels",'FindABibIndex','width=875,height=400,toolbar=no,scrollbars=yes');
+                window.open("/cgi-bin/koha/labels/label-item-search.pl?batch_id=[% batch_id | html %]&amp;type=labels",'FindABibIndex','width=875,height=400,toolbar=no,scrollbars=yes');
             } else {
                 document.forms["add_by_number"].submit();
             }
         }
 
         function DeDuplicate() {
-            window.location = "/cgi-bin/koha/labels/label-edit-batch.pl?op=de_duplicate&amp;batch_id=[% batch_id %]";
+            window.location = "/cgi-bin/koha/labels/label-edit-batch.pl?op=de_duplicate&amp;batch_id=[% batch_id | html %]";
         }
 
         function Xport(mode) {
                     alert(_("Please select at least one label to export."));
                     return;     // no batch selected
                 }
-                return GB_showCenter(_("Export labels"), "/cgi-bin/koha/labels/label-print.pl?batch_id=[% batch_id %]&" + getstr, 400, 800);
+                return GB_showCenter(_("Export labels"), "/cgi-bin/koha/labels/label-print.pl?batch_id=[% batch_id | html %]&" + getstr, 400, 800);
             } else if (mode == 'batch') {
-                return GB_showCenter(_("Export labels"), "/cgi-bin/koha/labels/label-print.pl?batch_id=[% batch_id %]", 400, 800);
+                return GB_showCenter(_("Export labels"), "/cgi-bin/koha/labels/label-print.pl?batch_id=[% batch_id | html %]", 400, 800);
             } else {
                 // some pass-thru error trapping just in case...
             }
index c1ae3e0..b7a42e8 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% SET footerjs = 1 %]
 [% BLOCK translate_label_types %]
 [%  SWITCH type %]
@@ -9,7 +10,7 @@
 [%  END %]
 [% END %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Layouts &rsaquo; [% IF ( layout_id ) %]Edit ([% layout_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Layouts &rsaquo; [% IF ( layout_id ) %]Edit ([% layout_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -28,7 +29,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-home.pl">Label creator</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-manage.pl?label_element=layout">Layouts</a> &rsaquo;
-        [% IF ( layout_id ) %]Edit ([% layout_id %])[% ELSE %]New[% END %]
+        [% IF ( layout_id ) %]Edit ([% layout_id | html %])[% ELSE %]New[% END %]
     </div>
 
     <div class="main container-fluid">
                             <ol>
                                 <li>
                                     <label for="layout_name">Layout name: </label>
-                                    <input type="text" name="layout_name" id="layout_name" size="20" value="[% layout_name %]" />
+                                    <input type="text" name="layout_name" id="layout_name" size="20" value="[% layout_name | html %]" />
                                 </li>
                                 <li>
                                     <label for="barcode_type">Choose barcode type (encoding): </label>
                                     <select name="barcode_type" id="barcode_type">
                                     [% FOREACH barcode_type IN barcode_types %]
                                     [% IF ( barcode_type.selected ) %]
-                                    <option value="[% barcode_type.type %]" selected="selected">[% barcode_type.name %]</option>
+                                    <option value="[% barcode_type.type | html %]" selected="selected">[% barcode_type.name | html %]</option>
                                     [% ELSE %]
-                                    <option value="[% barcode_type.type %]">[% barcode_type.name %]</option>
+                                    <option value="[% barcode_type.type | html %]">[% barcode_type.name | html %]</option>
                                     [% END %]
                                     [% END %]
                                     </select>
@@ -63,9 +64,9 @@
                                     <select name="printing_type" id="printing_type">
                                     [% FOREACH label_type IN label_types %]
                                     [% IF ( label_type.selected ) %]
-                                    <option value="[% label_type.type %]" selected="selected">[% PROCESS translate_label_types type=label_type.type %]</option>
+                                    <option value="[% label_type.type | html %]" selected="selected">[% PROCESS translate_label_types type=label_type.type %]</option>
                                     [% ELSE %]
-                                    <option value="[% label_type.type %]">[% PROCESS translate_label_types type=label_type.type %]</option>
+                                    <option value="[% label_type.type | html %]">[% PROCESS translate_label_types type=label_type.type %]</option>
                                     [% END %]
                                     [% END %]
                                     </select>
                                                                                                <div id="layout_table">
                                                     <p>
                                             [% FOREACH text_field IN fields %]
-                                                        <select name="[% text_field.field_name %]" id="[% text_field.field_name |url %]">
+                                                        <select name="[% text_field.field_name | html %]" id="[% text_field.field_name |url %]">
                                                             <option value=""></option>
                                                             [% FOREACH orde IN [1..field_count] %]
                                                                 [% IF ( orde == text_field.order ) %]
-                                                            <option value="[% orde %]" selected="1">[% orde %]</option>
+                                                            <option value="[% orde | html %]" selected="1">[% orde | html %]</option>
                                                                 [% ELSE %]
-                                                            <option value="[% orde %]">[% orde %]</option>
+                                                            <option value="[% orde | html %]">[% orde | html %]</option>
                                                                 [% END %]
                                                             [% END %]
-                                                        </select>&nbsp;<label for="[% text_field.field_name |url %]">[% text_field.field_label %]</label>
+                                                        </select>&nbsp;<label for="[% text_field.field_name |url %]">[% text_field.field_label | html %]</label>
 
                                                         &nbsp;&nbsp;
 
                                             [% END %]
                                            <li> <fieldset id="layout_string" class="brief">
                                                 <label for="format_string">Data fields</label>
-                                                <input type="text" name="format_string" id="format_string" size="80" value="[% format_string |html %]" />
+                                                <input type="text" name="format_string" id="format_string" size="80" value="[% format_string | html %]" />
                                                 <div class="hint">
                                                     <p>Enter a comma separated list of fields to print.  You may include any <em>Koha field</em> or MARC subfield.</p>
                                                     <p>See online help for advanced options</p>
                                     <select name="text_justify" id="text_justify">
                                         [% FOREACH text_justification_type IN text_justification_types %]
                                         [% IF ( text_justification_type.selected ) %]
-                                        <option value="[% text_justification_type.type %]" selected="selected">[% PROCESS translate_justification_types type=text_justification_type.type %]</option>
+                                        <option value="[% text_justification_type.type | html %]" selected="selected">[% PROCESS translate_justification_types type=text_justification_type.type %]</option>
                                         [% ELSE %]
-                                        <option value="[% text_justification_type.type %]">[% PROCESS translate_justification_types type=text_justification_type.type %]</option>
+                                        <option value="[% text_justification_type.type | html %]">[% PROCESS translate_justification_types type=text_justification_type.type %]</option>
                                         [% END %]
                                         [% END %]
                                     </select>
                                     <select name="font" id="font">
                                         [% FOREACH font_type IN font_types %]
                                         [% IF ( font_type.selected ) %]
-                                        <option value="[% font_type.type %]" selected="selected">[% font_type.name %]</option>
+                                        <option value="[% font_type.type | html %]" selected="selected">[% font_type.name | html %]</option>
                                         [% ELSE %]
-                                        <option value="[% font_type.type %]">[% font_type.name %]</option>
+                                        <option value="[% font_type.type | html %]">[% font_type.name | html %]</option>
                                         [% END %]
                                         [% END %]
                                     </select>
                                 </li>
                                 <li>
                                     <label for="font_size">Font size: </label>
-                                    <input type="text" name="font_size" id="font_size" size="2" value="[% font_size |html %]" />
+                                    <input type="text" name="font_size" id="font_size" size="2" value="[% font_size | html %]" />
                                 </li>
                                 <li>
                                     <label for="oblique_title">Oblique title: </label>
                             <input type="submit" value="Save" />
                             <a class="cancel" href="/cgi-bin/koha/labels/label-manage.pl?label_element=layout">Cancel</a>
                             <input type="hidden" name="op" value="save" />
-                            <input type="hidden" name="layout_id" value="[% layout_id %]" />
+                            <input type="hidden" name="layout_id" value="[% layout_id | html %]" />
                         </fieldset>
                     </form>
             </main>
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script>
         $(document).ready(function() {
             $("input[name='layout_choice']").change( function() { layout_method() } );
index 944d736..1fc6f59 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Profiles &rsaquo; [% IF ( profile_id ) %]Edit ([% profile_id %])[% ELSE %]New[% END%]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Profiles &rsaquo; [% IF ( profile_id ) %]Edit ([% profile_id | html %])[% ELSE %]New[% END%]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-home.pl">Label creator</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-manage.pl?label_element=profile">Profiles</a> &rsaquo;
-        [% IF ( profile_id ) %]Edit ([% profile_id %])[% ELSE %]New[% END%]
+        [% IF ( profile_id ) %]Edit ([% profile_id | html %])[% ELSE %]New[% END%]
     </div>
 
     <div class="main container-fluid">
                                         <ol>
                                             <li>
                                                 [% IF ( profile_id ) %]
-                                                 <span class="label">Printer name:</span>[% printer_name %]
-                                                <input type="hidden" name="printer_name" value="[% printer_name %]" />
+                                                 <span class="label">Printer name:</span>[% printer_name | html %]
+                                                <input type="hidden" name="printer_name" value="[% printer_name | html %]" />
                                                 [% ELSE %]
                                                 <label for="printer_name">Printer name:</label><input type="text"  size="20" name="printer_name" id="printer_name" />
                                                 [% END %]
                                             </li>
                                             <li>
                                                 [% IF ( profile_id ) %]
-                                                                                               <span class="label">Paper bin:</span> [% paper_bin %]
-                                                <input type="hidden" name="paper_bin" value="[% paper_bin %]" />
+                                                                                               <span class="label">Paper bin:</span> [% paper_bin | html %]
+                                                <input type="hidden" name="paper_bin" value="[% paper_bin | html %]" />
                                                 [% ELSE %]
                                                 <label for="paper_bin">Paper bin:</label><input type="text"  size="20" name="paper_bin" id="paper_bin" />
                                                 [% END %]
                                             </li>
                                             <li>
                                                 [% IF ( label_template ) %]
-                                                 <label for="template_name">Template name:</label> [% label_template %]
+                                                 <label for="template_name">Template name:</label> [% label_template | html %]
                                                 [% ELSE %]
                                                  <span class="label">Template name:</span> Profile unassigned
                                                 [% END %]
@@ -53,9 +54,9 @@
                                                 <select id="units" name="units">
                                                     [% FOREACH unit IN units %]
                                                     [% IF ( unit.selected ) %]
-                                                    <option value="[% unit.type %]" selected="selected">
+                                                    <option value="[% unit.type | html %]" selected="selected">
                                                     [% ELSE %]
-                                                    <option value="[% unit.type %]">
+                                                    <option value="[% unit.type | html %]">
                                                     [% END %]
                                                     [% SWITCH unit.type %]
                                                     [%   CASE 'POINT' %]
                                                                                <fieldset class="rows"><legend>Offset:</legend>
                                                                                <ol>
                                             <li>
-                                                <label for="offset_horz">Horizontal: </label><input type="text"  size="4" name="offset_horz" id="offset_horz" value="[% offset_horz %]" />
+                                                <label for="offset_horz">Horizontal: </label><input type="text"  size="4" name="offset_horz" id="offset_horz" value="[% offset_horz | html %]" />
                                             </li>
                                             <li>
-                                                <label for="offset_vert">Vertical: </label><input type="text" size="4" name="offset_vert" id="offset_vert" value="[% offset_vert %]" />
+                                                <label for="offset_vert">Vertical: </label><input type="text" size="4" name="offset_vert" id="offset_vert" value="[% offset_vert | html %]" />
                                             </li>
                                          </ol>
                                                                                </fieldset>
                                                                                <fieldset class="rows"><legend>Creep:</legend>
                                                                                <ol>
                                             <li>
-                                                <label for="creep_horz">Horizontal: </label><input type="text"  size="4" name="creep_horz" id="creep_horz" value="[% creep_horz %]" />
+                                                <label for="creep_horz">Horizontal: </label><input type="text"  size="4" name="creep_horz" id="creep_horz" value="[% creep_horz | html %]" />
                                             </li>
                                             <li>
-                                                <label for="creep_vert">Vertical: </label><input type="text" size="4" name="creep_vert" id="creep_vert" value="[% creep_vert %]" />
+                                                <label for="creep_vert">Vertical: </label><input type="text" size="4" name="creep_vert" id="creep_vert" value="[% creep_vert | html %]" />
                                             </li>
                                         </ol>
                                     </fieldset>
                                         <input type="submit" value="Save" />
                                         <a href="/cgi-bin/koha/labels/label-manage.pl?label_element=profile" class="cancel">Cancel</a>
                                         <input type="hidden" name="op" value="save" />
-                                        <input type="hidden" name="profile_id" value="[% profile_id %]" />
+                                        <input type="hidden" name="profile_id" value="[% profile_id | html %]" />
                                     </fieldset>
                     </form>
 
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script>
         $(document).ready(function(){
             var selectedUnit = $("#units option:selected").attr("value");
index 75a3567..04ecc26 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Templates &rsaquo; [% IF ( template_id ) %]Edit ([% template_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Templates &rsaquo; [% IF ( template_id ) %]Edit ([% template_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-home.pl">Label creator</a> &rsaquo;
         <a href="/cgi-bin/koha/labels/label-manage.pl?label_element=template">Templates</a> &rsaquo;
-        [% IF ( template_id ) %]Edit ([% template_id %])[% ELSE %]New[% END %]
+        [% IF ( template_id ) %]Edit ([% template_id | html %])[% ELSE %]New[% END %]
     </div>
 
     <div class="main container-fluid">
                             <fieldset class="rows">
                                 <ol>
                                     <li>
-                                        <span class="label">Template ID:</span>[% IF ( template_id ) %][% template_id %][% ELSE %]N/A[% END %]
+                                        <span class="label">Template ID:</span>[% IF ( template_id ) %][% template_id | html %][% ELSE %]N/A[% END %]
                                     </li>
                                     <li>
                                         <label for="template_code">Template code:</label>
-                                        <input type="text" size="30" maxlength="43" name="template_code" id="template_code" value="[% template_code %]" />
+                                        <input type="text" size="30" maxlength="43" name="template_code" id="template_code" value="[% template_code | html %]" />
                                     </li>
                                     <li>
                                         <label for="template_desc">Template description:</label>
-                                        <textarea cols="30" rows="3" id="template_desc" name="template_desc">[% template_desc %]</textarea>
+                                        <textarea cols="30" rows="3" id="template_desc" name="template_desc">[% template_desc | html %]</textarea>
                                     </li>
                                                                        <li>
                                  <label for="units">Units:</label>
                                  <select id="units" name="units">
                                  [% FOREACH unit IN units %]
                                      [% IF ( unit.selected ) %]
-                                     <option value="[% unit.type %]" selected="selected">
+                                     <option value="[% unit.type | html %]" selected="selected">
                                      [% ELSE %]
-                                     <option value="[% unit.type %]">
+                                     <option value="[% unit.type | html %]">
                                      [% END %]
 
                                      [% SWITCH unit.type %]
                              </li>
                                     <li>
                                         <label for="page_height">Page height:</label>
-                                        <input type="text" size="4" name="page_height" id="page_height" value="[% page_height %]" />
+                                        <input type="text" size="4" name="page_height" id="page_height" value="[% page_height | html %]" />
                                     </li>
                                     <li>
                                         <label for="page_width">Page width:</label>
-                                        <input type="text" size="4" name="page_width" id="page_width" value="[% page_width %]" />
+                                        <input type="text" size="4" name="page_width" id="page_width" value="[% page_width | html %]" />
                                     </li>
                                     <li>
                                         <label for="label_width">Label width:</label>
-                                        <input type="text" size="4" name="label_width" id="label_width" value="[% label_width %]" />
+                                        <input type="text" size="4" name="label_width" id="label_width" value="[% label_width | html %]" />
                                     </li>
                                     <li>
                                         <label for="label_height">Label height:</label>
-                                        <input type="text" size="4" name="label_height" id="label_height" value="[% label_height %]" />
+                                        <input type="text" size="4" name="label_height" id="label_height" value="[% label_height | html %]" />
                                     </li>
 
                                 </ol>
                             <fieldset class="rows">
                                 <ol><li>
                                     <label for="top_margin">Top page margin:</label>
-                                    <input type="text" size="4" name="top_margin" id="top_margin" value="[% top_margin %]" />
+                                    <input type="text" size="4" name="top_margin" id="top_margin" value="[% top_margin | html %]" />
                                 </li>
                                 <li>
                                     <label for="left_margin">Left page margin:</label>
-                                    <input type="text" size="4" name="left_margin" id="left_margin" value="[% left_margin %]" />
+                                    <input type="text" size="4" name="left_margin" id="left_margin" value="[% left_margin | html %]" />
                                 </li>
                                     <li>
                                         <label for="top_text_margin">Top text margin:</label>
-                                        <input type="text" size="4" name="top_text_margin" id="top_text_margin" value="[% top_text_margin %]" />
+                                        <input type="text" size="4" name="top_text_margin" id="top_text_margin" value="[% top_text_margin | html %]" />
                                     </li>
                                     <li>
                                         <label for="left_text_margin">Left text margin:</label>
-                                        <input type="text" size="4" name="left_text_margin" id="left_text_margin" value="[% left_text_margin %]" />
+                                        <input type="text" size="4" name="left_text_margin" id="left_text_margin" value="[% left_text_margin | html %]" />
                                     </li>
                                     <li>
                                         <label for="cols">Number of columns:</label>
-                                        <input type="text" size="4" name="cols" id="cols" value="[% cols %]" />
+                                        <input type="text" size="4" name="cols" id="cols" value="[% cols | html %]" />
                                     </li>
                                     <li>
                                         <label for="rows">Number of rows:</label>
-                                        <input type="text" size="4" name="rows" id="rows" value="[% rows %]" />
+                                        <input type="text" size="4" name="rows" id="rows" value="[% rows | html %]" />
                                     </li>
                                     <li>
                                         <label for="col_gap">Gap between columns:</label>
-                                        <input type="text" size="4" name="col_gap" id="col_gap" value="[% col_gap %]" />
+                                        <input type="text" size="4" name="col_gap" id="col_gap" value="[% col_gap | html %]" />
                                     </li>
                                     <li>
                                         <label for="row_gap">Gap between rows:</label>
-                                        <input type="text" size="4" name="row_gap" id="row_gap" value="[% row_gap %]" />
+                                        <input type="text" size="4" name="row_gap" id="row_gap" value="[% row_gap | html %]" />
                                     </li>
 
                                     <li>
                                         <select id="profile_id" name="profile_id">
                                         [% FOREACH profile_lis IN profile_list %]
 [% IF ( profile_lis.selected ) %]
-<option value="[% profile_lis.profile_id %]" selected="selected">
+<option value="[% profile_lis.profile_id | html %]" selected="selected">
 [% ELSE %]
-<option value="[% profile_lis.profile_id %]">
+<option value="[% profile_lis.profile_id | html %]">
 [% END %]
-                                        [% profile_lis.printer_name %]/[% profile_lis.paper_bin %]
+                                        [% profile_lis.printer_name | html %]/[% profile_lis.paper_bin | html %]
                                         </option>
                                         [% END %]
                                         </select>
                             <input type="submit" class="submit" value="Save" /><a class="cancel" href="/cgi-bin/koha/labels/label-manage.pl?label_element=template">Cancel</a>
                             <input type="hidden" name="op" value="save" />
                             [% IF ( template_id ) %]
-                            <input type="hidden" name="template_id" value="[% template_id %]" />
+                            <input type="hidden" name="template_id" value="[% template_id | html %]" />
                             [% END %]
                         </fieldset>
                 </form>
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script>
         $(document).ready(function(){
             var selectedUnit = $("#units option:selected").attr("value");
index 4bf1aae..eb5b9f3 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Label creator</title>
     [% INCLUDE 'doc-head-close.inc' %]
     [% IF ( bidi ) %]
-    [% Asset.css("css/right-to-left.css") %]
+    [% Asset.css("css/right-to-left.css") | $raw %]
     [% END %]
 </head>
 <body id="labels_label-home" class="tools labels">
@@ -32,7 +33,7 @@
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 3dd7899..a0c14c0 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% BLOCK translate_label_element %]
@@ -15,7 +16,7 @@
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; [% PROCESS translate_label_element element=label_element_title %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="labels_label-manage" class="tools labels">
 
                         [% IF ( error ) %]
                             <div class="dialog alert">
-                                <strong>WARNING:</strong> An error was encountered and the [% op %] operation for [% label_element %] [% element_id %] was not completed. Please have your system administrator check the error log for details.
+                                <strong>WARNING:</strong> An error was encountered and the [% op | html %] operation for [% label_element | html %] [% element_id | html %] was not completed. Please have your system administrator check the error log for details.
                             </div>
                         [% END %]
 
                         <div id="manage-label-layouts">
-                            <div class="hint">Current library: [% LoginBranchname %]</div>
+                            <div class="hint">Current library: [% LoginBranchname | html %]</div>
                             [% IF ( table_loop ) %]
-                            <form name="layouts" action="/cgi-bin/koha/label-manage.pl?label_element=[% label_element %]">
+                            <form name="layouts" action="/cgi-bin/koha/label-manage.pl?label_element=[% label_element | html %]">
                             [% IF    ( label_element == 'layout' ) %]
                             <h2>Currently available layouts</h2>
                             [% ELSIF ( label_element == 'template' ) %]
@@ -75,7 +76,7 @@
                                                     [% CASE 'Batch ID'        %]<th>Batch ID</th>
                                                     [% CASE 'Item Count'      %]<th>Item count</th>
                                                     [% CASE 'Fields to Print' %]<th>Fields to print</th>
-                                                    [% CASE                   %]<th>[% header_field.field_label %]</th>
+                                                    [% CASE                   %]<th>[% header_field.field_label | html %]</th>
                                                 [% END %]
                                             [% END %]
                                         </tr>
                                             [% IF ( text_field.select_field ) %]
                                                 <td class="actions">
                                                     <a class="btn btn-default btn-xs" href="/cgi-bin/koha/labels/label-edit-[% label_element |url %].pl?op=edit&amp;element_id=[% text_field.field_value |url %]"><i class="fa fa-edit"></i> Edit</a>
-                                                    <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/labels/label-manage.pl?op=delete&amp;label_element=[% label_element %]&amp;element_id=[% text_field.field_value |url %]"><i class="fa fa-trash"></i> Delete</a>
+                                                    <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/labels/label-manage.pl?op=delete&amp;label_element=[% label_element | html %]&amp;element_id=[% text_field.field_value |url %]"><i class="fa fa-trash"></i> Delete</a>
                                                 </td>
-                                                [% IF label_element == 'batch' %] <td><input type="checkbox" name="action" value="[% text_field.field_value %]" /></td>[% END %]
+                                                [% IF label_element == 'batch' %] <td><input type="checkbox" name="action" value="[% text_field.field_value | html %]" /></td>[% END %]
                                             [% ELSIF ( text_field.field_value ) %]
-                                                <td>[% text_field.field_value %]</td>
+                                                <td>[% text_field.field_value | html %]</td>
                                             [% ELSE %]
                                                 <td>&nbsp;</td>
                                             [% END %]
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'greybox.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script>
                     return(document.layouts.action[selected[0]].value);
                 }
                 else {
-                    alert(_("Please select only one %s to %s.").format("[% label_element %]", op));
+                    alert(_("Please select only one %s to %s.").format("[% label_element | html %]", op));
                     return (-1);
                 }
             }
                     return(document.layouts.action.value);
                 }
             };
-            alert(_("Please select a %s.").format("[% label_element %]"));
+            alert(_("Please select a %s.").format("[% label_element | html %]"));
             return (-1);
         }
         $(document).ready(function(){
index ba40006..663a0d7 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Label creator &rsaquo; Label printing/exporting</title>
                         [% FOREACH batche IN batches %]
                         <fieldset>
                             [% IF ( batche.label_ids ) %]
-                                <legend>[% IF ( batche.label_count == 1 ) %][% batche.label_count %] single label[% ELSE %][% batche.label_count %] single labels[% END %]</legend>
-                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/[% batche.create_script %]?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]&amp;start_label=[% batche.start_label %][% batche.label_ids %]">Download as PDF</a></p>
+                                <legend>[% IF ( batche.label_count == 1 ) %][% batche.label_count | html %] single label[% ELSE %][% batche.label_count | html %] single labels[% END %]</legend>
+                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/[% batche.create_script | html %]?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]&amp;start_label=[% batche.start_label | html %][% batche.label_ids | html %]">Download as PDF</a></p>
 
-                                    <p><a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %][% batche.label_ids %]">Download as CSV</a></p>
+                                    <p><a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %][% batche.label_ids | html %]">Download as CSV</a></p>
 
-                                    <p><a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %][% batche.label_ids %]">Download as XML</a></p>
+                                    <p><a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %][% batche.label_ids | html %]">Download as XML</a></p>
                             [% ELSIF ( batche.item_numbers ) %]
-                            <legend>[% IF ( batche.label_count == 1 ) %][% batche.label_count %] single label[% ELSE %][% batche.label_count %] single labels[% END %]</legend>
-                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/[% batche.create_script %]?template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]&amp;start_label=[% batche.start_label %][% batche.item_numbers %]">Download as PDF</a></p>
+                            <legend>[% IF ( batche.label_count == 1 ) %][% batche.label_count | html %] single label[% ELSE %][% batche.label_count | html %] single labels[% END %]</legend>
+                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/[% batche.create_script | html %]?template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]&amp;start_label=[% batche.start_label | html %][% batche.item_numbers | html %]">Download as PDF</a></p>
 
-                                    <p><a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %][% batche.item_numbers %]">Download as CSV</a></p>
+                                    <p><a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %][% batche.item_numbers | html %]">Download as CSV</a></p>
 
-                                    <p><a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %][% batche.item_numbers %]">Download as XML</a></p>
+                                    <p><a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %][% batche.item_numbers | html %]">Download as XML</a></p>
                             [% ELSE %]
-                            <legend>Label Batch Number [% batche.batch_id %]</legend>
-                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]&amp;start_label=[% batche.start_label %]">Download as PDF</a>
+                            <legend>Label Batch Number [% batche.batch_id | html %]</legend>
+                                    <p><a class="document pdf" href="/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]&amp;start_label=[% batche.start_label | html %]">Download as PDF</a>
                                 </p>
                                 <p>
-                                    <a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]">Download as CSV</a>
+                                    <a class="document csv" href="/cgi-bin/koha/labels/label-create-csv.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]">Download as CSV</a>
                                 </p>
                                 <p>
-                                    <a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]">Download as XML</a></p>
+                                    <a class="document xml" href="/cgi-bin/koha/labels/label-create-xml.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]">Download as XML</a></p>
                             [% END %]
                         </fieldset>
                         [% END %]
         [% ELSE %]
             <h3>
                 [% IF ( label_ids ) %]
-                    [% IF ( label_count == 1 ) %]Exporting [% label_count %] label[% ELSE %]Exporting [% label_count %] labels[% END %]
+                    [% IF ( label_count == 1 ) %]Exporting [% label_count | html %] label[% ELSE %]Exporting [% label_count | html %] labels[% END %]
                 [% ELSIF ( item_numbers ) %]
-                    [% IF ( item_count == 1 ) %]Exporting [% item_count %] label[% ELSE %]Exporting [% item_count %] labels[% END %]
+                    [% IF ( item_count == 1 ) %]Exporting [% item_count | html %] label[% ELSE %]Exporting [% item_count | html %] labels[% END %]
                 [% ELSE %]
-                    [% IF ( multi_batch_count == 1 ) %][% multi_batch_count %] batch to export[% ELSE %][% multi_batch_count %] batches to export[% END %]
+                    [% IF ( multi_batch_count == 1 ) %][% multi_batch_count | html %] batch to export[% ELSE %][% multi_batch_count | html %] batches to export[% END %]
                 [% END %]
             </h3>
             <form name="exporting" method="post" action="/cgi-bin/koha/labels/label-print.pl">
                 <input type="hidden" name="op" value="export" />
-                <input type="hidden" name="referer" value="[% referer %]" />
+                <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
-                    <input type="hidden" name="batch_id" value="[% batch_id.batch_id %]" />
+                    <input type="hidden" name="batch_id" value="[% batch_id.batch_id | html %]" />
                 [% END %]
                 [% FOREACH label_id IN label_ids %]
-                    <input type="hidden" name="label_id" value="[% label_id.label_id %]" />
+                    <input type="hidden" name="label_id" value="[% label_id.label_id | html %]" />
                 [% END %]
                 [% FOREACH item_number IN item_numbers %]
-                    <input type="hidden" name="item_number" value="[% item_number.item_number %]" />
+                    <input type="hidden" name="item_number" value="[% item_number.item_number | html %]" />
                 [% END %]
                 <fieldset class="rows">
                     <ol>
@@ -70,7 +71,7 @@
                             <label for="template_id" style="width:20em">Select a template to be applied: </label>
                             <select name="template_id" id="template_id">
                                     [% FOREACH template IN templates %]
-                                    <option value="[% template.template_id %]">[% template.template_code %]</option>
+                                    <option value="[% template.template_id | html %]">[% template.template_code | html %]</option>
                                     [% END %]
                                 </select>
                         </li>
@@ -78,7 +79,7 @@
                             <label for="layout_id" style="width:20em">Select a layout to be applied: </label>
                             <select name="layout_id" id="layout_id">
                                     [% FOREACH layout IN layouts %]
-                                    <option value="[% layout.layout_id %]">[% layout.layout_name %]</option>
+                                    <option value="[% layout.layout_id | html %]">[% layout.layout_name | html %]</option>
                                     [% END %]
                                 </select>
                         </li>
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'greybox.inc' %]
     <script>
         function Done() {
-            window.location = "[% referer %]";
+            window.location = "[% referer | html %]";
         };
         $(document).ready(function(){
             $(".gb-close").on("click",function(){
index 42b76b1..40412b9 100644 (file)
@@ -1,19 +1,20 @@
+[% USE raw %]
 [% BLOCK pagination %]
     <nav>
         [% IF ( displayprev || displaynext ) %]
             <ul class="pagination">
                 [% IF ( displayprev ) %]
-                    <li><a class="nav" href="label-item-search.pl?startfrom=[% startfromprev %]&amp;ccl_query=[% ccl_query %]&amp;resultsperpage=[% resultsperpage %]&amp;op=do_search&amp;batch_id=[% batch_id %]"><i class="fa fa-arrow-left"></i> Previous</a></li>
+                    <li><a class="nav" href="label-item-search.pl?startfrom=[% startfromprev | html %]&amp;ccl_query=[% ccl_query | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;op=do_search&amp;batch_id=[% batch_id | html %]"><i class="fa fa-arrow-left"></i> Previous</a></li>
                 [% END %]
                 [% FOREACH number IN numbers %]
                     [% IF ( startfrom == number.startfrom ) %]
-                        <li class="active"><span>[% number.number %]</span></a></li>
+                        <li class="active"><span>[% number.number | html %]</span></a></li>
                     [% ELSE %]
-                        <li><a class="nav" href="label-item-search.pl?startfrom=[% number.startfrom %]&amp;ccl_query=[% ccl_query %]&amp;resultsperpage=[% resultsperpage %]&amp;op=do_search&amp;batch_id=[% batch_id %]">[% number.number %]</a></li>
+                        <li><a class="nav" href="label-item-search.pl?startfrom=[% number.startfrom | html %]&amp;ccl_query=[% ccl_query | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;op=do_search&amp;batch_id=[% batch_id | html %]">[% number.number | html %]</a></li>
                     [% END %]
                 [% END %]
                 [% IF ( displaynext ) %]
-                    <li><a class="nav" href="label-item-search.pl?startfrom=[% startfromnext %]&amp;ccl_query=[% ccl_query %]&amp;resultsperpage=[% resultsperpage %]&amp;op=do_search&amp;batch_id=[% batch_id %]">Next <i class="fa fa-arrow-right"></i></a></li>
+                    <li><a class="nav" href="label-item-search.pl?startfrom=[% startfromnext | html %]&amp;ccl_query=[% ccl_query | html %]&amp;resultsperpage=[% resultsperpage | html %]&amp;op=do_search&amp;batch_id=[% batch_id | html %]">Next <i class="fa fa-arrow-right"></i></a></li>
                 [% END %]
             </ul>
         [% END %]
@@ -32,7 +33,7 @@
         <div class="results">
             [% PROCESS pagination %]
                 [% IF ( results ) %]
-                <strong>Results [% from %] through [% to %] [% IF ( total ) %] of [% total %][% END %]</strong>
+                <strong>Results [% from | html %] through [% to | html %] [% IF ( total ) %] of [% total | html %][% END %]</strong>
                 [% ELSE %]
                 No results found
                 [% END %]
                 <div><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a> <a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></div>
 
                 <div id="label-search-results">
-                <input type="hidden" name="ccl_query" value="[% ccl_query %]" />
+                <input type="hidden" name="ccl_query" value="[% ccl_query | html %]" />
             [% FOREACH result_se IN result_set %]
             <div style="border-bottom:1px solid #CCC;padding:1em 0;">
-                    <h4>[% result_se.title |html %]</h4>
-                            <p>[% IF ( result_se.author ) %]by [% result_se.author %][% END %]
-                            [[% result_se.itemtype %]], [% IF ( result_se.publishercode ) %][% result_se.publishercode %] [% END %][% IF ( result_se.place ) %][% result_se.place %] [% END %][% IF ( result_se.copyrightdate ) %][% result_se.copyrightdate %], [% END %][% IF ( result_se.pages ) %][% result_se.pages %][% END %][% IF ( result_se.isbn ) %], <b>ISBN: </b>[% result_se.isbn %][% END %][% IF ( result_se.notes ) %],<br />[% result_se.notes %][% END %]</p>
+                    <h4>[% result_se.title | html %]</h4>
+                            <p>[% IF ( result_se.author ) %]by [% result_se.author | html %][% END %]
+                            [[% result_se.itemtype | html %]], [% IF ( result_se.publishercode ) %][% result_se.publishercode | html %] [% END %][% IF ( result_se.place ) %][% result_se.place | html %] [% END %][% IF ( result_se.copyrightdate ) %][% result_se.copyrightdate | html %], [% END %][% IF ( result_se.pages ) %][% result_se.pages | html %][% END %][% IF ( result_se.isbn ) %], <b>ISBN: </b>[% result_se.isbn | html %][% END %][% IF ( result_se.notes ) %],<br />[% result_se.notes | html %][% END %]</p>
 
                     <table>
                     [% FOREACH item_tabl IN result_se.item_table %]
@@ -70,7 +71,7 @@
                                         [% CASE "Select" -%]
                                             <th>Select</th>
                                         [% CASE %]
-                                            <th>[% header_field.field_label %]</th>
+                                            <th>[% header_field.field_label | html %]</th>
                                     [% END -%]
                                 [% END %]
                             </tr>
                     <tr>
                     [% FOREACH text_field IN item_tabl.text_fields %]
                     [% IF ( text_field.select_field ) %]
-                        <td><input type="checkbox" name="action" value="[% text_field.field_value %]"></td>
+                        <td><input type="checkbox" name="action" value="[% text_field.field_value | html %]"></td>
                     [% ELSIF ( text_field.link_field ) %]
                         <td>
-                            <a class="btn btn-default btn-xs select_item" data-item-number="[% text_field.field_value %]" data-batch-id="[% batch_id %]" data-field-type="[% text_field.type %]"><i class="fa fa-plus"></i> Add</a>
+                            <a class="btn btn-default btn-xs select_item" data-item-number="[% text_field.field_value | html %]" data-batch-id="[% batch_id | html %]" data-field-type="[% text_field.type | html %]"><i class="fa fa-plus"></i> Add</a>
                         </td>
                     [% ELSE %]
-                        <td>[% text_field.field_value %]</td>
+                        <td>[% text_field.field_value | html %]</td>
                     [% END %]
                     [% END %]
                     </tr>
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     <script>
         $(document).ready(function(){
             $("#toolbar").fixFloat();
                 $("input[type='checkbox']").prop("checked",false);
             });
             $("#add_items").on("click",function(){
-                add_item('checked',[% batch_id %],'[% type %]');
+                add_item('checked',[% batch_id | html %],'[% type | html %]');
             });
             $(".select_item").on("click",function(e){
                 e.preventDefault();
index e982150..4e7e25f 100644 (file)
@@ -8,14 +8,14 @@
 
 <h1>Search for items
 [% IF ( batch_id ) %]
-to add to Batch [% batch_id %]
+to add to Batch [% batch_id | html %]
 [% END %]
 </h1>
 
 <form name="f" method="post" action="/cgi-bin/koha/labels/label-item-search.pl">
        <input type="hidden" name="op" value="do_search" />
-       <input type="hidden" name="batch_id" value="[% batch_id %]" />
-       <input type="hidden" name="type" value="[% type %]" />
+       <input type="hidden" name="batch_id" value="[% batch_id | html %]" />
+       <input type="hidden" name="type" value="[% type | html %]" />
 
        <fieldset class="rows">
 <ol><li>
@@ -75,7 +75,7 @@ to add to Batch [% batch_id %]
         <option value="">Field-weighted, relevance ranked</option>
         [% FOREACH sort_by_loo IN sort_by_loop %]
 
-[% IF ( sort_by_loo.selected ) %]<option value="[% sort_by_loo.value %]" selected="selected">[% sort_by_loo.label %]</option>[% ELSE %]<option value="[% sort_by_loo.value %]">[% sort_by_loo.label %]</option>[% END %]
+[% IF ( sort_by_loo.selected ) %]<option value="[% sort_by_loo.value | html %]" selected="selected">[% sort_by_loo.label | html %]</option>[% ELSE %]<option value="[% sort_by_loo.value | html %]">[% sort_by_loo.label | html %]</option>[% END %]
 
         [% END %]
     </select>
index f834a0f..1e277c5 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]<title>Koha &rsaquo; Tools &rsaquo; Quick spine label creator</title>
@@ -38,7 +39,7 @@
      </div> <!-- /.row -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 615c639..585b8fc 100644 (file)
@@ -1,22 +1,23 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 <!DOCTYPE html>
-[% IF ( bidi ) %]<html lang="[% lang %]" dir="[% bidi %]">[% ELSE %]<html lang="[% lang %]">[% END %]
+[% IF ( bidi ) %]<html lang="[% lang | html %]" dir="[% bidi | html %]">[% ELSE %]<html lang="[% lang | html %]">[% END %]
 <head>
 <title>Koha &rsaquo; Tools &rsaquo; Spine labels</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-[% Asset.css("css/spinelabel.css") %]
+[% Asset.css("css/spinelabel.css") | $raw %]
 <style>
     @media print {
         .noprint { display: none; }
     }
 </style>
-[% IF ( IntranetUserCSS ) %]<style>[% IntranetUserCSS %]</style>[% END %]
+[% IF ( IntranetUserCSS ) %]<style>[% IntranetUserCSS | html %]</style>[% END %]
 </head>
 
        [% IF ( BarcodeNotFound ) %]
                <body id="labels_spinelabel-print" class="tools labels">
-            <p>The barcode [% Barcode |html %] was not found.</p>
+            <p>The barcode [% Barcode | html %] was not found.</p>
             <p><a href="spinelabel-home.pl">Return to spine label printer</a></p>
        [% ELSE %]
                [% IF ( autoprint ) %]
@@ -25,7 +26,7 @@
             <body id="labels_spinelabel-print" class="tools labels">
                [% END %] 
                        <span id="spinelabel" class="label">
-                               [% content %]
+                               [% content | html %]
                        </span>
                        <span id="print_button" class="noprint">
                 <button onclick="window.print()">Print this slabel</button>
        [% END %]
 
 [% IF ( IntranetUserJS ) %]
-    [% Asset.js( "lib/jquery/jquery-2.2.3.min.js" ) %]
-    [% Asset.js( "lib/jquery/jquery-migrate-1.3.0.min.js" ) %]
+    [% Asset.js( "lib/jquery/jquery-2.2.3.min.js" ) | $raw %]
+    [% Asset.js( "lib/jquery/jquery-migrate-1.3.0.min.js" ) | $raw %]
     <script>
-        [% IntranetUserJS %]
+        [% IntranetUserJS | html %]
     </script>
 [% END %]
 
index 92e01eb..1ffd01e 100644 (file)
@@ -11,7 +11,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patron-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; <a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account for [% INCLUDE 'patron-title.inc' %]</a> &rsaquo; Details for account line [% accountline.id %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; <a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account for [% INCLUDE 'patron-title.inc' %]</a> &rsaquo; Details for account line [% accountline.id | html %]</div>
 
 <div id="doc3" class="yui-t2">
 <div id="bd">
                     <tbody>
                         <tr>
                             <td>
-                                <span title="[% accountline.date %]">[% accountline.date |$KohaDates %]</span>
+                                <span title="[% accountline.date | html %]">[% accountline.date |$KohaDates %]</span>
                             </td>
                             <td>
                                 [%- INCLUDE 'accounttype.inc' account => accountline -%]
                                 [%- IF accountline.payment_type -%]
-                                    , [% AuthorisedValues.GetByCode('PAYMENT_TYPE', accountline.payment_type) %]
+                                    , [% AuthorisedValues.GetByCode('PAYMENT_TYPE', accountline.payment_type) | html %]
                                 [%- END =%]
                                 [%- IF accountline.description -%]
-                                    , [% accountline.description %]
+                                    , [% accountline.description | html %]
                                 [%- END -%]
 
                                 &nbsp;
                                 [% IF ( accountline.itemnumber ) %]
                                     [% SET biblio = accountline.item.biblio %]
-                                    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber %]&amp;itemnumber=[% accountline.itemnumber %]">[% biblio.title |html %]</a>
+                                    <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber | html %]&amp;itemnumber=[% accountline.itemnumber | html %]">[% biblio.title | html %]</a>
                                 [% END %]
                             </td>
 
                             </td>
 
                             <td>
-                                [% accountline.amount | $Price %]
+                                [% accountline.amount | $Price | html %]
                             </td>
 
                             <td>
-                                [% accountline.amountoutstanding | $Price %]
+                                [% accountline.amountoutstanding | $Price | html %]
                             </td>
                         </tr>
                     </tbody>
                                 [% IF offset_accountline %]
                                     <tr>
                                         <td>[% offset_accountline.date | $KohaDates %]</td>
-                                        <td>[% offset_accountline.timestamp | $KohaDates with_hours => 1 %]</td>
-                                        <td>[% offset_accountline.amount | $Price %]</td>
-                                        <td>[% offset_accountline.amountoutstanding | $Price %]</td>
+                                        <td>[% offset_accountline.timestamp | $KohaDates with_hours => 1 | html %]</td>
+                                        <td>[% offset_accountline.amount | $Price | html %]</td>
+                                        <td>[% offset_accountline.amountoutstanding | $Price | html %]</td>
                                         <td>[% INCLUDE 'accounttype.inc' account => offset_accountline %]</td>
-                                        <td>[% offset_accountline.note %]</td>
-                                        <td>[% IF offset_accountline.manager_id %]<a href="moremember.pl?borrowernumber=[% offset_accountline.manager_id %]">[% offset_accountline.manager_id %]</a>[% END %]</td>
-                                        <td>[% ao.created_on | $KohaDates with_hours => 1 %]</td>
-                                        <td>[% ao.amount | $Price %]</td>
+                                        <td>[% offset_accountline.note | html %]</td>
+                                        <td>[% IF offset_accountline.manager_id %]<a href="moremember.pl?borrowernumber=[% offset_accountline.manager_id | html %]">[% offset_accountline.manager_id | html %]</a>[% END %]</td>
+                                        <td>[% ao.created_on | $KohaDates with_hours => 1 | html %]</td>
+                                        <td>[% ao.amount | $Price | html %]</td>
                                         <td>[% INCLUDE 'account_offset_type.inc' account_offset => ao %]</td>
-                                        <td><a href="accountline-details.pl?accountlines_id=[% offset_accountline.id %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a></td>
+                                        <td><a href="accountline-details.pl?accountlines_id=[% offset_accountline.id | html %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a></td>
                                     </tr>
                                 [% END %]
                             [% END %]
index e615ba0..3307a31 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
@@ -25,8 +26,8 @@
 
                 <h1>API keys for [% INCLUDE 'patron-title.inc' %]</h1>
                 <form id="add-api-key" action="/cgi-bin/koha/members/apikeys.pl" method="post" style="display:none">
-                    <input type="hidden" name="patron_id" value="[% patron.id %]" />
-                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                    <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
+                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                     <input type="hidden" name="op" value="generate" />
                     <fieldset class="brief">
                         <legend>Generate new client id/secret pair</legend>
                             <tbody>
                                 [% FOREACH key IN api_keys %]
                                     <tr>
-                                        <td>[% key.description %]</td>
-                                        <td>[% key.client_id %]</td>
-                                        <td>[% key.secret %]</td>
+                                        <td>[% key.description | html %]</td>
+                                        <td>[% key.client_id | html %]</td>
+                                        <td>[% key.secret | html %]</td>
                                         <td>[% IF key.active %]Yes[% ELSE %]No[% END %]</td>
                                         <td>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
-                                                <input type="hidden" name="patron_id" value="[% patron.id %]" />
-                                                <input type="hidden" name="key" value="[% key.id %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                                                <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
+                                                <input type="hidden" name="key" value="[% key.id | html %]" />
+                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                                                 <input type="hidden" name="op" value="delete" />
                                                 <button class="btn btn-default btn-xs delete" type="submit"><i class="fa fa-trash"></i> Delete</button>
                                             </form>
                                             <form action="/cgi-bin/koha/members/apikeys.pl" method="post">
-                                                <input type="hidden" name="patron_id" value="[% patron.id %]" />
-                                                <input type="hidden" name="key" value="[% key.id %]" />
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                                                <input type="hidden" name="patron_id" value="[% patron.id | html %]" />
+                                                <input type="hidden" name="key" value="[% key.id | html %]" />
+                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                                                 [% IF key.active %]
                                                     <input type="hidden" name="op" value="revoke" />
                                                     <button class="btn btn-default btn-xs" type="submit"><i class="fa fa-remove"></i> Revoke</button>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script>
         $(document).ready(function(){
             $(".delete").on("click", function(e){
index 6d9e68b..283ef72 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -10,7 +11,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons &rsaquo; Account for [% INCLUDE 'patron-title.inc' no_html = 1 %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_borraccount" class="pat">
        <div id="yui-main">
        <div class="yui-b">
 [% INCLUDE 'members-toolbar.inc' %]
-<form action="/cgi-bin/koha/members/boraccount.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" /></form>
+<form action="/cgi-bin/koha/members/boraccount.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
 
 <!-- The manual invoice and credit buttons -->
 <div class="statictabs">
 <ul>
-    <li class="active"><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a></li>
-    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a></li>
-    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a></li>
-    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a></li>
+    <li class="active"><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account</a></li>
+    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]" >Pay fines</a></li>
+    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual invoice</a></li>
+    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual credit</a></li>
 </ul>
 <div class="tabs-container">
 <!-- The table with the account items -->
   [% FOREACH account IN accounts %]
 
    <tr>
-   <td><span title="[% account.date %]">[% account.date |$KohaDates %]</span></td>
+   <td><span title="[% account.date | html %]">[% account.date |$KohaDates %]</span></td>
       <td>
         [% INCLUDE 'accounttype.inc' accountline => account %]
-        [%- IF account.payment_type %], [% AuthorisedValues.GetByCode('PAYMENT_TYPE', account.payment_type) %][% END %]
-        [%- IF account.description %], [% account.description %][% END %]
-        &nbsp;[% IF ( account.itemnumber ) %]<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% account.item.biblionumber %]&amp;itemnumber=[% account.itemnumber %]">[% account.item.biblio.title |html %]</a>[% END %]</td>
-      <td>[% IF account.itemnumber %][% Branches.GetName( account.item.homebranch ) %][% END %]</td>
+        [%- IF account.payment_type %], [% AuthorisedValues.GetByCode('PAYMENT_TYPE', account.payment_type) | html %][% END %]
+        [%- IF account.description %], [% account.description | html %][% END %]
+        &nbsp;[% IF ( account.itemnumber ) %]<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% account.item.biblionumber | html %]&amp;itemnumber=[% account.itemnumber | html %]">[% account.item.biblio.title | html %]</a>[% END %]</td>
+      <td>[% IF account.itemnumber %][% Branches.GetName( account.item.homebranch ) | html %][% END %]</td>
       <td>[% account.note | html_line_break %]</td>
-      [% IF ( account.amountcredit ) %]<td class="credit" style="text-align: right;">[% ELSE %]<td class="debit" style="text-align: right;">[% END %][% account.amount | $Price %]</td>
-      [% IF ( account.amountoutstandingcredit ) %]<td class="credit" style="text-align: right;">[% ELSE %]<td class="debit" style="text-align: right;">[% END %][% account.amountoutstanding | $Price %]</td>
+      [% IF ( account.amountcredit ) %]<td class="credit" style="text-align: right;">[% ELSE %]<td class="debit" style="text-align: right;">[% END %][% account.amount | $Price | html %]</td>
+      [% IF ( account.amountoutstandingcredit ) %]<td class="credit" style="text-align: right;">[% ELSE %]<td class="debit" style="text-align: right;">[% END %][% account.amountoutstanding | $Price | html %]</td>
       <td class="actions">
         [% IF ( account.payment ) %]
-          <a target="_blank" href="printfeercpt.pl?action=print&amp;accountlines_id=[% account.accountlines_id %]&amp;borrowernumber=[% account.borrowernumber %]" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print</a>
+          <a target="_blank" href="printfeercpt.pl?action=print&amp;accountlines_id=[% account.accountlines_id | html %]&amp;borrowernumber=[% account.borrowernumber | html %]" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print</a>
         [% ELSE %]
-          <a target="_blank" href="printinvoice.pl?action=print&amp;accountlines_id=[% account.accountlines_id %]&amp;borrowernumber=[% account.borrowernumber %]" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print</a>
+          <a target="_blank" href="printinvoice.pl?action=print&amp;accountlines_id=[% account.accountlines_id | html %]&amp;borrowernumber=[% account.borrowernumber | html %]" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print</a>
         [% END %]
-        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a>
+        <a href="accountline-details.pl?accountlines_id=[% account.accountlines_id | html %]" class="btn btn-default btn-xs"><i class="fa fa-list"></i> Details</a>
         [% IF ( reverse_col) %]
           [% IF ( account.payment || account.amount < 0 ) %]
                 [% IF account.payment %]
-                    <a href="boraccount.pl?action=reverse&amp;accountlines_id=[% account.accountlines_id %]&amp;borrowernumber=[% account.borrowernumber %]" class="btn btn-default btn-xs"><i class="fa fa-undo"></i> Reverse</a>
+                    <a href="boraccount.pl?action=reverse&amp;accountlines_id=[% account.accountlines_id | html %]&amp;borrowernumber=[% account.borrowernumber | html %]" class="btn btn-default btn-xs"><i class="fa fa-undo"></i> Reverse</a>
                 [% END %]
                 [% IF account.amount < 0 %]
-                    <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id %]&amp;borrowernumber=[% account.borrowernumber %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void</a>
+                    <a href="boraccount.pl?action=void&amp;accountlines_id=[% account.accountlines_id | html %]&amp;borrowernumber=[% account.borrowernumber | html %]" class="btn btn-default btn-xs void"><i class="fa fa-ban"></i> Void</a>
                 [% END %]
           [% ELSE %]
             &nbsp;
@@ -95,9 +96,9 @@
   <tr>
     <td colspan="5">Total due</td>
     [% IF ( totalcredit ) %]
-        <td class="credit" style="text-align: right;">[% total | $Price %]</td>
+        <td class="credit" style="text-align: right;">[% total | $Price | html %]</td>
     [% ELSE %]
-       <td class="debit"style="text-align: right;">[% total | $Price %]</td>
+       <td class="debit"style="text-align: right;">[% total | $Price | html %]</td>
     [% END %]
     <td></td>
   </tr>
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             var txtActivefilter = _("Filter paid transactions");
             var txtInactivefilter = _("Show all transactions");
-            var columns_settings = [% ColumnsSettings.GetColumns('members', 'fines', 'account-fines', 'json') %];
+            var columns_settings = [% ColumnsSettings.GetColumns('members', 'fines', 'account-fines', 'json').raw %];
             var table_account_fines = KohaTable("table_account_fines", {
                 "sPaginationType": "four_button",
                 'aaSorting': [[0, 'desc']],
index 4ef44d7..d9b2582 100644 (file)
@@ -1,16 +1,17 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Price %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Delete patron [% patron.firstname %] [% patron.surname %]</title>
+<title>Koha &rsaquo; Delete patron [% patron.firstname | html %] [% patron.surname | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="pat_deletemem" class="pat">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patron-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> &rsaquo; Delete patron [% patron.firstname %] [% patron.surname %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> &rsaquo; Delete patron [% patron.firstname | html %] [% patron.surname | html %]</div>
 <div id="doc3" class="yui-t2">
    
    <div id="bd">
         <h3>Cannot delete patron</h3>
             <ul>
             [% IF ( ItemsOnIssues ) %]
-                <li>Patron has [% ItemsOnIssues %] item(s) checked out.</li>
+                <li>Patron has [% ItemsOnIssues | html %] item(s) checked out.</li>
             [% END %]
             [% IF ( charges ) %]
-                <li>Patron has [% charges | $Price %] in fines.</li>
+                <li>Patron has [% charges | $Price | html %] in fines.</li>
             [% END %]
             [% IF ( guarantees ) %]
                 <li>Patron's record has guaranteed accounts attached.</li>
     [% ELSIF op == 'delete_confirm' and patron %]
         [%# TODO add "patron does not exist" unless patron %]
         <div class="dialog alert">
-            <h3>Are you sure you want to delete the patron [% patron.firstname %] [% patron.surname %]? This cannot be undone.</h3>
+            <h3>Are you sure you want to delete the patron [% patron.firstname | html %] [% patron.surname | html %]? This cannot be undone.</h3>
             <form action="/cgi-bin/koha/members/deletemem.pl">
-                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
-                <input type="hidden" name="member" value="[% patron.borrowernumber %]"/>
+                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                <input type="hidden" name="member" value="[% patron.borrowernumber | html %]"/>
                 <input type="hidden" name="op" value="delete_confirmed" />
                 <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
             </form>
             <form action="/cgi-bin/koha/members/moremember.pl">
-                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]"/>
+                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]"/>
                 <button type="submit" class="deny"><i class="fa fa-fw fa-remove"></i> No, do not delete</button>
             </form>
         </div>
@@ -64,7 +65,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index f2a51ba..694f494 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Patrons &rsaquo; [% UNLESS blocking_error  %]Discharge for [% patron.firstname %] [% patron.surname %] ([% patron.cardnumber %])[% END %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; [% UNLESS blocking_error  %]Discharge for [% patron.firstname | html %] [% patron.surname | html %] ([% patron.cardnumber | html %])[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="discharge" class="discharge">
@@ -14,7 +15,7 @@
 <div id="breadcrumbs">
          <a href="/cgi-bin/koha/mainpage.pl">Home</a>
 &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
-&rsaquo; [% UNLESS blocking_error  %]Discharge for [% patron.firstname %] [% patron.surname %] ([% patron.cardnumber %])[% END %]
+&rsaquo; [% UNLESS blocking_error  %]Discharge for [% patron.firstname | html %] [% patron.surname | html %] ([% patron.cardnumber | html %])[% END %]
 </div>
 
 <div id="doc3" class="yui-t1">
@@ -24,7 +25,7 @@
 <div class="yui-g">
 <h3>Discharge</h3>
 [% FOR message IN messages %]
-    <div class="dialog [% message.type %]">
+    <div class="dialog [% message.type | html %]">
     [% IF message.code == "unable_to_generate_pdf" %]
         An error occurs when generating the pdf file.
         Please contact the administrator to resolve this problem.
@@ -39,7 +40,7 @@
     [% END %]
     <form method="post">
         <input type="submit" value="Generate discharge" name="discharge" />
-        <input type="hidden" value="[% patron.borrowernumber %]" name="borrowernumber" />
+        <input type="hidden" value="[% patron.borrowernumber | html %]" name="borrowernumber" />
     </form>
 [% END %]
 
@@ -55,8 +56,8 @@
         <tbody>
             [% FOR d IN validated_discharges %]
                 <tr>
-                    <td>[% d.needed | $KohaDates with_hours = 1 %]</td>
-                    <td>[% d.validated | $KohaDates with_hours = 1 %]</td>
+                    <td>[% d.needed | $KohaDates with_hours = 1 | html %]</td>
+                    <td>[% d.validated | $KohaDates with_hours = 1 | html %]</td>
                 </tr>
             [% END %]
         </tbody>
@@ -75,7 +76,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 5c27c04..f65bddc 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE KohaDates %]
@@ -5,7 +6,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons &rsaquo; Pending discharge requests</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 <body id="pat_discharges" class="pat">
 [% INCLUDE 'header.inc' %]
           <tbody>
             [% FOREACH d IN pending_discharges %]
               <tr>
-                <td><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% d.borrower.borrowernumber %]">[% d.borrower.surname %], [% d.borrower.firstname %]</a></td>
-                <td>[% d.borrower.branchcode.branchname %]</td>
-                <td><span title="[% d.needed %]">[% d.needed | $KohaDates %]</span></td>
-                <td><a class="btn btn-xs btn-default" href="/cgi-bin/koha/members/discharges.pl?op=allow&borrowernumber=[% d.borrower.borrowernumber %]"><i class="fa fa-check"></i> Allow</a></td>
+                <td><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% d.borrower.borrowernumber | html %]">[% d.borrower.surname | html %], [% d.borrower.firstname | html %]</a></td>
+                <td>[% d.borrower.branchcode.branchname | html %]</td>
+                <td><span title="[% d.needed | html %]">[% d.needed | $KohaDates %]</span></td>
+                <td><a class="btn btn-xs btn-default" href="/cgi-bin/koha/members/discharges.pl?op=allow&borrowernumber=[% d.borrower.borrowernumber | html %]"><i class="fa fa-check"></i> Allow</a></td>
               </tr>
             [% END %]
           </tbody>
@@ -52,7 +53,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 
     [% INCLUDE 'datatables.inc' %]
     <script>
index 0cdffa4..027b563 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
                     <tbody>
                         [% FOREACH f IN files %]
                             <tr>
-                                 <td><a href="?borrowernumber=[% patron.borrowernumber %]&amp;op=download&amp;file_id=[% f.file_id %]">[% f.file_name %]</a></td>
-                                 <td>[% f.file_type %]</td>
-                                 <td>[% f.file_description %]</td>
+                                 <td><a href="?borrowernumber=[% patron.borrowernumber | html %]&amp;op=download&amp;file_id=[% f.file_id | html %]">[% f.file_name | html %]</a></td>
+                                 <td>[% f.file_type | html %]</td>
+                                 <td>[% f.file_description | html %]</td>
                                  <td>[% f.date_uploaded | $KohaDates %]</td>
-                                 [% IF CAN_user_borrowers_edit_borrowers %]<td><a class="btn btn-default btn-xs confirmdelete" href="?borrowernumber=[% patron.borrowernumber %]&amp;op=delete&amp;file_id=[% f.file_id %]"><i class="fa fa-trash"></i> Delete</a></td>[% END %]
+                                 [% IF CAN_user_borrowers_edit_borrowers %]<td><a class="btn btn-default btn-xs confirmdelete" href="?borrowernumber=[% patron.borrowernumber | html %]&amp;op=delete&amp;file_id=[% f.file_id | html %]"><i class="fa fa-trash"></i> Delete</a></td>[% END %]
                             </tr>
                         [% END %]
                     </tbody>
@@ -64,7 +65,7 @@
                         <legend>Upload new file</legend>
                         <ol>
                         <li><input type="hidden" name="op" value="upload" />
-                        <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                        <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                         <input type="hidden" name="MAX_FILE_SIZE" value="2000000" />
 
                         <label for="description">Description:</label>
@@ -87,7 +88,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
             $(".confirmdelete").on("click", function(){
index 744be40..047f19e 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Koha %]
@@ -9,7 +10,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Holds history for [% INCLUDE 'patron-title.inc' no_html = 1 %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_holdshistory" class="pat">
       </thead>
       <tbody>
       [% FOREACH hold IN holds %]
-          <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblio.biblionumber %]">[% hold.biblio.title |html %]</a></td>
-          <td>[% hold.biblio.author %]</td>
-          <td>[% hold.item.barcode %]</td>
-          <td>[% Branches.GetName( hold.branchcode ) %]</td>
-          <td><span title="[% hold.reservedate %]">[% hold.reservedate | $KohaDates %]</span></td>
+          <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% hold.biblio.biblionumber | html %]">[% hold.biblio.title | html %]</a></td>
+          <td>[% hold.biblio.author | html %]</td>
+          <td>[% hold.item.barcode | html %]</td>
+          <td>[% Branches.GetName( hold.branchcode ) | html %]</td>
+          <td><span title="[% hold.reservedate | html %]">[% hold.reservedate | $KohaDates %]</span></td>
           <td>
               [% IF hold.expirationdate %]
-                  <span title="[% hold.expirationdate %]">[% hold.expirationdate | $KohaDates %]</span>
+                  <span title="[% hold.expirationdate | html %]">[% hold.expirationdate | $KohaDates %]</span>
               [% ELSE %]
                   <span title="0000-00-00"></span>
               [% END %]
           </td>
           <td>
               [% IF hold.waitingdate %]
-                  <span title="[% hold.waitingdate %]">[% hold.waitingdate | $KohaDates %]</span>
+                  <span title="[% hold.waitingdate | html %]">[% hold.waitingdate | $KohaDates %]</span>
               [% ELSE %]
                   <span title="0000-00-00"></span>
               [% END %]
           </td>
           <td>
               [% IF hold.cancellationdate %]
-                  <span title="[% hold.cancellationdate %]">[% hold.cancellationdate | $KohaDates %]</span>
+                  <span title="[% hold.cancellationdate | html %]">[% hold.cancellationdate | $KohaDates %]</span>
               [% ELSE %]
                   <span title="0000-00-00"></span>
               [% END %]
@@ -82,7 +83,7 @@
           [% IF show_itemtype_column %]
             <td>
               [% IF hold.itemtype %]
-                  [% ItemTypes.GetDescription( hold.itemtype ) %]
+                  [% ItemTypes.GetDescription( hold.itemtype ) | html %]
               [% ELSE %]
                   <span>Any item type</span>
               [% END %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript" id="js">
         $(document).ready(function() {
             var columns_settings = [% ColumnsSettings.GetColumns('members', 'holdshistory', 'holdshistory-table', 'json') %];
index f8272c3..44e2098 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -33,7 +34,7 @@
           <div class="first">
 
             [% FOR m IN messages %]
-                <div class="dialog [% m.type %]">
+                <div class="dialog [% m.type | html %]">
                     [% SWITCH m.code %]
                     [% CASE 'error_on_profile_store' %]
                         An error occurred whilst updating this housebound profile.
@@ -48,7 +49,7 @@
                     [% CASE 'error_on_visit_create' %]
                         An error occurred whilst creating a new housebound visit.
                     [% CASE %]
-                        [% m.code %]
+                        [% m.code | html %]
                     [% END %]
                     Please try again later.
                 </div>
@@ -59,7 +60,7 @@
               <h4>Manage housebound profile</h4>
               <form id="editform" method="post" name="editform"
                     action="/cgi-bin/koha/members/housebound.pl">
-                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 [% IF ( housebound_profile ) %]
                   <input type="hidden" name="method" value="updateconfirm" />
                 [% ELSE %]
                         <option value="">Select a frequency</option>
                         [% FOREACH frequency IN AuthorisedValues.GetAuthValueDropbox('HSBND_FREQ') %]
                           [% IF housebound_profile.frequency == frequency.authorised_value %]
-                            <option value="[% frequency.authorised_value %]" selected="selected">[% frequency.lib %]</option>
+                            <option value="[% frequency.authorised_value | html %]" selected="selected">[% frequency.lib | html %]</option>
                           [% ELSE %]
-                            <option value="[% frequency.authorised_value %]">[% frequency.lib %]</option>
+                            <option value="[% frequency.authorised_value | html %]">[% frequency.lib | html %]</option>
                           [% END %]
                         [% END %]
                       </select>
                       <label for="fav_itemtypes">Preferred materials:</label>
                       [% IF ( housebound_profile ) %]
                         <input id="fav_itemtypes" type="text" size="50" name="fav_itemtypes"
-                               value="[% housebound_profile.fav_itemtypes %]">
+                               value="[% housebound_profile.fav_itemtypes | html %]">
                       [% ELSE %]
                         <input id="fav_itemtypes" type="text" value="" size="50" name="fav_itemtypes">
                       [% END %]
                       <label for="fav_subjects">Subjects:</label>
                       [% IF ( housebound_profile ) %]
                         <input id="fav_subjects" type="text" size="50" name="fav_subjects"
-                               value="[% housebound_profile.fav_subjects %]">
+                               value="[% housebound_profile.fav_subjects | html %]">
                       [% ELSE %]
                         <input id="fav_subjects" type="text" value="" size="50" name="fav_subjects">
                       [% END %]
                       <label for="fav_authors">Authors:</label>
                       [% IF ( housebound_profile ) %]
                         <input id="fav_authors" type="text" size="50" name="fav_authors"
-                               value="[% housebound_profile.fav_authors %]">
+                               value="[% housebound_profile.fav_authors | html %]">
                       [% ELSE %]
                         <input id="fav_authors" type="text" value="" size="50" name="fav_authors">
                       [% END %]
                       <label for="referral">Referral:</label>
                       [% IF ( housebound_profile ) %]
                         <input id="referral" type="text" size="50" name="referral"
-                               value="[% housebound_profile.referral %]">
+                               value="[% housebound_profile.referral | html %]">
                       [% ELSE %]
                         <input id="referral" type="text" value="" size="50" name="referral">
                       [% END %]
                       <label for="notes">Notes:</label>
                       [% IF ( housebound_profile ) %]
                         <input id="notes" type="text" size="50" name="notes"
-                               value="[% housebound_profile.notes %]">
+                               value="[% housebound_profile.notes | html %]">
                       [% ELSE %]
                         <input id="notes" type="text" value="" size="50" name="notes">
                       [% END %]
                 <fieldset class="action">
                   <button type="submit" class="btn btn-default btn-sm"><i class="fa fa-save"></i> Save changes</button>
                   <a class="cancel btn btn-link btn-sm"
-                     href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber %]">
+                     href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber | html %]">
                     Cancel
                   </a>
                 </fieldset>
                     action="/cgi-bin/koha/members/housebound.pl">
                 [% IF ( visit ) %]
                   <input type="hidden" name="method" value="editvisitconfirm" />
-                  <input type="hidden" name="visit_id" value="[% visit.id %]" />
+                  <input type="hidden" name="visit_id" value="[% visit.id | html %]" />
                 [% ELSE %]
                   <input type="hidden" name="method" value="addvisitconfirm" />
                 [% END %]
-                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 <fieldset class="rows" id="instance">
                   <legend>Delivery details</legend>
                   <ol>
                         [% IF ( visit ) %]
                           [% FOREACH chooser IN choosers %]
                             [% IF ( visit.chooser_brwnumber == chooser.borrowernumber ) %]
-                              <option value="[% chooser.borrowernumber %]" selected="selected">
+                              <option value="[% chooser.borrowernumber | html %]" selected="selected">
                                 [% INCLUDE 'patron-title.inc' patron = chooser invert_name = 0 %]
                               </option>
                             [% ELSE %]
-                              <option value="[% chooser.borrowernumber %]">
+                              <option value="[% chooser.borrowernumber | html %]">
                                 [% INCLUDE 'patron-title.inc' patron = chooser invert_name = 0 %]
                               </option>
                             [% END %]
                           [% END %]
                         [% ELSE %]
                           [% FOREACH chooser IN choosers %]
-                            <option value="[% chooser.borrowernumber %]">
+                            <option value="[% chooser.borrowernumber | html %]">
                                 [% INCLUDE 'patron-title.inc' patron = chooser invert_name = 0 %]
                             </option>
                           [% END %]
                         [% IF ( visit ) %]
                           [% FOREACH deliverer IN deliverers %]
                             [% IF ( visit.deliverer_brwnumber == deliverer.borrowernumber ) %]
-                              <option value="[% deliverer.borrowernumber %]" selected="selected">
+                              <option value="[% deliverer.borrowernumber | html %]" selected="selected">
                                 [% INCLUDE 'patron-title.inc' patron = deliverer invert_name = 0 %]
                               </option>
                             [% ELSE %]
-                              <option value="[% deliverer.borrowernumber %]">
+                              <option value="[% deliverer.borrowernumber | html %]">
                                 [% INCLUDE 'patron-title.inc' patron = deliverer invert_name = 0 %]
                               </option>
                             [% END %]
                           [% END %]
                         [% ELSE %]
                           [% FOREACH deliverer IN deliverers %]
-                            <option value="[% deliverer.borrowernumber %]">
+                            <option value="[% deliverer.borrowernumber | html %]">
                               [% INCLUDE 'patron-title.inc' patron = deliverer invert_name = 0 %]
                             </option>
                           [% END %]
                 <fieldset class="action">
                   <button type="submit" class="btn btn-default btn-sm"><i class="fa fa-save"></i> Save</button>
                   <a class="cancel"
-                     href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber %]">
+                     href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber | html %]">
                     Cancel
                   </a>
                 </fieldset>
                 <ol>
                   <li>
                     <span class="label" class="required"> Delivery day:</span>
-                    [% hpd = housebound_profile.day %]
+                    [% hpd = housebound_profile.day | html %]
                     [% IF hpd == 'any' %]
                       Any
                     [% ELSIF hpd == 'monday' %]
                   </li>
                   <li>
                     <span class="label" class="required">Frequency:</span>
-                    [% AuthorisedValues.GetByCode( 'HSBND_FREQ', housebound_profile.frequency, 0 ) || housebound_profile.frequency %]
+                    [% AuthorisedValues.GetByCode( 'HSBND_FREQ', housebound_profile.frequency, 0 ) || housebound_profile.frequency | html %]
                   </li>
                   <li>
                     <span class="label">Material:</span>
-                    [% housebound_profile.fav_itemtypes %]
+                    [% housebound_profile.fav_itemtypes | html %]
                   </li>
                   <li>
                     <span class="label">Subjects:</span>
-                    [% housebound_profile.fav_subjects %]
+                    [% housebound_profile.fav_subjects | html %]
                   </li>
                   <li>
                     <span class="label">Authors:</span>
-                    [% housebound_profile.fav_authors %]
+                    [% housebound_profile.fav_authors | html %]
                   </li>
                   <li>
                     <span class="label">Referral:</span>
-                    [% housebound_profile.referral %]
+                    [% housebound_profile.referral | html %]
                   </li>
                   <li>
                     <span class="label">Notes:</span>
-                    [% housebound_profile.notes %]
+                    [% housebound_profile.notes | html %]
                   </li>
                 </ol>
                 <div class="action">
-                  <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber %]&method=update_or_create"><i class="fa fa-pencil"></i> Edit</a>
+                  <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?borrowernumber=[% patron.borrowernumber | html %]&method=update_or_create"><i class="fa fa-pencil"></i> Edit</a>
                 </div>
               </div>
               <div>
                 <h3>Deliveries</h3>
-                [% housebound_visits = housebound_profile.housebound_visits %]
+                [% housebound_visits = housebound_profile.housebound_visits | html %]
                 [% IF  housebound_visits.size > 0 %]
                 <table border="0" width="100%" cellpadding="3" cellspacing="0">
                   <tr>
                   </tr>
                     [% FOREACH entry IN housebound_visits %]
                     <tr>
-                      <td>[% entry.id %]</td>
-                      <td>[% entry.appointment_date | $KohaDates %] ([% entry.day_segment %])</td>
+                      <td>[% entry.id | html %]</td>
+                      <td>[% entry.appointment_date | $KohaDates %] ([% entry.day_segment | html %])</td>
                       <td>
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% entry.chooser.borrowernumber %]">
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% entry.chooser.borrowernumber | html %]">
                           [% INCLUDE 'patron-title.inc' patron = entry.chooser invert_name = 0 %]
                         </a>
                       </td>
                       <td>
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% entry.deliverer.borrowernumber %]">
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% entry.deliverer.borrowernumber | html %]">
                           [% INCLUDE 'patron-title.inc' patron = entry.deliverer invert_name = 0 %]
                         </a>
                       </td>
                       <td class="actions">
-                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?method=visit_update_or_create&visit_id=[% entry.id %]&borrowernumber=[% patron.borrowernumber %]"><i class="fa fa-pencil"></i> Edit</a>
-                        <a class="delete btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?method=visit_delete&visit_id=[% entry.id %]&borrowernumber=[% patron.borrowernumber %]"><i class="fa fa-trash"></i> Delete</a>
+                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?method=visit_update_or_create&visit_id=[% entry.id | html %]&borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                        <a class="delete btn btn-default btn-xs" href="/cgi-bin/koha/members/housebound.pl?method=visit_delete&visit_id=[% entry.id | html %]&borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-trash"></i> Delete</a>
                       </td>
                     </tr>
                     [% END %]
                 </table>
                 [% END %]
                 <div class="action">
-                  <a href="/cgi-bin/koha/members/housebound.pl?method=visit_update_or_create&borrowernumber=[% patron.borrowernumber %]"
+                  <a href="/cgi-bin/koha/members/housebound.pl?method=visit_update_or_create&borrowernumber=[% patron.borrowernumber | html %]"
                     class="btn btn-default btn-sm">
                     <i class="fa fa-plus"></i> Add a new delivery
                   </a>
         });
     </script>
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 68e36a1..e935fbb 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 <!-- The manual invoice and credit buttons -->
 <div class="statictabs">
 <ul>
-    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a></li>
-    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a></li>
-    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a></li>
-    <li class="active"><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a></li>
+    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account</a></li>
+    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]" >Pay fines</a></li>
+    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual invoice</a></li>
+    <li class="active"><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual credit</a></li>
 </ul>
 <div class="tabs-container">
 
 <form action="/cgi-bin/koha/members/mancredit.pl" method="post" id="mancredit">
-<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
 
 <fieldset class="rows">
 <legend>Manual credit</legend><ol>
@@ -46,7 +47,7 @@
     <li><label for="amount">Amount: </label><input type="number" name="amount" id="amount" required="required" value="" step="any" min="0" /> Example: 5.00</li>
 </ol></fieldset>
 
-<fieldset class="action"><input type="submit" name="add" value="Add credit" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a></fieldset>
+<fieldset class="action"><input type="submit" name="add" value="Add credit" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a></fieldset>
 </form>
 
 </div></div>
@@ -61,7 +62,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
             $('#mancredit').preventDoubleFormSubmit();
index 30fb7d1..e011681 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 <!-- The manual invoice and credit buttons -->
 <div class="statictabs">
 <ul>
-    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a></li>
-    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a></li>
-    <li class="active"><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a></li>
-    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a></li>
+    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account</a></li>
+    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]" >Pay fines</a></li>
+    <li class="active"><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual invoice</a></li>
+    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual credit</a></li>
 </ul>
 <div class="tabs-container">
 
@@ -35,8 +36,8 @@
   ERROR an invalid itemnumber was entered, please hit back and try again
 [% END %]
 [% ELSE %]
-<form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+<form action="/cgi-bin/koha/members/maninvoice.pl" method="post" id="maninvoice"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
        <fieldset class="rows">
        <legend>Manual invoice</legend>
        <ol>
@@ -49,7 +50,7 @@
           <option value="N">New card</option>
           <option value="M">Sundry</option>
           [% FOREACH invoice_types_loo IN invoice_types_loop %]
-            <option value="[% invoice_types_loo.authorised_value %]">[% invoice_types_loo.authorised_value %]</option>
+            <option value="[% invoice_types_loo.authorised_value | html %]">[% invoice_types_loo.authorised_value | html %]</option>
           [% END %]
         </select>
       </li>
@@ -58,7 +59,7 @@
     <li><label for="note">Note: </label><input type="text" name="note" size="50" id="note" /></li>
     <li><label for="amount">Amount: </label><input type="number" name="amount" id="amount" required="required" value="" step="any" min="0" /> Example: 5.00</li>
        </ol></fieldset>
-<fieldset class="action"><input type="submit" name="add" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a></fieldset>
+<fieldset class="action"><input type="submit" name="add" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a></fieldset>
 </form>
 
 [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         var type_fees = {'L':'','F':'','A':'','N':'','M':''};
         [% FOREACH invoice_types_loo IN invoice_types_loop %]
-            type_fees['[% invoice_types_loo.authorised_value %]'] = "[% invoice_types_loo.lib %]";
+            type_fees['[% invoice_types_loo.authorised_value | html %]'] = "[% invoice_types_loo.lib | html %]";
         [% END %]
         $(document).ready(function(){
             $('#maninvoice').preventDoubleFormSubmit();
index 804e24b..c46e1ff 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% PROCESS 'permissions.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Patrons &rsaquo; Set permissions for [% patron.surname %], [% patron.firstname %]</title>
-[% Asset.css("css/treeview/jquery.treeview.css") %]
+<title>Koha &rsaquo; Patrons &rsaquo; Set permissions for [% patron.surname | html %], [% patron.firstname | html %]</title>
+[% Asset.css("css/treeview/jquery.treeview.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patron-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Set permissions for [% patron.surname %], [% patron.firstname %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Set permissions for [% patron.surname | html %], [% patron.firstname | html %]</div>
 
 <div id="doc3" class="yui-t2">
    
 [% INCLUDE 'members-toolbar.inc' %]
 
 <form method="post" action="/cgi-bin/koha/members/member-flags.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
-    <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    <input type="hidden" name="member" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
     <input type="hidden" name="newflags" value="1" />
-    <h1>Set permissions for [% patron.surname %], [% patron.firstname %]</h1>
+    <h1>Set permissions for [% patron.surname | html %], [% patron.firstname | html %]</h1>
     <!-- <ul id="permissionstree"><li class="root">All privileges<ul> -->
     <ul id="permissionstree" class="treeview-grey">
         <!-- <li class="folder-close">One level down<ul> -->
         [% END %]
                        [% IF ( loo.checked ) %]
           [% IF disable_superlibrarian_privs && loo.bit == 0 %]
-              <input type="checkbox" disabled="disabled" class="flag parent superlib" id="flag-[% loo.bit %]_disabled" name="flag" value="[% loo.flag %]" checked="checked" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
-              <input type="hidden" id="flag-[% loo.bit %]" name="flag" value="[% loo.flag %]" >
+              <input type="checkbox" disabled="disabled" class="flag parent superlib" id="flag-[% loo.bit | html %]_disabled" name="flag" value="[% loo.flag | html %]" checked="checked" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
+              <input type="hidden" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" >
           [% ELSE %]
-              <input type="checkbox" class="flag parent" id="flag-[% loo.bit %]" name="flag" value="[% loo.flag %]" checked="checked" />
+              <input type="checkbox" class="flag parent" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" checked="checked" />
           [% END %]
                        [% ELSE %]
           [% IF disable_superlibrarian_privs && loo.bit == 0 %]
-              <input type="checkbox" disabled="disabled" class="flag parent" id="flag-[% loo.bit %]_disabled" name="flag" value="[% loo.flag %]" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
+              <input type="checkbox" disabled="disabled" class="flag parent" id="flag-[% loo.bit | html %]_disabled" name="flag" value="[% loo.flag | html %]" title="The system preference ProtectSuperlibrarianPrivileges is enabled" />
           [% ELSE %]
-              <input type="checkbox" class="flag parent" id="flag-[% loo.bit %]" name="flag" value="[% loo.flag %]" />
+              <input type="checkbox" class="flag parent" id="flag-[% loo.bit | html %]" name="flag" value="[% loo.flag | html %]" />
           [% END %]
                        [% END %]
-                <label class="permissioncode" for="flag-[% loo.bit %]">[% loo.flag %]</label>
+                <label class="permissioncode" for="flag-[% loo.bit | html %]">[% loo.flag | html %]</label>
                 <span class="permissiondesc">[% PROCESS main_permissions name=loo.flag %]</span>
             [% IF ( loo.sub_perm_loop ) %]
-                <ul id="flag-[% loo.bit %]-children">
+                <ul id="flag-[% loo.bit | html %]-children">
                     [% FOREACH sub_perm_loo IN loo.sub_perm_loop %]
                         <li>
                                    [% IF ( sub_perm_loo.checked ) %]
-                            <input type="checkbox" class="flag child" id="[% sub_perm_loo.id %]" name="flag" value="[% sub_perm_loo.perm %]" checked="checked" />
+                            <input type="checkbox" class="flag child" id="[% sub_perm_loo.id | html %]" name="flag" value="[% sub_perm_loo.perm | html %]" checked="checked" />
                                    [% ELSE %]
-                            <input type="checkbox" class="flag child" id="[% sub_perm_loo.id %]" name="flag" value="[% sub_perm_loo.perm %]" />
+                            <input type="checkbox" class="flag child" id="[% sub_perm_loo.id | html %]" name="flag" value="[% sub_perm_loo.perm | html %]" />
                                    [% END %]
-                    <label class="permissioncode" for="[% sub_perm_loo.id %]">[% sub_perm_loo.code %]</label>
+                    <label class="permissioncode" for="[% sub_perm_loo.id | html %]">[% sub_perm_loo.code | html %]</label>
                              <span class="permissiondesc">[% PROCESS sub_permissions name=sub_perm_loo.code %]</span>
                         </li>
                     [% END %]
@@ -74,7 +75,7 @@
     <!-- </ul></li></ul> -->
     </ul>
 
-<fieldset class="action"><input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a></fieldset>
+<fieldset class="action"><input type="submit" value="Save" /> <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a></fieldset>
 
 </form>
 </div>
@@ -87,8 +88,8 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.treeview.pack.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.treeview.pack.js") | $raw %]
     <!-- set up tree -->
     <script type="text/javascript">
         $(document).ready(function() {
index 976e529..eeb4178 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Patrons &rsaquo; [% IF ( newpassword ) %]Password updated [% ELSE %]Update password for [% patron.surname %], [% patron.firstname %][% END %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; [% IF ( newpassword ) %]Password updated [% ELSE %]Update password for [% patron.surname | html %], [% patron.firstname | html %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -11,7 +12,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patron-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a> &rsaquo; [% IF ( newpassword ) %]Password Updated[% ELSE %]Change username and/or password[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a> &rsaquo; [% IF ( newpassword ) %]Password Updated[% ELSE %]Change username and/or password[% END %]</div>
 
 <div id="doc3" class="yui-t2">
 
@@ -26,9 +27,9 @@
 [% ELSE %]
 
 <form method="post" id="changepasswordf" action="/cgi-bin/koha/members/member-password.pl">
-<input type="hidden" name="destination" value="[% destination %]" />
-<input type="hidden" name="cardnumber" value="[% patron.cardnumber %]" />
-<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
+<input type="hidden" name="destination" value="[% destination | html %]" />
+<input type="hidden" name="cardnumber" value="[% patron.cardnumber | html %]" />
+<input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
        [% IF ( errormsg ) %]
                <div class="dialog alert">
                <h4>The following errors have occurred:</h4>
@@ -37,7 +38,7 @@
         <li>You have entered a username that already exists. Please choose another one.</li>
                [% END %]
         [% IF ( ERROR_password_too_short ) %]
-            <li id="ERROR_short_password">Password must be at least [% Koha.Preference('minPasswordLength') %] characters long.</li>
+            <li id="ERROR_short_password">Password must be at least [% Koha.Preference('minPasswordLength') | html %] characters long.</li>
         [% END %]
         [% IF ( ERROR_password_too_weak ) %]
             <li id="ERROR_weak_password">Password must contain at least one digit, one lowercase and one uppercase.</li>
        [% END %]
 
 
-    <fieldset class="brief"><legend>Change username and/or password for [% patron.firstname %] [% patron.surname %]</legend>
+    <fieldset class="brief"><legend>Change username and/or password for [% patron.firstname | html %] [% patron.surname | html %]</legend>
        <ol>
     <li><label for="newuserid">New username:</label>
-    <input type="hidden" name="member" value="[% patron.borrowernumber %]" /><input type="text" id="newuserid" name="newuserid" size="20" value="[% patron.userid %]" /></li>
+    <input type="hidden" name="member" value="[% patron.borrowernumber | html %]" /><input type="text" id="newuserid" name="newuserid" size="20" value="[% patron.userid | html %]" /></li>
     [% SET password_pattern = ".{" _ Koha.Preference('minPasswordLength') _ ",}" %]
     [% IF Koha.Preference('RequireStrongPassword') %]
         [% SET password_pattern = '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{' _ Koha.Preference('minPasswordLength') _ ',}' %]
        </ol>
 </fieldset>
     <fieldset class="action">
-        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
         <input type="submit" value="Save" />
-        <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a>
+        <a class="cancel" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
     </fieldset>
 </form>[% END %]
 
 </div>
 </div>
-<div class="loading hide"><strong>Processing...</strong><img src="[% interface %]/[% theme %]/img/loading.gif" alt="" /></div>
+<div class="loading hide"><strong>Processing...</strong><img src="[% interface | html %]/[% theme | html %]/img/loading.gif" alt="" /></div>
 <div class="yui-b">
 [% INCLUDE 'circ-menu.inc' %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/JavaScript">
 
         function generate_password() {
             // Always generate a strong password
             var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
-            var length = [% Koha.Preference('minPasswordLength') %];
+            var length = [% Koha.Preference('minPasswordLength') | html %];
             if ( length < 8 ) length = 8;
             var password='';
             for ( var i = 0 ; i < length ; i++){
             $("body").on('click', "#fillrandom",function(e) {
                 e.preventDefault();
                 var password = '';
-                var pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% Koha.Preference('minPasswordLength') %],}/;
+                var pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% Koha.Preference('minPasswordLength') | html %],}/;
                 while ( ! pattern_regex.test( password ) ) {
                     password = generate_password();
                 }
index 7c130ee..1a765a6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE ColumnsSettings %]
@@ -7,7 +8,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons [% IF ( searching ) %]&rsaquo; Search results[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_member" class="pat">
           <div class="browse">
             Browse by last name:
             [% FOREACH letter IN alphabet.split(' ') %]
-                <a href="#" class="filterByLetter">[% letter %]</a>
+                <a href="#" class="filterByLetter">[% letter | html %]</a>
             [% END %]
           </div>
 
           [% IF CAN_user_borrowers_edit_borrowers && pending_borrower_modifications %]
             <div class="pending-info" id="patron_updates_pending">
               <a href="/cgi-bin/koha/members/members-update.pl">Patrons requesting modifications</a>:
-              <span class="number_box"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications %]</a></span>
+              <span class="number_box"><a href="/cgi-bin/koha/members/members-update.pl">[% pending_borrower_modifications | html %]</a></span>
             </div>
           [% END %]
 
@@ -68,7 +69,7 @@
                               [% IF patron_lists %]
                                   <optgroup label="Patron lists:">
                                       [% FOREACH pl IN patron_lists %]
-                                          <option value="[% pl.patron_list_id %]">[% pl.name |html %]</option>
+                                          <option value="[% pl.patron_list_id | html %]">[% pl.name | html %]</option>
                                       [% END %]
                                   </optgroup>
                               [% END %]
           <ol>
             <li>
               <label for="searchmember_filter">Search:</label>
-              <input type="text" id="searchmember_filter" value="[% searchmember %]"/>
+              <input type="text" id="searchmember_filter" value="[% searchmember | html %]"/>
             </li>
             <li>
               <label for="searchfieldstype_filter">Search fields:</label>
                 <option value="">Any</option>
                 [% FOREACH cat IN categories %]
                   [% IF cat.categorycode == categorycode_filter %]
-                    <option selected="selected" value="[% cat.categorycode %]">[% cat.description |html %]</option>
+                    <option selected="selected" value="[% cat.categorycode | html %]">[% cat.description | html %]</option>
                   [% ELSE %]
-                    <option value="[% cat.categorycode %]">[% cat.description |html %]</option>
+                    <option value="[% cat.categorycode | html %]">[% cat.description | html %]</option>
                   [% END %]
                 [% END %]
               </select>
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'columns_settings.inc' %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $('#merge-patrons').prop('disabled', true);
                 $("#searchmember_filter").val("[% searchmember | html %]");
             [% END %]
             [% IF searchfieldstype %]
-                $("searchfieldstype_filter").val("[% searchfieldstype %]");
+                $("searchfieldstype_filter").val("[% searchfieldstype | html %]");
             [% END %]
             [% IF searchtype %]
-                $("#searchtype_filter").val("[% searchtype %]");
+                $("#searchtype_filter").val("[% searchtype | html %]");
             [% END %]
             [% IF categorycode %]
-                $("#categorycode_filter").val("[% categorycode_filter %]");
+                $("#categorycode_filter").val("[% categorycode_filter | html %]");
             [% END %]
             [% IF branchcode %]
-                $("#branchcode_filter").val("[% branchcode_filter %]");
+                $("#branchcode_filter").val("[% branchcode_filter | html %]");
             [% END %]
 
             [% IF view != "show_results" %]
 
             // Build the aLengthMenu
             var aLengthMenu = [
-                [%PatronsPerPage %], 10, 20, 50, 100, -1
+                [% PatronsPerPage | html %], 10, 20, 50, 100, -1
             ];
             jQuery.unique(aLengthMenu);
             aLengthMenu.sort(function( a, b ){
             });
 
             // Apply DataTables on the results table
-            var columns_settings = [% ColumnsSettings.GetColumns( 'members', 'member', 'memberresultst', 'json' ) %];
+            var columns_settings = [% ColumnsSettings.GetColumns( 'members', 'member', 'memberresultst', 'json' ) | $raw %];
             [% UNLESS CAN_user_tools_manage_patron_lists %]
                 [%# Remove the first column if we do not display the checkbox %]
                 columns_settings.splice(0, 1);
                 [% END %]
                 "aLengthMenu": [aLengthMenu, aLengthMenuLabel],
                 'sPaginationType': 'full_numbers',
-                "iDisplayLength": [% PatronsPerPage %],
+                "iDisplayLength": [% PatronsPerPage | html %],
                 "bProcessing": true,
             }, columns_settings);
             update_searched();
index 695b1e2..52acc1d 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -10,9 +11,9 @@
         [% ELSIF ( opduplicate ) %]Duplicate
         [% ELSE %] Modify
         [% END %] patron
-        [% IF (firstname) %][% firstname %] [% END %]
-        [% IF (surname) %][% surname %] [% END %]
-        ([%IF categoryname %][% categoryname %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])
+        [% IF (firstname) %][% firstname | html %] [% END %]
+        [% IF (surname) %][% surname | html %] [% END %]
+        ([%IF categoryname %][% categoryname | html %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -25,8 +26,8 @@
 <div id="breadcrumbs">
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
     [% UNLESS blocking_error %]
-    &rsaquo;[% IF (firstname || surname ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">[% IF (firstname) %][% firstname | html %] [% END %][% IF (surname) %][% surname | html %] [% END %]</a>  &rsaquo;[% END %]
-<strong>[% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron ([%IF ( categoryname ) %][% categoryname %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])</strong>
+    &rsaquo;[% IF (firstname || surname ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">[% IF (firstname) %][% firstname | html %] [% END %][% IF (surname) %][% surname | html %] [% END %]</a>  &rsaquo;[% END %]
+<strong>[% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron ([%IF ( categoryname ) %][% categoryname | html %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])</strong>
     [% END %]
 </div>
 [% IF ( opadd ) %]<div id="doc" class="yui-t7">[% ELSE %]<div id="doc3" class="yui-t2">[% END %]
@@ -39,7 +40,7 @@
         [% IF ( error_alert == "no_email" ) %]
             <div class="error">This member has no email</div>
         [% ELSE %]
-            <div class="error">[% error_alert %]</div>
+            <div class="error">[% error_alert | html %]</div>
         [% END %]
     [% END %]
     [% IF info_alert %]
@@ -49,7 +50,7 @@
     [% INCLUDE 'noadd-warnings.inc' %]
 
        [% UNLESS ( no_add ) %]
-    <h1>[% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron [% IF (firstname) %][% firstname | html %] [% END %][% IF (surname) %][% surname | html %] [% END %]([%IF ( categoryname ) %][% categoryname %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])</h1>
+    <h1>[% IF ( opadd ) %]Add[% ELSIF ( opduplicate ) %]Duplicate[% ELSE %] Modify[% END %] patron [% IF (firstname) %][% firstname | html %] [% END %][% IF (surname) %][% surname | html %] [% END %]([%IF ( categoryname ) %][% categoryname | html %][% ELSE %][% IF ( I ) %]Organization[% END %][% IF ( A ) %]Adult[% END %][% IF ( C ) %]Child[% END %][% IF ( P ) %]Professional[% END %][% IF ( S ) %]Staff[% END %][% END %])</h1>
 
     [% IF quickadd && opadd && !check_member %]
         <a href="#" class="toggle_quick_add"><i class="fa fa-plus-square"></i> Show full form</a>
@@ -59,7 +60,7 @@
        [% IF ( check_member ) %]
                        <div class="dialog alert">
                                <h3>Duplicate patron record?</h3>
-                <p><a class="popup" href="#" onclick="Dopop('moremember.pl?print=brief&amp;borrowernumber=[% check_member %]');return false;" >View existing record</a></p>
+                <p><a class="popup" href="#" onclick="Dopop('moremember.pl?print=brief&amp;borrowernumber=[% check_member | html %]');return false;" >View existing record</a></p>
                 <button id="duplicate" type="submit" class="new"><i class="fa fa-pencil"></i> It is a duplicate.
                 Edit existing record</button>
 
@@ -83,7 +84,7 @@
             [% END %]
                        [% IF ( ERROR_age_limitations ) %]
             <li id="ERROR_age_limitations">Patron's age is incorrect for their category.
-                    Ages allowed are [% age_low %]-[% age_high %].</li>
+                    Ages allowed are [% age_low | html %]-[% age_high | html %].</li>
                        [% END %]
                        [% IF ( ERROR_branch ) %]
                                <li id="ERROR_branch">Library is invalid.</li>
@@ -98,7 +99,7 @@
                                <li id="ERROR_dateexpiry">Date of expiration is invalid.</li>
                        [% END %]
             [% IF ( ERROR_password_too_short ) %]
-                <li id="ERROR_short_password">Password must be at least [% minPasswordLength %] characters long.</li>
+                <li id="ERROR_short_password">Password must be at least [% minPasswordLength | html %] characters long.</li>
             [% END %]
             [% IF ( ERROR_password_too_weak ) %]
                 <li id="ERROR_weak_password">Password must contain at least one digit, one lowercase and one uppercase.</li>
                                <li id="ERROR_password_mismatch">Passwords do not match.</li>
                        [% END %]
             [% IF ( ERROR_extended_unique_id_failed ) %]
-                <li id="ERROR_extended_unique_id_failed"><strong>[% ERROR_extended_unique_id_failed_description %]:</strong> Attribute value "[% ERROR_extended_unique_id_failed_value %]" is already in use by another patron record.</li>
+                <li id="ERROR_extended_unique_id_failed"><strong>[% ERROR_extended_unique_id_failed_description | html %]:</strong> Attribute value "[% ERROR_extended_unique_id_failed_value | html %]" is already in use by another patron record.</li>
                        [% END %]
             [% IF ERROR_bad_email %]
                 <li id="ERROR_bad_email">The primary email is invalid.</li>
     [% IF opadd %]
         <a class="btn btn-default btn-sm" href="/cgi-bin/koha/members/member.pl" class="toggler save_entryform">
     [% ELSE %]
-        <a class="btn btn-default btn-sm" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">
+        <a class="btn btn-default btn-sm" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">
     [% END %]
         <i class="fa fa-times"></i> Cancel
     </a>
 
 <form name="form" id="entryform"  action="/cgi-bin/koha/members/memberentry.pl" method="post" autocomplete="off" class="toggler" >
 [% UNLESS ( check_member ) %]
-    <input type="hidden" name="nodouble"  value="[% nodouble %]" />
+    <input type="hidden" name="nodouble"  value="[% nodouble | html %]" />
 [% END %]
 <!--    field always hidden in different form (1,2,3) -->
-<input type="hidden" name="BorrowerMandatoryField" value="[% BorrowerMandatoryField %]" />
-<input type="hidden" name="category_type" value="[% category_type %]" />
-<input type="hidden" name="updtype" value="[% updtype %]" />
-<input type="hidden" name="destination" value="[% destination %]" />
-<input type="hidden" name="check_member" value="[% check_member %]" />
-<input type="hidden" name="borrowernumber" value="[% borrowernumber UNLESS opduplicate %]" />
-<input type="hidden" name="nodouble"  value="[% nodouble UNLESS opduplicate %]" />
-<input type="hidden" name="csrf_token" value="[% csrf_token %]" />
-[% IF ( step ) %]<input type="hidden" name="step"  value="[% step %]" />[% END %]
+<input type="hidden" name="BorrowerMandatoryField" value="[% BorrowerMandatoryField | html %]" />
+<input type="hidden" name="category_type" value="[% category_type | html %]" />
+<input type="hidden" name="updtype" value="[% updtype | html %]" />
+<input type="hidden" name="destination" value="[% destination | html %]" />
+<input type="hidden" name="check_member" value="[% check_member | html %]" />
+<input type="hidden" name="borrowernumber" value="[% borrowernumber | html UNLESS opduplicate %]" />
+<input type="hidden" name="nodouble"  value="[% nodouble | html UNLESS opduplicate %]" />
+<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+[% IF ( step ) %]<input type="hidden" name="step"  value="[% step | html %]" />[% END %]
 [% IF ( opadd ) %]<input type="hidden" name="op" value="insert" />
 [% ELSIF ( opduplicate ) %]
 <input type="hidden" name="op" value="insert" />
 [% IF step == 4 || step == 5 || step == 6 || step == 2 || step == 1 || step == 7 %]
 [%# Only put the cardnumber if we arent showing it in the form later %]
 [% IF cardnumber %]
-<input type="hidden" name="cardnumber" value="[% cardnumber %]" />
+<input type="hidden" name="cardnumber" value="[% cardnumber | html %]" />
 [% END %]
 [% END %]
 [% END %]
                 <option value=""></option>
                 [% FOREACH t IN Koha.Preference('BorrowersTitles').split('\|') %]
                     [% IF btitle == t %]
-                        <option value="[% t %]" selected="selected">[% t %]</option>
+                        <option value="[% t | html %]" selected="selected">[% t | html %]</option>
                     [% ELSE %]
-                        <option value="[% t %]">[% t %]</option>
+                        <option value="[% t | html %]">[% t | html %]</option>
                     [% END %]
                 [% END %]
             </select>
         [% END %]
 
                [% IF ( uppercasesurnames ) %]
-            <input style="text-transform:uppercase;" type="text" id="surname" name="surname" size="20"  value="[% surname %]" />
+            <input style="text-transform:uppercase;" type="text" id="surname" name="surname" size="20"  value="[% surname | html %]" />
                [% ELSE %]
-            <input type="text" id="surname" name="surname" size="20"  value="[% surname %]" />
+            <input type="text" id="surname" name="surname" size="20"  value="[% surname | html %]" />
                [% END %]
                [% IF ( mandatorysurname ) %]<span class="required">Required</span>[% END %]
                </li>
                 [% END %]
                 Date of birth: </label>
 
-                <input type="text" id="dateofbirth" name="dateofbirth" size="20" onchange="write_age();" value="[% dateofbirth UNLESS opduplicate %]" class="datepicker" />
+                <input type="text" id="dateofbirth" name="dateofbirth" size="20" onchange="write_age();" value="[% dateofbirth | html UNLESS opduplicate %]" class="datepicker" />
 
         [% IF ( mandatorydateofbirth ) %]<span class="required">Required</span>[% END %]
         [% IF ( ERROR_dateofbirth ) %]<span class="required">(Error)</span>[% END %]
 [% END # hide fieldset %]
 
 [% IF ( showguarantor ) %]
-    <input type="hidden" id="guarantorid" name="guarantorid"   value="[% guarantorid %]" />
+    <input type="hidden" id="guarantorid" name="guarantorid"   value="[% guarantorid | html %]" />
     [% UNLESS step_6 %]
-        <input type="hidden" name="branchcode" value="[% branchcode %]" />
+        <input type="hidden" name="branchcode" value="[% branchcode | html %]" />
     [% END %]
     <fieldset id="memberentry_guarantor" class="rows">
         <legend id="guarantor_lgd">Guarantor information</legend>
                [% ELSE %]
                <li id="contact-details" style="display: none">
                [% END %]
-                   <span class="label">Organization #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid %]</a>[% END %]
+                   <span class="label">Organization #:</span> [% IF ( guarantorid ) %] <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid | html %]" target="blank">[% guarantorid | html %]</a>[% END %]
                </li>
                <li>
                    <label for="contactname">Organization name: </label>
                    [% IF ( guarantorid ) %]
-                   <span>[% contactname %]</span>
+                   <span>[% contactname | html %]</span>
                    <input name="contactname" id="contactname" type="hidden" size="20" value="[% contactname | html %]" />
                    [% ELSE %]
                     <input name="contactname" id="contactname" type="text" size="20" value="[% contactname | html %]" />
      <span class="label">Patron #:</span>
      [% IF guarantorid %]
         [% IF logged_in_user.can_see_patron_infos( guarantor ) %]
-            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid %]" target="blank">[% guarantorid | html %]</a>
+            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantorid | html %]" target="blank">[% guarantorid | html %]</a>
         [% ELSE %]
             [% guarantorid | html %]
         [% END %]
  <li>
      <label for="contactname">Surname: </label>
      [% IF ( guarantorid ) %]
-     <span>[% contactname %]</span>
+     <span>[% contactname | html %]</span>
      <input name="contactname" id="contactname" type="hidden" size="20" value="[% contactname | html %]" />
      [% ELSE %]
         <input name="contactname" id="contactname" type="text" size="20" value="[% contactname | html %]" />
  <li>
      <label for="contactfirstname">First name: </label>
      [% IF ( guarantorid ) %]
-     <span>[% contactfirstname %]</span>
+     <span>[% contactfirstname | html %]</span>
      <input name="contactfirstname" id="contactfirstname" type="hidden" size="20" value="[% contactfirstname | html %]" />
      [% ELSE %]
         <input name="contactfirstname" id="contactfirstname" type="text" size="20" value="[% contactfirstname | html %]" />
      <select name="relationship" id="relationship" >
          [% FOREACH relshiploo IN relshiploop %]
          [% IF ( relshiploo.selected ) %]
-         <option value="[% relshiploo.relationship %]" selected="selected" >[% relshiploo.relationship %]</option>
+         <option value="[% relshiploo.relationship | html %]" selected="selected" >[% relshiploo.relationship | html %]</option>
          [% ELSE %]
-         <option value="[% relshiploo.relationship %]">[% relshiploo.relationship %]</option>
+         <option value="[% relshiploo.relationship | html %]">[% relshiploo.relationship | html %]</option>
          [% END %]
          [% END %]
      </select>
 
 [% END %]
 [% UNLESS noaddress && noaddress2 && nocity && nostate && nozipcode && nocountry %]
-    [% IF Koha.Preference( 'AddressFormat' ) %]
-        [% INCLUDE "member-main-address-style-${ Koha.Preference( 'AddressFormat' ) }.inc" %]
-    [% ELSE %]
-        [% INCLUDE 'member-main-address-style-us.inc' %]
-    [% END %]
+    [% SWITCH Koha.Preference( 'AddressFormat' ) %]
+        [% CASE 'de' %]
+            [% INCLUDE 'member-main-address-style-de.inc' %]
+        [% CASE # us %]
+            [% INCLUDE 'member-main-address-style-us.inc' %]
+     [% END %]
 [% END # nostreet && nocity etc group%]
 
 [% UNLESS nophone && nophonepro && nomobile && noemail && noemailpro && nofax %]
 [% IF ( step_6 ) %]
 
     [% UNLESS noB_address && noB_address2 && noB_city && noB_zipcode && noB_state && noB_country &&nocontactnote && noB_phone && noB_email %]
-        [% IF Koha.Preference( 'AddressFormat' ) %]
-            [% INCLUDE "member-alt-address-style-${ Koha.Preference( 'AddressFormat' ) }.inc" %]
-        [% ELSE %]
+    [% SWITCH Koha.Preference( 'AddressFormat' ) %]
+        [% CASE 'de' %]
+            [% INCLUDE 'member-alt-address-style-de.inc' %]
+        [% CASE # us %]
             [% INCLUDE 'member-alt-address-style-us.inc' %]
-        [% END %]
+     [% END %]
+
     [% END # UNLESS noB_address && noB_city && noB_state && noB_phone && noB_email %]
 [% END %]
 [% IF ( step_2 ) %]
     [% UNLESS noaltcontactsurname && noaltcontactfirstname && noaltcontactaddress1 && noaltcontactaddress2 && noaltcontactaddress3 && noaltcontactstate && noaltcontactzipcode && noaltcontactcountry && noaltcontactphone %]
-        [% IF Koha.Preference( 'AddressFormat' ) %]
-            [% INCLUDE "member-alt-contact-style-${ Koha.Preference( 'AddressFormat' ) }.inc" %]
-        [% ELSE %]
+    [% SWITCH Koha.Preference( 'AddressFormat' ) %]
+        [% CASE 'de' %]
+            [% INCLUDE 'member-alt-contact-style-de.inc' %]
+        [% CASE # us %]
             [% INCLUDE 'member-alt-contact-style-us.inc' %]
-        [% END %]
+     [% END %]
     [% END # UNLESS noaltcontactsurname && noaltcontactfirstname etc %]
 
 [% END %]
 
           <!-- NOTE: div.hint closing tag isn't on the same line -->
           [% IF minlength_cardnumber == maxlength_cardnumber %]
-                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" minlength="[% minlength_cardnumber %]" maxlength="[% maxlength_cardnumber %]" />
-                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber %] characters.</span>
-                <div class="hint">Card number must be exactly [% minlength_cardnumber %] characters.
+                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" minlength="[% minlength_cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
+                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber | html %] characters.</span>
+                <div class="hint">Card number must be exactly [% minlength_cardnumber | html %] characters.
           [% ELSIF minlength_cardnumber && maxlength_cardnumber %]
-                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" minlength="[% minlength_cardnumber %]" maxlength="[% maxlength_cardnumber %]" />
-                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber %] characters.</span>
-                <div class="hint">Card number must be between [% minlength_cardnumber %] and [% maxlength_cardnumber %] characters.
+                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" minlength="[% minlength_cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
+                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber | html %] characters.</span>
+                <div class="hint">Card number must be between [% minlength_cardnumber | html %] and [% maxlength_cardnumber | html %] characters.
           [% ELSIF maxlength_cardnumber %]
-                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" maxlength="[% maxlength_cardnumber %]" />
-                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber %] characters.</span>
-                <div class="hint">Card number can be up to [% maxlength_cardnumber %] characters.
+                <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
+                [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]<span id="cn_max" class="required">Card number must not be more than [% maxlength_cardnumber | html %] characters.</span>
+                <div class="hint">Card number can be up to [% maxlength_cardnumber | html %] characters.
           [% ELSE %]
                 <input type="text" id="cardnumber" name="cardnumber" size="20" value="[% cardnumber | html %]" />
                 [% IF mandatorycardnumber %]<span class="required">Required</span>[% END %]
                     [% IF ( typeloo.typename_X ) %]<optgroup label="Statistical">[% END %]
                 [% END %]
                 [% IF ( categoryloo.categorycodeselected ) %]
-                    <option value="[% categoryloo.categorycode %]" selected="selected" data-typename="[% typeloo.typename %]">[% categoryloo.categoryname %]</option>
+                    <option value="[% categoryloo.categorycode | html %]" selected="selected" data-typename="[% typeloo.typename | html %]">[% categoryloo.categoryname | html %]</option>
                 [% ELSE %]
-                    <option value="[% categoryloo.categorycode %]" data-typename="[% typeloo.typename %]">[% categoryloo.categoryname %]</option>
+                    <option value="[% categoryloo.categorycode | html %]" data-typename="[% typeloo.typename | html %]">[% categoryloo.categoryname | html %]</option>
                 [% END %]
                 [% IF ( loop.last ) %]
                     </optgroup>
                     [% FOR sublanguage IN language.sublanguages_loop %]
                         [% IF language.plural %]
                             [% IF sublanguage.rfc4646_subtag == lang %]
-                                <option value="[% sublanguage.rfc4646_subtag %]" selected="selected">[% sublanguage.native_description %] [% sublanguage.region_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                                <option value="[% sublanguage.rfc4646_subtag | html %]" selected="selected">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                             [% ELSE %]
-                                <option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] [% sublanguage.region_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                                <option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                             [% END %]
                         [% ELSE %]
                             [% IF sublanguage.rfc4646_subtag == lang %]
-                                <option value="[% sublanguage.rfc4646_subtag %]" selected="selected">[% sublanguage.native_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                                <option value="[% sublanguage.rfc4646_subtag | html %]" selected="selected">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                             [% ELSE %]
-                                <option value="[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] ([% sublanguage.rfc4646_subtag %])</option>
+                                <option value="[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</option>
                             [% END %]
                         [% END %]
                     [% END %]
                        [% END %]
                        Registration date: </label>
             [% IF ( dateformat == "metric" ) %]
-                <input type="text" id="from" name="dateenrolled"  maxlength="10" size="10" onchange="CheckDate(document.form.dateenrolled);check_manip_date('verify');" value="[% dateenrolled %]" class="datepickerfrom" />
+                <input type="text" id="from" name="dateenrolled"  maxlength="10" size="10" onchange="CheckDate(document.form.dateenrolled);check_manip_date('verify');" value="[% dateenrolled | html %]" class="datepickerfrom" />
             [% ELSE %]
-                <input type="text" id="from" name="dateenrolled"  maxlength="10" size="10" value="[% dateenrolled %]" class="datepickerfrom" />
+                <input type="text" id="from" name="dateenrolled"  maxlength="10" size="10" value="[% dateenrolled | html %]" class="datepickerfrom" />
             [% END %]
                [% IF ( mandatorydateenrolled ) %]<span class="required">Required</span>[% END %]
                [% IF ( ERROR_dateenrolled ) %]<span class="required">(Error)</span>[% END %]
                        Expiry date (leave blank for auto calc): </label>
             [% IF ( dateformat == "metric" ) %]
                                [% UNLESS ( opadd ) %]
-                    <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" onchange="CheckDate(document.form.dateexpiry);check_manip_date('verify');" value="[% dateexpiry UNLESS opduplicate %]" class="datepickerto" />
+                    <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" onchange="CheckDate(document.form.dateexpiry);check_manip_date('verify');" value="[% dateexpiry | html UNLESS opduplicate %]" class="datepickerto" />
                                [% ELSE %]
                     <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" onchange="CheckDate(document.form.dateexpiry);check_manip_date('verify');" class="datepickerto" />
                                [% END %]
                        [% ELSE %]
                                [% UNLESS ( opadd ) %]
-                <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" value="[% dateexpiry UNLESS opduplicate %]" class="datepickerto" />
+                <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" value="[% dateexpiry | html UNLESS opduplicate %]" class="datepickerto" />
                                [% ELSE %]
-                <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" value="[% dateexpiry %]" class="datepickerto" />
+                <input type="text" id="to" name="dateexpiry" maxlength="10"  size="10" value="[% dateexpiry | html %]" class="datepickerto" />
                                [% END %]
                        [% END %]
                [% IF ( mandatorydateexpiry ) %]<span class="required">Required</span>[% END %]
        [% IF ( opduplicate ) %]
                <input type="text" id="userid" name="userid" size="20" disabled="disabled" />
        [% ELSE %]
-               <input type="text" id="userid" name="userid" size="20" disabled="disabled" value="[% userid %]" />
+               <input type="text" id="userid" name="userid" size="20" disabled="disabled" value="[% userid | html %]" />
        [% END %]
 [% ELSE %]
        [% IF ( opduplicate ) %]
                <input type="text" id="userid" name="userid" size="20" value="" />
        [% ELSE %]
-               <input type="text" id="userid" name="userid" size="20" value="[% userid %]" />
+               <input type="text" id="userid" name="userid" size="20" value="[% userid | html %]" />
        [% END %]
 [% END %]
 
                                [% IF ( opduplicate ) %]
                                        <input type="password" id="password" name="password" size="20"  disabled="disabled" />
                                [% ELSE %]
-                                       <input type="password" id="password" name="password" size="20"  disabled="disabled" value="[% password %]" />
+                                       <input type="password" id="password" name="password" size="20"  disabled="disabled" value="[% password | html %]" />
                                [% END %]
 [% ELSE %]
                                [% IF ( opduplicate ) %]
                                        <input type="password" id="password" name="password" size="20" />
                                [% ELSE %]
-                                       <input type="password" id="password" name="password" size="20" value="[% password %]" />
+                                       <input type="password" id="password" name="password" size="20" value="[% password | html %]" />
                                [% END %]
 [% END %]
                        [% ELSE %]
             [% IF ( ERROR_password_too_short ) %]<span class="required">Password is too short</span>[% END %]
             [% IF ( ERROR_password_too_weak ) %]<span class="required">Password is too weak</span>[% END %]
             [% IF ( ERROR_password_has_whitespaces ) %]<span class="required">Password has leading or trailing whitespaces</span>[% END %]
-            <div class="hint">Minimum password length: [% minPasswordLength %]</div>
+            <div class="hint">Minimum password length: [% minPasswordLength | html %]</div>
                </li>
                <li>
                        [% IF ( mandatorypassword ) %]
                                [% IF ( opduplicate ) %]
                                        <input type="password" id="password2" name="password2" size="20"  disabled="disabled" />
                                [% ELSE %]
-                                       <input type="password" id="password2" name="password2" size="20"  disabled="disabled" value="[% password %]" />
+                                       <input type="password" id="password2" name="password2" size="20"  disabled="disabled" value="[% password | html %]" />
                                [% END %]
 [% ELSE %]
                                [% IF ( opduplicate ) %]
                                        <input type="password" id="password2" name="password2" size="20" />
                                [% ELSE %]
-                                       <input type="password" id="password2" name="password2" size="20" value="[% password %]" />
+                                       <input type="password" id="password2" name="password2" size="20" value="[% password | html %]" />
                                [% END %]
 [% END %]
                        [% ELSE %]
             <legend id="account_flags_lgd">Patron account flags</legend>
                        <ol class="radio">
                        [% FOREACH flagloo IN flagloop %]
-                               <li><label class="radio" for="yes[% flagloo.name %]">
+                               <li><label class="radio" for="yes[% flagloo.name | html %]">
                 [% IF ( flagloo.key == 'gonenoaddress' ) %]Gone no address:[% END %]
                 [% IF ( flagloo.key == 'lost' ) %]Lost card:[% END %]
                 </label>
                 [% IF CAN_user_circulate_manage_restrictions %]
-                            <label for="yes[% flagloo.name %]">
+                            <label for="yes[% flagloo.name | html %]">
                                [% IF ( flagloo.yes ) %]
-                               <input type="radio" id="yes[% flagloo.name %]" name="[% flagloo.name %]" value="1" checked="checked" />
+                               <input type="radio" id="yes[% flagloo.name | html %]" name="[% flagloo.name | html %]" value="1" checked="checked" />
                                [% ELSE %]
-                               <input type="radio" id="yes[% flagloo.name %]" name="[% flagloo.name %]" value="1" />
+                               <input type="radio" id="yes[% flagloo.name | html %]" name="[% flagloo.name | html %]" value="1" />
                                [% END %]
                             Yes </label>
-                            <label for="no[% flagloo.name %]">
+                            <label for="no[% flagloo.name | html %]">
                                [% IF ( flagloo.no ) %]
-                               <input type="radio" id="no[% flagloo.name %]" name="[% flagloo.name %]" value="0" checked="checked"/>
+                               <input type="radio" id="no[% flagloo.name | html %]" name="[% flagloo.name | html %]" value="0" checked="checked"/>
                                [% ELSE %]
-                               <input type="radio" id="no[% flagloo.name %]" name="[% flagloo.name %]" value="0" />
+                               <input type="radio" id="no[% flagloo.name | html %]" name="[% flagloo.name | html %]" value="0" />
                                [% END %]
                             No </label>
                 [% ELSE %]
                         <tbody>
                             [% FOREACH d IN debarments %]
                                 <tr>
-                                    <td>[% d.type %]</td>
+                                    <td>[% d.type | html %]</td>
                                     <td>
                                     [% IF d.comment.search('OVERDUES_PROCESS') %]
-                                        Restriction added by overdues process [% d.comment.remove('OVERDUES_PROCESS ') %]
+                                        Restriction added by overdues process [% d.comment.remove('OVERDUES_PROCESS ') | $raw %]
                                     [% ELSE %]
-                                        [% d.comment %]
+                                        [% d.comment | $raw %]
                                     [% END %]
                                     </td>
                                     <td>[% IF d.expiration %] [% d.expiration | $KohaDates %] [% ELSE %] <i>Indefinite</i> [% END %]</td>
                                     <td>[% d.created | $KohaDates %]</td>
                                     [% IF CAN_user_borrowers_edit_borrowers && CAN_user_circulate_manage_restrictions %]
                                       <td>
-                                        <input type="checkbox" id="debarment_[% d.borrower_debarment_id %]" name="remove_debarment" value="[% d.borrower_debarment_id %]" />
+                                        <input type="checkbox" id="debarment_[% d.borrower_debarment_id | html %]" name="remove_debarment" value="[% d.borrower_debarment_id | html %]" />
                                       </td>
                                     [% END %]
                                 </tr>
     <input type="hidden" name="setting_extended_patron_attributes" value="1" />
     [% FOREACH pa_loo IN patron_attributes %]
         [% IF pa_loo.class %]
-            <fieldset id="aai_[% pa_loo.class %]">
-            <legend id="[% pa_loo.class %]_lgd">[% pa_loo.lib %]</legend>
+            <fieldset id="aai_[% pa_loo.class | html %]">
+            <legend id="[% pa_loo.class | html %]_lgd">[% pa_loo.lib | html %]</legend>
         [% END %]
         <ol class="attributes_table">
             [% FOREACH patron_attribute IN pa_loo.items %]
-                <li data-category_code="[% patron_attribute.category_code %]">
-                    <label for="[% patron_attribute.form_id %]">[% patron_attribute.description %]: </label>
+                <li data-category_code="[% patron_attribute.category_code | html %]">
+                    <label for="[% patron_attribute.form_id | html %]">[% patron_attribute.description | html %]: </label>
                         [% IF ( patron_attribute.use_dropdown ) %]
-                            <select id="[% patron_attribute.form_id %]" name="[% patron_attribute.form_id %]">
+                            <select id="[% patron_attribute.form_id | html %]" name="[% patron_attribute.form_id | html %]">
                                 <option value=""></option>
                                 [% FOREACH auth_val_loo IN patron_attribute.auth_val_loop %]
                                     [% IF auth_val_loo.authorised_value == patron_attribute.value %]
-                                        <option value="[% auth_val_loo.authorised_value %]" selected="selected">
-                                            [% auth_val_loo.lib %]
+                                        <option value="[% auth_val_loo.authorised_value | html %]" selected="selected">
+                                            [% auth_val_loo.lib | html %]
                                         </option>
                                     [% ELSE %]
-                                        <option value="[% auth_val_loo.authorised_value %]" >
-                                            [% auth_val_loo.lib %]
+                                        <option value="[% auth_val_loo.authorised_value | html %]" >
+                                            [% auth_val_loo.lib | html %]
                                         </option>
                                     [% END %]
                                 [% END %]
                             </select>
                         [% ELSE %]
-                            <textarea rows="2" cols="30" id="[% patron_attribute.form_id %]" name="[% patron_attribute.form_id %]">[% patron_attribute.value %]</textarea>
+                            <textarea rows="2" cols="30" id="[% patron_attribute.form_id | html %]" name="[% patron_attribute.form_id | html %]">[% patron_attribute.value | html %]</textarea>
                         [% END %]
-                        <input type="hidden" id="[% patron_attribute.form_id %]_code" name="[% patron_attribute.form_id %]_code" value="[% patron_attribute.code |html %]" />
+                        <input type="hidden" id="[% patron_attribute.form_id | html %]_code" name="[% patron_attribute.form_id | html %]_code" value="[% patron_attribute.code | html %]" />
                         <a href="#" onclick="clear_entry(this); return false;"><i class="fa fa-fw fa-trash"></i> Clear</a>
                         [% IF ( patron_attribute.repeatable ) %]
                         <a href="#" onclick="clone_entry(this); return false;"><i class="fa fa-fw fa-plus"></i> New</a>
     [% INCLUDE 'messaging-preference-form.inc' %]
     [% IF ( SMSSendDriver ) %]
         <p><label for="SMSnumber">SMS number:</label>
-            <input type="text" id="SMSnumber" name="SMSnumber" value="[% SMSnumber %]" />
+            <input type="text" id="SMSnumber" name="SMSnumber" value="[% SMSnumber | html %]" />
         </p>
         [% UNLESS nosms_provider_id %]
         <p>
                 <option value="">Unknown</option>
                 [% FOREACH s IN sms_providers %]
                     [% IF s.id == sms_provider_id %]
-                        <option value="[% s.id %]" selected="selected">[% s.name %]</option>
+                        <option value="[% s.id | html %]" selected="selected">[% s.name | html %]</option>
                     [% ELSE %]
-                        <option value="[% s.id %]">[% s.name %]</option>
+                        <option value="[% s.id | html %]">[% s.name | html %]</option>
                     [% END %]
                 [% END %]
             </select>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
 
                 })
 
             [% IF categorycode %]
-                update_category_code( "[% categorycode %]" );
+                update_category_code( "[% categorycode | html %]" );
             [% ELSE %]
                 if ( $("#categorycode_entry").length > 0 ){
                     var category_code = $("#categorycode_entry").find("option:selected").val();
         });
 
         function update_cardnumber_warning(size){
-            var max_len = [% maxlength_cardnumber %];
+            var max_len = [% maxlength_cardnumber | html %];
             if ( size >= max_len ) {
                 $("#cn_max").show();
             } else {
 
             $('#duplicate').on('click', function() {
                 $("input[name='op']").val('modify');
-                $("input[name='borrowernumber']").val('[% check_member %]');
+                $("input[name='borrowernumber']").val('[% check_member | html %]');
                 $("input[name='check_member']").val('');
                 $('#entryform').submit();
             });
             $(document).ready(function () {
 
                 $("#entryform,#saverecord").hide();
-                [% q_add_f = Koha.Preference('PatronQuickAddFields').split('\|') %]
-                var qaddfields = [[% FOREACH field IN q_add_f.unique %]"[% field %]",[% END %]];
+                [% q_add_f = Koha.Preference('PatronQuickAddFields').split('\|') | html %]
+                var qaddfields = [[% FOREACH field IN q_add_f.unique %]"[% field | html %]",[% END %]];
                 var skipped_fields = ["contactname","contactfirstname","relationship"]; //Guarantor form is pulled as a whole, ignore individual fields
                 $("#entryform label").each(function () {
                     var input_label = $(this).attr('for');
         [% END %]
 
     </script>
-    [% Asset.js("js/members.js") %]
-    [% Asset.js("js/messaging-preference-form.js") %]
+    [% Asset.js("js/members.js") | $raw %]
+    [% Asset.js("js/messaging-preference-form.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 26667e2..687afde 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
@@ -62,7 +63,7 @@
 [% CASE 'altcontactphone'     %]<span>Alternate contact: Phone</span>
 [% CASE 'smsalertnumber'      %]<span>SMS alert number</span>
 [% CASE 'extended_attributes' %]<span>Additional attributes and identifiers</span>
-[% CASE %][% field %]
+[% CASE %][% field | html %]
 [% END %]
 [% END %]
 
@@ -80,9 +81,9 @@
 
 [% BLOCK display_attribute %]
     [% IF type.authorised_value_category %]
-        [% AuthorisedValues.GetByCode(type.authorised_value_category,attr.attribute) %]
+        [% AuthorisedValues.GetByCode(type.authorised_value_category,attr.attribute) | html %]
     [% ELSE %]
-        [% attr.attribute %]
+        [% attr.attribute | html %]
     [% END %]
 [% END %]
 
                     <div id="pending_updates">
                             [% FOREACH pm IN PendingModifications %]
                                 [% SET borrowernumber = pm.borrowernumber %]
-                                <h3><a href="#panel_modify_[% pm.borrowernumber %]">[% borrowers.$borrowernumber.surname %][% IF ( borrowers.$borrowernumber.firstname ) %], [% borrowers.$borrowernumber.firstname %][% END %] - [% Categories.GetName( borrowers.$borrowernumber.categorycode ) %] ([% Branches.GetName( borrowers.$borrowernumber.branchcode ) %]) ([% borrowers.$borrowernumber.cardnumber %]) - Requested on [% pm.timestamp | $KohaDates with_hours = 1 %]</a></h3>
-                                <div id="panel_modify_[% pm.borrowernumber %]">
+                                <h3><a href="#panel_modify_[% pm.borrowernumber | html %]">[% borrowers.$borrowernumber.surname | html %][% IF ( borrowers.$borrowernumber.firstname ) %], [% borrowers.$borrowernumber.firstname | html %][% END %] - [% Categories.GetName( borrowers.$borrowernumber.categorycode ) | html %] ([% Branches.GetName( borrowers.$borrowernumber.branchcode ) | html %]) ([% borrowers.$borrowernumber.cardnumber | html %]) - Requested on [% pm.timestamp | $KohaDates with_hours = 1 | html %]</a></h3>
+                                <div id="panel_modify_[% pm.borrowernumber | html %]">
                                     <div style="background-color:#E6F0F2;padding:.5em;margin:.3em 0;">
-                                        <input type="radio" id="approve_modify_[% pm.borrowernumber %]" name="modify_[% pm.borrowernumber %]" value="approve" />
-                                        <label for="approve_modify_[% pm.borrowernumber %]">Approve</label>
+                                        <input type="radio" id="approve_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="approve" />
+                                        <label for="approve_modify_[% pm.borrowernumber | html %]">Approve</label>
 
-                                        <input type="radio" id="deny_modify_[% pm.borrowernumber %]" name="modify_[% pm.borrowernumber %]" value="deny" />
-                                        <label for="deny_modify_[% pm.borrowernumber %]">Deny</label>
+                                        <input type="radio" id="deny_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="deny" />
+                                        <label for="deny_modify_[% pm.borrowernumber | html %]">Deny</label>
 
-                                        <input type="radio" id="ignore_modify_[% pm.borrowernumber %]" name="modify_[% pm.borrowernumber %]" value="ignore" checked="checked"/>
-                                        <label for="ignore_modify_[% pm.borrowernumber %]">Ignore</label>
-                                        | <a target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% pm.borrowernumber %]" >Patron details</a>
+                                        <input type="radio" id="ignore_modify_[% pm.borrowernumber | html %]" name="modify_[% pm.borrowernumber | html %]" value="ignore" checked="checked"/>
+                                        <label for="ignore_modify_[% pm.borrowernumber | html %]">Ignore</label>
+                                        | <a target="_blank" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% pm.borrowernumber | html %]" >Patron details</a>
                                     </div>
                                   [% IF !pm.extended_attributes and pm.size > 3 or pm.extended_attributes and pm.size > 4 %]
                                   [%# timestamp+verification_token+borrowernumber=3 %]
                                                                 <td>[% borrowers.$borrowernumber.$key | $KohaDates %]</td>
                                                                 <td>[% pm.$key | $KohaDates %]</td>
                                                             [% ELSIF key == 'branchcode' %]
-                                                                <td>[% Branches.GetName( borrowers.$borrowernumber.$key )  %]</td>
-                                                                <td>[% Branches.GetName( pm.$key ) %]</td>
+                                                                <td>[% Branches.GetName( borrowers.$borrowernumber.$key ) | html %]</td>
+                                                                <td>[% Branches.GetName( pm.$key ) | html %]</td>
                                                             [% ELSE %]
-                                                                <td>[% borrowers.$borrowernumber.$key %]</td>
-                                                                <td>[% pm.$key %]</td>
+                                                                <td>[% borrowers.$borrowernumber.$key | html %]</td>
+                                                                <td>[% pm.$key | html %]</td>
                                                             [% END %]
                                                         </tr>
                                                     [% END %]
                                             </tr>
                                           [% FOREACH attribute_group IN borrowers.$borrowernumber.modified_attributes %]
                                             <tr>
-                                                <td>[% attribute_group.type.description %]</td>
+                                                <td>[% attribute_group.type.description | html %]</td>
                                                 <td>[% PROCESS display_extended_attributes attrs=attribute_group.before type=attribute_group.type %]</td>
                                                 <td>[% PROCESS display_extended_attributes attrs=attribute_group.after type=attribute_group.type %]</td>
                                             </tr>
                                     <div class="dialog message" style="margin-top:.8em">
                                         <h4>Patron's address in doubt</h4>
                                         <p>The <strong>Gone no address</strong> flag is set for this patron. If this modification request resolves the issue, please unset the flag.</p>
-                                        <input type="checkbox" id="unset_gna_[% pm.borrowernumber %]" name="unset_gna_[% pm.borrowernumber %]" value="unset_gna_[% pm.borrowernumber %]"/>
-                                        <label for="unset_gna_[% pm.borrowernumber %]">Unset Gone no address for this patron</label>
+                                        <input type="checkbox" id="unset_gna_[% pm.borrowernumber | html %]" name="unset_gna_[% pm.borrowernumber | html %]" value="unset_gna_[% pm.borrowernumber | html %]"/>
+                                        <label for="unset_gna_[% pm.borrowernumber | html %]">Unset Gone no address for this patron</label>
                                     </div>
                                   [% END %]
                                 </div>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(function() {
             $( "#pending_updates" ).accordion();
index 60faffc..1c257c0 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE Categories %]
@@ -38,7 +39,7 @@
         [% CASE 'Virtualshelfcontent'   %]list items
         [% CASE 'Virtualshelfshare'     %]list shares
         [% CASE 'Virtualshelve'         %]lists
-        [% CASE %][% rs %]
+        [% CASE %][% rs | html %]
     [% END %]
 [% END %]
 
                             <tbody>
                                 [% FOREACH p IN patrons %]
                                     <tr>
-                                        <td><input class='keeper' type='radio' name='keeper' value='[% p.id %]' /></td>
+                                        <td><input class='keeper' type='radio' name='keeper' value='[% p.id | html %]' /></td>
                                         <td>[% p.cardnumber | html %]</td>
                                         <td>[% INCLUDE 'patron-title.inc' patron = p %]</td>
                                         <td>[% p.dateofbirth | $KohaDates %]</td>
-                                        <td>[% Categories.GetName( p.categorycode ) %] ([% p.categorycode %])</td>
-                                        <td>[% Branches.GetName( p.branchcode ) %]</td>
+                                        <td>[% Categories.GetName( p.categorycode ) | html %] ([% p.categorycode | html %])</td>
+                                        <td>[% Branches.GetName( p.branchcode ) | html %]</td>
                                         <td>[% p.dateexpiry | $KohaDates %]</td>
                                 [% END %]
                             </tbody>
                         </table>
 
                         [% FOREACH p IN patrons %]
-                            <input type="hidden" name="id" value="[% p.id %]" />
+                            <input type="hidden" name="id" value="[% p.id | html %]" />
                         [% END %]
 
                         <p/>
                     [% IF error == 'INVALID_KEEPER' %]
                         <div class="dialog alert">Merge failed! The patron to keep was invalid.</div>
                     [% ELSE %]
-                        <div class="dialog alert">Merge failed! The following error was reported: [% error %].</div>
+                        <div class="dialog alert">Merge failed! The following error was reported: [% error | html %].</div>
                     [% END %]
                 [% ELSIF !results.merged.keys.size %]
                     <div class="dialog alert">No valid patrons to merge were found.</div>
                 [% ELSE %]
                     <p>
-                        Patron records merged into <a href="moremember.pl?borrowernumber=[% keeper.id %]">[% INCLUDE 'patron-title.inc' patron = keeper %]</a>
+                        Patron records merged into <a href="moremember.pl?borrowernumber=[% keeper.id | html %]">[% INCLUDE 'patron-title.inc' patron = keeper %]</a>
                     </p>
 
                     [% FOREACH pair IN results.merged.pairs %]
                             [% SET count = r.value %]
                             [% IF count %]
                                 <p>
-                                    <span>[% count %] [% PROCESS display_names rs = name %] transferred.</span>
+                                    <span>[% count | html %] [% PROCESS display_names rs = name %] transferred.</span>
                                     [% IF name == 'Reserve' %]
                                         <strong>It is advisable to check for and resolve duplicate holds due to merging.</strong>
                                     [% END %]
                 [% END %]
 
                 [% UNLESS error %]
-                    <a class="btn btn-default btn-sm" href="moremember.pl?borrowernumber=[% keeper.id %]">View patron record</a>
+                    <a class="btn btn-default btn-sm" href="moremember.pl?borrowernumber=[% keeper.id | html %]">View patron record</a>
                 [% END %]
             [% END %]
         </div>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 
     <script>
     $(document).ready(function() {
index 0c2270a..0c3a517 100644 (file)
 
             <div class="col-xs-12">
        <h3>[% UNLESS ( I ) %]
-   [% title %] [% firstname %] [% END %] [% surname %] ([% cardnumber %])</h3>
+   [% title | html %] [% firstname | html %] [% END %] [% surname | html %] ([% cardnumber | html %])</h3>
             </div>
         </div>
         <div class="row">
             <div class="col-xs-6">
                 <div id="patron-information">
 
-     [% UNLESS ( I ) %][% IF ( othernames ) %]&ldquo;[% othernames %]&rdquo;[% END %]
+     [% UNLESS ( I ) %][% IF ( othernames ) %]&ldquo;[% othernames | html %]&rdquo;[% END %]
         <div class = "address">
             <ul>
                 [% IF Koha.Preference( 'AddressFormat' ) %]
         </div>
        <div class="rows">
                <ol>
-            [% IF ( phone ) %]<li><span class="label">Primary phone: </span>[% phone %]</li>[% END %]
-            [% IF ( phonepro ) %]<li><span class="label">Secondary phone: </span>[% phonepro %]</li>[% END %]
-            [% IF ( mobile ) %]<li><span class="label">Other phone: </span>[% mobile %]</li>[% END %]
-            [% IF ( fax ) %]<li><span class="label">Fax: </span>[% fax %]</li>[% END %]
-            [% IF ( email ) %]<li class="email"><span class="label">Primary email:</span><a href="mailto:[% email %]">[% email %]</a></li>[% END %]
-            [% IF ( emailpro ) %]<li class="email"><span class="label">Secondary email: </span><a href="mailto:[% emailpro %]">[% emailpro %]</a></li>[% END %]
+            [% IF ( phone ) %]<li><span class="label">Primary phone: </span>[% phone | html %]</li>[% END %]
+            [% IF ( phonepro ) %]<li><span class="label">Secondary phone: </span>[% phonepro | html %]</li>[% END %]
+            [% IF ( mobile ) %]<li><span class="label">Other phone: </span>[% mobile | html %]</li>[% END %]
+            [% IF ( fax ) %]<li><span class="label">Fax: </span>[% fax | html %]</li>[% END %]
+            [% IF ( email ) %]<li class="email"><span class="label">Primary email:</span><a href="mailto:[% email | html %]">[% email | html %]</a></li>[% END %]
+            [% IF ( emailpro ) %]<li class="email"><span class="label">Secondary email: </span><a href="mailto:[% emailpro | html %]">[% emailpro | html %]</a></li>[% END %]
             [% UNLESS ( I ) %]
-                [% IF ( inititals ) %]<li><span class="label">Initials: </span>[% initials %]</li>[% END %]
+                [% IF ( inititals ) %]<li><span class="label">Initials: </span>[% initials | html %]</li>[% END %]
                 [% IF ( dateofbirth ) %]<li><span class="label">Date of birth:</span>[% dateofbirth | $KohaDates %]</li>[% END %]
-                [% IF ( sex ) %]<li><span class="label">Gender:</span>[% IF ( sex == 'F' ) %]Female[% ELSIF ( sex == 'M' ) %]Male[% ELSE %][% sex %][% END %]</li>[% END %][% END %]
+                [% IF ( sex ) %]<li><span class="label">Gender:</span>[% IF ( sex == 'F' ) %]Female[% ELSIF ( sex == 'M' ) %]Male[% ELSE %][% sex | html %][% END %]</li>[% END %][% END %]
             [% END %]
     [% IF ( isguarantee ) %]
         [% IF ( guaranteeloop ) %]
-            <li><span class="label">Guarantees:</span><ul>[% FOREACH guaranteeloo IN guaranteeloop %]<li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guaranteeloo.borrowernumber %]">[% guaranteeloo.name %]  </a></li>[% END %]</ul></li>
+            <li><span class="label">Guarantees:</span><ul>[% FOREACH guaranteeloo IN guaranteeloop %]<li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guaranteeloo.borrowernumber | html %]">[% guaranteeloo.name | html %]  </a></li>[% END %]</ul></li>
         [% END %]
     [% ELSE %]
         [% IF ( guarantor.borrowernumber ) %]
-            <li><span class="label">Guarantor:</span><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantor.borrowernumber %]">[% guarantor.surname %], [% guarantor.firstname %]</a></li>
+            <li><span class="label">Guarantor:</span><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantor.borrowernumber | html %]">[% guarantor.surname | html %], [% guarantor.firstname | html %]</a></li>
         [% END %]
     [% END %]
        </ol>
@@ -61,9 +61,9 @@
        <h3>Library use</h3>
        <div class="rows">
        <ol>
-    <li><span class="label">Card number: </span>[% cardnumber %]</li>
-       <li><span class="label">Borrowernumber: </span> [% borrowernumber %]</li>
-    <li><span class="label">Category: </span>[% categoryname %] ([% categorycode %])</li>
+    <li><span class="label">Card number: </span>[% cardnumber | html %]</li>
+       <li><span class="label">Borrowernumber: </span> [% borrowernumber | html %]</li>
+    <li><span class="label">Category: </span>[% categoryname | html %] ([% categorycode | html %])</li>
     <li><span class="label">Registration date: </span>[% dateenrolled | $KohaDates %]</li>
     <li><span class="label">Expiration date: </span>
     [% IF ( was_renewed ) %]
             [% dateexpiry | $KohaDates %]
     [% END %]
     </li>
-    <li><span class="label">Library: </span>[% branchname %]</li>
+    <li><span class="label">Library: </span>[% branchname | html %]</li>
 
-    [% IF ( sort1 ) %]<li><span class="label">Sort field 1:</span>[% lib1 %]</li>[% END %]
-    [% IF ( sort2 ) %]<li><span class="label">Sort field 2:</span>[% lib2 %]</li>[% END %]
+    [% IF ( sort1 ) %]<li><span class="label">Sort field 1:</span>[% lib1 | html %]</li>[% END %]
+    [% IF ( sort2 ) %]<li><span class="label">Sort field 2:</span>[% lib2 | html %]</li>[% END %]
        </ol>
        </div>
        </div>
index 3bb901a..968c800 100644 (file)
@@ -4,13 +4,13 @@
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-    <title>Summary for [% patron.firstname %] [% patron.surname %] ([% patron.cardnumber %])</title>
+    <title>Summary for [% patron.firstname | html %] [% patron.surname | html %] ([% patron.cardnumber | html %])</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
 <body id="pat_moremember-print" class="pat">
     <div id="main">
-        <h3><a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% patron.cardnumber %]">Account summary: [% patron.firstname %] [% patron.surname %] ([% patron.cardnumber %])</a></h3>
+        <h3><a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% patron.cardnumber | html %]">Account summary: [% patron.firstname | html %] [% patron.surname | html %] ([% patron.cardnumber | html %])</a></h3>
 
         <ul>
             [% IF Koha.Preference( 'AddressFormat' ) %]
             [% ELSE %]
                 [% INCLUDE 'member-display-address-style-us.inc' %]
             [% END %]
-            <li>[% IF ( patron.phone ) %][% patron.phone %][% ELSE %](no phone number on file)[% END %]</li>
-            <li>[% IF ( patron.email ) %][% patron.email %][% ELSE %](no primary email on file)[% END %]</li>
+            <li>[% IF ( patron.phone ) %][% patron.phone | html %][% ELSE %](no phone number on file)[% END %]</li>
+            <li>[% IF ( patron.email ) %][% patron.email | html %][% ELSE %](no primary email on file)[% END %]</li>
             [% IF ( patron.emailpro ) %]
-                <li>[% patron.emailpro %]</li>
+                <li>[% patron.emailpro | html %]</li>
             [% END %]
             <li>Registration date: [% patron.dateenrolled | $KohaDates %]</li>
             <li>Expiration date: [% patron.dateexpiry | $KohaDates %]</li>
-            <li>Library: [% Branches.GetName( patron.branchcode ) %]</li>
-            <li>Category: [% patron.category.description %]</li>
+            <li>Library: [% Branches.GetName( patron.branchcode ) | html %]</li>
+            <li>Category: [% patron.category.description | html %]</li>
         </ul>
 
         [% IF ( issues ) %]
                 [% FOREACH issue IN issues %]
                     [% IF ( issue.overdue ) %]<tr class="overdue">[% ELSE %]<tr>[% END %]
                         <td>
-                            [% issue.title |html %]
-                            <a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issue.itemnumber %]&amp;biblionumber=[% issue.biblionumber %]&amp;bi=[% issue.biblioitemnumber %]"></a>
+                            [% issue.title | html %]
+                            <a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issue.itemnumber | html %]&amp;biblionumber=[% issue.biblionumber | html %]&amp;bi=[% issue.biblioitemnumber | html %]"></a>
                         </td>
-                        <td>[% issue.author %]</td>
-                        <td>[% issue.itemcallnumber %]</td>
-                        <td>[% issue.itemtype_description %]</td>
-                        <td>[% issue.date_due | $KohaDates as_due_date => 1 %]</td>
-                        <td>[% issue.barcode %]</td>
-                        <td>[% issue.charge %]</td>
-                        <td>[% issue.replacementprice %]</td>
+                        <td>[% issue.author | html %]</td>
+                        <td>[% issue.itemcallnumber | html %]</td>
+                        <td>[% issue.itemtype_description | html %]</td>
+                        <td>[% issue.date_due | $KohaDates as_due_date => 1 | html %]</td>
+                        <td>[% issue.barcode | html %]</td>
+                        <td>[% issue.charge | html %]</td>
+                        <td>[% issue.replacementprice | html %]</td>
                         <td>[% IF ( issue.overdue ) %]Overdue![% ELSE %]&nbsp;[% END %]</td>
                     </tr>
                 [% END %]
 
             <tr>
                 <td colspan="6" style="text-align: right; font-weight:bold;">Totals:</td>
-                <td>[% totaldue %]</td>
-                <td>[% totalprice %]</td>
+                <td>[% totaldue | html %]</td>
+                <td>[% totalprice | html %]</td>
                 <td colspan="3">&nbsp;</td>
             </tr>
         </table>
 
             [% FOREACH reserve IN reserves %]
                 <tr>
-                    <td>[% reserve.title %]</td>
-                    <td>[% reserve.author %]</td>
+                    <td>[% reserve.title | html %]</td>
+                    <td>[% reserve.author | html %]</td>
                     <td>[% reserve.reservedate | $KohaDates %]</td>
                     <td>[% reserve.expirationdate | $KohaDates %]</td>
-                    <td>[% reserve.waiting_at %]</td>
+                    <td>[% reserve.waiting_at | html %]</td>
                 </tr>
             [% END %]
         </table>
             [% FOREACH account IN accounts %]
                 <tr>
                     <td>
-                        [% IF ( account.itemnumber ) %]<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% account.item.biblionumber %]&amp;itemnumber=[% account.itemnumber %]">[% END %]
-                        [% account.description %]&nbsp;[% IF account.itemnumber AND account.accounttype != 'F' AND account.accounttype != 'FU' %] [% account.item.biblio.title |html %][% END %]
+                        [% IF ( account.itemnumber ) %]<a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% account.item.biblionumber | html %]&amp;itemnumber=[% account.itemnumber | html %]">[% END %]
+                        [% account.description | html %]&nbsp;[% IF account.itemnumber AND account.accounttype != 'F' AND account.accounttype != 'FU' %] [% account.item.biblio.title | html %][% END %]
                         [% IF ( account.itemnumber ) %]</a>[% END %]
                     </td>
                     <td>[% account.date | $KohaDates %]</td>
-                    <td style="text-align:right;">[% account.amount | $Price %]</td>
-                    <td style="text-align:right;">[% account.amountoutstanding | $Price %]</td>
+                    <td style="text-align:right;">[% account.amount | $Price | html %]</td>
+                    <td style="text-align:right;">[% account.amountoutstanding | $Price | html %]</td>
                 </tr>
             [% END %]
 
             <tfoot>
                 <tr>
                     <td colspan="3">Total due</td>
-                    <td colspan="2" style="text-align:right;">[% totaldue | $Price %]</td>
+                    <td colspan="2" style="text-align:right;">[% totaldue | $Price | html %]</td>
                 </tr>
             </tfoot>
         </table>
index 8ec67a6..1f8ae04 100644 (file)
@@ -1,33 +1,34 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Print Receipt for [% cardnumber %]</title>
+<title>Print Receipt for [% cardnumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon %][% ELSE %][% interface %]/[% theme %]/img/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("css/print.css") %]
+<link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("css/print.css") | $raw %]
 </head>
 
 <body id="pat_moremember-receipt" class="pat">
 
 <div id="receipt">
 
-<h3>[% LibraryName %]</h3>
-[% IF ( branchname ) %][% branchname %]<br />[% END %]
-Checked out to [% firstname %] [% surname %] <br />
-(<a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% cardnumber %]">[% cardnumber %]</a>)<br />
+<h3>[% LibraryName | html %]</h3>
+[% IF ( branchname ) %][% branchname | html %]<br />[% END %]
+Checked out to [% firstname | html %] [% surname | html %] <br />
+(<a href="/cgi-bin/koha/circ/circulation.pl?findborrower=[% cardnumber | html %]">[% cardnumber | html %]</a>)<br />
 
-[% todaysdate %]<br />
+[% todaysdate | html %]<br />
 
 [% IF ( quickslip ) %]
 <h4>Checked out today</h4>
 [% FOREACH issueloo IN issueloop %]
 [% IF ( issueloo.red ) %][% ELSE %]
 [% IF ( issueloo.today ) %]
-<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber %]&amp;biblionumber=[% issueloo.biblionumber %]&amp;bi=[% issueloo.biblioitemnumber %]">[% issueloo.title |html %]</a><br />
-Barcode: [% issueloo.barcode %]<br />
-Date due: [% issueloo.date_due %]<br /></p>
+<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber | html %]&amp;biblionumber=[% issueloo.biblionumber | html %]&amp;bi=[% issueloo.biblioitemnumber | html %]">[% issueloo.title | html %]</a><br />
+Barcode: [% issueloo.barcode | html %]<br />
+Date due: [% issueloo.date_due | html %]<br /></p>
     [% END %]
     [% END %]
     [% END %]
@@ -36,9 +37,9 @@ Date due: [% issueloo.date_due %]<br /></p>
 <h4>Checked out</h4>
 [% FOREACH issueloo IN issueloop %]
 [% IF ( issueloo.red ) %][% ELSE %]
-<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber %]&amp;biblionumber=[% issueloo.biblionumber %]&amp;bi=[% issueloo.biblioitemnumber %]">[% issueloo.title |html %]</a><br />
-Barcode: [% issueloo.barcode %]<br />
-Date due: [% issueloo.date_due %]<br /></p>
+<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber | html %]&amp;biblionumber=[% issueloo.biblionumber | html %]&amp;bi=[% issueloo.biblioitemnumber | html %]">[% issueloo.title | html %]</a><br />
+Barcode: [% issueloo.barcode | html %]<br />
+Date due: [% issueloo.date_due | html %]<br /></p>
     [% END %]
     [% END %]
 
@@ -50,9 +51,9 @@ Date due: [% issueloo.date_due %]<br /></p>
 <h4>Overdues</h4>
     [% FOREACH issueloo IN issueloop %]
     [% IF ( issueloo.red ) %]
-<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber %]&amp;biblionumber=[% issueloo.biblionumber %]&amp;bi=[% issueloo.biblioitemnumber %]">[% issueloo.title |html %]</a><br />
-Barcode: [% issueloo.barcode %]<br />
-Date due: [% issueloo.date_due %]</p>
+<p><a href="/cgi-bin/koha/catalogue/detail.pl?item=[% issueloo.itemnumber | html %]&amp;biblionumber=[% issueloo.biblionumber | html %]&amp;bi=[% issueloo.biblioitemnumber | html %]">[% issueloo.title | html %]</a><br />
+Barcode: [% issueloo.barcode | html %]<br />
+Date due: [% issueloo.date_due | html %]</p>
 [% END %]
 [% END %]
 [% END %]
@@ -60,11 +61,11 @@ Date due: [% issueloo.date_due %]</p>
 
 [% IF ( koha_news_count ) %]
             <hr><h4 style="text-align: center; font-style:italic;">News</h4>
-                       <!-- [% koha_news_count %] recent news item(s) -->
+                       <!-- [% koha_news_count | html %] recent news item(s) -->
             [% FOREACH koha_new IN koha_news %]
-                    <div class="newsitem" id="news[% koha_new.idnew %]"><h5 style="margin-bottom: 1px; margin-top: 1px"><b>[% koha_new.title %]</b></h5>
-                                        <p style="margin-bottom: 1px; margin-top: 1px">[% koha_new.content %]</p>
-                                       <p class="newsfooter" style="font-size: 8pt; font-style:italic; margin-bottom: 1px; margin-top: 1px"> Posted on [% koha_new.newdate %]
+                    <div class="newsitem" id="news[% koha_new.idnew | html %]"><h5 style="margin-bottom: 1px; margin-top: 1px"><b>[% koha_new.title | html %]</b></h5>
+                                        <p style="margin-bottom: 1px; margin-top: 1px">[% koha_new.content | $raw %]</p>
+                                       <p class="newsfooter" style="font-size: 8pt; font-style:italic; margin-bottom: 1px; margin-top: 1px"> Posted on [% koha_new.newdate | html %]
 
 </p><hr /></div>
             [% END %]
index 09e6b7c..bdc7e36 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -12,7 +13,7 @@
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style>
     input[type="file"] { display: inline-block; }
     .patroninfo-section { padding: .5em; margin: .5em; }
                                                 <span>
                                             [% END %]
                                                 [% patron_message.message_date | $KohaDates %]
-                                                [% Branches.GetName( patron_message.branchcode ) %]
+                                                [% Branches.GetName( patron_message.branchcode ) | html %]
                                                 [% IF patron_message.manager_id %]
-                                                    ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron_message.manager_id %]">[% patron_message.get_column('manager_firstname') %] [% patron_message.get_column('manager_surname') %]</a> )
+                                                    ( <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron_message.manager_id | html %]">[% patron_message.get_column('manager_firstname') | html %] [% patron_message.get_column('manager_surname') | html %]</a> )
                                                 [% END %]
                                                 <i>"[% patron_message.message | html %]"</i>
                                             </span>
                                             [% IF patron_message.branchcode == branchcode OR Koha.Preference('AllowAllMessageDeletion') %]
-                                                <a class="btn btn-link btn-sm" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% patron_message.message_id %]&amp;borrowernumber=[% patron_message.borrowernumber %]&amp;from=moremember" onclick="return confirm(MSG_CONFIRM_DELETE_MESSAGE);"><i class="fa fa-trash"></i> Delete</a>
+                                                <a class="btn btn-link btn-sm" href="/cgi-bin/koha/circ/del_message.pl?message_id=[% patron_message.message_id | html %]&amp;borrowernumber=[% patron_message.borrowernumber | html %]&amp;from=moremember" onclick="return confirm(MSG_CONFIRM_DELETE_MESSAGE);"><i class="fa fa-trash"></i> Delete</a>
                                             [% END %]
                                         </li>
                                     [% END %]
                                     [% IF ( userdebarred ) %]
                                         <li class="blocker">Patron's account is restricted
                                             [% IF ( userdebarreddate ) %]
-                                                until [% userdebarreddate %]
+                                                until [% userdebarreddate | html %]
                                             [% END %]
 
                                             [% IF ( debarredcomment ) %]
                                 <div class="patroninfo-heading">
                                     <h3>Contact information</h3>
                                     [% IF ( guarantor.borrowernumber ) %]
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=1&amp;guarantorid=[% guarantor.borrowernumber %]"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=1&amp;guarantorid=[% guarantor.borrowernumber | html %]"><i class="fa fa-pencil"></i> Edit</a>
                                     [% ELSE %]
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=1"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=1"><i class="fa fa-pencil"></i> Edit</a>
                                     [% END %]
                                 </div>
 
                                         [% IF ( patron.phone ) %]
                                             <li>
                                                 <span class="label">Primary phone: </span>
-                                                <a href="tel:[% patron.phone %]">[% patron.phone | html %]</a>
+                                                <a href="tel:[% patron.phone | html %]">[% patron.phone | html %]</a>
                                             </li>
                                         [% END %]
                                         [% IF ( patron.phonepro ) %]
                                             <li>
                                                 <span class="label">Secondary phone: </span>
-                                                <a href="tel:[% patron.phonepro %]">[% patron.phonepro | html %]</a>
+                                                <a href="tel:[% patron.phonepro | html %]">[% patron.phonepro | html %]</a>
                                             </li>
                                         [% END %]
                                         [% IF ( patron.mobile ) %]
                                             <li>
                                                 <span class="label">Other phone: </span>
-                                                <a href="tel:[% patron.mobile %]">[% patron.mobile | html %]</a>
+                                                <a href="tel:[% patron.mobile | html %]">[% patron.mobile | html %]</a>
                                             </li>
                                         [% END %]
                                         [% IF ( patron.fax ) %]
                                             <li>
                                                 <span class="label">Fax: </span>
-                                                [% patron.fax |html %]
+                                                [% patron.fax | html %]
                                             </li>
                                         [% END %]
                                         [% IF ( patron.email ) %]
                                             <li class="email">
                                                 <span class="label">Primary email:</span>
-                                                <a title="[% patron.email %]" href="mailto:[% patron.email | url %]">[% patron.email | html %]</a>
+                                                <a title="[% patron.email | html %]" href="mailto:[% patron.email | url %]">[% patron.email | html %]</a>
                                             </li>
                                         [% END %]
                                         [% IF ( patron.emailpro ) %]
                                             <li class="email">
                                                 <span class="label">Secondary email: </span>
-                                                <a title="[% patron.emailpro %]" href="mailto:[% patron.emailpro | url %]">[% patron.emailpro | html %]</a>
+                                                <a title="[% patron.emailpro | html %]" href="mailto:[% patron.emailpro | url %]">[% patron.emailpro | html %]</a>
                                             </li>
                                         [% END %]
                                         [% UNLESS ( I ) %]
                                             [% IF ( patron.dateofbirth ) %]
                                                 <li>
                                                     <span class="label">Date of birth:</span>
-                                                    [% patron.dateofbirth | $KohaDates %] ([% age %] years)
+                                                    [% patron.dateofbirth | $KohaDates %] ([% age | html %] years)
                                                 </li>
                                             [% END %]
                                             [% IF ( patron.sex ) %]
                                                 <li>
                                                     <span class="label">Gender:</span>
-                                                    [% IF ( patron.sex == 'F' ) %]Female[% ELSIF ( patron.sex == 'M' ) %]Male[% ELSE %][% patron.sex %][% END %]
+                                                    [% IF ( patron.sex == 'F' ) %]Female[% ELSIF ( patron.sex == 'M' ) %]Male[% ELSE %][% patron.sex | html %][% END %]
                                                 </li>
                                             [% END %]
                                         [% END %]
                                                 <ul>
                                                     [% FOREACH guarantee IN guarantees %]
                                                         [% IF logged_in_user.can_see_patron_infos( guarantee ) %]
-                                                            <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantee.borrowernumber %]">[% guarantee.firstname | html %] [% guarantee.surname | html %]</a></li>
+                                                            <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantee.borrowernumber | html %]">[% guarantee.firstname | html %] [% guarantee.surname | html %]</a></li>
                                                         [% ELSE %]
                                                             <li>[% guarantee.firstname | html %] [% guarantee.surname | html %]</li>
                                                         [% END %]
                                             <li>
                                                 <span class="label">Guarantor:</span>
                                                 [% IF guarantor.borrowernumber AND logged_in_user.can_see_patron_infos( guarantor ) %]
-                                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantor.borrowernumber %]">[% guarantor.firstname | html %] [% guarantor.surname | html %]</a>
+                                                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% guarantor.borrowernumber | html %]">[% guarantor.firstname | html %] [% guarantor.surname | html %]</a>
                                                 [% ELSE %]
                                                     [% guarantor.firstname | html %] [% guarantor.surname | html %]
                                                 [% END %]
                                             [% IF ( patron.image ) %]
                                                 <div class="hint">To update the image for [% patron.title | html %] [% patron.surname | html %], select a new image file and click 'Upload.' <br />Click the 'Delete' button to remove the current image.</div>
                                             [% ELSE %]
-                                                <div class="hint">[% patron.title %] [% patron.firstname | html %] [% patron.surname | html %] does not currently have an image available. To import an image for [% patron.title %] [% patron.surname | html %], enter the name of an image file to upload.</div>
+                                                <div class="hint">[% patron.title | html %] [% patron.firstname | html %] [% patron.surname | html %] does not currently have an image available. To import an image for [% patron.title | html %] [% patron.surname | html %], enter the name of an image file to upload.</div>
                                             [% END %]
                                             <p>Only PNG, GIF, JPEG, XPM formats are supported.</p>
                                             <label for="uploadfile">Select the file to upload: </label>
                                             <input type="file" id="uploadfile" name="uploadfile" required="required" />
                                             <div class="action">
-                                                <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                                                <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                                                 <input type="hidden" id="image" name="filetype" value="image" />
                                                 <input type="hidden" id="cardnumber" name="cardnumber" value="[% patron.cardnumber | html %]" />
-                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                                                 <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-upload"></i> Upload</button>
                                                 <input name="op" type="hidden" value="Upload" />
                                                 [% IF ( patron.image ) %]
-                                                    <a id="delpicture" href="/cgi-bin/koha/tools/picture-upload.pl?op=Delete&amp;borrowernumber=[% patron.borrowernumber %]&amp;csrf_token=[% csrf_token %]" class="btn btn-default btn-xs delete"><i class="fa fa-trash"></i> Delete</a>
+                                                    <a id="delpicture" href="/cgi-bin/koha/tools/picture-upload.pl?op=Delete&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;csrf_token=[% csrf_token | html %]" class="btn btn-default btn-xs delete"><i class="fa fa-trash"></i> Delete</a>
                                                 [% END %]
                                                 <a href="#" id="cancel-picture-upload" class="cancel">Cancel</a>
                                             </div>
                                     [% IF ( housebound_role.housebound_chooser == 1 OR housebound_role.housebound_deliverer == 1 ) %]
                                         <div class="patroninfo-heading">
                                             <h3>Housebound roles</h3>
-                                            <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=4"><i class="fa fa-pencil"></i> Edit</a>
+                                            <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=4"><i class="fa fa-pencil"></i> Edit</a>
                                         </div>
                                         <div class="rows">
                                             <ol>
                                     [% ELSE %]
                                         <div class="patroninfo-heading">
                                             <h3>Housebound roles</h3>
-                                            <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=7"><i class="fa fa-plus"></i> Add</a>
+                                            <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=7"><i class="fa fa-plus"></i> Add</a>
                                         </div>
                                     [% END %]
                                 </div> [% #/ div#houseboundroles %]
                                         [% IF ( attributes_loop ) %]
                                             <div class="patroninfo-heading">
                                                 <h3>Additional attributes and identifiers</h3>
-                                                <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=4"><i class="fa fa-pencil"></i> Edit</a>
+                                                <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=4"><i class="fa fa-pencil"></i> Edit</a>
                                             </div>
                                             [% FOREACH attribute IN attributes_loop %]
                                                 [% IF attribute.class %]
-                                                    <div id="aai_[% attribute.class %]" class="rows">
+                                                    <div id="aai_[% attribute.class | html %]" class="rows">
                                                 [% ELSE %]
                                                     <div id="aai" class="rows">
                                                 [% END %]
-                                                    <h4>[% attribute.lib %]</h4>
+                                                    <h4>[% attribute.lib | html %]</h4>
                                                     <ol>
                                                         [% FOREACH item IN attribute.items %]
                                                             <li>
-                                                                <span class="label">[% item.description %]: </span>
+                                                                <span class="label">[% item.description | html %]: </span>
                                                                 [% IF ( item.value_description ) %]
-                                                                    [% item.value_description %]
+                                                                    [% item.value_description | html %]
                                                                 [% ELSE %]
                                                                     [% item.value| html_line_break %]
                                                                 [% END %]
                                         [% ELSE %]
                                             <div class="patroninfo-heading">
                                                 <h3>Additional attributes and identifiers</h3>
-                                                <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=4"><i class="fa fa-plus"></i> Add</a>
+                                                <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=4"><i class="fa fa-plus"></i> Add</a>
                                             </div>
                                         [% END %]
                                     </div> [% # /div#patron-extended-attributes %]
                                 <div id="patron-messaging-prefs" class="patroninfo-section">
                                     <div class="patroninfo-heading">
                                         <h3>Patron messaging preferences</h3>
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=5"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=5"><i class="fa fa-pencil"></i> Edit</a>
                                     </div>
                                     [% INCLUDE 'messaging-preference-form.inc' %]
                                     [% IF ( SMSSendDriver ) %]
                                             <ol>
                                                 <li>
                                                     <span class="label">SMS number:</span>
-                                                    <a href="sms:[% patron.smsalertnumber %]">[% patron.smsalertnumber %]</a>
+                                                    <a href="sms:[% patron.smsalertnumber | html %]">[% patron.smsalertnumber | html %]</a>
                                                 </li>
                                             </ol>
                                         </div>
                             <div id="patron-library-details" class="patroninfo-section">
                                 <div class="patroninfo-heading">
                                     <h3>Library use</h3>
-                                    <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=3"><i class="fa fa-pencil"></i> Edit</a>
+                                    <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=3"><i class="fa fa-pencil"></i> Edit</a>
                                 </div>
                                 <div class="rows">
                                     <ol>
                                         <li>
                                             <span class="label">Card number: </span>
-                                            [% patron.cardnumber %]
+                                            [% patron.cardnumber | html %]
                                         </li>
                                         <li>
                                             <span class="label">Borrowernumber: </span>
-                                            [% patron.borrowernumber %]
+                                            [% patron.borrowernumber | html %]
                                         </li>
                                         <li>
                                             <span class="label">Category: </span>
-                                            [% patron.category.description %] ([% patron.categorycode %])
+                                            [% patron.category.description | html %] ([% patron.categorycode | html %])
                                         </li>
                                         <li>
                                             <span class="label">Registration date: </span>
                                         </li>
                                         <li>
                                             <span class="label">Library: </span>
-                                            [% branchname %]
+                                            [% branchname | html %]
                                         </li>
 
                                         [% IF ( OPACPrivacy ) %]
                                         [% IF ( patron.sort1 ) %]
                                             <li>
                                                 <span class="label">Sort field 1:</span>
-                                                [% AuthorisedValues.GetByCode('Bsort1', patron.sort1) |html %]
+                                                [% AuthorisedValues.GetByCode('Bsort1', patron.sort1) | html %]
                                             </li>
                                         [% END %]
                                         [% IF ( patron.sort2 ) %]
                                             <li>
                                                 <span class="label">Sort field 2:</span>
-                                                [% AuthorisedValues.GetByCode('Bsort2', patron.sort2) |html %]
+                                                [% AuthorisedValues.GetByCode('Bsort2', patron.sort2) | html %]
                                             </li>
                                         [% END %]
                                         <li>
                                             <span class="label">Username: </span>
-                                            [% patron.userid |html  %]
+                                            [% patron.userid | html %]
                                         </li>
                                         <li>
                                             <span class="label">Password: </span>
                                             [% IF ( patron.password ) %]
                                                 *******
                                             [% ELSE %]
-                                                <span class="problem"><a href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber %]">Undefined</a></span>
+                                                <span class="problem"><a href="/cgi-bin/koha/members/member-password.pl?member=[% patron.borrowernumber | html %]">Undefined</a></span>
                                             [% END %]
                                         </li>
 
                                         [% IF ( patron.borrowernotes ) %]
                                             <li>
                                                 <span class="label">Circulation note: </span>
-                                                [% patron.borrowernotes |html %]
+                                                [% patron.borrowernotes | html %]
                                             </li>
                                         [% END %]
 
                                         [% IF ( patron.opacnote ) %]
                                             <li>
                                                 <span class="label">OPAC note:</span>
-                                                [% patron.opacnote |html %]
+                                                [% patron.opacnote | html %]
                                             </li>
                                         [% END %]
 
                                                 [% IF ( syncstatus ) %]
                                                     <li>
                                                         <span class="label">Sync status: </span>
-                                                        [% syncstatus %]
+                                                        [% syncstatus | html %]
                                                     </li>
                                                 [% END %]
                                                 [% IF ( lastsync ) %]
                                         [% IF Koha.Preference('TranslateNotices') %]
                                             <li>
                                                 <span class="label">Preferred language for notices: </span>
-                                                [% translated_language %]
+                                                [% translated_language | html %]
                                             </li>
                                         [% END %]
                                     </ol>
                                 [% IF ( patron.B_phone || patron.B_email || patron.contactnote || patron.B_address || patron.B_address2 || patron.B_city || patron.B_zipcode || patron.B_country ) %]
                                     <div class="patroninfo-heading">
                                         <h3>Alternate address</h3>
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=6"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=6"><i class="fa fa-pencil"></i> Edit</a>
                                     </div>
                                     <div class="address">
                                         <ul>
                                             [% IF ( patron.B_phone ) %]
                                                 <li>
                                                     <span class="label">Phone: </span>
-                                                    <a href="tel:[% patron.B_phone %]">[% patron.B_phone |html  %]</a>
+                                                    <a href="tel:[% patron.B_phone | html %]">[% patron.B_phone |html  %]</a>
                                                 </li>
                                             [% END %]
 
                                             [% IF ( patron.B_email ) %]
                                                 <li class="email">
                                                     <span class="label">Email: </span>
-                                                    <a title="[% patron.B_email %]" href="mailto:[% patron.B_email | url %]">[% B_email |html %]</a>
+                                                    <a title="[% patron.B_email | html %]" href="mailto:[% patron.B_email | url %]">[% B_email |html %]</a>
                                                 </li>
                                             [% END %]
 
                                 [% ELSE %]
                                     <div class="patroninfo-heading">
                                       <h3 class="inline">Alternate address</h3>
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=6"><i class="fa fa-plus"></i> Add</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=6"><i class="fa fa-plus"></i> Add</a>
                                     </div>
                                 [% END %]
                             </div> [% # /div#patron-alternate-address %]
                                 [% IF ( patron.altcontactsurname || patron.altcontactfirstname || patron.altcontactaddress1 || patron.altcontactaddress2 || patron.altcontactaddress3 || patron.altcontactstate || patron.altcontactzipcode || patron.altcontactcountry || patron.altcontactphone ) %]
                                     <div class="patroninfo-heading">
                                         <h3>Alternative contact</h3>
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=2"><i class="fa fa-pencil"></i> Edit</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=2"><i class="fa fa-pencil"></i> Edit</a>
                                     </div>
                                     <div class="rows">
                                         <ol>
                                 [% ELSE %]
                                     <div class="patroninfo-heading">
                                         <h3>Alternative contact</h3>
-                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber %]&amp;step=2"><i class="fa fa-plus"></i> Add</a>
+                                        <a class="btn btn-default btn-xs" href="memberentry.pl?op=modify&amp;borrowernumber=[% patron.borrowernumber | html %]&amp;step=2"><i class="fa fa-plus"></i> Add</a>
                                     </div>
                                 [% END %]
                             </div> [% # /div#patron-alternative-contact %]
                     <div id="finesholdsissues" class="toptabs">
                         <ul>
                             <li>
-                                <a href="#checkouts">[% issuecount %] Checkout(s)</a>
+                                <a href="#checkouts">[% issuecount | html %] Checkout(s)</a>
                             </li>
                             [% IF relatives_issues_count %]
                                 <li>
                             [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]
                                 <li>
                                     [% IF ( holds_count ) %]
-                                        <a href="#reserves" id="holds-tab">[% holds_count %] Hold(s)</a>
+                                        <a href="#reserves" id="holds-tab">[% holds_count | html %] Hold(s)</a>
                                     [% ELSE %]
                                         <a href="#reserves" id="holds-tab">0 Holds</a>
                                     [% END %]
                             [% END %]
                             [% IF Koha.Preference('ArticleRequests') %]
                                 <li>
-                                    <a href="#article-requests" id="article-requests-tab"> [% patron.article_requests_current.count %] Article requests</a>
+                                    <a href="#article-requests" id="article-requests-tab"> [% patron.article_requests_current.count | html %] Article requests</a>
                                 </li>
                             [% END %]
                             <li>
-                                <a id="debarments-tab-link" href="#reldebarments">[% debarments.size %] Restrictions</a>
+                                <a id="debarments-tab-link" href="#reldebarments">[% debarments.size | html %] Restrictions</a>
                             </li>
                             [% SET enrollments = patron.get_club_enrollments(1) %]
                             [% SET enrollable  = patron.get_enrollable_clubs(0,1) %]
                             [% IF CAN_user_clubs && ( enrollable.count || enrollments.count ) %]
                                 <li>
                                     <a id="clubs-tab-link" href="#clubs-tab">
-                                        Clubs ([% enrollments.count %]/[% enrollable.count %])
+                                        Clubs ([% enrollments.count | html %]/[% enrollable.count | html %])
                                     </a>
                                 </li>
                             [% END %]
 
                         <div id="finesandcharges">
                             [% IF ( totaldue_raw ) %]
-                                <p>Total due: [% totaldue %]</p>
+                                <p>Total due: [% totaldue | html %]</p>
                             [% ELSE %]
                                 <p>No outstanding charges</p>
                             [% END %]
                                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
                                             <fieldset class="action">
                                                 <input type="hidden" name="from" value="borrower" />
-                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                                                 <input type="submit" value="Suspend all holds" />
 
                                                 [% IF Koha.Preference('AutoResumeSuspendedHolds') %]
                                         <form action="/cgi-bin/koha/reserve/modrequest_suspendall.pl" method="post">
                                             <fieldset class="action">
                                                 <input type="hidden" name="from" value="borrower" />
-                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                                                <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                                                 <input type="hidden" name="suspend" value="0" />
                                                 <input type="submit" value="Resume all suspended holds" />
                                             </fieldset>
     [% INCLUDE 'columns_settings.inc' %]
     [% INCLUDE 'strings.inc' %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery-ui-timepicker-addon.min.js") | $raw %]
     [% INCLUDE 'timepicker.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.rowGrouping.js") %]
-    [% Asset.js("js/pages/circulation.js") %]
-    [% Asset.js("js/checkouts.js") %]
-    [% Asset.js("js/holds.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.rowGrouping.js") | $raw %]
+    [% Asset.js("js/pages/circulation.js") | $raw %]
+    [% Asset.js("js/checkouts.js") | $raw %]
+    [% Asset.js("js/holds.js") | $raw %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
-    [% Asset.js("js/messaging-preference-form.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
+    [% Asset.js("js/messaging-preference-form.js") | $raw %]
     <script>
         /* Set some variable needed in circulation.js */
-        var interface = "[% interface %]";
-        var theme = "[% theme %]";
-        var borrowernumber = "[% patron.borrowernumber %]";
-        var branchcode = "[% Branches.GetLoggedInBranchcode() %]";
-        var exports_enabled = "[% Koha.Preference('ExportCircHistory') %]";
-        var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 %]
-        var AllowRenewalLimitOverride = [% (CAN_user_circulate_override_renewals && Koha.Preference('AllowRenewalLimitOverride') )? 1: 0 %];
+        var interface = "[% interface | html %]";
+        var theme = "[% theme | html %]";
+        var borrowernumber = "[% patron.borrowernumber | html %]";
+        var branchcode = "[% Branches.GetLoggedInBranchcode() | html %]";
+        var exports_enabled = "[% Koha.Preference('ExportCircHistory') | html %]";
+        var AllowCirculate = [% (CAN_user_circulate_circulate_remaining_permissions)? 1 : 0 | html %]
+        var AllowRenewalLimitOverride = [% (CAN_user_circulate_override_renewals && Koha.Preference('AllowRenewalLimitOverride') )? 1: 0 | html %];
         var script = "moremember";
         var relatives_borrowernumbers = new Array();
         [% FOREACH b IN relatives_borrowernumbers %]
-            relatives_borrowernumbers.push("[% b %]");
+            relatives_borrowernumbers.push("[% b | html %]");
         [% END %]
 
         var MSG_EXPORT_SELECT_CHECKOUTS = _("You must select checkout(s) to export");
         var MSG_CONFIRM_DELETE_MESSAGE = _("Are you sure you want to delete this message? This cannot be undone.");
 
-        columns_settings = [% ColumnsSettings.GetColumns( 'members', 'moremember', 'issues-table', 'json' ) %]
+        columns_settings = [% ColumnsSettings.GetColumns( 'members', 'moremember', 'issues-table', 'json' ) | $raw %]
 
         $(document).ready(function() {
             if ( $('#clubs-tab').length ) {
                 $('#clubs-tab-link').on('click', function() {
                     $('#clubs-tab').text(_("Loading..."));
-                    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber %]');
+                    $('#clubs-tab').load('/cgi-bin/koha/clubs/patron-clubs-tab.pl?borrowernumber=[% borrowernumber | html %]');
                 });
             }
 
index 6107d34..44db3a6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
                     <h3>Existing patrons</h3>
                     <ul>
                         [% FOREACH patron IN local_result %]
-                            <li>[% patron.firstname %] [% patron.surname %] [% patron.cardnumber %] |
-                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">Details</a> |
-                                <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&destination=circ&borrowernumber=[% patron.borrowernumber %]">Edit</a> |
-                                <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber %]">Check out</a>
+                            <li>[% patron.firstname | html %] [% patron.surname | html %] [% patron.cardnumber | html %] |
+                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">Details</a> |
+                                <a href="/cgi-bin/koha/members/memberentry.pl?op=modify&destination=circ&borrowernumber=[% patron.borrowernumber | html %]">Edit</a> |
+                                <a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=[% patron.borrowernumber | html %]">Check out</a>
                             </li>
                         [% END %]
                     </ul>
@@ -49,7 +50,7 @@
                     [% IF result.antall_poster_returnert == 0 %]
 
                         <div class="dialog alert">
-                            <p>No results found in the Norwegian national patron database. Message: "[% result.melding %]"</p>
+                            <p>No results found in the Norwegian national patron database. Message: "[% result.melding | html %]"</p>
                         </div>
 
                     [% ELSE %]
@@ -80,7 +81,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
 <input type="hidden" name="m_land" value="[% p.m_land | html_entity %]" />
 <input type="hidden" name="m_sjekk" value="[% p.m_sjekk | html_entity %]" />
 <input type="hidden" name="m_gyldig_til" value="[% p.m_gyldig_til | html_entity %]" />
-<input type="hidden" name="pin" value="[% p.pin %]" />
+<input type="hidden" name="pin" value="[% p.pin | html %]" />
 <input type="hidden" name="passord" value="[% p.passord | html_entity %]" />
 <input type="hidden" name="feide" value="[% p.feide | html_entity %]" />
 <input type="hidden" name="folkeregsjekk_dato" value="[% p.folkeregsjekk_dato | html_entity %]" />
 as
 <select name="categorycode">
 [% FOREACH c IN categories %]
-    <option value="[% c.categorycode %]">[% c.description %]</option>
+    <option value="[% c.categorycode | html %]">[% c.description | html %]</option>
 [% END %]
 </select>
 </form>
index 19a2f40..a26d5f0 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -7,7 +8,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Sent notices for [% INCLUDE 'patron-title.inc' no_html = 1 %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     .notice { display: none; }
     .notice-title { font-weight: bold; display: block; }
@@ -41,9 +42,9 @@
            [% FOREACH QUEUED_MESSAGE IN QUEUED_MESSAGES %]
            <tr>
                <td>
-            <a class="notice-title" data-noticeid="[% QUEUED_MESSAGE.message_id %]" href="#">[% QUEUED_MESSAGE.subject %]</a>
-            <div id="notice[% QUEUED_MESSAGE.message_id %]" class="notice">
-                <iframe srcdoc="[% QUEUED_MESSAGE.content FILTER html_line_break FILTER html %]"></iframe>
+            <a class="notice-title" data-noticeid="[% QUEUED_MESSAGE.message_id | html %]" href="#">[% QUEUED_MESSAGE.subject | html %]</a>
+            <div id="notice[% QUEUED_MESSAGE.message_id | html %]" class="notice">
+                <iframe srcdoc="[% QUEUED_MESSAGE.content FILTER html_line_break | html %]"></iframe>
             </div>
         </td>
                <td>
             [% ELSIF ( QUEUED_MESSAGE.message_transport_type == 'print' ) %]print
             [% ELSIF ( QUEUED_MESSAGE.message_transport_type == 'feed' ) %]feed
             [% ELSIF ( QUEUED_MESSAGE.message_transport_type == 'sms' ) %]sms
-            [% ELSE %][% QUEUED_MESSAGE.message_transport_type %][% END %]
+            [% ELSE %][% QUEUED_MESSAGE.message_transport_type | html %][% END %]
         </td>
                <td>
             [% IF ( QUEUED_MESSAGE.status == 'sent' ) %]sent
             [% ELSIF ( QUEUED_MESSAGE.status == 'pending' ) %]pending
             [% ELSIF ( QUEUED_MESSAGE.status == 'failed' ) %]failed
             [% ELSIF ( QUEUED_MESSAGE.status == 'deleted' ) %]deleted
-            [% ELSE %][% QUEUED_MESSAGE.status %][% END %]
+            [% ELSE %][% QUEUED_MESSAGE.status | html %][% END %]
             [% IF ( QUEUED_MESSAGE.status != 'pending' ) %]
-            <div id="resend_notice[% QUEUED_MESSAGE.message_id %]"  class="notice">
-                <form action="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber %]" method="POST">
+            <div id="resend_notice[% QUEUED_MESSAGE.message_id | html %]"  class="notice">
+                <form action="/cgi-bin/koha/members/notices.pl?borrowernumber=[% borrowernumber | html %]" method="POST">
                     <input type="hidden" name="op" value="resend_notice" />
-                    <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
-                    <input type="hidden" name="message_id" value="[% QUEUED_MESSAGE.message_id %]" />
+                    <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
+                    <input type="hidden" name="message_id" value="[% QUEUED_MESSAGE.message_id | html %]" />
                     <fieldset class="action">
                         <button class="btn btn-default btn-xs" type="submit">Resend</button>
                     </fieldset>
@@ -72,7 +73,7 @@
             </div>
             [% END %]
         </td>
-        <td><span title="[% QUEUED_MESSAGE.time_queued %]">[% QUEUED_MESSAGE.time_queued | $KohaDates with_hours => 1 %]</span></td>
+        <td><span title="[% QUEUED_MESSAGE.time_queued | html %]">[% QUEUED_MESSAGE.time_queued | $KohaDates with_hours => 1 | html %]</span></td>
            </tr>
            [% END %]
        </tbody>
         });
     </script>
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index ec72e85..ffac4d7 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -5,7 +6,7 @@
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% patron.firstname |html %] [% patron.surname |html %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; Pay Fines for  [% patron.firstname | html %] [% patron.surname | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -13,7 +14,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'patron-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% patron.firstname |html %] [% patron.surname |html %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>  &rsaquo; Pay fines for [% patron.firstname | html %] [% patron.surname | html %]</div>
 
 <div id="doc3" class="yui-t2">
    
 <!-- The manual invoice and credit buttons -->
 <div class="statictabs">
 <ul>
-    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a></li>
-    <li class="active"><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a></li>
-    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a></li>
-    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a></li>
+    <li><a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account</a></li>
+    <li class="active"><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]" >Pay fines</a></li>
+    <li><a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual invoice</a></li>
+    <li><a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual credit</a></li>
 </ul>
 <div class="tabs-container">
 
 [% IF ( accounts ) %]
     <form action="/cgi-bin/koha/members/pay.pl" method="post" id="pay-fines-form">
-    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
+    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
 <p><span class="checkall"><a id="CheckAll" href="#"><i class="fa fa-check"></i> Select all</a></span> | <span class="clearall"><a id="CheckNone" href="#"><i class="fa fa-remove"></i> Clear all</a></span></p>
 <table id="finest">
 <thead>
@@ -51,7 +52,7 @@
 <tfoot>
 <tr>
     <td class="total" colspan="6">Total due:</td>
-    <td style="text-align: right;">[% total | $Price %]</td>
+    <td style="text-align: right;">[% total | $Price | html %]</td>
 </tr>
 </tfoot>
 <tbody>
 <tr>
     <td>
     [% IF ( line.amountoutstanding > 0 ) %]
-        <input class="cb" type="checkbox" checked="checked" name="incl_par_[% line.accountlines_id %]" />
+        <input class="cb" type="checkbox" checked="checked" name="incl_par_[% line.accountlines_id | html %]" />
     [% END %]
     </td>
     <td>
     [% IF ( line.amountoutstanding > 0 ) %]
-        <input type="submit" name="pay_indiv_[% line.accountlines_id %]" value="Pay" />
-        [% IF CAN_user_updatecharges_writeoff %]<input type="submit" name="wo_indiv_[% line.accountlines_id %]" value="Write off" />[% END %]
+        <input type="submit" name="pay_indiv_[% line.accountlines_id | html %]" value="Pay" />
+        [% IF CAN_user_updatecharges_writeoff %]<input type="submit" name="wo_indiv_[% line.accountlines_id | html %]" value="Write off" />[% END %]
     [% END %]
-    <input type="hidden" name="itemnumber[% line.accountlines_id %]" value="[% line.itemnumber %]" />
-    <input type="hidden" name="description[% line.accountlines_id %]" value="[% line.description %]" />
-    <input type="hidden" name="accounttype[% line.accountlines_id %]" value="[% line.accounttype %]" />
-    <input type="hidden" name="amount[% line.accountlines_id %]" value="[% line.amount %]" />
-    <input type="hidden" name="accountlines_id[% line.accountlines_id %]" value="[% line.accountlines_id %]" />
-    <input type="hidden" name="amountoutstanding[% line.accountlines_id %]" value="[% line.amountoutstanding %]" />
-    <input type="hidden" name="borrowernumber[% line.accountlines_id %]" value="[% line.borrowernumber %]" />
+    <input type="hidden" name="itemnumber[% line.accountlines_id | html %]" value="[% line.itemnumber | html %]" />
+    <input type="hidden" name="description[% line.accountlines_id | html %]" value="[% line.description | html %]" />
+    <input type="hidden" name="accounttype[% line.accountlines_id | html %]" value="[% line.accounttype | html %]" />
+    <input type="hidden" name="amount[% line.accountlines_id | html %]" value="[% line.amount | html %]" />
+    <input type="hidden" name="accountlines_id[% line.accountlines_id | html %]" value="[% line.accountlines_id | html %]" />
+    <input type="hidden" name="amountoutstanding[% line.accountlines_id | html %]" value="[% line.amountoutstanding | html %]" />
+    <input type="hidden" name="borrowernumber[% line.accountlines_id | html %]" value="[% line.borrowernumber | html %]" />
     </td>
     <td>
         [% SWITCH line.accounttype %]
           [% CASE 'WO' %]Writeoff
           [% CASE 'C' %]Credit
           [% CASE 'CR' %]Credit
-          [% CASE %][% line.accounttype %]
+          [% CASE %][% line.accounttype | html %]
         [%- END -%]
-        [%- IF line.description %], [% line.description %][% END %]
-        [% IF line.title %]([% line.title %])[% END %]
+        [%- IF line.description %], [% line.description | html %][% END %]
+        [% IF line.title %]([% line.title | html %])[% END %]
     </td>
-    <td><input type="text" name="payment_note_[% line.accountlines_id %]" /></td>
-    <td>[% line.accounttype %]</td>
-    <td class="debit" style="text-align: right;">[% line.amount | $Price %]</td>
-    <td class="debit" style="text-align: right;">[% line.amountoutstanding | $Price %]</td>
+    <td><input type="text" name="payment_note_[% line.accountlines_id | html %]" /></td>
+    <td>[% line.accounttype | html %]</td>
+    <td class="debit" style="text-align: right;">[% line.amount | $Price | html %]</td>
+    <td class="debit" style="text-align: right;">[% line.amountoutstanding | $Price | html %]</td>
 </tr>
 [% END %]
 [% IF ( account_grp.total ) %]
 <tr>
 
     <td class="total" colspan="8" style="text-align: right;">Sub total:</td>
-    <td style="text-align: right;">[% account_grp.total | $Price %]</td>
+    <td style="text-align: right;">[% account_grp.total | $Price | html %]</td>
 </tr>
 [% END %]
 </tbody>
 [% IF CAN_user_updatecharges_writeoff %]<input type="submit" name="woall"  id="woall" value="Write off all" class="submit" />[% END %]
 <input type="submit" id="payselected" name="payselected"  value="Pay selected" class="submit" />
 <input type="submit" id="writeoff-selected" name="writeoff_selected"  value="Write off selected" class="submit" />
-<a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a>
+<a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
 </fieldset>
 </form>
 [% ELSE %]
-    <p>[% patron.firstname |html %] [% patron.surname |html %] has no outstanding fines.</p>
+    <p>[% patron.firstname | html %] [% patron.surname | html %] has no outstanding fines.</p>
 [% END %]
 </div></div>
 
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type= "text/javascript">
         function enableCheckboxActions(){
             // Enable/disable controls if checkboxes are checked
         $(document).ready(function(){
         $('#pay-fines-form').preventDoubleFormSubmit();
             $("#woall").click(function(event){
-                var msg = _("Are you sure you want to write off %s in outstanding fines? This cannot be undone!").format( "[% total | $Price %]" );
+                var msg = _("Are you sure you want to write off %s in outstanding fines? This cannot be undone!").format( "[% total | $Price | html %]" );
                 var answer = confirm(msg);
                     if (!answer){
                         event.preventDefault();
index 91fd550..14384b3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% USE Price %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Patrons &rsaquo; Collect fine payment for  [% patron.firstname %] [% patron.surname %]</title>
+<title>Koha &rsaquo; Patrons &rsaquo; Collect fine payment for  [% patron.firstname | html %] [% patron.surname | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -15,7 +16,7 @@
 <div id="breadcrumbs">
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo;
     <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a> &rsaquo;
-    <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]">Pay fines for [% patron.firstname %] [% patron.surname %]</a> &rsaquo;
+    <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Pay fines for [% patron.firstname | html %] [% patron.surname | html %]</a> &rsaquo;
     [% IF    ( pay_individual )      %]Pay an individual fine
     [% ELSIF ( writeoff_individual ) %]Write off an individual fine
     [% ELSE %]
 <div class="statictabs">
 <ul>
     <li>
-    <a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Account</a>
+    <a href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Account</a>
     </li>
     <li class="active">
-    <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]" >Pay fines</a>
+    <a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]" >Pay fines</a>
     </li>
     <li>
-    <a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual invoice</a>
+    <a href="/cgi-bin/koha/members/maninvoice.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual invoice</a>
     </li>
     <li>
-    <a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber %]" >Create manual credit</a>
+    <a href="/cgi-bin/koha/members/mancredit.pl?borrowernumber=[% patron.borrowernumber | html %]" >Create manual credit</a>
     </li>
 </ul>
 <div class="tabs-container">
 
 [% IF ( pay_individual ) %]
     <form name="payindivfine" id="payindivfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
-    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />
-    <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />
-    <input type="hidden" name="description" id="description" value="[% description %]" />
-    <input type="hidden" name="accounttype" id="accounttype" value="[% accounttype %]" />
-    <input type="hidden" name="amount" id="amount" value="[% amount %]" />
-    <input type="hidden" name="amountoutstanding" id="amountoutstanding" value="[% amountoutstanding %]" />
-    <input type="hidden" name="accountlines_id" id="accountlines_id" value="[% accountlines_id %]" />
-    <input type="hidden" name="title" id="title" value="[% title %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
+    <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" />
+    <input type="hidden" name="description" id="description" value="[% description | html %]" />
+    <input type="hidden" name="accounttype" id="accounttype" value="[% accounttype | html %]" />
+    <input type="hidden" name="amount" id="amount" value="[% amount | html %]" />
+    <input type="hidden" name="amountoutstanding" id="amountoutstanding" value="[% amountoutstanding | html %]" />
+    <input type="hidden" name="accountlines_id" id="accountlines_id" value="[% accountlines_id | html %]" />
+    <input type="hidden" name="title" id="title" value="[% title | html %]" />
 
 <fieldset class="rows">
     <legend>Pay an individual fine</legend>
-    <input type="hidden" name="payment_note" id="payment_note" value="[% payment_note %]" />
+    <input type="hidden" name="payment_note" id="payment_note" value="[% payment_note | html %]" />
     <table>
     <thead><tr>
             <th>Description</th>
@@ -87,9 +88,9 @@
     </tfoot>
     <tbody><tr>
             <td>
-                [% individual_description %]
+                [% individual_description | html %]
             </td>
-            <td>[% accounttype %]</td>
+            <td>[% accounttype | html %]</td>
             <td class="debit">[% amount | format('%.2f') %]</td>
             <td class="debit">[% amountoutstanding | format('%.2f') %]</td>
         </tr></tbody>
     <li>
         <label for="paid">Collect from patron: </label>
             <!-- default to paying all -->
-        <input name="paid" id="paid" value="[% amountoutstanding %]" />
+        <input name="paid" id="paid" value="[% amountoutstanding | html %]" />
     </li>
     [% SET payment_types = AuthorisedValues.GetAuthValueDropbox('PAYMENT_TYPE') %]
     [% IF payment_types %]
             <select name="payment_type" id="payment_type">
                 <option value=""></option>
                 [% FOREACH pt IN payment_types %]
-                    <option value="[% pt.authorised_value %]">[% pt.lib %]</option>
+                    <option value="[% pt.authorised_value | html %]">[% pt.lib | html %]</option>
                 [% END %]
             </select>
         </li>
 </fieldset>
 
     <div class="action"><input type="submit" name="submitbutton" value="Confirm" />
-        <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a></div>
+        <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a></div>
     </form>
 [% ELSIF ( writeoff_individual ) %]
     <form name="woindivfine" id="woindivfine" action="/cgi-bin/koha/members/pay.pl" method="post" >
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
     <fieldset class="rows">
     <legend>Write off an individual fine</legend>
-    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual %]" />
-    <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber %]" />
-    <input type="hidden" name="description" id="description" value="[% description %]" />
-    <input type="hidden" name="accounttype" id="accounttype" value="[% accounttype %]" />
-    <input type="hidden" name="amount" id="amount" value="[% amount %]" />
-    <input type="hidden" name="accountlines_id" id="accountlines_id" value="[% accountlines_id %]" />
-    <input type="hidden" name="title" id="title" value="[% title %]" />
-    <input type="hidden" name="payment_note" id="payment_note" value="[% payment_note %]" />
-    <input type="hidden" name="amountoutstanding" id="amountoutstanding" value="[% amountoutstanding %]" />
+    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="pay_individual" id="pay_individual" value="[% pay_individual | html %]" />
+    <input type="hidden" name="itemnumber" id="itemnumber" value="[% itemnumber | html %]" />
+    <input type="hidden" name="description" id="description" value="[% description | html %]" />
+    <input type="hidden" name="accounttype" id="accounttype" value="[% accounttype | html %]" />
+    <input type="hidden" name="amount" id="amount" value="[% amount | html %]" />
+    <input type="hidden" name="accountlines_id" id="accountlines_id" value="[% accountlines_id | html %]" />
+    <input type="hidden" name="title" id="title" value="[% title | html %]" />
+    <input type="hidden" name="payment_note" id="payment_note" value="[% payment_note | html %]" />
+    <input type="hidden" name="amountoutstanding" id="amountoutstanding" value="[% amountoutstanding | html %]" />
     <input type="hidden" name="confirm_writeoff" id="confirm_writeoff" value="1" />
     <table>
     <thead><tr>
         </tr></thead>
     <tfoot><td colspan="3">Total amount outstanding:</td><td>[% amountoutstanding | format('%.2f') %]</td></tfoot>
     <tbody><tr>
-            <td>[% description %] [% title %]</td>
-            <td>[% accounttype %]</td>
+            <td>[% description | html %] [% title | html %]</td>
+            <td>[% accounttype | html %]</td>
             <td class="debit">[% amount | format('%.2f') %]</td>
             <td class="debit">[% amountoutstanding | format('%.2f') %]</td>
         </tr></tbody>
                 <li>
                     <label for="paid">Writeoff amount: </label>
                     <!-- default to writing off all -->
-                    <input name="amountwrittenoff" id="amountwrittenoff" value="[% amountoutstanding | $Price on_editing => 1 %]" />
+                    <input name="amountwrittenoff" id="amountwrittenoff" value="[% amountoutstanding | $Price on_editing => 1 | html %]" />
                 </li>
             </ol>
         </fieldset>
         <div class="action">
             <input type="submit" value="Write off this charge" />
-            <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a>
+            <a class="cancel" href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
         </div>
     </form>
 [% ELSE %]
 
     <form name="payfine" id="payfine" method="post" action="/cgi-bin/koha/members/paycollect.pl">
-    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
-    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" />
-    <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts %]" />
-    <input type="hidden" name="total" id="total" value="[% total %]" />
-    <input type="hidden" name="type" value="[% type %]" />
+    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" />
+    <input type="hidden" name="selected_accts" id="selected_accts" value="[% selected_accts | html %]" />
+    <input type="hidden" name="total" id="total" value="[% total | html %]" />
+    <input type="hidden" name="type" value="[% type | html %]" />
 
     <fieldset class="rows">
     [% IF ( selected_accts ) %]
             <select name="payment_type" id="payment_type">
                 <option value=""></option>
                 [% FOREACH pt IN payment_types %]
-                    <option value="[% pt.authorised_value %]">[% pt.lib %]</option>
+                    <option value="[% pt.authorised_value | html %]">[% pt.lib | html %]</option>
                 [% END %]
             </select>
         </li>
     [% END %]
     <li>
         <label for="selected_accts_notes">Note: </label>
-        <textarea name="selected_accts_notes" id="selected_accts_notes">[% selected_accts_notes %]</textarea>
+        <textarea name="selected_accts_notes" id="selected_accts_notes">[% selected_accts_notes | html %]</textarea>
     </li>
     </ol>
     </fieldset>
     <div class="action">
         <input type="submit" name="submitbutton" value="Confirm" />
-        <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber %]">Cancel</a>
+        <a class="cancel" href="/cgi-bin/koha/members/boraccount.pl?borrowernumber=[% patron.borrowernumber | html %]">Cancel</a>
     </div>
     </form>
 [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type= "text/javascript">
         $(document).ready(function() {
             $('#payindivfine, #payfine').preventDoubleFormSubmit();
index 1e9ad5b..1ac29c9 100644 (file)
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Print receipt for [% patron.cardnumber %]</title>
+<title>Print receipt for [% patron.cardnumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/printreceiptinvoice.css") %]
+[% Asset.css("css/printreceiptinvoice.css") | $raw %]
 [% INCLUDE 'blocking_errors.inc' %]
 </head>
 
@@ -18,7 +19,7 @@
 [% IF ( LibraryName ) %]
  <tr>
     <th colspan=4 class="centerednames">
-               <h3>[% LibraryName %]</h3>
+               <h3>[% LibraryName | html %]</h3>
        </th>
  </tr>
 [% END %]
  </tr>
  <tr>
     <th colspan=4 class="centerednames">
-        <h2>[% Branches.GetName( patron.branchcode ) %]</h2>
+        <h2>[% Branches.GetName( patron.branchcode ) | html %]</h2>
        </th>
  </tr>
  <tr>
     <th colspan=4 >
-        Received with thanks from  [% patron.firstname %] [% patron.surname %] <br />
-        Card number : [% patron.cardnumber %]<br />
+        Received with thanks from  [% patron.firstname | html %] [% patron.surname | html %] <br />
+        Card number : [% patron.cardnumber | html %]<br />
        </th>
  </tr>
   <tr>
           [% CASE 'M' %]Sundry
           [% CASE 'L' %]Lost Item
           [% CASE 'W' %]Writeoff
-          [% CASE %][% account.accounttype %]
+          [% CASE %][% account.accounttype | html %]
         [%- END -%]
-        [%- IF account.description %], [% account.description %][% END %]
+        [%- IF account.description %], [% account.description | html %][% END %]
       </td>
-      <td>[% account.note %]</td>
-      [% IF ( account.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amount %]</td>
+      <td>[% account.note | html %]</td>
+      [% IF ( account.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amount | html %]</td>
     </tr>
 
   [% END %]
 <tfoot>
   <tr>
     <td colspan="3">Total outstanding dues as on date : </td>
-    [% IF ( totalcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% total %]</td>
+    [% IF ( totalcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% total | html %]</td>
   </tr>
   </tfoot>
 </table>
index ec3ddf6..2b1e066 100644 (file)
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Print receipt for [% patron.cardnumber %]</title>
+<title>Print receipt for [% patron.cardnumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/printreceiptinvoice.css") %]
+[% Asset.css("css/printreceiptinvoice.css") | $raw %]
 </head>
 
 <body id="printinvoice" class="pat">
@@ -17,7 +18,7 @@
 [% IF ( LibraryName ) %]
   <tr>
     <th colspan="5" class="centerednames">
-               <h3>[% LibraryName %]</h3>
+               <h3>[% LibraryName | html %]</h3>
        </th>
   </tr>
 [% END %]
   </tr>
   <tr>
     <th colspan="5" class="centerednames">
-        <h2>[% Branches.GetName( patron.branchcode ) %]</h2>
+        <h2>[% Branches.GetName( patron.branchcode ) | html %]</h2>
        </th>
   </tr>
   <tr>
     <th colspan="5" >
-        Bill to: [% patron.firstname %] [% patron.surname %] <br />
-        Card number: [% patron.cardnumber %]<br />
+        Bill to: [% patron.firstname | html %] [% patron.surname | html %] <br />
+        Card number: [% patron.cardnumber | html %]<br />
        </th>
   </tr>
   <tr>
           [% CASE 'M' %]Sundry
           [% CASE 'L' %]Lost Item
           [% CASE 'W' %]Writeoff
-          [% CASE %][% account.accounttype %]
+          [% CASE %][% account.accounttype | html %]
         [%- END -%]
-        [%- IF account.description %], [% account.description %][% END %]
+        [%- IF account.description %], [% account.description | html %][% END %]
       </td>
-      <td>[% account.note %]</td>
-      [% IF ( account.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amount %]</td>
-      [% IF ( account.amountoutstandingcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amountoutstanding %]</td>
+      <td>[% account.note | html %]</td>
+      [% IF ( account.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amount | html %]</td>
+      [% IF ( account.amountoutstandingcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% account.amountoutstanding | html %]</td>
     </tr>
 
   [% END %]
 <tfoot>
   <tr>
     <td colspan="4">Total outstanding dues as on date: </td>
-    [% IF ( totalcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% total %]</td>
+    [% IF ( totalcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% total | html %]</td>
   </tr>
   </tfoot>
 </table>
index 5214d88..709edb6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues  %]
@@ -5,7 +6,7 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Patrons &rsaquo; Purchase suggestions for [% INCLUDE 'patron-title.inc' no_html = 1 %]</title>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -28,7 +29,7 @@
                 <h2>Purchase suggestions</h2>
 
                 <div id="toolbar" class="btn-toolbar">
-                    <a class="btn btn-default btn-sm" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
+                    <a class="btn btn-default btn-sm" id="newsuggestion" href="/cgi-bin/koha/suggestion/suggestion.pl?op=add&amp;suggestedby=[% patron.borrowernumber | html %]&amp;redirect=purchase_suggestions&amp;borrowernumber=[% patron.borrowernumber | html %]"><i class="fa fa-plus"></i> New purchase suggestion</a>
                 </div>
 
                 [% IF suggestions %]
                                     <p>
                                         <strong>
                                             [% IF ( CAN_user_catalogue ) %]
-                                                <a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% s.suggestionid %]&amp;op=show">[% s.title |html %]</a>
+                                                <a href="/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% s.suggestionid | html %]&amp;op=show">[% s.title | html %]</a>
                                             [% ELSE %]
-                                                [% s.title |html %]
+                                                [% s.title | html %]
                                             [% END %]
                                         </strong>
                                     </p>
                                     <p>
-                                        [% IF ( s.author ) %][% s.author %],[% END %]
-                                        [% IF ( s.copyrightdate ) %] - [% s.copyrightdate %],[% END %]
-                                        [% IF ( s.publishercode ) %] - [% s.publishercode %][% END %]
-                                        [% IF ( s.place ) %]([% s.place %])[% END %]
-                                        [% IF ( s.collectiontitle ) %] , [% s.collectiontitle %][% END %]
-                                        [% IF ( s.itemtype ) %] - [% s.itemtype %][% END %]
+                                        [% IF ( s.author ) %][% s.author | html %],[% END %]
+                                        [% IF ( s.copyrightdate ) %] - [% s.copyrightdate | html %],[% END %]
+                                        [% IF ( s.publishercode ) %] - [% s.publishercode | html %][% END %]
+                                        [% IF ( s.place ) %]([% s.place | html %])[% END %]
+                                        [% IF ( s.collectiontitle ) %] , [% s.collectiontitle | html %][% END %]
+                                        [% IF ( s.itemtype ) %] - [% s.itemtype | html %][% END %]
                                     </p>
                                 </td>
-                                <td>[% s.note %]
+                                <td>[% s.note | html %]
                                 <td>
                                     [% IF ( s.surnamemanagedby ) %]
-                                        [% s.surnamemanagedby %]
+                                        [% s.surnamemanagedby | html %]
                                         [% IF ( s.firstnamemanagedby ) %],[% END %]
-                                        [% s.firstnamemanagedby %]
+                                        [% s.firstnamemanagedby | html %]
                                     [% ELSE %]
                                         &nbsp;
                                     [% END %]
                                     [% CASE %]
                                         [% SET status_description = AuthorisedValues.GetByCode('SUGGEST_STATUS', s.STATUS) %]
                                         [% IF status_description %]
-                                            [% status_description %]
+                                            [% status_description | html %]
                                         [% ELSE %]
                                             <span>Unknown</span>
                                         [% END %]
                                     [% END %]
-                                    [% IF s.reason %]([% s.reason %])[% END %]
+                                    [% IF s.reason %]([% s.reason | html %])[% END %]
                                 </td>
                             </tr>
                         [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index e3b0861..8ba70f3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Koha %]
@@ -7,7 +8,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Circulation History for [% INCLUDE 'patron-title.inc' no_html = 1 %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_readingrec" class="pat">
@@ -33,7 +34,7 @@
 [% ELSIF ( !loop_reading ) %]
     <div class="dialog message">This patron has no circulation history.</div>
 [% ELSE %]
-<form action="/cgi-bin/koha/members/readingrec.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber %]" /></form>
+<form action="/cgi-bin/koha/members/readingrec.pl" method="get"><input type="hidden" name="borrowernumber" id="borrowernumber" value="[% patron.borrowernumber | html %]" /></form>
 
 
 <div id="tabs" class="toptabs">
       [% FOREACH issue IN loop_reading %]
         [% IF  issue.returndate  %]<tr>[% ELSE %]<tr class="onissue">[% END %]
           <td style="display:none;">
-            [% IF issue.onsite_checkout %][% issuetype = 'onsite_checkout' %]
-            [% ELSE %][% issuetype = 'standard_checkout' %]
+            [% IF issue.onsite_checkout %][% issuetype = 'onsite_checkout' | html %]
+            [% ELSE %][% issuetype = 'standard_checkout' | html %]
             [% END %]
-            [% issuetype %]
+            [% issuetype | html %]
           </td>
           <td>
-            <span title="[% issue.issuestimestamp %]">[% issue.issuestimestamp | $KohaDates with_hours => 1 %]</span>
+            <span title="[% issue.issuestimestamp | html %]">[% issue.issuestimestamp | $KohaDates with_hours => 1 | html %]</span>
           </td>
-          <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% issue.biblionumber %]">[% issue.title |html %]</a></td>
+          <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% issue.biblionumber | html %]">[% issue.title | html %]</a></td>
 
-          <td>[% issue.author %]</td>
+          <td>[% issue.author | html %]</td>
 
           <td>
             [% IF issue.classification %]
-                [% issue.classification %]
+                [% issue.classification | html %]
             [% ELSE %]
-                [% issue.itemcallnumber %]
+                [% issue.itemcallnumber | html %]
             [% END %]
           </td>
 
-          <td>[% issue.barcode %]</td>
-          <td>[% issue.renewals %]</td>
+          <td>[% issue.barcode | html %]</td>
+          <td>[% issue.renewals | html %]</td>
           <td>
-            <span title="[% issue.issuedate %]">[% issue.issuedate |$KohaDates with_hours => 1 %]</span>
+            <span title="[% issue.issuedate | html %]">[% issue.issuedate |$KohaDates with_hours => 1 | html %]</span>
           </td>
-          <td>[% Branches.GetName( issue.branchcode ) %]</td>
+          <td>[% Branches.GetName( issue.branchcode ) | html %]</td>
           <td>
             [% IF issue.date_due %]
-                <span title="[% issue.date_due %]">[% issue.date_due |$KohaDates with_hours => 1 %]</span>
+                <span title="[% issue.date_due | html %]">[% issue.date_due |$KohaDates with_hours => 1 | html %]</span>
             [% ELSE %]
                 <span title="0000-00-00"></span>
             [% END %]
           </td>
           <td>
             [% IF  issue.returndate %]
-              <span title="[% issue.returndate %]">[% issue.returndate |$KohaDates with_hours => 1 %]</span>
+              <span title="[% issue.returndate | html %]">[% issue.returndate |$KohaDates with_hours => 1 | html %]</span>
             [% ELSE %]
               <span title="Checked out"><small>Checked out</small></span>
             [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript" id="js">
         $(document).ready(function() {
index c4163ed..37698b2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -22,7 +23,7 @@
 
 <!-- Search Bar -->
 <p class="tip">Search subscriptions:</p>
-<form action="/cgi-bin/koha/serials/serials-search.pl" method="get">[% IF ( routing ) %]<input type="hidden" name="routing" value="[% routing %]" />[% END %]<input type="hidden" name="searched" value="1" /> <label for="ISSN_filter">ISSN:</label> <input type="text" size="10" maxlength="11" name="ISSN_filter" id="ISSN_filter" value="[% ISSN_filter %]" /> <label for="title_filter">Title:</label> <input type="text" size="20" maxlength="40" name="title_filter" id="title_filter" value="[% title_filter %]" /><input type="submit" value="Search" class="submit" />
+<form action="/cgi-bin/koha/serials/serials-search.pl" method="get">[% IF ( routing ) %]<input type="hidden" name="routing" value="[% routing | html %]" />[% END %]<input type="hidden" name="searched" value="1" /> <label for="ISSN_filter">ISSN:</label> <input type="text" size="10" maxlength="11" name="ISSN_filter" id="ISSN_filter" value="[% ISSN_filter | html %]" /> <label for="title_filter">Title:</label> <input type="text" size="20" maxlength="40" name="title_filter" id="title_filter" value="[% title_filter | html %]" /><input type="submit" value="Search" class="submit" />
 </form>
 <!-- Search Bar End -->
 
@@ -31,9 +32,9 @@
 [% UNLESS ( routinglists ) %]
 0 subscription routing lists
 [% ELSIF ( routinglists.count == 1 ) %]
-[% routinglists.count %] subscription routing list
+[% routinglists.count | html %] subscription routing list
 [% ELSE %]
-[% routinglists.count %] subscription routing lists
+[% routinglists.count | html %] subscription routing lists
 [% END %]
 </h1>
 
         [% FOREACH routinglist IN routinglists %]
             <tr>
                 <td>
-                    <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% routinglist.subscription.subscriptionid %]">
-                        [% routinglist.subscription.biblio.title %]
+                    <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% routinglist.subscription.subscriptionid | html %]">
+                        [% routinglist.subscription.biblio.title | html %]
                     </a>
                 </td>
                 <td>
-                    [% routinglist.ranking %]
+                    [% routinglist.ranking | html %]
                 </td>
                 <td>
-                    <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% routinglist.subscription.subscriptionid %]">
+                    <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% routinglist.subscription.subscriptionid | html %]">
                         Edit routing list
                     </a>
-                    <input type="hidden" name="biblionumber" value="[% routinglist.subscription.biblionumber %]" />
-                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+                    <input type="hidden" name="biblionumber" value="[% routinglist.subscription.biblionumber | html %]" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
                 </td>
             </tr>
             [% END %]
@@ -72,8 +73,8 @@
     </table>
 [% ELSE %]
     <p>Patron does not belong to any subscription routing lists.</p>
-    <input type="hidden" name="biblionumber" value="[% routinglist.subscription.biblionumber %]" />
-    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+    <input type="hidden" name="biblionumber" value="[% routinglist.subscription.biblionumber | html %]" />
+    <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
 [% END %]
 
 </div>
@@ -89,7 +90,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 016b873..0d49464 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -10,7 +11,7 @@
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_statistics" class="pat">
@@ -49,7 +50,7 @@
                             [% CASE 'holdingbranch' %]
                                 Holding library
                             [% CASE %]
-                                [% cn %]
+                                [% cn | html %]
                             [% END %]
                           </th>
                       [% END %]
                     [% FOREACH r IN datas %]
                         <tr>
                             [% FOREACH c IN r %]
-                                <td>[% c %]</td>
+                                <td>[% c | html %]</td>
                             [% END %]
                         </tr>
                     [% END %]
                 </tbody>
                 <tfoot>
                     <tr>
-                        <td colspan="[% column_names.size %]">TOTAL</td>
-                        <td>[% count_total_precedent_state %]</td>
-                        <td>[% count_total_issues %]</td>
-                        <td>[% count_total_issues_returned %]</td>
-                        <td>[% count_total_actual_state %]</td>
+                        <td colspan="[% column_names.size | html %]">TOTAL</td>
+                        <td>[% count_total_precedent_state | html %]</td>
+                        <td>[% count_total_issues | html %]</td>
+                        <td>[% count_total_issues_returned | html %]</td>
+                        <td>[% count_total_actual_state | html %]</td>
                     </tr>
                 </tfoot>
                 </table>
@@ -91,7 +92,7 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index f1bb9a1..11d971e 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 [% USE To %]
 [% USE Branches %]
 [% USE KohaDates %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 "dt_cardnumber":
-                    "[% data.cardnumber |html %]",
+                    "[% data.cardnumber | html %]",
                 "dt_name":
                     "[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = data.firstname surname = data.surname othernames = data.othernames cardnumber = data.cardnumber invert_name = 1%]",
                 "dt_dateofbirth":
@@ -17,7 +18,7 @@
                 "dt_address":
                     "[% INCLUDE escape_address data=data %]",
                 "dt_action":
-                    "<a href=\"#\" class=\"btn btn-default btn-xs select_user\" data-borrowernumber=\"[% data.borrowernumber %]\">Select</a><input type=\"hidden\" id=\"borrower_data[% data.borrowernumber %]\" name=\"borrower_data[% data.borrowernumber %]\" value=\"[% To.json(data) | html %]\" />"
+                    "<a href=\"#\" class=\"btn btn-default btn-xs select_user\" data-borrowernumber=\"[% data.borrowernumber | html %]\">Select</a><input type=\"hidden\" id=\"borrower_data[% data.borrowernumber | html %]\" name=\"borrower_data[% data.borrowernumber | html %]\" value=\"[% To.json(data) | html %]\" />"
             }[% UNLESS loop.last %],[% END %]
         [% END %]
     ]
@@ -31,5 +32,5 @@
 [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %]
 [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %]
 [%~ SET address = address _ Branches.GetName( data.branchcode ) %]
-[%~ To.json( address ) ~%]
+[%~ To.json( address ).raw ~%]
 [% END %]
index 666b59c..db1a9ff 100644 (file)
@@ -1,48 +1,49 @@
+[% USE raw %]
 [% USE To %]
 [% USE AuthorisedValues %]
 [% USE KohaDates %]
 [% USE Price %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 [% IF CAN_user_tools_manage_patron_lists %]
                 "dt_borrowernumber":
-                    "<input type='checkbox' class='selection' name='borrowernumber' value='[% data.borrowernumber %]' />",
+                    "<input type='checkbox' class='selection' name='borrowernumber' value='[% data.borrowernumber | html %]' />",
                 [% END %]
                 "dt_cardnumber":
                     "[% data.cardnumber | html %]",
                 "dt_name":
-                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) invert_name = 1 %]</a><br />[% INCLUDE escape_address data = data %][% IF data.email %]<br/>Email: <a href='mailto:[% data.email | html %]'>[% data.email | html %]</a>[% END %]</span>",
+                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) invert_name = 1 %]</a><br />[% INCLUDE escape_address data = data %][% IF data.email %]<br/>Email: <a href='mailto:[% data.email | html %]'>[% data.email | html %]</a>[% END %]</span>",
     "dt_dateofbirth":
         "[% data.dateofbirth | $KohaDates %]",
                 "dt_category":
-                    "[% data.category_description |html %] ([% data.category_type |html %])",
+                    "[% data.category_description | html %] ([% data.category_type | html %])",
                 "dt_branch":
-                    "[% data.branchname |html %]",
+                    "[% data.branchname | html %]",
                 "dt_dateexpiry":
-                    "[% data.dateexpiry %]",
+                    "[% data.dateexpiry | html %]",
                 "dt_od_checkouts":
-                    "[% IF data.overdues %]<span class='overdue'><strong>[% data.overdues %]</strong></span>[% ELSE %][% data.overdues %][% END %] / [% data.issues %]",
+                    "[% IF data.overdues %]<span class='overdue'><strong>[% data.overdues | html %]</strong></span>[% ELSE %][% data.overdues | html %][% END %] / [% data.issues | html %]",
                 "dt_fines":
-                    "<span style='text-align: right; display: block;'>[% IF data.fines < 0 %]<span class='credit'>[% data.fines | $Price %]</span> [% ELSIF data.fines > 0 %] <span class='debit'><strong>[% data.fines | $Price %]</strong></span> [% ELSE %] [% data.fines | $Price %] [% END %]</span>",
+                    "<span style='text-align: right; display: block;'>[% IF data.fines < 0 %]<span class='credit'>[% data.fines | $Price | html %]</span> [% ELSIF data.fines > 0 %] <span class='debit'><strong>[% data.fines | $Price | html %]</strong></span> [% ELSE %] [% data.fines | $Price | html %] [% END %]</span>",
                 "dt_borrowernotes":
-                    "[% data.borrowernotes.replace('\\\\' , '\\\\') |html |html_line_break |collapse %]",
+                    "[% data.borrowernotes.replace('\\\\' , '\\\\') |html_line_break |collapse %]",
                 "dt_action":
-                    "<a href='/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% data.borrowernumber %]' class='btn btn-default btn-xs'><i class='fa fa-pencil'></i> Edit</a>",
+                    "<a href='/cgi-bin/koha/members/memberentry.pl?op=modify&amp;destination=circ&amp;borrowernumber=[% data.borrowernumber | html %]' class='btn btn-default btn-xs'><i class='fa fa-pencil'></i> Edit</a>",
                 "borrowernumber":
-                    "[% data.borrowernumber %]"
+                    "[% data.borrowernumber | html %]"
             }[% UNLESS loop.last %],[% END %]
         [% END %]
     ]
 }
 [% BLOCK escape_address %]
 [%~ SET address = data.streetnumber _ ' ' %]
-[%~ IF data.streettype %][% address = address _ AuthorisedValues.GetByCode( 'ROADTYPE', data.streettype ) _ ' ' %][% END %]
-[%~ IF data.address %][% address = address _ data.address _ ' ' %][% END %]
-[%~ IF data.address2 %][% address = address _ data.address2 _ ' ' %][% END %]
-[%~ To.json( address ) ~%]
+[%~ IF data.streettype %][% address = address _ AuthorisedValues.GetByCode( 'ROADTYPE', data.streettype ) _ ' ' | html %][% END %]
+[%~ IF data.address %][% address = address _ data.address _ ' ' | html %][% END %]
+[%~ IF data.address2 %][% address = address _ data.address2 _ ' ' | html %][% END %]
+[%~ To.json( address ).raw ~%]
 [% END %]
index e30a977..5687f20 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Choose adult category</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pat_update-child" class="pat">
                         [% FOREACH patron_category IN patron_categories %]
                             <tr>
                                 <td>
-                                    <input type="radio" id="catcode[% patron_category.categorycode %]" name="catcode" value="[% patron_category.categorycode %]" />
+                                    <input type="radio" id="catcode[% patron_category.categorycode | html %]" name="catcode" value="[% patron_category.categorycode | html %]" />
                                 </td>
-                                <td>[% patron_category.categorycode  %]</td>
-                                <td><label for="catcode[% patron_category.categorycode %]"><strong>[% patron_category.description %]</strong></label></td>
+                                <td>[% patron_category.categorycode | html %]</td>
+                                <td><label for="catcode[% patron_category.categorycode | html %]"><strong>[% patron_category.description | html %]</strong></label></td>
                             </tr>
                         [% END %]
                     </tbody>
                 </table>
                 <input type="hidden" name="op" value="update" />
-                <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
-                <input type="hidden" name="cattype" value="[% cattype %]" />
+                <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
+                <input type="hidden" name="cattype" value="[% cattype | html %]" />
                 <fieldset class="action">
                     <input class="submit" type="submit" value="Submit" />
                     <a href="#" class="cancel close">Cancel</a>
     </script>
     [% IF ( SUCCESS ) %]
         <script type="text/javascript">
-            self.opener.location.href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]';
+            self.opener.location.href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]';
             window.close();
         </script>
     [% END %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index dee9157..b93aeb5 100644 (file)
@@ -18,7 +18,7 @@
 [% FOREACH message IN messages %]
   [% IF ( message.message ) %]
       [% IF ( message.ERROR_file_version ) %]
-          <div class="dialog alert"><p>Warning: This file is version [% message.upload_version %], but I only know how to import version [% message.current_version %]. I'll try my best.</p>
+          <div class="dialog alert"><p>Warning: This file is version [% message.upload_version | html %], but I only know how to import version [% message.current_version | html %]. I'll try my best.</p>
       [% END %]
   [% END %]
 [% END %]
index c5803ae..9c66a85 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE "doc-head-open.inc" %]
@@ -35,9 +36,9 @@
                        </thead>
                        <tbody>
                            [% FOREACH operation IN pending_operations %]
-                               <tr class="oc-[% operation.action %]">
-                                   <td><input type="checkbox" name="operationid" value="[% operation.operationid %]" /></td>
-                                       <td>[% operation.timestamp %]</td>
+                               <tr class="oc-[% operation.action | html %]">
+                                   <td><input type="checkbox" name="operationid" value="[% operation.operationid | html %]" /></td>
+                                       <td>[% operation.timestamp | html %]</td>
                             <td>
                                 [% SWITCH ( operation.action ) -%]
                                     [%   CASE "issue" -%]
                                     [%   CASE "payment" -%]
                                         Payment
                                     [%   CASE # default case -%]
-                                        [% operation.action %]
+                                        [% operation.action | html %]
                                 [% END -%]
                             </td>
                                        <td>
                                 [% IF ( operation.biblionumber ) %]
-                                               <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% operation.biblionumber %]" title="[% operation.bibliotitle %]">[% operation.barcode %]</a>
+                                               <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% operation.biblionumber | html %]" title="[% operation.bibliotitle | html %]">[% operation.barcode | html %]</a>
                                            [% ELSE %]
-                                               <span class="error">[% operation.barcode %]</span>
+                                               <span class="error">[% operation.barcode | html %]</span>
                                            [% END %]
                                        </td>
                                        <td>
                                        [% IF ( operation.actionissue || operation.actionpayment) %]
                                        [% IF ( operation.borrowernumber ) %]
-                                           <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% operation.borrowernumber %]" title="[% operation.borrower %]">[% operation.cardnumber %]</a>
+                                           <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% operation.borrowernumber | html %]" title="[% operation.borrower | html %]">[% operation.cardnumber | html %]</a>
                                        [% ELSE %]
-                                           <span class="error">[% operation.cardnumber %]</span>
+                                           <span class="error">[% operation.cardnumber | html %]</span>
                                        [% END %]
                                        [% END %]
                                        </td>
-                                        <td>[% operation.amount %]</td>
+                                        <td>[% operation.amount | html %]</td>
                                </tr>
                            [% END %]
                        </tbody>
@@ -88,7 +89,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
 
index b7f50e6..ca4b8f7 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
   [% FOREACH message IN messages %]
     [% IF ( message.message ) %]
        <div class="dialog alert">
-               [% IF ( message.ERROR_file_version ) %]<p>Warning: This file is version [% message.upload_version %], but I only know how to import version [% message.current_version %]. I'll try my best.</p>[% END %]
+               [% IF ( message.ERROR_file_version ) %]<p>Warning: This file is version [% message.upload_version | html %], but I only know how to import version [% message.current_version | html %]. I'll try my best.</p>[% END %]
        </div>
        [% END %]
-       [% IF ( message.ERROR_no_borrower_from_item ) %]<p>Warning: Unable to determine patron from item barcode ([% message.badbarcode %]). Cannot check in.</p>[% END %]
-       [% IF ( message.issue ) %]<p>Checked out <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber %]">[% message.title |html %]</a> ([% message.barcode %]) to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber %]">[% message.firstname %] [% message.surname %]</a> ([% message.cardnumber %]): [% message.datetime %]</p>[% END %]
-       [% IF ( message.renew ) %]<p>Renewed <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber %]">[% message.title |html %]</a>  ([% message.barcode %]) for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber %]">[% message.firstname %] [% message.surname %]</a> ([% message.cardnumber %]): [% message.datetime %]</p>[% END %]
-       [% IF ( message.return ) %]<p>Checked in <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber %]">[% message.title |html %]</a> ([% message.barcode %]) from <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber %]">[% message.firstname %] [% message.surname %]</a> ([% message.cardnumber %]): [% message.datetime %]</p>[% END %]
-       [% IF ( message.payment ) %]<p>Accepted payment ([% message.amount %]) from <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber %]">[% message.firstname %] [% message.surname %]</a> ([% message.cardnumber %]): [% message.datetime %]</p>[% END %]
+       [% IF ( message.ERROR_no_borrower_from_item ) %]<p>Warning: Unable to determine patron from item barcode ([% message.badbarcode | html %]). Cannot check in.</p>[% END %]
+    [% IF ( message.issue ) %]<p>Checked out <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber | html %]">[% message.title | html %]</a> ([% message.barcode | html %]) to <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber | html %]">[% message.firstname | html %] [% message.surname | html %]</a> ([% message.cardnumber | html %]): [% message.datetime | html %]</p>[% END %]
+    [% IF ( message.renew ) %]<p>Renewed <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber | html %]">[% message.title | html %]</a>  ([% message.barcode | html %]) for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber | html %]">[% message.firstname | html %] [% message.surname | html %]</a> ([% message.cardnumber | html %]): [% message.datetime | html %]</p>[% END %]
+    [% IF ( message.return ) %]<p>Checked in <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber | html %]">[% message.title | html %]</a> ([% message.barcode | html %]) from <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber | html %]">[% message.firstname | html %] [% message.surname | html %]</a> ([% message.cardnumber | html %]): [% message.datetime | html %]</p>[% END %]
+       [% IF ( message.payment ) %]<p>Accepted payment ([% message.amount | html %]) from <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% message.borrowernumber | html %]">[% message.firstname | html %] [% message.surname | html %]</a> ([% message.cardnumber | html %]): [% message.datetime | html %]</p>[% END %]
   [% END %]
 [% ELSE %]
    <h2>Upload offline circulation data</h2>
@@ -68,8 +69,8 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/background-job-progressbar.js") %]
-    [% Asset.js("js/file-upload.js") %]
+    [% Asset.js("js/background-job-progressbar.js") | $raw %]
+    [% Asset.js("js/file-upload.js") | $raw %]
     <script type="text/javascript">
         var xhr;
         $(document).ready(function(){
index 6a9bdfa..1fd91e0 100644 (file)
@@ -13,7 +13,7 @@
 [% INCLUDE 'installer-doc-head-close.inc' %]
 [% INCLUDE 'validator-strings.inc' %]
 [% INCLUDE 'installer-strings.inc' %]
-<script type="text/javascript" src="[% interface %]/[% theme %]/js/onboarding.js"></script>
+<script type="text/javascript" src="[% interface | html %]/[% theme | html %]/js/onboarding.js"></script>
 </head>
 
 <body id="installer" class="installer">
                         <ol>
                             <li>
                                 <label for="categorycode" class="required">Category code: </label>
-                                <input type="text" pattern="[0-9A-Za-z]{1,10}" id="categorycode" name="categorycode" value="[% category.categorycode |html %]" size="10" maxlength="10" class="required" required="required" />
+                                <input type="text" pattern="[0-9A-Za-z]{1,10}" id="categorycode" name="categorycode" value="[% category.categorycode | html %]" size="10" maxlength="10" class="required" required="required" />
                                 <span class="required">Required</span>
                             </li>
 
                             <li>
                                 <label for="description" class="required">Description: </label>
-                                <input type="text" id="description" name="description" size="40" maxlength="80" class="required" required="required" value="[% category.description |html%]" />
+                                <input type="text" id="description" name="description" size="40" maxlength="80" class="required" required="required" value="[% category.description | html %]" />
                                 <span class="required">Required</span>
                             </li>
 
                                         <li>
                                             <label for="enrolmentperiod">In months: </label>
                                             [% IF category.enrolmentperiod %]
-                                                <input type="number" class="enrolmentperiod" name="enrolmentperiod" id="enrolmentperiod" min="0" size="3" value="[% category.enrolmentperiod %]" />
+                                                <input type="number" class="enrolmentperiod" name="enrolmentperiod" id="enrolmentperiod" min="0" size="3" value="[% category.enrolmentperiod | html %]" />
                                             [% ELSE %]
                                                 <input type="number" class="enrolmentperiod" name="enrolmentperiod" id="enrolmentperiod" min="0" size="3" value="" />
                                             [% END %]
index 51ed7f0..b96c30d 100644 (file)
@@ -4,7 +4,7 @@
 [% INCLUDE 'installer-doc-head-close.inc' %]
 [% INCLUDE 'validator-strings.inc' %]
 [% INCLUDE 'installer-strings.inc' %]
-<script type="text/javascript" src="[% interface %]/[% theme %]/js/onboarding.js"></script>
+<script type="text/javascript" src="[% interface | html %]/[% theme | html %]/js/onboarding.js"></script>
 </head>
 
 <body id="installer" class="installer">
                         <ol>
                             <li>
                                 <label for="surname" class="required">Surname: </label>
-                                <input type="text" id="surname" name="surname" value="[% surname |html %]" class="required" required="required" />
+                                <input type="text" id="surname" name="surname" value="[% surname | html %]" class="required" required="required" />
                                 <span class="required">Required</span>
                             </li>
                             <li>
                                 <label for="firstname" class="required">First name: </label>
-                                <input  type="text" name="firstname" id="firstname" size="20" value="[% firstname |html %]" class="required" required="required">
+                                <input  type="text" name="firstname" id="firstname" size="20" value="[% firstname | html %]" class="required" required="required">
                                 <span class="required">Required</span>
                             </li>
                         </ol>
@@ -53,7 +53,7 @@
                                 <label for="libraries" class="required"> Library: </label>
                                 <select name="libraries" size="1" id="libraries">
                                     [% FOREACH library IN libraries %]
-                                        <option value="[% library.branchcode %]"> [% library.branchname %] </option>
+                                        <option value="[% library.branchcode | html %]"> [% library.branchname | html %] </option>
                                     [% END %]
                                 </select>
                                 <span class="required"> Required</span>
@@ -62,7 +62,7 @@
                                 <label for="categorycode_entry" class="required"> Patron category</label>
                                 <select id="categorycode_entry" name="categorycode_entry">
                                     [% FOREACH category IN categories %]
-                                        <option value = "[% category.categorycode %]">[%category.description %]</option>
+                                        <option value = "[% category.categorycode | html %]">[% category.description | html %]</option>
                                     [% END %]
                                 </select>
                                 <span class="required">Required</span><br><br>
                         <ol>
                             <li>
                                 <label for="userid" class="required">Username: </label>
-                                <input type="text" name="userid" id ="userid" size="20" value="[% userid |html %]" class="required" required="required" />
+                                <input type="text" name="userid" id ="userid" size="20" value="[% userid | html %]" class="required" required="required" />
                                 <span class="required">Required</span>
                             </li>
                             <li>
                                 <label for="password" class="required">Password: </label>
-                                <input type="password" name="password" id="password" size="20" value="[% member.password |html %]" class="required" required="required">
+                                <input type="password" name="password" id="password" size="20" value="[% member.password | html %]" class="required" required="required">
                                 <span class="required">Required</span>
                             </li>
                             <li>
index ec9c7b6..54274c0 100644 (file)
@@ -3,7 +3,7 @@
 [% INCLUDE 'installer-doc-head-close.inc' %]
 [% INCLUDE 'validator-strings.inc' %]
 [% INCLUDE 'installer-strings.inc' %]
-<script type="text/javascript" src="[% interface %]/[% theme %]/js/onboarding.js"></script>
+<script type="text/javascript" src="[% interface | html %]/[% theme | html %]/js/onboarding.js"></script>
 </head>
 
 <body id="installer" class="installer">
                         <ol>
                             <li>
                                 <label for="itemtype" class="required">Item type code: </label>
-                                <input type="text" name="itemtype" pattern="[0-9A-Za-z]{1,10}" id="itemtype" size="10" maxlength="10"  class="required" required="required" value="[% itemtype.itemtype |html %]" />
+                                <input type="text" name="itemtype" pattern="[0-9A-Za-z]{1,10}" id="itemtype" size="10" maxlength="10"  class="required" required="required" value="[% itemtype.itemtype | html %]" />
                                 <span class="required">Required</span>
                             </li>
 
                             <li>
                                 <label for="description" class="required">Description: </label>
-                                <input type="text" name="description" id="description" size="42" value="[% itemtype.description |html %]" class="required" required="required">
+                                <input type="text" name="description" id="description" size="42" value="[% itemtype.description | html %]" class="required" required="required">
                                 <span class="required">Required</span>
                             </li>
                         </ol>
index dfae544..d6eb24e 100644 (file)
@@ -9,7 +9,7 @@
 [% INCLUDE 'installer-doc-head-close.inc' %]
 [% INCLUDE 'validator-strings.inc' %]
 [% INCLUDE 'installer-strings.inc' %]
-<script type="text/javascript" src="[% interface %]/[% theme %]/js/onboarding.js"></script>
+<script type="text/javascript" src="[% interface | html %]/[% theme | html %]/js/onboarding.js"></script>
 </head>
 
 <body id="installer" class="installer">
@@ -42,7 +42,7 @@
                                         <option value=""> Choose</option>
                                         <option value="*" selected="selected">All</option>
                                         [% FOREACH library IN libraries %]
-                                            <option value="[% library.branchcode %]"> [% library.branchname %]</option>
+                                            <option value="[% library.branchcode | html %]"> [% library.branchname | html %]</option>
                                         [% END %]
                                     </select>
                                     <span class="required">Required</span>
@@ -53,7 +53,7 @@
                                         <option value=""> Choose</option>
                                         <option value="*" selected="selected">All</option>
                                         [% FOREACH category IN categories %]
-                                            <option value = "[% category.categorycode %]"> [%category.description %]</option>
+                                            <option value = "[% category.categorycode | html %]"> [% category.description | html %]</option>
                                         [%END%]
                                     </select>
                                     <span class="required">Required</span>
@@ -65,7 +65,7 @@
                                         <option value=""> Choose </option>
                                         <option value="*" selected="selected">All</option>
                                         [% FOREACH item IN itemtypes %]
-                                            <option value = "[% item.itemtype %]"> [% item.itemtype %]
+                                            <option value = "[% item.itemtype | html %]"> [% item.itemtype | html %]
                                         [%END%]
                                     </select>
                                     <span class="required"> Required</span>
index 23ee885..cfb1e7c 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -48,7 +49,7 @@
                 <ol>
                     <li>
                         <label class="required" for="list-name">Name:</label>
-                        <input id="list-name" name="name" type="text" class="required" required="required" value="[% list.name %]" />
+                        <input id="list-name" name="name" type="text" class="required" required="required" value="[% list.name | html %]" />
                     </li>
 
                     <li>
                     </li>
 
                     <li>
-                        <span class="label">Owner: </span>[% loggedinusername %]
+                        <span class="label">Owner: </span>[% loggedinusername | html %]
                     </li>
                 </ol>
 
             </fieldset>
 
             <fieldset class="action">
-                <input type="hidden" name="patron_list_id" value="[% list.patron_list_id %]" />
+                <input type="hidden" name="patron_list_id" value="[% list.patron_list_id | html %]" />
                 <input type="submit" value="Save" />
                 <a href="lists.pl" class="cancel">Cancel</a>
             </fieldset>
@@ -77,7 +78,7 @@
         </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index fe539ea..44f1ce4 100644 (file)
@@ -1,11 +1,12 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Tools &rsaquo; Patron lists &rsaquo; [% list.name %] &rsaquo; Add patrons</title>
+<title>Koha &rsaquo; Tools &rsaquo; Patron lists &rsaquo; [% list.name | html %] &rsaquo; Add patrons</title>
 [% INCLUDE 'doc-head-close.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     #add_patrons_by_search {
         display: none;
 <body id="patlist_list" class="pat patlist">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id %]">[% list.name |html %]</a> &rsaquo; Add patrons</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="lists.pl">Patron lists</a> &rsaquo; <a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% list.id | html %]">[% list.name | html %]</a> &rsaquo; Add patrons</div>
 
 <div id="doc3" class="yui-t2">
    <div id="bd">
     <div id="yui-main">
         <div class="yui-b">
-        <h1>[% list.name |html %]</h1>
+        <h1>[% list.name | html %]</h1>
 
         [% IF ( not_found.size > 0 ) %]
         <div class="dialog alert"><p>Warning, the following cardnumbers were not found:</p></div>
@@ -41,7 +42,7 @@
             </thead>
             <tbody>
             [% FOREACH nf IN not_found %]
-                <tr><td>[% nf |html %]</td></td>
+                <tr><td>[% nf | html %]</td></td>
             [% END %]
             </tbody>
         </table>
@@ -55,7 +56,7 @@
             </thead>
             <tbody>
             [% FOREACH ed IN existed %]
-                <tr><td>[% ed |html %]</td></td>
+                <tr><td>[% ed | html %]</td></td>
             [% END %]
             </tbody>
         </table>
@@ -92,7 +93,7 @@
                 <div id="patrons_to_add"></div>
 
                 <fieldset class="action">
-                    <input type="hidden" name="patron_list_id" value="[% list.patron_list_id %]" />
+                    <input type="hidden" name="patron_list_id" value="[% list.patron_list_id | html %]" />
                     <input type="submit" value="Add patrons" />
                     <a href="lists.pl" class="cancel">Cancel</a>
                 </fieldset>
                     [% FOREACH p IN list.patron_list_patrons %]
                         <tr>
                             <td>
-                                <input type="checkbox" name="patrons_to_remove" class="selection" value="[% p.patron_list_patron_id %]" />
-                                <input type="hidden" id="borrowernumber_[% p.patron_list_patron_id %]" value="[% p.borrowernumber.id %]" />
+                                <input type="checkbox" name="patrons_to_remove" class="selection" value="[% p.patron_list_patron_id | html %]" />
+                                <input type="hidden" id="borrowernumber_[% p.patron_list_patron_id | html %]" value="[% p.borrowernumber.id | html %]" />
                             </td>
                             <td>
-                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% p.borrowernumber.borrowernumber %]">
-                                    [% p.borrowernumber.cardnumber %]
+                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% p.borrowernumber.borrowernumber | html %]">
+                                    [% p.borrowernumber.cardnumber | html %]
                                 </a>
                             </td>
-                            <td>[% p.borrowernumber.firstname %]</td>
-                            <td>[% p.borrowernumber.surname %]</td>
+                            <td>[% p.borrowernumber.firstname | html %]</td>
+                            <td>[% p.borrowernumber.surname | html %]</td>
                             <td>
-                                [% p.borrowernumber.address %]
-                                [% p.borrowernumber.address2 %]
-                                [% p.borrowernumber.city %]
-                                [% p.borrowernumber.state %]
-                                [% p.borrowernumber.country %]
+                                [% p.borrowernumber.address | html %]
+                                [% p.borrowernumber.address2 | html %]
+                                [% p.borrowernumber.city | html %]
+                                [% p.borrowernumber.state | html %]
+                                [% p.borrowernumber.country | html %]
                             </td>
-                            <td>[% p.borrowernumber.categorycode.description %] ([% p.borrowernumber.categorycode.categorycode %])</td>
-                            <td>[% p.borrowernumber.branchcode.branchname %]</td>
-                            <td><span title="[% p.borrowernumber.dateexpiry %]">[% p.borrowernumber.dateexpiry | $KohaDates %]</span></td>
-                            <td>[% p.borrowernumber.borrowernotes %]</td>
+                            <td>[% p.borrowernumber.categorycode.description | html %] ([% p.borrowernumber.categorycode.categorycode | html %])</td>
+                            <td>[% p.borrowernumber.branchcode.branchname | html %]</td>
+                            <td><span title="[% p.borrowernumber.dateexpiry | html %]">[% p.borrowernumber.dateexpiry | $KohaDates %]</span></td>
+                            <td>[% p.borrowernumber.borrowernotes | html %]</td>
                         </tr>
                     [% END %]
                 </tbody>
             </table>
 
-            <input type="hidden" name="patron_list_id" value="[% list.patron_list_id %]" />
+            <input type="hidden" name="patron_list_id" value="[% list.patron_list_id | html %]" />
             <button type="submit" class="btn btn-default btn-sm list-remove"><i class="fa fa-trash" aria-hidden="true"></i> Remove selected patrons</button>
             <button class="btn btn-default btn-sm merge-patrons" type="submit"><i class="fa fa-compress"></i> Merge selected patrons</button>
         </form>
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
 
-    [% Asset.js("js/autocomplete/patrons.js") %]
+    [% Asset.js("js/autocomplete/patrons.js") | $raw %]
     <script type="text/javascript">
         var MSG_REMOVE_PATRON = _("Remove");
         $(document).ready(function() {
index b6057a6..a50d609 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Patron lists</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% INCLUDE 'greybox.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="patlist_lists" class="pat patlist">
                 [% FOREACH l IN lists %]
                     [% SET shared_by_other = l.owner.id != logged_in_user.id %]
                     <tr>
-                        <td><a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% l.patron_list_id %]">[% l.name |html%]</a></td>
-                        <td>[% l.patron_list_patrons_rs.count || 0 %]</td>
+                        <td><a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% l.patron_list_id | html %]">[% l.name | html %]</a></td>
+                        <td>[% l.patron_list_patrons_rs.count || 0 | html %]</td>
                         <td>
                             [% IF l.shared %]
                                 [% IF shared_by_other %]
-                                    by <a href=/cgi-bin/koha/members/moremember.pl?borrowernumber=[% l.owner.id %]">[% INCLUDE 'patron-title.inc' patron=l.owner %]</a>
+                                    by <a href=/cgi-bin/koha/members/moremember.pl?borrowernumber=[% l.owner.id | html %]">[% INCLUDE 'patron-title.inc' patron=l.owner %]</a>
                                 [% ELSE %]
                                     by you
                                 [% END %]
                         </td>
                         <td>
                             <div class="dropdown">
-                                <a class="btn btn-default btn-xs dropdown-toggle" id="listactions[% l.patron_list_id %]" role="button" data-toggle="dropdown" href="#">
+                                <a class="btn btn-default btn-xs dropdown-toggle" id="listactions[% l.patron_list_id | html %]" role="button" data-toggle="dropdown" href="#">
                                    Actions <b class="caret"></b>
                                 </a>
-                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="listactions[% l.patron_list_id %]">
-                                    <li><a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% l.patron_list_id %]"><i class="fa fa-user"></i> Add patrons</a></li>
+                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="listactions[% l.patron_list_id | html %]">
+                                    <li><a href="/cgi-bin/koha/patron_lists/list.pl?patron_list_id=[% l.patron_list_id | html %]"><i class="fa fa-user"></i> Add patrons</a></li>
                                     [% UNLESS shared_by_other %]
-                                        <li><a href="/cgi-bin/koha/patron_lists/add-modify.pl?patron_list_id=[% l.patron_list_id %]"><i class="fa fa-pencil"></i> Edit list</a></li>
-                                        <li><a class="delete_patron" href="/cgi-bin/koha/patron_lists/delete.pl?patron_list_id=[% l.patron_list_id %]" data-list-name="[% l.name %]"><i class="fa fa-trash"></i> Delete list</a></li>
+                                        <li><a href="/cgi-bin/koha/patron_lists/add-modify.pl?patron_list_id=[% l.patron_list_id | html %]"><i class="fa fa-pencil"></i> Edit list</a></li>
+                                        <li><a class="delete_patron" href="/cgi-bin/koha/patron_lists/delete.pl?patron_list_id=[% l.patron_list_id | html %]" data-list-name="[% l.name | html %]"><i class="fa fa-trash"></i> Delete list</a></li>
                                     [% END %]
                                     [% IF ( l.patron_list_patrons_rs.count ) %]
                                         <li class="divider"></li>
                                         <li>
-                                            <a class="print_cards" href="/cgi-bin/koha/patroncards/print.pl?patronlist_id=[% l.patron_list_id %]" data-patron_list_id="[% l.patron_list_id %]"><i class="fa fa-print"></i> Print patron cards</a>
+                                            <a class="print_cards" href="/cgi-bin/koha/patroncards/print.pl?patronlist_id=[% l.patron_list_id | html %]" data-patron_list_id="[% l.patron_list_id | html %]"><i class="fa fa-print"></i> Print patron cards</a>
                                         </li>
                                         [% IF CAN_user_tools_edit_patrons %]
                                             <li>
-                                                <a href="/cgi-bin/koha/tools/modborrowers.pl?patron_list_id=[% l.patron_list_id %]&op=show">
+                                                <a href="/cgi-bin/koha/tools/modborrowers.pl?patron_list_id=[% l.patron_list_id | html %]&op=show">
                                                     <i class="fa fa-pencil"></i> Batch edit patrons
                                                 </a>
                                             </li>
                                         [% END %]
                                         [% IF CAN_user_tools_delete_anonymize_patrons %]
                                             <li>
-                                                <a href="/cgi-bin/koha/tools/cleanborrowers.pl?step=2&patron_list_id=[% l.patron_list_id %]&checkbox=borrower">
+                                                <a href="/cgi-bin/koha/tools/cleanborrowers.pl?step=2&patron_list_id=[% l.patron_list_id | html %]&checkbox=borrower">
                                                     <i class="fa fa-trash"></i> Batch delete patrons
                                                 </a>
                                             </li>
                     <h3 id="patronExportModal_label">Print patron cards</h3>
                 </div>
                 <div class="modal-body">
-                    <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+                    <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
                 </div>
                 </div>
                 </div>
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
 
     <script type="text/javascript">
             });
 
             patronExportModal.on("hidden", function(){
-                patronExportModalBody.html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                patronExportModalBody.html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
 
             patronExportModal.on("submit", "#exportingf", function(e){
                 e.preventDefault();
                 modal_body = patronExportModalBody;
-                modal_body.html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                modal_body.html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
                 target_url = $(this).attr("action");
                 params =  $( this ).serialize();
                 modal_body.load( target_url + "?" + params + " #custom-doc");
index 1eaaa95..d16ad3f 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Batches &rsaquo; [% IF batch_id %]Edit ([% batch_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Batches &rsaquo; [% IF batch_id %]Edit ([% batch_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="pcard_edit-batch" class="tools pcard">
@@ -15,7 +16,7 @@
         <a href="/cgi-bin/koha/patroncards/home.pl">Patron card creator</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/manage.pl?card_element=batch">Batches</a> &rsaquo;
         [% IF batch_id %]
-            Edit ([% batch_id %])
+            Edit ([% batch_id | html %])
         [% ELSE %]
             New
         [% END %]
 
                 [% IF ( duplicate_message ) %]
                     <div class="dialog message">
-                        <strong>Duplicate patrons removed from batch number [% batch_id %]: [% duplicate_count %]</strong>
+                        <strong>Duplicate patrons removed from batch number [% batch_id | html %]: [% duplicate_count | html %]</strong>
                     </div>
                 [% END %]
 
                     [% INCLUDE 'patroncards-errors.inc' %]
                     <div id="manage-patroncard-batches">
-                        <div class="hint">Current library: [% LoginBranchname %]</div>
+                        <div class="hint">Current library: [% LoginBranchname | html %]</div>
                             <form name="add_by_bor_num" action="/cgi-bin/koha/patroncards/edit-batch.pl" method="post">
                                 <div>
                                     <fieldset class="rows" style="border-bottom: 0px; border: 0px;">
                                     <ol><li>
                                     <input type="hidden" name="op" value="add" />
-                                    <input type="hidden" name="batch_id" value="[% batch_id %]" />
+                                    <input type="hidden" name="batch_id" value="[% batch_id | html %]" />
                                     <label for="bor_num_list">Add by borrowernumber(s):
                                         <br /> <span class="hint">One borrowernumber per line.</span>
                                     </label>
@@ -64,7 +65,7 @@
                             </div>
                             [% IF ( table_loop ) %]
                             <form name="items" class="checkboxed">
-                                <h2>Patrons in batch number [% batch_id %]</h2>
+                                <h2>Patrons in batch number [% batch_id | html %]</h2>
                                 <table id="batcht">
                                     [% FOREACH table_loo IN table_loop %]
                                         [% IF ( table_loo.header_fields ) %]
@@ -81,7 +82,7 @@
                                                             [% CASE "Select" -%]
                                                                 <th>Select</th>
                                                             [% CASE %]
-                                                                <th>[% header_field.field_label %]</th>
+                                                                <th>[% header_field.field_label | html %]</th>
                                                         [% END -%]
                                                     [% END %]
                                                 </tr>
                                                 [% FOREACH text_field IN table_loo.text_fields %]
                                                     [% IF ( text_field.select_field ) %]
                                                         <td>
-                                                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/patroncards/edit-batch.pl?op=remove&amp;batch_id=[% batch_id %]&amp;label_id=[% text_field.field_value %]"><i class="fa fa-trash"></i> Delete</a>
-                                                            <a class="btn btn-default btn-xs export" href="#" data-batch-id="[% batch_id %]" data-label-id="[% text_field.field_value %]"><i class="fa fa-share-square-o"></i> Export</a>
+                                                            <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/patroncards/edit-batch.pl?op=remove&amp;batch_id=[% batch_id | html %]&amp;label_id=[% text_field.field_value | html %]"><i class="fa fa-trash"></i> Delete</a>
+                                                            <a class="btn btn-default btn-xs export" href="#" data-batch-id="[% batch_id | html %]" data-label-id="[% text_field.field_value | html %]"><i class="fa fa-share-square-o"></i> Export</a>
                                                         </td>
-                                                        <td><input type="checkbox" name="action" value="[% text_field.field_value %]" /></td>
+                                                        <td><input type="checkbox" name="action" value="[% text_field.field_value | html %]" /></td>
                                                     [% ELSE %]
-                                                        <td>[% text_field.field_value %]</td>
+                                                        <td>[% text_field.field_value | html %]</td>
                                                     [% END %]
                                                 [% END %]
                                             </tr>
     [% INCLUDE 'datatables.inc' %]
     <script>
         function DeleteConfirm() {
-            var msg = _("Are you sure you want to delete batch %s?").format("[% batch_id %]");
+            var msg = _("Are you sure you want to delete batch %s?").format("[% batch_id | html %]");
             var answer = confirm(msg);
             if (answer) {
-                window.location = "/cgi-bin/koha/patroncards/manage.pl?op=delete&amp;card_element=batch&amp;element_id=[% batch_id %]";
+                window.location = "/cgi-bin/koha/patroncards/manage.pl?op=delete&amp;card_element=batch&amp;element_id=[% batch_id | html %]";
             } else {
                 return; // abort delete
             }
             }
             var answer = confirm(msg);
             if (answer) {
-                window.location = "/cgi-bin/koha/patroncards/edit-batch.pl?op=remove&amp;batch_id=[% batch_id %]&amp;" + getstr;
+                window.location = "/cgi-bin/koha/patroncards/edit-batch.pl?op=remove&amp;batch_id=[% batch_id | html %]&amp;" + getstr;
             } else {
                 return; // abort delete
             }
         }
 
         function DeDuplicate() {
-            window.location = "/cgi-bin/koha/patroncards/edit-batch.pl?op=de_duplicate&amp;batch_id=[% batch_id %]";
+            window.location = "/cgi-bin/koha/patroncards/edit-batch.pl?op=de_duplicate&amp;batch_id=[% batch_id | html %]";
         };
         function Xport(mode) {
             if (mode == 'label') {
                     alert(_("Please select at least one card to export."));
                     return;     // no batch selected
                 }
-                return GB_showCenter(_("Export patron cards"), "/cgi-bin/koha/patroncards/print.pl?batch_id=[% batch_id %]&" + getstr, 400, 800);
+                return GB_showCenter(_("Export patron cards"), "/cgi-bin/koha/patroncards/print.pl?batch_id=[% batch_id | html %]&" + getstr, 400, 800);
             } else if (mode == 'batch') {
-                return GB_showCenter(_("Export patron cards"), "/cgi-bin/koha/patroncards/print.pl?batch_id=[% batch_id %]", 400, 800);
+                return GB_showCenter(_("Export patron cards"), "/cgi-bin/koha/patroncards/print.pl?batch_id=[% batch_id | html %]", 400, 800);
             } else {
                 // some pass-thru error trapping just in case...
             }
index ae14812..b93385b 100644 (file)
@@ -1,6 +1,6 @@
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Layout &rsaquo; [% IF ( layout_id ) %]Edit ([% layout_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Layout &rsaquo; [% IF ( layout_id ) %]Edit ([% layout_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +12,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/home.pl">Patron card creator</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/manage.pl?card_element=layout">Layouts</a> &rsaquo;
-        [% IF ( layout_id ) %]Edit ([% layout_id %])[% ELSE %]New[% END %]
+        [% IF ( layout_id ) %]Edit ([% layout_id | html %])[% ELSE %]New[% END %]
     </div>
     <div id="doc3" class="yui-t2">
         <div id="bd">
                                 <ol>
                                 <li>
                                     <label for="layout_name">Layout name: </label>
-                                    <input type="text" name="layout_name" id="layout_name" size="20" value="[% layout_name %]" />
+                                    <input type="text" name="layout_name" id="layout_name" size="20" value="[% layout_name | html %]" />
                                 </li>
                                 <li>
                                     <label for="units">Units: </label>
                                     <select id="units" name="units">
                                     [% FOREACH unit IN units %]
                                         [% IF ( unit.selected ) %]
-                                        <option value="[% unit.type %]" selected="selected">
+                                        <option value="[% unit.type | html %]" selected="selected">
                                         [% ELSE %]
-                                        <option value="[% unit.type %]">
+                                        <option value="[% unit.type | html %]">
                                         [% END %]
-                                        [% unit.desc %]
+                                        [% unit.desc | html %]
                                         </option>
                                     [% END %]
                                     </select>
                                             <ol>
                                             <li>
                                                 <label for="field_1_text">Text: </label>
-                                                <input type="text" name="field_1_text" id="field_1_text" size="60" value="[% field_1_text |html %]" />
+                                                <input type="text" name="field_1_text" id="field_1_text" size="60" value="[% field_1_text | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_1_font">Font: </label>
                                                 <select name="field_1_font" id="field_1_font">
                                                     [% FOREACH field_1_fon IN field_1_font %]
                                                     [% IF ( field_1_fon.selected ) %]
-                                                    <option value="[% field_1_fon.type %]" selected="selected">[% field_1_fon.name %]</option>
+                                                    <option value="[% field_1_fon.type | html %]" selected="selected">[% field_1_fon.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_1_fon.type %]">[% field_1_fon.name %]</option>
+                                                    <option value="[% field_1_fon.type | html %]">[% field_1_fon.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_1_font_size">Font size: </label>
-                                                <input type="text" name="field_1_font_size" id="field_1_font_size" size="2" value="[% field_1_font_size |html %]" />
+                                                <input type="text" name="field_1_font_size" id="field_1_font_size" size="2" value="[% field_1_font_size | html %]" />
                                                 <span class="font_unit"> pt</span>
                                             </li>
                                             <li>
                                                 <select name="field_1_text_alignment" id="field_1_text_alignment">
                                                     [% FOREACH field_1_text_alignmen IN field_1_text_alignment %]
                                                     [% IF ( field_1_text_alignmen.selected ) %]
-                                                    <option value="[% field_1_text_alignmen.type %]" selected="selected">[% field_1_text_alignmen.name %]</option>
+                                                    <option value="[% field_1_text_alignmen.type | html %]" selected="selected">[% field_1_text_alignmen.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_1_text_alignmen.type %]">[% field_1_text_alignmen.name %]</option>
+                                                    <option value="[% field_1_text_alignmen.type | html %]">[% field_1_text_alignmen.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_1_llx">Lower left X coordinate: </label>
-                                                <input type="text" name="field_1_llx" id="field_1_llx" size="2" value="[% field_1_llx |html %]" />
+                                                <input type="text" name="field_1_llx" id="field_1_llx" size="2" value="[% field_1_llx | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_1_lly">Lower left Y coordinate: </label>
-                                                <input type="text" name="field_1_lly" id="field_1_lly" size="2" value="[% field_1_lly |html %]" />
+                                                <input type="text" name="field_1_lly" id="field_1_lly" size="2" value="[% field_1_lly | html %]" />
                                             </li>
                                             </ol>
                                             </div>
                                             <ol>
                                             <li>
                                                 <label for="field_2_text">Text: </label>
-                                                <input type="text" name="field_2_text" id="field_2_text" size="60" value="[% field_2_text |html %]" />
+                                                <input type="text" name="field_2_text" id="field_2_text" size="60" value="[% field_2_text | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_2_font">Font: </label>
                                                 <select name="field_2_font" id="field_2_font">
                                                     [% FOREACH field_2_fon IN field_2_font %]
                                                     [% IF ( field_2_fon.selected ) %]
-                                                    <option value="[% field_2_fon.type %]" selected="selected">[% field_2_fon.name %]</option>
+                                                    <option value="[% field_2_fon.type | html %]" selected="selected">[% field_2_fon.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_2_fon.type %]">[% field_2_fon.name %]</option>
+                                                    <option value="[% field_2_fon.type | html %]">[% field_2_fon.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_2_font_size">Font size: </label>
-                                                <input type="text" name="field_2_font_size" id="field_2_font_size" size="2" value="[% field_2_font_size |html %]" />
+                                                <input type="text" name="field_2_font_size" id="field_2_font_size" size="2" value="[% field_2_font_size | html %]" />
                                                 <span class="font_unit"> pt</span>
                                             </li>
                                             <li>
                                                 <select name="field_2_text_alignment" id="field_2_text_alignment">
                                                     [% FOREACH field_2_text_alignmen IN field_2_text_alignment %]
                                                     [% IF ( field_2_text_alignmen.selected ) %]
-                                                    <option value="[% field_2_text_alignmen.type %]" selected="selected">[% field_2_text_alignmen.name %]</option>
+                                                    <option value="[% field_2_text_alignmen.type | html %]" selected="selected">[% field_2_text_alignmen.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_2_text_alignmen.type %]">[% field_2_text_alignmen.name %]</option>
+                                                    <option value="[% field_2_text_alignmen.type | html %]">[% field_2_text_alignmen.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_2_llx">Lower left X coordinate: </label>
-                                                <input type="text" name="field_2_llx" id="field_2_llx" size="2" value="[% field_2_llx |html %]" />
+                                                <input type="text" name="field_2_llx" id="field_2_llx" size="2" value="[% field_2_llx | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_2_lly">Lower left Y coordinate: </label>
-                                                <input type="text" name="field_2_lly" id="field_2_lly" size="2" value="[% field_2_lly |html %]" />
+                                                <input type="text" name="field_2_lly" id="field_2_lly" size="2" value="[% field_2_lly | html %]" />
                                             </li>
                                             </ol>
                                             </div>
                                             <ol>
                                             <li>
                                                 <label for="field_3_text">Text: </label>
-                                                <input type="text" name="field_3_text" id="field_3_text" size="60" value="[% field_3_text |html %]" />
+                                                <input type="text" name="field_3_text" id="field_3_text" size="60" value="[% field_3_text | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_3_font">Font: </label>
                                                 <select name="field_3_font" id="field_3_font">
                                                     [% FOREACH field_3_fon IN field_3_font %]
                                                     [% IF ( field_3_fon.selected ) %]
-                                                    <option value="[% field_3_fon.type %]" selected="selected">[% field_3_fon.name %]</option>
+                                                    <option value="[% field_3_fon.type | html %]" selected="selected">[% field_3_fon.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_3_fon.type %]">[% field_3_fon.name %]</option>
+                                                    <option value="[% field_3_fon.type | html %]">[% field_3_fon.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_3_font_size">Font size: </label>
-                                                <input type="text" name="field_3_font_size" id="field_3_font_size" size="2" value="[% field_3_font_size |html %]" />
+                                                <input type="text" name="field_3_font_size" id="field_3_font_size" size="2" value="[% field_3_font_size | html %]" />
                                                 <span class="font_unit"> pt</span>
                                             </li>
                                             <li>
                                                 <select name="field_3_text_alignment" id="field_3_text_alignment">
                                                     [% FOREACH field_3_text_alignmen IN field_3_text_alignment %]
                                                     [% IF ( field_3_text_alignmen.selected ) %]
-                                                    <option value="[% field_3_text_alignmen.type %]" selected="selected">[% field_3_text_alignmen.name %]</option>
+                                                    <option value="[% field_3_text_alignmen.type | html %]" selected="selected">[% field_3_text_alignmen.name | html %]</option>
                                                     [% ELSE %]
-                                                    <option value="[% field_3_text_alignmen.type %]">[% field_3_text_alignmen.name %]</option>
+                                                    <option value="[% field_3_text_alignmen.type | html %]">[% field_3_text_alignmen.name | html %]</option>
                                                     [% END %]
                                                     [% END %]
                                                 </select>
                                             </li>
                                             <li>
                                                 <label for="field_3_llx">Lower left X coordinate: </label>
-                                                <input type="text" name="field_3_llx" id="field_3_llx" size="2" value="[% field_3_llx |html %]" />
+                                                <input type="text" name="field_3_llx" id="field_3_llx" size="2" value="[% field_3_llx | html %]" />
                                             </li>
                                             <li>
                                                 <label for="field_3_lly">Lower left Y coordinate: </label>
-                                                <input type="text" name="field_3_lly" id="field_3_lly" size="2" value="[% field_3_lly |html %]" />
+                                                <input type="text" name="field_3_lly" id="field_3_lly" size="2" value="[% field_3_lly | html %]" />
                                             </li>
                                             </ol>
                                             </div>
                                 <ol>
                                 <li>
                                     <label for="barcode_llx">Lower left X coordinate: </label>
-                                    <input type="text" name="barcode_llx" id="barcode_llx" size="2" value="[% barcode_llx |html %]" />
+                                    <input type="text" name="barcode_llx" id="barcode_llx" size="2" value="[% barcode_llx | html %]" />
                                 </li>
                                 <li>
                                     <label for="barcode_lly">Lower left Y coordinate: </label>
-                                    <input type="text" name="barcode_lly" id="barcode_lly" size="2" value="[% barcode_lly |html %]" />
+                                    <input type="text" name="barcode_lly" id="barcode_lly" size="2" value="[% barcode_lly | html %]" />
                                 </li>
                                 <li>
                                     <label for="barcode_height_scale">Scale height (relative to card): </label>
-                                    <input type="text" name="barcode_height_scale" id="barcode_height_scale" size="2" value="[% barcode_height_scale |html %]" />
+                                    <input type="text" name="barcode_height_scale" id="barcode_height_scale" size="2" value="[% barcode_height_scale | html %]" />
                                 </li>
                                 <li>
                                     <label for="barcode_width_scale">Scale width (relative to card): </label>
-                                    <input type="text" name="barcode_width_scale" id="barcode_width_scale" size="2" value="[% barcode_width_scale |html %]" />
+                                    <input type="text" name="barcode_width_scale" id="barcode_width_scale" size="2" value="[% barcode_width_scale | html %]" />
                                 </li>
                                 <li>
                                     <label for="barcode_type">Barcode type: </label>
                                     <select name="barcode_type" id="barcode_type">
                                         [% FOREACH barcode_typ IN barcode_type %]
                                         [% IF ( barcode_typ.selected ) %]
-                                        <option value="[% barcode_typ.type %]" selected="selected">[% barcode_typ.name %]</option>
+                                        <option value="[% barcode_typ.type | html %]" selected="selected">[% barcode_typ.name | html %]</option>
                                         [% ELSE %]
-                                        <option value="[% barcode_typ.type %]">[% barcode_typ.name %]</option>
+                                        <option value="[% barcode_typ.type | html %]">[% barcode_typ.name | html %]</option>
                                         [% END %]
                                         [% END %]
                                     </select>
                                         <select name="image_1_image_source" id="image_1_image_source">
                                             [% FOREACH image_1_image_sourc IN image_1_image_source %]
                                             [% IF ( image_1_image_sourc.selected ) %]
-                                            <option value="[% image_1_image_sourc.type %]" selected="selected">[% image_1_image_sourc.name %]</option>
+                                            <option value="[% image_1_image_sourc.type | html %]" selected="selected">[% image_1_image_sourc.name | html %]</option>
                                             [% ELSE %]
-                                            <option value="[% image_1_image_sourc.type %]">[% image_1_image_sourc.name %]</option>
+                                            <option value="[% image_1_image_sourc.type | html %]">[% image_1_image_sourc.name | html %]</option>
                                             [% END %]
                                             [% END %]
                                         </select>
                                         <select name="image_1_image_name" id="image_1_image_name">
                                             [% FOREACH image_1_image_nam IN image_1_image_name %]
                                             [% IF ( image_1_image_nam.selected ) %]
-                                            <option value="[% image_1_image_nam.type %]" selected="selected">[% image_1_image_nam.name %]</option>
+                                            <option value="[% image_1_image_nam.type | html %]" selected="selected">[% image_1_image_nam.name | html %]</option>
                                             [% ELSE %]
-                                            <option value="[% image_1_image_nam.type %]">[% image_1_image_nam.name %]</option>
+                                            <option value="[% image_1_image_nam.type | html %]">[% image_1_image_nam.name | html %]</option>
                                             [% END %]
                                             [% END %]
                                         </select>
                                     <ol>
                                     <li>
                                         <label for="image_1_Dx">Display height: </label>
-                                        <input type="text" name="image_1_Dx" id="image_1_Dx" size="2" value="[% image_1_Dx |html %]" />
+                                        <input type="text" name="image_1_Dx" id="image_1_Dx" size="2" value="[% image_1_Dx | html %]" />
                                     </li>
                                     <li>
                                         <label for="image_1_Tx">Lower left X coordinate: </label>
-                                        <input type="text" name="image_1_Tx" id="image_1_Tx" size="2" value="[% image_1_Tx |html %]" />
+                                        <input type="text" name="image_1_Tx" id="image_1_Tx" size="2" value="[% image_1_Tx | html %]" />
                                     </li>
                                     <li>
                                         <label for="image_1_Ty">Lower left Y coordinate: </label>
-                                        <input type="text" name="image_1_Ty" id="image_1_Ty" size="2" value="[% image_1_Ty |html %]" />
+                                        <input type="text" name="image_1_Ty" id="image_1_Ty" size="2" value="[% image_1_Ty | html %]" />
                                     </li>
                                     </ol>
                                     </div>
                                         <select name="image_2_image_source" id="image_2_image_source">
                                             [% FOREACH image_2_image_sourc IN image_2_image_source %]
                                             [% IF ( image_2_image_sourc.selected ) %]
-                                            <option value="[% image_2_image_sourc.type %]" selected="selected">[% image_2_image_sourc.name %]</option>
+                                            <option value="[% image_2_image_sourc.type | html %]" selected="selected">[% image_2_image_sourc.name | html %]</option>
                                             [% ELSE %]
-                                            <option value="[% image_2_image_sourc.type %]">[% image_2_image_sourc.name %]</option>
+                                            <option value="[% image_2_image_sourc.type | html %]">[% image_2_image_sourc.name | html %]</option>
                                             [% END %]
                                             [% END %]
                                         </select>
                                         <select name="image_2_image_name" id="image_2_image_name">
                                             [% FOREACH image_2_image_nam IN image_2_image_name %]
                                             [% IF ( image_2_image_nam.selected ) %]
-                                            <option value="[% image_2_image_nam.type %]" selected="selected">[% image_2_image_nam.name %]</option>
+                                            <option value="[% image_2_image_nam.type | html %]" selected="selected">[% image_2_image_nam.name | html %]</option>
                                             [% ELSE %]
-                                            <option value="[% image_2_image_nam.type %]">[% image_2_image_nam.name %]</option>
+                                            <option value="[% image_2_image_nam.type | html %]">[% image_2_image_nam.name | html %]</option>
                                             [% END %]
                                             [% END %]
                                         </select>
                                     <ol>
                                     <li>
                                         <label for="image_2_Dx">Display height: </label>
-                                        <input type="text" name="image_2_Dx" id="image_2_Dx" size="2" value="[% image_2_Dx |html %]" />
+                                        <input type="text" name="image_2_Dx" id="image_2_Dx" size="2" value="[% image_2_Dx | html %]" />
                                     </li>
                                     <li>
                                         <label for="image_2_Tx">Lower left X coordinate: </label>
-                                        <input type="text" name="image_2_Tx" id="image_2_Tx" size="2" value="[% image_2_Tx |html %]" />
+                                        <input type="text" name="image_2_Tx" id="image_2_Tx" size="2" value="[% image_2_Tx | html %]" />
                                     </li>
                                     <li>
                                         <label for="image_2_Ty">Lower left Y coordinate: </label>
-                                        <input type="text" name="image_2_Ty" id="image_2_Ty" size="2" value="[% image_2_Ty |html %]" />
+                                        <input type="text" name="image_2_Ty" id="image_2_Ty" size="2" value="[% image_2_Ty | html %]" />
                                     </li>
                                     </ol>
                                     </div>
                         <input class="btn btn-default btn-default" type="submit" value="Save" />
                         <a class="cancel" href="/cgi-bin/koha/patroncards/manage.pl?card_element=layout">Cancel</a>
                         <input type="hidden" name="op" value="save" />
-                        <input type="hidden" name="layout_id" value="[% layout_id %]" />
+                        <input type="hidden" name="layout_id" value="[% layout_id | html %]" />
                     </fieldset>
                 </form>
                 </div>
index 2125101..0b5e8c9 100644 (file)
@@ -1,6 +1,6 @@
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Profiles &rsaquo; [% IF ( profile_id ) %]Edit ([% profile_id %])[% ELSE %]New[% END%]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Profiles &rsaquo; [% IF ( profile_id ) %]Edit ([% profile_id | html %])[% ELSE %]New[% END%]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +12,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/home.pl">Patron card creator</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/manage.pl?card_element=profile">Profiles</a> &rsaquo;
-        [% IF ( profile_id ) %]Edit ([% profile_id %])[% ELSE %]New[% END%]
+        [% IF ( profile_id ) %]Edit ([% profile_id | html %])[% ELSE %]New[% END%]
     </div>
     <div id="doc3" class="yui-t2">
         <div id="bd">
                         </div>
                     </div>
                         <div class="yui-g">
-                            <h3>[% IF (profile_id) %]Edit[% ELSE %]Create[% END%] printer profile[% IF (profile_id) %] ([% profile_id %])[% END %]</h3>
+                            <h3>[% IF (profile_id) %]Edit[% ELSE %]Create[% END%] printer profile[% IF (profile_id) %] ([% profile_id | html %])[% END %]</h3>
                                 <div class="yui-g first">
                                     <form name="input" action="/cgi-bin/koha/patroncards/edit-profile.pl" method="get">
                                     <fieldset class="rows"><legend>Profile settings</legend>
                                         <ol>
                                             <li>
                                                 [% IF ( profile_id ) %]
-                                                 <span class="label">Printer name:</span>[% printer_name %]
-                                                <input type="hidden" name="printer_name" value="[% printer_name %]" />
+                                                 <span class="label">Printer name:</span>[% printer_name | html %]
+                                                <input type="hidden" name="printer_name" value="[% printer_name | html %]" />
                                                 [% ELSE %]
                                                 <label for="printer_name">Printer name:</label><input type="text"  size="20" name="printer_name" id="printer_name" />
                                                 [% END %]
                                             </li>
                                             <li>
                                                 [% IF ( profile_id ) %]
-                                                <span class="label">Paper bin:</span> [% paper_bin %]
-                                                <input type="hidden" name="paper_bin" value="[% paper_bin %]" />
+                                                <span class="label">Paper bin:</span> [% paper_bin | html %]
+                                                <input type="hidden" name="paper_bin" value="[% paper_bin | html %]" />
                                                 [% ELSE %]
                                                 <label for="paper_bin">Paper bin:</label><input type="text"  size="20" name="paper_bin" id="paper_bin" />
                                                 [% END %]
                                             </li>
                                             <li>
                                                 [% IF ( label_template ) %]
-                                                 <label for="template_name">Template name:</label> [% label_template %]
+                                                 <label for="template_name">Template name:</label> [% label_template | html %]
                                                 [% ELSE %]
                                                  <span class="label">Template name:</span> Profile unassigned
                                                 [% END %]
                                                 <select id="units" name="units">
                                                     [% FOREACH unit IN units %]
                                                     [% IF ( unit.selected ) %]
-                                                    <option value="[% unit.type %]" selected="selected">
+                                                    <option value="[% unit.type | html %]" selected="selected">
                                                     [% ELSE %]
-                                                    <option value="[% unit.type %]">
+                                                    <option value="[% unit.type | html %]">
                                                     [% END %]
-                                                    [% unit.desc %]
+                                                    [% unit.desc | html %]
                                                     </option>
                                                     [% END %]
                                                 </select>
                                         <fieldset class="rows"><legend>Offset:</legend>
                                         <ol>
                                             <li>
-                                                <label for="offset_horz">Horizontal: </label><input type="text"  size="4" name="offset_horz" id="offset_horz" value="[% offset_horz %]" />
+                                                <label for="offset_horz">Horizontal: </label><input type="text"  size="4" name="offset_horz" id="offset_horz" value="[% offset_horz | html %]" />
                                             </li>
                                             <li>
-                                                <label for="offset_vert">Vertical: </label><input type="text" size="4" name="offset_vert" id="offset_vert" value="[% offset_vert %]" />
+                                                <label for="offset_vert">Vertical: </label><input type="text" size="4" name="offset_vert" id="offset_vert" value="[% offset_vert | html %]" />
                                             </li>
                                          </ol>
                                         </fieldset>
                                         <fieldset class="rows"><legend>Creep:</legend>
                                         <ol>
                                             <li>
-                                                <label for="creep_horz">Horizontal: </label><input type="text"  size="4" name="creep_horz" id="creep_horz" value="[% creep_horz %]" />
+                                                <label for="creep_horz">Horizontal: </label><input type="text"  size="4" name="creep_horz" id="creep_horz" value="[% creep_horz | html %]" />
                                             </li>
                                             <li>
-                                                <label for="creep_vert">Vertical: </label><input type="text" size="4" name="creep_vert" id="creep_vert" value="[% creep_vert %]" />
+                                                <label for="creep_vert">Vertical: </label><input type="text" size="4" name="creep_vert" id="creep_vert" value="[% creep_vert | html %]" />
                                             </li>
                                         </ol>
                                     </fieldset>
@@ -95,7 +95,7 @@
                                         <input type="submit" value="Save" />
                                         <a href="/cgi-bin/koha/patroncards/manage.pl?card_element=profile" class="cancel">Cancel</a>
                                         <input type="hidden" name="op" value="save" />
-                                        <input type="hidden" name="profile_id" value="[% profile_id %]" />
+                                        <input type="hidden" name="profile_id" value="[% profile_id | html %]" />
                                     </fieldset>
                     </form>
                                 </div>
index 3fa08fc..b561bbd 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Templates &rsaquo; [% IF (template_id) %]Edit ([% template_id %])[% ELSE %]New[% END %]</title>
+    <title>Koha &rsaquo; Tools &rsaquo; Patron card creator &rsaquo; Templates &rsaquo; [% IF (template_id) %]Edit ([% template_id | html %])[% ELSE %]New[% END %]</title>
     [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -13,7 +14,7 @@
         <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/home.pl">Patron card creator</a> &rsaquo;
         <a href="/cgi-bin/koha/patroncards/manage.pl?card_element=template">Templates</a> &rsaquo;
-        [% IF (template_id) %]Edit ([% template_id %])[% ELSE %]New[% END %]
+        [% IF (template_id) %]Edit ([% template_id | html %])[% ELSE %]New[% END %]
     </div>
     <div id="doc3" class="yui-t2">
         <div id="bd">
                     </div>
                     <form name="input" action="/cgi-bin/koha/patroncards/edit-template.pl" method="get">
                     <div class="yui-g">
-                        <h3>[% IF (template_id) %]Edit[% ELSE %]Create[% END %] patron card template[% IF (template_id) %] ([% template_id %])[% END %]</h3>
+                        <h3>[% IF (template_id) %]Edit[% ELSE %]Create[% END %] patron card template[% IF (template_id) %] ([% template_id | html %])[% END %]</h3>
                         <div class="yui-u first">
                             <fieldset class="rows">
                                 <ol>
                                     <li>
-                                        <span class="label">Template ID:</span>[% IF ( template_id ) %][% template_id %][% ELSE %]N/A[% END %]
+                                        <span class="label">Template ID:</span>[% IF ( template_id ) %][% template_id | html %][% ELSE %]N/A[% END %]
                                     </li>
                                     <li>
                                         <label for="template_code">Template code:</label>
-                                        <input type="text" size="30" maxlength="43" name="template_code" id="template_code" value="[% template_code %]" />
+                                        <input type="text" size="30" maxlength="43" name="template_code" id="template_code" value="[% template_code | html %]" />
                                     </li>
                                     <li>
                                         <label for="template_desc">Template description:</label>
-                                        <textarea cols="30" rows="3" id="template_desc" name="template_desc">[% template_desc %]</textarea>
+                                        <textarea cols="30" rows="3" id="template_desc" name="template_desc">[% template_desc | html %]</textarea>
                                     </li>
                                     <li>
                                         <label for="units">Units:</label>
@@ -48,9 +49,9 @@
                                         [% FOREACH unit IN units %]
 
                                             [% IF ( unit.selected ) %]
-                                            <option value="[% unit.type %]" selected="selected">
+                                            <option value="[% unit.type | html %]" selected="selected">
                                             [% ELSE %]
-                                            <option value="[% unit.type %]">
+                                            <option value="[% unit.type | html %]">
                                             [% END %]
 
                                             [% SWITCH unit.type %]
                                     </li>
                                     <li>
                                         <label for="page_height">Page height:</label>
-                                        <input type="text" size="4" name="page_height" id="page_height" value="[% page_height %]" />
+                                        <input type="text" size="4" name="page_height" id="page_height" value="[% page_height | html %]" />
                                     </li>
                                     <li>
                                         <label for="page_width">Page width:</label>
-                                        <input type="text" size="4" name="page_width" id="page_width" value="[% page_width %]" />
+                                        <input type="text" size="4" name="page_width" id="page_width" value="[% page_width | html %]" />
                                     </li>
                                     <li>
                                         <label for="card_height">Card height:</label>
-                                        <input type="text" size="4" name="card_height" id="card_height" value="[% card_height %]" />
+                                        <input type="text" size="4" name="card_height" id="card_height" value="[% card_height | html %]" />
                                     </li>
                                     <li>
                                         <label for="card_width">Card width:</label>
-                                        <input type="text" size="4" name="card_width" id="card_width" value="[% card_width %]" />
+                                        <input type="text" size="4" name="card_width" id="card_width" value="[% card_width | html %]" />
                                     </li>
 
 
                             <fieldset class="rows">
                                 <ol><li>
                                     <label for="top_margin">Top page margin:</label>
-                                    <input type="text" size="4" name="top_margin" id="top_margin" value="[% top_margin %]" />
+                                    <input type="text" size="4" name="top_margin" id="top_margin" value="[% top_margin | html %]" />
                                 </li>
                                 <li>
                                     <label for="left_margin">Left page margin:</label>
-                                    <input type="text" size="4" name="left_margin" id="left_margin" value="[% left_margin %]" />
+                                    <input type="text" size="4" name="left_margin" id="left_margin" value="[% left_margin | html %]" />
                                 </li>
                                     <li>
                                         <label for="cols">Number of columns:</label>
-                                        <input type="text" size="4" name="cols" id="cols" value="[% cols %]" />
+                                        <input type="text" size="4" name="cols" id="cols" value="[% cols | html %]" />
                                     </li>
                                     <li>
                                         <label for="rows">Number of rows:</label>
-                                        <input type="text" size="4" name="rows" id="rows" value="[% rows %]" />
+                                        <input type="text" size="4" name="rows" id="rows" value="[% rows | html %]" />
                                     </li>
                                     <li>
                                         <label for="col_gap">Gap between columns:</label>
-                                        <input type="text" size="4" name="col_gap" id="col_gap" value="[% col_gap %]" />
+                                        <input type="text" size="4" name="col_gap" id="col_gap" value="[% col_gap | html %]" />
                                     </li>
                                     <li>
                                         <label for="row_gap">Gap between rows:</label>
-                                        <input type="text" size="4" name="row_gap" id="row_gap" value="[% row_gap %]" />
+                                        <input type="text" size="4" name="row_gap" id="row_gap" value="[% row_gap | html %]" />
                                     </li>
 
                                     <li>
                                         <select id="profile_id" name="profile_id">
                                         [% FOREACH profile_lis IN profile_list %]
                                         [% IF ( profile_lis.selected ) %]
-                                        <option value="[% profile_lis.profile_id %]" selected="selected">
+                                        <option value="[% profile_lis.profile_id | html %]" selected="selected">
                                         [% ELSE %]
-                                        <option value="[% profile_lis.profile_id %]">
+                                        <option value="[% profile_lis.profile_id | html %]">
                                         [% END %]
-                                        [% profile_lis.printer_name %]/[% profile_lis.paper_bin %]
+                                        [% profile_lis.printer_name | html %]/[% profile_lis.paper_bin | html %]
                                         </option>
                                         [% END %]
                                         </select>
                             <a class="cancel" href="/cgi-bin/koha/patroncards/manage.pl?card_element=template">Cancel</a>
                             <input type="hidden" name="op" value="save" />
                             [% IF ( template_id ) %]
-                            <input type="hidden" name="template_id" value="[% template_id %]" />
+                            <input type="hidden" name="template_id" value="[% template_id | html %]" />
                             [% END %]
                         </fieldset>
                     </div>
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script>
         $(document).ready(function(){
             var selectedUnit = $("#units option:selected").attr("value");
index 7edb249..fc9bed9 100644 (file)
@@ -56,8 +56,8 @@
                                 [% IF ( IMPORT_SUCCESSFUL ) %]
                                     <div class="dialog message">
                                     <h3>Image successfully uploaded</h3>
-                                    <ul><li>File: [% SOURCE_FILE %]</li>
-                                    <li>Image name: [% IMAGE_NAME %]</li></ul>
+                                    <ul><li>File: [% SOURCE_FILE | html %]</li>
+                                    <li>Image name: [% IMAGE_NAME | html %]</li></ul>
                                     </div>
                                 [% END %]
                             </fieldset>
@@ -87,7 +87,7 @@
                                         [% CASE " " %]
                                             <th>Delete</th>
                                         [% CASE %]
-                                           <th>[% header_field.field_label %]</th>
+                                           <th>[% header_field.field_label | html %]</th>
                                     [% END %]
                                     [% END %]
                                     </tr>
                                     [% FOREACH text_field IN TABL.text_fields %]
                                     [% IF ( text_field.select_field ) %]
                                         <td>
-                                            <a class="delete_image btn btn-default btn-xs" href="/cgi-bin/koha/patroncards/image-manage.pl?op=delete&image_id=[% text_field.field_value %]"><i class="fa fa-trash"></i> Delete</a>
+                                            <a class="delete_image btn btn-default btn-xs" href="/cgi-bin/koha/patroncards/image-manage.pl?op=delete&image_id=[% text_field.field_value | html %]"><i class="fa fa-trash"></i> Delete</a>
                                         </td>
-                                        <td align="center"><input type="checkbox" name="action" value="[% text_field.field_value %]" /></td>
+                                        <td align="center"><input type="checkbox" name="action" value="[% text_field.field_value | html %]" /></td>
                                     [% ELSIF ( text_field.field_value ) %]
-                                        <td>[% text_field.field_value %]</td>
+                                        <td>[% text_field.field_value | html %]</td>
                                     [% ELSE %]
                                         <td>&nbsp;</td>
                                     [% END %]
index 8136394..6bd66b3 100644 (file)
@@ -44,9 +44,9 @@
                     [% INCLUDE 'patroncards-errors.inc' %]
                     <div class="yui-gc">
                         <div class="yui-u first" id="manage-patroncards-layouts">
-                            <div class="hint">Current library: [% LoginBranchname %]</div>
+                            <div class="hint">Current library: [% LoginBranchname | html %]</div>
                             [% IF ( table_loop ) %]
-                            <form name="layouts" action="/cgi-bin/koha/manage.pl?card_element=[% card_element %]">
+                            <form name="layouts" action="/cgi-bin/koha/manage.pl?card_element=[% card_element | html %]">
                             <h2>Currently available [% PROCESS translate_card_element element=card_element_title FILTER lower %]</h2>
                             <table>
                                 [% FOREACH table_loo IN table_loop %]
@@ -67,7 +67,7 @@
                                         [%-  CASE 'Paper Bin'     -%]<th>Paper bin</th>
                                         [%-  CASE 'Batch ID'      -%]<th>Batch ID</th>
                                         [%-  CASE 'Patron Count'  -%]<th>Patron count</th>
-                                        [%-  CASE                 -%]<th>[% header_field.field_label %]</th>
+                                        [%-  CASE                 -%]<th>[% header_field.field_label | html %]</th>
                                     [% END -%]
                                 [% END %]
                                 </tr>
                                 [% FOREACH text_field IN table_loo.text_fields %]
                                 [% IF ( text_field.select_field ) %]
                                     <td>
-                                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/patroncards/edit-[% card_element %].pl?op=edit&element_id=[% text_field.field_value %]"><i class="fa fa-edit"></i> Edit</a>
+                                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/patroncards/edit-[% card_element | html %].pl?op=edit&element_id=[% text_field.field_value | html %]"><i class="fa fa-edit"></i> Edit</a>
                                       [% IF ( print ) %]<a class="btn btn-default btn-xs export" data-batch-id="[% text_field.field_value |url %]" href="/cgi-bin/koha/patroncards/print.pl?batch_id=[% text_field.field_value |url %]"><i class="fa fa-share-square-o"></i> Export</a>[% END %]
-                                      <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/patroncards/manage.pl?op=delete&card_element=[% card_element %]&element_id=[% text_field.field_value %]"><i class="fa fa-trash"></i> Delete</a>
+                                      <a class="btn btn-default btn-xs delete" href="/cgi-bin/koha/patroncards/manage.pl?op=delete&card_element=[% card_element | html %]&element_id=[% text_field.field_value | html %]"><i class="fa fa-trash"></i> Delete</a>
                                     </td>
-                                    [% IF ( print ) %]<td><input type="checkbox" name="action" value="[% text_field.field_value %]" /></td>[% END %]
+                                    [% IF ( print ) %]<td><input type="checkbox" name="action" value="[% text_field.field_value | html %]" /></td>[% END %]
                                 [% ELSIF ( text_field.field_value ) %]
-                                    <td>[% text_field.field_value %]</td>
+                                    <td>[% text_field.field_value | html %]</td>
                                 [% ELSE %]
                                     <td>&nbsp;</td>
                                 [% END %]
                                         <select id="patron_list_id" name="patron_list_id">
                                             <option value=""></option>
                                             [% FOREACH pl IN patron_lists %]
-                                                <option value="[% pl.patron_list_id %]">[% pl.name %]</option>
+                                                <option value="[% pl.patron_list_id | html %]">[% pl.name | html %]</option>
                                             [% END %]
                                         </select>
                                     </li>
                     }
                 }
 
-                window.location = "/cgi-bin/koha/patroncards/manage.pl?op=delete&card_element=[% card_element %]&element_id=" + elements;
+                window.location = "/cgi-bin/koha/patroncards/manage.pl?op=delete&card_element=[% card_element | html %]&element_id=" + elements;
             }
             else {
                 return; // abort delete
         function Edit() {
             var element_id = selected_layouts("edit");
             if (element_id>-1) {
-                window.location = "/cgi-bin/koha/patroncards/edit-[% card_element %].pl?op=edit&element_id=" + element_id;
+                window.location = "/cgi-bin/koha/patroncards/edit-[% card_element | html %].pl?op=edit&element_id=" + element_id;
             }
             else {
                 return;     // no layout selected
index 3d7a30b..c27c004 100644 (file)
                     <fieldset>
                     [% FOREACH batche IN batches %]
                         [% IF ( batche.label_ids ) %]
-                        <legend>[% batche.card_count %] Single patron cards</legend>
+                        <legend>[% batche.card_count | html %] Single patron cards</legend>
                         <p>
-                                <a class="document pdf" href="/cgi-bin/koha/patroncards/[% batche.create_script %]?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]]&amp;layout_back_id=[% batche.layout_back_id %]&amp;start_card=[% batche.start_card %][% batche.label_ids %]">label_single_[% batche.card_count %].pdf</a>
+                                <a class="document pdf" href="/cgi-bin/koha/patroncards/[% batche.create_script | html %]?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]]&amp;layout_back_id=[% batche.layout_back_id | html %]&amp;start_card=[% batche.start_card | html %][% batche.label_ids | html %]">label_single_[% batche.card_count | html %].pdf</a>
                         </p>
                         [% ELSIF ( batche.borrower_numbers ) %]
-                        <legend>[% batche.card_count %] Single Patron Cards</legend>
+                        <legend>[% batche.card_count | html %] Single Patron Cards</legend>
                         <p>
-                                <a class="document pdf" href="/cgi-bin/koha/patroncards/[% batche.create_script %]?template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]&amp;layout_back_id=[% batche.layout_back_id %]&amp;start_card=[% batche.start_card %][% batche.borrower_numbers %]">label_single_[% batche.card_count %].pdf</a>
+                                <a class="document pdf" href="/cgi-bin/koha/patroncards/[% batche.create_script | html %]?template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]&amp;layout_back_id=[% batche.layout_back_id | html %]&amp;start_card=[% batche.start_card | html %][% batche.borrower_numbers | html %]">label_single_[% batche.card_count | html %].pdf</a>
                         </p>
                         [% ELSE %]
-                        <legend>Card batch number [% batche.batch_id %]</legend>
+                        <legend>Card batch number [% batche.batch_id | html %]</legend>
                         <p>
-                                <a class="document pdf" href="/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=[% batche.batch_id %]&amp;template_id=[% batche.template_id %]&amp;layout_id=[% batche.layout_id %]&amp;layout_back_id=[% batche.layout_back_id %]&amp;start_card=[% batche.start_card %]">label_batch_[% batche.batch_id %].pdf</a>
+                                <a class="document pdf" href="/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=[% batche.batch_id | html %]&amp;template_id=[% batche.template_id | html %]&amp;layout_id=[% batche.layout_id | html %]&amp;layout_back_id=[% batche.layout_back_id | html %]&amp;start_card=[% batche.start_card | html %]">label_batch_[% batche.batch_id | html %].pdf</a>
                         </p>
                         [% END %]
                     [% END %]
             [% ELSIF ( patronlist_id && template_id && layout_id ) %]
                 <h3>Click on the link to download the patron cards from the patron list.</h3>
                     <p>
-                        <a class="document pdf" href="/cgi-bin/koha/patroncards/create-pdf.pl?patronlist_id=[% patronlist_id %]&amp;template_id=[% template_id %]&amp;layout_id=[% layout_id %]&amp;layout_back_id=[% layout_back_id %]&amp;start_card=[% start_card %]">label_patronlist_[% patronlist_id %].pdf</a>
+                        <a class="document pdf" href="/cgi-bin/koha/patroncards/create-pdf.pl?patronlist_id=[% patronlist_id | html %]&amp;template_id=[% template_id | html %]&amp;layout_id=[% layout_id | html %]&amp;layout_back_id=[% layout_back_id | html %]&amp;start_card=[% start_card | html %]">label_patronlist_[% patronlist_id | html %].pdf</a>
                     </p>
             [% ELSE %]
             <h3>
                     [% IF ( label_ids ) %]
-                        [% IF ( card_count == 1 ) %]Exporting [% card_count %] patron card[% ELSE %]Exporting [% card_count %] patron cards[% END %]
+                        [% IF ( card_count == 1 ) %]Exporting [% card_count | html %] patron card[% ELSE %]Exporting [% card_count | html %] patron cards[% END %]
                     [% ELSIF ( borrower_numbers ) %]
-                        [% IF ( borrower_count == 1 ) %]Exporting [% borrower_count %] patron card[% ELSE %]Exporting [% borrower_count %] patron cards[% END %]
+                        [% IF ( borrower_count == 1 ) %]Exporting [% borrower_count | html %] patron card[% ELSE %]Exporting [% borrower_count | html %] patron cards[% END %]
                     [% ELSIF ( patronlist_id ) %] Exporting from patron list
                     [% ELSE %]
-                        [% IF ( multi_batch_count == 1 ) %][% multi_batch_count %] batch to export[% ELSE %][% multi_batch_count %] batches to export[% END %]
+                        [% IF ( multi_batch_count == 1 ) %][% multi_batch_count | html %] batch to export[% ELSE %][% multi_batch_count | html %] batches to export[% END %]
                     [% END %]
             </h3>
             <form id="exportingf" name="exporting" method="post" action="/cgi-bin/koha/patroncards/print.pl">
                 <input type="hidden" name="op" value="export" />
-                <input type="hidden" name="referer" value="[% referer %]" />
+                <input type="hidden" name="referer" value="[% referer | html %]" />
                 [% FOREACH batch_id IN batch_ids %]
-                    <input type="hidden" name="batch_id" value="[% batch_id.batch_id %]" />
+                    <input type="hidden" name="batch_id" value="[% batch_id.batch_id | html %]" />
                 [% END %]
                 [% FOREACH label_id IN label_ids %]
-                    <input type="hidden" name="label_id" value="[% label_id.label_id %]" />
+                    <input type="hidden" name="label_id" value="[% label_id.label_id | html %]" />
                 [% END %]
                 [% FOREACH borrower_number IN borrower_numbers %]
-                    <input type="hidden" name="borrower_number" value="[% borrower_number.borrower_number %]" />
+                    <input type="hidden" name="borrower_number" value="[% borrower_number.borrower_number | html %]" />
                 [% END %]
-                [% IF (patronlist_id) %] <input type="hidden" name="patronlist_id" value="[% patronlist_id %]" /> [% END %]
+                [% IF (patronlist_id) %] <input type="hidden" name="patronlist_id" value="[% patronlist_id | html %]" /> [% END %]
                 <fieldset class="rows">
                     <ol>
                         <li>
                             <label style="width:9em" for="template_id">Select a template to be applied: </label>
                             <select name="template_id" id="template_id">
                                 [% FOREACH template IN templates %]
-                                <option value="[% template.template_id %]">[% template.template_code %]</option>
+                                <option value="[% template.template_id | html %]">[% template.template_code | html %]</option>
                                 [% END %]
                             </select>
                         </li>
@@ -78,7 +78,7 @@
                             <label style="width:9em" for="layout_id">Select a layout to be applied: </label>
                             <select name="layout_id" id="layout_id">
                                 [% FOREACH layout IN layouts %]
-                                <option value="[% layout.layout_id %]">[% layout.layout_name %]</option>
+                                <option value="[% layout.layout_id | html %]">[% layout.layout_name | html %]</option>
                                 [% END %]
                             </select>
                         </li>
@@ -87,7 +87,7 @@
                             <select name="layout_back_id" id="layout_back_id">
                                 <option value="0">Back side layout not used</option>
                                 [% FOREACH layout IN layouts %]
-                                <option value="[% layout.layout_id %]">[% layout.layout_name %]</option>
+                                <option value="[% layout.layout_id | html %]">[% layout.layout_name | html %]</option>
                                 [% END %]
                             </select>
                             <span class="hint">Used for duplex printers (needs a '1 up template')</span>
     [% INCLUDE 'greybox.inc' %]
     <script>
         function Done() {
-            window.location = "[% referer %]";
+            window.location = "[% referer | html %]";
         };
         $(document).ready(function(){
             $(".gb-close").on("click",function(){
index 61c34d0..3ff9547 100644 (file)
@@ -1,25 +1,25 @@
 [% USE To %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 "dt_cardnumber":
-                    "[% data.cardnumber %]",
+                    "[% data.cardnumber | html %]",
                 "dt_name":
-                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
+                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
                 "dt_category":
-                    "[% data.category_description |html %] ([% data.category_type |html %])",
+                    "[% data.category_description | html %] ([% data.category_type | html %])",
                 "dt_branch":
-                    "[% data.branchname |html %]",
+                    "[% data.branchname | html %]",
                 "dt_dateexpiry":
-                    "[% data.dateexpiry %]",
+                    "[% data.dateexpiry | html %]",
                 "dt_borrowernotes":
-                    "[% data.borrowernotes.replace('\\\\' , '\\\\') |html |html_line_break |collapse %]",
+                    "[% data.borrowernotes.replace('\\\\' , '\\\\') |html_line_break |collapse %]",
                 "dt_action":
-                    "<a href=\"#\" data-borrowernumber=\"[% data.borrowernumber %]\" data-firstname=\"[% data.firstname %]\" data-surname=\"[% data.surname %]\" class=\"btn btn-default btn-xs add_user\"><i class=\"fa fa-plus\"></i> Add</a>"
+                    "<a href=\"#\" data-borrowernumber=\"[% data.borrowernumber | html %]\" data-firstname=\"[% data.firstname | html %]\" data-surname=\"[% data.surname | html %]\" class=\"btn btn-default btn-xs add_user\"><i class=\"fa fa-plus\"></i> Add</a>"
             }[% UNLESS loop.last %],[% END %]
         [% END %]
     ]
index ee9c1a0..305f3eb 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
@@ -52,7 +53,7 @@
                             [% ELSIF method == 'opac_online_payment' %]
                                 <div class="dialog message">No plugins that can process online payments via the public catalog are installed</div>
                             [% ELSE %]
-                                <div class="dialog message">Unknown plugin type <i>[% method %]</i></div>
+                                <div class="dialog message">Unknown plugin type <i>[% method | html %]</i></div>
                             [% END %]
                         [% END %]
                     [% ELSE %]
@@ -72,9 +73,9 @@
 
                             [% FOREACH plugin IN plugins %]
                                 <tr>
-                                    <td><strong>[% plugin.metadata.name %]</strong></td>
+                                    <td><strong>[% plugin.metadata.name | html %]</strong></td>
                                     <td>
-                                        [% plugin.metadata.description %]
+                                        [% plugin.metadata.description | html %]
 
                                         [% IF ( plugin.metadata.minimum_version && koha_version < plugin.metadata.minimum_version ) %]
                                             <div class="error">Warning: This report was written for a newer version of Koha. Run at your own risk.</div>
                                             <div class="error">Warning: This report was written for an older version of Koha. Run at your own risk.</div>
                                         [% END %]
                                     </td>
-                                    <td>[% plugin.metadata.author %]</td>
-                                    <td>[% plugin.metadata.version %]</td>
-                                    <td>[% plugin.metadata.minimum_version %]</td>
-                                    <td>[% plugin.metadata.maximum_version %]</td>
+                                    <td>[% plugin.metadata.author | html %]</td>
+                                    <td>[% plugin.metadata.version | html %]</td>
+                                    <td>[% plugin.metadata.minimum_version | html %]</td>
+                                    <td>[% plugin.metadata.maximum_version | html %]</td>
                                     <td>[% plugin.metadata.date_updated | $KohaDates %]</td>
                                     [% IF ( CAN_user_plugins_configure || CAN_user_plugins_manage || CAN_user_plugins_report || CAN_user_plugins_tool ) %]
                                         <td class="actions">
                                             <div class="dropdown">
-                                                <a class="btn btn-default btn-xs dropdown-toggle" id="pluginactions[% plugin.class %]" role="button" data-toggle="dropdown" href="#">
+                                                <a class="btn btn-default btn-xs dropdown-toggle" id="pluginactions[% plugin.class | html %]" role="button" data-toggle="dropdown" href="#">
                                                    Actions <b class="caret"></b>
                                                 </a>
-                                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="pluginactions[% plugin.class %]">
+                                                <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="pluginactions[% plugin.class | html %]">
                                                     [% IF ( CAN_user_plugins_report ) %]
                                                         [% IF plugin.can('report') %]
-                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class %]&method=report"><i class="fa fa-table"></i> Run report</a></li>
+                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class | html %]&method=report"><i class="fa fa-table"></i> Run report</a></li>
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( CAN_user_plugins_tool ) %]
                                                         [% IF plugin.can('tool') %]
-                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class %]&method=tool"><i class="fa fa-wrench"></i> Run tool</a></li>
+                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class | html %]&method=tool"><i class="fa fa-wrench"></i> Run tool</a></li>
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( CAN_user_plugins_configure ) %]
                                                         [% IF plugin.can('configure') %]
-                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class %]&method=configure"><i class="fa fa-cog"></i> Configure</a></li>
+                                                            <li><a href="/cgi-bin/koha/plugins/run.pl?class=[% plugin.class | html %]&method=configure"><i class="fa fa-cog"></i> Configure</a></li>
                                                         [% END %]
                                                     [% END %]
                                                     [% IF ( CAN_user_plugins_manage ) %]
-                                                            <li><a class="uninstall_plugin" data-plugin-name="[% plugin.metadata.name %]" href="/cgi-bin/koha/plugins/plugins-uninstall.pl?class=[% plugin.class %]"><i class="fa fa-trash"></i> Uninstall</a></li>
+                                                            <li><a class="uninstall_plugin" data-plugin-name="[% plugin.metadata.name | html %]" href="/cgi-bin/koha/plugins/plugins-uninstall.pl?class=[% plugin.class | html %]"><i class="fa fa-trash"></i> Uninstall</a></li>
                                                     [% END %]
                                                 </ul>
                                             </div>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
index 057e9ac..06daeb5 100644 (file)
@@ -25,9 +25,9 @@
                         [% IF ( ERROR.NOTKPZ ) %]<li><b>The upload file does not appear to be a kpz file.  The extension is not '.kpz'.</b></li>
                         [% ELSIF ( ERROR.NOWRITETEMP ) %]<li><b>This script is not able to create/write to the necessary temporary directory.</b></li>
                         [% ELSIF ( ERROR.EMPTYUPLOAD ) %]<li><b>The upload file appears to be empty.</b></li>
-                        [% ELSIF ( ERROR.UZIPFAIL ) %]<li><b>[% ERROR.UZIPFAIL %] failed to unpack.<br />Please verify the integrity of the zip file and retry.</b></li>
+                        [% ELSIF ( ERROR.UZIPFAIL ) %]<li><b>[% ERROR.UZIPFAIL | html %] failed to unpack.<br />Please verify the integrity of the zip file and retry.</b></li>
                         [% ELSIF ( ERROR.NOWRITEPLUGINS ) %]<li><b>Cannot unpack file to the plugins directory.<br />Please verify that the Apache user can write to the plugins directory.</b></li>
-                        [% ELSE %]<li><b>[% ERROR.CORERR %] An unknown error has occurred.<br />Please review the error log for more details.</b></li>[% END %]
+                        [% ELSE %]<li><b>[% ERROR.CORERR | html %] An unknown error has occurred.<br />Please review the error log for more details.</b></li>[% END %]
                     [% END %]
                 </div>
                 [% END %]
index 4e5c916..c9c00a3 100644 (file)
                         [% CASE '10' %] Sort2
                         [% CASE %] Unknown filter
                     [% END %]
-                    : [% loopfilte.filter %]
+                    : [% loopfilte.filter | html %]
                 </p>
                        [% END %]
                [% END %]
 
                <table>
                        <tr >
-                               <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                               <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th>[% loopco.coltitle %]</th>
+                                       <th>[% loopco.coltitle | html %]</th>
                                [% END %]
                                <th>TOTAL</th>
                        </tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                                        <tr>
                                                [% IF ( loopro.hilighted ) %]<td class="hilighted">[% ELSE %]<td>[% END %]
-                                               [% loopro.rowtitle %]</td>
+                                               [% loopro.rowtitle | html %]</td>
                                                [% FOREACH loopcel IN loopro.loopcell %]
                                                        [% IF ( loopcel.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                               [% IF ( loopcel.value ) %][% loopcel.value %]
+                                                               [% IF ( loopcel.value ) %][% loopcel.value | html %]
                                                                [% ELSE %] &nbsp;
                                                                [% END %]
                                                        </td>
                                                [% END %]
                                                [% IF ( loopro.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                       [% loopro.totalrow %]
+                                                       [% loopro.totalrow | html %]
                                                </td>
                                        </tr>
                                [% END %]
                                        <th>TOTAL</th>
                                        [% FOREACH loopfoote IN mainloo.loopfooter %]
                                                <th>
-                                                       [% loopfoote.totalcol %]
+                                                       [% loopfoote.totalcol | html %]
                                                </th>
                                        [% END %]
-                                       <th>[% mainloo.total %]</th>
+                                       <th>[% mainloo.total | html %]</th>
                                </tr>
                </table>
        [% END %]
                     <select name="Filter">
                         <option value="">All vendors</option>
                         [% FOREACH bookseller IN booksellers %]
-                            <option value="[% bookseller.name %]">[% bookseller.name %]</option>
+                            <option value="[% bookseller.name | html %]">[% bookseller.name | html %]</option>
                         [% END %]
                     </select>
                 </td>
                     <select name="Filter">
                         <option value="" selected="selected">All libraries</option>
                         [% FOREACH branch IN branches %]
-                            <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+                            <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                         [% END %]
                     </select>
                 </td>
             <tr>
                 <td>
                     [% IF ccode_label %]
-                        [% ccode_label %]
+                        [% ccode_label | html %]
                     [% ELSE %]
                         Collection
                     [% END %]
                         <select name="Filter">
                             <option value="" selected="selected">All</option>
                             [% FOREACH ccode_av IN ccode_avlist %]
-                                <option value="[% ccode_av.value %]">[% ccode_av.lib %]</option>
+                                <option value="[% ccode_av.value | html %]">[% ccode_av.lib | html %]</option>
                             [% END %]
                         </select>
                     [% ELSE %]
                     <select name="Filter" size="1" id="itemtypes">
                         <option value="">All item types</option>
                         [% FOREACH itemtype IN itemtypes %]
-                        <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+                        <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                         [% END %]
                     </select>
                 </td>
                     <select name="Filter" size="1" id="budget">
                         <option value="">All funds</option>
                         [% FOREACH value IN Budgets.values %]
-                        <option value="[% value %]">[% Budgets.labels.$value %]</option>
+                        <option value="[% value | html %]">[% Budgets.labels.$value | html %]</option>
                         [% END %]
                     </select>
                 </td>
                         <select name="Filter" size="1" id="sort1">
                             <option value="">All</option>
                             [% FOREACH value IN Sort1.values %]
-                            <option value="[% value %]">[% Sort1.labels.$value %]</option>
+                            <option value="[% value | html %]">[% Sort1.labels.$value | html %]</option>
                             [% END %]
                         </select>
                     </td>
                         <select name="Filter" size="1" id="sort2">
                             <option value="">All</option>
                             [% FOREACH value IN Sort2.values %]
-                            <option value="[% value %]">[% Sort2.labels.$value %]</option>
+                            <option value="[% value | html %]">[% Sort2.labels.$value | html %]</option>
                             [% END %]
                         </select>
                     </td>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index fedf5dc..8eb406c 100644 (file)
                                 [% CASE "Return To" -%]
                                     Checked in before [% loopfilte.filter | $KohaDates %]
                                 [% CASE "Branch" -%]
-                                    Library is [% Branches.GetName( loopfilte.filter ) %]
+                                    Library is [% Branches.GetName( loopfilte.filter ) | html %]
                                 [% CASE "Doc Type" -%]
-                                    Item type is [% ItemTypes.GetDescription( loopfilte.filter ) %]
+                                    Item type is [% ItemTypes.GetDescription( loopfilte.filter ) | html %]
                                 [% CASE "Bor Cat" -%]
-                                    Patron category code is [% loopfilte.filter %]
+                                    Patron category code is [% loopfilte.filter | html %]
                                 [% CASE "Day" -%]
-                                    Day is [% loopfilte.filter %]
+                                    Day is [% loopfilte.filter | html %]
                                 [% CASE "Month" -%]
-                                    Month is [% loopfilte.filter %]
+                                    Month is [% loopfilte.filter | html %]
                                 [% CASE "Year" -%]
-                                    Year is [% loopfilte.filter %]
+                                    Year is [% loopfilte.filter | html %]
                                 [% CASE # default case -%]
-                                    [% loopfilte.crit %] = [% loopfilte.filter %]
+                                    [% loopfilte.crit | html %] = [% loopfilte.filter | html %]
                             [% END -%]
                         </li>
                     [% END %]
@@ -62,7 +62,7 @@
                        <tr>
                                <th rowspan="2">Rank</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th colspan="2">[% loopco.coltitle %]</th>
+                                       <th colspan="2">[% loopco.coltitle | html %]</th>
                                [% END %]
                        </tr>
                        <tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                                <tr>
                                        [% IF ( loopro.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                       [% loopro.rowtitle %]</td>
+                                       [% loopro.rowtitle | html %]</td>
                                        [% FOREACH loopcel IN loopro.loopcell %]
                                                [% IF ( loopcel.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                       [% IF ( loopcel.reference ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopcel.reference %]">[% END %]
-                                                       [% IF ( loopcel.value ) %][% loopcel.value %][% END %]
+                                                       [% IF ( loopcel.reference ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopcel.reference | html %]">[% END %]
+                                                       [% IF ( loopcel.value ) %][% loopcel.value | html %][% END %]
                                                        [% IF ( loopcel.reference ) %]</a>[% END %]
                                                </td>
                                                [% IF ( loopcel.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                               [% IF ( loopcel.count ) %][% loopcel.count %][% END %]
+                                               [% IF ( loopcel.count ) %][% loopcel.count | html %][% END %]
                                                </td>
                                        [% END %]
                                </tr>
                                <label for="branch">Library: </label>
 <select name="Filter" id="branch"><option value="" > Any library</option>
     [% FOREACH l IN Branches.all( unfiltered => 1 ) %]
-        <option value="[% l.branchcode %]" >[% l.branchname %] </option>
+        <option value="[% l.branchcode | html %]" >[% l.branchname | html %] </option>
      [% END %] 
     </select>                  </li>
                        <li> 
                 <label for="documenttype">Item type: </label><select name="Filter" id="documenttype"><option value="" > Any item type</option>
     [% FOREACH itemtype IN itemtypes %]
-        <option value="[% itemtype.itemtype %]" >[% itemtype.translated_description %] </option>
+        <option value="[% itemtype.itemtype | html %]" >[% itemtype.translated_description | html %] </option>
      [% END %] 
     </select>
                        </li>
                        <li> 
                 <label for="patroncategory">Patron category: </label><select name="Filter" id="patroncategory"><option value="" > Any category code</option>
     [% FOREACH patron_category IN patron_categories%]
-        <option value="[% patron_category.categorycode %]" >[% patron_category.description %] </option>
+        <option value="[% patron_category.categorycode | html %]" >[% patron_category.description | html %] </option>
      [% END %]
     </select>
                        </li>
                        <label class="inline" for="MIME">Into an application: </label>
                        <select name="MIME" id="MIME">
                        [% FOREACH mimeloo IN mimeloop %]
-                               <option value="[% mimeloo.type %]">[% mimeloo.type %]</option>
+                               <option value="[% mimeloo.type | html %]">[% mimeloo.type | html %]</option>
                        [% END %]
                        </select>
                        <label class="inline" for="sep">Delimiter: </label>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIseplist.values.sort() %]
               [% IF ( value == CGIseplist.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index ff4008f..ddf5fbe 100644 (file)
@@ -22,7 +22,7 @@
         [% IF ( mainloo.loopfilter ) %]
             <p>Filtered on:</p>
             [% FOREACH loopfilte IN mainloo.loopfilter %]
-                    <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit %] =[% loopfilte.filter %][% IF ( loopfilte.err ) %]  [% END %]</p>
+                    <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit | html %] =[% loopfilte.filter | html %][% IF ( loopfilte.err ) %]  [% END %]</p>
             [% END %]
         [% END %]
         
             <tr>
                 <th>Num/Patrons</th>
                 [% FOREACH loopco IN mainloo.loopcol %]
-                    <th>[% loopco.coltitle %]</th>
+                    <th>[% loopco.coltitle | html %]</th>
                 [% END %]
             </tr>
                 [% FOREACH loopro IN mainloo.looprow %]
             <tr>
-                        <td>[% loopro.rowtitle %]</td>
+                        <td>[% loopro.rowtitle | html %]</td>
                         [% FOREACH loopcel IN loopro.loopcell %]
-                        <td>[% IF ( loopcel.value ) %][% loopcel.value %][% END %]
+                        <td>[% IF ( loopcel.value ) %][% loopcel.value | html %][% END %]
                             </td>
                         [% END %]
                     </tr>
@@ -51,7 +51,7 @@
                <ol>
             <li><label for="patroncategory">Patron category: </label> <select name="Filter" id="patroncategory"><option value="" > Any category code</option>
     [% FOREACH patron_category IN patron_categories %]
-        <option value="[% patron_category.categorycode %]" >[% patron_category.description %] </option>
+        <option value="[% patron_category.categorycode | html %]" >[% patron_category.description | html %] </option>
     [% END %]
     </select>
 </li>
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index 95c78f5..5edd401 100644 (file)
             <p>Filtered on:</p>
                        [% FOREACH loopfilte IN mainloo.loopfilter %]
                                <p>
-                                       [% loopfilte.crit %] = [% loopfilte.filter %]
+                                       [% loopfilte.crit | html %] = [% loopfilte.filter | html %]
                                </p>
                        [% END %]
                [% END %]
                <table>
                        <tr>
-                               <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                               <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th>[% IF ( loopco.coltitle_display ) %][% loopco.coltitle_display %][% ELSE %][% loopco.coltitle %][% END %]
+                                       <th>[% IF ( loopco.coltitle_display ) %][% loopco.coltitle_display | html %][% ELSE %][% loopco.coltitle | html %][% END %]
                                        </th>
                                [% END %]
                                <th>TOTAL</th>
                        </tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                     <tr>
-                                               <td>[% IF ( loopro.rowtitle_display ) %][% loopro.rowtitle_display %][% ELSE %][% loopro.rowtitle %][% END %]
+                                               <td>[% IF ( loopro.rowtitle_display ) %][% loopro.rowtitle_display | html %][% ELSE %][% loopro.rowtitle | html %][% END %]
                                                </td>
                                                [% FOREACH loopcel IN loopro.loopcell %]
-                                               <td>[% IF ( loopcel.value ) %][% loopcel.value %][% ELSE %]&nbsp;[% END %]
+                                               <td>[% IF ( loopcel.value ) %][% loopcel.value | html %][% ELSE %]&nbsp;[% END %]
                                                </td>
                                                [% END %]
-                                               <td>[% loopro.totalrow %]</td>
+                                               <td>[% loopro.totalrow | html %]</td>
                                        </tr>
                                [% END %]
                                <tr>
                                        <th>TOTAL</th>
                                        [% FOREACH loopfoote IN mainloo.loopfooter %]
-                                               <th>[% loopfoote.totalcol %]</th>
+                                               <th>[% loopfoote.totalcol | html %]</th>
                                        [% END %]
-                                       <th>[% mainloo.total %]</th>
+                                       <th>[% mainloo.total | html %]</th>
                                </tr>
                </table>
        [% END %]
@@ -83,7 +83,7 @@
                 <select name="Filter"  size="1" id="catcode">
                     <option value=""></option>
                     [% FOREACH patron_category IN patron_categories %]
-                        <option value="[% patron_category.categorycode %]">[% patron_category.description %]</option>
+                        <option value="[% patron_category.categorycode | html %]">[% patron_category.description | html %]</option>
                     [% END %]
                 </select>
             </td>
                        <td><select name="Filter"  size="1" id="zipcode">
                                <option value=""> </option>
                                [% FOREACH ZIP_LOO IN ZIP_LOOP %]
-                               <option value="[% ZIP_LOO.zipcode %]">[% ZIP_LOO.zipcode %]</option>
+                               <option value="[% ZIP_LOO.zipcode | html %]">[% ZIP_LOO.zipcode | html %]</option>
                                [% END %]
                                </select>
                        </td>
                 <select name="Filter"  size="1" id="branch">
                 <option value=""></option>
                 [% FOREACH l IN Branches.all( unfiltered => 1 ) %]
-                    <option value="[% l.branchcode %]">[% l.branchcode %] - [% l.branchname || 'UNKNOWN' %]</option>
+                    <option value="[% l.branchcode | html %]">[% l.branchcode | html %] - [% l.branchname || 'UNKNOWN' | html %]</option>
                 [% END %]
                 </select>
                        </td>
                                        <select id="sort1" size="1" name="Filter">
                                        <option value=""/>
                                        [% FOREACH SORT1_LOO IN SORT1_LOOP %]
-                                               <option value="[% SORT1_LOO.authorized_value %]">[% SORT1_LOO.lib %]</option>
+                                               <option value="[% SORT1_LOO.authorized_value | html %]">[% SORT1_LOO.lib | html %]</option>
                                        [% END %]
                                        </select>
                                </td>
                                        <select id="sort2" size="1" name="Filter">
                                        <option value=""/>
                                        [% FOREACH SORT2_LOO IN SORT2_LOOP %]
-                                               <option value="[% SORT2_LOO.value %]">[% SORT2_LOO.value %]</option>
+                                               <option value="[% SORT2_LOO.value | html %]">[% SORT2_LOO.value | html %]</option>
                                        [% END %]
                                        </select>
                                </td>
             [% FOREACH pa_loo IN patron_attributes %]
                 [% IF (pa_loo.class) %]
                     <tr>
-                        <th>[% pa_loo.class %] ([% pa_loo.lib %])</th>
+                        <th>[% pa_loo.class | html %] ([% pa_loo.lib | html %])</th>
                         <th colspan="3"></th>
                     </tr>
                 [% END %]
             [% FOREACH patron_attribute IN pa_loo.items %]
-                <tr data-category_code="[% patron_attribute.category_code %]">
+                <tr data-category_code="[% patron_attribute.category_code | html %]">
                     <td>
-                        [% patron_attribute.code %]
-                        ([% patron_attribute.description %])
+                        [% patron_attribute.code | html %]
+                        ([% patron_attribute.description | html %])
                     </td>
                     <td>
                         <input type="radio" name="Line"
-                            value="patron_attr.[% patron_attribute.code %]" />
+                            value="patron_attr.[% patron_attribute.code | html %]" />
                     </td>
                     <td>
                         <input type="radio" name="Column"
-                            value="patron_attr.[% patron_attribute.code %]" />
+                            value="patron_attr.[% patron_attribute.code | html %]" />
                     </td>
                     <td>
                         [% IF ( patron_attribute.use_dropdown ) %]
-                            <select name="Filter_patron_attr.[% patron_attribute.code %]"  >
+                            <select name="Filter_patron_attr.[% patron_attribute.code | html %]"  >
                                 <option value="" />
                                 [% FOREACH auth_val_loo IN patron_attribute.auth_val_loop %]
-                                    <option value="[% auth_val_loo.authorised_value %]" >
-                                        [% auth_val_loo.lib %]
+                                    <option value="[% auth_val_loo.authorised_value | html %]" >
+                                        [% auth_val_loo.lib | html %]
                                     </option>
                                 [% END %]
                             </select>
                         [% ELSE %]
                             <input type="text" maxlength="64"
-                                   name="Filter_patron_attr.[% patron_attribute.code %]" />
+                                   name="Filter_patron_attr.[% patron_attribute.code | html %]" />
                         [% END %]
                     </td>
                 </tr>
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index d38df2f..7bf56a2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Price %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Reports [% IF ( do_it ) %]&rsaquo; Cash register statistics &rsaquo; Results[% ELSE %]&rsaquo; Cash register statistics[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="cash_register_stats" class="rep">
                         [% END %]
 
                         [% FOREACH manualinv IN manualinv_types %]
-                            [% value_manualinv = manualinv.authorised_value|truncate(5, '') %]
+                            [% value_manualinv = manualinv.authorised_value|truncate(5, '') | html %]
                             [% IF transaction_type == value_manualinv %]
-                            <option value="[% value_manualinv %]" selected="selected">[% manualinv.authorised_value %]</option>
+                            <option value="[% value_manualinv | html %]" selected="selected">[% manualinv.authorised_value | html %]</option>
                             [% ELSE %]
-                            <option value="[% value_manualinv %]">[% manualinv.authorised_value %]</option>
+                            <option value="[% value_manualinv | html %]">[% manualinv.authorised_value | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                         <option value="ALL">All</option>
                         [% FOREACH branchloo IN branchloop %]
                             [% IF ( branchloo.selected ) %]
-                            <option value="[% branchloo.branchcode %]" selected="selected">[% branchloo.branchname %]</option>
+                            <option value="[% branchloo.branchcode | html %]" selected="selected">[% branchloo.branchname | html %]</option>
                             [% ELSE %]
-                            <option value="[% branchloo.branchcode %]">[% branchloo.branchname %]</option>
+                            <option value="[% branchloo.branchcode | html %]">[% branchloo.branchname | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
         </thead>
         [% FOREACH loopresul IN loopresult %]
             <tr>
-                <td>[% loopresul.mfirstname %] [% loopresul.msurname %]</td>
-                <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopresul.borrowernumber %]">[% loopresul.cardnumber %]</a></td>
-                <td>[% loopresul.bfirstname %] [% loopresul.bsurname %]</td>
-                <td>[% loopresul.branchname %]</td>
+                <td>[% loopresul.mfirstname | html %] [% loopresul.msurname | html %]</td>
+                <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopresul.borrowernumber | html %]">[% loopresul.cardnumber | html %]</a></td>
+                <td>[% loopresul.bfirstname | html %] [% loopresul.bsurname | html %]</td>
+                <td>[% loopresul.branchname | html %]</td>
                 <td>[% loopresul.date | $KohaDates %]</td>
                 <td>
                     [% IF loopresul.accounttype == "ACT" %]
                         <span>New card</span>
                     [% ELSE %]
                         [% FOREACH manualinv IN manualinv_types %]
-                            [% value_manualinv = manualinv.authorised_value|truncate(5, '') %]
+                            [% value_manualinv = manualinv.authorised_value|truncate(5, '') | html %]
                             [% IF loopresul.accounttype == value_manualinv %]
-                            <span>[% manualinv.authorised_value %]</span>
-                            [% LAST %]
+                            <span>[% manualinv.authorised_value | html %]</span>
+                            [% LAST | html %]
                             [% END %]
                         [% END %]
                     [% END %]
                 </td>
-                <td>[% loopresul.note %]</td>
-                <td style="text-align:right;">[% loopresul.amount | $Price %]</td>
-                <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopresul.biblionumber %]">[% loopresul.title %]</a></td>
-                <td>[% loopresul.barcode %]</td>
-                <td>[% ItemTypes.GetDescription(loopresul.itype) %]</td>
+                <td>[% loopresul.note | html %]</td>
+                <td style="text-align:right;">[% loopresul.amount | $Price | html %]</td>
+                <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopresul.biblionumber | html %]">[% loopresul.title | html %]</a></td>
+                <td>[% loopresul.barcode | html %]</td>
+                <td>[% ItemTypes.GetDescription(loopresul.itype) | html %]</td>
             </tr>
         [% END %]
         <tfoot>
         <tr>
             [% IF transaction_type == "ACT" %]
             <th colspan="7" style="text-align:right;">TOTAL</th>
-            <th style="text-align:right;">[% total  | $Price %]</th>
+            <th style="text-align:right;">[% total  | $Price | html %]</th>
             <th colspan="3">&nbsp;</th>
             [% END %]
         </tr>
index 756d6e0..d9ff9bf 100644 (file)
 [% IF ( do_it ) %]
 
        [% FOREACH mainloo IN mainloop %]
-        <h1>Top [% mainloo.limit %] Most-circulated items</h1>
+        <h1>Top [% mainloo.limit | html %] Most-circulated items</h1>
                [% IF ( mainloo.loopfilter ) %]
             <p>Filtered on:</p>
                        [% FOREACH loopfilte IN mainloo.loopfilter %]
-                    <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit %] =[% loopfilte.filter |html %][% IF ( loopfilte.err ) %]  [% END %]</p>
+                    <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit | html %] =[% loopfilte.filter | html %][% IF ( loopfilte.err ) %]  [% END %]</p>
                        [% END %]
                [% END %]
                
                <table>
 <tr>                           <th>Rank/Biblioitemnumbers</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th colspan="2">[% loopco.coltitle %]</th>
+                                       <th colspan="2">[% loopco.coltitle | html %]</th>
                                [% END %]</tr>
         <tr>
                                <th>&nbsp;</th>
@@ -42,7 +42,7 @@
                          </tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                     <tr>
-                                               <td>[% loopro.rowtitle %]</td>
+                                               <td>[% loopro.rowtitle | html %]</td>
                                                [% FOREACH loopcel IN loopro.loopcell %]
                                                        <td>
 
        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopcel.reference |url %]">
  [% END %]
  [% END %]                                        
-                                                               [% IF ( loopcel.value ) %][% loopcel.value %][% END %]
+                                                               [% IF ( loopcel.value ) %][% loopcel.value | html %][% END %]
                                                                [% IF ( loopcel.reference ) %]</a>[% END %]
                                                        </td>
                                                        <td>
-                                                               [% IF ( loopcel.count ) %][% loopcel.count %][% END %]
+                                                               [% IF ( loopcel.count ) %][% loopcel.count | html %][% END %]
                                                        </td>
                                                [% END %]
                                        </tr>
@@ -86,7 +86,7 @@
       <li> 
         <label for="documenttype">Item type: </label><select name="Filter" id="documenttype"><option value="" > Any item type</option>
     [% FOREACH itemtype IN itemtypes %]
-        <option value="[% itemtype.itemtype %]" >[% itemtype.translated_description %] </option>
+        <option value="[% itemtype.itemtype | html %]" >[% itemtype.translated_description | html %] </option>
      [% END %] 
     </select>
       </li>
       <li>
         <label for="ccode">Collection: </label><select name="Filter" id="ccode"><option value="" > Any collection</option>
     [% FOREACH ccodeloo IN ccodeloop %]
-        <option value="[% ccodeloo.value %]" >[% ccodeloo.description %] </option>
+        <option value="[% ccodeloo.value | html %]" >[% ccodeloo.description | html %] </option>
      [% END %]
     </select>
       </li>
       <li>
         <label for="shelvingloc">Shelving location: </label><select name="Filter" id="shelvingloc"><option value="" > Any shelving location</option>
     [% FOREACH shelvinglocloo IN shelvinglocloop %]
-        <option value="[% shelvinglocloo.value %]" >[% shelvinglocloo.description %] </option>
+        <option value="[% shelvinglocloo.value | html %]" >[% shelvinglocloo.description | html %] </option>
      [% END %]
     </select>
       </li>
       <li>
         <label for="patroncategory">Patron category: </label><select name="Filter" id="patroncategory"><option value="" > Any category code</option>
     [% FOREACH patron_category IN patron_categories %]
-        <option value="[% patron_category.categorycode %]" >[% patron_category.description %] </option>
+        <option value="[% patron_category.categorycode | html %]" >[% patron_category.description | html %] </option>
      [% END %]
     </select>
         </li>
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index aa098c3..30d3d16 100644 (file)
@@ -27,7 +27,7 @@
                                [% ELSE %]<p>
                                [% END %]
                                        [% IF ( loopfilte.sql ) %]<span class="sql">[% END %]
-                                       [% loopfilte.crit %] = [% loopfilte.filter %]
+                                       [% loopfilte.crit | html %] = [% loopfilte.filter | html %]
                                        [% IF ( loopfilte.sql ) %]</span>[% END %]
                                </p>
                        [% END %]
                 <tr><th>Group</th><th>Call number range</th><th>Number of items displayed</th><th>Total items in group</th>
                                </tr>
                        [% FOREACH looptable IN mainloo.looptables %]
-                               <tr><td><a href="#table[% looptable.coltitle %]">[% looptable.coltitle %]</a></td>
+                               <tr><td><a href="#table[% looptable.coltitle | html %]">[% looptable.coltitle | html %]</a></td>
                                        <td>[% IF ( looptable.looptable_count ) %]
-                                               [% looptable.looptable_first %] to [% looptable.looptable_last %]
+                                               [% looptable.looptable_first | html %] to [% looptable.looptable_last | html %]
                                                [% END %]
                                        </td>
-                                       <td>[% looptable.looptable_count %]</td>
-                                       <td>[% looptable.coltitle_count %]</td>
+                                       <td>[% looptable.looptable_count | html %]</td>
+                                       <td>[% looptable.coltitle_count | html %]</td>
                                </tr>
                        [% END %]
-                               <tr><th>TOTAL</th><th></th><th>[% mainloo.total_looptable_count %]</th><th>[% mainloo.total_coltitle_count %]</th>
+                               <tr><th>TOTAL</th><th></th><th>[% mainloo.total_looptable_count | html %]</th><th>[% mainloo.total_coltitle_count | html %]</th>
                                </tr>
                        </table>
 
                [% END %]
                [% FOREACH looptable IN mainloo.looptables %]
-               <h3><a id="table[% looptable.coltitle %]"></a>
-                       [% looptable.coltitle %]
+               <h3><a id="table[% looptable.coltitle | html %]"></a>
+                       [% looptable.coltitle | html %]
                </h3>
                <table>
                        <tr>
                                [% FOREACH loopro IN looptable.looprow %]
                     <tr>
                    
-                                               <td>[% loop.count %]</td>
-                        <td>[% IF ( loopro.itemcallnumber ) %][% loopro.itemcallnumber %][% ELSE %]No call number[% END %]</td>
-                        <td>[% IF ( loopro.barcode ) %][% loopro.barcode %][% ELSE %]No barcode[% END %]</td>
-                        <td><p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopro.biblionumber %]">[% IF ( loopro.title ) %][% loopro.title %][% ELSE %]NO TITLE[% END %]</a> [% IF ( loopro.author ) %] by [% loopro.author %][% END %]</p>
-                            [% IF ( loopro.branch ) %]at [% Branches.GetName( loopro.branch ) %][% END %]
+                                               <td>[% loop.count | html %]</td>
+                        <td>[% IF ( loopro.itemcallnumber ) %][% loopro.itemcallnumber | html %][% ELSE %]No call number[% END %]</td>
+                        <td>[% IF ( loopro.barcode ) %][% loopro.barcode | html %][% ELSE %]No barcode[% END %]</td>
+                        <td><p><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopro.biblionumber | html %]">[% IF ( loopro.title ) %][% loopro.title | html %][% ELSE %]NO TITLE[% END %]</a> [% IF ( loopro.author ) %] by [% loopro.author | html %][% END %]</p>
+                            [% IF ( loopro.branch ) %]at [% Branches.GetName( loopro.branch ) | html %][% END %]
                                                </td>
                                        </tr>
                                [% END %]
                                [% ELSE %]
-                                       <tr><td colspan="4">No items for [% looptable.coltitle %]</td>
+                                       <tr><td colspan="4">No items for [% looptable.coltitle | html %]</td>
                                        </tr>
                                [% END %]
                </table>
@@ -98,7 +98,7 @@
         <label for="documenttype">Item type: </label><select name="Filter" id="documenttype">
         <option value="">Any item type</option>
     [% FOREACH itemtype IN itemtypes %]
-        <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+        <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
      [% END %] 
     </select>
     </li>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
     <input type="hidden" name="do_it" value="1" />
     <input type="hidden" name="output" value="screen" />
        </fieldset>
index f47b00e..57fb13a 100644 (file)
                [% IF ( mainloo.loopfilter ) %]
             <p>Filtered on:</p>
                        [% FOREACH loopfilte IN mainloo.loopfilter %]
-                                       <p>[% loopfilte.crit %] =[% loopfilte.filter %]</p>
+                                       <p>[% loopfilte.crit | html %] =[% loopfilte.filter | html %]</p>
                        [% END %]
                [% END %]
                
                <table>
                        <tr>
-                               <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                               <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th>[% loopco.coltitle %]</th>
+                                       <th>[% loopco.coltitle | html %]</th>
                                [% END %]
                                <th>TOTAL</th>
                        </tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                                        <tr>
                                                [% IF ( loopro.hilighted ) %]<td class="hilighted">[% ELSE %]<td>[% END %]
-                                               [% loopro.rowtitle %]</td>
+                                               [% loopro.rowtitle | html %]</td>
                                                [% FOREACH loopcel IN loopro.loopcell %]
                                                        [% IF ( loopcel.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                               [% IF ( loopcel.value ) %][% loopcel.value %]
+                                                               [% IF ( loopcel.value ) %][% loopcel.value | html %]
                                                                [% ELSE %]&nbsp;
                                                                [% END %]
                                                        </td>
                                                [% END %]
                                                [% IF ( loopro.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                       [% loopro.totalrow %]
+                                                       [% loopro.totalrow | html %]
                                                </td>
                                        </tr>
                                [% END %]
                                        <th>TOTAL</th>
                                        [% FOREACH loopfoote IN mainloo.loopfooter %]
                                                <th>
-                                                       [% loopfoote.totalcol %]
+                                                       [% loopfoote.totalcol | html %]
                                                </th>
                                        [% END %]
-                                       <th>[% mainloo.total %]</th>
+                                       <th>[% mainloo.total | html %]</th>
                                </tr>
                </table>
        [% END %]
       </tr>
                         <tr>
                 <td>Item type</td>
-                               <td><input type="radio" name="Line" value="[% item_itype %]" /></td>
-                               <td><input type="radio" name="Column" value="[% item_itype %]" /></td>
-                               <td><select name="Filter" id="[% item_itype %]">
+                               <td><input type="radio" name="Line" value="[% item_itype | html %]" /></td>
+                               <td><input type="radio" name="Column" value="[% item_itype | html %]" /></td>
+                               <td><select name="Filter" id="[% item_itype | html %]">
                                        <option value=""> </option>
                     [% FOREACH itemtype IN itemtypes %]
-                        <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+                        <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                     [% END %]
                                        </select>
                                </td>
                                <td><select name="Filter" id="location">
                                        <option value=""> </option>
                                        [% FOREACH locationloo IN locationloop %]
-                                       [% IF ( locationloo.selected ) %]<option value="[% locationloo.code %]" selected="selected">[% locationloo.description %]</option>[% ELSE %]<option value="[% locationloo.code %]">[% locationloo.description %]</option>[% END %]
+                                       [% IF ( locationloo.selected ) %]<option value="[% locationloo.code | html %]" selected="selected">[% locationloo.description | html %]</option>[% ELSE %]<option value="[% locationloo.code | html %]">[% locationloo.description | html %]</option>[% END %]
                                        [% END %]
                                        </select>
                                </td>
                                <td><select name="Filter" id="ccode">
                                        <option value=""> </option>
                                        [% FOREACH authval IN authvals %]
-                                       [% IF ( authval.selected ) %]<option value="[% authval.code %]" selected="selected">[% authval.description %]</option>[% ELSE %]<option value="[% authval.code %]">[% authval.description %]</option>[% END %]
+                                       [% IF ( authval.selected ) %]<option value="[% authval.code | html %]" selected="selected">[% authval.description | html %]</option>[% ELSE %]<option value="[% authval.code | html %]">[% authval.description | html %]</option>[% END %]
                                        [% END %]
                                        </select>
                                </td>
                        </tr>
             [% IF (notforloan) %]
                 <tr>
-                    <td>[% notforloan_label %]</td>
+                    <td>[% notforloan_label | html %]</td>
                     <td><input type="radio" name="Line"   value="items.notforloan" /></td>
                     <td><input type="radio" name="Column" value="items.notforloan" /></td>
                     <td>
                             <select name="Filter" id="notforloan">
                                 <option value="">&nbsp;</option>
                                 [% FOREACH av IN notforloan_avlist %]
-                                    <option value="[% av.authorised_value %]">
-                                        [% av.lib %]
+                                    <option value="[% av.authorised_value | html %]">
+                                        [% av.lib | html %]
                                     </option>
                                 [% END %]
                             </select>
             [% END %]
             [% IF (materials) %]
                 <tr>
-                    <td>[% materials_label %]</td>
+                    <td>[% materials_label | html %]</td>
                     <td><input type="radio" name="Line"   value="items.materials" /></td>
                     <td><input type="radio" name="Column" value="items.materials" /></td>
                     <td>
                             <select name="Filter" id="materials">
                                 <option value="">&nbsp;</option>
                                 [% FOREACH av IN materials_avlist %]
-                                    <option value="[% av.authorised_value %]">
-                                        [% av.lib %]
+                                    <option value="[% av.authorised_value | html %]">
+                                        [% av.lib | html %]
                                     </option>
                                 [% END %]
                             </select>
                        <label class="inline" for="MIME">Into an application: </label>
                        <select name="MIME" id="MIME">
                        [% FOREACH CGIextChoic IN CGIextChoice %]
-                       <option value="[% CGIextChoic.type %]">[% CGIextChoic.type %]</option>
+                       <option value="[% CGIextChoic.type | html %]">[% CGIextChoic.type | html %]</option>
                        [% END %]
                        </select>
                        <!-- <label class="inline" for="sep">Delimiter: </label> -->
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index b3958f2..ecb9f77 100644 (file)
@@ -51,9 +51,9 @@
           <option value="">All</option>
         [% FOREACH area IN areas %]
           [%- IF ( area.selected ) -%]
-          <option value="[% area.id %]" selected="selected">[%- PROCESS area_name area=area.id -%]</option>
+          <option value="[% area.id | html %]" selected="selected">[%- PROCESS area_name area=area.id -%]</option>
           [%- ELSE -%]
-          <option value="[% area.id %]">[%- PROCESS area_name area=area.id -%]</option>
+          <option value="[% area.id | html %]">[%- PROCESS area_name area=area.id -%]</option>
           [%- END -%]
         [% END %]
         </select>
             <tr>
                 <td>[% definition.name | html %]</td>
                 <td>[% definition.description | html %]</td>
-                <td>[% definition.areaname %]</td>
-                <td>[% definition.saved_sql %]</td>
+                <td>[% definition.areaname | html %]</td>
+                <td>[% definition.saved_sql | html %]</td>
                 <td class="actions"><form method="post" action="/cgi-bin/koha/reports/dictionary.pl">
-                    <input type="hidden" name="id" value="[% definition.id %]" />
+                    <input type="hidden" name="id" value="[% definition.id | html %]" />
                     <input type="hidden" name="phase" value="Delete Definition" />
                     <button type="submit" name="submit" class="btn btn-default btn-xs" id="delete"><i class="fa fa-trash"></i> Delete</button>
                 </form></td>
         <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
         <label for="area">Select table:</label><select name="area" id="area">
       [%- FOREACH area IN areas -%]
-        <option value="[%- area.id -%]">[%- PROCESS area_name area=area.id -%]</option>
+        <option value="[%- area.id | html -%]">[%- PROCESS area_name area=area.id -%]</option>
       [%- END -%]
         </select>
       </li>
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">      
 <fieldset class="rows">
 <legend>Step 3 of 5: Choose a column</legend>
-<input type="hidden" name="area" value="[% area %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
 
 </optgroup>        
 [% END %]                                                         
 
-<optgroup label="[% column.table %]">              
+<optgroup label="[% column.table | html %]">              
 [% ELSE %]               
-<option value="[% column.name %]">
-[% IF ( column.description ) %][% column.description %]    
+<option value="[% column.name | html %]">
+[% IF ( column.description ) %][% column.description | html %]    
 [% ELSE %]               
-[% column.name %]                          
+[% column.name | html %]                          
 [% END %]              
 </option>      
 [% END %]              
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
 <fieldset class="rows">
 <legend>Step 4 of 5: Specify a value</legend>
-<input type="hidden" name="area" value="[% area %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
-<input type="hidden" name="columnstring" value="[% columnstring %]" />
+<input type="hidden" name="columnstring" value="[% columnstring | html %]" />
 
 [% FOREACH column IN columns %]
-<input type="hidden" name="criteria_column" value="[% column.name %]" />
-<ol><li><span class="label">Column: </span> [% column.name %]</li>
+<input type="hidden" name="criteria_column" value="[% column.name | html %]" />
+<ol><li><span class="label">Column: </span> [% column.name | html %]</li>
 [% IF ( column.distinct ) %]
-    <li><label for="[% column.name %]_value">Choose: </label> <select id="[% column.name %]_value" name="[% column.name %]_value">
+    <li><label for="[% column.name | html %]_value">Choose: </label> <select id="[% column.name | html %]_value" name="[% column.name | html %]_value">
         [% FOREACH value IN column.values %]
-            <option value="[% value.availablevalues %]">[% value.availablevalues %]</option>
+            <option value="[% value.availablevalues | html %]">[% value.availablevalues | html %]</option>
         [% END %]
     </select></li>
 [% END %]
 [% IF ( column.date ) %]
     <li class="radio">
         <label for="all_dates">All dates</label>
-        <input type="radio" id="all_dates" name="[% column.name %]_date_type_value" value="all" checked="checked" />
+        <input type="radio" id="all_dates" name="[% column.name | html %]_date_type_value" value="all" checked="checked" />
         <label for="date_range">Date range</label>
-        <input type="radio" id="date_range" name="[% column.name %]_date_type_value" value="range" />
+        <input type="radio" id="date_range" name="[% column.name | html %]_date_type_value" value="range" />
     </li>
     <li class="radio">
         Start of date range
-        <input type="text" size="10" id="from" name="[% column.name %]_start_value" value="" class="datepickerfrom" />
+        <input type="text" size="10" id="from" name="[% column.name | html %]_start_value" value="" class="datepickerfrom" />
         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
         End of date range
-        <input type="text" size="10" id="to" name="[% column.name %]_end_value" value="" class="datepickerto" />
+        <input type="text" size="10" id="to" name="[% column.name | html %]_end_value" value="" class="datepickerto" />
         <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
     </li>
 [% END %]
 [% IF ( column.text ) %]
-       <li><label for="[% column.name %]_value">Search string matches: </label> <input type="text" size="13" name="[% column.name %]_value" /></li>
+       <li><label for="[% column.name | html %]_value">Search string matches: </label> <input type="text" size="13" name="[% column.name | html %]_value" /></li>
 [% END %]
 
 [% END %]
 
 [% IF ( step_5 ) %]
 <form action="/cgi-bin/koha/reports/dictionary.pl" method="post">
-<input type="hidden" name="area" value="[% area %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
 <input type="hidden" name="definition_name" value="[% definition_name | html %]" />
 <input type="hidden" name="definition_description" value="[% definition_description | html %]" />
-<input type="hidden" name="columnstring" value="[% columnstring %]" />
+<input type="hidden" name="columnstring" value="[% columnstring | html %]" />
 
 <h3>Add new definition</h3>
 
         </tr>
       [%- FOREACH criteria_loo IN criteria_loop -%]
         <tr>
-          <td>[%- criteria_loo.name -%]</td>
-          <td>[%- criteria_loo.value -%]</td>
+          <td>[%- criteria_loo.name | html -%]</td>
+          <td>[%- criteria_loo.value | html -%]</td>
         </tr>
       [%- END -%]
       </table>
   </ol>
 </fieldset>
 
-<fieldset class="action"><input type="hidden" name="sql" value="[% query %]" />
+<fieldset class="action"><input type="hidden" name="sql" value="[% query | html %]" />
 <input type="hidden" name="phase" value="New Term step 6" />
 <input type="submit" name="submit" value="Save" />         </fieldset>
 
index 5d0546b..5cd4e21 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Koha %]
@@ -19,7 +20,7 @@
 <title>Koha &rsaquo; Reports &rsaquo; Guided reports wizard [%- IF ( saved1 ) -%]&rsaquo; Saved reports
 [%- ELSIF ( create ) -%]&rsaquo; Create from SQL
 [%- ELSIF ( showsql ) -%]&rsaquo; Saved reports &rsaquo; SQL view
-[%- ELSIF ( execute ) -%]&rsaquo; Saved reports &rsaquo; [% name %] Report
+[%- ELSIF ( execute ) -%]&rsaquo; Saved reports &rsaquo; [% name | html %] Report
 [%- ELSIF ( editsql ) -%]&rsaquo; Saved reports &rsaquo; Edit SQL report
 [%- END -%]
 [%- IF ( build1 ) -%]&rsaquo; Build a report, step 1 of 6: Choose a module
@@ -33,7 +34,7 @@
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( saved1 ) %]
     [% Asset.css("css/reports.css") %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 </head>
 
@@ -49,7 +50,7 @@
 [% ELSIF ( create ) %]&rsaquo; Create from SQL
 [% ELSIF ( showsql ) %]&rsaquo; <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a> &rsaquo; SQL view
 [% ELSIF ( editsql ) %]&rsaquo; <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a> &rsaquo; Edit SQL report
-[% ELSIF ( execute ) %]&rsaquo; <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a> &rsaquo; <em>[% name %]</em> Report
+[% ELSIF ( execute ) %]&rsaquo; <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved">Saved reports</a> &rsaquo; <em>[% name | html %]</em> Report
 [% ELSIF ( build1 || build2 || build3 || build4 || build5 || build6 ) %]&rsaquo; <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=Build%20new">Build a report</a>
     [% IF ( build1 ) %]&rsaquo; Step 1 of 6: Choose a module
     [% ELSIF ( build2 ) %]&rsaquo; Step 2 of 6: Pick a report type
@@ -69,7 +70,7 @@
         <h3 id="update_sql_label">Update SQL</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <a href="#" class="btn btn-default" id="update_sql_button" role="button" data-toggle="modal">Update</a>
@@ -120,7 +121,7 @@ canned reports and writing custom SQL reports.</p>
 
 [% IF report_converted %]
     <div class="dialog message">
-        The report "[% report_converted %]" has been converted.
+        The report "[% report_converted | html %]" has been converted.
     </div>
 [% END %]
 
@@ -131,13 +132,13 @@ canned reports and writing custom SQL reports.</p>
     <p>Filtered by:
         <span class="filter">
             [% IF ( filters.date ) %]
-                <span class="filter_date"><strong>Date:</strong> [% filters.date %]</span>
+                <span class="filter_date"><strong>Date:</strong> [% filters.date | html %]</span>
             [% END %]
             [% IF ( filters.author ) %]
-                <span class="filter_author"><strong>Author:</strong> [% filters.author %]</span>
+                <span class="filter_author"><strong>Author:</strong> [% filters.author | html %]</span>
             [% END %]
             [% IF ( filters.keyword ) %]
-                <span class="filter_keyword"><strong>Keyword:</strong> [% filters.keyword %]</span>
+                <span class="filter_keyword"><strong>Keyword:</strong> [% filters.keyword | html %]</span>
             [% END %]
             <a class="clear_filter" href="/cgi-bin/koha/reports/guided_reports.pl?phase=Use%20saved&clear_filters=1"><i class="fa fa-remove"></i> Clear</a>
         </span>
@@ -148,7 +149,7 @@ canned reports and writing custom SQL reports.</p>
     <ul>
         <li><a href="#reports">All</a></li>
         [% FOREACH group IN groups_with_subgroups %]
-            <li><a id="[% group.id %]" href="#reports">[% group.name %]</a></li>
+            <li><a id="[% group.id | html %]" href="#reports">[% group.name | html %]</a></li>
         [% END %]
     </ul>
     <div id="reports">
@@ -195,25 +196,25 @@ canned reports and writing custom SQL reports.</p>
                     [% UNLESS ( loop.odd ) %]<tr class="odd">[% ELSE %]<tr>[% END %]
                         <td>
                             [% IF ( CAN_user_reports_delete_reports ) %] <!-- not break CSS -->
-                                <input type="checkbox" name="ids" value="[% savedreport.id %]" />
+                                <input type="checkbox" name="ids" value="[% savedreport.id | html %]" />
                             [% END %]
                         </td>
-                        <td><label for="ids">[% savedreport.id %]</label></td>
+                        <td><label for="ids">[% savedreport.id | html %]</label></td>
                         <td>
                             [% IF ( savedreport.report_name ) %]
-                                [% savedreport.report_name %]
+                                [% savedreport.report_name | html %]
                             [% ELSE %]
                                 [ no name ]
                             [% END %]
                         </td>
-                        <td>[% savedreport.type %]</td>
-                        <td>[% savedreport.groupname %]</td>
-                        <td>[% savedreport.subgroupname %]</td>
-                        <td>[% savedreport.notes %]</td>
-                        <td>[% savedreport.borrowersurname %][% IF ( savedreport.borrowerfirstname ) %], [% savedreport.borrowerfirstname %][% END %] ([% savedreport.borrowernumber %])</td>
-                        <td><span title="[% savedreport.date_created %]">[% savedreport.date_created | $KohaDates %]</span></td>
-                        <td><span title="[% savedreport.last_modified %]">[% savedreport.last_modified | $KohaDates with_hours => 1 %]</span></td>
-                        <td><span title="[% savedreport.last_run %]">[% savedreport.last_run | $KohaDates with_hours => 1 %]</span></td>
+                        <td>[% savedreport.type | html %]</td>
+                        <td>[% savedreport.groupname | html %]</td>
+                        <td>[% savedreport.subgroupname | html %]</td>
+                        <td>[% savedreport.notes | html %]</td>
+                        <td>[% savedreport.borrowersurname | html %][% IF ( savedreport.borrowerfirstname ) %], [% savedreport.borrowerfirstname | html %][% END %] ([% savedreport.borrowernumber | html %])</td>
+                        <td><span title="[% savedreport.date_created | html %]">[% savedreport.date_created | $KohaDates %]</span></td>
+                        <td><span title="[% savedreport.last_modified | html %]">[% savedreport.last_modified | $KohaDates with_hours => 1 | html %]</span></td>
+                        <td><span title="[% savedreport.last_run | html %]">[% savedreport.last_run | $KohaDates with_hours => 1 | html %]</span></td>
                         <td class="report_public">
                         [% IF (savedreport.public) %]
                             Yes
@@ -223,22 +224,22 @@ canned reports and writing custom SQL reports.</p>
                         </td>
                         <td class="report_json_url">
                         [% IF (savedreport.public) %]
-                            <a href="[% OPACBaseURL %]/cgi-bin/koha/svc/report?id=[% savedreport.id | uri %]">[% OPACBaseURL %]/cgi-bin/koha/svc/report?id=[% savedreport.id | html %]</a>
+                            <a href="[% OPACBaseURL | html %]/cgi-bin/koha/svc/report?id=[% savedreport.id | uri %]">[% OPACBaseURL | html %]/cgi-bin/koha/svc/report?id=[% savedreport.id | html %]</a>
                         [% ELSE %]
-                            <a href="/cgi-bin/koha/svc/report?id=[% savedreport.id | uri %]">[% Koha.Preference('staffClientBaseURL') %]/cgi-bin/koha/svc/report?id=[% savedreport.id | html %]</a>
+                            <a href="/cgi-bin/koha/svc/report?id=[% savedreport.id | uri %]">[% Koha.Preference('staffClientBaseURL') | html %]/cgi-bin/koha/svc/report?id=[% savedreport.id | html %]</a>
                         [% END %]
                         </td>
-                        <td>[% savedreport.cache_expiry %]</td>
+                        <td>[% savedreport.cache_expiry | html %]</td>
                         <td>
                             [% FOR result IN savedreport.results %]
-                                <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=retrieve%20results&amp;id=[% result.id %]">[% result.date_run %]</a>
+                                <a href="/cgi-bin/koha/reports/guided_reports.pl?phase=retrieve%20results&amp;id=[% result.id | html %]">[% result.date_run | html %]</a>
                                 <br/>
                             [% END %]
                         </td>
                         <td>
                             [% IF savedreport.seems_obsolete %]
                                 This report seems obsolete, it uses biblioitems.marcxml field.
-                                <a href="/cgi-bin/koha/svc/convert_report?report_id=[% savedreport.id %]" data-report_id="[% savedreport.id %]" class="update_sql btn btn-default btn-xs" title="Update SQL"><i class="fa fa-eye"></i> Update SQL</a>
+                                <a href="/cgi-bin/koha/svc/convert_report?report_id=[% savedreport.id | html %]" data-report_id="[% savedreport.id | html %]" class="update_sql btn btn-default btn-xs" title="Update SQL"><i class="fa fa-eye"></i> Update SQL</a>
                             [% END %]
                         </td>
                         <td>
@@ -246,19 +247,19 @@ canned reports and writing custom SQL reports.</p>
                                 <div class="btn-group">
                                     [%# There should be no space between these two buttons, it would render badly %]
                                     <a class="btn btn-default btn-xs" role="button"
-                                       href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id %]&amp;phase=Run%20this%20report"><i
+                                       href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id | html %]&amp;phase=Run%20this%20report"><i
                                        class="fa fa-play"></i> Run</a><a
-                                       class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id %]" role="button" data-toggle="dropdown"
+                                       class="btn btn-default btn-xs dropdown-toggle" id="reportactions[% savedreport.id | html %]" role="button" data-toggle="dropdown"
                                        href="#"><b class="caret"></b></a>
-                                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id %]">
-                                        <li><a href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id %]&amp;phase=Show%20SQL"><i class="fa fa-search"></i> Show</a></li>
+                                    <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="reportactions[% savedreport.id | html %]">
+                                        <li><a href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id | html %]&amp;phase=Show%20SQL"><i class="fa fa-search"></i> Show</a></li>
                                         [% IF ( CAN_user_reports_create_reports ) %]
-                                            <li><a href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id %]&amp;phase=Edit%20SQL"><i class="fa fa-pencil"></i> Edit</a></li>
+                                            <li><a href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id | html %]&amp;phase=Edit%20SQL"><i class="fa fa-pencil"></i> Edit</a></li>
                                             <li><a title="Duplicate this saved report" href="/cgi-bin/koha/reports/guided_reports.pl?phase=Create report from SQL&amp;sql=[% savedreport.savedsql |uri %]&amp;reportname=[% savedreport.report_name |uri %]&amp;notes=[% savedreport.notes |uri %]"><i class="fa fa-copy"></i> Duplicate</a></li>
                                         [% END %]
-                                        <li><a href="/cgi-bin/koha/tools/scheduler.pl?id=[% savedreport.id %]"><i class="fa fa-clock-o"></i> Schedule</a></li>
+                                        <li><a href="/cgi-bin/koha/tools/scheduler.pl?id=[% savedreport.id | html %]"><i class="fa fa-clock-o"></i> Schedule</a></li>
                                         [% IF ( CAN_user_reports_delete_reports ) %]
-                                            <li><a class="confirmdelete" title="Delete this saved report" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id %]&amp;phase=Delete%20Saved"><i class="fa fa-trash"></i> Delete</a></li>
+                                            <li><a class="confirmdelete" title="Delete this saved report" href="/cgi-bin/koha/reports/guided_reports.pl?reports=[% savedreport.id | html %]&amp;phase=Delete%20Saved"><i class="fa fa-trash"></i> Delete</a></li>
                                         [% END %]
                                     </ul>
                                 </div>
@@ -324,7 +325,7 @@ canned reports and writing custom SQL reports.</p>
     <label for="area">Choose: </label>
       <select name="area" id="area">
     [%- FOREACH area IN areas -%]
-      <option value="[% area %]">[%- PROCESS area_name area=area -%]</option>
+      <option value="[% area | html %]">[%- PROCESS area_name area=area -%]</option>
     [%- END -%]
       </select>
   </li>
@@ -334,7 +335,7 @@ canned reports and writing custom SQL reports.</p>
   <li><label for="public">Report is public:</label><select id="public" name="public"> <option value="0" selected="selected">No (default)</option> <option value="1">Yes</option> </select></li>
 [% END %]
 [% IF (usecache) %] <li>
-<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry %]"></input>
+<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry | html %]"></input>
 <select id="cache_expiry_units" name="cache_expiry_units">
 <option value="seconds">Seconds (default)</option>
 <option value="minutes">Minutes</option>
@@ -356,9 +357,9 @@ canned reports and writing custom SQL reports.</p>
 [% IF ( build2 ) %]
 <h1>Build a report</h1>
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-<input type="hidden" name="area" value="[% area %]" />
-<input type="hidden" name="public" value="[% public %]" />
-<input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
+<input type="hidden" name="public" value="[% public | html %]" />
+<input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
 <fieldset class="rows"><legend>Step 2 of 6: Pick a report type</legend>
 <ol><li><label for="types">Choose: </label>
     <select id="types" name="types">
@@ -379,9 +380,9 @@ canned reports and writing custom SQL reports.</p>
 
 <!--- Summary and Matrix reports have not yet been implemented-->
 <!--<div class="yui-u">Summary:
-<img src="[% interface %]/[% theme %]/img/reports-summary-graphic.gif" /></div>
+<img src="[% interface | html %]/[% theme | html %]/img/reports-summary-graphic.gif" /></div>
 <div class="yui-u">Matrix:
-<img src="[% interface %]/[% theme %]/img/reports-matrix-graphic.gif" /></div>-->
+<img src="[% interface | html %]/[% theme | html %]/img/reports-matrix-graphic.gif" /></div>-->
 
 [% END %]
 
@@ -391,10 +392,10 @@ canned reports and writing custom SQL reports.</p>
 <p>Note: Be careful selecting when selecting columns. If your choice is too broad it could result in a very large report that will either not complete, or slow your system down.</p>
 
 <form id="column_submit" action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-    <input type="hidden" name="area" value="[% area %]" />
-    <input type="hidden" name="type" value="[% type %]" />
-    <input type="hidden" name="public" value="[% public %]" />
-    <input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+    <input type="hidden" name="area" value="[% area | html %]" />
+    <input type="hidden" name="type" value="[% type | html %]" />
+    <input type="hidden" name="public" value="[% public | html %]" />
+    <input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
     <fieldset>
 <div class="yui-g">
 <div class="yui-u first">      <div style="float: left;"><select id="availableColumns" name="oldcolumns2" multiple="multiple" size="25" style="min-width: 200px;height:300px;">
@@ -406,12 +407,12 @@ canned reports and writing custom SQL reports.</p>
 </optgroup>
 [% END %]
 
-<optgroup label="[% column.table %]">
+<optgroup label="[% column.table | html %]">
 [% ELSE %]
-<option value="[% column.name %]">
-[% IF ( column.description ) %][% column.description %] &nbsp; / &nbsp; [% column.name %]
+<option value="[% column.name | html %]">
+[% IF ( column.description ) %][% column.description | html %] &nbsp; / &nbsp; [% column.name | html %]
 [% ELSE %]
-[% column.name %]
+[% column.name | html %]
 [% END %]
 </option>
 [% END %]
@@ -441,46 +442,46 @@ canned reports and writing custom SQL reports.</p>
 [% IF ( build4 ) %]
 <h1>Build a report</h1>
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" >
-    <input type="hidden" name="area" value="[% area %]" />
-    <input type="hidden" name="type" value="[% type %]" />
-    <input type="hidden" name="column" value="[% column %]" />
-    <input type="hidden" name="public" value="[% public %]" />
-    <input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+    <input type="hidden" name="area" value="[% area | html %]" />
+    <input type="hidden" name="type" value="[% type | html %]" />
+    <input type="hidden" name="column" value="[% column | html %]" />
+    <input type="hidden" name="public" value="[% public | html %]" />
+    <input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
     <fieldset><legend>Step 4 of 6: Select criteria to limit on</legend>
     <table>
         [% FOREACH criteri IN criteria %]
         <tr>
         <td>
-            <input type="checkbox" name="criteria_column" id="[% criteri.name %]" value="[% criteri.name %]" /> 
-            <label for="[% criteri.name %]">[% criteri.description %] </label>
+            <input type="checkbox" name="criteria_column" id="[% criteri.name | html %]" value="[% criteri.name | html %]" /> 
+            <label for="[% criteri.name | html %]">[% criteri.description | html %] </label>
         </td>
         [% IF ( criteri.date ) %]
         <td>
-            <input type="text" size="10" id="[% criteri.name %]_value" name="[% criteri.name %]_value" value="" class="datepicker" />
+            <input type="text" size="10" id="[% criteri.name | html %]_value" name="[% criteri.name | html %]_value" value="" class="datepicker" />
                <span class="hint">[% INCLUDE 'date-format.inc' %]</span>
         </td>
         </tr>
         [% ELSE %]
         [% IF ( criteri.textrange ) %]
             <td>from
-            <input type="text" size="10" id="[% criteri.from %]_value" name="[% criteri.from %]_value" value="" /> to 
-            <input type="text" size="10" id="[% criteri.to %]_value" name="[% criteri.to %]_value" value="" />
+            <input type="text" size="10" id="[% criteri.from | html %]_value" name="[% criteri.from | html %]_value" value="" /> to 
+            <input type="text" size="10" id="[% criteri.to | html %]_value" name="[% criteri.to | html %]_value" value="" />
             </td>
             </tr>
         [% ELSE %]
             [% IF ( criteri.daterange ) %]
             <td>from 
-            <input type="text" size="10" id="from_[% criteri.name %]_value" name="from_[% criteri.name %]_value" value="" class="datepickerfrom" />
+            <input type="text" size="10" id="from_[% criteri.name | html %]_value" name="from_[% criteri.name | html %]_value" value="" class="datepickerfrom" />
             to
-            <input type="text" size="10" id="to_[% criteri.name %]_value" name="to_[% criteri.name %]_value" value="" class="datepickerto" />
+            <input type="text" size="10" id="to_[% criteri.name | html %]_value" name="to_[% criteri.name | html %]_value" value="" class="datepickerto" />
                        <span class="hint">[% INCLUDE 'date-format.inc' %]</span>
             </td>
         </tr>
             [% ELSE %]
             <td>
-                <select name="[% criteri.name %]_value">
+                <select name="[% criteri.name | html %]_value">
                 [% FOREACH value IN criteri.values %]
-                <option value="[% value.availablevalues %]">[% IF ( value.default ) %]Default[% ELSE %][% value.display_value |html %][% END %]</option>
+                <option value="[% value.availablevalues | html %]">[% IF ( value.default ) %]Default[% ELSE %][% value.display_value | html %][% END %]</option>
                 [% END %]
                 </select>
             </td>
@@ -496,7 +497,7 @@ canned reports and writing custom SQL reports.</p>
 <fieldset><legend>Dictionary definitions</legend>
 <table>
 [% FOREACH definition IN definitions %]
-    <tr><td><input type="checkbox" name="definition" value="[% definition.id %]" /> [% definition.name %]</td></tr>
+    <tr><td><input type="checkbox" name="definition" value="[% definition.id | html %]" /> [% definition.name | html %]</td></tr>
 [% END %]
 </table>
 </fieldset>
@@ -513,20 +514,20 @@ canned reports and writing custom SQL reports.</p>
 <h1>Build a report</h1>
 <h3>Step 5 of 6: Pick which columns to total</h3>
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-<input type="hidden" name="area" value="[% area %]" />
-<input type="hidden" name="type" value="[% type %]" />
-<input type="hidden" name="column" value="[% column %]" />
-<input type="hidden" name="definition" value="[% definition %]" />
-<input type="hidden" name="criteria" value="[% criteriastring %]" />
-<input type="hidden" name="public" value="[% public %]" />
-<input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
+<input type="hidden" name="type" value="[% type | html %]" />
+<input type="hidden" name="column" value="[% column | html %]" />
+<input type="hidden" name="definition" value="[% definition | html %]" />
+<input type="hidden" name="criteria" value="[% criteriastring | html %]" />
+<input type="hidden" name="public" value="[% public | html %]" />
+<input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
 <fieldset><table>
 [% FOREACH total_b IN total_by %]
-<tr><td><input type="checkbox" name="total_by" id="[% total_b.name %]" value="[% total_b.name %]" /> <label for="[% total_b.name %]">[% total_b.name %]</label></td>
-<td><select name="[% total_b.name %]_tvalue">
+<tr><td><input type="checkbox" name="total_by" id="[% total_b.name | html %]" value="[% total_b.name | html %]" /> <label for="[% total_b.name | html %]">[% total_b.name | html %]</label></td>
+<td><select name="[% total_b.name | html %]_tvalue">
 
 [% FOREACH selec IN total_b.select %]
-<option value="[% selec.value %]">[% selec.value %]</option>
+<option value="[% selec.value | html %]">[% selec.value | html %]</option>
 [% END %]
 </select>
 
@@ -545,20 +546,20 @@ canned reports and writing custom SQL reports.</p>
 <h1>Build a report</h1>
 <h3>Step 6 of 6: Choose how you want the report ordered</h3>
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-<input type="hidden" name="area" value="[% area %]" />
-<input type="hidden" name="type" value="[% type %]" />
-<input type="hidden" name="column" value="[% column %]" />
-<input type="hidden" name="criteria" value="[% criteriastring %]" />
-<input type="hidden" name="definition" value="[% definition %]" />
-<input type="hidden" name="totals" value="[% totals %]" />
-<input type="hidden" name="public" value="[% public %]" />
-<input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
+<input type="hidden" name="type" value="[% type | html %]" />
+<input type="hidden" name="column" value="[% column | html %]" />
+<input type="hidden" name="criteria" value="[% criteriastring | html %]" />
+<input type="hidden" name="definition" value="[% definition | html %]" />
+<input type="hidden" name="totals" value="[% totals | html %]" />
+<input type="hidden" name="public" value="[% public | html %]" />
+<input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
 <fieldset><table>[% FOREACH order_b IN order_by %]
-<tr><td><input type="checkbox" id="[% order_b.name %]" name="order_by" value="[% order_b.name %]" /> <label for="[% order_b.name %]">[% order_b.name %]</label></td><td>
-<select name="[% order_b.name %]_ovalue">
+<tr><td><input type="checkbox" id="[% order_b.name | html %]" name="order_by" value="[% order_b.name | html %]" /> <label for="[% order_b.name | html %]">[% order_b.name | html %]</label></td><td>
+<select name="[% order_b.name | html %]_ovalue">
 
 [% FOREACH selec IN order_b.select %]
-<option value="[% selec.value %]">[% selec.value %]</option>
+<option value="[% selec.value | html %]">[% selec.value | html %]</option>
 [% END %]
 </select>
 </td></tr>
@@ -577,14 +578,14 @@ canned reports and writing custom SQL reports.</p>
 <h1>Confirm custom report</h1>
 <p>Your report will be generated with the following SQL statement.</p>
 <p> 
-[% sql |html %]
+[% sql | html %]
 </p>
 
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post">
-<input type="hidden" name="sql" value="[% sql %]" />
-<input type="hidden" name="type" value="[% type %]" />
-<input type="hidden" name="public" value="[% public %]" />
-<input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+<input type="hidden" name="sql" value="[% sql | html %]" />
+<input type="hidden" name="type" value="[% type | html %]" />
+<input type="hidden" name="public" value="[% public | html %]" />
+<input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
 <p>You will need to save the report before you can execute it</p>
 <fieldset class="action"><input type="hidden" name="phase" value="Save" />  
 <input type="submit" name="submit" value="Save" />  </fieldset>
@@ -593,11 +594,11 @@ canned reports and writing custom SQL reports.</p>
 
 [% IF ( save ) %]
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" class="validated">
-<input type="hidden" name="sql" value="[% sql |html %]" />
-<input type="hidden" name="type" value="[% type %]" />
-<input type="hidden" name="area" value="[% area %]" />
-<input type="hidden" name="public" value="[% public %]" />
-<input type="hidden" name="cache_expiry" value="[% cache_expiry %]" />
+<input type="hidden" name="sql" value="[% sql | html %]" />
+<input type="hidden" name="type" value="[% type | html %]" />
+<input type="hidden" name="area" value="[% area | html %]" />
+<input type="hidden" name="public" value="[% public | html %]" />
+<input type="hidden" name="cache_expiry" value="[% cache_expiry | html %]" />
 <fieldset class="rows">
 <legend>Save your custom report</legend>
 <ol>
@@ -612,30 +613,30 @@ canned reports and writing custom SQL reports.</p>
 
 [% IF ( warn_authval_problem ) %]
     <div class="dialog alert">
-        <h3>Errors found when processing parameters for report: [% name %]</h3>
+        <h3>Errors found when processing parameters for report: [% name | html %]</h3>
         [% FOREACH problematic_authval IN problematic_authvals %]
             <p>
-            <strong>[% problematic_authval.name %]:</strong> The authorized value category (<strong>[% problematic_authval.authval %]</strong>)
+            <strong>[% problematic_authval.name | html %]:</strong> The authorized value category (<strong>[% problematic_authval.authval | html %]</strong>)
                 you selected does not exist.
             </p>
         [% END %]
         <!-- Save Anyway Form -->
         <form action='/cgi-bin/koha/reports/guided_reports.pl'>
         <!--Every parameter the user issued is provided as a hidden field for recovery-->
-            <input type='hidden' name='id' value='[% id %]' />
-            <input type='hidden' name='sql' value='[% sql %]' />
-            <input type='hidden' name='reportname' value='[% reportname %]' />
-            <input type='hidden' name='group' value='[% group %]' />
-            <input type='hidden' name='subgroup' value='[% subgroup %]' />
-            <input type='hidden' name='notes' value='[% notes %]' />
-            <input type='hidden' name='cache_expiry' value='[% cache_expiry %]' />
-            <input type='hidden' name='cache_expiry_units' value='[% cache_expiry_units %]' />
-            <input type='hidden' name='public' value='[% public %]' />
+            <input type='hidden' name='id' value='[% id | html %]' />
+            <input type='hidden' name='sql' value='[% sql | html %]' />
+            <input type='hidden' name='reportname' value='[% reportname | html %]' />
+            <input type='hidden' name='group' value='[% group | html %]' />
+            <input type='hidden' name='subgroup' value='[% subgroup | html %]' />
+            <input type='hidden' name='notes' value='[% notes | html %]' />
+            <input type='hidden' name='cache_expiry' value='[% cache_expiry | html %]' />
+            <input type='hidden' name='cache_expiry_units' value='[% cache_expiry_units | html %]' />
+            <input type='hidden' name='public' value='[% public | html %]' />
         [% IF ( phase_update) %]
             <input type='hidden' name='phase' value='Update SQL' />
             <button type="submit" name="save_anyway" value="Save anyway" class="approve"><i class="fa fa-fw fa-check"></i> Save anyway</button>
         [% ELSIF ( phase_save) %]
-            <input type='hidden' name='area' value='[% area %]' />
+            <input type='hidden' name='area' value='[% area | html %]' />
             <input type='hidden' name='phase' value='Save Report' />
             <button type="submit" name="save_anyway" value="Save anyway" class="approve"><i class="fa fa-fw fa-check"></i> Save anyway</button>
         [% END %]
@@ -649,14 +650,14 @@ canned reports and writing custom SQL reports.</p>
 
 [% IF ( enter_params ) %]
     <form action='/cgi-bin/koha/reports/guided_reports.pl'>
-        <input type='hidden' name='reports' value="[% reports %]" />
+        <input type='hidden' name='reports' value="[% reports | html %]" />
     [% IF ( auth_val_error ) %]
         <input type='hidden' name='phase' value='Edit SQL' />
         <div class="dialog alert">
-            <h3>Errors found when processing parameters for report: [% name %]</h3>
+            <h3>Errors found when processing parameters for report: [% name | html %]</h3>
             [% FOREACH auth_val_error IN auth_val_errors %]
                 <p>
-                    <strong>[% auth_val_error.entry %]:</strong> The authorized value category (<strong>[% auth_val_error.auth_val %]</strong>)
+                    <strong>[% auth_val_error.entry | html %]:</strong> The authorized value category (<strong>[% auth_val_error.auth_val | html %]</strong>)
                     you selected does not exist.
                 </p>
             [% END %]
@@ -664,23 +665,23 @@ canned reports and writing custom SQL reports.</p>
         <fieldset class="action"><input type="submit" value="Edit SQL" /></fieldset>
     [% ELSE %]
         <input type='hidden' name='phase' value='Run this report' />
-        <h1>Enter parameters for report [% name %]:</h1>
-        [% IF ( notes ) %]<p>[% notes %]</p>[% END %]
+        <h1>Enter parameters for report [% name | html %]:</h1>
+        [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
         <fieldset class="rows">
             <ol>
             [% FOREACH sql_param IN sql_params %]
-                <input name="param_name" value="[% sql_param.name %]" type="hidden" />
+                <input name="param_name" value="[% sql_param.name | html %]" type="hidden" />
                 [% IF sql_param.input == 'date' %]
                     <li>
-                    <label for="date_[% sql_param_entry %][% loop.count %]">[% sql_param.entry %]:</label> <input id="date_[% sql_param_entry %][% loop.count %]" type="text" value="" size="10" name="sql_params" class="datepicker" />
+                    <label for="date_[% sql_param_entry | html %][% loop.count | html %]">[% sql_param.entry | html %]:</label> <input id="date_[% sql_param_entry | html %][% loop.count | html %]" type="text" value="" size="10" name="sql_params" class="datepicker" />
                     </li>
                 [% ELSIF ( sql_param.input == 'text' ) %]
-                    <li><label for="sql_params[% loop.count %]">[% sql_param.entry %]: </label><input id="sql_params[% loop.count %]" type="text" name="sql_params" /></li>
+                    <li><label for="sql_params[% loop.count | html %]">[% sql_param.entry | html %]: </label><input id="sql_params[% loop.count | html %]" type="text" name="sql_params" /></li>
                 [% ELSE %]
-                    <li><label for="sql_params_[% sql_param.labelid %]">[% sql_param.entry %]:</label>
-                        <select name="[%- sql_param.input.name -%]" tabindex="1"  size="1" id="[%- sql_param.input.id -%]">
+                    <li><label for="sql_params_[% sql_param.labelid | html %]">[% sql_param.entry | html %]:</label>
+                        <select name="[%- sql_param.input.name | html -%]" tabindex="1"  size="1" id="[%- sql_param.input.id | html -%]">
                         [% FOREACH value IN sql_param.input.values %]
-                            <option value="[%- value -%]">[%- sql_param.input.labels.$value -%]</option>
+                            <option value="[%- value | html -%]">[%- sql_param.input.labels.$value | html -%]</option>
                         [% END %]
                         </select>
                     </li>
@@ -694,34 +695,34 @@ canned reports and writing custom SQL reports.</p>
 [% END %]
 
 [% IF ( execute ) %]
-<h1>[% name %]</h1>
-[% IF ( notes ) %]<p><span class="label">Notes:</span> [% notes %]</p>[% END %]
-[% IF ( unlimited_total ) %]<p><span class="label">Total number of results:</span> [% unlimited_total %][% IF unlimited_total > limit %] ([% limit %] shown)[% END %].</p>[% END %]
-<div id="sql_output" style="display:none;"><span class="label">Report SQL:</span><pre>[% sql |html %]</pre></div>
+<h1>[% name | html %]</h1>
+[% IF ( notes ) %]<p><span class="label">Notes:</span> [% notes | html %]</p>[% END %]
+[% IF ( unlimited_total ) %]<p><span class="label">Total number of results:</span> [% unlimited_total | html %][% IF unlimited_total > limit %] ([% limit | html %] shown)[% END %].</p>[% END %]
+<div id="sql_output" style="display:none;"><span class="label">Report SQL:</span><pre>[% sql | html %]</pre></div>
 </br>
 
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="get" id="limitselect">
     <input type="hidden" name="phase" value="Run this report"/>
-    <input type="hidden" name="reports" value="[% report_id %]"/>
+    <input type="hidden" name="reports" value="[% report_id | html %]"/>
 
     [% FOREACH p IN sql_params %]
-        <input type="hidden" name="sql_params" value="[% p %]"/>
+        <input type="hidden" name="sql_params" value="[% p | html %]"/>
     [% END %]
 
     <label for="limit">Rows per page: </label>
     <select name="limit" id="limit">
-        [% limits = [ 10, 20, 50, 100, 200, 300, 400, 500, 1000 ] %]
+        [% limits = [ 10, 20, 50, 100, 200, 300, 400, 500, 1000 ] | html %]
         [% FOREACH l IN limits %]
                 [% IF l == limit %]
-                    <option value="[% l %]" selected="selected">[% l %]</option>
+                    <option value="[% l | html %]" selected="selected">[% l | html %]</option>
                 [% ELSE %]
-                    <option value="[% l %]">[% l %]</option>
+                    <option value="[% l | html %]">[% l | html %]</option>
                 [% END %]
         [% END %]
     </select>
 </form>
 
-<div class="pages">[% pagination_bar %]</div>
+<div class="pages">[% pagination_bar | $raw %]</div>
 [% UNLESS ( errors ) %]
     <form method="POST" action="/cgi-bin/koha/tools/batchMod.pl" id="report_results">
         <input type="hidden" name="op" value="show" />
@@ -730,21 +731,21 @@ canned reports and writing custom SQL reports.</p>
                 [% FOREACH header_ro IN header_row %]
                     [% IF header_ro.cell == 'itemnumber' %]
                         <th>
-                            [% header_ro.cell %] <button type="submit" data-toggle="tooltip" title="Send visible items to batch modification" class="btn btn-xs btn-default send_to_item_mod"><i class="fa fa-pencil"></i> Batch modify</button>
+                            [% header_ro.cell | html %] <button type="submit" data-toggle="tooltip" title="Send visible items to batch modification" class="btn btn-xs btn-default send_to_item_mod"><i class="fa fa-pencil"></i> Batch modify</button>
                         </th>
                     [% ELSE %]
-                        <th>[% header_ro.cell %]</th>
+                        <th>[% header_ro.cell | html %]</th>
                     [% END %]
                 [% END %]
             </tr>
             [% FOREACH result IN results %]
                 <tr>
                     [% FOREACH cells IN result.cells %]
-                        [% place = loop.index %]
+                        [% place = loop.index | html %]
                         [% IF header_row.$place.cell == 'itemnumber' %]
                             <input type="hidden" name="[% header_row.$place.cell | html %]" value="[% cells.cell | html %]" />
                         [% END %]
-                        <td>[% cells.cell %]</td>
+                        <td>[% cells.cell | html %]</td>
                     [% END %]
                 </tr>
             [% END %]
@@ -775,7 +776,7 @@ $(document).ready(function() {
   <li><label for="public">Report is public:</label><select id="public" name="public"> <option value="0" selected="selected">No (default)</option> <option value="1">Yes</option> </select></li>
 [% END %]
 [% IF (usecache) %] <li>
-<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry %]"></input>
+<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry | html %]"></input>
 <select id="cache_expiry_units" name="cache_expiry_units">
 <option value="seconds" selected="selected">Seconds (default)</option>
 <option value="minutes">Minutes</option>
@@ -783,13 +784,13 @@ $(document).ready(function() {
 <option value="days">Days</option>
 </select>
 </li>[% END %]
-    <li><label for="notes">Notes:</label> <textarea id="notes" name="notes" cols="50" rows="2">[% notes %]</textarea></li>
+    <li><label for="notes">Notes:</label> <textarea id="notes" name="notes" cols="50" rows="2">[% notes | html %]</textarea></li>
 </ol>
 </fieldset>
 <fieldset class="rows">
 <legend>SQL:</legend>
 <div style="margin:1em;">
-<textarea id="sql" name="sql" class="required" required="required" cols="50" rows="10">[% sql %]</textarea> <span class="required">Required</span>
+<textarea id="sql" name="sql" class="required" required="required" cols="50" rows="10">[% sql | html %]</textarea> <span class="required">Required</span>
 </div>
 </fieldset>
 
@@ -801,13 +802,13 @@ $(document).ready(function() {
 
 [% IF saved_results %]
 <h1>Saved report results</h1>
-<h2>[% name %]</h2>
-<p>[% notes %]</p>
+<h2>[% name | html %]</h2>
+<p>[% notes | html %]</p>
 <table>
 [% FOREACH rows IN saved_results %]
 <tr>
 [% FOREACH col IN rows %]
-<td>[% col %]</td>
+<td>[% col | html %]</td>
 [% END %]
 <tr>
 [% END %]
@@ -816,10 +817,10 @@ $(document).ready(function() {
 
 [% IF ( showsql ) %]
 <fieldset class="rows">
-    <legend>[% reportname %]</legend>
+    <legend>[% reportname | html %]</legend>
     <ol>
-        [% IF ( notes ) %]<li><span class="label">Notes:</span> [% notes %]</li>[% ELSE %][% END %]
-        <li><textarea id="sql">[% sql %]</textarea></li>
+        [% IF ( notes ) %]<li><span class="label">Notes:</span> [% notes | html %]</li>[% ELSE %][% END %]
+        <li><textarea id="sql">[% sql | html %]</textarea></li>
     </ol>
 </fieldset>
 [% END %]
@@ -829,7 +830,7 @@ $(document).ready(function() {
 </br>
 <div id="report_updated">
     <div class="dialog message">
-        <p>Your report "[% reportname %]" has been saved</p>
+        <p>Your report "[% reportname | html %]" has been saved</p>
     </div>
 </div>
 [% END %]
@@ -838,7 +839,7 @@ $(document).ready(function() {
 [% IF ( editsql ) %]
 <form action="/cgi-bin/koha/reports/guided_reports.pl" method="post" class="validated">
 <input type="hidden" name="phase" value="Update SQL" />
-<input type="hidden" name="id" value="[% id %]"/>
+<input type="hidden" name="id" value="[% id | html %]"/>
 <fieldset class="rows">
 <legend>Edit SQL report</legend>
 <ol>
@@ -850,7 +851,7 @@ $(document).ready(function() {
   <li><label for="public">Report is public:</label><select id="public" name="public"> <option value="0" selected="selected">No (default)</option> <option value="1">Yes</option> </select></li>
 [% END %]
 [% IF (usecache) %] <li>
-<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry %]"></input>
+<label for="cache_expiry">Cache expiry:</label><input type="text" id="cache_expiry" name="cache_expiry" value="[% cache_expiry | html %]"></input>
 <select id="cache_expiry_units" name="cache_expiry_units">
 <option value="seconds">Seconds (default)</option>
 <option value="minutes">Minutes</option>
@@ -858,14 +859,14 @@ $(document).ready(function() {
 <option value="days">Days</option>
 </select>
 </li>[% END %]
-<li><label for="notes">Notes:</label><textarea id="notes" name="notes" cols="50" rows="2">[% notes %]</textarea></li>
+<li><label for="notes">Notes:</label><textarea id="notes" name="notes" cols="50" rows="2">[% notes | html %]</textarea></li>
 </ol>
 </fieldset>
 
 <fieldset class="rows">
     <legend>SQL:</legend>
     <div style="margin:1em;">
-        <textarea id="sql" name="sql" class="required" required="required" cols="50" rows="10">[% sql %]</textarea> <span class="required">Required</span>
+        <textarea id="sql" name="sql" class="required" required="required" cols="50" rows="10">[% sql | html %]</textarea> <span class="required">Required</span>
     </div>
 </fieldset>
 
@@ -882,10 +883,10 @@ $(document).ready(function() {
 <div class="dialog alert">
 <b>The following error was encountered:</b><br />
 [% FOREACH error IN errors %]
-    [% IF ( error.sqlerr ) %]This report contains the SQL keyword <b>[% error.sqlerr %]</b>.
+    [% IF ( error.sqlerr ) %]This report contains the SQL keyword <b>[% error.sqlerr | html %]</b>.
     <br />Use of this keyword is not allowed in Koha reports due to security and data integrity risks. Only SELECT queries are allowed.
     <br />Please return to the &quot;Saved Reports&quot; screen and delete this report or retry creating a new one.
-    [% ELSIF ( error.queryerr ) %]The database returned the following error: <br />[% error.queryerr %]<br />Please check the log for further details.
+    [% ELSIF ( error.queryerr ) %]The database returned the following error: <br />[% error.queryerr | html %]<br />Please check the log for further details.
     [% ELSIF ( error.cache_expiry ) %]Please select a cache expiry less than 30 days.
     [% ELSE %]
     [% END %]
@@ -911,12 +912,12 @@ $(document).ready(function() {
   <fieldset class="brief">
   <h3>Filter</h3>
   <ol>
-    <li><label for="filter_date">Date:</label> <input type="text" id="filter_date" name="filter_date" size="10" value="[% filters.date %]" class="datepicker" />
+    <li><label for="filter_date">Date:</label> <input type="text" id="filter_date" name="filter_date" size="10" value="[% filters.date | html %]" class="datepicker" />
     <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
 
     </li>
-    <li><label for="filter_author">Author:</label> <input type="text" id="filter_author" name="filter_author" value="[% filters.author %]" size="16" /></li>
-    <li><label for="filter_keyword">Keyword:</label> <input type="text" id="filter_keyword" name="filter_keyword" value="[% filters.keyword %]" size="16" /></li>
+    <li><label for="filter_author">Author:</label> <input type="text" id="filter_author" name="filter_author" value="[% filters.author | html %]" size="16" /></li>
+    <li><label for="filter_keyword">Keyword:</label> <input type="text" id="filter_keyword" name="filter_keyword" value="[% filters.keyword | html %]" size="16" /></li>
   </ol>
   </fieldset>
   <fieldset class="action">
@@ -942,11 +943,11 @@ $(document).ready(function() {
         var MSG_CONFIRM_DELETE = _("Are you sure you want to delete this report? This cannot be undone.");
         var group_subgroups = {};
         [% FOREACH group IN groups_with_subgroups %]
-            var gid = "[% group.id %]"
+            var gid = "[% group.id | html %]"
             group_subgroups[gid] = new Array();
             [% FOREACH subgroup IN group.subgroups %]
-                var sgid = "[% subgroup.id %]";
-                var sgname = "[% subgroup.name %]";
+                var sgid = "[% subgroup.id | html %]";
+                var sgname = "[% subgroup.name | html %]";
                 group_subgroups[gid].push([sgid, sgname]);
             [% END %]
         [% END %]
@@ -970,7 +971,7 @@ $(document).ready(function() {
         $(document).ready(function(){
 
             $('[data-toggle="tooltip"]').tooltip();
-            var columns_settings = [% ColumnsSettings.GetColumns( 'reports', 'saved-sql', 'table_reports', 'json' ) %];
+            var columns_settings = [% ColumnsSettings.GetColumns( 'reports', 'saved-sql', 'table_reports', 'json' ).raw %];
 
             $('#limit').change(function() {
                 $('#limitselect').submit();
@@ -995,7 +996,7 @@ $(document).ready(function() {
 
             [% IF (saved1) %]
                 var rtable = KohaTable("table_reports", {
-                    'iDisplayLength': [% Koha.Preference('NumSavedReports') %],
+                    'iDisplayLength': [% Koha.Preference('NumSavedReports') | html %],
                     'bAutoWidth': false,
                     'sPaginationType': 'four_button',
                     'aaSorting': [[ 1, "asc" ]],
@@ -1091,7 +1092,7 @@ $(document).ready(function() {
 
                 $("#update_sql").on("hidden.bs.modal", function(){
                     $("#update_sql_label").html("");
-                    $("#update_sql .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                    $("#update_sql .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
                 });
             [% END %]
 
@@ -1199,11 +1200,11 @@ $(document).ready(function() {
             <option value="">(None)</option>
             [% FOREACH group IN groups_with_subgroups %]
                 [% IF (group.selected) %]
-                    <option value="[% group.id %]" selected="selected">
+                    <option value="[% group.id | html %]" selected="selected">
                 [% ELSE %]
-                    <option value="[% group.id %]">
+                    <option value="[% group.id | html %]">
                 [% END %]
-                    [% group.name %]
+                    [% group.name | html %]
                 </option>
             [% END %]
         </select>
@@ -1223,11 +1224,11 @@ $(document).ready(function() {
                 [% IF (group.selected) %]
                     [% FOREACH subgroup IN group.subgroups %]
                         [% IF (subgroup.selected) %]
-                            <option value="[% subgroup.id %]" selected="selected">
+                            <option value="[% subgroup.id | html %]" selected="selected">
                         [% ELSE %]
-                            <option value="[% subgroup.id %]">
+                            <option value="[% subgroup.id | html %]">
                         [% END %]
-                            [% subgroup.name %]
+                            [% subgroup.name | html %]
                         </option>
                     [% END %]
                 [% END %]
index 32871a5..ff4bd40 100644 (file)
                [% IF ( mainloo.loopfilter ) %]
             <p>Filtered on:</p>
                        [% FOREACH loopfilte IN mainloo.loopfilter %]
-                                       <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit %] =[% loopfilte.filter %][% IF ( loopfilte.err ) %]  [% END %]</p>
+                                       <p>[% IF ( loopfilte.err ) %]  [% END %] [% loopfilte.crit | html %] =[% loopfilte.filter | html %][% IF ( loopfilte.err ) %]  [% END %]</p>
                        [% END %]
                [% END %]
                
                <table>
                        <tr>
-                               <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                               <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                                [% FOREACH loopco IN mainloo.loopcol %]
-                                       <th>[% loopco.coltitle %]</th>
+                                       <th>[% loopco.coltitle | html %]</th>
                                [% END %]
                                <th>TOTAL</th>
                        </tr>
                                [% FOREACH loopro IN mainloo.looprow %]
                                        <tr>
                                                [% IF ( loopro.hilighted ) %]<td class="hilighted">[% ELSE %]<td>[% END %]
-                                               [% loopro.rowtitle %]</td>
+                                               [% loopro.rowtitle | html %]</td>
                                                [% FOREACH loopcel IN loopro.loopcell %]
                                                        [% IF ( loopcel.hilighted ) %]<td class="hilighted">[% ELSE %]<td>[% END %]
-                                                               [% IF ( loopcel.value ) %][% loopcel.value %][% END %]
+                                                               [% IF ( loopcel.value ) %][% loopcel.value | html %][% END %]
                                                        </td>
                                                [% END %]
                                                [% IF ( loopro.hilighted ) %]<td>[% ELSE %]<td>[% END %]
-                                                       [% loopro.totalrow %]
+                                                       [% loopro.totalrow | html %]
                                                </td>
                                        </tr>
                                [% END %]
                                        <th>TOTAL</th>
                                        [% FOREACH loopfoote IN mainloo.loopfooter %]
                                                <th>
-                                                       [% loopfoote.totalcol %]
+                                                       [% loopfoote.totalcol | html %]
                                                </th>
                                        [% END %]
-                                       <th>[% mainloo.total %]</th>
+                                       <th>[% mainloo.total | html %]</th>
                                </tr>
                </table>
        [% END %]
                     <select name="Filter" size="1" id="borcat">
                         <option value=""></option>
                         [% FOREACH patron_category IN patron_categories %]
-                            <option value="[%- patron_category.categorycode -%]">[%- patron_category.description-%]</option>
+                            <option value="[%- patron_category.categorycode | html -%]">[%- patron_category.description | html -%]</option>
                         [% END %]
                     </select>
                 </td>
                     <select name="Filter" size="1" id="itemtypes">
                         <option value=""></option>
                         [% FOREACH itemtype IN itemtypes %]
-                        <option value="[%- itemtype.itemtype -%]">[%- itemtype.translated_description -%]</option>
+                        <option value="[%- itemtype.itemtype | html -%]">[%- itemtype.translated_description | html -%]</option>
                         [% END %]
                     </select>
                 </td>
                         <select name="Filter" size="1" id="sort1">
                             <option value=""></option>
                             [%- FOREACH value IN Sort1.values %]
-                            <option value="[%- value -%]">[%- value -%]</option>
+                            <option value="[%- value | html -%]">[%- value | html -%]</option>
                             [%- END %]
                         </select>
                     </td>
                         <select name="Filter" size="1" id="sort2">
                             <option value=""></option>
                             [%- FOREACH value IN Sort2.values %]
-                            <option value="[%- value -%]">[%- value -%]</option>
+                            <option value="[%- value | html -%]">[%- value | html -%]</option>
                             [%- END %]
                         </select>
                     </td>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="hidden" name="Filter" value="" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        <input type="submit" value="Submit" />
        </fieldset>
index f7ff19f..ee92ee7 100644 (file)
@@ -50,9 +50,9 @@
                     [% CASE 12 %]Holding library =
                     [% CASE 13 %]Patron library =
                     [% CASE 14 %]Issuing library =
-                    [% CASE %][% loopfilte.crit %] =
+                    [% CASE %][% loopfilte.crit | html %] =
                 [% END %]
-                [% loopfilte.filter %]
+                [% loopfilte.filter | html %]
                                </li>
             [% END %]
             </ul>
         
         <table> 
             <tr>
-                <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                 [% FOREACH loopco IN mainloo.loopcol %]
-                    <th>[% loopco.coltitle_display |html %]</th>
+                    <th>[% loopco.coltitle_display | html %]</th>
                 [% END %]
                 <th>TOTAL</th>
                 </tr>
                 [% FOREACH loopro IN mainloo.looprow %]
                     <tr>
-                        <td>[% loopro.rowtitle_display or "UNKNOWN VALUE" |html %]</td>
+                        <td>[% loopro.rowtitle_display or "UNKNOWN VALUE" | html %]</td>
                     [% FOREACH loopcel IN loopro.loopcell %]
-                                               <td>[% loopcel.value || 0 %]</td>
+                                               <td>[% loopcel.value || 0 | html %]</td>
                     [% END %]
-                                               <td>[% loopro.totalrow %]</td>
+                                               <td>[% loopro.totalrow | html %]</td>
                     </tr>
                 [% END %]
             <tr>
                 <th>TOTAL</th>
                 [% FOREACH loopfoote IN mainloo.loopfooter %]
-                <th>[% loopfoote.totalcol %]</th>
+                <th>[% loopfoote.totalcol | html %]</th>
                 [% END %]
-                <th>[% mainloo.total %]</th>
+                <th>[% mainloo.total | html %]</th>
             </tr>
         </table>
     [% END %]
            <td><select name="Filter" id="borcat">
                <option value=""> </option>
                [% FOREACH categoryloo IN categoryloop %]
-                 <option value="[% categoryloo.categorycode %]">[% categoryloo.description %]</option>
+                 <option value="[% categoryloo.categorycode | html %]">[% categoryloo.description | html %]</option>
                [% END %]
                </select>
              </td> 
            <td><select name="Filter" id="itemtype">
                <option value=""> </option>
                [% FOREACH itemtype IN itemtypes %]
-                 <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+                 <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                [% END %]
                </select>
              </td> 
             <td><select name="Filter" id="ccode">
                 <option value=""> </option>
                 [% FOREACH ccodeloo IN ccodeloop %]
-                    <option value="[% ccodeloo.code %]">[% ccodeloo.description %]</option>
+                    <option value="[% ccodeloo.code | html %]">[% ccodeloo.description | html %]</option>
                 [% END %]
                 </select>
             </td>
             <td><select name="Filter" id="location">
                 <option value=""> </option>
                 [% FOREACH locationloo IN locationloop %]
-                    <option value="[% locationloo.code %]">[% locationloo.description %]</option>
+                    <option value="[% locationloo.code | html %]">[% locationloo.description | html %]</option>
                 [% END %]
                </select>
             </td> 
                        <td><select name="Filter" id="sort1">
                <option value=""> </option>
                [% FOREACH Bsort IN Bsort1 %]
-                <option value="[% Bsort.authorised_value %]" >[% Bsort.lib %]</option>
+                <option value="[% Bsort.authorised_value | html %]" >[% Bsort.lib | html %]</option>
                [% END %]
                </select>
             </td> 
                <td><select name="Filter" id="sort2">
                <option value=""> </option>
                [% FOREACH Bsort IN Bsort2 %]
-                   <option value="[% Bsort.authorised_value %]" >[% Bsort.lib %]</option>
+                   <option value="[% Bsort.authorised_value | html %]" >[% Bsort.lib | html %]</option>
                [% END %]
                </select>
             </td> 
                 <select name="Filter" id="patronbranch">
                     <option value="">&nbsp;</option>
                     [% FOREACH branch IN branchloop %]
-                        <option value="[% branch.value %]">
-                            [% branch.branchname %]
+                        <option value="[% branch.value | html %]">
+                            [% branch.branchname | html %]
                         </option>
                     [% END %]
                 </select>
             [% FOREACH class IN attribute_types_by_class.keys.sort %]
                 [% IF (class) %]
                 <tr>
-                    <th>[% class %]</th>
+                    <th>[% class | html %]</th>
                     <th colspan="3"></th>
                 </tr>
                 [% END %]
                 [% FOREACH attr_type IN attribute_types_by_class.$class %]
                     <tr>
-                        <td>[% attr_type.description %]</td>
-                        <td><input type="radio" name="Line" value="borrower_attributes.[% attr_type.code %]" /> </td>
-                        <td><input type="radio" name="Column" value="borrower_attributes.[% attr_type.code %]" /> </td>
+                        <td>[% attr_type.description | html %]</td>
+                        <td><input type="radio" name="Line" value="borrower_attributes.[% attr_type.code | html %]" /> </td>
+                        <td><input type="radio" name="Column" value="borrower_attributes.[% attr_type.code | html %]" /> </td>
                         <td>
                             [% IF attr_type.authorised_value_category %]
-                                <select name="Filter_borrower_attributes.[% attr_type.code %]">
+                                <select name="Filter_borrower_attributes.[% attr_type.code | html %]">
                                     <option value="">&nbsp;</option>
                                     [% FOREACH av IN attr_type.authorised_values %]
-                                        <option value="[% av.authorised_value %]">
-                                            [% av.lib %]
+                                        <option value="[% av.authorised_value | html %]">
+                                            [% av.lib | html %]
                                         </option>
                                     [% END %]
                                 </select>
                             [% ELSE %]
-                                <input type="text" name="Filter_borrower_attributes.[% attr_type.code %]" />
+                                <input type="text" name="Filter_borrower_attributes.[% attr_type.code | html %]" />
                             [% END %]
                         </td>
                     </tr>
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index a8cb2ba..93ce0ba 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
@@ -8,7 +9,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Reports &rsaquo; Lost items</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="rep_itemslost" class="rep">
@@ -29,7 +30,7 @@
 
 <div class="results">
     [% IF items.count%]
-        [% items.count %] lost items found
+        [% items.count | html %] lost items found
     [% ELSE %]
         No lost items found
     [% END %]
@@ -46,8 +47,8 @@
                     Using the following CSV profile:
                     <select name="csv_profile_id" id="csv_profile_id">
                         [% FOREACH csv_profile IN csv_profiles %]
-                            <option value="[% csv_profile.export_format_id %]">
-                                [% csv_profile.profile %]
+                            <option value="[% csv_profile.export_format_id | html %]">
+                                [% csv_profile.profile | html %]
                             </option>
                         [% END %]
                     </select>
                     <tr>
                         [% IF csv_profiles.count %]
                             <td style="text-align:center;vertical-align:middle">
-                                <input type="checkbox" value="[% item.itemnumber %]" name="itemnumber" />
+                                <input type="checkbox" value="[% item.itemnumber | html %]" name="itemnumber" />
                             </td>
                         [% END %]
                         <td>
-                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblionumber %]" title="[% item.itemnotes %]">[% item.biblio.title |html %]</a>
+                            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item.biblionumber | html %]" title="[% item.itemnotes | html %]">[% item.biblio.title | html %]</a>
                         </td>
-                        <td>[% item.biblio.author %]</td>
-                        <td>[% AuthorisedValues.GetDescriptionByKohaField( kohafield => 'items.itemlost', authorised_value => item.itemlost ) %]
-                        <td><span title="[% item.itemlost_on %]">[% item.itemlost_on | $KohaDates %]</span></td>
+                        <td>[% item.biblio.author | html %]</td>
+                        <td>[% AuthorisedValues.GetDescriptionByKohaField( kohafield => 'items.itemlost', authorised_value => item.itemlost ) | html %]
+                        <td><span title="[% item.itemlost_on | html %]">[% item.itemlost_on | $KohaDates %]</span></td>
                         <td>
-                            <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% item.biblionumber %]" title="[% item.itemnotes %]">[% item.barcode %]</a>
+                            <a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% item.biblionumber | html %]" title="[% item.itemnotes | html %]">[% item.barcode | html %]</a>
                         </td>
-                        <td>[% item.itemcallnumber %]</td>
-                        <td><span title="[% item.datelastseen %]">[% item.datelastseen | $KohaDates %]</span></td>
-                        <td>[% item.price %]</td>
-                        <td>[% item.replacementprice %]</td>
-                        <td>[% Branches.GetName(item.homebranch) %]</td>
-                        <td>[% ItemTypes.GetDescription(item.effective_itemtype) %]</td>
-                        <td>[% Branches.GetName(item.holdingbranch) %]</td>
-                        <td>[% AuthorisedValues.GetByCode( 'LOC', item.location )%]</td>
-                        <td>[% AuthorisedValues.GetDescriptionByKohaField( kohafield => 'items.notforloan', authorised_value => item.notforloan ) %]
-                        <td>[% item.itemnotes %]</td>
+                        <td>[% item.itemcallnumber | html %]</td>
+                        <td><span title="[% item.datelastseen | html %]">[% item.datelastseen | $KohaDates %]</span></td>
+                        <td>[% item.price | html %]</td>
+                        <td>[% item.replacementprice | html %]</td>
+                        <td>[% Branches.GetName(item.homebranch) | html %]</td>
+                        <td>[% ItemTypes.GetDescription(item.effective_itemtype) | html %]</td>
+                        <td>[% Branches.GetName(item.holdingbranch) | html %]</td>
+                        <td>[% AuthorisedValues.GetByCode( 'LOC', item.location ) | html %]</td>
+                        <td>[% AuthorisedValues.GetDescriptionByKohaField( kohafield => 'items.notforloan', authorised_value => item.notforloan ) | html %]
+                        <td>[% item.itemnotes | html %]</td>
                     </tr>
                 [% END %]
             </tbody>
     <li><label for="itemtypesfilter">Item type: </label><select name="itemtypesfilter" id="itemtypesfilter">
                 <option value="">All</option>
                 [% FOREACH itemtype IN itemtypes %]
-                    <option value="[% itemtype.itemtype  %]">[% itemtype.translated_description %]</option>
+                    <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                 [% END %]
             </select></li>
 
             <option value="">All</option>
             [% FOREACH l IN AuthorisedValues.GetDescriptionsByKohaField( kohafield => 'items.itemlost') %]
                 [% IF l.authorised_value == lostfilter %]
-                    <option value="[% l.authorised_value %]" selected="selected">[% l.lib %]</option>
+                    <option value="[% l.authorised_value | html %]" selected="selected">[% l.lib | html %]</option>
                 [% ELSE %]
-                    <option value="[% l.authorised_value %]">[% l.lib %]</option>
+                    <option value="[% l.authorised_value | html %]">[% l.lib | html %]</option>
                 [% END %]
             [% END %]
         </select>
             <option value="">All</option>
             [% FOREACH n IN AuthorisedValues.GetDescriptionsByKohaField( kohafield => 'items.notforloan') %]
                 [% IF n.authorised_value == notforloanfilter %]
-                    <option value="[% n.authorised_value %]" selected="selected">[% n.lib %]</option>
+                    <option value="[% n.authorised_value | html %]" selected="selected">[% n.lib | html %]</option>
                 [% ELSE %]
-                    <option value="[% n.authorised_value %]">[% n.lib %]</option>
+                    <option value="[% n.authorised_value | html %]">[% n.lib | html %]</option>
                 [% END %]
             [% END %]
         </select>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") | $raw %]
     [% INCLUDE 'columns_settings.inc' %]
-    [% Asset.js("js/table_filters.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/table_filters.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type='text/javascript'>
         $(document).ready(function() {
-            var columns_settings = [% ColumnsSettings.GetColumns( 'reports', 'lostitems', 'lostitems-table', 'json' ) %];
+            var columns_settings = [% ColumnsSettings.GetColumns( 'reports', 'lostitems', 'lostitems-table', 'json' ).raw %];
             var lostitems_table = KohaTable("lostitems-table", {
                 "dom": 'B<"clearfix">t',
                 "aaSorting": [],
index d1cb134..61c8941 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE ItemTypes %]
@@ -6,7 +7,7 @@
 <title>Koha &rsaquo; Reports &rsaquo; Catalog by item types</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( do_it ) %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 </head>
 
@@ -24,7 +25,7 @@
 
 [% IF ( do_it ) %]
 [% FOREACH mainloo IN mainloop %]
-    <h1>Reports on item types [% IF branch %] held at [% Branches.GetName( branch ) %][% END %]</h1>
+    <h1>Reports on item types [% IF branch %] held at [% Branches.GetName( branch ) | html %][% END %]</h1>
        <table id="itemtypest">
                <thead>
                <tr>
                <tfoot>
                        <tr>
                                <th>TOTAL</th>
-                               <th>[% mainloo.total %]</th>
+                               <th>[% mainloo.total | html %]</th>
                        </tr>
                </tfoot>
                <tbody>
                        [% FOREACH loopitemtyp IN mainloo.loopitemtype %]
                                <tr>
-                    <td>[% ItemTypes.GetDescription( loopitemtyp.itemtype ) %]</td>
-                                       <td>[% loopitemtyp.count %]</td>
+                    <td>[% ItemTypes.GetDescription( loopitemtyp.itemtype ) | html %]</td>
+                                       <td>[% loopitemtyp.count | html %]</td>
                                </tr>
                        [% END %]
                </tbody>
@@ -64,7 +65,7 @@
             </ol>
           </fieldset>
           <fieldset class="action"><input type="submit" value="Submit" />
-            <input type="hidden" name="report_name" value="[% report_name %]" />
+            <input type="hidden" name="report_name" value="[% report_name | html %]" />
             <input type="hidden" name="do_it" value="1" />
           </fieldset>
         </form>
index edea6ad..1b1c4d4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Price %]
 [% SET footerjs = 1 %]
@@ -9,7 +10,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/reports/reports-home.pl">Reports</a>[% IF ( get_orders ) %] &rsaquo; <a href="/cgi-bin/koha/reports/orders_by_fund.pl">Orders by fund</a> &rsaquo; Results[% ELSE %] &rsaquo; Orders by fund[% END %]</div>
 
 <div id="doc3" class="yui-t2">
         <div id="yui-main">
         <div class="yui-b">
 
-[% IF ( current_budget_name ) %]<h1>Orders for fund '[% current_budget_name %]'</h1>
+[% IF ( current_budget_name ) %]<h1>Orders for fund '[% current_budget_name | html %]'</h1>
 [% ELSE %]<h1>Orders by fund</h1>
 [% END %]
 
 [% IF ( get_orders ) %]
     <div class="results">
         [% IF ( total ) %]
-            Orders found: [% total %]
+            Orders found: [% total | html %]
         [% ELSE %]
             No order found
         [% END %]
             [% UNLESS ( loop.odd ) %]<tr class="highlight">
             [% ELSE %] <tr>
             [% END %]
-            <td>[% ordersloo.budget_name |html %]</td>
-            <td><a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% ordersloo.basketno %]"> [% ordersloo.basketno |html %]</a></td>
-            <td>[% ordersloo.basketname |html %]</td>
-            <td>[% ordersloo.authorisedbyname %]</td>
-            <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ordersloo.biblionumber %]"> [% ordersloo.title |html %]</a></td>
-            <td>[% ordersloo.currency %]</td>
-            <td>[% ordersloo.listprice | $Price %]</td>
-            <td>[% ordersloo.rrp | $Price %]</td>
-            <td>[% ordersloo.ecost | $Price %]</td>
-            <td>[% ordersloo.quantity %]</td>
-            <td>[% ordersloo.total_rrp | $Price %]</td>
-            <td>[% ordersloo.total_ecost | $Price %]</td>
-            <td>[% ordersloo.entrydate %]</td>
-            <td>[% ordersloo.datereceived %]</td>
-            <td>[% ordersloo.order_internalnote |html %]</td>
-            <td>[% ordersloo.order_vendornote |html %]</td>
+            <td>[% ordersloo.budget_name | html %]</td>
+            <td><a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% ordersloo.basketno | html %]"> [% ordersloo.basketno | html %]</a></td>
+            <td>[% ordersloo.basketname | html %]</td>
+            <td>[% ordersloo.authorisedbyname | html %]</td>
+            <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% ordersloo.biblionumber | html %]"> [% ordersloo.title | html %]</a></td>
+            <td>[% ordersloo.currency | html %]</td>
+            <td>[% ordersloo.listprice | $Price | html %]</td>
+            <td>[% ordersloo.rrp | $Price | html %]</td>
+            <td>[% ordersloo.ecost | $Price | html %]</td>
+            <td>[% ordersloo.quantity | html %]</td>
+            <td>[% ordersloo.total_rrp | $Price | html %]</td>
+            <td>[% ordersloo.total_ecost | $Price | html %]</td>
+            <td>[% ordersloo.entrydate | html %]</td>
+            <td>[% ordersloo.datereceived | html %]</td>
+            <td>[% ordersloo.order_internalnote | html %]</td>
+            <td>[% ordersloo.order_vendornote | html %]</td>
             </tr>
         [% END %]
         </tbody>
-        <tfoot><tr><th>TOTAL</th><th></th><th></th><th></th><th></th><th></th><th></th><th></th><th></th><th>[% total_quantity  %]</th><th>[% total_rrp | $Price %]</th><th>[% total_ecost | $Price %]</th><th></th><th></th><th></th><th></th></tr></tfoot>
+        <tfoot><tr><th>TOTAL</th><th></th><th></th><th></th><th></th><th></th><th></th><th></th><th></th><th>[% total_quantity | html %]</th><th>[% total_rrp | $Price | html %]</th><th>[% total_ecost | $Price | html %]</th><th></th><th></th><th></th><th></th></tr></tfoot>
         </table>
     [% END %]
     [% ELSE %]
             <option value="activebudgets">All active funds</option>
         [% FOREACH budgetsloo IN budgetsloop %]
             [% IF ( budgetsloo.selected ) %]
-                <option value="[% budgetsloo.value %]" selected="selected">
+                <option value="[% budgetsloo.value | html %]" selected="selected">
             [% ELSE %]
-                [% bdgclass=budgetsloo.active? "": "b_inactive" %]
-                    <option class="[% bdgclass %]" value="[% budgetsloo.value %]">
+                [% bdgclass=budgetsloo.active? "": "b_inactive" | html %]
+                    <option class="[% bdgclass | html %]" value="[% budgetsloo.value | html %]">
             [% END %]
-            [% budgetsloo.description %] [% IF !budgetsloo.active %](inactive)[% END %]
+            [% budgetsloo.description | html %] [% IF !budgetsloo.active %](inactive)[% END %]
             </option>
         [% END %]
         </select>
                 <label class="inline" for="MIME">Into an application </label>
                 <select id='MIME' name='MIME' size='1'>
                 [% FOREACH outputFormatloo IN outputFormatloop %]
-                    <option value="[% outputFormatloo %]">[% outputFormatloo %]</option>
+                    <option value="[% outputFormatloo | html %]">[% outputFormatloo | html %]</option>
                 [% END %]
                 </select>
                 <select id='sep' name='sep' size='1'>
                 [% FOREACH delimiterloo IN delimiterloop %]
                     [% IF delimiterloo == delimiterPreference %]
-                        <option value="[% delimiterloo %]">[% delimiterloo %]</option>
+                        <option value="[% delimiterloo | html %]">[% delimiterloo | html %]</option>
                     [% END %]
                 [% END %]
                 [% FOREACH delimiterloo IN delimiterloop %]
                     [% IF delimiterloo != delimiterPreference %]
-                        <option value="[% delimiterloo %]">[% delimiterloo %]</option>
+                        <option value="[% delimiterloo | html %]">[% delimiterloo | html %]</option>
                     [% END %]
                 [% END %]
                 </select>
index 3837eaa..20be414 100644 (file)
@@ -89,7 +89,7 @@
 
 </div>
     <div class="col-md-12" id="intranet-reports-home-html">
-        [% Koha.Preference('IntranetReportsHomeHTML') %]
+        [% Koha.Preference('IntranetReportsHomeHTML') | html %]
     </div>
 </div>
 [% INCLUDE 'intranet-bottom.inc' %]
index 0a10c00..9465e53 100644 (file)
@@ -31,7 +31,7 @@
                                [% ELSIF ( loopfilte.sql ) %]<li class="sql">
                                [% ELSE %]<li>
                                [% END %]
-                                       [% loopfilte.crit %] [% loopfilte.filter %]
+                                       [% loopfilte.crit | html %] [% loopfilte.filter | html %]
                                </li>
             [% END %]
             </ul>
         
         <table> 
             <tr>
-                <th>[% mainloo.line %] / [% mainloo.column %]</th>
+                <th>[% mainloo.line | html %] / [% mainloo.column | html %]</th>
                 [% FOREACH loopco IN mainloo.loopcol %]
-                    <th>[% loopco.coltitle_display |html %]</th>
+                    <th>[% loopco.coltitle_display | html %]</th>
                 [% END %]
                 <th>TOTAL</th>
                 </tr>
                 [% FOREACH loopro IN mainloo.looprow %]
                     <tr>
-                        <td>[% loopro.rowtitle_display or "UNKNOWN VALUE" |html %]</td>
+                        <td>[% loopro.rowtitle_display or "UNKNOWN VALUE" | html %]</td>
                     [% FOREACH loopcel IN loopro.loopcell %]
                                                <td align="center">
-                                               [% IF ( loopcel.url_complement ) %]<a href="reserves_stats.pl?output=[% loopcel.output %]&amp;[% loopcel.url_complement %]">[% loopcel.value %]</a>[% ELSE %][% loopcel.value %][% END %]
+                                               [% IF ( loopcel.url_complement ) %]<a href="reserves_stats.pl?output=[% loopcel.output | html %]&amp;[% loopcel.url_complement | html %]">[% loopcel.value | html %]</a>[% ELSE %][% loopcel.value | html %][% END %]
                                                </td>
                     [% END %]
-                                               <td align="center">[% loopro.totalrow %]</td>
+                                               <td align="center">[% loopro.totalrow | html %]</td>
                     </tr>
                 [% END %]
             <tr>
                 <th>TOTAL</th>
                 [% FOREACH loopfoote IN mainloo.loopfooter %]
-                <th>[% loopfoote.totalcol %]</th>
+                <th>[% loopfoote.totalcol | html %]</th>
                 [% END %]
-                <th>[% mainloo.total %]</th>
+                <th>[% mainloo.total | html %]</th>
             </tr>
         </table>
     [% END %]
            <td><select name="filter_categorycode" id="borcat">
                <option value=""> </option>
                [% FOREACH categoryloo IN categoryloop %]
-                 <option value="[% categoryloo.categorycode %]">[% categoryloo.description %]</option>
+                 <option value="[% categoryloo.categorycode | html %]">[% categoryloo.description | html %]</option>
                [% END %]
                </select>
              </td> 
            <td><select name="filter_items.itype" id="itype">
                <option value=""> </option>
                [% FOREACH itemtype IN itemtypes %]
-                 <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+                 <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                [% END %]
                </select>
              </td> 
             <td><select name="filter_items.ccode" id="ccode">
                 <option value=""> </option>
                 [% FOREACH ccodeloo IN ccodeloop %]
-                                       [% IF ( ccodeloo.selected ) %] <option value="[% ccodeloo.code %]" selected="selected">[% ccodeloo.description %]</option>[% ELSE %]<option value="[% ccodeloo.code %]">[% ccodeloo.description %]</option>[% END %]
+                                       [% IF ( ccodeloo.selected ) %] <option value="[% ccodeloo.code | html %]" selected="selected">[% ccodeloo.description | html %]</option>[% ELSE %]<option value="[% ccodeloo.code | html %]">[% ccodeloo.description | html %]</option>[% END %]
                 [% END %]
                 </select>
             </td>
             <td><select name="filter_items.location" id="location">
                 <option value=""> </option>
                 [% FOREACH locationloo IN locationloop %]
-                                       [% IF ( locationloo.selected ) %]<option value="[% locationloo.code %]" selected="selected">[% locationloo.description %]</option>[% ELSE %]<option value="[% locationloo.code %]">[% locationloo.description %]</option>[% END %]
+                                       [% IF ( locationloo.selected ) %]<option value="[% locationloo.code | html %]" selected="selected">[% locationloo.description | html %]</option>[% ELSE %]<option value="[% locationloo.code | html %]">[% locationloo.description | html %]</option>[% END %]
                                [% END %]
                </select>
             </td> 
                        <td><select name="filter_borrowers.sort1" id="sort1">
                <option value=""> </option>
                [% FOREACH Bsort IN Bsort1 %]
-                          [% IF ( Bsort.selected ) %]<option value="[% Bsort.authorised_value %]" selected="selected">[% Bsort.lib %]</option>[% ELSE %]<option value="[% Bsort.authorised_value %]" >[% Bsort.lib %]</option>[% END %]
+                          [% IF ( Bsort.selected ) %]<option value="[% Bsort.authorised_value | html %]" selected="selected">[% Bsort.lib | html %]</option>[% ELSE %]<option value="[% Bsort.authorised_value | html %]" >[% Bsort.lib | html %]</option>[% END %]
                [% END %]
                </select>
             </td> 
                <td><select name="filter_borrowers.sort2" id="sort2">
                <option value=""> </option>
                [% FOREACH Bsort IN Bsort2 %]
-                          [% IF ( Bsort.selected ) %]<option value="[% Bsort.authorised_value %]" selected="selected">[% Bsort.lib %]</option>[% ELSE %]<option value="[% Bsort.authorised_value %]" >[% Bsort.lib %]</option>[% END %]
+                          [% IF ( Bsort.selected ) %]<option value="[% Bsort.authorised_value | html %]" selected="selected">[% Bsort.lib | html %]</option>[% ELSE %]<option value="[% Bsort.authorised_value | html %]" >[% Bsort.lib | html %]</option>[% END %]
                [% END %]
                </select>
             </td> 
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index 25af72f..e56e244 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -8,7 +9,7 @@
 <style type="text/css">
        .sql {display: none;}
 </style>
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="rep_serials_stats" class="rep">
                <tbody>
                        <tr>
                                [% FOREACH data IN datas %]
-                    <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% data.aqbooksellerid %]">[% data.name %]</a></td>
-                    <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% data.subscriptionid %]">[% data.title |html %]</a></td>
-                                       <td>[% data.subscriptionid %]</td>
-                    <td>[% Branches.GetName( data.branchcode ) %]</td>
-                                       <td>[% data.callnumber %]</td>
-                    <td><span title="[% data.startdate %]">[% data.startdate | $KohaDates %]</span></td>
-                    <td><span title="[% data.enddate %]">[% data.enddate | $KohaDates %]</span></td>
+                    <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% data.aqbooksellerid | html %]">[% data.name | html %]</a></td>
+                    <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% data.subscriptionid | html %]">[% data.title | html %]</a></td>
+                                       <td>[% data.subscriptionid | html %]</td>
+                    <td>[% Branches.GetName( data.branchcode ) | html %]</td>
+                                       <td>[% data.callnumber | html %]</td>
+                    <td><span title="[% data.startdate | html %]">[% data.startdate | $KohaDates %]</span></td>
+                    <td><span title="[% data.enddate | html %]">[% data.enddate | $KohaDates %]</span></td>
                     <td>
                         [% IF data.closed %]
                             Closed
@@ -73,7 +74,7 @@
                                <select name="bookseller" id="bookseller">
                     <option value="">Any vendor</option>
                                [% FOREACH bookseller IN booksellers %]
-                                               <option value="[% bookseller.aqbooksellerid %]">[% bookseller.name %]</option>
+                                               <option value="[% bookseller.aqbooksellerid | html %]">[% bookseller.name | html %]</option>
                                        [% END %]
                            </select>
                        </li><li>
             <label class="inline" for="MIME">Into an application:</label>
             <select name="MIME" id="MIME" size="1">
             [% FOREACH value IN CGIextChoice %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
             [% END %]
             </select>
             <select name="sep" id="sep" size="1">
             [% FOREACH value IN CGIsepChoice.values.sort() %]
               [% IF ( value == CGIsepChoice.default ) %]
-                <option value="[% value %]" selected="selected">[% value %]</option>
+                <option value="[% value | html %]" selected="selected">[% value | html %]</option>
               [% ELSE %]
-                <option value="[% value %]">[% value %]</option>
+                <option value="[% value | html %]">[% value | html %]</option>
               [% END %]
             [% END %]
             </select>
 
        <fieldset class="action">
        <input type="submit" value="Submit" />
-       <input type="hidden" name="report_name" value="[% report_name %]" />
+       <input type="hidden" name="report_name" value="[% report_name | html %]" />
        <input type="hidden" name="do_it" value="1" />
        </fieldset>
        </form>
index 2b435d2..212c205 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -7,12 +8,12 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 [% UNLESS ( multi_hold ) %]
-    <title>Koha &rsaquo; Circulation &rsaquo; Holds &rsaquo; Place a hold on [% title |html %]</title>
+    <title>Koha &rsaquo; Circulation &rsaquo; Holds &rsaquo; Place a hold on [% title | html %]</title>
 [% ELSE %]
     <title>Koha &rsaquo; Circulation &rsaquo; Holds &rsaquo; Confirm holds</title>
 [% END %]
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="circ_request" class="catalog">
@@ -20,7 +21,7 @@
 [% INCLUDE 'circ-search.inc' %]
 
 [% UNLESS ( multi_hold ) %]
-    <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">[% title |html %]</a> &rsaquo; Place a hold on [% title |html %]</div>
+    <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">[% title | html %]</a> &rsaquo; Place a hold on [% title | html %]</div>
 [% ELSE %]
     <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/catalogue/search.pl">Catalog</a> &rsaquo; Confirm holds</div>
 [% END %]
@@ -42,8 +43,8 @@
 
   [% IF ( messagetransfert ) %]
                <div class="dialog message">
-                               <h2>Hold found for ([% nextreservtitle %]), please transfer</h2>
-                       <p>Hold placed by : <strong> [% nextreservsurname %] [% nextreservfirstname %]</strong> at : <strong> [% branchname %] </strong>, Please transfer this item.
+                               <h2>Hold found for ([% nextreservtitle | html %]), please transfer</h2>
+                       <p>Hold placed by : <strong> [% nextreservsurname | html %] [% nextreservfirstname | html %]</strong> at : <strong> [% branchname | html %] </strong>, Please transfer this item.
                        </p>
                        <form name="cancelReservewithtransfert" action="branchreserves.pl" method="post">
                                <input type="submit" class="button" />
@@ -52,7 +53,7 @@
   [% END %]
 
   [% UNLESS ( multi_hold ) %]
-    <h1>Place a hold on [% INCLUDE 'biblio-default-view.inc' %][% title |html %]</a></h1>
+    <h1>Place a hold on [% INCLUDE 'biblio-default-view.inc' %][% title | html %]</a></h1>
   [% ELSE %]
     <h1>Confirm holds</h1>
   [% END %]
@@ -61,7 +62,7 @@
     [% IF ( messageborrower ) %]
       <div class="dialog alert"><h3>Patron not found</h3><p>No patron with this name, please, try another</p> </div>
     [% END %]
-    <form  id="holds_patronsearch" action="request.pl?biblionumber=[% biblionumber %]" method="post">
+    <form  id="holds_patronsearch" action="request.pl?biblionumber=[% biblionumber | html %]" method="post">
         <fieldset id="circ_holds_selectborrower" class="brief">
 
         [% UNLESS borrowers %]
                 <input type="text" size="40" id="patron" class="focus" name="findborrower" />
                 <input type="submit" value="Search" />
             [% IF multi_hold %]
-                <input type="hidden" name="multi_hold" value="[% multi_hold %]"/>
-                <input type="hidden" name="biblionumbers" value="[% biblionumbers %]"/>
+                <input type="hidden" name="multi_hold" value="[% multi_hold | html %]"/>
+                <input type="hidden" name="biblionumbers" value="[% biblionumbers | html %]"/>
             [% ELSE %]
-                <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+                <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
             [% END %]
             </fieldset>
         [% ELSE %]
@@ -82,8 +83,8 @@
 
         [% END %]
         [% IF ( multi_hold ) %]
-            <input type="hidden" name="multi_hold" value="[% multi_hold %]"/>
-            <input type="hidden" name="biblionumbers" value="[% biblionumbers %]"/>
+            <input type="hidden" name="multi_hold" value="[% multi_hold | html %]"/>
+            <input type="hidden" name="biblionumbers" value="[% biblionumbers | html %]"/>
         [% END %]
     </form>
   [% ELSIF NOT noitems %]
       <h3>Cannot place hold</h3>
       <ul>
         [% IF ( exceeded_maxreserves ) %]
-          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] </a> can only place a maximum of [% maxreserves %] total holds.</li>
+          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] </a> can only place a maximum of [% maxreserves | html %] total holds.</li>
         [% ELSIF ( exceeded_holds_per_record ) %]
-          <li><strong>Too many holds for this record: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] </a> can only place a maximum of [% max_holds_for_record %] hold(s) on this record.</li>
+          <li><strong>Too many holds for this record: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] </a> can only place a maximum of [% max_holds_for_record | html %] hold(s) on this record.</li>
         [% ELSIF ( alreadypossession ) %]
-          <li> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a> <strong>is already in possession</strong> of one item.</li>
+          <li> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a> <strong>is already in possession</strong> of one item.</li>
         [% ELSIF ( alreadyreserved ) %]
-          <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a> <strong>already has a hold</strong> on this item.</li>
+          <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a> <strong>already has a hold</strong> on this item.</li>
         [% ELSIF ( ageRestricted ) %]
           <li><strong>Age restricted</strong></li>
         [% ELSIF ( none_available ) %]
           <li> <strong>No items are available</strong> to be placed on hold.</li>
         [% ELSIF ( maxreserves ) %]
-          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] </a> has too many holds.</li>
+          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] </a> has too many holds.</li>
         [% END %]
       </ul>
     [% ELSE %]
         <h3>Cannot place hold on some items</h3>
         [% IF ( exceeded_maxreserves ) %]
-          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] </a> can place [% new_reserves_allowed %] of the requested [% new_reserves_count %] holds for a maximum of [% maxreserves %] total holds.</li>
+          <li><strong>Too many holds: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] </a> can place [% new_reserves_allowed | html %] of the requested [% new_reserves_count | html %] holds for a maximum of [% maxreserves | html %] total holds.</li>
         [% ELSIF ( exceeded_holds_per_record ) %]
             [% FOREACH biblioloo IN biblioloop %]
                 [% IF (biblioloo.tooManyHoldsForThisRecord) %]
-                    <li><strong>Too many holds for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber %]"> [% biblioloo.title %]</a>: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] </a> can only place a maximum of [% max_holds_for_record %] hold(s) on this record.</li>
+                    <li><strong>Too many holds for <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber | html %]"> [% biblioloo.title | html %]</a>: </strong> <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] </a> can only place a maximum of [% max_holds_for_record | html %] hold(s) on this record.</li>
                 [% END %]
             [% END %]
         [% END %]
 [% IF ( expiry || diffbranch || patron.is_debarred || ( amount_outstanding && Koha.Preference('maxoutstanding') && amount_outstanding > Koha.Preference('maxoutstanding') ) ) %]
 <div class="dialog message"><ul>
     [% IF ( expiry ) %]
-    <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a>: <strong>Account has expired</strong></li>
+    <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a>: <strong>Account has expired</strong></li>
     [% END %]
 
     [% IF patron.is_debarred %]
-    <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]#reldebarments">[% patron.firstname %] [% patron.surname %]</a>: <strong>Patron has restrictions</strong></li>
+    <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]#reldebarments">[% patron.firstname | html %] [% patron.surname | html %]</a>: <strong>Patron has restrictions</strong></li>
     [% END %]
 
     [% IF amount_outstanding && Koha.Preference('maxoutstanding') && amount_outstanding > Koha.Preference('maxoutstanding') %]
-    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a>: <strong>Patron has outstanding fines: [% amount_outstanding | format('%.2f') %]</strong></li>
+    <li><a href="/cgi-bin/koha/members/pay.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a>: <strong>Patron has outstanding fines: [% amount_outstanding | format('%.2f') %]</strong></li>
     [% END %]
 
     [% IF ( diffbranch ) %]
-    <li> <strong>Pickup library is different. </strong>Patron: <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a> Patron's home library: ([% Branches.GetName(patron.branchcode) %] / [% patron.branchcode %] )</li>
+    <li> <strong>Pickup library is different. </strong>Patron: <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a> Patron's home library: ([% Branches.GetName(patron.branchcode) | html %] / [% patron.branchcode | html %] )</li>
     [% END %]
 
 </ul></div>
             <form action="placerequest.pl" method="post" onsubmit="return checkMultiHold();" name="form">
         [% END %]
 
-        <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber %]" />
+        <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]" />
         <input type="hidden" name="type" value="str8" />
 
         [% IF ( multi_hold ) %]
-            <input type="hidden" name="multi_hold" value="[% multi_hold %]"/>
-            <input type="hidden" name="biblionumbers" id="multi_hold_bibs" value="[% biblionumbers %]"/>
+            <input type="hidden" name="multi_hold" value="[% multi_hold | html %]"/>
+            <input type="hidden" name="biblionumbers" id="multi_hold_bibs" value="[% biblionumbers | html %]"/>
             <input type="hidden" name="bad_bibs" id="bad_bibs" value=""/>
             <input type="hidden" name="request" value="any"/>
             [% FOREACH biblioloo IN biblioloop %]
-              <input type="hidden" name="title_[% biblioloo.biblionumber %]" value="[% biblioloo.title |html %]"/>
-              <input type="hidden" name="rank_[% biblioloo.biblionumber %]" value="[% biblioloo.rank %]"/>
+              <input type="hidden" name="title_[% biblioloo.biblionumber | html %]" value="[% biblioloo.title | html %]"/>
+              <input type="hidden" name="rank_[% biblioloo.biblionumber | html %]" value="[% biblioloo.rank | html %]"/>
             [% END %]
         [% ELSE %]
-            <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
-            <input type="hidden" name="title" value="[% title |html %]" />
-            <input type="hidden" name="rank-request" value="[% fixedRank %]" />
+            <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+            <input type="hidden" name="title" value="[% title | html %]" />
+            <input type="hidden" name="rank-request" value="[% fixedRank | html %]" />
         [% END %]
 
        <ol> <li><span class="label">Patron:</span>
             [% IF ( patron.borrowernumber ) %]
-                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %] ([% patron.cardnumber %])</a>
+                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %] ([% patron.cardnumber | html %])</a>
             [% ELSE %]
                 Not defined yet
             [% END %]
         [% UNLESS ( multi_hold ) %]
           <li>
               <span class="label">Estimated priority:</span>
-              <strong>[% fixedRank %]</strong>
+              <strong>[% fixedRank | html %]</strong>
           </li>
         [% END %]
         <li>
                     <select name="itemtype" size="1" id="itemtype">
                         <option value="">Any item type</option>
                         [%- FOREACH itemtype IN available_itemtypes %]
-                            <option value="[% itemtype %]">[% ItemTypes.GetDescription( itemtype ) %]</option>
+                            <option value="[% itemtype | html %]">[% ItemTypes.GetDescription( itemtype ) | html %]</option>
                         [%- END %]
                     </select>
                 </li>
                [% ELSE %]
                    <input type="checkbox" id="requestany" name="request" checked="checked" value="Any" />
                 [% END %]
-               <input type="hidden" name="biblioitem" value="[% biblioitemnumber %]" />
-               <input type="hidden" name="alreadyreserved" value="[% alreadyreserved %]" />
+               <input type="hidden" name="biblioitem" value="[% biblioitemnumber | html %]" />
+               <input type="hidden" name="alreadyreserved" value="[% alreadyreserved | html %]" />
           </li>
 
           [% IF remaining_holds_for_record > 1 %]
               <li>
                    <label for="holds_to_place_count">Holds to place (count)</label>
-                   <input type="number" name="holds_to_place_count" min="1" max="[% remaining_holds_for_record %]" step="1" value="1" />
+                   <input type="number" name="holds_to_place_count" min="1" max="[% remaining_holds_for_record | html %]" step="1" value="1" />
               </li>
             [% ELSE %]
                 <input type="hidden" name="holds_to_place_count" value="1" />
         [% FOREACH bibitemloo IN bibitemloop %]
           <ol>
             [% UNLESS ( item_level_itypes ) %]
-              <li><span class="label">Item type:</span> [% bibitemloo.description %]</li>
+              <li><span class="label">Item type:</span> [% bibitemloo.description | html %]</li>
             [% END %]
 
-            [% IF ( bibitemloo.publicationyear ) %]<li><span class="label">Publication year:</span> [% bibitemloo.publicationyear %]</li>[% END %]
+            [% IF ( bibitemloo.publicationyear ) %]<li><span class="label">Publication year:</span> [% bibitemloo.publicationyear | html %]</li>[% END %]
           </ol>
 
         <h2 style="padding: 0 1em;">
             [% SET selected = 0 %]
             [% FOREACH itemloo IN bibitemloo.itemloop %]
             [% UNLESS ( itemloo.hide ) %]
-                <tr class="[% itemloo.backgroundcolor %]">
+                <tr class="[% itemloo.backgroundcolor | html %]">
                     <td>
                 [% IF itemloo.force_hold_level == 'record' # Patron has placed a record level hold previously for this record %]
                     <span class="error">
                         Hold must be record level
                     </span>
                 [% ELSIF ( itemloo.available ) %]
-                    <input type="radio" name="checkitem" value="[% itemloo.itemnumber %]" />
+                    <input type="radio" name="checkitem" value="[% itemloo.itemnumber | html %]" />
                 [% ELSIF ( itemloo.override ) %]
-                    <input type="radio" name="checkitem" class="needsoverride" value="[% itemloo.itemnumber %]" />
+                    <input type="radio" name="checkitem" class="needsoverride" value="[% itemloo.itemnumber | html %]" />
                     <i class="fa fa-exclamation-triangle fa-lg" style="color:gold" alt="Requires override of hold policy"/></i>
                 [% ELSE %]
                     <span class="error">
                             [% ELSIF itemloo.not_holdable == 'itemAlreadyOnHold' %]
                                 Patron already has hold for this item
                             [% ELSE %]
-                                [% itemloo.not_holdable %]
+                                [% itemloo.not_holdable | html %]
                             [% END %]
                         [% END %]
                     </span>
                 [% IF ( item_level_itypes ) %]
                     <td>
                     [% UNLESS ( noItemTypeImages ) %]
-                        [% IF ( itemloo.imageurl ) %]<img src="[% itemloo.imageurl %]" alt="" /> <br /> [% END %]
+                        [% IF ( itemloo.imageurl ) %]<img src="[% itemloo.imageurl | html %]" alt="" /> <br /> [% END %]
                     [% END %]
-                        [% itemloo.itypename %]
+                        [% itemloo.itypename | html %]
                     </td>
                 [% END %]
 
                     <td>
-                        [% itemloo.barcode %]
+                        [% itemloo.barcode | html %]
                     </td>
                     <td>
-                        [% Branches.GetName( itemloo.homebranch ) %]
+                        [% Branches.GetName( itemloo.homebranch ) | html %]
                     </td>
                     <td>
-                        [% Branches.GetName( itemloo.holdingbranch ) %]
+                        [% Branches.GetName( itemloo.holdingbranch ) | html %]
                     </td>
                     <td>
-                        [% itemloo.itemcallnumber %]
+                        [% itemloo.itemcallnumber | html %]
                     </td>
                     <td>
-                        [% IF ( itemloo.copynumber ) %][% itemloo.copynumber %][% ELSE %]&nbsp;[% END %]
+                        [% IF ( itemloo.copynumber ) %][% itemloo.copynumber | html %][% ELSE %]&nbsp;[% END %]
                     </td>
                 [% IF itemdata_enumchron %]
                     <td>
-                        [% itemloo.enumchron %]
+                        [% itemloo.enumchron | html %]
                     </td>
                 [% END %]
                     <td>
                 [% IF ( itemloo.onloan ) %]
-                    <span title="[% itemloo.date_due %]" class="checkedout">Due [% itemloo.date_due | $KohaDates as_due_date => 1 %]</span>
+                    <span title="[% itemloo.date_due | html %]" class="checkedout">Due [% itemloo.date_due | $KohaDates as_due_date => 1 | html %]</span>
                 [% ELSE %]
                     <span title="0000-00-00">
                         [% IF ( itemloo.transfertwhen ) %]
-                            In transit from [% Branches.GetName( itemloo.transfertfrom ) %],
-                            to [% Branches.GetName( itemloo.transfertto ) %], since [% itemloo.transfertwhen %]
+                            In transit from [% Branches.GetName( itemloo.transfertfrom ) | html %],
+                            to [% Branches.GetName( itemloo.transfertto ) | html %], since [% itemloo.transfertwhen | html %]
                         [% END %]
                     </span>
                 [% END %]
                 [% END %]
 
                 [% IF ( itemloo.notforloan ) %]
-                   Not for loan ([% itemloo.notforloanvalue %])
+                   Not for loan ([% itemloo.notforloanvalue | html %])
                 [% END %]
 
                 [% IF ( itemloo.reservedate ) %]
                             Can't be cancelled when item is in transit
                     [% ELSE %]
                     [% IF ( itemloo.waitingdate ) %]Waiting[% ELSE %]On hold[% END %]
-                    [% IF ( itemloo.canreservefromotherbranches ) %]for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% itemloo.ReservedFor.borrowernumber %]">[% itemloo.ReservedFor.firstname %] [% itemloo.ReservedFor.surname %]</a>[% END %] [% IF ( itemloo.waitingdate ) %]at[% ELSE %]expected at[% END %] [% Branches.GetName( itemloo.ExpectedAtLibrary ) %]
+                    [% IF ( itemloo.canreservefromotherbranches ) %]for <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% itemloo.ReservedFor.borrowernumber | html %]">[% itemloo.ReservedFor.firstname | html %] [% itemloo.ReservedFor.surname | html %]</a>[% END %] [% IF ( itemloo.waitingdate ) %]at[% ELSE %]expected at[% END %] [% Branches.GetName( itemloo.ExpectedAtLibrary ) | html %]
                     since
-                    [% IF ( itemloo.waitingdate ) %][% itemloo.waitingdate | $KohaDates %][% ELSE %][% IF ( itemloo.reservedate ) %][% itemloo.reservedate %][% END %][% END %]. <a class="info" href="modrequest.pl?CancelBiblioNumber=[% itemloo.biblionumber %]&amp;CancelBorrowerNumber=[% itemloo.ReservedFor.borrowernumber %]&amp;CancelItemnumber=[% itemloo.itemnumber %]"  onclick="return confirmDelete(MSG_CONFIRM_DELETE_HOLD);">Cancel hold</a>
+                    [% IF ( itemloo.waitingdate ) %][% itemloo.waitingdate | $KohaDates %][% ELSE %][% IF ( itemloo.reservedate ) %][% itemloo.reservedate | html %][% END %][% END %]. <a class="info" href="modrequest.pl?CancelBiblioNumber=[% itemloo.biblionumber | html %]&amp;CancelBorrowerNumber=[% itemloo.ReservedFor.borrowernumber | html %]&amp;CancelItemnumber=[% itemloo.itemnumber | html %]"  onclick="return confirmDelete(MSG_CONFIRM_DELETE_HOLD);">Cancel hold</a>
 
                     [% END %]
                 [% ELSE %]
         </table>
     [% IF ( bibitemloo.hiddencount ) %]
         <form>
-        <p class="hiddencount"><a href="request.pl?biblionumber=[% bibitemloo.biblionumber %]&amp;borrowernumber=[% bibitemloo.borrowernumber %]&amp;showallitems=1">Show all items ([% bibitemloo.hiddencount %] hidden)</a></p>
+        <p class="hiddencount"><a href="request.pl?biblionumber=[% bibitemloo.biblionumber | html %]&amp;borrowernumber=[% bibitemloo.borrowernumber | html %]&amp;showallitems=1">Show all items ([% bibitemloo.hiddencount | html %] hidden)</a></p>
         </form>
     [% END %] <!-- hiddencount -->
     [% END %] <!-- bibitemloop -->
         [% END %]
           <td>
             <ul>
-              <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber %]">[% biblioloo.title |html %]</a></li>
+              <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber | html %]">[% biblioloo.title | html %]</a></li>
               [% IF ( biblioloo.publicationyear ) %]
-                <li><span class="label">Publication year:</span> [% biblioloo.publicationyear %]</li>
+                <li><span class="label">Publication year:</span> [% biblioloo.publicationyear | html %]</li>
               [% END %]
             </ul>
             [% UNLESS ( biblioloo.warn ) %]
-              <span class="multi_hold_item" title="[% biblioloo.biblionumber %]"></span>
+              <span class="multi_hold_item" title="[% biblioloo.biblionumber | html %]"></span>
             [% ELSE %]
-              <span class="not_holdable" title="[% biblioloo.biblionumber %]"></span>
+              <span class="not_holdable" title="[% biblioloo.biblionumber | html %]"></span>
             [% END %]
           </td>
           [% UNLESS ( item_level_itypes ) %]
             <td>
-              <img src="[% biblioloo.imageurl %]" alt="[% biblioloo.itypename %]" title="[% biblioloo.itypename %]" />
+              <img src="[% biblioloo.imageurl | html %]" alt="[% biblioloo.itypename | html %]" title="[% biblioloo.itypename | html %]" />
             </td>
           [% END %]
-            <td>[% biblioloo.rank %]</td>
+            <td>[% biblioloo.rank | html %]</td>
           <td>
             [% IF ( biblioloo.alreadyres ) %]
               <ul>
             [% END %]
 
           [% IF ( biblioloo.alreadyres ) %]
-              <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber %]">[% patron.firstname %] [% patron.surname %]</a> <strong>already has a hold</strong> on this item </li>
+              <li><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% patron.borrowernumber | html %]">[% patron.firstname | html %] [% patron.surname | html %]</a> <strong>already has a hold</strong> on this item </li>
           [% END %]
           [% IF ( biblioloo.none_avail ) %]
               <li> <strong>No items are available</strong> to be placed on hold</li>
 
 [% UNLESS ( patron ) %]
 [% IF ( reserveloop ) %]
-<form name="T[% time %]" action="modrequest.pl" method="post">
+<form name="T[% time | html %]" action="modrequest.pl" method="post">
   [% IF ( multi_hold ) %]
     <input type = "hidden" name="multi_hold" value="1"/>
-    <input type = "hidden" name="biblionumbers" value="[% biblionumbers %]"/>
+    <input type = "hidden" name="biblionumbers" value="[% biblionumbers | html %]"/>
   [% END %]
 
 <fieldset class="rows left">
     [% IF ( biblioloo.reserveloop ) %]
     <table>
       [% IF ( multi_hold ) %]
-          <caption><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber %]">[% biblioloo.title |html %]</a></caption>
+          <caption><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblioloo.biblionumber | html %]">[% biblioloo.title | html %]</a></caption>
       [% END %]
       <tr>
         [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
         <th>Pickup library</th>
         <th>Details</th>
         [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
-            <th><img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Toggle set to lowest priority" /></th>
+            <th><img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Toggle set to lowest priority" /></th>
         [% END %]
        <th>&nbsp;</th>
     [% IF SuspendHoldsIntranet %]<th>&nbsp;</th><!-- Suspend Holds Column Header -->[% END %]
   [% FOREACH reserveloo IN biblioloo.reserveloop %]
         <tr>
         <td>
-          <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id %]" />
-          <input type="hidden" name="borrowernumber" value="[% reserveloo.borrowernumber %]" />
-          <input type="hidden" name="biblionumber" value="[% reserveloo.biblionumber %]" />
+          <input type="hidden" name="reserve_id" value="[% reserveloo.reserve_id | html %]" />
+          <input type="hidden" name="borrowernumber" value="[% reserveloo.borrowernumber | html %]" />
+          <input type="hidden" name="biblionumber" value="[% reserveloo.biblionumber | html %]" />
           <select name="rank-request">
               [% IF ( reserveloo.found ) %]
                   [% IF ( reserveloo.intransit ) %]
               [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
                   [% FOREACH optionloo IN reserveloo.optionloop %]
                       [% IF ( optionloo.selected ) %]
-                          <option value="[% optionloo.num %]" selected="selected">[% optionloo.num %]</option>
+                          <option value="[% optionloo.num | html %]" selected="selected">[% optionloo.num | html %]</option>
                       [% ELSE %]
-                          <option value="[% optionloo.num %]">[% optionloo.num %]</option>
+                          <option value="[% optionloo.num | html %]">[% optionloo.num | html %]</option>
                       [% END %]
                   [% END %]
               [% ELSIF !reserveloo.found %]
-                  <option value="[% reserveloo.priority %]" selected="selected">[% reserveloo.priority %]</option>
+                  <option value="[% reserveloo.priority | html %]" selected="selected">[% reserveloo.priority | html %]</option>
               [% END %]
               <option value="del">del</option>
           </select>
 
      [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
         <td style="white-space:nowrap;">
-            <a title="Move hold up" href="request.pl?action=move&amp;where=up&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
-            <img src="[% interface %]/[% theme %]/img/go-up.png" alt="Go up" />
+            <a title="Move hold up" href="request.pl?action=move&amp;where=up&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
+            <img src="[% interface | html %]/[% theme | html %]/img/go-up.png" alt="Go up" />
                 </a>
 
-                <a title="Move hold to top" href="request.pl?action=move&amp;where=top&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
-                    <img src="[% interface %]/[% theme %]/img/go-top.png" alt="Go top" />
+                <a title="Move hold to top" href="request.pl?action=move&amp;where=top&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
+                    <img src="[% interface | html %]/[% theme | html %]/img/go-top.png" alt="Go top" />
                 </a>
 
-                <a title="Move hold to bottom" href="request.pl?action=move&amp;where=bottom&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
-                    <img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Go bottom" />
+                <a title="Move hold to bottom" href="request.pl?action=move&amp;where=bottom&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
+                    <img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Go bottom" />
                 </a>
 
-                <a title="Move hold down" href="request.pl?action=move&amp;where=down&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
-                    <img src="[% interface %]/[% theme %]/img/go-down.png" alt="Go down" />
+                <a title="Move hold down" href="request.pl?action=move&amp;where=down&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
+                    <img src="[% interface | html %]/[% theme | html %]/img/go-down.png" alt="Go down" />
                 </a>
         </td>
     [% END %]
         <td>
           [% INCLUDE 'patron-title.inc' patron=reserveloo.patron hide_patron_infos_if_needed=1 %]
         </td>
-        <td>[% reserveloo.notes %]</td>
-        <td>[% reserveloo.date %]</td>
-        <td>[% reserveloo.expirationdate %]</td>
+        <td>[% reserveloo.notes | html %]</td>
+        <td>[% reserveloo.date | html %]</td>
+        <td>[% reserveloo.expirationdate | html %]</td>
         <td>
     [% IF ( reserveloo.found ) %]
        [% IF ( reserveloo.atdestination ) %]
             [% IF ( reserveloo.found ) %]
-                Item waiting at <b> [% reserveloo.wbrname %]</b> <input type="hidden" name="pickup" value="[% reserveloo.wbrcode %]" /> since [% reserveloo.waiting_date | $KohaDates %]
+                Item waiting at <b> [% reserveloo.wbrname | html %]</b> <input type="hidden" name="pickup" value="[% reserveloo.wbrcode | html %]" /> since [% reserveloo.waiting_date | $KohaDates %]
             [% ELSE %]
-                Waiting to be pulled <input type="hidden" name="pickup" value="[% reserveloo.wbrcode %]" />
+                Waiting to be pulled <input type="hidden" name="pickup" value="[% reserveloo.wbrcode | html %]" />
             [% END %]
           [% ELSE %]
-            Item being transferred to <b> [% reserveloo.wbrname %]</b> <input type="hidden" name="pickup" value="[% reserveloo.wbrcode %]" />
+            Item being transferred to <b> [% reserveloo.wbrname | html %]</b> <input type="hidden" name="pickup" value="[% reserveloo.wbrcode | html %]" />
          [% END %]
     [% ELSE %]
         [% IF Koha.Preference('IndependentBranches') && Branches.all().size == 1 %]
-            [% Branches.GetName(reserveloo.branchcode) %] <input type="hidden" name="pickup" value="[% reserveloo.branchcode %]" />
+            [% Branches.GetName(reserveloo.branchcode) | html %] <input type="hidden" name="pickup" value="[% reserveloo.branchcode | html %]" />
         [% ELSE %]
             <select name="pickup">
                 [% PROCESS options_for_libraries libraries => Branches.all( selected => reserveloo.branchcode ) %]
         </td>
         <td>
     [% IF ( reserveloo.found ) %]
-          <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% reserveloo.biblionumber %]">
+          <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% reserveloo.biblionumber | html %]">
                 [% IF ( reserveloo.barcodenumber ) %]
-                    [% reserveloo.barcodenumber %]
-                    <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber %]" />
+                    [% reserveloo.barcodenumber | html %]
+                    <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber | html %]" />
                 [% ELSE %]
                     No barcode
                 [% END %]
     [% ELSE %]
             [% IF ( reserveloo.item_level_hold ) %]
                 <i>Only item
-                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% reserveloo.biblionumber %]">
+                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% reserveloo.biblionumber | html %]">
                      [% IF ( reserveloo.barcodenumber ) %]
-                         [% reserveloo.barcodenumber %]
-                        <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber %]" />
+                         [% reserveloo.barcodenumber | html %]
+                        <input type="hidden" name="itemnumber" value="[% reserveloo.itemnumber | html %]" />
                     [% ELSE %]
                         No barcode
                     [% END %]
                 </i>
             [% ELSE %]
                 [% IF reserveloo.itemtype %]
-                    <i>Next available [% ItemTypes.GetDescription( reserveloo.itemtype ) %] item</i>
+                    <i>Next available [% ItemTypes.GetDescription( reserveloo.itemtype ) | html %] item</i>
                 [% ELSE %]
                     <i>Next available</i>
                 [% END %]
 
     [% IF ( CAN_user_reserveforothers_modify_holds_priority ) %]
        <td>
-                <a title="Toggle lowest priority" href="request.pl?action=setLowestPriority&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
+                <a title="Toggle lowest priority" href="request.pl?action=setLowestPriority&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
                        [% IF ( reserveloo.lowestPriority ) %]
-                        <img src="[% interface %]/[% theme %]/img/go-bottom.png" alt="Unset lowest priority" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-bottom.png" alt="Unset lowest priority" />
                        [% ELSE %]
-                        <img src="[% interface %]/[% theme %]/img/go-down.png" alt="Set to lowest priority" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/go-down.png" alt="Set to lowest priority" />
                        [% END %]
                </a>
        </td>
     [% END %]
 
        <td>
-        <a class="cancel-hold" title="Cancel hold" href="request.pl?action=cancel&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;reserve_id=[% reserveloo.reserve_id %]&amp;date=[% reserveloo.date %]">
-                    <img src="[% interface %]/[% theme %]/img/x.png" alt="Cancel" />
+        <a class="cancel-hold" title="Cancel hold" href="request.pl?action=cancel&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;date=[% reserveloo.date | html %]">
+                    <img src="[% interface | html %]/[% theme | html %]/img/x.png" alt="Cancel" />
                 </a>
        </td>
 
         [% IF SuspendHoldsIntranet %]
        <td>
         [% UNLESS ( reserveloo.found ) %]
-            <input type="button" value="[% IF ( reserveloo.suspend ) %]Unsuspend[% ELSE %]Suspend[% END %]" onclick="window.location.href='request.pl?action=toggleSuspend&amp;reserve_id=[% reserveloo.reserve_id %]&amp;borrowernumber=[% reserveloo.borrowernumber %]&amp;biblionumber=[% reserveloo.biblionumber %]&amp;date=[% reserveloo.date %]&amp;suspend_until=' + $('#suspend_until_[% reserveloo.reserve_id %]').val()" />
+            <input type="button" value="[% IF ( reserveloo.suspend ) %]Unsuspend[% ELSE %]Suspend[% END %]" onclick="window.location.href='request.pl?action=toggleSuspend&amp;reserve_id=[% reserveloo.reserve_id | html %]&amp;borrowernumber=[% reserveloo.borrowernumber | html %]&amp;biblionumber=[% reserveloo.biblionumber | html %]&amp;date=[% reserveloo.date | html %]&amp;suspend_until=' + $('#suspend_until_[% reserveloo.reserve_id | html %]').val()" />
 
             [% IF AutoResumeSuspendedHolds %]
-                <label for="suspend_until_[% reserveloo.reserve_id %]">[% IF ( reserveloo.suspend ) %] on [% ELSE %] until [% END %]</label>
-                <input name="suspend_until" id="suspend_until_[% reserveloo.reserve_id %]" size="10" value="[% reserveloo.suspend_until | $KohaDates %]" class="datepicker suspend_until_datepicker" />
-                <a href='#' onclick="document.getElementById('suspend_until_[% reserveloo.reserve_id %]').value='';">Clear date</a>
+                <label for="suspend_until_[% reserveloo.reserve_id | html %]">[% IF ( reserveloo.suspend ) %] on [% ELSE %] until [% END %]</label>
+                <input name="suspend_until" id="suspend_until_[% reserveloo.reserve_id | html %]" size="10" value="[% reserveloo.suspend_until | $KohaDates %]" class="datepicker suspend_until_datepicker" />
+                <a href='#' onclick="document.getElementById('suspend_until_[% reserveloo.reserve_id | html %]').value='';">Clear date</a>
             [% ELSE %]
-                <input type="hidden" name="suspend_until" id="suspend_until_[% reserveloo.reserve_id %]" value=""/>
+                <input type="hidden" name="suspend_until" id="suspend_until_[% reserveloo.reserve_id | html %]" value=""/>
             [% END %]
        [% ELSE %]
                <input type="hidden" name="suspend_until" value="" />
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/circ-patron-search-results.js") %]
+    [% Asset.js("js/circ-patron-search-results.js") | $raw %]
     <script>
         var MSG_CONFIRM_DELETE_HOLD   = _("Are you sure you want to cancel this hold?");
-        var patron_homebranch = "[% Branches.GetName( patron.branchcode ) |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+        var patron_homebranch = "[% Branches.GetName( patron.branchcode ) |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
         var override_items = {[% FOREACH bibitemloo IN bibitemloop %][% FOREACH itemloo IN bibitemloo.itemloop %][% IF ( itemloo.override ) %]
-        [% itemloo.itemnumber %]: {
-            homebranch: "[% Branches.GetName( itemloo.homebranch ) |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-            holdallowed: [% itemloo.holdallowed %]
+        [% itemloo.itemnumber | html %]: {
+            homebranch: "[% Branches.GetName( itemloo.homebranch ) |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+            holdallowed: [% itemloo.holdallowed | html %]
             },
             [% END %][% END %][% END %]
         };
index 37e478c..dff9da3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
     <tbody>[% FOREACH review IN reviews %]
     <tr>
         <td>
-            [% IF ( review.borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% review.borrowernumber %]">[% review.patron.surname %], [% review.patron.firstname %]</a>[% ELSE %](deleted patron)[% END %]
+            [% IF ( review.borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% review.borrowernumber | html %]">[% review.patron.surname | html %], [% review.patron.firstname | html %]</a>[% ELSE %](deleted patron)[% END %]
         </td>
         <td>
-            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% review.biblionumber %]">[% review.bibliotitle %]</a>
+            <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% review.biblionumber | html %]">[% review.bibliotitle | html %]</a>
         </td>
         <td>
-            [% review.review |html %]
+            [% review.review | html %]
         </td>
         <td>
-            [% IF ( status ) %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=unapprove&amp;reviewid=[% review.reviewid %]" class="btn btn-default btn-xs"><i class="fa fa-remove"></i> Unapprove</a>[% ELSE %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=approve&amp;reviewid=[% review.reviewid %]" class="btn btn-default btn-xs"><i class="fa fa-check"></i> Approve</a>[% END %]
-            <a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=delete&amp;reviewid=[% review.reviewid %]" class="btn btn-default btn-xs"><i class="fa fa-trash" aria-hidden="true"></i> Delete</a>
+            [% IF ( status ) %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=unapprove&amp;reviewid=[% review.reviewid | html %]" class="btn btn-default btn-xs"><i class="fa fa-remove"></i> Unapprove</a>[% ELSE %]<a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=approve&amp;reviewid=[% review.reviewid | html %]" class="btn btn-default btn-xs"><i class="fa fa-check"></i> Approve</a>[% END %]
+            <a href="/cgi-bin/koha/reviews/reviewswaiting.pl?op=delete&amp;reviewid=[% review.reviewid | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash" aria-hidden="true"></i> Delete</a>
         </td>
     </tr>
     [% END %]</tbody>
 </table>
- <div class="pages">[% pagination_bar %]</div>
+ <div class="pages">[% pagination_bar | $raw %]</div>
 [% ELSE %]
 [% IF ( status ) %]<p><b>No comments have been approved.</b></p>[% ELSE %]<p><b>No comments to moderate.</b></p>[% END %]
 [% END %]
@@ -76,7 +77,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 365745d..7c0f04c 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Tools &rsaquo; Rotating collections &rsaquo; Collection [% colTitle %] &rsquo; Add or remove items</title>
+<title>Koha &rsaquo; Tools &rsaquo; Rotating collections &rsaquo; Collection [% colTitle | html %] &rsquo; Add or remove items</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -9,7 +10,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Rotating collections</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId %]">Collection <i>[% colTitle %]</i></a> &rsaquo; Add or remove items</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Rotating collections</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId | html %]">Collection <i>[% colTitle | html %]</i></a> &rsaquo; Add or remove items</div>
 
 <div id="doc3" class="yui-t2">
     <div id="bd">
                 </div>
               [% ELSE %]
               [% INCLUDE 'rotating-collections-toolbar.inc' %]
-              <h1>Collection <i>[% colTitle %]</i></h1>
+              <h1>Collection <i>[% colTitle | html %]</i></h1>
 
               [% IF ( previousActionAdd ) %]
                 [% IF ( addSuccess ) %]
-                  <div class="dialog message">Item with barcode '[% barcode %]' added successfully</div>
+                  <div class="dialog message">Item with barcode '[% barcode | html %]' added successfully</div>
                 [% ELSE %]
                   <div class="dialog alert">
-                    <p>Failed to add item with barcode <i>[% barcode %]</i>:
+                    <p>Failed to add item with barcode <i>[% barcode | html %]</i>:
                     <p>
                         [% IF failureMessage == "NO_ITEM" %]
                             No item with matching barcode found
@@ -39,7 +40,7 @@
                         [% ELSIF failureMessage == "IN_COLLECTION" %]
                             Item is already in this collection
                         [% ELSE %]
-                            [% failureMessage %]
+                            [% failureMessage | html %]
                         [% END %]
                     </p>
                 </div>
 
               [% IF ( previousActionRemove ) %]
                 [% IF ( removeSuccess ) %]
-                  <div class="dialog message">Item with barcode <i>[% barcode %]</i> removed successfully</div>
+                  <div class="dialog message">Item with barcode <i>[% barcode | html %]</i> removed successfully</div>
                 [% ELSE %]
                   <div class="dialog alert">
-                    Failed to remove item with barcode <i>[% barcode %]</i>:
+                    Failed to remove item with barcode <i>[% barcode | html %]</i>:
                     <p>
                         [% IF failureMessage == "NO_ITEM" %]
                             No item with matching barcode found
                         [% ELSIF failureMessage == "NOT_IN_COLLECTION" %]
                             Item is not in this collection
                         [% ELSE %]
-                            [% failureMessage %]
+                            [% failureMessage | html %]
                         [% END %]
                     </p>
                 </div>
@@ -81,7 +82,7 @@
                             </li>
                         </ol>
                         <p>
-                            <input type="hidden" id="colId" name="colId" value="[% colId %]" />
+                            <input type="hidden" id="colId" name="colId" value="[% colId | html %]" />
                             <input type="hidden" name="action" value="addItem" />
                             <input type="submit" value="Submit" />
                         </p>
@@ -91,7 +92,7 @@
               </div>
 
               <div>
-                <h2>Items in <i>[% colTitle %]</i></h2>
+                <h2>Items in <i>[% colTitle | html %]</i></h2>
                 [% IF ( collectionItemsLoop ) %]
                   <table>
                     <tr>
                     </tr>
                     [% FOREACH collectionItemsLoo IN collectionItemsLoop %]
                       <tr>
-                        <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = collectionItemsLoo.biblionumber %][% collectionItemsLoo.title |html %]</a></td>
-                        <td>[% collectionItemsLoo.itemcallnumber %]</td>
-                        <td>[% collectionItemsLoo.barcode %]</td>
-                        <td><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId %]&amp;barcode=[% collectionItemsLoo.barcode %]&amp;removeItem=1&amp;action=addItem">Remove</a></td>
+                        <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = collectionItemsLoo.biblionumber %][% collectionItemsLoo.title | html %]</a></td>
+                        <td>[% collectionItemsLoo.itemcallnumber | html %]</td>
+                        <td>[% collectionItemsLoo.barcode | html %]</td>
+                        <td><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId | html %]&amp;barcode=[% collectionItemsLoo.barcode | html %]&amp;removeItem=1&amp;action=addItem">Remove</a></td>
                       </tr>
                     [% END %]
                   </table>
     </div> <!-- /#bd -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/rotating-collections.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/rotating-collections.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 0f0f755..298f9ec 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -5,7 +6,7 @@
     [%- IF ( action == "new" ) %]
         Add a new collection
     [% ELSE %]
-        Edit collection [% editColTitle %]
+        Edit collection [% editColTitle | html %]
     [% END -%]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -18,7 +19,7 @@
     [%- IF ( action == "new" ) %]
         Add a new collection
     [% ELSE %]
-        <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% editColId %]">Collection <i>[% editColTitle %]</i></a> &rsaquo; Edit
+        <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% editColId | html %]">Collection <i>[% editColTitle | html %]</i></a> &rsaquo; Edit
     [% END -%]
 </div>
 
               [% IF ( previousActionCreate ) %]
                 [% IF ( createSuccess ) %]
                     <div class="dialog message">
-                        <p>Collection <i>[% createdTitle %]</i> added successfully</p>
+                        <p>Collection <i>[% createdTitle | html %]</i> added successfully</p>
                         <p><a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Return to rotating collections home</a></p>
                     </div>
                 [% ELSE %]
                   <div class="dialog alert">
-                    <p>Collection <i>[% createdTitle %]</i> failed to be added</p>
+                    <p>Collection <i>[% createdTitle | html %]</i> failed to be added</p>
                     <p>
                         [% IF failureMessage == "NO_TITLE" %]
                             No title entered.
@@ -44,7 +45,7 @@
                         [% ELSIF failureMessage == "NO_DESCRIPTION" %]
                             No description entered.
                         [% ELSE %]
-                            [% failureMessage %]
+                            [% failureMessage | html %]
                         [% END %]
                     </p>
                   </div>
               [% IF ( previousActionUpdate ) %]
                 [% IF ( updateSuccess ) %]
                   <div class="dialog message">
-                      <p>Collection <i>[% updatedTitle %]</i> updated successfully</p>
+                      <p>Collection <i>[% updatedTitle | html %]</i> updated successfully</p>
                       <p><a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Return to rotating collections home</a></p>
                   </div>
                 [% ELSE %]
                   <div class="dialog alert">
-                    <p>Collection <i>[% updatedTitle %]</i> failed to be updated</p>
+                    <p>Collection <i>[% updatedTitle | html %]</i> failed to be updated</p>
                     <p>
                         [% IF failureMessage == "NO_ID" %]
                             No collection id given.
                         [% ELSIF failureMessage == "DUPLICATE_TITLE" %]
                             Title already in use.
                         [% ELSE %]
-                            [% failureMessage %]
+                            [% failureMessage | html %]
                         [% END %]
                     </p>
                 </div>
@@ -88,7 +89,7 @@
 
                 [% IF action == "new" || action == "edit" %]
                     [% IF ( previousActionEdit ) %]
-                      <h1>Edit collection <i>[% editColTitle %]</i></h1>
+                      <h1>Edit collection <i>[% editColTitle | html %]</i></h1>
                     [% ELSE %]
                       <h1>Add new collection</h1>
                     [% END %]
@@ -96,7 +97,7 @@
                     <form action="editCollections.pl" method="post" class="validated">
                         [% IF ( previousActionEdit ) %]
                             <input type="hidden" name="action" value="update" />
-                            <input type="hidden" name="colId" value="[% editColId %]" />
+                            <input type="hidden" name="colId" value="[% editColId | html %]" />
                         [% ELSE %]
                             <input type="hidden" name="action" value="create" />
                         [% END %]
                                 <li>
                                     <label class="required" for="title">Title: </label>
                                     [% IF ( editColTitle ) %]
-                                        <input type="text" name="title" value="[% editColTitle %]" required="required" />
+                                        <input type="text" name="title" value="[% editColTitle | html %]" required="required" />
                                         <span class="required">Required</span>
                                     [% ELSE %]
                                         <input type="text" name="title" required="required" />
                                 <li>
                                     <label for="description">Description: </label>
                                     [% IF (editColDescription ) %]
-                                        <input type="text" size="50" name="description" value="[% editColDescription %]" />
+                                        <input type="text" size="50" name="description" value="[% editColDescription | html %]" />
                                     [% ELSE %]
                                         <input type="text" size="50" name="description" />
                                     [% END %]
     </div> <!-- /#bd -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/rotating-collections.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/rotating-collections.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index f3602ee..86343e2 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Rotating collections</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="rcoll_rotatingCollections" class="tools rcoll">
                             <tbody>
                             [% FOREACH collectionsLoo IN collectionsLoop %]
                                 <tr>
-                                    <td><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% collectionsLoo.colId %]">[% collectionsLoo.colTitle %]</a></td>
-                                    <td>[% collectionsLoo.colDesc %]</td>
-                                    <td>[% Branches.GetName( collectionsLoo.colBranchcode ) %]</td>
+                                    <td><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% collectionsLoo.colId | html %]">[% collectionsLoo.colTitle | html %]</a></td>
+                                    <td>[% collectionsLoo.colDesc | html %]</td>
+                                    <td>[% Branches.GetName( collectionsLoo.colBranchcode ) | html %]</td>
                                     <td>
                                     <div class="dropdown">
-                                        <a class="btn btn-default btn-xs" dropdown-toggle" id="collectionsactions[% collectionsLoo.colId %]" role="button" data-toggle="dropdown" href="#">
+                                        <a class="btn btn-default btn-xs" dropdown-toggle" id="collectionsactions[% collectionsLoo.colId | html %]" role="button" data-toggle="dropdown" href="#">
                                         Actions <b class="caret"></b></a>
-                                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="collectionsactions[% collectionsLoo.colId %]">
-                                            <li><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% collectionsLoo.colId %]"><i class="fa fa-plus"></i> Add or remove items</a></li>
-                                            <li><a href="/cgi-bin/koha/rotating_collections/transferCollection.pl?colId=[% collectionsLoo.colId %]"><i class="fa fa-exchange"></i> Transfer</a></li>
-                                            <li><a href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=edit&amp;colId=[% collectionsLoo.colId %]"><i class="fa fa-pencil"></i> Edit</a></li>
-                                            <li><a class="confirmdelete" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=delete&amp;colId=[% collectionsLoo.colId %]"><i class="fa fa-trash"></i> Delete</a></li>
+                                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="collectionsactions[% collectionsLoo.colId | html %]">
+                                            <li><a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% collectionsLoo.colId | html %]"><i class="fa fa-plus"></i> Add or remove items</a></li>
+                                            <li><a href="/cgi-bin/koha/rotating_collections/transferCollection.pl?colId=[% collectionsLoo.colId | html %]"><i class="fa fa-exchange"></i> Transfer</a></li>
+                                            <li><a href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=edit&amp;colId=[% collectionsLoo.colId | html %]"><i class="fa fa-pencil"></i> Edit</a></li>
+                                            <li><a class="confirmdelete" href="/cgi-bin/koha/rotating_collections/editCollections.pl?action=delete&amp;colId=[% collectionsLoo.colId | html %]"><i class="fa fa-trash"></i> Delete</a></li>
                                         </ul>
                                     </div>
                                     </td>
@@ -68,8 +69,8 @@
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/rotating-collections.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/rotating-collections.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 123be61..f91ac72 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Rotating collections</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId %]">Collection <i>[% colTitle %]</i></a> &rsaquo; Transfer collection</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/rotatingCollections.pl">Rotating collections</a> &rsaquo; <a href="/cgi-bin/koha/rotating_collections/addItems.pl?colId=[% colId | html %]">Collection <i>[% colTitle | html %]</i></a> &rsaquo; Transfer collection</div>
 
 <div id="doc3" class="yui-t2">
     <div id="bd">
         <div id="yui-main">
             <div class="yui-b">
 
-                <h1>Transfer collection <i>[% colTitle %]</i></h1>
+                <h1>Transfer collection <i>[% colTitle | html %]</i></h1>
 
                 [% IF ( transferSuccess ) %]
                     <div class="dialog message">
@@ -34,7 +35,7 @@
                 [% ELSE %]
                     <div>
                         <form action="transferCollection.pl" method="post">
-                            <input type="hidden" name="colId" value="[% colId %]" />
+                            <input type="hidden" name="colId" value="[% colId | html %]" />
                             <fieldset class="rows">
                                 <ol>
                                     <li>
@@ -60,8 +61,8 @@
     </div> <!-- /#bd -->
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/rotating-collections.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/rotating-collections.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index 1d1cc7c..95d1b0f 100644 (file)
@@ -12,9 +12,9 @@
 [% UNLESS count %]
     <h2>Your search returned no results.</h2>
 [% ELSIF ( supplier.length < 1 ) %]
-    <h2>Vendor search: [% count %] result(s) found</h2>
+    <h2>Vendor search: [% count | html %] result(s) found</h2>
 [% ELSE %]
-    <h2>Vendor search: [% count %] result(s) found for '[% supplier %]'</h2>
+    <h2>Vendor search: [% count | html %] result(s) found for '[% supplier | html %]'</h2>
 [% END %]
 
 [% IF ( loop_suppliers ) %]
@@ -25,8 +25,8 @@
        </tr>
        [% FOREACH loop_supplier IN loop_suppliers %]
         <tr>
-            <td>[% loop_supplier.name |html %]</td>
-            <td><a class="btn btn-default btn-xs select_vendor" href="#" data-vendorid="[% loop_supplier.aqbooksellerid %]" data-vendorname="[% loop_supplier.name |html%]">Choose</a></td>
+            <td>[% loop_supplier.name | html %]</td>
+            <td><a class="btn btn-default btn-xs select_vendor" href="#" data-vendorid="[% loop_supplier.aqbooksellerid | html %]" data-vendorname="[% loop_supplier.name | html %]">Choose</a></td>
                </tr>
        [% END %]
 </table>
@@ -55,4 +55,4 @@
   </script>
 [% END %]
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index d93cc20..2567058 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
@@ -11,7 +12,7 @@
   [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="ser_add_fields" class="ser">
         <tbody>
           [% FOR field IN fields %]
             <tr>
-              <td>[% field.name %]</td>
-              <td>[% field.authorised_value_category %]</td>
-              <td>[% field.marcfield %]</td>
+              <td>[% field.name | html %]</td>
+              <td>[% field.authorised_value_category | html %]</td>
+              <td>[% field.marcfield | html %]</td>
               <td>
                 [% IF field.searchable %]Yes[% ELSE %]No[% END %]
               </td>
               <td class="actions">
-                <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/add_fields.pl?op=add_form&amp;field_id=[% field.id %]"><i class="fa fa-pencil"></i> Edit</a>
-                <a class="confirmdelete btn btn-default btn-xs" href="/cgi-bin/koha/serials/add_fields.pl?op=delete&amp;field_id=[% field.id %]"><i class="fa fa-trash"></i> Delete</a>
+                <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/add_fields.pl?op=add_form&amp;field_id=[% field.id | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                <a class="confirmdelete btn btn-default btn-xs" href="/cgi-bin/koha/serials/add_fields.pl?op=delete&amp;field_id=[% field.id | html %]"><i class="fa fa-trash"></i> Delete</a>
               </td>
             </tr>
           [% END %]
           </li>
           <li>
             <label for="marcfield">Marc field: </label>
-            <input type="text" name="marcfield" id="marcfield" value="[% field.marcfield| html %]" />
+            <input type="text" name="marcfield" id="marcfield" value="[% field.marcfield | html %]" />
           </li>
           <li>
             <label for="searchable">Searchable: </label>
       </fieldset>
       <fieldset class="action">
         [% IF field %]
-          <input type="hidden" name="field_id" value="[% field.id %]" />
+          <input type="hidden" name="field_id" value="[% field.id | html %]" />
         [% END %]
         <input type="hidden" name="op" value="add" />
         <input type="submit" value="Save" />
index a828f70..cc10ebb 100644 (file)
@@ -51,7 +51,7 @@
 
 [% IF ( subscriptions_loop ) %]
 <p>
-    <b>[% numsubscription %]</b> subscription(s)
+    <b>[% numsubscription | html %]</b> subscription(s)
         [% IF ( title ) %]
         with title matching <span class="title">[% title | html %]</class>
         [% IF ( issn ) %]and [% END %]
     [% FOREACH subscriptions_loo IN subscriptions_loop %]
         <tr>
             <td style="text-align:center;vertical-align:middle">
-                <input type="checkbox" value="[% subscriptions_loo.subscriptionid %]" name="subscriptionid" />
+                <input type="checkbox" value="[% subscriptions_loo.subscriptionid | html %]" name="subscriptionid" />
             </td>
             <td>
-                [% subscriptions_loo.issn %]
+                [% subscriptions_loo.issn | html %]
             </td>
             <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptions_loo.subscriptionid |url %]">[% IF ( subscriptions_loo.title ) %]
-                    [% subscriptions_loo.title |html %]
+                    [% subscriptions_loo.title | html %]
                 [% ELSE %]
                     |
                 [% END %]
                 </a>
             </td>
             [% IF can_change_library %]<td>
-                [% Branches.GetName( subscriptions_loo.branchcode ) %]
+                [% Branches.GetName( subscriptions_loo.branchcode ) | html %]
             </td>[% END %]
             <td>
-                [% subscriptions_loo.notes %]
+                [% subscriptions_loo.notes | html %]
             </td>
             <td>
-                [% subscriptions_loo.internalnotes %]
+                [% subscriptions_loo.internalnotes | html %]
             </td>
             <td>
                 [% subscriptions_loo.expirationdate | $KohaDates %]
             </td>
             <td class="actions">
-                <a href="/cgi-bin/koha/serials/subscription-add.pl?op=modify&amp;subscriptionid=[% subscriptions_loo.subscriptionid %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                <a href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscriptions_loo.subscriptionid %]" data-subscriptionid="[% subscriptions_loo.subscriptionid %]" class="btn btn-default btn-xs renew_subscription"><i class="fa fa-refresh"></i> Renew</a>
+                <a href="/cgi-bin/koha/serials/subscription-add.pl?op=modify&amp;subscriptionid=[% subscriptions_loo.subscriptionid | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+                <a href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscriptions_loo.subscriptionid | html %]" data-subscriptionid="[% subscriptions_loo.subscriptionid | html %]" class="btn btn-default btn-xs renew_subscription"><i class="fa fa-refresh"></i> Renew</a>
             </td>
         </tr>
     [% END %]
index 8f5f547..ba71129 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Serials &rsaquo; Claims</title>
     [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="ser_claims" class="ser">
@@ -28,7 +29,7 @@
         [% ELSIF error_claim == 'bad_or_missing_sender' %]
             <div class="dialog alert">Bad or missing sender address; check your branch email address or preference KohaAdminEmailAddress.</div>
         [% ELSE %]
-            <div class="dialog alert">[% error_claim %]</div>
+            <div class="dialog alert">[% error_claim | html %]</div>
         [% END %]
     [% END %]
     [% IF info_claim %]
            <select id="supplierid" name="supplierid">
                [% FOREACH suploo IN suploop %]
                    [% IF ( suploo.selected ) %]
-                   <option value="[% suploo.id %]" selected="selected" >
+                   <option value="[% suploo.id | html %]" selected="selected" >
                    [% ELSE %]
-                   <option value="[% suploo.id %]">
+                   <option value="[% suploo.id | html %]">
                    [% END %]
-                       [% suploo.name %]
-                       ([% suploo.count %])
+                       [% suploo.name | html %]
+                       ([% suploo.count | html %])
                    </option>
                [% END %]
            </select>
@@ -69,9 +70,9 @@
        <ol>
        <li>
         <label for="from">From:</label>
-        <input type="text" name="begindate" id="from" value="[% begindate %]" size="10" maxlength="10" class="datepickerfrom" />
+        <input type="text" name="begindate" id="from" value="[% begindate | html %]" size="10" maxlength="10" class="datepickerfrom" />
         <label for="to" style="float:none;">To:</label>
-        <input type="text" name="enddate" id="to" value="[% enddate %]" size="10" maxlength="10" class="datepickerto" />
+        <input type="text" name="enddate" id="to" value="[% enddate | html %]" size="10" maxlength="10" class="datepickerto" />
         <span class="hint">[% INCLUDE 'date-format.inc' %]</span>
         <input id="filterByDate" type="button" value="OK" />
         <a href="#" id="clearfilter"><i class="fa fa-remove"></i> Clear filter</a>
@@ -96,7 +97,7 @@
                         <th>Claims count</th>
                         <th class="title-string">Claim date</th>
                         [% FOR field IN additional_fields_for_subscription %]
-                          <th>[% field.name %]</th>
+                          <th>[% field.name | html %]</th>
                         [% END %]
                     </tr>
                 </thead>
                     <td><input type="text" class="filter" data-column_num="8" placeholder="Search claim count" /></td>
                     <td><input type="text" class="filter" data-column_num="9" placeholder="Search claim date" /></td>
                     [% FOR field IN additional_fields_for_subscription %]
-                      <td><input type="text" class="filter" data-column_num="[% loop.count + 9 %]" placeholder="Search [% field.name %]" /></td>
+                      <td><input type="text" class="filter" data-column_num="[% loop.count + 9 | html %]" placeholder="Search [% field.name | html %]" /></td>
                     [% END %]
                   </tr>
                 </tfoot>
                     <tr>
                         <td>
                           [% UNLESS missingissue.cannot_claim %]
-                            <input type="checkbox" name="serialid" value="[% missingissue.serialid %]" />
+                            <input type="checkbox" name="serialid" value="[% missingissue.serialid | html %]" />
                           [% END %]
                         </td>
-                        <td>[% missingissue.name %]</td>
+                        <td>[% missingissue.name | html %]</td>
                         <td>
-                            <span class="branch-[% missingissue.branchcode %]">[% Branches.GetName( missingissue.branchcode ) %]</span>
+                            <span class="branch-[% missingissue.branchcode | html %]">[% Branches.GetName( missingissue.branchcode ) | html %]</span>
                         </td>
                         <td>
-                        <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% missingissue.subscriptionid %]">[% missingissue.title |html %]</a>
+                        <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% missingissue.subscriptionid | html %]">[% missingissue.title | html %]</a>
                         </td>
-                        <td>[% missingissue.issn %]</td>
-                        <td>[% missingissue.serialseq %]</td>
+                        <td>[% missingissue.issn | html %]</td>
+                        <td>[% missingissue.serialseq | html %]</td>
                         <td>
                             [% IF ( missingissue.status1 ) %]<span class="status-expected">Expected</span>[% END %]
                             [% IF ( missingissue.status3 ) %]<span class="status-late">Late</span>[% END %]
                         </td>
                         <td class="planneddate">
                             [% IF ( missingissue.planneddate ) %]
-                                <span title="[% missingissue.planneddateISO %]">[% missingissue.planneddate %]</span>
+                                <span title="[% missingissue.planneddateISO | html %]">[% missingissue.planneddate | html %]</span>
                             [% ELSE %]
                                 <span title="0000-00-00"></span>
                             [% END %]
                         </td>
-                        <td>[% missingissue.claims_count %]</td>
+                        <td>[% missingissue.claims_count | html %]</td>
                         <td>
                             [% IF ( missingissue.claimdate ) %]
-                                <span title="[% missingissue.claimdateISO %]">[% missingissue.claimdate %]</span>
+                                <span title="[% missingissue.claimdateISO | html %]">[% missingissue.claimdate | html %]</span>
                             [% ELSE %]
                                 <span title="0000-00-00"></span>
                             [% END %]
                         </td>
                         [% FOR field IN additional_fields_for_subscription %]
                           [% IF field.authorised_value_category %]
-                            <td>[% AuthorisedValues.GetByCode( field.authorised_value_category, missingissue.additional_fields.${field.name} ) %]</td>
+                            <td>[% AuthorisedValues.GetByCode( field.authorised_value_category, missingissue.additional_fields.${field.name} ) | html %]</td>
                           [% ELSE %]
-                            <td>[% missingissue.additional_fields.${field.name} %]</td>
+                            <td>[% missingissue.additional_fields.${field.name} | html %]</td>
                           [% END %]
                         [% END %]
                     </tr>
                 <label for="csv_code">Select CSV profile:</label>
                 <select id="csv_profile_for_export">
                   [% FOR csv IN csv_profiles %]
-                    <option value="[% csv.export_format_id %]">[% csv.profile %]</option>
+                    <option value="[% csv.export_format_id | html %]">[% csv.profile | html %]</option>
                    [% END %]
                 </select>
                 <span class="exportSelected"><a id="ExportSelected" href="/cgi-bin/koha/serials/claims.pl">Download selected claims</a></span>
                     <label for="letter_code">Select notice:</label>
                     <select name="letter_code" id="letter_code">
                         [% FOREACH letter IN letters %]
-                            <option value="[% letter.code %]">[% letter.name %]</option>
+                            <option value="[% letter.code | html %]">[% letter.name | html %]</option>
                         [% END %]
                     </select>
                     <input type="hidden" name="op" value="send_alert" />
-                    <input type="hidden" name="supplierid" value="[% supplierid %]" />
+                    <input type="hidden" name="supplierid" value="[% supplierid | html %]" />
                     <input type="submit" name="submit" class="button" value="Send notification" />
                 </fieldset>
             [% END %]
index b8131b1..6b0b0bf 100644 (file)
@@ -9,7 +9,7 @@
 <div class="main container-fluid">
 
 [% IF ( total ) %]
-<h1>Search results from [% from %] to [% to %] of [% total %]</h1>
+<h1>Search results from [% from | html %] to [% to | html %] of [% total | html %]</h1>
 <table>
     <tr>
        <th>Title</th>
     </tr>
     [% FOREACH resultsloo IN resultsloop %]
         <tr>
-            <td class="title">[% resultsloo.title |html %] [% resultsloo.subtitle |html %]
+            <td class="title">[% resultsloo.title | html %] [% resultsloo.subtitle | html %]
             </td>
             <td>
-                [% resultsloo.author |html %]
+                [% resultsloo.author | html %]
             </td>
             <td>
-                [% resultsloo.publishercode |html %]
+                [% resultsloo.publishercode | html %]
             </td>
             <td>
-                [% resultsloo.publicationyear |html %]
+                [% resultsloo.publicationyear | html %]
             </td>
             <td>
-                [% resultsloo.issn |html %]
+                [% resultsloo.issn | html %]
             </td>
-            <td><a class="btn btn-default btn-xs select_title" data-biblionumber="[% resultsloo.biblionumber %]" href="#" title="Choose this record">Choose</a></td>
+            <td><a class="btn btn-default btn-xs select_title" data-biblionumber="[% resultsloo.biblionumber | html %]" href="#" title="Choose this record">Choose</a></td>
         </tr>
     [% END %]
     </table>
 [% ELSE %]
 
     <div class="dialog message">
-        <p>No results found for <b>[% query %]</b></p>
+        <p>No results found for <b>[% query | html %]</b></p>
     </div>
 
 [% END %]
index 5739534..98f7548 100644 (file)
 
 <table>
     <tr>
-        <td colspan="2"><h3>[% libraryname %]</h3></td>
+        <td colspan="2"><h3>[% libraryname | html %]</h3></td>
     </tr>
     <tr>
-        <td colspan="2"><b>Title:</b> [% title |html %]<br />[% issue %]</td>
+        <td colspan="2"><b>Title:</b> [% title | html %]<br />[% issue | html %]</td>
     </tr>
     <tr>
         <td><b>Name</b></td>
     </tr>
     [% FOREACH memberloo IN memberloop %]
     <tr>
-        <td>[% memberloo.name %]</td>
+        <td>[% memberloo.name | html %]</td>
         <td>&nbsp;</td>
     </tr>
     [% END %]
 </table>
 
 <div id="routingnotes">
-    <p id="generalroutingnote">[% generalroutingnote %]</p>
-    <p id="routingnote">[% routingnotes %]</p>
+    <p id="generalroutingnote">[% generalroutingnote | html %]</p>
+    <p id="routingnote">[% routingnotes | html %]</p>
 </div>
 
     <div id="closewindow" class="noprint"><a class="btn btn-default btn-default" id="print_slip" href="#"><i class="fa fa-print"></i> Print</a> <a class="btn btn-default btn-default close" href="#">Close</a></div>
index 7fb8410..cf956e2 100644 (file)
@@ -8,7 +8,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid %]"><i>[% title |html %]</i></a> &rsaquo; Preview routing list</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid | html %]"><i>[% title | html %]</i></a> &rsaquo; Preview routing list</div>
 
 <div id="doc3" class="yui-t2">
    
        <div id="yui-main">
        <div class="yui-b">
 
-<h2>Preview routing list for <i>[% title |html %]</i></h2>
+<h2>Preview routing list for <i>[% title | html %]</i></h2>
 
 <form method="post" action="routing-preview.pl">
-<input type="hidden" id="subscriptionid" name="subscriptionid" value="[% subscriptionid %]" />
-    <input type="hidden" id="issue_escaped" name="issue_escaped" value="[% issue_escaped %]" />
+<input type="hidden" id="subscriptionid" name="subscriptionid" value="[% subscriptionid | html %]" />
+    <input type="hidden" id="issue_escaped" name="issue_escaped" value="[% issue_escaped | html %]" />
 <fieldset class="rows">
        <ol>
-               <li><span class="label">Issue:</span>[% issue %]</li>
+               <li><span class="label">Issue:</span>[% issue | html %]</li>
                <li><span class="label">List member:</span><table style="clear:none;margin:0;">
         <tr><th>Name</th></tr>
 [% FOREACH memberloo IN memberloop %]
-        <tr><td>[% memberloo.surname %], [% memberloo.firstname %]</td></tr>
+        <tr><td>[% memberloo.surname | html %], [% memberloo.firstname | html %]</td></tr>
 [% END %]
         </table></li>
-               <li><span class="label">Notes:</span>[% routingnotes %]</li>
+               <li><span class="label">Notes:</span>[% routingnotes | html %]</li>
        </ol>
 </fieldset>
 
index f42656a..3b9083d 100644 (file)
@@ -1,13 +1,13 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; [% title |html %] &rsaquo; [% IF ( op ) %]Create routing list[% ELSE %]Edit routing list[% END %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; [% title | html %] &rsaquo; [% IF ( op ) %]Create routing list[% ELSE %]Edit routing list[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="ser_routing" class="ser">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid %]"><i>[% title |html %]</i></a> &rsaquo; [% IF ( op ) %]Create routing list[% ELSE %]Edit routing list[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid | html %]"><i>[% title | html %]</i></a> &rsaquo; [% IF ( op ) %]Create routing list[% ELSE %]Edit routing list[% END %]</div>
 
 <div id="doc3" class="yui-t2">
    
 
 
 [% IF ( op ) %]
-<h1>Create routing list for <i>[% title |html %]</i></h1>
+<h1>Create routing list for <i>[% title | html %]</i></h1>
 [% ELSE %]
-<h1>Edit routing list for <i>[% title |html %]</i></h1>
+<h1>Edit routing list for <i>[% title | html %]</i></h1>
 [% END %]
 
 <form method="post" action="routing.pl">
 <input type="hidden" name="op" value="save" />
-<input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+<input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
 <fieldset class="rows">
        <ol>
                <li><label for="date_selected">Issue: </label>
 <select name="date_selected" id="date_selected">
 [% FOREACH date IN dates %]
-[% IF ( date.selected ) %]<option value="[% date.serialseq %] ([% date.publisheddate %])" selected="selected">[% date.serialseq %] ([% date.publisheddate %])</option>[% ELSE %]<option value="[% date.serialseq %] ([% date.publisheddate %])">[% date.serialseq %] ([% date.publisheddate %])</option>[% END %]
+[% IF ( date.selected ) %]<option value="[% date.serialseq | html %] ([% date.publisheddate | html %])" selected="selected">[% date.serialseq | html %] ([% date.publisheddate | html %])</option>[% ELSE %]<option value="[% date.serialseq | html %] ([% date.publisheddate | html %])">[% date.serialseq | html %] ([% date.publisheddate | html %])</option>[% END %]
 [% END %]
-</select> [% issue %]</li>
+</select> [% issue | html %]</li>
 
 <li>
     <span class="label">Recipients:</span>
             </tr>
             [% USE m_loop = iterator(memberloop) %]
             [% FOREACH member IN m_loop %]
-            <tr><td>[% member.name %]</td>
+            <tr><td>[% member.name | html %]</td>
                 <td>
-                    <select name="itemrank" class="itemrank" data-subscriptionid="[% subscriptionid %]" data-routingid="[% member.routingid %]">
-                    [% rankings = [1 .. m_loop.size] %]
+                    <select name="itemrank" class="itemrank" data-subscriptionid="[% subscriptionid | html %]" data-routingid="[% member.routingid | html %]">
+                    [% rankings = [1 .. m_loop.size] | html %]
                     [% FOREACH r IN rankings %]
                         [% IF r == member.ranking %]
-                          <option selected="selected" value="[% r %]">[% r %]</option>
+                          <option selected="selected" value="[% r | html %]">[% r | html %]</option>
                         [% ELSE %]
-                          <option value="[% r %]">[% r %]</option>
+                          <option value="[% r | html %]">[% r | html %]</option>
                         [% END %]
                     [% END %]
                     </select>
                 </td>
-                <td><a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?routingid=[% member.routingid %]&amp;subscriptionid=[% subscriptionid %]&amp;op=delete"><i class="fa fa-trash"></i> Delete</a></td>
+                <td><a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?routingid=[% member.routingid | html %]&amp;subscriptionid=[% subscriptionid | html %]&amp;op=delete"><i class="fa fa-trash"></i> Delete</a></td>
             </tr>
             [% END %]
         </table>
     <p style="margin-left:10em;">
         <a href="#" id="add_recipients"><i class="fa fa-plus"></i> Add recipients</a>
         [% IF memberloop %]
-            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid %]&amp;op=delete"><i class="fa fa-trash"></i> Delete all</a>
+            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscriptionid | html %]&amp;op=delete"><i class="fa fa-trash"></i> Delete all</a>
         [% END %]
     </p>
 </li>
 
-       <li><label for="notes">Notes:</label><textarea name="notes" id="notes" rows="3" cols="50">[% routingnotes %]</textarea></li>
+       <li><label for="notes">Notes:</label><textarea name="notes" id="notes" rows="3" cols="50">[% routingnotes | html %]</textarea></li>
        </ol>
 
 </fieldset>
         }
 
         function add_user(borrowernumber) {
-            var myurl = "routing.pl?subscriptionid="+[% subscriptionid %]+"&borrowernumber="+borrowernumber+"&op=add";
+            var myurl = "routing.pl?subscriptionid="+[% subscriptionid | html %]+"&borrowernumber="+borrowernumber+"&op=add";
             window.location.href = myurl;
         }
     </script>
index 8ba7264..8bee8c4 100644 (file)
@@ -1,19 +1,20 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; Serial collection information for [% bibliotitle %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; Serial collection information for [% bibliotitle | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="ser_serials-collection" class="ser">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Serial collection information for  <i>[% bibliotitle %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Serial collection information for  <i>[% bibliotitle | html %]</i></div>
 
 <div id="doc3" class="yui-t2">
    
@@ -26,9 +27,9 @@
 [% UNLESS ( popup ) %]
        [% INCLUDE 'serials-toolbar.inc' %]
 
-       <h1>Serial collection information for  <i>[% bibliotitle %]</i>
-        [% IF location %] ([% AuthorisedValues.GetByCode( 'LOC', location ) %]) [% END %]
-               [% IF ( callnumber ) %]callnumber: [% callnumber %][% END %]</h1>
+       <h1>Serial collection information for  <i>[% bibliotitle | html %]</i>
+        [% IF location %] ([% AuthorisedValues.GetByCode( 'LOC', location ) | html %]) [% END %]
+               [% IF ( callnumber ) %]callnumber: [% callnumber | html %][% END %]</h1>
 [% END %]
 
 [% IF ( subscriptions ) %]
 </tr>
 [% FOREACH subscription IN subscriptions %]
     <tr>
-        <td><a href="subscription-detail.pl?subscriptionid=[% subscription.subscriptionid %]"># [% subscription.subscriptionid %]</a> </td>
-        <td>[% subscription.frequency.description %]</td>
-        <td>[% subscription.numberpattern.label %]</td>
-        <td>[% IF subscription.branchcode %][% Branches.GetName( subscription.branchcode ) %][% END %]</td>
-        <td> [% subscription.callnumber %]</td>
-        <td> [% subscription.notes %]
+        <td><a href="subscription-detail.pl?subscriptionid=[% subscription.subscriptionid | html %]"># [% subscription.subscriptionid | html %]</a> </td>
+        <td>[% subscription.frequency.description | html %]</td>
+        <td>[% subscription.numberpattern.label | html %]</td>
+        <td>[% IF subscription.branchcode %][% Branches.GetName( subscription.branchcode ) | html %][% END %]</td>
+        <td> [% subscription.callnumber | html %]</td>
+        <td> [% subscription.notes | html %]
             [% UNLESS subscription.closed %]
                 [% IF ( subscription.subscriptionexpired ) %]
                     <br /><span class="problem"> Subscription expired</span>
         [% UNLESS subscription.closed %]
             [% IF ( routing && CAN_user_serials_routing ) %]
                 [% IF ( subscription.hasRouting ) %]
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid %]"><i class="fa fa-pencil"></i> Edit routing list</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid | html %]"><i class="fa fa-pencil"></i> Edit routing list</a>
                 [% ELSE %]
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=new"><i class="fa fa-plus"></i> Create routing list</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid | html %]&amp;op=new"><i class="fa fa-plus"></i> Create routing list</a>
                 [% END %]
             [% END %]
-            [% IF ( subscription.abouttoexpire ) %]<a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscription.subscriptionid %]" onclick="popup([% subscription.subscriptionid %]); return false;"><i class="fa fa-refresh"></i> Renew</a>
+            [% IF ( subscription.abouttoexpire ) %]<a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscription.subscriptionid | html %]" onclick="popup([% subscription.subscriptionid | html %]); return false;"><i class="fa fa-refresh"></i> Renew</a>
             [% ELSE %]
-                [% IF ( subscription.subscriptionexpired ) %]<a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscription.subscriptionid %]" onclick="popup([% subscription.subscriptionid %]); return false;"><i class="fa fa-refresh"></i> Renew</a>
+                [% IF ( subscription.subscriptionexpired ) %]<a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-renew.pl?subscriptionid=[% subscription.subscriptionid | html %]" onclick="popup([% subscription.subscriptionid | html %]); return false;"><i class="fa fa-refresh"></i> Renew</a>
                 [% ELSE %]
                     &nbsp;
                 [% END %]
@@ -87,7 +88,7 @@
 [% END %]
 [% IF ( subscr ) %]
 [% IF ( subscriptioncount > 1 ) %]
-<tr ><td colspan="8">  <a href="serials-collection.pl?biblionumber=[% biblionumber %]">See any subscription attached to this biblio</a></td>
+<tr ><td colspan="8">  <a href="serials-collection.pl?biblionumber=[% biblionumber | html %]">See any subscription attached to this biblio</a></td>
 </tr>
 [% END %]
 [% END %]
             [% IF year.year == 'manage' %]
                 <li><a href="#subscription-year-manage">Manage</a></li>
             [% ELSE %]
-                <li><a href="#subscription-year-[% year.year %]">[% year.year %]</a></li>
+                <li><a href="#subscription-year-[% year.year | html %]">[% year.year | html %]</a></li>
             [% END %]
         [% END %]
     [% END %]
 </ul>
 
  [% FOREACH year IN years %]
-<div id="subscription-year-[% year.year %]">
+<div id="subscription-year-[% year.year | html %]">
     [% IF ( CAN_user_serials_receive_serials ) %]
         <p>
             <div class="btn-group"><input type="submit" value="Edit serials" class="btn btn-default btn-sm" /></div>
             [% UNLESS subscription.closed %]
-                <div class="btn-group"><input type="button" value="Generate next" onclick="javascription:generateNext([% subscriptionidlist %])" class="btn btn-default btn-sm" /></div>
+                <div class="btn-group"><input type="button" value="Generate next" onclick="javascription:generateNext([% subscriptionidlist | html %])" class="btn btn-default btn-sm" /></div>
                 [% IF ( subscriptions.size == 1 and !serialsadditems ) %]&nbsp;
                     <div class="btn-group"><input type="button" value="Multi receiving" href="#multi_receiving" class="btn btn-default btn-sm" data-toggle="modal"></div>
                 [% END %]
         </p>
     [% END %]
       <span class="checkall">
-        <a class="CheckAll" href="#" onclick="CheckAll('subscription-year-[% year.year %]'); return false;">Select all</a>
+        <a class="CheckAll" href="#" onclick="CheckAll('subscription-year-[% year.year | html %]'); return false;">Select all</a>
       </span> |
       <span class="clearall">
-        <a class="CheckNone" href="#" onclick="CheckNone('subscription-year-[% year.year %]'); return false;">Clear all</a>
+        <a class="CheckNone" href="#" onclick="CheckNone('subscription-year-[% year.year | html %]'); return false;">Clear all</a>
       </span>
         <table class="subscription-year-table">
           <thead>
                     disabled
                   [% ELSE %]
                     [% IF ( serial.subscriptionexpired ) %]
-                    <input type="checkbox" name="serialid" value="[% serial.serialid %]" disabled="disabled" />
+                    <input type="checkbox" name="serialid" value="[% serial.serialid | html %]" disabled="disabled" />
                     [% ELSE %]
                       [% IF ( serial.checked ) %]
-                    <input type="checkbox" class="checkboxed" name="serialid" checked="checked" value="[% serial.serialid %]" />
+                    <input type="checkbox" class="checkboxed" name="serialid" checked="checked" value="[% serial.serialid | html %]" />
                       [% ELSE %]
-                    <input type="checkbox" class="checkboxed" name="serialid" value="[% serial.serialid %]" />
+                    <input type="checkbox" class="checkboxed" name="serialid" value="[% serial.serialid | html %]" />
                       [% END %]
                     [% END %]
                   [% END %]
                 </td>
             [% END %]
 [% IF ( subscriptions.size > 1 ) %]
-                 <td><a href="serials-collection.pl?subscriptionid=[% serial.subscriptionid %]">[% serial.subscriptionid %]</a></td>
+                 <td><a href="serials-collection.pl?subscriptionid=[% serial.subscriptionid | html %]">[% serial.subscriptionid | html %]</a></td>
 [% END %]
                 <td>
-                    <span title="[% serial.publisheddate %]">
+                    <span title="[% serial.publisheddate | html %]">
                       [% IF serial.publisheddate %]
                         [% serial.publisheddate | $KohaDates %]
                       [% ELSE %]
                 </td>
                 <td>
                    [% IF serial.publisheddatetext %]
-                      <span title="[% serial.publisheddatetext %]">
-                        [% serial.publisheddatetext %]
+                      <span title="[% serial.publisheddatetext | html %]">
+                        [% serial.publisheddatetext | html %]
                       </span>
                    [% END %]
                 </td>
                 <td>
-                    <span title="[% serial.planneddate %]">
+                    <span title="[% serial.planneddate | html %]">
                       [% IF serial.planneddate %]
                         [% serial.planneddate | $KohaDates %]
                       [% ELSE %]
                 </td>
                 <td>
                     [% IF ( matches = serial.serialseq.match('(.*)Spring(.*)') ) %]
-                        [% matches.0 %]Spring[% matches.1 %]
+                        [% matches.0 | html %]Spring[% matches.1 | html %]
                     [% ELSIF ( matches = serial.serialseq.match('(.*)Summer(.*)') ) %]
-                        [% matches.0 %]Summer[% matches.1 %]
+                        [% matches.0 | html %]Summer[% matches.1 | html %]
                     [% ELSIF ( matches = serial.serialseq.match('(.*)Fall(.*)') ) %]
-                        [% matches.0 %]Fall[% matches.1 %]
+                        [% matches.0 | html %]Fall[% matches.1 | html %]
                     [% ELSIF ( matches = serial.serialseq.match('(.*)Winter(.*)') ) %]
-                        [% matches.0 %]Winter[% matches.1 %]
+                        [% matches.0 | html %]Winter[% matches.1 | html %]
                     [% ELSIF ( matches = prediction.number.match('(.*)Spr(.*)') ) %]
-                        [% matches.0 %]Spr[% matches.1 %]
+                        [% matches.0 | html %]Spr[% matches.1 | html %]
                     [% ELSIF ( matches = prediction.number.match('(.*)Sum(.*)') ) %]
-                        [% matches.0 %]Sum[% matches.1 %]
+                        [% matches.0 | html %]Sum[% matches.1 | html %]
                     [% ELSIF ( matches = prediction.number.match('(.*)Fal(.*)') ) %]
-                        [% matches.0 %]Fal[% matches.1 %]
+                        [% matches.0 | html %]Fal[% matches.1 | html %]
                     [% ELSIF ( matches = prediction.number.match('(.*)Win(.*)') ) %]
-                        [% matches.0 %]Win[% matches.1 %]
+                        [% matches.0 | html %]Win[% matches.1 | html %]
                     [% ELSE %]
-                        [% serial.serialseq %]
+                        [% serial.serialseq | html %]
                     [% END %]
                 </td>
                 <td>
                     [% IF ( serial.status8 ) %]Stopped[% END %]
                 </td>
                 <td>
-                    [% serial.notes %]
+                    [% serial.notes | html %]
                 </td>
                 <td>
-                    [% Branches.GetName( serial.branchcode ) %]
+                    [% Branches.GetName( serial.branchcode ) | html %]
                 </td>
                 [% IF ( routing ) %]
                 <td class="actions">
-                    <a href="" onclick="print_slip([% serial.subscriptionid |html %], '[% serial.serialseq.replace("'", "\\'") |html %] ([% serial.publisheddate | $KohaDates %])'); return false" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print list</a>
+                    <a href="" onclick="print_slip([% serial.subscriptionid | html %], '[% serial.serialseq.replace("'", "\\'") | html %] ([% serial.publisheddate | $KohaDates %])'); return false" class="btn btn-default btn-xs"><i class="fa fa-print"></i> Print list</a>
                 </td>
                 [% END %]
             </tr>
       </table>
     </div>
     [% END %]
-  <input type="hidden" name="subscriptionid" value="[% subscriptionidlist %]" />
+  <input type="hidden" name="subscriptionid" value="[% subscriptionidlist | html %]" />
 
 </div>
 </form>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
-        var subscriptionid = "[% subscriptionid %]";
+        var subscriptionid = "[% subscriptionid | html %]";
         var MSG_CLOSE_SUBSCRIPTION = _("Are you sure you want to close this subscription?");
         var MSG_REOPEN_SUBSCRIPTION = _("Are you sure you want to reopen this subscription?");
         var CONFIRM_DELETE_SUBSCRIPTION = _("Are you sure you want to delete this subscription?");
     </script>
-    [% Asset.js("js/serials-toolbar.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/serials-toolbar.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 
     <script type="text/javascript">
 
index 0821f43..f661c3c 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; Serial edition [% bibliotitle %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; Serial edition [% bibliotitle | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("js/cataloging.js") %]
-[% Asset.js("js/prevent_submit.js") %]
+[% Asset.js("js/cataloging.js") | $raw %]
+[% Asset.js("js/prevent_submit.js") | $raw %]
 [% INCLUDE 'calendar.inc' %]
 <script language="JavaScript" type="text/javascript">
 //<![CDATA[
@@ -83,7 +84,7 @@ $(document).ready(function() {
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Serial edition <i>[% bibliotitle %] [% IF ( callnumber ) %]([% callnumber %])[% END %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Serial edition <i>[% bibliotitle | html %] [% IF ( callnumber ) %]([% callnumber | html %])[% END %]</i></div>
 
 <div id="doc3" class="yui-t2">
    
@@ -93,23 +94,23 @@ $(document).ready(function() {
 
     [% INCLUDE 'modals/serials_multi_receiving.inc' %]
 
-<h1>Serial edition <i>[% bibliotitle %]</i>
-    [% IF location %] ([% AuthorisedValues.GetByCode('LOC', location) %])[% END %]
-    [% IF ( callnumber ) %] callnumber: [% callnumber %][% END %]</h1>
-[% IF internalnotes %]<p>Nonpublic note: [% internalnotes %]</p>[% END %]
+<h1>Serial edition <i>[% bibliotitle | html %]</i>
+    [% IF location %] ([% AuthorisedValues.GetByCode('LOC', location) | html %])[% END %]
+    [% IF ( callnumber ) %] callnumber: [% callnumber | html %][% END %]</h1>
+[% IF internalnotes %]<p>Nonpublic note: [% internalnotes | html %]</p>[% END %]
 <form method="post" name="f" action="serials-edit.pl" id="serials_edit">
 
 [% IF ( Errors ) %]
 <div class="dialog alert">
 <ul>
-[% IF ( barcode_not_unique ) %]<li>Error: Barcode not unique for [% FOREACH errse IN errseq %]serialseq [% errse.serialseq %]<br/>[% END %]</li>[% END %]
+[% IF ( barcode_not_unique ) %]<li>Error: Barcode not unique for [% FOREACH errse IN errseq %]serialseq [% errse.serialseq | html %]<br/>[% END %]</li>[% END %]
 </ul>
 </div>
 [% END %]
 
     <input type="hidden" name="op" value="serialchangestatus" />
     [% FOREACH subscription IN subscriptions %]
-    <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid %]" />
+    <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
     [% END %]
        <table>
        <tr>
@@ -123,30 +124,30 @@ $(document).ready(function() {
 [% FOREACH serialslis IN serialslist %]
     <tr>
         <td>
-            <input type="hidden" name="serialid" value="[% serialslis.serialid %]" />
-            <input type="hidden" name="biblionumber" value="[% serialslis.biblionumber %]" />
-            <input type="hidden" name="itemcount" value="[% serialslis.issuesatonce %]" />
-            <input type="hidden" name="user" value="[% serialslis.librarian %]" />
-            Issue <input type="text" name="serialseq" id="serialseq[% serialslis.serialid %]" value="[% serialslis.serialseq %]" size="20" maxlength="100" />
+            <input type="hidden" name="serialid" value="[% serialslis.serialid | html %]" />
+            <input type="hidden" name="biblionumber" value="[% serialslis.biblionumber | html %]" />
+            <input type="hidden" name="itemcount" value="[% serialslis.issuesatonce | html %]" />
+            <input type="hidden" name="user" value="[% serialslis.librarian | html %]" />
+            Issue <input type="text" name="serialseq" id="serialseq[% serialslis.serialid | html %]" value="[% serialslis.serialseq | html %]" size="20" maxlength="100" />
         </td>
         <td>
-            <input type="text" name="publisheddate" value="[% serialslis.publisheddate %]" size="10" maxlength="15" class="datepicker" />
+            <input type="text" name="publisheddate" value="[% serialslis.publisheddate | html %]" size="10" maxlength="15" class="datepicker" />
         </td>
         <td>
-            <input type="text" name="publisheddatetext" value="[% serialslis.publisheddatetext %]" size="10" maxlength="100" />
+            <input type="text" name="publisheddatetext" value="[% serialslis.publisheddatetext | html %]" size="10" maxlength="100" />
         </td>
         <td>
-            <input type="text" name="planneddate" value="[% serialslis.planneddate %]" size="10" maxlength="15" class="datepicker" />
+            <input type="text" name="planneddate" value="[% serialslis.planneddate | html %]" size="10" maxlength="15" class="datepicker" />
         </td>
         <td>
             [% IF ( serialslis.editdisable ) %]
-              <input type="hidden" name="status" id="status[% serialslis.serialid %]" value="[% serialslis.serstatus %]">
+              <input type="hidden" name="status" id="status[% serialslis.serialid | html %]" value="[% serialslis.serstatus | html %]">
               <select name="status" size="1"  disabled="disabled">
             [% ELSE %]
               [% IF ( serialslis.serialsadditems ) %]
-              <select name="status" size="1" id="status[% serialslis.serialid %]" onchange="if (this.value==2){unHideItems('items'+[% serialslis.subscriptionid %][% serialslis.serialid %],'label[% serialslis.subscriptionid %][% serialslis.serialid %]','[% serialslis.serialid %]'); changeDate(this, '[% serialslis.arriveddate %]')} else if (this.value==7){changeDate(this, '[% serialslis.arriveddate %]')} else { HideItems('items'+[% serialslis.subscriptionid %]+[% serialslis.serialid %],'label[% serialslis.subscriptionid %][% serialslis.serialid %]'); changeDate(this, '[% serialslis.planneddate %]')}" >
+              <select name="status" size="1" id="status[% serialslis.serialid | html %]" onchange="if (this.value==2){unHideItems('items'+[% serialslis.subscriptionid | html %][% serialslis.serialid | html %],'label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]','[% serialslis.serialid | html %]'); changeDate(this, '[% serialslis.arriveddate | html %]')} else if (this.value==7){changeDate(this, '[% serialslis.arriveddate | html %]')} else { HideItems('items'+[% serialslis.subscriptionid | html %]+[% serialslis.serialid | html %],'label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]'); changeDate(this, '[% serialslis.planneddate | html %]')}" >
                [% ELSE %]
-              <select name="status" size="1" id="status[% serialslis.serialid %]" onchange="if (this.value==2 || this.value==7){changeDate(this, '[% serialslis.arriveddate %]')} else {changeDate(this, '[% serialslis.planneddate %]')}" >
+              <select name="status" size="1" id="status[% serialslis.serialid | html %]" onchange="if (this.value==2 || this.value==7){changeDate(this, '[% serialslis.arriveddate | html %]')} else {changeDate(this, '[% serialslis.planneddate | html %]')}" >
                [% END %] 
             [% END %]
             [% IF ( serialslis.status1 ) %]
@@ -211,50 +212,50 @@ $(document).ready(function() {
 
         </td>
         <td>
-            <input type="text" name="notes" value="[% serialslis.sernotes %]" size="20" maxlength="255" />
+            <input type="text" name="notes" value="[% serialslis.sernotes | html %]" size="20" maxlength="255" />
         </td>
     </tr>
   [% UNLESS ( serialslis.subscriptionexpired ) %]
   [% IF ( serialslis.serialsadditems ) %]
           <tr>
           <td colspan="6">
-      <a id="label[% serialslis.subscriptionid %][% serialslis.serialid %]" style="color: grey; font-size: 80%; cursor: pointer;"  onclick="unHideItems('items[% serialslis.subscriptionid %][% serialslis.serialid %]','label[% serialslis.subscriptionid %][% serialslis.serialid %]',  '[% serialslis.serialid %]');setStatus([% serialslis.serialid %]);">
+      <a id="label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]" style="color: grey; font-size: 80%; cursor: pointer;"  onclick="unHideItems('items[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]','label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]',  '[% serialslis.serialid | html %]');setStatus([% serialslis.serialid | html %]);">
              Click to add item</a>
-        <fieldset class="rows" style="display:none;" id="items[% serialslis.subscriptionid %][% serialslis.serialid %]">
-        <legend><a style="cursor: pointer;"  onclick="HideItems('items[% serialslis.subscriptionid %][% serialslis.serialid %]','label[% serialslis.subscriptionid %][% serialslis.serialid %]')">
+        <fieldset class="rows" style="display:none;" id="items[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]">
+        <legend><a style="cursor: pointer;"  onclick="HideItems('items[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]','label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]')">
                 Item</a>
         </legend>
           <div class="cataloguing_additem_itemlist">
         [% FOREACH item IN serialslis.items %]
-        <div id="item[% item.serialid %][% item.countitems %]" class="items">
+        <div id="item[% item.serialid | html %][% item.countitems | html %]" class="items">
         <ol>[% FOREACH iteminformatio IN item.iteminformation %]<li>
-               <div class="subfield_line" style="[% iteminformatio.hidden %]" id="subfield[% item.serialid %][% item.countitems %][% iteminformatio.subfield %][% iteminformatio.random %]">
+               <div class="subfield_line" style="[% iteminformatio.hidden | html %]" id="subfield[% item.serialid | html %][% item.countitems | html %][% iteminformatio.subfield | html %][% iteminformatio.random | html %]">
                 [% IF (iteminformatio.mandatory) %]
-                    <label class="required">[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                    <label class="required">[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                 [% ELSE %]
-                    <label>[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                    <label>[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                 [% END %]
                 [% IF ( iteminformatio.marc_value.type == 'select' ) %]
                   <select name="field_value" size="1">
                   [% FOREACH value IN iteminformatio.marc_value.values %]
                     [% IF ( value == iteminformatio.marc_value.default ) %]
-                      <option value="[% value %]" selected="selected">[% iteminformatio.marc_value.labels.$value %]</option>
+                      <option value="[% value | html %]" selected="selected">[% iteminformatio.marc_value.labels.$value | html %]</option>
                     [% ELSE %]
-                      <option value="[% value %]">[% iteminformatio.marc_value.labels.$value %]</option>
+                      <option value="[% value | html %]">[% iteminformatio.marc_value.labels.$value | html %]</option>
                     [% END %]
                   [% END %]
                   </select>
                 [% ELSE %]
-                [% iteminformatio.marc_value %]
+                [% iteminformatio.marc_value | $raw %]
                 [% END %]
-                <input type="hidden" name="itemid" value="[% item.itemid %]" />
-                <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield %]" />
-                <input type="hidden" name="tag" value="[% iteminformatio.tag %]" />
-                <input type="hidden" name="subfield" value="[% iteminformatio.subfield %]" />
-                <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory %]" />
+                <input type="hidden" name="itemid" value="[% item.itemid | html %]" />
+                <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield | html %]" />
+                <input type="hidden" name="tag" value="[% iteminformatio.tag | html %]" />
+                <input type="hidden" name="subfield" value="[% iteminformatio.subfield | html %]" />
+                <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory | html %]" />
                 [% IF ( iteminformatio.repeatable ) %]
                     <a href="#" class="buttonPlus" onclick="CloneItemSubfield(this.parentNode); return false;">
-                        <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                     </a>
                 [% END %]
                 [% IF ( iteminformatio.mandatory ) %] <span class="required">Required</span>[% END %]
@@ -262,12 +263,12 @@ $(document).ready(function() {
         [% END %]</ol></div><!-- /iteminformation -->
         
         <input type="hidden" name="moditem" value="" /> 
-        <input type="hidden" name="tag" value="[% item.itemtagfield %]" />
-        <input type="hidden" name="subfield" value="[% item.itemtagsubfield %]" />
-        <input type="hidden" name="serial" value="[% item.serialid %]" />
-        <input type="hidden" name="bibnum" value="[% item.biblionumber %]" />
-        <input type="hidden" name="itemid" value="[% item.itemid %]" />
-        <input type="hidden" name="field_value" value="[% item.itemnumber %]" />
+        <input type="hidden" name="tag" value="[% item.itemtagfield | html %]" />
+        <input type="hidden" name="subfield" value="[% item.itemtagsubfield | html %]" />
+        <input type="hidden" name="serial" value="[% item.serialid | html %]" />
+        <input type="hidden" name="bibnum" value="[% item.biblionumber | html %]" />
+        <input type="hidden" name="itemid" value="[% item.itemid | html %]" />
+        <input type="hidden" name="field_value" value="[% item.itemnumber | html %]" />
         [% END %] <!-- /items -->
         </div>
         </fieldset>
@@ -281,22 +282,22 @@ $(document).ready(function() {
     <tr>
         <td>
             <input type="hidden" name="serialid" value="NEW" />
-            <input type="hidden" name="biblionumber" value="[% newserialloo.biblionumber %]" />
-            <input type="hidden" name="itemcount" value="[% newserialloo.issuesatonce %]" />
-            <input type="hidden" name="user" value="[% newserialloo.librarian %]" />
-            Supplemental issue <input type="text" name="serialseq" id="serialseq[% newserialloo.serialid %]" value="" size="20" maxlength="100" onchange="if (this.value!=''){unHideItems('items[% newserialloo.subscriptionid %][% newserialloo.serialid %]','label[% newserialloo.subscriptionid %][% newserialloo.serialid %]', '[% newserialloo.serialid %]')} else {HideItems('items[% newserialloo.subscriptionid %][% newserialloo.serialid %]','label[% newserialloo.subscriptionid %][% newserialloo.serialid %]')}" />
+            <input type="hidden" name="biblionumber" value="[% newserialloo.biblionumber | html %]" />
+            <input type="hidden" name="itemcount" value="[% newserialloo.issuesatonce | html %]" />
+            <input type="hidden" name="user" value="[% newserialloo.librarian | html %]" />
+            Supplemental issue <input type="text" name="serialseq" id="serialseq[% newserialloo.serialid | html %]" value="" size="20" maxlength="100" onchange="if (this.value!=''){unHideItems('items[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]', '[% newserialloo.serialid | html %]')} else {HideItems('items[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]')}" />
         </td>
         <td>
-            <input type="text" name="publisheddate" value="[% newserialloo.publisheddate %]" size="10" maxlength="15"  class="datepicker" />
+            <input type="text" name="publisheddate" value="[% newserialloo.publisheddate | html %]" size="10" maxlength="15"  class="datepicker" />
         </td>
         <td>
-            <input type="text" name="publisheddatetext" value="[% newserialloo.publisheddatetext %]" size="10" maxlength="100" />
+            <input type="text" name="publisheddatetext" value="[% newserialloo.publisheddatetext | html %]" size="10" maxlength="100" />
         </td>
         <td>
-            <input type="text" name="planneddate" value="[% newserialloo.planneddate %]" size="10" maxlength="15" class="datepicker" />
+            <input type="text" name="planneddate" value="[% newserialloo.planneddate | html %]" size="10" maxlength="15" class="datepicker" />
         </td>
         <td>
-            <select name="status" size="1" id="addstatus[% newserialloo.serialid %]" onchange="if (this.value==2){unHideItems('items'+'[% newserialloo.subscriptionid %][% newserialloo.serialid %]','label[% newserialloo.subscriptionid %][% newserialloo.serialid %]','[% newserialloo.serialid %]'); changeDate(this, '[% newserialloo.arriveddate %]')} else if (this.value==7){changeDate(this, '[% newserialloo.arriveddate %]')} else { HideItems('items'+'[% newserialloo.subscriptionid %]'+[% newserialloo.serialid %],'label[% serialslis.subscriptionid %][% serialslis.serialid %]'); changeDate(this, '[% serialslis.planneddate %]')}" >
+            <select name="status" size="1" id="addstatus[% newserialloo.serialid | html %]" onchange="if (this.value==2){unHideItems('items'+'[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','[% newserialloo.serialid | html %]'); changeDate(this, '[% newserialloo.arriveddate | html %]')} else if (this.value==7){changeDate(this, '[% newserialloo.arriveddate | html %]')} else { HideItems('items'+'[% newserialloo.subscriptionid | html %]'+[% newserialloo.serialid | html %],'label[% serialslis.subscriptionid | html %][% serialslis.serialid | html %]'); changeDate(this, '[% serialslis.planneddate | html %]')}" >
 
                     <option value="">----</option>
                   [% IF ( newserialloo.status1 ) %]
@@ -365,42 +366,42 @@ $(document).ready(function() {
   [% IF ( newserialloo.serialsadditems ) %]
           <tr>
           <td colspan="6">
-      <a id="label[% newserialloo.subscriptionid %][% newserialloo.serialid %]" style="color: grey; font-size: 80%; cursor: pointer;"  onclick="unHideItems('items[% newserialloo.subscriptionid %][% newserialloo.serialid %]','label[% newserialloo.subscriptionid %][% newserialloo.serialid %]', '[% newserialloo.serialid %]')">
+      <a id="label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]" style="color: grey; font-size: 80%; cursor: pointer;"  onclick="unHideItems('items[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]', '[% newserialloo.serialid | html %]')">
              Click to add item</a>
-        <fieldset  class="rows" style="display:none;" id="items[% newserialloo.subscriptionid %][% newserialloo.serialid %]">
-        <legend><a style="cursor: pointer;"  onclick="HideItems('items[% newserialloo.subscriptionid %][% newserialloo.serialid %]','label[% newserialloo.subscriptionid %][% newserialloo.serialid %]')">
+        <fieldset  class="rows" style="display:none;" id="items[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]">
+        <legend><a style="cursor: pointer;"  onclick="HideItems('items[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]','label[% newserialloo.subscriptionid | html %][% newserialloo.serialid | html %]')">
                 Item</a>
         </legend>
           <div class="cataloguing_additem_itemlist">
-        <div id="item[% newserialloo.serialid %][% newserialloo.countitems %]" class="items">
+        <div id="item[% newserialloo.serialid | html %][% newserialloo.countitems | html %]" class="items">
         <ol>[% FOREACH iteminformatio IN newserialloo.iteminformation %]<li>
-               <div class="subfield_line" style="[% iteminformatio.hidden %]" id="subfield[% newserialloo.serialid %][% newserialloo.countitems %][% iteminformatio.subfield %][% iteminformatio.random %]">
+               <div class="subfield_line" style="[% iteminformatio.hidden | html %]" id="subfield[% newserialloo.serialid | html %][% newserialloo.countitems | html %][% iteminformatio.subfield | html %][% iteminformatio.random | html %]">
                 [% IF (iteminformatio.mandatory) %]
-                    <label class="required">[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                    <label class="required">[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                 [% ELSE %]
-                    <label>[% iteminformatio.subfield %] - [% iteminformatio.marc_lib %]</label>
+                    <label>[% iteminformatio.subfield | html %] - [% iteminformatio.marc_lib | $raw %]</label>
                 [% END %]
                 [% IF ( iteminformatio.marc_value.type == 'select' ) %]
                   <select name="field_value" size="1">
                   [% FOREACH value IN iteminformatio.marc_value.values %]
                     [% IF ( value == iteminformatio.marc_value.default ) %]
-                      <option value="[% value %]" selected="selected">[% iteminformatio.marc_value.labels.$value %]</option>
+                      <option value="[% value | html %]" selected="selected">[% iteminformatio.marc_value.labels.$value | html %]</option>
                     [% ELSE %]
-                      <option value="[% value %]">[% iteminformatio.marc_value.labels.$value %]</option>
+                      <option value="[% value | html %]">[% iteminformatio.marc_value.labels.$value | html %]</option>
                     [% END %]
                   [% END %]
                   </select>
                 [% ELSE %]
-                [% iteminformatio.marc_value %]
+                [% iteminformatio.marc_value | $raw %]
                 [% END %]
-                <input type="hidden" name="itemid" value="[% newserialloo.itemid %]" />
-                <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield %]" />
-                <input type="hidden" name="tag" value="[% iteminformatio.tag %]" />
-                <input type="hidden" name="subfield" value="[% iteminformatio.subfield %]" />
-                <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory %]" />
+                <input type="hidden" name="itemid" value="[% newserialloo.itemid | html %]" />
+                <input type="hidden" name="kohafield" value="[% iteminformatio.kohafield | html %]" />
+                <input type="hidden" name="tag" value="[% iteminformatio.tag | html %]" />
+                <input type="hidden" name="subfield" value="[% iteminformatio.subfield | html %]" />
+                <input type="hidden" name="mandatory" value="[% iteminformatio.mandatory | html %]" />
                 [% IF ( iteminformatio.repeatable ) %]
                     <a href="#" class="buttonPlus" onclick="CloneItemSubfield(this.parentNode); return false;">
-                        <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                     </a>
                 [% END %]
                 [% IF ( iteminformatio.mandatory ) %] <span class="required">Required</span>[% END %]
@@ -408,12 +409,12 @@ $(document).ready(function() {
        </li>[% END %]</ol>
         
         <input type="hidden" name="moditem" value="" /> 
-        <input type="hidden" name="tag" value="[% newserialloo.itemtagfield %]" />
-        <input type="hidden" name="subfield" value="[% newserialloo.itemtagsubfield %]" />
-        <input type="hidden" name="serial" value="[% newserialloo.serialid %]" />
-        <input type="hidden" name="bibnum" value="[% newserialloo.biblionumber %]" />
-        <input type="hidden" name="itemid" value="[% newserialloo.itemid %]" />
-        <input type="hidden" name="field_value" value="[% newserialloo.itemnumber %]" />
+        <input type="hidden" name="tag" value="[% newserialloo.itemtagfield | html %]" />
+        <input type="hidden" name="subfield" value="[% newserialloo.itemtagsubfield | html %]" />
+        <input type="hidden" name="serial" value="[% newserialloo.serialid | html %]" />
+        <input type="hidden" name="bibnum" value="[% newserialloo.biblionumber | html %]" />
+        <input type="hidden" name="itemid" value="[% newserialloo.itemid | html %]" />
+        <input type="hidden" name="field_value" value="[% newserialloo.itemnumber | html %]" />
         </div>
         </div>
         </fieldset>
@@ -440,15 +441,15 @@ $(document).ready(function() {
 [% INCLUDE 'serials-menu.inc' %]
 <ul>
     [% FOREACH subscription IN subscriptions %]
-        <li><a href="serials-collection.pl?subscriptionid=[% subscription.subscriptionid %]" title="serial collection for [% subscription.bibliotitle %]">Serial collection #[% subscription.subscriptionid %]</a></li>
-        <li><a href="subscription-detail.pl?subscriptionid=[% subscription.subscriptionid %]" title="detail of the subscription">Subscription #[% subscription.subscriptionid %]</a></li>
+        <li><a href="serials-collection.pl?subscriptionid=[% subscription.subscriptionid | html %]" title="serial collection for [% subscription.bibliotitle | html %]">Serial collection #[% subscription.subscriptionid | html %]</a></li>
+        <li><a href="subscription-detail.pl?subscriptionid=[% subscription.subscriptionid | html %]" title="detail of the subscription">Subscription #[% subscription.subscriptionid | html %]</a></li>
         [% IF ( subscription.abouttoexpire ) %]
           [% UNLESS subscription.closed %]
-            <li><a href="#" onclick="javascript:popup([% subscription.subscriptionid %])">Renew #[% subscription.subscriptionid %]</a></li>
+            <li><a href="#" onclick="javascript:popup([% subscription.subscriptionid | html %])">Renew #[% subscription.subscriptionid | html %]</a></li>
           [% END %]
         [% END %]
     [% END %]
-    <li><a href="/cgi-bin/koha/catalogue/[% default_bib_view %].pl?biblionumber=[% biblionumber %]" title="go to [% bibliotitle %]">Show biblio</a></li></ul>
+    <li><a href="/cgi-bin/koha/catalogue/[% default_bib_view | html %].pl?biblionumber=[% biblionumber | html %]" title="go to [% bibliotitle | html %]">Show biblio</a></li></ul>
 </div>
 </div>
 [% INCLUDE 'intranet-bottom.inc' %]
index d6ecbc4..7673939 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials [% biblionumber %]</title>
+<title>Koha &rsaquo; Serials [% biblionumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="ser_serials-home" class="ser">
@@ -24,9 +25,9 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/serials-toolbar.js") %]
+    [% Asset.js("js/serials-toolbar.js") | $raw %]
     <script type="text/javascript">
-        var subscriptionid = "[% subscriptionid %]";
+        var subscriptionid = "[% subscriptionid | html %]";
         var MSG_CLOSE_SUBSCRIPTION = _("Are you sure you want to close this subscription?");
         var MSG_REOPEN_SUBSCRIPTION = _("Are you sure you want to reopen this subscription?");
         var CONFIRM_DELETE_SUBSCRIPTION = _("Are you sure you want to delete this subscription?");
index 08f46f7..91cb45b 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Branches %]
@@ -5,9 +6,9 @@
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials [% biblionumber %]</title>
+<title>Koha &rsaquo; Serials [% biblionumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">input.dt-filter { width : 100%; font-size : 85%; }</style>
 </head>
 
 
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; [% IF ( done_searched ) %]<a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Search results[% ELSE %]Serials [% END %] </div>
 
-[% url_params = [] %]
+[% url_params = [] | html %]
 [% FOREACH param IN CGI.params.pairs %]
-    [% escaped_value = BLOCK %][% param.value | uri %][% END %]
-    [% url_params.push(param.key _ '=' _ escaped_value) %]
+    [% escaped_value = BLOCK | html %][% param.value | uri %][% END %]
+    [% url_params.push(param.key _ '=' _ escaped_value) | html %]
 [% END %]
 [% SET referrer = '/cgi-bin/koha/serials/serials-search.pl?' %]
-[% referrer = BLOCK %][% referrer | url %][% url_params.join("&amp;") |uri %][% END %]
+[% referrer = BLOCK | html %][% referrer | url %][% url_params.join("&amp;") |uri %][% END %]
 [% SET edit_action_link = '/cgi-bin/koha/serials/subscription-batchedit.pl?referrer=' _ referrer %]
 
 [% BLOCK subscriptions_table %]
@@ -36,9 +37,9 @@
     [% END %]
     [% IF CAN_user_serials_edit_subscription %]
         <div class="actions">
-            <a class="select-all" href="#" data-tab="[% tab %]"><i class="fa fa-check"></i> Select all</a>
+            <a class="select-all" href="#" data-tab="[% tab | html %]"><i class="fa fa-check"></i> Select all</a>
             |
-            <a class="clear-all" href="#" data-tab="[% tab %]"><i class="fa fa-remove"></i> Clear all</a>
+            <a class="clear-all" href="#" data-tab="[% tab | html %]"><i class="fa fa-remove"></i> Clear all</a>
             <span class="itemselection_actions">
                 | Actions:
                 <a class="itemselection_action_modify"><i class="fa fa-pencil"></i> Edit selected serials</a>
@@ -59,7 +60,7 @@
                 <th class="title-string">Expiration date</th>
             [% END %]
             [% FOR field IN additional_fields_for_subscription %]
-              <th>[% field.name %]</th>
+              <th>[% field.name | html %]</th>
             [% END %]
             <th class="NoSort">Actions</th>
         </tr>
@@ -77,7 +78,7 @@
               <td><input type="text" class="dt-filter" data-column_num="6" placeholder="Search expiration date" /></td>
           [% END %]
           [% FOR field IN additional_fields_for_subscription %]
-            <td><input type="text" class="dt-filter" data-column_num="[% loop.count + 6 %]" placeholder="Search [% field.name %]" /></td>
+            <td><input type="text" class="dt-filter" data-column_num="[% loop.count + 6 | html %]" placeholder="Search [% field.name | html %]" /></td>
           [% END %]
           <td></td>
         </tr>
           <tr>
             <td>
                 [% UNLESS subscription.cannotedit %]
-                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid %]" />
+                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
                 [% ELSE %]
-                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid %]" disabled="disabled" title="You cannot edit this subscription" />
+                    <input type="checkbox" name="subscriptionid" value="[% subscription.subscriptionid | html %]" disabled="disabled" title="You cannot edit this subscription" />
                 [% END %]
             </td>
             <td>
-            [% IF ( subscription.issn ) %][% subscription.issn %]
+            [% IF ( subscription.issn ) %][% subscription.issn | html %]
             [% END %]
             </td>
-            <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid %]" class="button" title="subscription detail">[% subscription.title |html %]</a>
+            <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid | html %]" class="button" title="subscription detail">[% subscription.title | html %]</a>
             </td>
-            <td>[% IF ( subscription.publicnotes ) %][% subscription.publicnotes %][% END %]
-            [% IF ( subscription.internalnotes ) %]([% subscription.internalnotes %])[% END %]
+            <td>[% IF ( subscription.publicnotes ) %][% subscription.publicnotes | html %][% END %]
+            [% IF ( subscription.internalnotes ) %]([% subscription.internalnotes | html %])[% END %]
             </td>
             <td>
-              [% IF ( subscription.branchcode ) %][% Branches.GetName( subscription.branchcode ) %][% END %]
+              [% IF ( subscription.branchcode ) %][% Branches.GetName( subscription.branchcode ) | html %][% END %]
             </td>
             <td>
-              [% IF ( subscription.location ) %][% AuthorisedValues.GetByCode( 'LOC', subscription.location ) %][% END %]
+              [% IF ( subscription.location ) %][% AuthorisedValues.GetByCode( 'LOC', subscription.location ) | html %][% END %]
             </td>
             <td>
-              [% IF ( subscription.callnumber ) %][% subscription.callnumber %][% END %]
+              [% IF ( subscription.callnumber ) %][% subscription.callnumber | html %][% END %]
             </td>
             [% UNLESS closed %]
                 <td>
                     [% IF ( subscription.enddate ) %]
-                        <span title="[% subscription.enddate %]">[% subscription.enddate | $KohaDates %]</span>
+                        <span title="[% subscription.enddate | html %]">[% subscription.enddate | $KohaDates %]</span>
                     [% ELSE %]
                         <span title="0000-00-00"></span>
                     [% END %]
 
             [% FOR field IN additional_fields_for_subscription %]
               [% IF field.authorised_value_category %]
-                <td>[% AuthorisedValues.GetByCode( field.authorised_value_category, subscription.additional_fields.${field.name} ) %]</td>
+                <td>[% AuthorisedValues.GetByCode( field.authorised_value_category, subscription.additional_fields.${field.name} ) | html %]</td>
               [% ELSE %]
-                <td>[% subscription.additional_fields.${field.name} %]</td>
+                <td>[% subscription.additional_fields.${field.name} | html %]</td>
               [% END %]
             [% END %]
 
             <td>
                 <div class="dropdown">
                     [% IF closed %]
-                        <a class="btn btn-default btn-xs dropdown-toggle" id="closedsubactions[% subscription.subscriptionid %]" role="button" data-toggle="dropdown" href="#">
+                        <a class="btn btn-default btn-xs dropdown-toggle" id="closedsubactions[% subscription.subscriptionid | html %]" role="button" data-toggle="dropdown" href="#">
                            Actions <b class="caret"></b>
                         </a>
-                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="closedsubactions[% subscription.subscriptionid %]">
+                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="closedsubactions[% subscription.subscriptionid | html %]">
 
                             [% IF ( routing && CAN_user_serials_routing ) %]
                                 [% UNLESS ( subscription.cannotedit ) %]
                                     <li>
-                                        <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=reopen&amp;routing=[% subscription.routing %]&amp;searched=1&amp;title_filter=[% title_filter | uri %]&amp;ISSN_filter=[% ISSN_filter | uri %]&amp;EAN_filter=[% EAN_filter | uri %]&amp;published_filter=[% publisher_filter | uri %]&amp;bookseller_filter=[% bookseller_filter | uri %]&amp;branch_filter=[% branch_filter | uri %]" id="reopensub"> <i class="fa fa-repeat"></i> Reopen</a>
+                                        <a href="/cgi-bin/koha/serials/serials-search.pl?subscriptionid=[% subscription.subscriptionid | html %]&amp;op=reopen&amp;routing=[% subscription.routing | html %]&amp;searched=1&amp;title_filter=[% title_filter | uri %]&amp;ISSN_filter=[% ISSN_filter | uri %]&amp;EAN_filter=[% EAN_filter | uri %]&amp;published_filter=[% publisher_filter | uri %]&amp;bookseller_filter=[% bookseller_filter | uri %]&amp;branch_filter=[% branch_filter | uri %]" id="reopensub"> <i class="fa fa-repeat"></i> Reopen</a>
                                     </li>
                                 [% END %]
                             [% END # IF ( routing && CAN_user_serials_routing ) %]
 
                             <li>
-                                <a href="/cgi-bin/koha/serials/serials-collection.pl?subscriptionid=[% subscription.subscriptionid %]"><i class="fa fa-list-alt"></i> Issue history</a>
+                                <a href="/cgi-bin/koha/serials/serials-collection.pl?subscriptionid=[% subscription.subscriptionid | html %]"><i class="fa fa-list-alt"></i> Issue history</a>
                             </li>
 
                         </ul>
                             [% IF ( CAN_user_serials_receive_serials ) %]
                                 [%# There should be no space between these two buttons, it would render badly %]
                                 <a class="btn btn-default btn-xs" role="button"
-                                   href="/cgi-bin/koha/serials/serials-edit.pl?subscriptionid=[% subscription.subscriptionid %]&amp;serstatus=1,3,7"><i
+                                   href="/cgi-bin/koha/serials/serials-edit.pl?subscriptionid=[% subscription.subscriptionid | html %]&amp;serstatus=1,3,7"><i
                                    class="fa fa-inbox"></i> Serial receive</a><a
-                                   class="btn btn-default btn-xs dropdown-toggle" id="subactions[% subscription.subscriptionid %]" role="button"
+                                   class="btn btn-default btn-xs dropdown-toggle" id="subactions[% subscription.subscriptionid | html %]" role="button"
                                    data-toggle="dropdown" href="#"><b class="caret"></b></a>
                             [% ELSE %]
-                                <a class="btn btn-default btn-xs dropdown-toggle" id="subactions[% subscription.subscriptionid %]" role="button" data-toggle="dropdown" href="#">Actions <b class="caret"></b></a>
+                                <a class="btn btn-default btn-xs dropdown-toggle" id="subactions[% subscription.subscriptionid | html %]" role="button" data-toggle="dropdown" href="#">Actions <b class="caret"></b></a>
                             [% END %]
-                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="subactions[% subscription.subscriptionid %]">
+                        <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="subactions[% subscription.subscriptionid | html %]">
 
                             [% IF ( routing && CAN_user_serials_routing ) %]
                                 [% IF ( subscription.cannotedit ) %]
                                 [% ELSE %]
                                     [% IF ( subscription.routingedit ) %]
                                         <li>
-                                            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid %]"><i class="fa fa-pencil"></i> Edit routing list ([% subscription.routingedit %])</a>
+                                            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid | html %]"><i class="fa fa-pencil"></i> Edit routing list ([% subscription.routingedit | html %])</a>
                                         </li>
                                     [% ELSE %]
                                         <li>
-                                            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid %]&amp;op=new"> <i class="fa fa-plus"></i> New routing list</a>
+                                            <a href="/cgi-bin/koha/serials/routing.pl?subscriptionid=[% subscription.subscriptionid | html %]&amp;op=new"> <i class="fa fa-plus"></i> New routing list</a>
                                         </li>
                                     [% END %]
                                 [% END %]
                             [% END # IF ( routing && CAN_user_serials_routing ) %]
 
                             <li>
-                                <a href="/cgi-bin/koha/serials/serials-collection.pl?subscriptionid=[% subscription.subscriptionid %]"><i class="fa fa-list-alt"></i> Issue history</a>
+                                <a href="/cgi-bin/koha/serials/serials-collection.pl?subscriptionid=[% subscription.subscriptionid | html %]"><i class="fa fa-list-alt"></i> Issue history</a>
                             </li>
                         </ul>
                         </div>
       [% INCLUDE 'serials-toolbar.inc' %]
 
       [% IF ( done_searched ) %]
-        <h2>Serials subscriptions ([% total %] found)</h2>
+        <h2>Serials subscriptions ([% total | html %] found)</h2>
       [% ELSE %]
         <h2>Serials subscriptions search</h2>
       [% END %]
                 </li>
                 [% FOR field IN additional_fields_for_subscription %]
                   <li>
-                    <label for="additional_field_[% field.id %]"> [% field.name %]: </label>
+                    <label for="additional_field_[% field.id | html %]"> [% field.name | html %]: </label>
                     [% IF field.authorised_value_choices %]
-                      <select id="additional_field_[% field.id %]" name="additional_field_[% field.id %]_filter">
+                      <select id="additional_field_[% field.id | html %]" name="additional_field_[% field.id | html %]_filter">
                         <option value="">All</option>
                         [% FOREACH av IN field.authorised_value_choices %]
-                          <option value="[% av.authorised_value %]">[% av.lib %]</option>
+                          <option value="[% av.authorised_value | html %]">[% av.lib | html %]</option>
                         [% END %]
                       </select>
                     [% ELSE %]
-                      <input id="additional_field_[% field.id %]" type="text" value="[% additional_fields.${field.name} %]" name="additional_field_[% field.id %]_filter" />
+                      <input id="additional_field_[% field.id | html %]" type="text" value="[% additional_fields.${field.name} | html %]" name="additional_field_[% field.id | html %]_filter" />
                     [% END %]
                   </li>
                 [% END %]
         [% IF ( total ) %]
           <div id="serialstabs" class="toptabs" style="clear:both;">
             <ul class="ui-tabs-nav">
-              <li><a href="#opened">Open ([% openedsubscriptions.size || 0 %])</a></li>
-              <li><a href="#closed">Closed ([% closedsubscriptions.size || 0 %])</a></li>
+              <li><a href="#opened">Open ([% openedsubscriptions.size || 0 | html %])</a></li>
+              <li><a href="#closed">Closed ([% closedsubscriptions.size || 0 | html %])</a></li>
             </ul>
             <div id="opened">
               [% IF openedsubscriptions %]
 
                 [% FOR field IN additional_fields_for_subscription %]
                   <li>
-                    <label for="additional_field_[% field.id %]ID"> [% field.name %]: </label>
+                    <label for="additional_field_[% field.id | html %]ID"> [% field.name | html %]: </label>
                     [% IF field.authorised_value_choices %]
-                      <select id="additional_field_[% field.id %]" name="additional_field_[% field.id %]_filter">
+                      <select id="additional_field_[% field.id | html %]" name="additional_field_[% field.id | html %]_filter">
                         <option value="">All</option>
                         [% FOREACH av IN field.authorised_value_choices %]
                           [% IF av.authorised_value == additional_field_filters.${field.name}.value %]
-                            <option value="[% av.authorised_value %]" selected="selected">[% av.lib %]</option>
+                            <option value="[% av.authorised_value | html %]" selected="selected">[% av.lib | html %]</option>
                           [% ELSE %]
-                            <option value="[% av.authorised_value %]">[% av.lib %]</option>
+                            <option value="[% av.authorised_value | html %]">[% av.lib | html %]</option>
                           [% END %]
                         [% END %]
                       </select>
                     [% ELSE %]
-                      <input id="additional_field_[% field.id %]" type="text" value="[% additional_field_filters.${field.name}.value %]" name="additional_field_[% field.id %]_filter" />
+                      <input id="additional_field_[% field.id | html %]" type="text" value="[% additional_field_filters.${field.name}.value | html %]" name="additional_field_[% field.id | html %]_filter" />
                     [% END %]
                   </li>
                 [% END %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
-        var subscriptionid = "[% subscriptionid %]";
+        var subscriptionid = "[% subscriptionid | html %]";
         var MSG_CLOSE_SUBSCRIPTION = _("Are you sure you want to close this subscription?");
         var MSG_REOPEN_SUBSCRIPTION = _("Are you sure you want to reopen this subscription?");
         var CONFIRM_DELETE_SUBSCRIPTION = _("Are you sure you want to delete this subscription?");
     </script>
-    [% Asset.js("js/serials-toolbar.js") %]
+    [% Asset.js("js/serials-toolbar.js") | $raw %]
     <script type="text/javascript">
 
             function itemSelectionBuildEditLink(div) {
                     subscription_ids.push($(this).val());
                 });
                 if (subscription_ids.length > 0) {
-                    var url = "[% edit_action_link %]";
+                    var url = "[% edit_action_link | html %]";
                     url += '&subscriptionid=' + subscription_ids.join('&subscriptionid=');
                     $('a.itemselection_action_modify').attr('href', url);
                 } else {
index c137a77..d99b946 100644 (file)
       <tr>
         <td>
             [% IF ( matches = prediction.number.match('(.*)Spring(.*)') ) %]
-                [% matches.0 %]Spring[% matches.1 %]
+                [% matches.0 | html %]Spring[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Summer(.*)') ) %]
-                [% matches.0 %]Summer[% matches.1 %]
+                [% matches.0 | html %]Summer[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Fall(.*)') ) %]
-                [% matches.0 %]Fall[% matches.1 %]
+                [% matches.0 | html %]Fall[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Winter(.*)') ) %]
-                [% matches.0 %]Winter[% matches.1 %]
+                [% matches.0 | html %]Winter[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Spr(.*)') ) %]
-                [% matches.0 %]Spr[% matches.1 %]
+                [% matches.0 | html %]Spr[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Sum(.*)') ) %]
-                [% matches.0 %]Sum[% matches.1 %]
+                [% matches.0 | html %]Sum[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Fal(.*)') ) %]
-                [% matches.0 %]Fal[% matches.1 %]
+                [% matches.0 | html %]Fal[% matches.1 | html %]
             [% ELSIF ( matches = prediction.number.match('(.*)Win(.*)') ) %]
-                [% matches.0 %]Win[% matches.1 %]
+                [% matches.0 | html %]Win[% matches.1 | html %]
             [% ELSE %]
-                [% prediction.number %]
+                [% prediction.number | html %]
             [% END %]
         </td>
         <td>
@@ -72,9 +72,9 @@
          <td style="text-align:center">
          [% UNLESS (loop.first) %]
           [% IF (prediction.not_published) %]
-            <input type="checkbox" name="irregularity" value="[% prediction.issuenumber %]" data-dow="[% prediction.dow %]" checked="checked" />
+            <input type="checkbox" name="irregularity" value="[% prediction.issuenumber | html %]" data-dow="[% prediction.dow | html %]" checked="checked" />
           [% ELSE %]
-            <input type="checkbox" name="irregularity" value="[% prediction.issuenumber %]" data-dow="[% prediction.dow %]" />
+            <input type="checkbox" name="irregularity" value="[% prediction.issuenumber | html %]" data-dow="[% prediction.dow | html %]" />
           [% END %]
          </td>
          [% END %]
index 8f95b49..846cbc3 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; [% IF ( modify ) %][% bibliotitle |html %] &rsaquo; Modify subscription[% ELSE %]New subscription[% END %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; [% IF ( modify ) %][% bibliotitle | html %] &rsaquo; Modify subscription[% ELSE %]New subscription[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 <style type="text/css">
 fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
@@ -17,20 +18,20 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; [% IF ( modify ) %]<a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid %]"><i>[% bibliotitle |html %]</i></a> &rsaquo; Modify subscription[% ELSE %]New subscription[% END %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; [% IF ( modify ) %]<a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscriptionid | html %]"><i>[% bibliotitle | html %]</i></a> &rsaquo; Modify subscription[% ELSE %]New subscription[% END %]</div>
 
 <div class="main container-fluid">
     <div class="row">
 
-            <h1>[% IF ( modify ) %] Modify subscription for <i>[% bibliotitle |html %]</i>[% ELSE %]Add a new subscription[% END %] (<span id="page_number">1/2</span>)</h1>
+            <h1>[% IF ( modify ) %] Modify subscription for <i>[% bibliotitle | html %]</i>[% ELSE %]Add a new subscription[% END %] (<span id="page_number">1/2</span>)</h1>
             <form method="post" id="subscription_add_form" name="f" action="/cgi-bin/koha/serials/subscription-add.pl" class="validated">
                 [% IF ( modify ) %]
                     <input type="hidden" name="op" value="modsubscription" />
-                    <input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+                    <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
                 [% ELSE %]
                         <input type="hidden" name="op" value="addsubscription" />
                 [% END %]
-                <input type="hidden" name="user" value="[% loggedinusername %]" />
+                <input type="hidden" name="user" value="[% loggedinusername | html %]" />
                 <input type="hidden" name="irreg_check" value="0" />
 
                 <div id="page_1">
@@ -39,20 +40,20 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                             <legend>Subscription details</legend>
                             <ol>
                                 [% IF ( subscriptionid ) %]
-                                    <li><span class="label">Subscription #</span> [% subscriptionid %]</li>
+                                    <li><span class="label">Subscription #</span> [% subscriptionid | html %]</li>
                                 [% END %]
                                 <li>
                                     <label for="aqbooksellerid">Vendor: </label>
-                                    <input type="text" name="aqbooksellerid" id="aqbooksellerid" value="[% aqbooksellerid %]" size="8" /> (<input type="text" name="aqbooksellername" id="aqbooksellername" value="[% aqbooksellername %]" disabled="disabled" readonly="readonly" />) <a href="#" id="vendor_search"><i class="fa fa-search"></i> Search for a vendor</a>
+                                    <input type="text" name="aqbooksellerid" id="aqbooksellerid" value="[% aqbooksellerid | html %]" size="8" /> (<input type="text" name="aqbooksellername" id="aqbooksellername" value="[% aqbooksellername | html %]" disabled="disabled" readonly="readonly" />) <a href="#" id="vendor_search"><i class="fa fa-search"></i> Search for a vendor</a>
                                 </li>
                                 <li>
                                     <label for="biblionumber" class="required" title="Subscriptions must be associated with a bibliographic record">Record:</label>
-                                    <input type="text" name="biblionumber" id="biblionumber" value="[% bibnum %]" size="8" />
-                                    (<input type="text" name="title" value="[% bibliotitle %]" disabled="disabled" readonly="readonly" />) <span class="required" title="Subscriptions must be associated with a bibliographic record">Required</span>
+                                    <input type="text" name="biblionumber" id="biblionumber" value="[% bibnum | html %]" size="8" />
+                                    (<input type="text" name="title" value="[% bibliotitle | html %]" disabled="disabled" readonly="readonly" />) <span class="required" title="Subscriptions must be associated with a bibliographic record">Required</span>
                                     <div class="inputnote"> <a href="#" id="record_search"><i class="fa fa-search"></i> Search for record</a>
                                         [% IF ( CAN_user_editcatalogue ) %]
                                             [% IF ( modify ) %]
-                                            | <a href="#" id="biblio_add_edit" data-biblionumber="[% bibnum %]"><i class="fa fa-pencil"></i> Edit record</a>
+                                            | <a href="#" id="biblio_add_edit" data-biblionumber="[% bibnum | html %]"><i class="fa fa-pencil"></i> Edit record</a>
                                             [% ELSE %]
                                             | <a href="#" id="biblio_add_edit"><i class="fa fa-plus"></i> Create record</a>
                                             [% END %]
@@ -100,7 +101,7 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                 </li>
                                 <li>
                                     <label for="callnumber">Call number:</label>
-                                    <input type="text" name="callnumber" id="callnumber" value="[% callnumber %]" size="20" />
+                                    <input type="text" name="callnumber" id="callnumber" value="[% callnumber | html %]" size="20" />
                                 </li>
                                 <li>
                                     <label for="branchcode">Library:</label>
@@ -117,11 +118,11 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                 </li>
                                 <li>
                                     <label for="notes">Public note:</label>
-                                    <textarea name="notes" id="notes" cols="30" rows="2">[% notes %]</textarea>
+                                    <textarea name="notes" id="notes" cols="30" rows="2">[% notes | html %]</textarea>
                                 </li>
                                 <li>
                                     <label for="internalnotes">Nonpublic note:</label>
-                                    <textarea name="internalnotes" id="internalnotes" cols="30" rows="2">[% internalnotes %]</textarea>
+                                    <textarea name="internalnotes" id="internalnotes" cols="30" rows="2">[% internalnotes | html %]</textarea>
                                 </li>
                                 <li>
                                     [% IF ( letterloop ) %]
@@ -130,9 +131,9 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                             <option value="">None</option>
                                             [% FOREACH letterloo IN letterloop %]
                                                 [% IF ( letterloo.selected ) %]
-                                                    <option value="[% letterloo.value %]" selected="selected">[% letterloo.lettername %]</option>
+                                                    <option value="[% letterloo.value | html %]" selected="selected">[% letterloo.lettername | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% letterloo.value %]">[% letterloo.lettername %]</option>
+                                                    <option value="[% letterloo.value | html %]">[% letterloo.lettername | html %]</option>
                                                 [% END %]
                                             [% END %]
                                         </select>
@@ -148,9 +149,9 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                         <option value="">None</option>
                                         [% FOREACH locations_loo IN locations_loop %]
                                             [% IF locations_loo.authorised_value == location %]
-                                                <option value="[% locations_loo.authorised_value %]" selected="selected">[% locations_loo.lib %]</option>
+                                                <option value="[% locations_loo.authorised_value | html %]" selected="selected">[% locations_loo.lib | html %]</option>
                                             [% ELSE %]
-                                                <option value="[% locations_loo.authorised_value %]">[% locations_loo.lib %]</option>
+                                                <option value="[% locations_loo.authorised_value | html %]">[% locations_loo.lib | html %]</option>
                                             [% END %]
                                         [% END %]
                                     </select>
@@ -161,9 +162,9 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                         <option value=""></option>
                                         [% FOREACH type IN typeloop %]
                                             [% IF ( type.selected ) %]
-                                                <option value="[% type.code %]" selected="selected">[% type.value %]</option>
+                                                <option value="[% type.code | html %]" selected="selected">[% type.value | html %]</option>
                                             [% ELSE %]
-                                                <option value="[% type.code %]">[% type.value %]</option>
+                                                <option value="[% type.code | html %]">[% type.value | html %]</option>
                                             [% END %]
                                         [% END %]
                                     </select>
@@ -175,9 +176,9 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                             <option value=""></option>
                                         [% FOREACH previous IN previoustypeloop %]
                                             [% IF ( previous.selected ) %]
-                                                <option value="[% previous.code %]" selected="selected">[% previous.value %]</option>
+                                                <option value="[% previous.code | html %]" selected="selected">[% previous.value | html %]</option>
                                             [% ELSE %]
-                                                <option value="[% previous.code %]">[% previous.value %]</option>
+                                                <option value="[% previous.code | html %]">[% previous.value | html %]</option>
                                             [% END %]
                                         [% END %]
                                     </select>
@@ -185,15 +186,15 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                 [% END %]
                                     <li>
                                     <label for="graceperiod">Grace period:</label>
-                                    <input type="text" name="graceperiod" id="graceperiod" value="[% graceperiod %]" size="5"/> day(s)
+                                    <input type="text" name="graceperiod" id="graceperiod" value="[% graceperiod | html %]" size="5"/> day(s)
                                 </li>
                                 <li>
                                      <label class="widelabel" for="staffdisplaycount">Number of issues to display to staff: </label>
-                                     <input type="text" name="staffdisplaycount" id="staffdisplaycount" value="[% staffdisplaycount %]" size="4"/>
+                                     <input type="text" name="staffdisplaycount" id="staffdisplaycount" value="[% staffdisplaycount | html %]" size="4"/>
                                  </li>
                                  <li>
                                     <label class="widelabel" for="opacdisplaycount">Number of issues to display to the public: </label>
-                                    <input type="text" name="opacdisplaycount" id="opacdisplaycount" value="[% opacdisplaycount %]" size="4"/>
+                                    <input type="text" name="opacdisplaycount" id="opacdisplaycount" value="[% opacdisplaycount | html %]" size="4"/>
                                 </li>
                             </ol>
                         </fieldset>
@@ -230,11 +231,11 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                             <option value="">-- please choose --</option>
                                             [% FOREACH frequency IN frequencies %]
                                                 [% IF (frequency.selected) %]
-                                                    <option value="[% frequency.id %]" selected="selected">
+                                                    <option value="[% frequency.id | html %]" selected="selected">
                                                 [% ELSE %]
-                                                    <option value="[% frequency.id %]">
+                                                    <option value="[% frequency.id | html %]">
                                                 [% END %]
-                                                    [% frequency.label %]
+                                                    [% frequency.label | html %]
                                                 </option>
                                             [% END %]
                                         </select>
@@ -265,12 +266,12 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                                             <option value="months">
                                                         [% END %]
                                                         months
-                                                    [% CASE %][% st %]
+                                                    [% CASE %][% st | html %]
                                                 [% END %]
                                                 </option>
                                             [% END %]
                                         </select>
-                                        <input type="text" name="sublength" id="sublength" value="[% sublength %]" size="3" /> (enter amount in numerals)
+                                        <input type="text" name="sublength" id="sublength" value="[% sublength | html %]" size="3" /> (enter amount in numerals)
                                         <input type="hidden" name="issuelengthcount">
                                     </li>
                                     <li>
@@ -287,11 +288,11 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                             <option value="">-- please choose --</option>
                                             [% FOREACH numberpattern IN numberpatterns %]
                                                 [% IF (numberpattern.selected) %]
-                                                    <option value="[% numberpattern.id %]" selected="selected">
+                                                    <option value="[% numberpattern.id | html %]" selected="selected">
                                                 [% ELSE %]
-                                                    <option value="[% numberpattern.id %]">
+                                                    <option value="[% numberpattern.id | html %]">
                                                 [% END %]
-                                                    [% numberpattern.label %]
+                                                    [% numberpattern.label | html %]
                                                 </option>
                                             [% END %]
                                         </select>
@@ -302,9 +303,9 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                             <option value=""></option>
                                             [% FOREACH l IN locales %]
                                                 [% IF l.language == locale %]
-                                                    <option value="[% l.language %]" selected="selected">[% l.description %]</option>
+                                                    <option value="[% l.language | html %]" selected="selected">[% l.description | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% l.language %]">[% l.description %]</option>
+                                                    <option value="[% l.language | html %]">[% l.description | html %]</option>
                                                 [% END %]
                                             [% END %]
                                         </select>
@@ -329,15 +330,15 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                                         Begins with
                                                       [% END %]
                                                     </td>
-                                                    <td id="beginsX"><input type="text" id="lastvaluetemp1" name="lastvaluetemp1" value="[% lastvalue1 %]" /></td>
-                                                    <td id="beginsY"><input type="text" id="lastvaluetemp2" name="lastvaluetemp2" value="[% lastvalue2 %]" /></td>
-                                                    <td id="beginsZ"><input type="text" id="lastvaluetemp3" name="lastvaluetemp3" value="[% lastvalue3 %]" /></td>
+                                                    <td id="beginsX"><input type="text" id="lastvaluetemp1" name="lastvaluetemp1" value="[% lastvalue1 | html %]" /></td>
+                                                    <td id="beginsY"><input type="text" id="lastvaluetemp2" name="lastvaluetemp2" value="[% lastvalue2 | html %]" /></td>
+                                                    <td id="beginsZ"><input type="text" id="lastvaluetemp3" name="lastvaluetemp3" value="[% lastvalue3 | html %]" /></td>
                                                 </tr>
                                                 <tr>
                                                     <td>Inner counter</td>
-                                                    <td id="innerX"><input type="text" id="innerlooptemp1" name="innerlooptemp1" value="[% innerloop1 %]" /></td>
-                                                    <td id="innerY"><input type="text" id="innerlooptemp2" name="innerlooptemp2" value="[% innerloop2 %]" /></td>
-                                                    <td id="innerZ"><input type="text" id="innerlooptemp3" name="innerlooptemp3" value="[% innerloop3 %]" /></td>
+                                                    <td id="innerX"><input type="text" id="innerlooptemp1" name="innerlooptemp1" value="[% innerloop1 | html %]" /></td>
+                                                    <td id="innerY"><input type="text" id="innerlooptemp2" name="innerlooptemp2" value="[% innerloop2 | html %]" /></td>
+                                                    <td id="innerZ"><input type="text" id="innerlooptemp3" name="innerlooptemp3" value="[% innerloop3 | html %]" /></td>
                                                 </tr>
                                             </tbody>
                                         </table>
@@ -353,7 +354,7 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                       </li>
                                       <li>
                                         <label for="numberingmethod">Numbering formula:</label>
-                                        <input readonly="readonly" type="text" name="numberingmethod" id="numberingmethod" size="50" value="[% numberingmethod %]" />
+                                        <input readonly="readonly" type="text" name="numberingmethod" id="numberingmethod" size="50" value="[% numberingmethod | html %]" />
                                       </li>
                                         <table id="advancedpredictionpatternt">
                                             <thead>
@@ -412,7 +413,7 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                                 </tr>
                                                 <tr>
                                                     [% BLOCK numbering_select %]
-                                                        <select disabled="disabled" id="[% name %]" name="[% name %]">
+                                                        <select disabled="disabled" id="[% name | html %]" name="[% name | html %]">
                                                             <option value=""></option>
                                                             <option value="dayname">Name of day</option>
                                                             <option value="dayabrv">Name of day (abbreviated)</option>
@@ -443,23 +444,23 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
                                   <ol>
                                     [% FOR field IN additional_fields_for_subscription %]
                                       <li>
-                                        <label for="additional_field_[% field.id %]"> [% field.name %]: </label>
+                                        <label for="additional_field_[% field.id | html %]"> [% field.name | html %]: </label>
                                         [% IF field.authorised_value_choices %]
-                                          <select name="additional_field_[% field.id %]" id="additional_field_[% field.id %]">
+                                          <select name="additional_field_[% field.id | html %]" id="additional_field_[% field.id | html %]">
                                             [% FOREACH av IN field.authorised_value_choices %]
                                               [% IF av.authorised_value == additional_fields.${field.name} %]
-                                                <option value="[% av.authorised_value %]" selected="selected">[% av.lib %]</option>
+                                                <option value="[% av.authorised_value | html %]" selected="selected">[% av.lib | html %]</option>
                                               [% ELSE %]
-                                                <option value="[% av.authorised_value %]">[% av.lib %]</option>
+                                                <option value="[% av.authorised_value | html %]">[% av.lib | html %]</option>
                                               [% END %]
                                             [% END %]
-                                          </select> (Authorised values for [% field.authorised_value_category %])
+                                          </select> (Authorised values for [% field.authorised_value_category | html %])
                                         [% ELSE %]
                                           [% IF field.marcfield %]
-                                            <input type="text" value="[% additional_fields.${field.name} %]" id="additional_field_[% field.id %]" name="additional_field_[% field.id %]" readonly="readonly" />
-                                            This value will be filled with the [% field.marcfield %] subfield of the selected biblio.
+                                            <input type="text" value="[% additional_fields.${field.name} | html %]" id="additional_field_[% field.id | html %]" name="additional_field_[% field.id | html %]" readonly="readonly" />
+                                            This value will be filled with the [% field.marcfield | html %] subfield of the selected biblio.
                                           [% ELSE %]
-                                            <input type="text" value="[% additional_fields.${field.name} %]" id="additional_field_[% field.id %]" name="additional_field_[% field.id %]" />
+                                            <input type="text" value="[% additional_fields.${field.name} | html %]" id="additional_field_[% field.id | html %]" name="additional_field_[% field.id | html %]" />
                                           [% END %]
                                         [% END %]
                                       </li>
@@ -486,12 +487,12 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
-        var subscriptionid = "[% subscriptionid %]";
-        var irregularity = "[% irregularity %]";
-        var more_than_one_serial = "[% more_than_one_serial %]";
+        var subscriptionid = "[% subscriptionid | html %]";
+        var irregularity = "[% irregularity | html %]";
+        var more_than_one_serial = "[% more_than_one_serial | html %]";
         var tags = [];
         [% FOREACH field IN dont_export_field_loop %]
-            tags.push("[% field.fieldid %]");
+            tags.push("[% field.fieldid | html %]");
         [% END %]
         var MSG_LINK_TO_VENDOR = _("If you wish to claim late or missing issues you must link this subscription to a vendor. Click OK to ignore or Cancel to return and enter a vendor");
         var MSG_LINK_BIBLIO = _("You must choose or create a bibliographic record");
@@ -509,8 +510,8 @@ fieldset.rows li.radio { width: 100%; } /* override staff-global.css */
         var MSG_PUB_DATE_UNDEFINED = _("First publication date is not defined");
         var MSG_NEXT_ISSUE_UNDEFINED = _("Next issue publication date is not defined");
     </script>
-    [% Asset.js("js/subscription-add.js") %]
-    [% Asset.js("js/showpredictionpattern.js") %]
+    [% Asset.js("js/subscription-add.js") | $raw %]
+    [% Asset.js("js/showpredictionpattern.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index ccd899a..b2e72a8 100644 (file)
                             <tbody>
                                 [% FOREACH subscription IN subscriptions %]
                                     <tr>
-                                        <td>[% subscription.biblio.biblioitem.issn %]</td>
-                                        <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid %]">[% subscription.biblio.title %] (#[% subscription.subscriptionid %])</a></td>
-                                        <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% subscription.vendor.id %]">[% subscription.vendor.name |html %]</a></td>
-                                        <td>[% AuthorisedValues.GetByCode('LOC', subscription.location) %]</td>
-                                        <td>[% Branches.GetName(subscription.branchcode) %]</td>
-                                        <td>[% ItemTypes.GetDescription( subscription.itemtype ) %]</td>
-                                        <td>[% subscription.notes %]</td>
-                                        <td>[% subscription.internalnotes %]</td>
-                                        <td>[% subscription.callnumber %]</td>
+                                        <td>[% subscription.biblio.biblioitem.issn | html %]</td>
+                                        <td><a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% subscription.subscriptionid | html %]">[% subscription.biblio.title | html %] (#[% subscription.subscriptionid | html %])</a></td>
+                                        <td><a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% subscription.vendor.id | html %]">[% subscription.vendor.name | html %]</a></td>
+                                        <td>[% AuthorisedValues.GetByCode('LOC', subscription.location) | html %]</td>
+                                        <td>[% Branches.GetName(subscription.branchcode) | html %]</td>
+                                        <td>[% ItemTypes.GetDescription( subscription.itemtype ) | html %]</td>
+                                        <td>[% subscription.notes | html %]</td>
+                                        <td>[% subscription.internalnotes | html %]</td>
+                                        <td>[% subscription.callnumber | html %]</td>
                                         <td>
                                             [% IF subscription.serialsadditems %]
                                                 <span>Yes</span>
 
                     <form method="post">
                         [% FOREACH subscription IN subscriptions %]
-                            <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid %]"/>
+                            <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]"/>
                         [% END %]
                         [% IF referrer %]
-                            <input type="hidden" name="referrer" value="[% referrer %]"/>
+                            <input type="hidden" name="referrer" value="[% referrer | html %]"/>
                         [% END %]
                         <fieldset class="rows">
                             <ol>
@@ -83,7 +83,7 @@
                                     <select id="booksellerid" name="booksellerid">
                                         <option value="">No change</option>
                                         [% FOREACH bookseller IN booksellers %]
-                                            <option value="[% bookseller.id %]">[% bookseller.name %]</option>
+                                            <option value="[% bookseller.id | html %]">[% bookseller.name | html %]</option>
                                         [% END %]
                                     </select>
                                 </li>
@@ -92,7 +92,7 @@
                                     <select id="location" name="location">
                                         <option value="">No change</option>
                                         [% FOREACH av IN AuthorisedValues.Get('LOC') %]
-                                            <option value="[% av.authorised_value | html %]">[% av.lib %]</option>
+                                            <option value="[% av.authorised_value | html %]">[% av.lib | html %]</option>
                                         [% END %]
                                     </select>
                                 </li>
                                     <select id="branchcode" name="branchcode">
                                         <option value="">No change</option>
                                         [% FOREACH branch IN Branches.all %]
-                                            <option value="[% branch.branchcode | html %]">[% branch.branchname %]</option>
+                                            <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
                                         [% END %]
                                     </select>
                                 </li>
                                     <select id="itemtype" name="itemtype">
                                         <option value="">No change</option>
                                         [% FOREACH itemtype IN ItemTypes.Get() %]
-                                            <option value="[% itemtype.itemtype %]">[% itemtype.description %]</option>
+                                            <option value="[% itemtype.itemtype | html %]">[% itemtype.description | html %]</option>
                                         [% END %]
                                     </select>
                                 </li>
                                 </li>
                                 [% FOREACH field IN additional_fields %]
                                     <li>
-                                        <label for="field_[% field.id %]">[% field.name %]</label>
+                                        <label for="field_[% field.id | html %]">[% field.name | html %]</label>
                                         [% IF field.authorised_value_category %]
-                                            <select id="field_[% field.id %]" name="field_[% field.id %]">
+                                            <select id="field_[% field.id | html %]" name="field_[% field.id | html %]">
                                                 <option value="">No change</option>
                                                 [% FOREACH av IN AuthorisedValues.Get(field.authorised_value_category) %]
-                                                    <option value="[% av.authorised_value %]">[% av.lib %]</option>
+                                                    <option value="[% av.authorised_value | html %]">[% av.lib | html %]</option>
                                                 [% END %]
                                             </select>
                                         [% ELSE %]
-                                            <input id="field_[% field.id %]" name="field_[% field.id %]" placeholder="No change"/>
+                                            <input id="field_[% field.id | html %]" name="field_[% field.id | html %]" placeholder="No change"/>
                                         [% END %]
                                     </li>
                                 [% END %]
 
                         <fieldset class="action">
                             <button type="submit" name="batchedit" value="1">Save</button>
-                            <a class="cancel" href="[% referrer %]">Cancel</a>
+                            <a class="cancel" href="[% referrer | html %]">Cancel</a>
                         </fieldset>
                     </form>
                 </div>
index fc710c9..59a88ec 100644 (file)
@@ -24,8 +24,8 @@
             <select name="itemtypelimit" id="itemtypelimit">
                 <option value="">All</option>
                 [%- FOREACH itemtypeloo IN itemtypeloop %]
-                <option value="[% itemtypeloo.code %]">
-                    [% itemtypeloo.description |html %]
+                <option value="[% itemtypeloo.code | html %]">
+                    [% itemtypeloo.description | html %]
                 </option>
                 [%- END %]
             </select>
@@ -36,8 +36,8 @@
             <select name="ccodelimit" id="ccodelimit">
                 <option value="">All</option>
                 [%- FOREACH ccodeloo IN ccodeloop %]
-                <option value="[% ccodeloo.code %]">
-                    [% ccodeloo.description |html %]
+                <option value="[% ccodeloo.code | html %]">
+                    [% ccodeloo.description | html %]
                 </option>
                 [%- END %]
             </select>
@@ -50,4 +50,4 @@
     </fieldset>
 </form>
 
-[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
\ No newline at end of file
+[% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
index ac4b8f8..7f8b219 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% USE AuthorisedValues %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; Details for subscription #[% subscriptionid %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; Details for subscription #[% subscriptionid | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 
@@ -12,7 +13,7 @@
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Details for subscription #[% subscriptionid %]</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Details for subscription #[% subscriptionid | html %]</div>
 
 <div id="doc3" class="yui-t2">
    
        <div class="yui-b">
        [% INCLUDE 'serials-toolbar.inc' %]
 
-    <h1>Subscription for [% bibliotitle%] [% IF closed %](closed)[% END %]</h1>
+    <h1>Subscription for [% bibliotitle | html %] [% IF closed %](closed)[% END %]</h1>
     [% IF ( abouttoexpire ) %]
       [% UNLESS closed %]
-        <div class="dialog message">Subscription will expire [% enddate %]. <a href="#" id="renewsub">Renew this subscription</a>.</div>
+        <div class="dialog message">Subscription will expire [% enddate | html %]. <a href="#" id="renewsub">Renew this subscription</a>.</div>
       [% END %]
     [% END %]
     [% IF ( NEEDSCONFIRMATION ) %]
                        [% IF ( LINKEDITEMS ) %] <li>The subscription has linked items<br /> Those items won't be deleted</li> [% END %]
                        </ul>
                        <form method="post" action="/cgi-bin/koha/serials/subscription-detail.pl">
-                       <input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+                       <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
                        <input type="hidden" name="issueconfirmed" value="1" />
                        <input type="hidden" name="op" value="del" />
             <button type="submit" class="approve" accesskey="y"><i class="fa fa-fw fa-check"></i> Yes, delete (Y)</button>
                        </form>
                        <form method="get" action="/cgi-bin/koha/serials/subscription-detail.pl">
-                       <input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+                       <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
             <button type="submit" class="deny" accesskey="n"><i class="fa fa-fw fa-remove"></i> No, don't delete (N)</button>
                        </form>
 
     <div class="yui-u first">
     <div class="rows">
                <ol>
-               <li><span class="label">Subscription ID: </span>[% subscriptionid %]</li>
-        <li><span class="label">Librarian identity:</span> [% librarian %]</li>
-        <li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid %]">[% aqbooksellername |html %]</a></li>
-        <li><span class="label">Biblio:</span>  <a href="/cgi-bin/koha/catalogue/[% default_bib_view %].pl?biblionumber=[% bibnum %]">[% bibliotitle %]</a> <i>([% bibnum %])</i></li>
+               <li><span class="label">Subscription ID: </span>[% subscriptionid | html %]</li>
+        <li><span class="label">Librarian identity:</span> [% librarian | html %]</li>
+        <li><span class="label">Vendor:</span> <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% aqbooksellerid | html %]">[% aqbooksellername | html %]</a></li>
+        <li><span class="label">Biblio:</span>  <a href="/cgi-bin/koha/catalogue/[% default_bib_view | html %].pl?biblionumber=[% bibnum | html %]">[% bibliotitle | html %]</a> <i>([% bibnum | html %])</i></li>
         [% IF ( OPACBaseURL ) %]
             <li>
                 <span class="label">OPAC view:</span>
-                <a id="view-subscription-in-opac" target="_blank" href="[% Koha.Preference('OPACBaseURL') %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]">Open in new window.</a>
+                <a id="view-subscription-in-opac" target="_blank" href="[% Koha.Preference('OPACBaseURL') | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Open in new window.</a>
             </li>
         [% END %]
-[% IF ( branchcode ) %]<li><span class="label">Library:</span> [% Branches.GetName( branchcode ) %]</li>[% END %]
+[% IF ( branchcode ) %]<li><span class="label">Library:</span> [% Branches.GetName( branchcode ) | html %]</li>[% END %]
         [% IF ( serialsadditems ) %]
             <li><span class="label">Items:</span> Serial receipt creates an item record.</li>
         [% ELSE %]
                 Serial number is kept when an irregularity is found.
             [% END %]
         </li>
-        <li><span class="label">Grace period:</span> [% graceperiod %]</li>
+        <li><span class="label">Grace period:</span> [% graceperiod | html %]</li>
         </ol>
     </div>
     </div>
     <div class="yui-u">
     <div class="rows">
         <ol>
-        [% IF ( location ) %]<li><span class="label">Location:</span> [% location %]</li>[% END %]
-        [% IF ( callnumber ) %]<li><span class="label">Call number:</span> [% callnumber |html %]</li>[% END %]
-               [% IF ( staffdisplaycount ) %]<li><span class="label">Number of issues to display to staff:</span>[% staffdisplaycount %]</li>[% END %]
-        [% IF ( opacdisplaycount ) %]<li><span class="label">Number of issues to display in OPAC:</span>[% opacdisplaycount %]</li>[% END %]
+        [% IF ( location ) %]<li><span class="label">Location:</span> [% location | html %]</li>[% END %]
+        [% IF ( callnumber ) %]<li><span class="label">Call number:</span> [% callnumber | html %]</li>[% END %]
+               [% IF ( staffdisplaycount ) %]<li><span class="label">Number of issues to display to staff:</span>[% staffdisplaycount | html %]</li>[% END %]
+        [% IF ( opacdisplaycount ) %]<li><span class="label">Number of issues to display in OPAC:</span>[% opacdisplaycount | html %]</li>[% END %]
         [% IF ( letter ) %]
             <li>
-                <span class="label">Patron notification:</span> [% letter %]
-                (<a href="/cgi-bin/koha/serials/viewalerts.pl?subscriptionid=[% subscriptionid %]">subscribers</a>)
+                <span class="label">Patron notification:</span> [% letter | html %]
+                (<a href="/cgi-bin/koha/serials/viewalerts.pl?subscriptionid=[% subscriptionid | html %]">subscribers</a>)
             </li>
         [% END %]
         [% IF ( hasRouting ) %]<li><span class="label">Routing:</span> yes</li>[% END %]
           <ol>
             [% FOR field IN additional_fields_for_subscription %]
               <li>
-                <span class="label">[% field.name %]:</span>
+                <span class="label">[% field.name | html %]:</span>
                 [% IF field.authorised_value_category %]
-                  [% AuthorisedValues.GetByCode( field.authorised_value_category, additional_fields.${field.name} ) %]
+                  [% AuthorisedValues.GetByCode( field.authorised_value_category, additional_fields.${field.name} ) | html %]
                 [% ELSE %]
-                  [% additional_fields.${field.name} %]
+                  [% additional_fields.${field.name} | html %]
                 [% END %]
               </li>
             [% END %]
     <div class="yui-g">
     <div class="rows">
         <ol>
-            <li><span class="label">Beginning date:</span> [% startdate %]
+            <li><span class="label">Beginning date:</span> [% startdate | html %]
             </li>
             <li><span class="label">Frequency:</span>
-                [% frequency.description %]
+                [% frequency.description | html %]
             </li>
             <li>
               <span class="label">Manual history: </span>
                 [% IF ( manualhistory ) %]
-                    Enabled <a href="/cgi-bin/koha/serials/subscription-history.pl?subscriptionid=[% subscriptionid %]">Edit history</a>
+                    Enabled <a href="/cgi-bin/koha/serials/subscription-history.pl?subscriptionid=[% subscriptionid | html %]">Edit history</a>
                 [% ELSE %]
                     Disabled
                 [% END %]
             </li>
             <li><span class="label">Number pattern:</span>
-                [% numberpattern.label %]
+                [% numberpattern.label | html %]
             </li>
             <li><table>
             <tr>
                 <td>Starting with:</td>
                 [% IF (has_X) %]
-                    <td align="center">[% lastvalue1 %]</td>
+                    <td align="center">[% lastvalue1 | html %]</td>
                 [% END %]
                 [% IF (has_Y) %]
-                    <td align="center">[% lastvalue2 %]</td>
+                    <td align="center">[% lastvalue2 | html %]</td>
                 [% END %]
                 [% IF (has_Z) %]
-                    <td align="center">[% lastvalue3 %]</td>
+                    <td align="center">[% lastvalue3 | html %]</td>
                 [% END %]
             </tr>
             <tr>
                 <td>Rollover:</td>
                 [% IF (has_X) %]
-                    <td align="center">[% numberpattern.whenmorethan1 %]</td>
+                    <td align="center">[% numberpattern.whenmorethan1 | html %]</td>
                 [% END %]
                 [% IF (has_Y) %]
-                    <td align="center">[% numberpattern.whenmorethan2 %]</td>
+                    <td align="center">[% numberpattern.whenmorethan2 | html %]</td>
                 [% END %]
                 [% IF (has_Z) %]
-                    <td align="center">[% numberpattern.whenmorethan3 %]</td>
+                    <td align="center">[% numberpattern.whenmorethan3 | html %]</td>
                 [% END %]
             </tr>
             </table></li>
             [% IF ( irregular_issues ) %]
-            <li><span class="label">Irregularity:</span> [% irregular_issues %] issues
+            <li><span class="label">Irregularity:</span> [% irregular_issues | html %] issues
             </li>
             [% END %]
-            <li><span class="label">First arrival:</span> [% firstacquidate %]
+            <li><span class="label">First arrival:</span> [% firstacquidate | html %]
             </li>
-        [% IF ( numberlength ) %]<li><span class="label">Number of issues:</span> [% numberlength %]</li>[% END %]
-        [% IF ( weeklength ) %]<li><span class="label">Number of weeks:</span> [% weeklength %]</li>[% END %]
-        [% IF ( monthlength ) %]<li><span class="label">Number of months:</span> [% monthlength %]</li>[% END %]
+        [% IF ( numberlength ) %]<li><span class="label">Number of issues:</span> [% numberlength | html %]</li>[% END %]
+        [% IF ( weeklength ) %]<li><span class="label">Number of weeks:</span> [% weeklength | html %]</li>[% END %]
+        [% IF ( monthlength ) %]<li><span class="label">Number of months:</span> [% monthlength | html %]</li>[% END %]
         </ol>
     </div>
     </div>
     </div>
     <div id="subscription_numbering" style="display:none;">
         <h3>Numbering calculation</h3>
-        <p><label>Numbering formula:</label> [% numberingmethod %]</p>
+        <p><label>Numbering formula:</label> [% numberingmethod | html %]</p>
         <table>
             <tr>
                 <th>&nbsp;</th>
                 <tr>
                     <td>Add</td>
                     <td>
-                        [% add1 %]
+                        [% add1 | html %]
                     </td>
                     <td>
-                        [% add2 %]
+                        [% add2 | html %]
                     </td>
                     <td>
-                        [% add3 %]
+                        [% add3 | html %]
                     </td>
                 </tr>
                 <tr>
                     <td>once every</td>
-                    <td>[% every1 %]</td>
-                    <td>[% every2 %]</td>
-                    <td>[% every3 %]</td>
+                    <td>[% every1 | html %]</td>
+                    <td>[% every2 | html %]</td>
+                    <td>[% every3 | html %]</td>
                 </tr>
                 <tr>
                     <td>When more than</td>
-                    <td>[% whenmorethan1 %] [% IF ( innerloop1 ) %]<br />
-                        <i>(is [% innerloop1 %])</i>[% END %]</td>
-                    <td>[% whenmorethan2 %] [% IF ( innerloop2 ) %]<br />
-                        <i>(is [% innerloop2 %])</i>[% END %]</td>
-                    <td>[% whenmorethan3 %] [% IF ( innerloop3 ) %]<br />
-                        <i>(is [% innerloop3 %])</i>[% END %]</td>
+                    <td>[% whenmorethan1 | html %] [% IF ( innerloop1 ) %]<br />
+                        <i>(is [% innerloop1 | html %])</i>[% END %]</td>
+                    <td>[% whenmorethan2 | html %] [% IF ( innerloop2 ) %]<br />
+                        <i>(is [% innerloop2 | html %])</i>[% END %]</td>
+                    <td>[% whenmorethan3 | html %] [% IF ( innerloop3 ) %]<br />
+                        <i>(is [% innerloop3 | html %])</i>[% END %]</td>
                 </tr>
                 <tr>
                     <td>Set back to</td>
-                    <td>[% setto1 %]</td>
-                    <td>[% setto2 %]</td>
-                    <td>[% setto3 %]</td>
+                    <td>[% setto1 | html %]</td>
+                    <td>[% setto2 | html %]</td>
+                    <td>[% setto3 | html %]</td>
                 </tr>
                 <tr>
                     <td>
                             Inner counter
                     </td>
-                    <td>[% innerloop1 %]</td>
-                    <td>[% innerloop2 %]</td>
-                    <td>[% innerloop3 %]</td>
+                    <td>[% innerloop1 | html %]</td>
+                    <td>[% innerloop2 | html %]</td>
+                    <td>[% innerloop3 | html %]</td>
                 </tr>
                 <tr>
                     <td>
                             Last value
                     </td>
-                    <td>[% lastvalue1 %]</td>
-                    <td>[% lastvalue2 %]</td>
-                    <td>[% lastvalue3 %]</td>
+                    <td>[% lastvalue1 | html %]</td>
+                    <td>[% lastvalue2 | html %]</td>
+                    <td>[% lastvalue3 | html %]</td>
                 </tr>
             </table>
     </div>
         [% FOREACH serialslis IN serialslist %]
             <tr>
                 <td>
-                    [% serialslis.serialseq %]
+                    [% serialslis.serialseq | html %]
                 </td>
                 <td>
                     [% IF serialslis.planneddate %]
-                      [% serialslis.planneddate %]
+                      [% serialslis.planneddate | html %]
                     [% ELSE %]
                       Unknown
                     [% END %]
                 </td>
                 <td>
                     [% IF serialslis.publisheddate %]
-                      [% serialslis.publisheddate %]
+                      [% serialslis.publisheddate | html %]
                     [% ELSE %]
                       Unknown
                     [% END %]
                 </td>
                 <td>
-                    [% serialslis.publisheddatetext %]
+                    [% serialslis.publisheddatetext | html %]
                 </td>
                 <td>
                     [% IF ( serialslis.status1 ) %]Expected[% END %]
                     [% IF ( serialslis.status7 ) %]
                       Claimed
                       [% IF ( serialslis.claimdate ) %]
-                        [% serialslis.claimdate %]
+                        [% serialslis.claimdate | html %]
                       [% END %]
                     [% END %]
                     [% IF ( serialslis.status8 ) %]Stopped[% END %]
     <div class="yui-g">
     <div class="rows">
         <ol>
-            <li><span class="label">Start date:</span> [% startdate %] </li>
-            <li><span class="label">End date:</span> [% enddate %]</li>
-            <li><span class="label">History start date:</span> [% histstartdate %] </li>
-            <li><span class="label">History end date:</span> [% histenddate %]</li>
-            <li><span class="label">Received issues:</span>[% recievedlist %]</li>
-            <li><span class="label">Missing issues:</span>[% missinglist %]</li>
-            <li><span class="label">Nonpublic note:</span>[% internalnotes FILTER html_line_break |html %]</li>
-            <li><span class="label">Public note:</span>[% notes FILTER html_line_break |html %]</li>
-            <li><span class="label">History staff note:</span>[% librariannote FILTER html_line_break %]</li>
-            <li><span class="label">History OPAC note:</span>[% opacnote FILTER html_line_break %]</li>
+            <li><span class="label">Start date:</span> [% startdate | html %] </li>
+            <li><span class="label">End date:</span> [% enddate | html %]</li>
+            <li><span class="label">History start date:</span> [% histstartdate | html %] </li>
+            <li><span class="label">History end date:</span> [% histenddate | html %]</li>
+            <li><span class="label">Received issues:</span>[% recievedlist | html %]</li>
+            <li><span class="label">Missing issues:</span>[% missinglist | html %]</li>
+            <li><span class="label">Nonpublic note:</span>[% internalnotes FILTER html_line_break | html %]</li>
+            <li><span class="label">Public note:</span>[% notes FILTER html_line_break | html %]</li>
+            <li><span class="label">History staff note:</span>[% librariannote FILTER html_line_break | html %]</li>
+            <li><span class="label">History OPAC note:</span>[% opacnote FILTER html_line_break | html %]</li>
         </ol>
     </div>
     </div>
                 <tbody>
                     <tr>
                         <td>Ordered amount</td>
-                        <td>[% value_tax_excluded_ordered %]</td>
-                        <td>[% value_tax_included_ordered %]</td>
-                        <td>[% budget_name_ordered %]</td>
+                        <td>[% value_tax_excluded_ordered | html %]</td>
+                        <td>[% value_tax_included_ordered | html %]</td>
+                        <td>[% budget_name_ordered | html %]</td>
                         <td>
                             [% IF ( ordered_exists ) %]
-                                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno %]">See basket information</a>
+                                <a href="/cgi-bin/koha/acqui/basket.pl?basketno=[% basketno | html %]">See basket information</a>
                             [% END %]
                         </td>
                     </tr>
                     <tr>
                         <td>Spent amount</td>
-                        <td>[% value_tax_excluded_spent %]</td>
-                        <td>[% value_tax_included_spent %]</td>
-                        <td>[% budget_name_spent %]</td>
+                        <td>[% value_tax_excluded_spent | html %]</td>
+                        <td>[% value_tax_included_spent | html %]</td>
+                        <td>[% budget_name_spent | html %]</td>
                         <td>
                             [% IF ( spent_exists ) %]
-                                <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid %]">See invoice information</a>
+                                <a href="/cgi-bin/koha/acqui/invoice.pl?invoiceid=[% invoiceid | html %]">See invoice information</a>
                             [% END %]
                         </td>
                     </tr>
 
 [% MACRO jsinclude BLOCK %]
     <script type="text/javascript">
-        var subscriptionid = "[% subscriptionid %]";
+        var subscriptionid = "[% subscriptionid | html %]";
         var MSG_CLOSE_SUBSCRIPTION = _("Are you sure you want to close this subscription?");
         var MSG_REOPEN_SUBSCRIPTION = _("Are you sure you want to reopen this subscription?");
         var CONFIRM_DELETE_SUBSCRIPTION = _("Are you sure you want to delete this subscription?");
     </script>
-    [% Asset.js("js/serials-toolbar.js") %]
+    [% Asset.js("js/serials-toolbar.js") | $raw %]
     <script type="text/javascript">
         // the english words used in display purposes
         var text = new Array(_("Number"),_("Volume"),_("Issue"),_("Month"),_("Week"),_("Starting with:"),_("Rollover at:"),_("Choose Hemisphere:"),_("Northern"),_("Southern",
         $(document).ready(function() {
             $("#subscription_description").tabs();
             $("#renewsub").click(function(){
-                popup([% subscriptionid %]);
+                popup([% subscriptionid | html %]);
                 return false;
             })
         });
index 9414baa..cecb67e 100644 (file)
         [% IF (new) %]
           <h1>New frequency</h1>
         [% ELSE %]
-          <h1>Edit frequency: [% description %]</h1>
+          <h1>Edit frequency: [% description | html %]</h1>
         [% END %]
         <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" id="add_frequency_form" method="post">
           [% IF (modify) %]
-            <input type="hidden" name="id" value="[% id %]" />
+            <input type="hidden" name="id" value="[% id | html %]" />
             <input type="hidden" name="op" value="savemod" />
           [% ELSE %]
             <input type="hidden" name="op" value="savenew" />
@@ -53,9 +53,9 @@
                   <option value="">None</option>
                   [% FOREACH unit IN units_loop %]
                     [% IF (unit.selected) %]
-                      <option selected="selected" value="[% unit.val %]">
+                      <option selected="selected" value="[% unit.val | html %]">
                     [% ELSE %]
-                      <option value="[% unit.val %]">
+                      <option value="[% unit.val | html %]">
                     [% END %]
                       [% PROCESS translate_frequnit frequnit=unit.val %]
                     </option>
@@ -68,7 +68,7 @@
                 [% IF (new) %]
                   <input type="text" id="issuesperunit" name="issuesperunit" value="1" size="3" />
                 [% ELSE %]
-                  <input type="text" id="issuesperunit" name="issuesperunit" value="[% issuesperunit %]" size="3" />
+                  <input type="text" id="issuesperunit" name="issuesperunit" value="[% issuesperunit | html %]" size="3" />
                 [% END %]
               </li>
               <li>
                 [% IF (new) %]
                   <input type="text" id="unitsperissue" name="unitsperissue" value="1" size="3" />
                 [% ELSE %]
-                  <input type="text" id="unitsperissue" name="unitsperissue" value="[% unitsperissue %]" size="3" />
+                  <input type="text" id="unitsperissue" name="unitsperissue" value="[% unitsperissue | html %]" size="3" />
                 [% END %]
               </li>
               <li>
                 <label for="displayorder">Display order: </label>
-                <input type="text" id="displayorder" name="displayorder" value="[% displayorder %]" size="3" />
+                <input type="text" id="displayorder" name="displayorder" value="[% displayorder | html %]" size="3" />
               </li>
             </ol>
           </fieldset>
         [% IF still_used %]
             <div class="dialog alert">
                 <p>
-                    This frequency is still used by [% subscriptions.size %]
+                    This frequency is still used by [% subscriptions.size | html %]
                     subscription(s). Do you still want to delete it?
                 </p>
                 <p><a href="#" id="show_blocking_subs">Show subscriptions</a></p>
                 <ul id="blocking_subs" style="display:none">
                     [% FOREACH sub IN subscriptions %]
                         <li style="list-style-type:none">
-                            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid %]">[% sub.title %]</a>
+                            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid | html %]">[% sub.title | html %]</a>
                         </li>
                     [% END %]
                 </ul>
                 <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="get">
                     <input type="hidden" name="op" value="del" />
                     <input type="hidden" name="confirm" value="1" />
-                    <input type="hidden" name="frequencyid" value="[% frequencyid %]" />
+                    <input type="hidden" name="frequencyid" value="[% frequencyid | html %]" />
                     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
                 </form>
                 <form action="/cgi-bin/koha/serials/subscription-frequencies.pl" method="get">
             <tbody>
               [% FOREACH frequency IN frequencies_loop %]
                 <tr>
-                  <td>[% frequency.description %]</td>
+                  <td>[% frequency.description | html %]</td>
                   <td>[% PROCESS translate_frequnit frequnit=frequency.unit %]</td>
-                  <td>[% frequency.issuesperunit %]</td>
-                  <td>[% frequency.unitsperissue %]</td>
-                  <td>[% frequency.displayorder %]</td>
+                  <td>[% frequency.issuesperunit | html %]</td>
+                  <td>[% frequency.unitsperissue | html %]</td>
+                  <td>[% frequency.displayorder | html %]</td>
                   <td class="actions">
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id %]"><i class="fa fa-pencil"></i> Edit</a>
-                    <a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id %]"><i class="fa fa-trash"></i> Delete</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=modify&frequencyid=[% frequency.id | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                    <a class="delete_frequency btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-frequencies.pl?op=del&frequencyid=[% frequency.id | html %]"><i class="fa fa-trash"></i> Delete</a>
                   </td>
                 </tr>
               [% END %]
index 02613b5..6c34282 100644 (file)
 <div id="bd">
   <div id="yui-main">
     <div class="yui-b">
-      <h1>Subscription history for [% title %]</h1>
+      <h1>Subscription history for [% title | html %]</h1>
         <div id="subscription_form_history">
           <form method="post" action="/cgi-bin/koha/serials/subscription-history.pl">
             <input type="hidden" name="op" value="mod" />
-            <input type="hidden" name="subscriptionid" value="[% subscriptionid %]" />
+            <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]" />
             <p>Hint : you can update the serial history manually. This can be useful for an old subscription or to clean the existing history. Modify those fields with care, as future serial receive will continue to update them automatically.</p>
             <table>
               <tr>
               </tr>
               <tr>
                 <td>Received issues</td>
-                <td><textarea name="receivedlist" cols="60" rows="5">[% receivedlist %]</textarea></td>
+                <td><textarea name="receivedlist" cols="60" rows="5">[% receivedlist | html %]</textarea></td>
               </tr>
               <tr>
                 <td>Missing issues</td>
-                <td><textarea name="missinglist" cols="60" rows="5">[% missinglist %]</textarea></td>
+                <td><textarea name="missinglist" cols="60" rows="5">[% missinglist | html %]</textarea></td>
               </tr>
               <tr>
                 <td>Note for OPAC</td>
-                <td><textarea name="opacnote" cols="60" rows="5">[% opacnote %]</textarea></td>
+                <td><textarea name="opacnote" cols="60" rows="5">[% opacnote | html %]</textarea></td>
               </tr>
               <tr>
                 <td>Note for staff</td>
-                <td><textarea name="librariannote" cols="60" rows="5">[% librariannote %]</textarea></td>
+                <td><textarea name="librariannote" cols="60" rows="5">[% librariannote | html %]</textarea></td>
               </tr>
             </table>
             <input type="submit" value="Save subscription history"  />
index 18f0ec6..53de19d 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Serials &rsaquo; Numbering patterns</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="ser_subscription_numberpatterns" class="ser">
@@ -17,7 +18,7 @@
     [% IF ( new ) %]
         &rsaquo; New numbering pattern
     [% ELSIF ( modify ) %]
-        &rsaquo; Modifying numbering pattern '[% label %]'
+        &rsaquo; Modifying numbering pattern '[% label | html %]'
     [% END %]
 </div>
 
@@ -36,7 +37,7 @@
               </div>
             [% END %]
           [% ELSE %]
-            <h1>Modify pattern: [% label %]</h1>
+            <h1>Modify pattern: [% label | html %]</h1>
             [% IF (error_existing_numberpattern) %]
               <div class="dialog alert">
                 <p>Another pattern with this name already exists.</p>
               <input type="hidden" name="op" value="savenew" />
             [% ELSE %]
               <input type="hidden" name="op" value="savemod" />
-              <input type="hidden" name="id" value="[% id %]" />
+              <input type="hidden" name="id" value="[% id | html %]" />
             [% END %]
             <fieldset class="rows">
               <ol>
                 <li>
                   <label for="label">Name:</label>
-                  <input type="text" id="label" name="label" value="[% label %]" />
+                  <input type="text" id="label" name="label" value="[% label | html %]" />
                 </li>
                 <li>
                   <label for="description">Description:</label>
-                  <input type="text" id="description" name="description" value="[% description %]" />
+                  <input type="text" id="description" name="description" value="[% description | html %]" />
                 </li>
                 <li>
                   <label for="numberingmethod">Numbering formula:</label>
-                  <input type="text" id="numberingmethod" name="numberingmethod" value="[% numberingmethod %]" />
+                  <input type="text" id="numberingmethod" name="numberingmethod" value="[% numberingmethod | html %]" />
                 </li>
                 <li>
                   <label for="displayorder">Display order:</label>
-                  <input type="text" id="displayorder" name="displayorder" value="[% displayorder %]" />
+                  <input type="text" id="displayorder" name="displayorder" value="[% displayorder | html %]" />
                 </li>
               </ol>
               <table>
                 <tbody>
                   <tr>
                     <td>Label</td>
-                    <td><input type="text" id="label1" name="label1" value="[% label1 %]" /></td>
-                    <td><input type="text" id="label2" name="label2" value="[% label2 %]" /></td>
-                    <td><input type="text" id="label3" name="label3" value="[% label3 %]" /></td>
+                    <td><input type="text" id="label1" name="label1" value="[% label1 | html %]" /></td>
+                    <td><input type="text" id="label2" name="label2" value="[% label2 | html %]" /></td>
+                    <td><input type="text" id="label3" name="label3" value="[% label3 | html %]" /></td>
                   </tr>
                   <tr>
                     <td>Add</td>
-                    <td><input type="text" id="add1" name="add1" value="[% add1 %]" /></td>
-                    <td><input type="text" id="add2" name="add2" value="[% add2 %]" /></td>
-                    <td><input type="text" id="add3" name="add3" value="[% add3 %]" /></td>
+                    <td><input type="text" id="add1" name="add1" value="[% add1 | html %]" /></td>
+                    <td><input type="text" id="add2" name="add2" value="[% add2 | html %]" /></td>
+                    <td><input type="text" id="add3" name="add3" value="[% add3 | html %]" /></td>
                   </tr>
                   <tr>
                     <td>Every</td>
-                    <td><input type="text" id="every1" name="every1" value="[% every1 %]" /></td>
-                    <td><input type="text" id="every2" name="every2" value="[% every2 %]" /></td>
-                    <td><input type="text" id="every3" name="every3" value="[% every3 %]" /></td>
+                    <td><input type="text" id="every1" name="every1" value="[% every1 | html %]" /></td>
+                    <td><input type="text" id="every2" name="every2" value="[% every2 | html %]" /></td>
+                    <td><input type="text" id="every3" name="every3" value="[% every3 | html %]" /></td>
                   </tr>
                   <tr>
                     <td>Set back to</td>
-                    <td><input type="text" id="setto1" name="setto1" value="[% setto1 %]" /></td>
-                    <td><input type="text" id="setto2" name="setto2" value="[% setto2 %]" /></td>
-                    <td><input type="text" id="setto3" name="setto3" value="[% setto3 %]" /></td>
+                    <td><input type="text" id="setto1" name="setto1" value="[% setto1 | html %]" /></td>
+                    <td><input type="text" id="setto2" name="setto2" value="[% setto2 | html %]" /></td>
+                    <td><input type="text" id="setto3" name="setto3" value="[% setto3 | html %]" /></td>
                   </tr>
                   <tr>
                     <td>When more than</td>
-                    <td><input type="text" id="whenmorethan1" name="whenmorethan1" value="[% whenmorethan1 %]" /></td>
-                    <td><input type="text" id="whenmorethan2" name="whenmorethan2" value="[% whenmorethan2 %]" /></td>
-                    <td><input type="text" id="whenmorethan3" name="whenmorethan3" value="[% whenmorethan3 %]" /></td>
+                    <td><input type="text" id="whenmorethan1" name="whenmorethan1" value="[% whenmorethan1 | html %]" /></td>
+                    <td><input type="text" id="whenmorethan2" name="whenmorethan2" value="[% whenmorethan2 | html %]" /></td>
+                    <td><input type="text" id="whenmorethan3" name="whenmorethan3" value="[% whenmorethan3 | html %]" /></td>
                   </tr>
                   <tr>
                     [% BLOCK numbering_select %]
-                      <select id="[% name %]" name="[% name %]">
+                      <select id="[% name | html %]" name="[% name | html %]">
                         <option value=""></option>
                         [% IF (value == "dayname") %]
                             <option selected="selected" value="dayname">Name of day</option>
                   <label for="frequency">Frequency: </label>
                   <select id="frequency">
                     [% FOREACH frequency IN frequencies_loop %]
-                      <option value="[% frequency.id %]">[% frequency.description %]</option>
+                      <option value="[% frequency.id | html %]">[% frequency.description | html %]</option>
                     [% END %]
                   </select>
                 </li>
                   <label for="sublength">Subscription length:</label>
                   <select id="subtype">
                     [% FOREACH subtype IN subtypes_loop %]
-                      <option value="[% subtype.value %]">[% subtype.value %]</option>
+                      <option value="[% subtype.value | html %]">[% subtype.value | html %]</option>
                     [% END %]
                   </select>
                   <input type="text" id="sublength" size="3" />
                   <select id="locale" name="locale">
                       <option value=""></option>
                       [% FOREACH locale IN locales %]
-                        <option value="[% locale.language %]">[% locale.description %]</option>
+                        <option value="[% locale.language | html %]">[% locale.description | html %]</option>
                       [% END %]
                     </select>
                   <span class="hint">If empty, English is used</span>
                 <tbody>
                   <tr>
                     <td>Begins with</td>
-                    <td><input type="text" id="lastvalue1" name="lastvalue1" value="[% lastvalue1 %]" /></td>
-                    <td><input type="text" id="lastvalue2" name="lastvalue2" value="[% lastvalue2 %]" /></td>
-                    <td><input type="text" id="lastvalue3" name="lastvalue3" value="[% lastvalue3 %]" /></td>
+                    <td><input type="text" id="lastvalue1" name="lastvalue1" value="[% lastvalue1 | html %]" /></td>
+                    <td><input type="text" id="lastvalue2" name="lastvalue2" value="[% lastvalue2 | html %]" /></td>
+                    <td><input type="text" id="lastvalue3" name="lastvalue3" value="[% lastvalue3 | html %]" /></td>
                   </tr>
                   <tr>
                     <td>Inner counter</td>
-                    <td><input type="text" id="innerloop1" name="innerloop1" value="[% innerloop1 %]" /></td>
-                    <td><input type="text" id="innerloop2" name="innerloop2" value="[% innerloop2 %]" /></td>
-                    <td><input type="text" id="innerloop3" name="innerloop3" value="[% innerloop3 %]" /></td>
+                    <td><input type="text" id="innerloop1" name="innerloop1" value="[% innerloop1 | html %]" /></td>
+                    <td><input type="text" id="innerloop2" name="innerloop2" value="[% innerloop2 | html %]" /></td>
+                    <td><input type="text" id="innerloop3" name="innerloop3" value="[% innerloop3 | html %]" /></td>
                   </tr>
                 </tbody>
               </table>
         [% IF still_used %]
             <div class="dialog alert">
                 <p>
-                    This pattern is still used by [% subscriptions.size %]
+                    This pattern is still used by [% subscriptions.size | html %]
                     subscription(s). Do you still want to delete it?
                 </p>
                 <p><a href="#" id="show_blocking_subs">Show subscriptions</a></p>
                 <ul id="blocking_subs" style="display:none">
                     [% FOREACH sub IN subscriptions %]
                         <li style="list-style-type:none">
-                            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid %]">[% sub.title %]</a>
+                            <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% sub.subscriptionid | html %]">[% sub.title | html %]</a>
                         </li>
                     [% END %]
                 </ul>
                 <form action="/cgi-bin/koha/serials/subscription-numberpatterns.pl" method="get">
                     <input type="hidden" name="op" value="del" />
                     <input type="hidden" name="confirm" value="1" />
-                    <input type="hidden" name="id" value="[% id %]" />
+                    <input type="hidden" name="id" value="[% id | html %]" />
                     <button type="submit" class="approve"><i class="fa fa-fw fa-check"></i> Yes, delete</button>
                 </form>
                 <form action="/cgi-bin/koha/serials/subscription-numberpatterns.pl" method="get">
             <tbody>
               [% FOREACH numberpattern IN numberpatterns_loop %]
                 <tr>
-                  <td>[% numberpattern.label %]</td>
-                  <td>[% numberpattern.description %]</td>
-                  <td>[% numberpattern.numberingmethod %]</td>
-                  <td>[% numberpattern.displayorder %]</td>
+                  <td>[% numberpattern.label | html %]</td>
+                  <td>[% numberpattern.description | html %]</td>
+                  <td>[% numberpattern.numberingmethod | html %]</td>
+                  <td>[% numberpattern.displayorder | html %]</td>
                   <td class="actions">
-                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-numberpatterns.pl?op=modify&id=[% numberpattern.id %]"><i class="fa fa-pencil"></i> Edit</a>
-                    <a class="delete_pattern btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-numberpatterns.pl?op=del&id=[% numberpattern.id %]"><i class="fa fa-trash"></i> Delete</a>
+                    <a class="btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-numberpatterns.pl?op=modify&id=[% numberpattern.id | html %]"><i class="fa fa-pencil"></i> Edit</a>
+                    <a class="delete_pattern btn btn-default btn-xs" href="/cgi-bin/koha/serials/subscription-numberpatterns.pl?op=del&id=[% numberpattern.id | html %]"><i class="fa fa-trash"></i> Delete</a>
                   </td>
                 </tr>
               [% END %]
 
 [% MACRO jsinclude BLOCK %]
     [% IF (daily_options) %]
-        [% Asset.js("js/showpredictionpattern.js") %]
+        [% Asset.js("js/showpredictionpattern.js") | $raw %]
     [% END %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
index 4a5fd2c..a976dac 100644 (file)
@@ -1,7 +1,7 @@
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 [% IF subscription %]
-<title>Koha &rsaquo; Serials subscription renew #[% subscription.subscriptionid %]</title>
+<title>Koha &rsaquo; Serials subscription renew #[% subscription.subscriptionid | html %]</title>
 [% ELSE %]
 <title>Koha &rsaquo; Serials subscription renew</title>
 [% END %]
       <div id="bd">
 <form name="f" action="/cgi-bin/koha/serials/subscription-renew.pl" method="post">
                <input type="hidden" name="op" value="renew" />
-               <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid %]" />
-               <fieldset class="rows"><legend>Subscription renewal for [% subscription.bibliotitle %]</legend>
+               <input type="hidden" name="subscriptionid" value="[% subscription.subscriptionid | html %]" />
+               <fieldset class="rows"><legend>Subscription renewal for [% subscription.bibliotitle | html %]</legend>
         <ol>
             <li>
                 <label for="startdate">Start date: </label>
-                <input type="text" size="10" id="startdate" name="startdate" value="[% startdate %]" class="datepicker"/>
+                <input type="text" size="10" id="startdate" name="startdate" value="[% startdate | html %]" class="datepicker"/>
                 <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
             </li>
                <li><fieldset>
                <legend>Subscription length:</legend>
-               <ol><li><label for="numberlength">Number of num:</label><input type="text" id="numberlength" name="numberlength" value="[% subscription.numberlength %]" /></li>
-               <li><label for="weeklength">Number of weeks: </label><input type="text" id="weeklength" name="weeklength" value="[% subscription.weeklength %]" /></li>
-               <li><label for="monthlength">Number of months: </label><input type="text" id="monthlength" name="monthlength" value="[% subscription.monthlength %]" /></li></ol></fieldset></li>
+               <ol><li><label for="numberlength">Number of num:</label><input type="text" id="numberlength" name="numberlength" value="[% subscription.numberlength | html %]" /></li>
+               <li><label for="weeklength">Number of weeks: </label><input type="text" id="weeklength" name="weeklength" value="[% subscription.weeklength | html %]" /></li>
+               <li><label for="monthlength">Number of months: </label><input type="text" id="monthlength" name="monthlength" value="[% subscription.monthlength | html %]" /></li></ol></fieldset></li>
                <li><label for="note">Note for the librarian that will manage your renewal request: </label>
                <textarea name="note" id="note" rows="5" cols="50"></textarea></li></ol></fieldset>
                <fieldset class="action"><input type="submit" value="Submit" class="button" /></fieldset>
@@ -58,4 +58,3 @@
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' popup_window=1 %]
-
index 2379369..976b178 100644 (file)
@@ -1,19 +1,19 @@
 [% USE To %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 "dt_cardnumber":
-                    "[% data.cardnumber %]",
+                    "[% data.cardnumber | html %]",
                 "dt_name":
-                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
+                    "<span style='white-space:nowrap'><a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.borrowernumber | html %]'>[% INCLUDE 'patron-title.inc' borrowernumber = data.borrowernumber category_type = data.category_type firstname = To.json(data.firstname) surname = To.json(data.surname) othernames = To.json(data.othernames) cardnumber = data.cardnumber invert_name = 1%]</a></span>",
                 "dt_branch":
-                    "[% data.branchname |html %]",
+                    "[% data.branchname | html %]",
                 "dt_action":
-                    "<a href=\"#\" class=\"add_user btn btn-default btn-xs\" data-borrowernumber=\"[% data.borrowernumber %]\" data-firstname=\"[% data.firstname %]\" data-surname=\"[% data.surname %]\">Add</a>"
+                    "<a href=\"#\" class=\"add_user btn btn-default btn-xs\" data-borrowernumber=\"[% data.borrowernumber | html %]\" data-firstname=\"[% data.firstname | html %]\" data-surname=\"[% data.surname | html %]\">Add</a>"
             }[% UNLESS loop.last %],[% END %]
         [% END %]
     ]
index 01f4edc..2ffc688 100644 (file)
@@ -1,22 +1,22 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Serials &rsaquo; Alert subscribers for [% bibliotitle %]</title>
+<title>Koha &rsaquo; Serials &rsaquo; Alert subscribers for [% bibliotitle | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 </head>
 <body id="ser_viewalerts" class="ser">
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'serials-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Alert subscribers for <i>[% bibliotitle %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a> &rsaquo; Alert subscribers for <i>[% bibliotitle | html %]</i></div>
 
 <div id="doc3" class="yui-t2">
     <div id="bd">
     <div id="yui-main">
     <div class="yui-b">
 
-<h1>Alert subscribers for <i>[% bibliotitle %]</i></h1>
+<h1>Alert subscribers for <i>[% bibliotitle | html %]</i></h1>
 
 <p>
-    <span class="label">Subscription:</span> <a href="subscription-detail.pl?subscriptionid=[% subscriptionid %]">[% bibliotitle %] #[% subscriptionid %]</a>
+    <span class="label">Subscription:</span> <a href="subscription-detail.pl?subscriptionid=[% subscriptionid | html %]">[% bibliotitle | html %] #[% subscriptionid | html %]</a>
 </p>
 
 [% IF subscribers.count %]
@@ -27,7 +27,7 @@
         [% FOREACH subscriber IN subscribers %]
         <tr>
             <td>
-                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% subscriber.borrowernumber %]">[% INCLUDE 'patron-title.inc' patron=subscriber %]</a>
+                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% subscriber.borrowernumber | html %]">[% INCLUDE 'patron-title.inc' patron=subscriber %]</a>
             </td>
         </tr>
         [% END %]
index d55268a..4bf90d0 100644 (file)
@@ -1,34 +1,35 @@
+[% USE raw %]
 <ol>
   [% FOREACH iteminfo IN iteminformation %]
     [% IF ( iteminfo.hidden ) %]
-       <li style="[% iteminfo.hidden %];">
+       <li style="[% iteminfo.hidden | html %];">
     [% ELSE %]
         <li>
     [% END %]
-      <div class="subfield_line" id="subfield[% iteminfo.serialid %][% iteminfo.countitems %][% iteminfo.subfield %][% iteminfo.random %]">
+      <div class="subfield_line" id="subfield[% iteminfo.serialid | html %][% iteminfo.countitems | html %][% iteminfo.subfield | html %][% iteminfo.random | html %]">
         [% IF (iteminfo.mandatory) %]
-            <label class="required">[% iteminfo.subfield %] - [% iteminfo.marc_lib %]</label>
+            <label class="required">[% iteminfo.subfield | html %] - [% iteminfo.marc_lib | $raw %]</label>
         [% ELSE %]
-            <label>[% iteminfo.subfield %] - [% iteminfo.marc_lib %]</label>
+            <label>[% iteminfo.subfield | html %] - [% iteminfo.marc_lib | $raw %]</label>
         [% END %]
         [% IF ( iteminfo.marc_value.type == 'select' ) %]
         <select name="field_value" size="1">
         [% FOREACH value IN iteminfo.marc_value.values %]
           [% IF ( value == iteminfo.marc_value.default ) %]
-            <option value="[% value %]" selected="selected">[% iteminfo.marc_value.labels.$value %]</option>
+            <option value="[% value | html %]" selected="selected">[% iteminfo.marc_value.labels.$value | html %]</option>
           [% ELSE %]
-            <option value="[% value %]">[% iteminfo.marc_value.labels.$value %]</option>
+            <option value="[% value | html %]">[% iteminfo.marc_value.labels.$value | html %]</option>
           [% END %]
         [% END %]
         </select>
         [% ELSE %]
-        [% iteminfo.marc_value %]
+        [% iteminfo.marc_value | $raw %]
         [% END %]
         <input type="hidden" name="itemid" value="1" />
-        <input type="hidden" name="kohafield" value="[% iteminfo.kohafield %]" />
-        <input type="hidden" name="tag" value="[% iteminfo.tag %]" />
-        <input type="hidden" name="subfield" value="[% iteminfo.subfield %]" />
-        <input type="hidden" name="mandatory" value="[% iteminfo.mandatory %]" />
+        <input type="hidden" name="kohafield" value="[% iteminfo.kohafield | html %]" />
+        <input type="hidden" name="tag" value="[% iteminfo.tag | html %]" />
+        <input type="hidden" name="subfield" value="[% iteminfo.subfield | html %]" />
+        <input type="hidden" name="mandatory" value="[% iteminfo.mandatory | html %]" />
         [% IF (iteminfo.mandatory) %] <span class="required">Required</span>[% END %]
       </div>
     </li>
index 63bcab8..2543fb6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% USE AuthorisedValues %]
@@ -8,24 +9,24 @@
 <title>Koha &rsaquo; Acquisitions  &rsaquo;
     [% IF ( op_save ) %]
         [% IF ( suggestionid ) %]
-            Suggestions &rsaquo;  Edit suggestion #[% suggestionid %]
+            Suggestions &rsaquo;  Edit suggestion #[% suggestionid | html %]
         [% ELSE %]
             Suggestions &rsaquo; Add suggestion
         [% END %]
     [% ELSIF ( op == 'show' ) %]
-           Suggestions &rsaquo; Show suggestion #[% suggestionid %]
+           Suggestions &rsaquo; Show suggestion #[% suggestionid | html %]
     [% ELSE %]
         Suggestions management
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( op_else ) %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 [% IF ( op_else ) %]
     <style type="text/css">
         h4.local_collapse a { font-size : 80%; text-decoration: none; } fieldset.brief ol { display : none; }
-        .overlay { top: 180px; left: 50%; position: absolute; margin-left: -100px; width: 200px; text-align: center; display: none; margin-top: -10px; background: #eeffd4; padding: .5em; color: #000; } .note { -moz-border-radius: 3px; border-radius:3px; background: transparent url("[% interface %]/[% theme %]/img/famfamfam/silk/comment.png") top left no-repeat; padding : 1px 3px 1px 18px; font-size : 90%; }
+        .overlay { top: 180px; left: 50%; position: absolute; margin-left: -100px; width: 200px; text-align: center; display: none; margin-top: -10px; background: #eeffd4; padding: .5em; color: #000; } .note { -moz-border-radius: 3px; border-radius:3px; background: transparent url("[% interface | html %]/[% theme | html %]/img/famfamfam/silk/comment.png") top left no-repeat; padding : 1px 3px 1px 18px; font-size : 90%; }
     </style>
 [% END %]
 </head>
     <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a> &rsaquo;
     [% IF ( op_save ) %]
         [% IF ( suggestionid ) %]
-            <a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a> &rsaquo;  Edit suggestion #[% suggestionid %]
+            <a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a> &rsaquo;  Edit suggestion #[% suggestionid | html %]
         [% ELSE %]
             <a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a> &rsaquo; Add suggestion
         [% END %]
     [% ELSIF ( op == 'show' ) %]
-           <a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a> &rsaquo; Show suggestion #[% suggestionid %]
+           <a href="/cgi-bin/koha/suggestion/suggestion.pl">Suggestions</a> &rsaquo; Show suggestion #[% suggestionid | html %]
     [% ELSE %]
         Suggestions management
     [% END %]
@@ -55,8 +56,8 @@
     <div class="yui-b">
 
     <div id="toolbar" class="btn-toolbar">
-        <a class="btn btn-default btn-sm" id="editsuggestion" href="suggestion.pl?op=edit&amp;suggestionid=[% suggestionid %]"><i class="fa fa-pencil"></i> Edit</a>
-        <a class="btn btn-default btn-sm deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestionid %]"><i class="fa fa-trash"></i> Delete</a>
+        <a class="btn btn-default btn-sm" id="editsuggestion" href="suggestion.pl?op=edit&amp;suggestionid=[% suggestionid | html %]"><i class="fa fa-pencil"></i> Edit</a>
+        <a class="btn btn-default btn-sm deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a>
     </div>
 
     <fieldset class="rows">
             [% IF ( title ) %]
                 <li>
                     <span class="label">Title:</span>
-                    [% title |html %]
+                    [% title | html %]
                 </li>
             [% END %]
             [% IF ( author ) %]
                 <li>
                     <span class="label">Author:</span>
-                    [% author |html %]
+                    [% author | html %]
                 </li>
             [% END %]
             [% IF ( copyrightdate ) %]
                 <li>
                     <span class="label">Copyright date:</span>
-                    [% copyrightdate |html %]
+                    [% copyrightdate | html %]
                 </li>
             [% END %]
             [% IF ( isbn ) %]
                 <li>
                     <span class="label">ISBN or ISSN or other standard number:</span>
-                    [% isbn |html %]
+                    [% isbn | html %]
                 </li>
             [% END %]
             [% IF ( publishercode ) %]
                 <li>
                     <span class="label">Publisher:</span>
-                    [% publishercode |html %]
+                    [% publishercode | html %]
                 </li>
             [% END %]
             [% IF ( place ) %]
                 <li>
                     <span class="label">Publication place:</span>
-                    [% place |html %]
+                    [% place | html %]
                 </li>
             [% END %]
             [% IF ( collectiontitle ) %]
                 <li>
                     <span class="label">Collection title:</span>
-                    [% collectiontitle |html %]
+                    [% collectiontitle | html %]
                 </li>
             [% END %]
             [% IF ( itemtype ) %]
                 <li>
                     <span class="label">Document type:</span>
-                    [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', itemtype, 0 ) %]
+                    [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', itemtype, 0 ) | html %]
                 </li>
             [% END %]
         [% IF ( patron_reason_loop ) %]
           <li><span class="label">Reason for suggestion: </span>
             [% FOREACH patron_reason_loo IN patron_reason_loop %]
-              [% IF patron_reason_loo.authorised_value == patronreason %][% patron_reason_loo.lib %][% END %]
+              [% IF patron_reason_loo.authorised_value == patronreason %][% patron_reason_loo.lib | html %][% END %]
             [% END %]
           </li>
         [% END %]
             [% IF ( note ) %]
                 <li>
                     <span class="label">Notes:</span>
-                    [% note |html %]
+                    [% note | html %]
                 </li>
             [% END %]
       </ol>
           [% ELSE %]
               [% FOREACH s IN SuggestionStatuses %]
                   [% IF STATUS == s.authorised_value %]
-                      [% s.lib %]
+                      [% s.lib | html %]
                       [% SET status_found = 1 %]
                   [% END %]
               [% END %]
                 <td>[% suggesteddate | $KohaDates %]</td>
                 <td>
                     [% IF ( suggestedby_borrowernumber ) %]
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestedby_borrowernumber %]">[% suggestedby_surname %], [% suggestedby_firstname %] ([% suggestedby_cardnumber %])</a>
-                        [% Branches.GetName( suggestedby_branchcode ) %] ([% suggestedby_description %])
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestedby_borrowernumber | html %]">[% suggestedby_surname | html %], [% suggestedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a>
+                        [% Branches.GetName( suggestedby_branchcode ) | html %] ([% suggestedby_description | html %])
                     [% END %]
                 </td>
             </tr>
                 <td>[% manageddate | $KohaDates %]</td>
                 <td>
                         [% IF ( managedby_borrowernumber ) %]
-                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% managedby_borrowernumber %]">[% managedby_surname %], [% managedby_firstname %] ([% suggestedby_cardnumber %])</a>
-                            [% Branches.GetName( managedby_branchcode ) %] ([% managedby_description %])
+                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% managedby_borrowernumber | html %]">[% managedby_surname | html %], [% managedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a>
+                            [% Branches.GetName( managedby_branchcode ) | html %] ([% managedby_description | html %])
                         [% END %]
                 </td>
             </tr>
                 <td>[% accepteddate | $KohaDates %]</td>
                 <td>
                     [% IF ( acceptedby_borrowernumber ) %]
-                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% acceptedby_borrowernumber %]">[% acceptedby_surname %], [% acceptedby_firstname %] ([% suggestedby_cardnumber %])</a>
-                        [% Branches.GetName( acceptedby_branchcode ) %] ([% acceptedby_description %])
+                        <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% acceptedby_borrowernumber | html %]">[% acceptedby_surname | html %], [% acceptedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a>
+                        [% Branches.GetName( acceptedby_branchcode ) | html %] ([% acceptedby_description | html %])
                     [% END %]
                 </td>
             </tr>
     <fieldset class="rows"> <legend>Acquisition information</legend>
       <ol>
         <li>
-          <span class="label">Library:</span> [% Branches.GetName( branchcode ) %]
+          <span class="label">Library:</span> [% Branches.GetName( branchcode ) | html %]
         </li>
         <li>
-          <span class="label">Fund:</span> [% budgetname %]
+          <span class="label">Fund:</span> [% budgetname | html %]
         </li>
         <li>
-          <span class="label">Copies:</span>[% quantity %]
+          <span class="label">Copies:</span>[% quantity | html %]
         </li>
         <li>
-          <span class="label">Currency:</span>[% currency %]
+          <span class="label">Currency:</span>[% currency | html %]
         </li>
         <li>
-          <span class="label">Price:</span>[% price | $Price %]
+          <span class="label">Price:</span>[% price | $Price | html %]
         </li>
         <li>
-          <span class="label">Total</span>[% total | $Price %]
+          <span class="label">Total</span>[% total | $Price | html %]
         </li>
       </ol>
     </fieldset>
 
 [% IF ( op_save ) %]
     <form id="add_edit" action="suggestion.pl" method="post" class="validated">
-    <input type="hidden" name="redirect" id="redirect" value="[% redirect %]" />
-    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber %]" />
+    <input type="hidden" name="redirect" id="redirect" value="[% redirect | html %]" />
+    <input type="hidden" name="borrowernumber" id="borrowernumber" value="[% borrowernumber | html %]" />
     [% IF ( suggestionid ) %]
-        <h1>Edit purchase suggestion #[% suggestionid %]</h1>
-        <input type="hidden" name="suggestionid" value="[% suggestionid %]"/>
+        <h1>Edit purchase suggestion #[% suggestionid | html %]</h1>
+        <input type="hidden" name="suggestionid" value="[% suggestionid | html %]"/>
     [% ELSE %]
         <h1>Enter a new purchase suggestion</h1>
     [% END %]
     <fieldset class="rows"> <legend>Bibliographic information</legend><ol>
         <li>
             <label for="title" class="required">Title:</label>
-            <input type="text" id="title" name="title" size="80" maxlength="255" value="[% title |html %]" required="required" class="required" />
+            <input type="text" id="title" name="title" size="80" maxlength="255" value="[% title | html %]" required="required" class="required" />
             <span class="required">Required</span>
         </li>
         <li><label for="author">Author:</label><input type="text" id="author" name="author" size="50" maxlength="80" value="[% author | html %]"/></li>
                     <option value=""> -- Choose -- </option>
                     [% FOREACH patron_reason_loo IN patron_reason_loop %]
                         [% IF patron_reason_loo.authorised_value == patronreason %]
-                            <option value="[% patron_reason_loo.authorised_value %]" selected="selected">[% patron_reason_loo.lib %]</option>
+                            <option value="[% patron_reason_loo.authorised_value | html %]" selected="selected">[% patron_reason_loo.lib | html %]</option>
                         [% ELSE %]
-                            <option value="[% patron_reason_loo.authorised_value %]">[% patron_reason_loo.lib %]</option>
+                            <option value="[% patron_reason_loo.authorised_value | html %]">[% patron_reason_loo.lib | html %]</option>
                         [% END %]
                     [% END %]
                 </select>
             </li>
         [% END %]
-        <li><label for="note">Notes:</label><textarea name="note" id="note" rows="5" cols="40">[% note %]</textarea></li>
+        <li><label for="note">Notes:</label><textarea name="note" id="note" rows="5" cols="40">[% note | html %]</textarea></li>
         </ol>
     </fieldset>
     <fieldset class="rows"> <legend>Suggestion management</legend>
 
                         [% FOREACH s IN SuggestionStatuses %]
                             [% IF s.authorised_value == suggestion.STATUS %]
-                                <option value="[% s.authorised_value %]" selected="selected">[% s.lib %]</option>
+                                <option value="[% s.authorised_value | html %]" selected="selected">[% s.lib | html %]</option>
                             [% ELSE %]
-                                <option value="[% s.authorised_value %]">[% s.lib %]</option>
+                                <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                         <option value=""> -- Choose a reason -- </option>
                         [% FOREACH reasonsloo IN suggestion.reasonsloop %]
                             [% IF (reasonsloo.lib == suggestion.reason) %]
-                                <option value="[% reasonsloo.lib %]" selected="selected">[% reasonsloo.lib %]</option>
+                                <option value="[% reasonsloo.lib | html %]" selected="selected">[% reasonsloo.lib | html %]</option>
                             [% ELSE %]
-                                <option value="[% reasonsloo.lib %]">[% reasonsloo.lib %]</option>
+                                <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option>
                             [% END %]
                         [% END %]
                         <option value="other">Others...</option>
             <tr>
                 <th><label for="suggesteddate">Created by:</label> </th>
                 <td><input type="text" id="suggesteddate" name="suggesteddate" class="datepicker" size="10" maxlength="10" value="[% suggesteddate | $KohaDates %]"/>[% INCLUDE 'date-format.inc' %]</td>
-                <td><input type="hidden" id="suggestedby" name="suggestedby" value="[% suggestedby %]"/>[% IF ( suggestedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestedby_borrowernumber %]">[% suggestedby_surname %], [% suggestedby_firstname %] ([% suggestedby_cardnumber %])</a>  [% Branches.GetName( suggestedby_branchcode ) %] ([% suggestedby_description %])[% END %]
+                <td><input type="hidden" id="suggestedby" name="suggestedby" value="[% suggestedby | html %]"/>[% IF ( suggestedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestedby_borrowernumber | html %]">[% suggestedby_surname | html %], [% suggestedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a>  [% Branches.GetName( suggestedby_branchcode ) | html %] ([% suggestedby_description | html %])[% END %]
                 </td>
             </tr>
             <tr>
                 <th><label for="managedon">Managed by:</label> </th>
                 <td><input type="text" id="managedon" name="manageddate" class="datepicker" size="10" maxlength="10" value="[% manageddate | $KohaDates %]" />[% INCLUDE 'date-format.inc' %]</td>
-                <td><input type="hidden" id="managedby" name="managedby" value="[% managedby %]"/>[% IF ( managedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% managedby_borrowernumber %]">[% managedby_surname %], [% managedby_firstname %] ([% suggestedby_cardnumber %])</a> [% Branches.GetName( managedby_branchcode ) %] ([% managedby_description %])[% END %]</td>
+                <td><input type="hidden" id="managedby" name="managedby" value="[% managedby | html %]"/>[% IF ( managedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% managedby_borrowernumber | html %]">[% managedby_surname | html %], [% managedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a> [% Branches.GetName( managedby_branchcode ) | html %] ([% managedby_description | html %])[% END %]</td>
             </tr>
             <tr>
                 <th><label for="accepteddate">Accepted on:</label> </th>
                 <td><input type="text" id="accepteddate" name="accepteddate" class="datepicker" size="10" maxlength="10" value="[% accepteddate | $KohaDates %]" />[% INCLUDE 'date-format.inc' %]</td>
-                <td><input type="hidden" id="acceptedby" name="acceptedby" value="[% acceptedby %]"/>[% IF ( acceptedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% acceptedby_borrowernumber %]">[% acceptedby_surname %], [% acceptedby_firstname %] ([% suggestedby_cardnumber %])</a> [% Branches.GetName( acceptedby_branchcode ) %] ([% acceptedby_description %])[% END %]</td>
+                <td><input type="hidden" id="acceptedby" name="acceptedby" value="[% acceptedby | html %]"/>[% IF ( acceptedby_borrowernumber ) %]<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% acceptedby_borrowernumber | html %]">[% acceptedby_surname | html %], [% acceptedby_firstname | html %] ([% suggestedby_cardnumber | html %])</a> [% Branches.GetName( acceptedby_branchcode ) | html %] ([% acceptedby_description | html %])[% END %]</td>
             </tr>
             </tbody>
         </table></li></ol>
         <li><label for="budgetid">Fund:</label>
             <select name="budgetid" id="budgetid">
                 <option value="">Any</option>[% FOREACH budgetsloo IN budgetsloop %]
-                [% IF ( budgetsloo.selected ) %]<option value="[% budgetsloo.budget_id %]" selected="selected">[% budgetsloo.budget_name %]</option>[% ELSE %]<option value="[% budgetsloo.budget_id %]">[% budgetsloo.budget_name %]</option>[% END %][% END %]
+                [% IF ( budgetsloo.selected ) %]<option value="[% budgetsloo.budget_id | html %]" selected="selected">[% budgetsloo.budget_name | html %]</option>[% ELSE %]<option value="[% budgetsloo.budget_id | html %]">[% budgetsloo.budget_name | html %]</option>[% END %][% END %]
             </select>
                </li><li><label for="quantity">Copies:</label>
-            <input type="text" size="10" id="quantity" name="quantity" value="[% quantity %]" />
+            <input type="text" size="10" id="quantity" name="quantity" value="[% quantity | html %]" />
                 </li>
                 <li>
                     <label for="currency">Currency:</label>
                     [% FOREACH c IN currencies %]
-                        <input type="hidden" value="[% c.rate %]" id="currency_rate_[% c.currency %]" name="currency_rate_[% c.currency %]" />
-                        <input type="hidden" id="[% c.currency %]" name="[% c.currency %]" value="[% c.rate %]" />
+                        <input type="hidden" value="[% c.rate | html %]" id="currency_rate_[% c.currency | html %]" name="currency_rate_[% c.currency | html %]" />
+                        <input type="hidden" id="[% c.currency | html %]" name="[% c.currency | html %]" value="[% c.rate | html %]" />
                     [% END %]
 
                     <select name="currency" id="currency">
                         [% FOREACH c IN currencies %]
                             [% IF suggestionid and suggestion.currency == c.currency or not suggestionid and c.active %]
-                                <option value="[% c.currency %]" selected="selected">[% c.currency %]</option>
+                                <option value="[% c.currency | html %]" selected="selected">[% c.currency | html %]</option>
                             [% ELSIF not c.archived %]
-                                <option value="[% c.currency %]">[% c.currency %]</option>
+                                <option value="[% c.currency | html %]">[% c.currency | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                 </li>
                 <li><label for="price">Price:</label>
-            <input type="text" size="20" name="price" id="price" value="[% price %]" />
+            <input type="text" size="20" name="price" id="price" value="[% price | html %]" />
                 </li><li><label for="total">Total: </label>
-                       <input type="text" readonly="readonly" id="total" name="total" size="10" value="[% total %]"/>
+                       <input type="text" readonly="readonly" id="total" name="total" size="10" value="[% total | html %]"/>
                 </li></ol>
-    </fieldset><input type="hidden" id="returnsuggested" name="returnsuggested" value="[% IF ( returnsuggestedby ) %][% returnsuggestedby %][% ELSE %]noone[% END %]"/>
-    <fieldset class="action"><input type="hidden" name="op" value="[% op %]" />[% IF ( suggestionid ) %]<input type="submit" value="Save" /> <a class="cancel" href="[% IF ( returnsuggestedby ) %]/cgi-bin/koha/members/moremember.pl?borrowernumber=[% returnsuggestedby %]#suggestions[% ELSE %]suggestion.pl[% END %]">Cancel</a>[% ELSE %]<input type="submit" value="Submit your suggestion" /> <a class="cancel" href="suggestion.pl">Cancel</a>[% END %]
+    </fieldset><input type="hidden" id="returnsuggested" name="returnsuggested" value="[% IF ( returnsuggestedby ) %][% returnsuggestedby | html %][% ELSE %]noone[% END %]"/>
+    <fieldset class="action"><input type="hidden" name="op" value="[% op | html %]" />[% IF ( suggestionid ) %]<input type="submit" value="Save" /> <a class="cancel" href="[% IF ( returnsuggestedby ) %]/cgi-bin/koha/members/moremember.pl?borrowernumber=[% returnsuggestedby | html %]#suggestions[% ELSE %]suggestion.pl[% END %]">Cancel</a>[% ELSE %]<input type="submit" value="Submit your suggestion" /> <a class="cancel" href="suggestion.pl">Cancel</a>[% END %]
     </fieldset>
     </form>
 [% END %]
 
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'already_exists' %]
-            The suggestion has not been added. A suggestion with this title already exists (<a href='/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% m.id %]&op=show'>suggestion #[% m.id %]</a>)
+            The suggestion has not been added. A suggestion with this title already exists (<a href='/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=[% m.id | html %]&op=show'>suggestion #[% m.id | html %]</a>)
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
     <ul class="ui-tabs-nav">
         [% FOREACH suggestion IN suggestions %]
                 <li>
-            <a href="#[% suggestion.suggestiontype %]">
+            <a href="#[% suggestion.suggestiontype | html %]">
             [% IF ( suggestion.suggestiontypelabel ) %]
                 [% IF (suggestion.suggestiontypelabel == "Pending") %]Pending
                 [% ELSIF (suggestion.suggestiontypelabel == "Accepted") %]Accepted
                 [% ELSIF (suggestion.suggestiontypelabel == "Available") %]Available
                 [% ELSIF (suggestion.suggestiontypelabel == "Ordered") %]Ordered
                 [% ELSIF (suggestion.suggestiontypelabel == "Unknown") %]Status unknown
-                [% ELSE %][% suggestion.suggestiontypelabel %][% END %]
+                [% ELSE %][% suggestion.suggestiontypelabel | html %][% END %]
             [% ELSE %]
                 [% IF ( suggestion.suggestiontype ) %]
-                    [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestion.suggestiontype ) %]
+                    [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestion.suggestiontype ) | html %]
                 [% ELSE %]
                     No name
                 [% END %]
             [% END %]
-            ([% suggestion.suggestions_loop.size %])</a></li>
+            ([% suggestion.suggestions_loop.size | html %])</a></li>
 
         [% END %]
     </ul>
 [% END %]
 
 [% FOREACH suggestion IN suggestions %]
-<div id="[% suggestion.suggestiontype %]">
-<form class="update_suggestions" name="f[% suggestion.suggestiontype %]" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype %]">
+<div id="[% suggestion.suggestiontype | html %]">
+<form class="update_suggestions" name="f[% suggestion.suggestiontype | html %]" method="post" action="/cgi-bin/koha/suggestion/suggestion.pl#[% suggestion.suggestiontype | html %]">
 
 [% IF ( suggestion.suggestions_loop ) %]
-<p><a id="CheckAll[% suggestion.suggestiontype %]" href="#">Check all</a> | <a id="UncheckAll[% suggestion.suggestiontype %]" href="#">Uncheck all</a></p>
-    <table id="[% suggestion.suggestiontype %]t" class="sorted">
+<p><a id="CheckAll[% suggestion.suggestiontype | html %]" href="#">Check all</a> | <a id="UncheckAll[% suggestion.suggestiontype | html %]" href="#">Uncheck all</a></p>
+    <table id="[% suggestion.suggestiontype | html %]t" class="sorted">
         <thead>
             <tr>
                 <th class="NoSort">&nbsp;</th>
             [% FOREACH suggestions_loo IN suggestion.suggestions_loop %]
                 <tr>
                 <td>
-                    <input type="checkbox" name="edit_field" value="[% suggestions_loo.suggestionid %]" />
+                    <input type="checkbox" name="edit_field" value="[% suggestions_loo.suggestionid | html %]" />
                 </td>
                 <td>
-                    <a href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid %]&amp;op=show" title="suggestion" >
-                        [% suggestions_loo.title |html %][% IF ( suggestions_loo.author ) %], by [% suggestions_loo.author %][% END %]</a>
+                    <a href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=show" title="suggestion" >
+                        [% suggestions_loo.title | html %][% IF ( suggestions_loo.author ) %], by [% suggestions_loo.author | html %][% END %]</a>
                     <br />
-                    [% IF ( suggestions_loo.copyrightdate ) %]&copy; [% suggestions_loo.copyrightdate |html %] [% END %]
-                        [% IF ( suggestions_loo.volumedesc ) %]; Volume:<i>[% suggestions_loo.volumedesc |html %]</i> [% END %]
-                        [% IF ( suggestions_loo.isbn ) %]; ISBN:<i>[% suggestions_loo.isbn |html %]</i> [% END %][% IF ( suggestions_loo.publishercode ) %]; Published by [% suggestions_loo.publishercode |html %] [% END %][% IF ( suggestions_loo.publicationyear ) %] in <i>[% suggestions_loo.publicationyear |html %]</i> [% END %][% IF ( suggestions_loo.place ) %] in <i>[% suggestions_loo.place |html %]</i> [% END %][% IF ( suggestions_loo.collectiontitle ) %]; [% suggestions_loo.collectiontitle |html %] [% END %][% IF ( suggestions_loo.itemtype ) %]; [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', suggestions_loo.itemtype, 0 ) %] [% END %]<br />[% IF ( suggestions_loo.note ) %]<span class="note">[% suggestions_loo.note |html%]</span>[% END %]
+                    [% IF ( suggestions_loo.copyrightdate ) %]&copy; [% suggestions_loo.copyrightdate | html %] [% END %]
+                        [% IF ( suggestions_loo.volumedesc ) %]; Volume:<i>[% suggestions_loo.volumedesc | html %]</i> [% END %]
+                        [% IF ( suggestions_loo.isbn ) %]; ISBN:<i>[% suggestions_loo.isbn | html %]</i> [% END %][% IF ( suggestions_loo.publishercode ) %]; Published by [% suggestions_loo.publishercode | html %] [% END %][% IF ( suggestions_loo.publicationyear ) %] in <i>[% suggestions_loo.publicationyear | html %]</i> [% END %][% IF ( suggestions_loo.place ) %] in <i>[% suggestions_loo.place | html %]</i> [% END %][% IF ( suggestions_loo.collectiontitle ) %]; [% suggestions_loo.collectiontitle | html %] [% END %][% IF ( suggestions_loo.itemtype ) %]; [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', suggestions_loo.itemtype, 0 ) | html %] [% END %]<br />[% IF ( suggestions_loo.note ) %]<span class="note">[% suggestions_loo.note | html %]</span>[% END %]
                 </td>
                 <td>
-                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestions_loo.suggestedby %]">[% suggestions_loo.surnamesuggestedby %][% IF ( suggestions_loo.firstnamesuggestedby ) %], [% suggestions_loo.firstnamesuggestedby %][% END %] [% IF (suggestions_loo.cardnumbersuggestedby ) %]([% suggestions_loo.cardnumbersuggestedby %])[% END %]</a>
+                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestions_loo.suggestedby | html %]">[% suggestions_loo.surnamesuggestedby | html %][% IF ( suggestions_loo.firstnamesuggestedby ) %], [% suggestions_loo.firstnamesuggestedby | html %][% END %] [% IF (suggestions_loo.cardnumbersuggestedby ) %]([% suggestions_loo.cardnumbersuggestedby | html %])[% END %]</a>
                     [% IF ( suggestions_loo.suggesteddate ) %] - [% suggestions_loo.suggesteddate | $KohaDates %][% END %]
                 </td>
                 <td>
-                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestions_loo.suggestedby %]">[% suggestions_loo.surnamemanagedby %][% IF ( suggestions_loo.firstnamemanagedby ) %], [% suggestions_loo.firstnamemanagedby %][% END %]</a>
+                    <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% suggestions_loo.suggestedby | html %]">[% suggestions_loo.surnamemanagedby | html %][% IF ( suggestions_loo.firstnamemanagedby ) %], [% suggestions_loo.firstnamemanagedby | html %][% END %]</a>
                     [% IF ( suggestions_loo.manageddate ) %] - [% suggestions_loo.manageddate | $KohaDates %][% END %]
                 </td>
                 <td>
-                    [% Branches.GetName( suggestions_loo.branchcode ) %]
+                    [% Branches.GetName( suggestions_loo.branchcode ) | html %]
                 </td>
                 <td>
-                    [% suggestions_loo.budget_name %]
+                    [% suggestions_loo.budget_name | html %]
                 </td>
                 <td>
                     [% IF ( suggestions_loo.ASKED ) %]
                     [% ELSIF ( suggestions_loo.CHECKED ) %]
                         Checked
                     [% ELSIF AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS ) %]
-                        [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS ) %]
+                        [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS ) | html %]
                     [% ELSE %]
                         Status unknown
                     [% END %]
 
                     [% IF ( suggestions_loo.reason ) %]
-                        <br />([% suggestions_loo.reason %])
+                        <br />([% suggestions_loo.reason | html %])
                     [% END %]
                 </td>
                 <td class="actions">
-                    <a class="btn btn-xs btn-default" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a>
-                    <a class="btn btn-default btn-xs deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestions_loo.suggestionid %]"><i class="fa fa-trash"></i> Delete</a>
+                    <a class="btn btn-xs btn-default" href="suggestion.pl?suggestionid=[% suggestions_loo.suggestionid | html %]&amp;op=edit"><i class="fa fa-pencil"></i> Edit</a>
+                    <a class="btn btn-default btn-xs deletesuggestion" href="suggestion.pl?op=delete&amp;edit_field=[% suggestions_loo.suggestionid | html %]"><i class="fa fa-trash"></i> Delete</a>
                 </td>
         </tr>
         [% END %]</tbody>
         </table>  <fieldset>
-    <div id="select-reason[% suggestion.suggestiontype %]">
-        <div id="status[% suggestion.suggestiontype %]">
-            <label for="STATUS[% suggestion.suggestiontype %]">Mark selected as: </label>
-            <select name="STATUS" id="STATUS[% suggestion.suggestiontype %]">
+    <div id="select-reason[% suggestion.suggestiontype | html %]">
+        <div id="status[% suggestion.suggestiontype | html %]">
+            <label for="STATUS[% suggestion.suggestiontype | html %]">Mark selected as: </label>
+            <select name="STATUS" id="STATUS[% suggestion.suggestiontype | html %]">
                 <option value=""> -- Choose a status --</option>
 
                 [% IF (statusselected_ASKED ) %]
                 [% END %]
 
                 [% FOREACH s IN SuggestionStatuses %]
-                    <option value="[% s.authorised_value %]">[% s.lib %]</option>
+                    <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
                 [% END %]
             </select>
 
-            <label for="reason[% suggestion.suggestiontype %]">with this reason:</label>
-            <select id="reason[% suggestion.suggestiontype %]" name="reason[% suggestion.suggestiontype %]">
+            <label for="reason[% suggestion.suggestiontype | html %]">with this reason:</label>
+            <select id="reason[% suggestion.suggestiontype | html %]" name="reason[% suggestion.suggestiontype | html %]">
                 <option value=""> -- Choose a reason -- </option>
                 [% FOREACH reasonsloo IN suggestion.reasonsloop %]
-                    <option value="[% reasonsloo.lib %]">[% reasonsloo.lib %]</option>
+                    <option value="[% reasonsloo.lib | html %]">[% reasonsloo.lib | html %]</option>
                 [% END %]
                 <option value="other">Others...</option>
             </select>
 
-            <span id="other_reason[% suggestion.suggestiontype %]">
-                <input type="text" size="31" id="select-other_reason[% suggestion.suggestiontype %]" name="other_reason[% suggestion.suggestiontype %]" placeholder="please note your reason here..." />
-                <a href="#back[% suggestion.suggestiontype %]">Cancel</a>
+            <span id="other_reason[% suggestion.suggestiontype | html %]">
+                <input type="text" size="31" id="select-other_reason[% suggestion.suggestiontype | html %]" name="other_reason[% suggestion.suggestiontype | html %]" placeholder="please note your reason here..." />
+                <a href="#back[% suggestion.suggestiontype | html %]">Cancel</a>
             </span>
 
             <strong style="padding: 0 1em;">OR:</strong>
 
-            <label for="[% suggestion.suggestiontype %]delete">Delete selected</label>
-            <input type="checkbox" name="op" id="[% suggestion.suggestiontype %]delete" />
+            <label for="[% suggestion.suggestiontype | html %]delete">Delete selected</label>
+            <input type="checkbox" name="op" id="[% suggestion.suggestiontype | html %]delete" />
         </div>
     </div>
 
-    <input type="hidden" name="branchcode" value="[% branchfilter %]" />
-    <input type="hidden" name="tabcode" value="[% suggestion.suggestiontype %]" />
+    <input type="hidden" name="branchcode" value="[% branchfilter | html %]" />
+    <input type="hidden" name="tabcode" value="[% suggestion.suggestiontype | html %]" />
     <input type="hidden" name="op" value="change" />
 </fieldset>
         <fieldset class="action">
                 <div style="display:block;" id="limits">
 
                                <fieldset class="brief"><h4 class="local_collapse"><a href="#">Bibliographic information</a></h4>
-                   <ol> <li><label for="title"> Title:</label><input type="text" id="title" name="title" value="[% title |html %]" /></li>
+                   <ol> <li><label for="title"> Title:</label><input type="text" id="title" name="title" value="[% title | html %]" /></li>
                     <li><label for="author"> Author:</label><input type="text" id="author" name="author" value="[% author | html %]" /></li>
                     <li><label for="isbn"> ISBN:</label><input type="text" id="isbn"  name="isbn" value="[% isbn | html %]" /></li>
                     <li><label for="publishercode"> Publisher:</label><input type="text" id="publishercode" name="publishercode" value="[% publishercode | html %]" /></li>
 
                               [% FOREACH s IN SuggestionStatuses %]
                                   [% IF s.authorised_value == selected_status %]
-                                      <option value="[% s.authorised_value %]" selected="selected">[% s.lib %]</option>
+                                      <option value="[% s.authorised_value | html %]" selected="selected">[% s.lib | html %]</option>
                                   [% ELSE %]
-                                      <option value="[% s.authorised_value %]">[% s.lib %]</option>
+                                      <option value="[% s.authorised_value | html %]">[% s.lib | html %]</option>
                                   [% END %]
                               [% END %]
                           </select>
                       </li>
 
                     <li><label for="suggestedby"> Suggested by:</label><select id="suggestedby" name="suggestedby"><option value="">Any</option>
-[% FOREACH suggestedby_loo IN suggestedby_loop %][% IF ( suggestedby_loo.selected ) %]<option value="[% suggestedby_loo.code %]" selected="selected">[% suggestedby_loo.desc %]</option>[% ELSE %]<option value="[% suggestedby_loo.code %]">[% suggestedby_loo.desc %]</option>[% END %][% END %]
+[% FOREACH suggestedby_loo IN suggestedby_loop %][% IF ( suggestedby_loo.selected ) %]<option value="[% suggestedby_loo.code | html %]" selected="selected">[% suggestedby_loo.desc | html %]</option>[% ELSE %]<option value="[% suggestedby_loo.code | html %]">[% suggestedby_loo.desc | html %]</option>[% END %][% END %]
                                                                      </select></li>
                     <li>
                         <label for="suggesteddate_from">Suggested date from:</label>
-                        <input type="text" id="suggesteddate_from" size="10" name="suggesteddate_from" value="[% suggesteddate_from %]" />
+                        <input type="text" id="suggesteddate_from" size="10" name="suggesteddate_from" value="[% suggesteddate_from | html %]" />
                     </li>
                     <li>
                         <label for="suggesteddate_to">To:</label>
-                        <input type="text" id="suggesteddate_to" size="10" name="suggesteddate_to" value="[% suggesteddate_to %]" />
+                        <input type="text" id="suggesteddate_to" size="10" name="suggesteddate_to" value="[% suggesteddate_to | html %]" />
                     </li>
                     <li><label for="managedby"> Managed by:</label><select id="managedby" name="managedby"><option value="">Any</option>
-[% FOREACH managedby_loo IN managedby_loop %][% IF ( managedby_loo.selected ) %]<option value="[% managedby_loo.code %]" selected="selected">[% managedby_loo.desc %]</option>[% ELSE %]<option value="[% managedby_loo.code %]">[% managedby_loo.desc %]</option>[% END %][% END %]
+[% FOREACH managedby_loo IN managedby_loop %][% IF ( managedby_loo.selected ) %]<option value="[% managedby_loo.code | html %]" selected="selected">[% managedby_loo.desc | html %]</option>[% ELSE %]<option value="[% managedby_loo.code | html %]">[% managedby_loo.desc | html %]</option>[% END %][% END %]
                                                                      </select></li>
                     <li>
                         <label for="manageddate_from">Management date from:</label>
-                        <input type="text" id="manageddate_from" size="10" name="manageddate_from" value="[% manageddate_from %]" />
+                        <input type="text" id="manageddate_from" size="10" name="manageddate_from" value="[% manageddate_from | html %]" />
                     </li>
                     <li>
                         <label for="manageddate_to">To:</label>
-                        <input type="text" id="manageddate_to" size="10" name="manageddate_to" value="[% manageddate_to %]" />
+                        <input type="text" id="manageddate_to" size="10" name="manageddate_to" value="[% manageddate_to | html %]" />
                     </li>
                     <li><label for="acceptedby"> Accepted by:</label><select id="acceptedby" name="acceptedby"><option value="">Any</option>
-[% FOREACH acceptedby_loo IN acceptedby_loop %][% IF ( acceptedby_loo.selected ) %] <option value="[% acceptedby_loo.code %]" selected="selected">[% acceptedby_loo.desc %]</option>[% ELSE %]<option value="[% acceptedby_loo.code %]">[% acceptedby_loo.desc %]</option>[% END %][% END %]
+[% FOREACH acceptedby_loo IN acceptedby_loop %][% IF ( acceptedby_loo.selected ) %] <option value="[% acceptedby_loo.code | html %]" selected="selected">[% acceptedby_loo.desc | html %]</option>[% ELSE %]<option value="[% acceptedby_loo.code | html %]">[% acceptedby_loo.desc | html %]</option>[% END %][% END %]
                                                      </select></li>
                     <li>
                         <label for="accepteddate_from">Accepted date from:</label>
-                        <input type="text" id="accepteddate_from" size="10" name="accepteddate_from" value="[% accepteddate_from %]" />
+                        <input type="text" id="accepteddate_from" size="10" name="accepteddate_from" value="[% accepteddate_from | html %]" />
                     </li>
                     <li>
                         <label for="accepteddate_to">To:</label>
-                        <input type="text" id="accepteddate_to" size="10" name="accepteddate_to" value="[% accepteddate_to %]" />
+                        <input type="text" id="accepteddate_to" size="10" name="accepteddate_to" value="[% accepteddate_to | html %]" />
                     </li>
                     <li><input type="submit" value="Go" /></li></ol>
                 </fieldset>
                           <option value="__NONE__">None</option>
                       [% END %]
                     [% FOREACH budgetid_loo IN budgetid_loop %]
-                        [% IF ( budgetid_loo.selected ) %] <option value="[% budgetid_loo.code %]" selected="selected">[% budgetid_loo.desc %]</option>[% ELSE %]<option value="[% budgetid_loo.code %]">[% budgetid_loo.desc %]</option>[% END %]
+                        [% IF ( budgetid_loo.selected ) %] <option value="[% budgetid_loo.code | html %]" selected="selected">[% budgetid_loo.desc | html %]</option>[% ELSE %]<option value="[% budgetid_loo.code | html %]">[% budgetid_loo.desc | html %]</option>[% END %]
                         [% END %]
                     </select></li>
                     <li><label for="branchcode">Library:</label>
     [% END %]
     [% IF ( op_else ) %]
         [% INCLUDE 'datatables.inc' %]
-        [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+        [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
         <script type="text/javascript">
             /**
             *  displayOther.
                     "sPaginationType": "four_button"
                 }));
             [% FOREACH suggestion IN suggestions %]
-                // functions for [% suggestion.suggestiontype %] interactions
-                $("#CheckAll[% suggestion.suggestiontype %]").click(function(e){
-                    $("#[% suggestion.suggestiontype %]t").checkCheckboxes();
+                // functions for [% suggestion.suggestiontype | html %] interactions
+                $("#CheckAll[% suggestion.suggestiontype | html %]").click(function(e){
+                    $("#[% suggestion.suggestiontype | html %]t").checkCheckboxes();
                     e.preventDefault();
                 });
-                $("#UncheckAll[% suggestion.suggestiontype %]").click(function(e){
-                    $("#[% suggestion.suggestiontype %]t").unCheckCheckboxes();
+                $("#UncheckAll[% suggestion.suggestiontype | html %]").click(function(e){
+                    $("#[% suggestion.suggestiontype | html %]t").unCheckCheckboxes();
                     e.preventDefault();
                 });
-                $("#other_reason[% suggestion.suggestiontype %]").hide();
-                $("#reason[% suggestion.suggestiontype %]").change(function(){
+                $("#other_reason[% suggestion.suggestiontype | html %]").hide();
+                $("#reason[% suggestion.suggestiontype | html %]").change(function(){
                     if($(this).val() == "other"){
                         $(this).hide();
-                        $("#other_reason[% suggestion.suggestiontype %]").show();
+                        $("#other_reason[% suggestion.suggestiontype | html %]").show();
                 }
                 });
-                $("#[% suggestion.suggestiontype %]delete").change(function(){
+                $("#[% suggestion.suggestiontype | html %]delete").change(function(){
                     if(this.checked){
-                        $("form[name='f[% suggestion.suggestiontype %]'] input[name=op]").attr("value","delete");
+                        $("form[name='f[% suggestion.suggestiontype | html %]'] input[name=op]").attr("value","delete");
                     } else {
-                        $("form[name='f[% suggestion.suggestiontype %]'] input[name=op]").attr("value","change");
+                        $("form[name='f[% suggestion.suggestiontype | html %]'] input[name=op]").attr("value","change");
                     }
                 });
 
             });
         </script>
     [% END %]
-    [% Asset.js("js/acq.js") %]
-    [% Asset.js("js/acquisitions-menu.js") %]
+    [% Asset.js("js/acq.js") | $raw %]
+    [% Asset.js("js/acquisitions-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
-
index e1ced5b..648a846 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Tags &rsaquo; [% IF ( do_it ) %]Review &rsaquo; [% ELSE %]Review tags[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
 tr.selected { background-color : #FFFFCC; } tr.selected td { background-color : transparent; }</style>
 </head>
@@ -12,14 +13,14 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tags/review.pl">Tags</a> &rsaquo; Results for tag <i>[% tag %]</i></div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tags/review.pl">Tags</a> &rsaquo; Results for tag <i>[% tag | html %]</i></div>
 
 <div id="doc3" class="yui-t2">
  <div id="bd">
   <div id="yui-main">
   <div class="yui-b">
 [% IF ( titles ) %]
-<h3>Titles tagged with the term <i>[% tag %]</i></h3>
+<h3>Titles tagged with the term <i>[% tag | html %]</i></h3>
 <table id="itemst">
        <thead><tr>
            <th>Title</th>
@@ -29,35 +30,35 @@ tr.selected { background-color : #FFFFCC; } tr.selected td { background-color :
 
         [% FOREACH title IN titles %]
             <tr>
-            <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = title.biblionumber %][% title.title |html %][% FOREACH subtitl IN title.subtitle %] [% subtitl.subfield %][% END %]</a>
-            [% title.author %]
-            <p>[% IF ( title.publishercode ) %]- [% title.publishercode|html %]
-            [% IF ( title.place ) %] [% title.place %][% END %][% END %]
-            [% IF ( title.pages ) %] - [% title.pages %][% IF ( title.size ) %] [% title.size %]
+            <td>[% INCLUDE 'biblio-default-view.inc' biblionumber = title.biblionumber %][% title.title | html %][% FOREACH subtitl IN title.subtitle %] [% subtitl.subfield | html %][% END %]</a>
+            [% title.author | html %]
+            <p>[% IF ( title.publishercode ) %]- [% title.publishercode | html %]
+            [% IF ( title.place ) %] [% title.place | html %][% END %][% END %]
+            [% IF ( title.pages ) %] - [% title.pages | html %][% IF ( title.size ) %] [% title.size | html %]
             [% END %]
             [% END %]</p>
             [% IF ( title.notes ) %]
-            <p>[% title.notes |html%]</p>[% END %]
+            <p>[% title.notes | html %]</p>[% END %]
             [% IF ( title.TagLoop ) %]<p style="font-size:90%"><strong>Tagged with:</strong> [% FOREACH TagLoo IN title.TagLoop %]
-            <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term %]">[% TagLoo.term |html %]</a> <span class="weight">([% TagLoo.weight_total %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]
+            <a href="/cgi-bin/koha/tags/list.pl?tag=[% TagLoo.term | html %]">[% TagLoo.term | html %]</a> <span class="weight">([% TagLoo.weight_total | html %])</span>[% IF ( loop.last ) %][% ELSE %], [% END %]
             [% END %]</p>
             [% END %]
             </td>
             <td>[% IF ( title.items ) %]<ul style="font-size:80%">[% FOREACH item IN title.items %]
                 <li>
-                    [% item.branchname %] [% item.location_description %]
+                    [% item.branchname | html %] [% item.location_description | html %]
                     [% IF ( item.itemcallnumber ) %]
-                        ([% item.itemcallnumber %])
+                        ([% item.itemcallnumber | html %])
                     [% END %]
                 </li>
                 [% END %]</ul>[% ELSE %]This record has no items.[% END %]
              </td>
-             <td><form method="post" action="/cgi-bin/koha/tags/list.pl"><input type="hidden" name="op" value="del" /><input type="hidden" name="tag" value="[% tag %]" /><input type="hidden" name="tag_id" value="[% title.tag_id %]" /><button type="submit" class="delete btn btn-default btn-sm"><i class="fa fa-trash"></i> Remove tag</button></form></td>
+             <td><form method="post" action="/cgi-bin/koha/tags/list.pl"><input type="hidden" name="op" value="del" /><input type="hidden" name="tag" value="[% tag | html %]" /><input type="hidden" name="tag_id" value="[% title.tag_id | html %]" /><button type="submit" class="delete btn btn-default btn-sm"><i class="fa fa-trash"></i> Remove tag</button></form></td>
             </tr>
         [% END %]
     </table>
 [% ELSE %]
-       <div class="dialog message">There are no titles tagged with the term <i>[% tag %]</i></div>
+       <div class="dialog message">There are no titles tagged with the term <i>[% tag | html %]</i></div>
 [% END %]
 </form>
  </div>
index d2e5167..f783f48 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Tags &rsaquo; [% IF ( do_it ) %]Review &rsaquo; [% ELSE %]Review tags[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
 .setlabel {width: 6em; font-family: courier; background-color:#E8E8E8;}
 .rejected { color: #CC0033; }
@@ -42,20 +43,20 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
                [% IF ( op == 'approve' ) %]            Approved
                [% ELSIF ( op == 'reject' ) %]  Rejected
                [% ELSIF ( op == 'test' ) %]            Tested
-               [% ELSE %]Unknown Operation ([% op %]) on
+               [% ELSE %]Unknown Operation ([% op | html %]) on
                [% END %]
-       [% op_count %] Term(s).
+       [% op_count | html %] Term(s).
   </div>
   [% END %]
   [% IF ( message_loop ) %]
   <div class="dialog alert" id="main_error">
     [% FOREACH message_loo IN message_loop %]
-        [% IF ( message_loo.date_from ) %]<strong>Error: </strong>"Date from" is not a legal value ("[% message_loo.date_from %]").
-        [% ELSIF ( message_loo.date_to ) %]<strong>Error: </strong>"Date to" is not a legal value ("[% message_loo.date_to %]").
-        [% ELSIF ( message_loo.failed_ok ) %]<strong>Error: </strong>Failed to approve term ([% message_loo.failed_ok %]).
-        [% ELSIF ( message_loo.failed_rej ) %]<strong>Error: </strong>Failed to reject term ([% message_loo.failed_rej %]).
-        [% ELSIF ( message_loo.approver ) %]No match for user ([% message_loo.approver %]). FILTER REQUIRES BORROWERNUMBER (not name).
-        [% ELSIF ( message_loo.approved_by ) %]<strong>Error: </strong>No match for borrowernumber ([% message_loo.approved_by %]).
+        [% IF ( message_loo.date_from ) %]<strong>Error: </strong>"Date from" is not a legal value ("[% message_loo.date_from | html %]").
+        [% ELSIF ( message_loo.date_to ) %]<strong>Error: </strong>"Date to" is not a legal value ("[% message_loo.date_to | html %]").
+        [% ELSIF ( message_loo.failed_ok ) %]<strong>Error: </strong>Failed to approve term ([% message_loo.failed_ok | html %]).
+        [% ELSIF ( message_loo.failed_rej ) %]<strong>Error: </strong>Failed to reject term ([% message_loo.failed_rej | html %]).
+        [% ELSIF ( message_loo.approver ) %]No match for user ([% message_loo.approver | html %]). FILTER REQUIRES BORROWERNUMBER (not name).
+        [% ELSIF ( message_loo.approved_by ) %]<strong>Error: </strong>No match for borrowernumber ([% message_loo.approved_by | html %]).
         [% ELSIF ( message_loo.op_zero ) %]<strong>Error: </strong> The root koha user in your KOHA_CONF file
             (default: kohaadmin) is not a valid tag moderator. These actions are logged
             by borrowernumber, so the moderator must exist in your borrowers table.
@@ -68,7 +69,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
   [% END %]
   [% IF ( pagination_bar ) %]
   <div class="pages" id="pagination_top">
-       [% pagination_bar %]
+    [% pagination_bar | $raw %]
   </div>
   [% END %]
   [% IF ( tagloop ) %]
@@ -89,47 +90,47 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
     <tbody>
     [% FOREACH tagloo IN tagloop %]
         <tr>
-            <td class="count">[% offset + loop.count %]
+            <td class="count">[% offset + loop.count | html %]
             </td>
-                [% IF ( tagloo.approved == 0 ) %]<td><span><input type="checkbox" value="[% tagloo.term|html %]" name="tags" class="pending" /></span>
-                [% ELSE %]<td><span><input type="checkbox" value="[% tagloo.term|html %]" name="tags" /></span>[% END %]
+                [% IF ( tagloo.approved == 0 ) %]<td><span><input type="checkbox" value="[% tagloo.term | html %]" name="tags" class="pending" /></span>
+                [% ELSE %]<td><span><input type="checkbox" value="[% tagloo.term | html %]" name="tags" /></span>[% END %]
             </td>
             <td>
                 [% IF ( tagloo.approved == -1 ) %]
-                    <span class="rejected status[% offset + loop.count %]">Rejected</span>
+                    <span class="rejected status[% offset + loop.count | html %]">Rejected</span>
                 [% ELSIF ( tagloo.approved == 1 ) %]
-                    <span class="approved status[% offset + loop.count %]">Approved</span>
+                    <span class="approved status[% offset + loop.count | html %]">Approved</span>
                 [% ELSE %]
-                    <span class="pending status[% offset + loop.count %]">Pending</span>
+                    <span class="pending status[% offset + loop.count | html %]">Pending</span>
                 [% END %]
             </td>
-            <td><a href="/cgi-bin/koha/tags/list.pl?tag=[% tagloo.term|uri %]">[% tagloo.term|html %]</a>
+            <td><a href="/cgi-bin/koha/tags/list.pl?tag=[% tagloo.term|uri %]">[% tagloo.term | html %]</a>
             </td>
-            <td>[% tagloo.weight_total %]
+            <td>[% tagloo.weight_total | html %]
             </td>
             [% IF ( tagloo.approved ) %]
             <td class="actions"><span class="ajax_buttons" style="visibility:hidden">
                 [% IF ( tagloo.approved == -1 ) %]
-                    <button data-num="[% offset + loop.count %]" class="approval_btn ok btn btn-default btn-xs" type="submit" title="[% tagloo.term|html %]" value="Approve" name="approve"><i class="fa fa-check"></i> Approve</button>
-                    <button data-num="[% offset + loop.count %]" class="approval_btn rej btn btn-default btn-xs" disabled="disabled" type="submit" title="[% tagloo.term|html %]" value="Rejected" name="reject"><i class="fa fa-remove"></i> Rejected</button>
+                    <button data-num="[% offset + loop.count | html %]" class="approval_btn ok btn btn-default btn-xs" type="submit" title="[% tagloo.term | html %]" value="Approve" name="approve"><i class="fa fa-check"></i> Approve</button>
+                    <button data-num="[% offset + loop.count | html %]" class="approval_btn rej btn btn-default btn-xs" disabled="disabled" type="submit" title="[% tagloo.term | html %]" value="Rejected" name="reject"><i class="fa fa-remove"></i> Rejected</button>
                 [% ELSE %]
-                    <button data-num="[% offset + loop.count %]" class="approval_btn ok btn btn-default btn-xs"  disabled="disabled" type="submit" title="[% tagloo.term|html %]" value="Approved" name="approve"><i class="fa fa-check"></i> Approved</button>
-                    <button data-num="[% offset + loop.count %]" class="approval_btn rej btn btn-default btn-xs" type="submit" title="[% tagloo.term|html %]" value="Reject" name="reject"><i class="fa fa-remove"></i> Reject</button>
+                    <button data-num="[% offset + loop.count | html %]" class="approval_btn ok btn btn-default btn-xs"  disabled="disabled" type="submit" title="[% tagloo.term | html %]" value="Approved" name="approve"><i class="fa fa-check"></i> Approved</button>
+                    <button data-num="[% offset + loop.count | html %]" class="approval_btn rej btn btn-default btn-xs" type="submit" title="[% tagloo.term | html %]" value="Reject" name="reject"><i class="fa fa-remove"></i> Reject</button>
                 [% END %]
                 </span>
             </td>
-            <td>[% IF ( tagloo.approved_by_name ) %]<a href="/cgi-bin/koha/tags/review.pl?approved_by=[% tagloo.approved_by %]&amp;approved=all">[% tagloo.approved_by_name %]</a>[% ELSE %]&nbsp;[% END %]
+            <td>[% IF ( tagloo.approved_by_name ) %]<a href="/cgi-bin/koha/tags/review.pl?approved_by=[% tagloo.approved_by | html %]&amp;approved=all">[% tagloo.approved_by_name | html %]</a>[% ELSE %]&nbsp;[% END %]
             </td>
             [% ELSE %]
             <td class="actions"><span class="ajax_buttons" style="visibility:hidden">
-                <button data-num="[% offset + loop.count %]" class="approval_btn ok btn btn-default btn-xs"  type="submit" title="[% tagloo.term|html %]" value="Approve" name="approve"><i class="fa fa-check"></i> Approve</button>
-                <button data-num="[% offset + loop.count %]" class="approval_btn rej btn btn-default btn-xs" type="submit" title="[% tagloo.term|html %]" value="Reject" name="reject"><i class="fa fa-remove"></i> Reject</button>
+                <button data-num="[% offset + loop.count | html %]" class="approval_btn ok btn btn-default btn-xs"  type="submit" title="[% tagloo.term | html %]" value="Approve" name="approve"><i class="fa fa-check"></i> Approve</button>
+                <button data-num="[% offset + loop.count | html %]" class="approval_btn rej btn btn-default btn-xs" type="submit" title="[% tagloo.term | html %]" value="Reject" name="reject"><i class="fa fa-remove"></i> Reject</button>
                 </span>
             </td>
             [% UNLESS ( filter_approved_pending ) %]<td>&nbsp;</td>[% END %]
             [% END %]
             <td>
-                <span title="[% tagloo.date_approved %]">[% tagloo.date_approved | $KohaDates %]</span>
+                <span title="[% tagloo.date_approved | html %]">[% tagloo.date_approved | $KohaDates %]</span>
             </td>
         </tr>
     [% END %]
@@ -147,16 +148,16 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
   <h4>Terms summary</h4>
   <ul>
     <li><a href="/cgi-bin/koha/tags/review.pl?approved=1">Approved</a>:
-        <span id="terms_summary_approved_count">[% approved_count %]</span>
+        <span id="terms_summary_approved_count">[% approved_count | html %]</span>
         </li>
     <li><a href="/cgi-bin/koha/tags/review.pl?approved=-1">Rejected</a>:
-        <span id="terms_summary_rejected_count">[% rejected_count %]</span>
+        <span id="terms_summary_rejected_count">[% rejected_count | html %]</span>
     </li>
     <li><a href="/cgi-bin/koha/tags/review.pl?approved=0">Pending</a>:
-    <span id="terms_summary_unapproved_count">[% unapproved_count %]</span>
+    <span id="terms_summary_unapproved_count">[% unapproved_count | html %]</span>
     </li>
     <li><a href="/cgi-bin/koha/tags/review.pl?approved=all">Total</a>:
-        <span id="terms_summary_approved_total">[% approved_total %]</span>
+        <span id="terms_summary_approved_total">[% approved_total | html %]</span>
     </li>
   </ul>
   <span id="terms_summary_status">&nbsp;</span>
@@ -170,11 +171,11 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
    <div id="verdict">
        [% IF ( test_term ) %]
        [% IF ( verdict_ok ) %]
-               &quot;[% test_term %]&quot; is permitted.
+               &quot;[% test_term | html %]&quot; is permitted.
        [% ELSIF ( verdict_rej ) %]
-               &quot;[% test_term %]&quot; is prohibited.
+               &quot;[% test_term | html %]&quot; is prohibited.
        [% ELSIF ( verdict_indeterminate ) %]
-               &quot;[% test_term %]&quot; is neither permitted nor prohibited.
+               &quot;[% test_term | html %]&quot; is neither permitted nor prohibited.
        [% END %]
        [% END %]
    </div>
@@ -191,7 +192,7 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 <fieldset class="brief">
   <h4>Filters</h4>
        <ol>
-           <li><label for="tag">Term:</label> <input type="text" name="tag" id="tag" value="[% filter_tag %]" />
+           <li><label for="tag">Term:</label> <input type="text" name="tag" id="tag" value="[% filter_tag | html %]" />
            </li>
            <li><label for="approved">Status:</label>
             <select name="approved" id="approved">
@@ -205,15 +206,15 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
             [% ELSE %]<option value="-1">rejected</option>[% END %]
                        </select>
            </li>
-           <li><label for="approver">Reviewer:</label> <input type="text" name="approver" id="approver" value="[% filter_approver %]" />
+           <li><label for="approver">Reviewer:</label> <input type="text" name="approver" id="approver" value="[% filter_approver | html %]" />
            </li>
            <li>
                        <label for="from">Date: from </label>
-            <input type="text" size="10" id="from" name="from" value="[% filter_date_approved_from %]" class="datepickerfrom" />
+            <input type="text" size="10" id="from" name="from" value="[% filter_date_approved_from | html %]" class="datepickerfrom" />
                        <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
 
                        <label for="to">...to </label>
-            <input type="text" size="10" id="to" name="to" value="[% filter_date_approved_to %]" class="datepickerto" />
+            <input type="text" size="10" id="to" name="to" value="[% filter_date_approved_to | html %]" class="datepickerto" />
                        <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
            </li>
   </ol>
@@ -226,8 +227,8 @@ tr > td input,td input[type="submit"] { font-size: 85%; padding: 1px; }
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("js/pages/tags-review.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("js/pages/tags-review.js") | $raw %]
     <script type="text/javascript">
         var MSG_AJAX_APPROVE_FAILED = _("AJAX failed to approve tag: %s");
         var MSG_AJAX_REJECTION_FAILED = _("AJAX failed to reject tag: %s");
index fd156d5..214ba23 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Access files</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 <body id="tools_access_files" class="tools">
 [% INCLUDE 'header.inc' %]
@@ -33,9 +34,9 @@
             <tbody>
                 [% FOREACH file IN files_loop %]
                 <tr>
-                    <td><a href="/cgi-bin/koha/tools/access_files.pl?id=[% file.id |url %]">[% file.name %]</a></td>
-                    <td align="right">[% file.size %]</td>
-                    <td>[% file.date %]</td>
+                    <td><a href="/cgi-bin/koha/tools/access_files.pl?id=[% file.id |url %]">[% file.name | html %]</a></td>
+                    <td align="right">[% file.size | html %]</td>
+                    <td>[% file.date | html %]</td>
                 </tr>
                 [% END %]
             </tbody>
@@ -53,7 +54,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
     //<![CDATA[
index 7e1d5a3..a156cd9 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
                 [% FOR rule IN rules %]
                   [% SET id = loop.count %]
                   <fieldset class="rule">
-                    <legend>Rule <span class="rulecount">[% loop.count %]</span> <a href="#" class="remove_rule"><i class="fa fa-trash"></i> Remove this rule</a></legend>
-                    <input type="hidden" name="unique_id" value="[% loop.count %]" /> <!-- FIXME on update, the unique_id should be filled -->
+                    <legend>Rule <span class="rulecount">[% loop.count | html %]</span> <a href="#" class="remove_rule"><i class="fa fa-trash"></i> Remove this rule</a></legend>
+                    <input type="hidden" name="unique_id" value="[% loop.count | html %]" /> <!-- FIXME on update, the unique_id should be filled -->
                     <div class="age">
                       <h5>Age in days</h5>
-                      <input class="age" type="number" value="[% rule.age %]" name="age_[% id %]" />
+                      <input class="age" type="number" value="[% rule.age | html %]" name="age_[% id | html %]" />
                     </div>
                     <div class="blocks">
                       <h5>Conditions</h5>
                       [% FOR condition IN rule.conditions %]
                         <div class="block">
-                          <select name="condition_field_[% id %]">
+                          <select name="condition_field_[% id | html %]">
                             <option value="">Choose a field name</option>
                             [% FOR field IN condition_fields %]
                               [% IF condition.field == field %]
-                                <option value="[% field %]" selected="selected">[% field %]</option>
+                                <option value="[% field | html %]" selected="selected">[% field | html %]</option>
                               [% ELSE %]
-                                <option value="[% field %]">[% field %]</option>
+                                <option value="[% field | html %]">[% field | html %]</option>
                               [% END %]
                             [% END %]
                           </select>
                           =
-                          <input type="text" value="[% condition.value %]" name="condition_value_[% id%]" />
+                          <input type="text" value="[% condition.value | html %]" name="condition_value_[% id | html %]" />
                           <a class="add_block" href="#"><i class="fa fa-plus"></i> Add a condition</a>
                           <a class="remove_block" href="#"><i class="fa fa-trash"></i> Remove condition</a>
                         </div>
                       <h5>Substitutions</h5>
                       [% FOR substitution IN rule.substitutions %]
                         <div class="block">
-                          <select class="required" required="required" name="substitution_field_[% id %]">
+                          <select class="required" required="required" name="substitution_field_[% id | html %]">
                             <option value="">Choose a field name</option>
                             [% FOR field IN substitution_fields %]
                               [% IF substitution.field == field %]
-                                <option value="[% field %]" selected="selected">[% field %]</option>
+                                <option value="[% field | html %]" selected="selected">[% field | html %]</option>
                               [% ELSE %]
-                                <option value="[% field %]">[% field %]</option>
+                                <option value="[% field | html %]">[% field | html %]</option>
                               [% END %]
                             [% END %]
                           </select>
                           =
-                          <input type="text" value="[% substitution.value %]" name="substitution_value_[% id %]" />
+                          <input type="text" value="[% substitution.value | html %]" name="substitution_value_[% id | html %]" />
                           <a class="add_block" href="#"><i class="fa fa-plus"></i> Add a substitution</a>
                           <a class="remove_block" href="#"><i class="fa fa-trash"></i> Remove substitution</a>
                           <span class="required">A field name is required</span>
                 <select name="condition_field">
                   <option value="">Choose a field name</option>
                   [% FOR field IN condition_fields %]
-                    <option value="[% field %]">[% field %]</option>
+                    <option value="[% field | html %]">[% field | html %]</option>
                   [% END %]
                 </select>
                 =
                 <select required="required" class="required" name="substitution_field">
                   <option value="">Choose a field name</option>
                   [% FOR field IN substitution_fields %]
-                    <option value="[% field %]">[% field %]</option>
+                    <option value="[% field | html %]">[% field | html %]</option>
                   [% END %]
                 </select>
                 =
                                 <tr>
                                     <td>
                                         [% IF rule.age.defined and rule.age.length > 0 %]
-                                            [% rule.age %] days
+                                            [% rule.age | html %] days
                                         [% ELSE %]
                                             There is no age for this rule.
                                         [% END %]
                                         [% FOR condition IN rule.conditions %]
                                             [% IF condition.field %]
                                                 <div class="block">
-                                                [% condition.field %] = [% condition.value %]
+                                                [% condition.field | html %] = [% condition.value | html %]
                                                 </div>
                                             [% ELSE %]
                                                 There is no condition for this rule.
                                     <td>
                                         [% FOR substitution IN rule.substitutions %]
                                             <div class="block">
-                                                [% substitution.field %] = [% substitution.value %]
+                                                [% substitution.field | html %] = [% substitution.value | html %]
                                             </div>
                                         [% END %]
                                     </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-    [% Asset.js("js/automatic_item_modification_by_age.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+    [% Asset.js("js/automatic_item_modification_by_age.js") | $raw %]
     [% IF op == 'edit_form' %]
         <script type="text/javascript">
             $(document).ready(function() {
index 1845229..3fb084f 100644 (file)
@@ -1,9 +1,10 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Batch item deletion</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <!--[if IE]>
 <style type="text/css">#selections { display: none; }</style>
 <![endif]-->
 
 
 <form name="f" action="batchMod.pl" method="post">
-     <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
-     <input type="hidden" name="op" value="[% op %]" />
+     <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
+     <input type="hidden" name="op" value="[% op | html %]" />
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <input type="hidden" name="completedJobID" id="completedJobID" value="" />
-     <input type="hidden" name="src" id="src" value="[% src %]" />
+     <input type="hidden" name="src" id="src" value="[% src | html %]" />
      [% IF biblionumber %]
-        <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
+        <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
      [% END %]
 
 [% IF ( item_loop ) %]
@@ -88,7 +89,7 @@
 
     <p id="selections"><strong>Show/hide columns:</strong> <span class="selected"><input type="checkbox" checked="checked" id="showall"/><label for="showall">Show all columns</label></span> <span><input type="checkbox" id="hideall"/><label for="hideall">Hide all columns</label></span>
         [% FOREACH item_header_loo IN item_header_loop %]
-        <span class="selected"><input id="checkheader[% loop.count %]" type="checkbox" checked="checked" /> <label for="checkheader[% loop.count %]">[% item_header_loo.header_value %]</label> </span>
+        <span class="selected"><input id="checkheader[% loop.count | html %]" type="checkbox" checked="checked" /> <label for="checkheader[% loop.count | html %]">[% item_header_loo.header_value | html %]</label> </span>
         [% END %]
     </p>
 
                 [% IF ( show ) %]<th>&nbsp;</th>[% END %]
                 <th class="anti-the">Title</th>
                 [% FOREACH item_header_loo IN item_header_loop %]
-                <th> [% item_header_loo.header_value %] </th>
+                <th> [% item_header_loo.header_value | html %] </th>
                 [% END %]
             </tr>
             </thead>
             <tbody>
-            [% FOREACH item_loo IN item_loop %] <tr> [% IF ( show ) %][% IF ( item_loo.nomod ) %] <td class="error">Cannot edit</td>[% ELSE %]<td><input type="checkbox" name="itemnumber" value="[% item_loo.itemnumber %]" id="row[% item_loo.itemnumber %]" checked="checked" /></td>[% END %][% END %]
-            <td><label for="row[% item_loo.itemnumber %]"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item_loo.biblionumber %]">[% item_loo.title %]</a>[% IF ( item_loo.author ) %], by [% item_loo.author %][% END %]</label></td>
-            [% FOREACH item_valu IN item_loo.item_value %] <td>[% item_valu.field |html %]</td>
+            [% FOREACH item_loo IN item_loop %] <tr> [% IF ( show ) %][% IF ( item_loo.nomod ) %] <td class="error">Cannot edit</td>[% ELSE %]<td><input type="checkbox" name="itemnumber" value="[% item_loo.itemnumber | html %]" id="row[% item_loo.itemnumber | html %]" checked="checked" /></td>[% END %][% END %]
+            <td><label for="row[% item_loo.itemnumber | html %]"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item_loo.biblionumber | html %]">[% item_loo.title | html %]</a>[% IF ( item_loo.author ) %], by [% item_loo.author | html %][% END %]</label></td>
+            [% FOREACH item_valu IN item_loo.item_value %] <td>[% item_valu.field | html %]</td>
                     [% END %] </tr>
             [% END %]
             </tbody>
     <ul>
     [% FOREACH simple_items_displa IN simple_items_display %]
         <li>
-            <a href="[% simple_items_displa.itemnumber %]">[% simple_items_displa.barcode %]</a>
+            <a href="[% simple_items_displa.itemnumber | html %]">[% simple_items_displa.barcode | html %]</a>
         </li>
     [% END %]
     </ul>
 [% IF ( show ) %]
 
 [% IF ( too_many_items ) %]
-    <p>Too many items ([% too_many_items %]) to display individually.</p>
+    <p>Too many items ([% too_many_items | html %]) to display individually.</p>
     [% FOREACH itemnumber IN itemnumbers_array %]
-        <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
+        <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
     [% END %]
 [% END %]
 
 [% IF ( itemresults ) %]
         <div id="cataloguing_additem_newitem">
-         <input type="hidden" name="op" value="[% op %]" />
+         <input type="hidden" name="op" value="[% op | html %]" />
          <p>This will delete [% IF ( too_many_items ) %]all the[% ELSE %]the selected[% END %] items.</p>
          <input type="hidden" name="del" value="1" />
          <fieldset class="action">
 
 [% IF ( action ) %]
     <div class="dialog message">
-            <p>[% deleted_items %] item(s) deleted.</p>
-            [% IF delete_records %] <p>[% deleted_records %] record(s) deleted.</p> [% END %]
+            <p>[% deleted_items | html %] item(s) deleted.</p>
+            [% IF delete_records %] <p>[% deleted_records | html %] record(s) deleted.</p> [% END %]
             [% IF src == 'CATALOGUING' # from catalogue/detail.pl > Delete items in a batch%]
-                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">Return to the record</a>
+                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">Return to the record</a>
             [% ELSIF src %]
-                <a href="[% src %]">Return to where you were</a>
+                <a href="[% src | html %]">Return to where you were</a>
             [% ELSE %]
                 <a href="/cgi-bin/koha/tools/batchMod.pl?del=1">Return to batch item deletion</a>
             [% END %]
         </div>
     [% IF ( not_deleted_items ) %]
     <div style="width:55%;margin:auto;">
-        <p>[% not_deleted_items %] item(s) could not be deleted: [% FOREACH not_deleted_itemnumber IN not_deleted_itemnumbers %][% not_deleted_itemnumber.itemnumber %][% END %]</p>
+        <p>[% not_deleted_items | html %] item(s) could not be deleted: [% FOREACH not_deleted_itemnumber IN not_deleted_itemnumbers %][% not_deleted_itemnumber.itemnumber | html %][% END %]</p>
     [% IF ( not_deleted_loop ) %]
     <table id="itemst">
         <thead>
         <tbody>
             [% FOREACH not_deleted_loo IN not_deleted_loop %]
             <tr>
-                <td>[% not_deleted_loo.itemnumber %]</td>
-                <td>[% IF ( CAN_user_editcatalogue_edit_items ) %]<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% not_deleted_loo.biblionumber %]&amp;itemnumber=[% not_deleted_loo.itemnumber %]">[% not_deleted_loo.barcode %]</a>[% ELSE %][% not_deleted_loo.barcode %][% END %]</td>
+                <td>[% not_deleted_loo.itemnumber | html %]</td>
+                <td>[% IF ( CAN_user_editcatalogue_edit_items ) %]<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% not_deleted_loo.biblionumber | html %]&amp;itemnumber=[% not_deleted_loo.itemnumber | html %]">[% not_deleted_loo.barcode | html %]</a>[% ELSE %][% not_deleted_loo.barcode | html %][% END %]</td>
                 <td>[% IF ( not_deleted_loo.book_on_loan ) %]Item is checked out[% ELSIF ( not_deleted_loo.book_reserved ) %]Item has a waiting hold[% END %]</td>
             </tr>
             [% END %]
 
     <p>
         [% IF src == 'CATALOGUING' # from catalogue/detail.pl > Delete items in a batch%]
-           <a class="btn btn-default" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]"><i class="fa fa-check-square-o"></i> Return to the record</a>
+           <a class="btn btn-default" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]"><i class="fa fa-check-square-o"></i> Return to the record</a>
         [% ELSIF src %]
-           <a class="btn btn-default" href="[% src %]"><i class="fa fa-check-square-o"></i> Return to where you were</a>
+           <a class="btn btn-default" href="[% src | html %]"><i class="fa fa-check-square-o"></i> Return to where you were</a>
         [% ELSE %]
            <a class="btn btn-default" href="/cgi-bin/koha/tools/batchMod.pl?del=1"><i class="fa fa-check-square-o"></i> Return to batch item deletion</a>
         [% END %]
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/pages/batchMod.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("js/pages/batchMod.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         // Prepare array of all column headers, incrementing each index by
         // two to accommodate control and title columns
-        var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count %]'[% UNLESS ( loop.last ) %],[% END %][% END %]);
+        var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count | html %]'[% UNLESS ( loop.last ) %],[% END %][% END %]);
         for( x=0; x<allColumns.length; x++ ){
           allColumns[x] = Number(allColumns[x]) + 2;
         }
index 24f273b..ed8584f 100644 (file)
@@ -1,20 +1,21 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Batch item modification</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.js("js/background-job-progressbar.js") %]
-[% Asset.js("js/cataloging.js") %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.js("js/background-job-progressbar.js") | $raw %]
+[% Asset.js("js/cataloging.js") | $raw %]
+[% Asset.css("css/datatables.css") | $raw %]
 [% INCLUDE 'datatables.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-[% Asset.js("js/pages/batchMod.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+[% Asset.js("js/pages/batchMod.js") | $raw %]
 <script type="text/javascript">
 //<![CDATA[
 
 // Prepare array of all column headers, incrementing each index by
 // two to accommodate control and title columns
-var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count %]'[% UNLESS ( loop.last ) %],[% END %][% END %]);
+var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count | html %]'[% UNLESS ( loop.last ) %],[% END %][% END %]);
 for( x=0; x<allColumns.length; x++ ){
   allColumns[x] = Number(allColumns[x]) + 2;
 }
@@ -42,7 +43,7 @@ $(document).ready(function(){
 <style type="text/css">#selections { display: none; }</style>
 <![endif]-->
 <style type="text/css">input[type=checkbox]{ margin : 0 .5em; }</style>
-[% Asset.css("css/addbiblio.css") %]
+[% Asset.css("css/addbiblio.css") | $raw %]
 
 [% INCLUDE 'select2.inc' %]
 <script type="text/javascript">
@@ -70,15 +71,15 @@ $(document).ready(function(){
               <h1>Batch item modification results</h1>
               <div class="dialog message">
                 [% IF (modified_items) %]
-                  [% modified_items %] item(s) modified (with [% modified_fields %] field(s) modified).
+                  [% modified_items | html %] item(s) modified (with [% modified_fields | html %] field(s) modified).
                 [% ELSE %]
                   No items modified.
                 [% END %]
               <fieldset class="action">
                   [% IF src == 'CATALOGUING' # from catalogue/detail.pl > Edit items in a batch%]
-                      <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">Return to the record</a>
+                      <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">Return to the record</a>
                   [% ELSIF src %]
-                      <a href="[% src %]">Return to where you were</a>
+                      <a href="[% src | html %]">Return to where you were</a>
                   [% ELSE %]
                       <a href="/cgi-bin/koha/tools/batchMod.pl">Return to batch item modification</a>
                   [% END %]
@@ -130,13 +131,13 @@ $(document).ready(function(){
 
 
 <form name="f" action="batchMod.pl" method="post">
-     <input type="hidden" name="op" value="[% op %]" />
+     <input type="hidden" name="op" value="[% op | html %]" />
      <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
      <input type="hidden" name="runinbackground" id="runinbackground" value="" />
      <input type="hidden" name="completedJobID" id="completedJobID" value="" />
-     <input type="hidden" name="src" id="src" value="[% src %]" />
+     <input type="hidden" name="src" id="src" value="[% src | html %]" />
      [% IF biblionumber %]
-        <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
+        <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
      [% END %]
 
 [% IF ( item_loop ) %]
@@ -149,7 +150,7 @@ $(document).ready(function(){
 
 <p id="selections"><strong>Show/hide columns:</strong> <span class="selected"><input type="checkbox" checked="checked" id="showall"/><label for="showall">Show all columns</label></span> <span><input type="checkbox" id="hideall"/><label for="hideall">Hide all columns</label></span> 
         [% FOREACH item_header_loo IN item_header_loop %]
-        <span class="selected"><input id="checkheader[% loop.count %]" type="checkbox" checked="checked" /> <label for="checkheader[% loop.count %]">[% item_header_loo.header_value %]</label> </span>
+        <span class="selected"><input id="checkheader[% loop.count | html %]" type="checkbox" checked="checked" /> <label for="checkheader[% loop.count | html %]">[% item_header_loo.header_value | html %]</label> </span>
         [% END %]
 </p>
         <table id="itemst">
@@ -158,7 +159,7 @@ $(document).ready(function(){
         <th>&nbsp;</th>
         <th class="anti-the">Title</th>
         [% FOREACH item_header_loo IN item_header_loop %]
-        <th> [% item_header_loo.header_value %] </th>
+        <th> [% item_header_loo.header_value | html %] </th>
         [% END %] 
     </tr>
       </thead>
@@ -169,13 +170,13 @@ $(document).ready(function(){
                   [% IF item_loo.nomod %]
                     <td class="error">Cannot edit</td>
                   [% ELSE %]
-                    <td><input type="checkbox" name="itemnumber" value="[% item_loo.itemnumber %]" id="row[% item_loo.itemnumber %]" checked="checked" data-is-onloan="[% item_loo.onloan %]" /></td>
+                    <td><input type="checkbox" name="itemnumber" value="[% item_loo.itemnumber | html %]" id="row[% item_loo.itemnumber | html %]" checked="checked" data-is-onloan="[% item_loo.onloan | html %]" /></td>
                   [% END %]
                 [% ELSE %]
                   <td>&nbsp;</td>
                 [% END %]
-                <td><label for="row[% item_loo.itemnumber %]"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item_loo.biblionumber %]">[% item_loo.title %]</a>[% IF ( item_loo.author ) %], by [% item_loo.author %][% END %]</label></td>
-                [% FOREACH item_valu IN item_loo.item_value %] <td>[% item_valu.field |html %]</td> 
+                <td><label for="row[% item_loo.itemnumber | html %]"><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% item_loo.biblionumber | html %]">[% item_loo.title | html %]</a>[% IF ( item_loo.author ) %], by [% item_loo.author | html %][% END %]</label></td>
+                [% FOREACH item_valu IN item_loo.item_value %] <td>[% item_valu.field | html %]</td>
         [% END %] </tr>
             [% END %]
       </tbody>
@@ -188,7 +189,7 @@ $(document).ready(function(){
     <ul>
     [% FOREACH simple_items_displa IN simple_items_display %]
   <li>
-      [% IF ( CAN_user_editcatalogue_edit_items ) %]<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% simple_items_displa.biblionumber %]&amp;itemnumber=[% simple_items_displa.itemnumber %]">[% simple_items_displa.barcode %]</a>[% ELSE %][% simple_items_displa.barcode %][% END %]
+      [% IF ( CAN_user_editcatalogue_edit_items ) %]<a href="/cgi-bin/koha/cataloguing/additem.pl?op=edititem&amp;biblionumber=[% simple_items_displa.biblionumber | html %]&amp;itemnumber=[% simple_items_displa.itemnumber | html %]">[% simple_items_displa.barcode | html %]</a>[% ELSE %][% simple_items_displa.barcode | html %][% END %]
   </li>
     [% END %]
     </ul>
@@ -197,9 +198,9 @@ $(document).ready(function(){
 [% IF ( show ) %]
 
 [% IF ( too_many_items ) %]
-    <p>Too many items ([% too_many_items %]): You are not allowed to edit more than [% Koha.Preference('MaxItemsToProcessForBatchMod') %] items in a batch.</p>
+    <p>Too many items ([% too_many_items | html %]): You are not allowed to edit more than [% Koha.Preference('MaxItemsToProcessForBatchMod') | html %] items in a batch.</p>
     [% FOREACH itemnumber IN itemnumbers_array %]
-  <input type="hidden" name="itemnumber" value="[% itemnumber %]" />
+  <input type="hidden" name="itemnumber" value="[% itemnumber | html %]" />
     [% END %]
 [% END %]<!-- /too_many_items -->
 
@@ -211,60 +212,61 @@ $(document).ready(function(){
   <ol>
         [% FOREACH ite IN item %]
           <li>
-            <div class="subfield_line" style="[% ite.visibility %]" id="subfield[% ite.tag %][% ite.subfield %][% ite.random %]">
+            <div class="subfield_line" style="[% ite.visibility | html %]" id="subfield[% ite.tag | html %][% ite.subfield | html %][% ite.random | html %]">
               [% SET mv = ite.marc_value %]
               [% IF ( ite.mandatory ) %]
-                <label class="required" for="[%- mv.id -%]">
+                <label class="required" for="[%- mv.id | html -%]">
               [% ELSE %]
-                <label for="[%- mv.id -%]">
+                <label for="[%- mv.id | html -%]">
               [% END %]
-                [% ite.subfield %] - [% ite.marc_lib %]
+                [% ite.subfield | html %] - [% ite.marc_lib | $raw %]
               </label>
 
               [% IF ( mv.type == 'select' ) -%]
-                <select name="[%- mv.name -%]" id="[%- mv.id -%]" size="1" tabindex="1" class="input_marceditor">
+                <select name="[%- mv.name | html -%]" id="[%- mv.id | html -%]" size="1" tabindex="1" class="input_marceditor">
                   [%- FOREACH aval IN mv.values %]
+              [% ite.subfield | html %] -
                     [% IF aval == mv.default %]
-                      <option value="[%- aval -%]" selected="selected">[%- mv.labels.$aval -%]</option>
+                      <option value="[%- aval | html -%]" selected="selected">[%- mv.labels.$aval | html -%]</option>
                     [% ELSE %]
-                      <option value="[%- aval -%]">[%- mv.labels.$aval -%]</option>
+                      <option value="[%- aval | html -%]">[%- mv.labels.$aval | html -%]</option>
                     [% END %]
                   [%- END -%]
                 </select>
               [% ELSIF ( mv.type == 'text1' ) %]
-                <input type="text" tabindex="1" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value -%]" />
-                <a href="#" class="buttonDot" onclick="Dopop('/cgi-bin/koha/authorities/auth_finder.pl?authtypecode=[%- mv.authtypecode -%]&index=[%- mv.id -%]','[%- mv.id -%]'); return false;" title="Tag editor">...</a>
+                <input type="text" tabindex="1" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" />
+                <a href="#" class="buttonDot" onclick="Dopop('/cgi-bin/koha/authorities/auth_finder.pl?authtypecode=[%- mv.authtypecode | html -%]&index=[%- mv.id | html -%]','[%- mv.id | html -%]'); return false;" title="Tag editor">...</a>
               [% ELSIF ( mv.type == 'text2' ) %]
-                <input type="text" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value -%]" />
+                <input type="text" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" />
                 [% IF mv.noclick %]
                   <a href="#" class="buttonDot disabled" title="No popup">...</a>
                 [% ELSE %]
-                  <a href="#" id="buttonDot_[% mv.id %]" class="buttonDot" title="Tag editor">...</a>
+                  <a href="#" id="buttonDot_[% mv.id | html %]" class="buttonDot" title="Tag editor">...</a>
                 [% END %]
-                [% mv.javascript %]
+                [% mv.javascript | $raw %]
               [% ELSIF ( mv.type == 'text' ) %]
-                <input type="text" tabindex="1" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value -%]" />
+                <input type="text" tabindex="1" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" />
               [% ELSIF ( mv.type == 'hidden' ) %]
-                <input type="hidden" tabindex="1" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value -%]" />
+                <input type="hidden" tabindex="1" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255" value="[%- mv.value | html -%]" />
               [% ELSIF ( mv.type == 'textarea' ) %]
-                <textarea tabindex="1" id="[%- mv.id -%]" name="field_value" class="input_marceditor" size="50" maxlength="255">[%- mv.value -%]"</textarea>
+                <textarea tabindex="1" id="[%- mv.id | html -%]" name="field_value" class="input_marceditor" size="50" maxlength="255">[%- mv.value | html -%]"</textarea>
               [%- END -%]
 
               [% UNLESS ( ite.mandatory ) %]
-                <input type="checkbox" id="row[% ite.tag %][% ite.subfield %][% ite.random %]" title="Check to delete subfield [% ite.subfield %]" name="disable_input" value="[% ite.subfield %]" />
+                <input type="checkbox" id="row[% ite.tag | html %][% ite.subfield | html %][% ite.random | html %]" title="Check to delete subfield [% ite.subfield | html %]" name="disable_input" value="[% ite.subfield | html %]" />
               [% ELSE %]
                 <span class="required">Required</span>
               [% END %]
 
-              <input type="hidden" name="tag"       value="[% ite.tag %]" />
-              <input type="hidden" name="subfield"       value="[% ite.subfield %]" />
-              <input type="hidden" name="mandatory"       value="[% ite.mandatory %]" />
+              <input type="hidden" name="tag"       value="[% ite.tag | html %]" />
+              <input type="hidden" name="subfield"       value="[% ite.subfield | html %]" />
+              <input type="hidden" name="mandatory"       value="[% ite.mandatory | html %]" />
               [% IF ( ite.repeatable ) %]
                 <a href="#" class="buttonPlus" onclick="CloneItemSubfield(this.parentNode); return false;">
-                  <img src="[% interface %]/[% theme %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
+                  <img src="[% interface | html %]/[% theme | html %]/img/clone-subfield.png" alt="Clone" title="Clone this subfield" />
                 </a>
               [% END %]
-              <span class="hint" id="hint[% ite.tag %][% ite.subfield %][% ite.random %]"></span>
+              <span class="hint" id="hint[% ite.tag | html %][% ite.subfield | html %][% ite.random | html %]"></span>
             </div>
           </li>
         [% END %]
@@ -285,9 +287,9 @@ $(document).ready(function(){
 [% ELSE %] <!-- // show -->
 <fieldset class="action">
 [% IF src == 'CATALOGUING' # from catalogue/detail.pl > Edit items in a batch%]
-   <a class="btn btn-default" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]"><i class="fa fa-check-square-o"></i> Return to the record</a>
+   <a class="btn btn-default" href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]"><i class="fa fa-check-square-o"></i> Return to the record</a>
 [% ELSIF src %]
-   <a class="btn btn-default" href="[% src %]"><i class="fa fa-check-square-o"></i> Return to where you were</a>
+   <a class="btn btn-default" href="[% src | html %]"><i class="fa fa-check-square-o"></i> Return to where you were</a>
 [% ELSE %]
    <a class="btn btn-default" href="/cgi-bin/koha/tools/batchMod.pl"><i class="fa fa-check-square-o"></i> Return to batch item modification</a>
 [% END %]
index 50a7b8e..4813dec 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -75,7 +76,7 @@
     </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index cd789a9..a3140d2 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% PROCESS 'authorities-search-results.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Batch record deletion</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_batch_delete_records" class="tools">
       <div class="dialog error" style="margin:auto;">
     [% END %]
     [% IF message.code == 'biblio_not_exists' %]
-      The biblionumber [% message.biblionumber |html %] does not exist in the database.
+      The biblionumber [% message.biblionumber | html %] does not exist in the database.
     [% ELSIF message.code == 'authority_not_exists' %]
-      The authority id [% message.authid |html %] does not exist in the database.
+      The authority id [% message.authid | html %] does not exist in the database.
     [% ELSIF message.code == 'item_issued' %]
-      At least one item is checked out on bibliographic record [% message.biblionumber %].
+      At least one item is checked out on bibliographic record [% message.biblionumber | html %].
     [% ELSIF message.code == 'reserve_not_cancelled' %]
-      Bibliographic record [% message.biblionumber %] was not deleted. A hold could not be canceled (reserve_id [% message.reserve_id %]).
+      Bibliographic record [% message.biblionumber | html %] was not deleted. A hold could not be canceled (reserve_id [% message.reserve_id | html %]).
     [% ELSIF message.code == 'item_not_deleted' %]
-      The bibliographic record [% message.biblionumber %] was not deleted. An error was encountered when deleting an item (itemnumber [% message.itemnumber %]).
+      The bibliographic record [% message.biblionumber | html %] was not deleted. An error was encountered when deleting an item (itemnumber [% message.itemnumber | html %]).
     [% ELSIF message.code == 'biblio_not_deleted' %]
-      Bibliographic record [% message.biblionumber %] was not deleted. An error occurred.
+      Bibliographic record [% message.biblionumber | html %] was not deleted. An error occurred.
     [% ELSIF message.code == 'authority_not_deleted' %]
-      Authority record [% message.authid %] was not deleted. An error occurred.
+      Authority record [% message.authid | html %] was not deleted. An error occurred.
     [% ELSIF message.code == 'biblio_deleted' %]
-      Bibliographic record [% message.biblionumber %] has been deleted successfully.
+      Bibliographic record [% message.biblionumber | html %] has been deleted successfully.
     [% ELSIF message.code == 'authority_deleted' %]
-      Authority [% message.authid %] has been deleted successfully.
+      Authority [% message.authid | html %] has been deleted successfully.
     [% END %]
     [% IF message.error %]
-      (The error was: [% message.error%], see the Koha log file for more information).
+      (The error was: [% message.error | html %], see the Koha log file for more information).
     [% END %]
     </div>
   [% END %]
             <tbody>
               [% FOR biblio IN records %]
                 <tr>
-                  <td><input type="checkbox" name="record_id" id="record_id_[% biblio.biblionumber %]" value="[% biblio.biblionumber %]" data-items="[% biblio.itemnumbers.size %]" data-issues="[% biblio.issues_count %]" data-reserves="[% biblio.holds_count %]" /></td>
-                  <td><label for="record_id_[% biblio.biblionumber %]">[% biblio.biblionumber %]</label></td>
-                  <td>[% INCLUDE 'biblio-default-view.inc' biblionumber=biblio.biblionumber %][% biblio.title %][% IF ( biblio.subtitle ) %][% FOREACH subtitle IN biblio.subtitle %] [% subtitle.subfield |html %][% END %][% END %]</a></td>
-                  <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.itemnumbers.size %]</a></td>
-                  <td><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.holds_count %]</a></td>
-                  <td><a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.issues_count %]</a></td>
+                  <td><input type="checkbox" name="record_id" id="record_id_[% biblio.biblionumber | html %]" value="[% biblio.biblionumber | html %]" data-items="[% biblio.itemnumbers.size | html %]" data-issues="[% biblio.issues_count | html %]" data-reserves="[% biblio.holds_count | html %]" /></td>
+                  <td><label for="record_id_[% biblio.biblionumber | html %]">[% biblio.biblionumber | html %]</label></td>
+                  <td>[% INCLUDE 'biblio-default-view.inc' biblionumber=biblio.biblionumber %][% biblio.title | html %][% IF ( biblio.subtitle ) %][% FOREACH subtitle IN biblio.subtitle %] [% subtitle.subfield | html %][% END %][% END %]</a></td>
+                  <td><a href="/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.itemnumbers.size | html %]</a></td>
+                  <td><a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.holds_count | html %]</a></td>
+                  <td><a href="/cgi-bin/koha/catalogue/issuehistory.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.issues_count | html %]</a></td>
                 </tr>
               [% END %]
             </tbody>
             <tbody>
               [% FOR authority IN records %]
                 <tr>
-                  <td><input type="checkbox" name="record_id" value="[% authority.authid %]" data-usage="[% authority.count_usage %]" /></td>
-                  <td><a href="/cgi-bin/koha/authorities/detail.pl?authid=[% authority.authid %]">[% authority.authid %]</a></td>
+                  <td><input type="checkbox" name="record_id" value="[% authority.authid | html %]" data-usage="[% authority.count_usage | html %]" /></td>
+                  <td><a href="/cgi-bin/koha/authorities/detail.pl?authid=[% authority.authid | html %]">[% authority.authid | html %]</a></td>
                   <td>[% PROCESS authresult summary=authority.summary %]</td>
-                  <td><a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;idx=an,phr&amp;q=[% authority.authid %]">[% authority.count_usage %] record(s)</a></td>
+                  <td><a href="/cgi-bin/koha/catalogue/search.pl?type=intranet&amp;op=do_search&amp;idx=an,phr&amp;q=[% authority.authid | html %]">[% authority.count_usage | html %] record(s)</a></td>
                 </tr>
               [% END %]
             </tbody>
       [% END %]
         <fieldset class="action">
           <input type="hidden" name="op" value="delete" />
-          <input type="hidden" name="recordtype" value="[% recordtype %]" />
+          <input type="hidden" name="recordtype" value="[% recordtype | html %]" />
           <input type="submit" value="Delete selected records" class="button" />
           <a class="cancel" href="/cgi-bin/koha/tools/batch_delete_records.pl">Cancel</a>
         </fieldset>
     [% ELSIF report.total_success == 0 %]
       No record has been deleted. An error occurred.
     [% ELSE %]
-      [% report.total_success %] / [% report.total_records %] records have been deleted successfully but some errors occurred.
+      [% report.total_success | html %] / [% report.total_records | html %] records have been deleted successfully but some errors occurred.
     [% END %]
     <p><a href="/cgi-bin/koha/tools/batch_delete_records.pl" title="New batch record deletion">New batch record deletion</a></p>
   [% ELSE %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         var MSG_CANNOT_BE_DELETED = _("This record cannot be deleted, at least one item is currently checked out.");
         $(document).ready(function() {
index bb0962d..fb03555 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% PROCESS 'authorities-search-results.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Batch record modification</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_batch_record_modification" class="tools">
                     <div><i class="fa fa-exclamation error"></i>
                 [% END %]
                 [% IF message.code == 'no_action_defined_for_the_template' %]
-                    The selected template (id=[% message.mmtid%]) does not exist or no action is defined.
+                    The selected template (id=[% message.mmtid | html %]) does not exist or no action is defined.
                 [% ELSIF message.code == 'biblio_not_exists' %]
-                    Bibliographic record [% message.biblionumber %] does not exist in the database.
+                    Bibliographic record [% message.biblionumber | html %] does not exist in the database.
                 [% ELSIF message.code == 'authority_not_exists' %]
-                    Authority record [% message.authid %] does not exist in the database.
+                    Authority record [% message.authid | html %] does not exist in the database.
                 [% ELSIF message.code == 'biblio_not_modified' %]
-                    Bibliographic record <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber %]">[% message.biblionumber %]</a> has not been modified. An error occurred on modifying it.
+                    Bibliographic record <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber | html %]">[% message.biblionumber | html %]</a> has not been modified. An error occurred on modifying it.
                 [% ELSIF message.code == 'authority_not_modified' %]
-                    Authority record <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% message.authid %]">[% message.authid %]</a> has not been modified. An error occurred on modifying it.
+                    Authority record <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% message.authid | html %]">[% message.authid | html %]</a> has not been modified. An error occurred on modifying it.
                 [% ELSIF message.code == 'biblio_modified' %]
-                    Bibliographic record <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber %]">[% message.biblionumber %]</a> has successfully been modified.
+                    Bibliographic record <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% message.biblionumber | html %]">[% message.biblionumber | html %]</a> has successfully been modified.
                 [% ELSIF message.code == 'authority_modified' %]
-                    Bibliographic record <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% message.authid %]">[% message.authid %]</a> has successfully been modified.
+                    Bibliographic record <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% message.authid | html %]">[% message.authid | html %]</a> has successfully been modified.
                 [% END %]
                 [% IF message.error %]
-                    (The error was: [% message.error%]. See the Koha logfile for more information).
+                    (The error was: [% message.error | html %]. See the Koha logfile for more information).
                 [% END %]
                 </div>
             [% END %]
@@ -90,7 +91,7 @@
             <select name="marc_modification_template_id" id="marc_modification_template_id" required="required">
               <option value="">Select a template</option>
                 [% FOREACH mmt IN MarcModificationTemplatesLoop %]
-                  <option value="[% mmt.template_id %]">[% mmt.name %]</option>
+                  <option value="[% mmt.template_id | html %]">[% mmt.name | html %]</option>
                 [% END %]
             </select>
           </li>
           <option value="">Select a template</option>
           [% FOREACH mmt IN MarcModificationTemplatesLoop %]
             [% IF mmt.selected %]
-              <option value="[% mmt.template_id %]" selected="selected">[% mmt.name %]</option>
+              <option value="[% mmt.template_id | html %]" selected="selected">[% mmt.name | html %]</option>
             [% ELSE %]
-              <option value="[% mmt.template_id %]">[% mmt.name %]</option>
+              <option value="[% mmt.template_id | html %]">[% mmt.name | html %]</option>
             [% END %]
           [% END %]
         </select>
                         <h3 id="marcPreviewLabel">MARC preview</h3>
                     </div>
                     <div class="modal-body">
-                        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+                        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
                     </div>
                     <div class="modal-footer">
                         <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
             <tbody>
               [% FOR biblio IN records %]
                 <tr>
-                  <td><input type="checkbox" name="record_id" value="[% biblio.biblionumber %]" /></td>
-                  <td>[% biblio.biblionumber %]</td>
-                  <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber %]">[% biblio.title %]</a></td>
+                  <td><input type="checkbox" name="record_id" value="[% biblio.biblionumber | html %]" /></td>
+                  <td>[% biblio.biblionumber | html %]</td>
+                  <td><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblio.biblionumber | html %]">[% biblio.title | html %]</a></td>
                   <td class="actions">
-                    <a href="/cgi-bin/koha/svc/records/preview?record_type=biblio&record_id=[% biblio.biblionumber %]&mmtid=[% mmtid %]" class="previewMARC btn btn-default btn-xs" data-record_type="biblio" data-record_id="[% biblio.biblionumber %]" data-mmtid="[% mmtid %]" title="Preview MARC"><i class="fa fa-eye"></i> Show MARC</a>
+                    <a href="/cgi-bin/koha/svc/records/preview?record_type=biblio&record_id=[% biblio.biblionumber | html %]&mmtid=[% mmtid | html %]" class="previewMARC btn btn-default btn-xs" data-record_type="biblio" data-record_id="[% biblio.biblionumber | html %]" data-mmtid="[% mmtid | html %]" title="Preview MARC"><i class="fa fa-eye"></i> Show MARC</a>
                   </td>
                 </tr>
               [% END %]
             <tbody>
               [% FOR authority IN records %]
                 <tr>
-                  <td><input type="checkbox" name="record_id" value="[% authority.authid %]" data-usage="[% authority.count_usage %]" /></td>
-                  <td><a href="/cgi-bin/koha/authorities/detail.pl?authid=[% authority.authid %]">[% authority.authid %]</a></td>
+                  <td><input type="checkbox" name="record_id" value="[% authority.authid | html %]" data-usage="[% authority.count_usage | html %]" /></td>
+                  <td><a href="/cgi-bin/koha/authorities/detail.pl?authid=[% authority.authid | html %]">[% authority.authid | html %]</a></td>
                   <td>[% PROCESS authresult summary=authority.summary %]</td>
-                  <td class="actions"><a href="/cgi-bin/koha/svc/records/preview?record_type=authority&record_id=[% authority.authid %]&mmtid=[% mmtid %]" data-record_type="authority" data-record_id="[% authority.authid %]" data-mmtid="[% mmtid %]" class="previewMARC btn btn-default btn-xs"><i class='fa fa-eye'></i> Show MARC</a>
+                  <td class="actions"><a href="/cgi-bin/koha/svc/records/preview?record_type=authority&record_id=[% authority.authid | html %]&mmtid=[% mmtid | html %]" data-record_type="authority" data-record_id="[% authority.authid | html %]" data-mmtid="[% mmtid | html %]" class="previewMARC btn btn-default btn-xs"><i class='fa fa-eye'></i> Show MARC</a>
                 </tr>
               [% END %]
             </tbody>
         [% END %]
         <fieldset class="action">
           <input type="hidden" name="op" value="modify" />
-          <input type="hidden" name="recordtype" value="[% recordtype %]" />
+          <input type="hidden" name="recordtype" value="[% recordtype | html %]" />
           <input type="button" id="mainformsubmit" value="Modify selected records" class="button" />
           <input type="hidden" name="runinbackground" id="runinbackground" value="" />
           <input type="hidden" name="completedJobID" id="completedJobID" value="" />
         </div>
     [% ELSE %]
         <div class="dialog message">
-            [% report.total_success %] / [% report.total_records %] records have successfully been modified. Some errors occurred. <a href="/cgi-bin/koha/tools/batch_record_modification.pl" title="New batch record modification">New batch record modification</a>
+            [% report.total_success | html %] / [% report.total_records | html %] records have successfully been modified. Some errors occurred. <a href="/cgi-bin/koha/tools/batch_record_modification.pl" title="New batch record modification">New batch record modification</a>
         </div>
     [% END %]
   [% ELSIF view == 'errors' %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-    [% Asset.js("js/background-job-progressbar.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+    [% Asset.js("js/background-job-progressbar.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
           $("#selectall").click(function(e){
             });
             $("#marcPreview").on("hidden", function(){
                 $("#marcPreviewLabel").html("");
-                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
 
         });
index 271a78d..0170430 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -36,9 +37,9 @@
             <option value="*">All libraries</option>
         [% FOREACH branch IN Branches.all( selected => current_branch ) %]
           [% IF branch.selected %]
-            <option value="[% branch.branchcode %]" selected="selected">[% branch.branchname %]</option>
+            <option value="[% branch.branchcode | html %]" selected="selected">[% branch.branchname | html %]</option>
           [% ELSE %]
-            <option value="[% branch.branchcode %]">[% branch.branchname %]</option>
+            <option value="[% branch.branchcode | html %]">[% branch.branchname | html %]</option>
           [% END %]
         [% END %]
         </select>
   [% IF current_branch == '*' %]
     <h1>Batch patron deletion/anonymization</h1>
   [% ELSE %]
-    <h1>Batch patron deletion/anonymization for [% Branches.GetName( current_branch ) %]</h1>
+    <h1>Batch patron deletion/anonymization for [% Branches.GetName( current_branch ) | html %]</h1>
   [% END %]
 [% ELSE %]
-    <h1>Batch patron deletion/anonymization for [% Branches.GetName( Branches.GetLoggedInBranchcode ) %]</h1>
+    <h1>Batch patron deletion/anonymization for [% Branches.GetName( Branches.GetLoggedInBranchcode ) | html %]</h1>
 [% END %]
 
 [% IF step == 1 %]
@@ -89,7 +90,7 @@
                         <option value="" selected="selected">Any</option>
                         [% FOREACH bc IN borrower_categorycodes %]
                             [% UNLESS bc.category_type == 'S' %]
-                                <option value="[% bc.categorycode %]">[% bc.description %]</option>
+                                <option value="[% bc.categorycode | html %]">[% bc.description | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
                     <select id="patron_list_id" name="patron_list_id">
                         <option value=""></option>
                         [% FOREACH pl IN patron_lists %]
-                            <option value="[% pl.patron_list_id %]">[% pl.name %]</option>
+                            <option value="[% pl.patron_list_id | html %]">[% pl.name | html %]</option>
                         [% END %]
                     </select>
                 </li>
 
             <!-- hidden here -->
             <input type="hidden" name="step" value="2" />
-            <input type="hidden" name="branch" value="[% current_branch %]" />
+            <input type="hidden" name="branch" value="[% current_branch | html %]" />
             </fieldset>
             <fieldset class="action"><input type="submit" value="Next &gt;&gt;" /></fieldset>
     </form>
     <fieldset>
         <legend>Warnings</legend>
         <ul>
-            <li>[% patrons_to_delete.size || 0 %] patrons will be deleted</li>
-            <li>[% patrons_to_anonymize.count || 0 %] patron's checkout histories will be anonymized</li>
+            <li>[% patrons_to_delete.size || 0 | html %] patrons will be deleted</li>
+            <li>[% patrons_to_anonymize.count || 0 | html %] patron's checkout histories will be anonymized</li>
         </ul>
 
         <br />
 
                 <br /><input id="testrun" type="radio" name="radio" value="testrun" checked="checked" />
                 <label for="testrun">Do not remove any patrons (test run)</label>
-                <input type="hidden" name="do_delete" value="[% patrons_to_delete.size %]" /></fieldset>
+                <input type="hidden" name="do_delete" value="[% patrons_to_delete.size | html %]" /></fieldset>
 
             [% END %]
             [% IF patrons_to_anonymize.count %]
-                Checkout history for [% patrons_to_anonymize.count %] patrons will be anonymized
-                <input type="hidden" name="do_anonym" value="[% patrons_to_anonymize.count %]" />
+                Checkout history for [% patrons_to_anonymize.count | html %] patrons will be anonymized
+                <input type="hidden" name="do_anonym" value="[% patrons_to_anonymize.count | html %]" />
             [% END %]
 
             <input type="hidden" name="step" value="3" />
             [% IF Koha.Preference('TrackLastPatronActivity') %]
                 <input type="hidden" name="borrower_lastseen" value="[% borrower_lastseen | $KohaDates %]" />
             [% END %]
-            <input type="hidden" name="borrower_categorycode" value="[% borrower_categorycode %]" />
-            <input type="hidden" name="patron_list_id" value="[% patron_list_id %]" />
-            <input type="hidden" name="branch" value="[% current_branch %]" />
+            <input type="hidden" name="borrower_categorycode" value="[% borrower_categorycode | html %]" />
+            <input type="hidden" name="patron_list_id" value="[% patron_list_id | html %]" />
+            <input type="hidden" name="branch" value="[% current_branch | html %]" />
     </fieldset>
     <fieldset class="action"><input type="submit" value="Finish" /> <a class="cancel" href="/cgi-bin/koha/tools/cleanborrowers.pl">Cancel</a></fieldset>
         </form>
 
     <div id="step3">
         [% IF ( testrun ) %]
-            <h4>[% TotalDel %] patrons would have been removed (if it wasn't a test run)</h4>
+            <h4>[% TotalDel | html %] patrons would have been removed (if it wasn't a test run)</h4>
             <h4>No patron records have been actually removed</h4>
         [% ELSE %]
             [% IF ( do_delete ) %]
                 [% IF ( trash ) %]
-                    <h4>[% TotalDel %] patrons have been successfully moved to trash</h4>
+                    <h4>[% TotalDel | html %] patrons have been successfully moved to trash</h4>
                 [% ELSE %]
-                    <h4>[% TotalDel %] patrons have been successfully deleted</h4>
+                    <h4>[% TotalDel | html %] patrons have been successfully deleted</h4>
                 [% END %]
             [% ELSE %]
                 <h4>No patron records have been removed</h4>
             [% END %]
         [% END %]
         [% IF do_anonym %]
-            <h4>All checkouts ([% do_anonym %]) older than [% last_issue_date | $KohaDates %] have been anonymized</h4>
+            <h4>All checkouts ([% do_anonym | html %]) older than [% last_issue_date | $KohaDates %] have been anonymized</h4>
         [% ELSE %]
             <h4>No patron records have been anonymized</h4>
         [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
index 9856dec..f10083a 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -21,7 +22,7 @@
     <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             An error occurred when updating this CSV profile. Perhaps it already exists.
@@ -38,7 +39,7 @@
         [% CASE 'already_exists' %]
             This CSV profile already exists.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
 
     <form action="/cgi-bin/koha/tools/csv-profiles.pl" class="validated" method="post">
         <input type="hidden" name="op" value="add_validate" />
-        <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" />
+        <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
         <fieldset class="rows">
             <ol>
                 [% IF csv_profile %]
-                    <li><span class="label">Profile ID: </span>[% csv_profile.export_format_id %]</li>
+                    <li><span class="label">Profile ID: </span>[% csv_profile.export_format_id | html %]</li>
                 [% END %]
                 <li>
                     <label for="profile" class="required">Profile name: </label>
                     <select id="type" name="type">
                         [% FOREACH type IN [ 'marc' 'sql'] %]
                         [% IF csv_profile.type == type %]
-                            <option value="[% type %]" selected="selected">[% PROCESS type_description type_code = type %]</option>
+                            <option value="[% type | html %]" selected="selected">[% PROCESS type_description type_code = type %]</option>
                         [% ELSE %]
-                            <option value="[% type %]">[% PROCESS type_description type_code = type %]</option>
+                            <option value="[% type | html %]">[% PROCESS type_description type_code = type %]</option>
                         [% END %]
                         [% END %]
                     </select>
                     <select id="used_for_sql" name="used_for_sql">
                         [% FOREACH used_for IN [ 'late_issues' 'export_basket' 'export_lost_items' ] %]
                         [% IF csv_profile.used_for == used_for %]
-                            <option value="[% used_for %]" selected="selected">[% PROCESS used_for_description used_for_code = used_for %]</option>
+                            <option value="[% used_for | html %]" selected="selected">[% PROCESS used_for_description used_for_code = used_for %]</option>
                         [% ELSE %]
-                            <option value="[% used_for %]">[% PROCESS used_for_description used_for_code = used_for %]</option>
+                            <option value="[% used_for | html %]">[% PROCESS used_for_description used_for_code = used_for %]</option>
                         [% END %]
                         [% END %]
                     </select>
                     <select id="used_for_marc" name="used_for_marc">
                         [% FOREACH used_for IN [ 'export_records' ] %]
                         [% IF csv_profile.used_for == used_for %]
-                            <option value="[% used_for %]" selected="selected">[% PROCESS used_for_description used_for_code = used_for %]</option>
+                            <option value="[% used_for | html %]" selected="selected">[% PROCESS used_for_description used_for_code = used_for %]</option>
                         [% ELSE %]
-                            <option value="[% used_for %]">[% PROCESS used_for_description used_for_code = used_for %]</option>
+                            <option value="[% used_for | html %]">[% PROCESS used_for_description used_for_code = used_for %]</option>
                         [% END %]
                         [% END %]
                     </select>
                     <select name="encoding" id="encoding">
                         [% FOREACH encoding IN encodings %]
                             [% IF csv_profile.encoding == encoding OR NOT csv_profile AND encoding == 'utf8' %]
-                                <option selected="selected">[% encoding %]</option>
+                                <option selected="selected">[% encoding | html %]</option>
                             [% ELSE %]
-                                <option>[% encoding %]</option>
+                                <option>[% encoding | html %]</option>
                             [% END %]
                         [% END %]
                     </select>
 
                 <li class="marc_specific">
                     <label for="marc_content" class="required">Profile MARC fields: </label>
-                    <textarea cols="50" rows="2" name="marc_content" id="marc_content">[% csv_profile.content %]</textarea>
+                    <textarea cols="50" rows="2" name="marc_content" id="marc_content">[% csv_profile.content | html %]</textarea>
                     <span class="required">Required</span>
                     <p>You have to define which fields or subfields you want to export, separated by pipes.</p>
                     <p>You can also use your own headers (instead of the ones from Koha) by prefixing the field number with an header, followed by the equal sign.</p>
 
                 <li class="sql_specific">
                     <label for="late_issues_content" class="required">Profile SQL fields: </label>
-                    <textarea cols="50" rows="2" name="sql_content" id="sql_content">[% csv_profile.content %]</textarea>
+                    <textarea cols="50" rows="2" name="sql_content" id="sql_content">[% csv_profile.content | html %]</textarea>
                     <p>You have to define which fields you want to export, separated by pipes.</p>
                     <p>You can also use your own headers (instead of the ones from Koha) by prefixing the field name with an header, followed by the equal sign.</p>
                     <p>Example: Name=subscription.name|Title=subscription.title|Issue number=serial.serialseq</p>
             <h3>Delete CSV Profile "[% csv_profile.profile | html %]?"</h3>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="post">
                 <input type="hidden" name="op" value="delete_confirmed" />
-                <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id %]" />
+                <input type="hidden" name="export_format_id" value="[% csv_profile.export_format_id | html %]" />
                 <input type="submit" class="approve" value="Yes, delete" />
             </form>
             <form action="/cgi-bin/koha/tools/csv-profiles.pl" method="get">
             <tbody>
                 [% FOREACH csv_profile IN csv_profiles %]
                 <tr>
-                    <td>[% csv_profile.export_format_id %]</td>
-                    <td>[% csv_profile.profile |html %]</td>
-                    <td>[% csv_profile.description |html %]</td>
-                    <td>[% csv_profile.content |html %]</td>
-                    <td>[% csv_profile.csv_separator %]</td>
+                    <td>[% csv_profile.export_format_id | html %]</td>
+                    <td>[% csv_profile.profile | html %]</td>
+                    <td>[% csv_profile.description | html %]</td>
+                    <td>[% csv_profile.content | html %]</td>
+                    <td>[% csv_profile.csv_separator | html %]</td>
                     <td>[% PROCESS type_description type_code = csv_profile.type %]</td>
                     <td>[% PROCESS used_for_description used_for_code = csv_profile.used_for %]</td>
                     <td class="actions">
-                        <a href="/cgi-bin/koha/tools/csv-profiles.pl?op=add_form&amp;export_format_id=[% csv_profile.export_format_id %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                        <a href="/cgi-bin/koha/tools/csv-profiles.pl?op=delete_confirm&amp;export_format_id=[% csv_profile.export_format_id %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
+                        <a href="/cgi-bin/koha/tools/csv-profiles.pl?op=add_form&amp;export_format_id=[% csv_profile.export_format_id | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+                        <a href="/cgi-bin/koha/tools/csv-profiles.pl?op=delete_confirm&amp;export_format_id=[% csv_profile.export_format_id | html %]" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
                     </td>
                 </tr>
                 [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         function reloadPage(p) {
             var id = p.value;
index 6d09067..1a7df26 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
        <div class="yui-b">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'invalid_mimetype' %]The file used does not have a valid format. Only csv and txt are allowed.
-        [% CASE %][% m.code %]
+        [% CASE %][% m.code | html %]
         [% END %]
     </div>
 [% END %]
@@ -66,7 +67,7 @@
             <select name="itemtype" id="itemtype">
                 <option value="">-- All --</option>
                 [% FOREACH itemtype IN itemtypes %]
-                    <option value="[% itemtype.itemtype %]">[% itemtype.translated_description %]</option>
+                    <option value="[% itemtype.itemtype | html %]">[% itemtype.translated_description | html %]</option>
                 [% END %]
             </select>
         </li>
         <ol>
             <li>
                     <label for="from">Start date:</label>
-                    <input type="text" size="10" id="from" name="start_accession" value="[% from %]" class="datepickerfrom" />
+                    <input type="text" size="10" id="from" name="start_accession" value="[% from | html %]" class="datepickerfrom" />
             </li>
             <li>
                 <label for="to">End date:</label>
-                <input size="10" id="to" name="end_accession" value="[% end_accession %]" type="text" class="datepickerto" />
+                <input size="10" id="to" name="end_accession" value="[% end_accession | html %]" type="text" class="datepickerto" />
             </li>
         </ol>
     </fieldset>
         </li>
         <li>
         <label for="export_remove_fields">Don't export fields:</label>
-        <input id="export_remove_fields" type="text" name="export_remove_fields" value="[% export_remove_fields %]" />
+        <input id="export_remove_fields" type="text" name="export_remove_fields" value="[% export_remove_fields | html %]" />
         separate by a blank. (e.g., 100a 200 606)
         </li></ol>
     </fieldset>
             <label for="bibs_csv_profile">CSV profile: </label>
             <select id="bibs_csv_profile" name="csv_profile_id">
                 [% FOR csv_profile IN csv_profiles %]
-                    <option value="[% csv_profile.export_format_id %]">[% csv_profile.profile %]</option>
+                    <option value="[% csv_profile.export_format_id | html %]">[% csv_profile.profile | html %]</option>
                 [% END %]
             </select>
         </li>
             <select name="authtype" id="authtype">
                 <option value="">-- All --</option>
                 [% FOREACH authority_type IN authority_types %]
-                    <option value="[% authority_type.authtypecode %]">[% authority_type.authtypetext %]</option>
+                    <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
                 [% END %]
             </select>
         </li>
     [% IF ( dbfiles && (dbfiles.size > 0) ) %]
         <ul>
         [% FOREACH dbfile IN dbfiles %]
-            <li><input type="radio" name="filename" value="[% dbfile %]">[% dbfile %]</input></li>
+            <li><input type="radio" name="filename" value="[% dbfile | html %]">[% dbfile | html %]</input></li>
         [% END %]
         </ul>
     [% ELSE %]
     [% IF ( conffiles && (conffiles.size > 0) ) %]
         <ul>
         [% FOREACH conffile IN conffiles %]
-            <li><input type="radio" name="filename" value="[% conffile %]">[% conffile %]</input></li>
+            <li><input type="radio" name="filename" value="[% conffile | html %]">[% conffile | html %]</input></li>
         [% END %]
         </ul>
     [% ELSE %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
         $(document).ready(function() {
index 5d65cef..651634f 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Branches %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>Koha &rsaquo; Tools &rsaquo; [% Branches.GetName( branch ) %] calendar</title>
+<title>Koha &rsaquo; Tools &rsaquo; [% Branches.GetName( branch ) | html %] calendar</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css"> .key { padding : 3px; white-space:nowrap; line-height:230%; }
 .ui-datepicker { font-size : 150%; }
 .ui-datepicker th, .ui-datepicker .ui-datepicker-title select { font-size : 80%; }
@@ -29,14 +30,14 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 [% INCLUDE 'header.inc' %]
 [% INCLUDE 'cat-search.inc' %]
 
-<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; [% Branches.GetName( branch ) %] calendar</div>
+<div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; [% Branches.GetName( branch ) | html %] calendar</div>
 
 <div id="doc3" class="yui-t1">
    
    <div id="bd">
     <div id="yui-main">
     <div class="yui-b">
-    <h2>[% Branches.GetName( branch ) %] calendar</h2>
+    <h2>[% Branches.GetName( branch ) | html %] calendar</h2>
     <div class="yui-g">
     <div class="yui-u first">
         <label for="branch">Define the holidays for:</label>
@@ -74,7 +75,7 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
             </li>
             <li class="dateinsert">
                 <b>To Date : </b>
-                <input type="text" id="datecancelrange" name="datecancelrange" size="20" value="[% datecancelrange %]" class="datepicker"/>
+                <input type="text" id="datecancelrange" name="datecancelrange" size="20" value="[% datecancelrange | html %]" class="datepicker"/>
             </li>
             <li><label for="showTitle">Title: </label><input type="text" name="showTitle" id="showTitle" size="35" /></li>
             <!-- showTitle is necessary for exception radio button to work properly -->
@@ -144,7 +145,7 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
             </li>
             <li class="dateinsert">
                 <b>To date: </b>
-                <input type="text" id="dateofrange" name="dateofrange" size="20" value="[% dateofrange %]" class="datepicker" />
+                <input type="text" id="dateofrange" name="dateofrange" size="20" value="[% dateofrange | html %]" class="datepicker" />
             </li>
             <li><label for="title">Title: </label><input type="text" name="newTitle" id="title" size="35" /></li>
             <li><label for="newDescription">Description:</label>
@@ -201,12 +202,12 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 
 <div style="margin-top: 2em;">
 <form action="copy-holidays.pl" method="post">
-    <input type="hidden" name="from_branchcode" value="[% branch %]" />
+    <input type="hidden" name="from_branchcode" value="[% branch | html %]" />
   <label for="branchcode">Copy holidays to:</label>
   <select id="branchcode" name="branchcode">
     <option value=""></option>
     [% FOREACH l IN Branches.all() %]
-    <option value="[% l.branchcode %]">[% l.branchname %]</option>
+    <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
     [% END %]
   </select>
     <input type="submit" value="Copy" />
@@ -248,9 +249,9 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 <tbody>
   [% FOREACH EXCEPTION_HOLIDAYS_LOO IN EXCEPTION_HOLIDAYS_LOOP %]
   <tr>
-  <td><a href="/cgi-bin/koha/tools/holidays.pl?branch=[% branch %]&amp;calendardate=[% EXCEPTION_HOLIDAYS_LOO.DATE %]"><span title="[% EXCEPTION_HOLIDAYS_LOO.DATE_SORT %]">[% EXCEPTION_HOLIDAYS_LOO.DATE %]</span></a></td>
-  <td>[% EXCEPTION_HOLIDAYS_LOO.TITLE |html %]</td>
-  <td>[% EXCEPTION_HOLIDAYS_LOO.DESCRIPTION |html %]</td>
+  <td><a href="/cgi-bin/koha/tools/holidays.pl?branch=[% branch | html %]&amp;calendardate=[% EXCEPTION_HOLIDAYS_LOO.DATE | html %]"><span title="[% EXCEPTION_HOLIDAYS_LOO.DATE_SORT | html %]">[% EXCEPTION_HOLIDAYS_LOO.DATE | html %]</span></a></td>
+  <td>[% EXCEPTION_HOLIDAYS_LOO.TITLE | html %]</td>
+  <td>[% EXCEPTION_HOLIDAYS_LOO.DESCRIPTION | html %]</td>
   </tr>
   [% END %] 
 </tbody>
@@ -270,10 +271,10 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 <tbody>
   [% FOREACH WEEK_DAYS_LOO IN WEEK_DAYS_LOOP %]
   <tr>
-  <td>[% WEEK_DAYS_LOO.KEY %]</td>
+  <td>[% WEEK_DAYS_LOO.KEY | html %]</td>
   </td> 
-  <td>[% WEEK_DAYS_LOO.TITLE |html %]</td>
-  <td>[% WEEK_DAYS_LOO.DESCRIPTION |html %]</td>
+  <td>[% WEEK_DAYS_LOO.TITLE | html %]</td>
+  <td>[% WEEK_DAYS_LOO.DESCRIPTION | html %]</td>
   </tr>
   [% END %] 
 </tbody>
@@ -297,9 +298,9 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 <tbody>
   [% FOREACH DAY_MONTH_HOLIDAYS_LOO IN DAY_MONTH_HOLIDAYS_LOOP %]
   <tr>
-  <td><span title="[% DAY_MONTH_HOLIDAYS_LOO.DATE_SORT %]">[% DAY_MONTH_HOLIDAYS_LOO.DATE %]</span></td>
-  <td>[% DAY_MONTH_HOLIDAYS_LOO.TITLE |html %]</td>
-  <td>[% DAY_MONTH_HOLIDAYS_LOO.DESCRIPTION |html %]</td>
+  <td><span title="[% DAY_MONTH_HOLIDAYS_LOO.DATE_SORT | html %]">[% DAY_MONTH_HOLIDAYS_LOO.DATE | html %]</span></td>
+  <td>[% DAY_MONTH_HOLIDAYS_LOO.TITLE | html %]</td>
+  <td>[% DAY_MONTH_HOLIDAYS_LOO.DESCRIPTION | html %]</td>
   </tr>
   [% END %] 
 </tbody>
@@ -319,9 +320,9 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 <tbody>
     [% FOREACH HOLIDAYS_LOO IN HOLIDAYS_LOOP %]
 <tr>
-  <td><a href="/cgi-bin/koha/tools/holidays.pl?branch=[% branch %]&amp;calendardate=[% HOLIDAYS_LOO.DATE %]"><span title="[% HOLIDAYS_LOO.DATE_SORT %]">[% HOLIDAYS_LOO.DATE %]</span></a></td>
-  <td>[% HOLIDAYS_LOO.TITLE |html %]</td>
-  <td>[% HOLIDAYS_LOO.DESCRIPTION.replace('\\\r\\\n', '<br />') |html %]</td>
+  <td><a href="/cgi-bin/koha/tools/holidays.pl?branch=[% branch | html %]&amp;calendardate=[% HOLIDAYS_LOO.DATE | html %]"><span title="[% HOLIDAYS_LOO.DATE_SORT | html %]">[% HOLIDAYS_LOO.DATE | html %]</span></a></td>
+  <td>[% HOLIDAYS_LOO.TITLE | html %]</td>
+  <td>[% HOLIDAYS_LOO.DESCRIPTION.replace('\\\r\\\n', '<br />') | html %]</td>
 </tr>
   [% END %] 
 </tbody>
@@ -341,7 +342,7 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         var weekdays = new Array(_("Sundays"),_("Mondays"),_("Tuesdays"),_("Wednesdays"),_("Thursdays"),_("Fridays"),_("Saturdays"));
 
@@ -351,19 +352,19 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
         var holidates = new Array();
         var exception_holidays = new Array();
         var day_month_holidays = new Array();
-        var hola= "[% code %]";
+        var hola= "[% code | html %]";
         [% FOREACH WEEK_DAYS_LOO IN WEEK_DAYS_LOOP %]
-        week_days["[% WEEK_DAYS_LOO.KEY %]"] = {title:"[% WEEK_DAYS_LOO.TITLE | replace('"','\"') |html %]", description:"[% WEEK_DAYS_LOO.DESCRIPTION | replace('"','\"') |html %]"};
+        week_days["[% WEEK_DAYS_LOO.KEY | html %]"] = {title:"[% WEEK_DAYS_LOO.TITLE | replace('"','\"') | html %]", description:"[% WEEK_DAYS_LOO.DESCRIPTION | replace('"','\"') | html %]"};
         [% END %]
         [% FOREACH HOLIDAYS_LOO IN HOLIDAYS_LOOP %]
-        holidates.push("[% HOLIDAYS_LOO.KEY %]");
-        holidays["[% HOLIDAYS_LOO.KEY %]"] = {title:"[% HOLIDAYS_LOO.TITLE | replace('"','\"') |html %]", description:"[% HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') |html %]"};
+        holidates.push("[% HOLIDAYS_LOO.KEY | html %]");
+        holidays["[% HOLIDAYS_LOO.KEY | html %]"] = {title:"[% HOLIDAYS_LOO.TITLE | replace('"','\"') | html %]", description:"[% HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') | html %]"};
         [% END %]
         [% FOREACH EXCEPTION_HOLIDAYS_LOO IN EXCEPTION_HOLIDAYS_LOOP %]
-        exception_holidays["[% EXCEPTION_HOLIDAYS_LOO.KEY %]"] = {title:"[% EXCEPTION_HOLIDAYS_LOO.TITLE | replace('"','\"') |html %]", description:"[% EXCEPTION_HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') |html %]"};
+        exception_holidays["[% EXCEPTION_HOLIDAYS_LOO.KEY | html %]"] = {title:"[% EXCEPTION_HOLIDAYS_LOO.TITLE | replace('"','\"') | html %]", description:"[% EXCEPTION_HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') | html %]"};
         [% END %]
         [% FOREACH DAY_MONTH_HOLIDAYS_LOO IN DAY_MONTH_HOLIDAYS_LOOP %]
-        day_month_holidays["[% DAY_MONTH_HOLIDAYS_LOO.KEY %]"] = {title:"[% DAY_MONTH_HOLIDAYS_LOO.TITLE | replace('"','\"') |html %]", description:"[% DAY_MONTH_HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') |html %]"};
+        day_month_holidays["[% DAY_MONTH_HOLIDAYS_LOO.KEY | html %]"] = {title:"[% DAY_MONTH_HOLIDAYS_LOO.TITLE | replace('"','\"') | html %]", description:"[% DAY_MONTH_HOLIDAYS_LOO.DESCRIPTION | replace('"','\"') | html %]"};
         [% END %]
 
         function holidayOperation(formObject, opType) {
@@ -435,7 +436,7 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
 
         function changeBranch () {
             var branch = $("#branch option:selected").val();
-            location.href='/cgi-bin/koha/tools/holidays.pl?branch=' + branch + '&calendardate=' + "[% calendardate %]";
+            location.href='/cgi-bin/koha/tools/holidays.pl?branch=' + branch + '&calendardate=' + "[% calendardate | html %]";
         }
 
         function Help() {
@@ -526,7 +527,7 @@ td.repeatableyearly a.ui-state-default {  background:  #FFCC66 none; color :  Bl
             onSelect: function(dateText, inst) {
                 dateChanged($(this).datepicker("getDate"));
             },
-            defaultDate: new Date("[% keydate %]")
+            defaultDate: new Date("[% keydate | html %]")
             });
             $(".hidePanel").on("click",function(){
                 if( $(this).hasClass("showHoliday") ){
index 119b01b..4e0a4b0 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% IF ( uploadborrowers ) %]
     <h5>Import results :</h5>
     <ul>
-        <li>[% imported %] imported records [% IF ( lastimported ) %](last was [% lastimported %])[% END %]</li>
+        <li>[% imported | html %] imported records [% IF ( lastimported ) %](last was [% lastimported | html %])[% END %]</li>
         [% IF imported and patronlistname %]
-            <li>Patronlist with imported patrons: [% patronlistname %]</li>
+            <li>Patronlist with imported patrons: [% patronlistname | html %]</li>
         [% END %]
-        <li>[% overwritten %] overwritten [% IF ( lastoverwritten ) %](last was [% lastoverwritten %])[% END %]</li>
-        <li>[% alreadyindb %] not imported because already in borrowers table and overwrite disabled [% IF ( lastalreadyindb ) %](last was [% lastalreadyindb %])[% END %]</li>
-        <li>[% invalid %] not imported because they are not in the expected format [% IF ( lastinvalid ) %](last was [% lastinvalid %])[% END %]</li>
-        <li>[% total %] records parsed</li>
+        <li>[% overwritten | html %] overwritten [% IF ( lastoverwritten ) %](last was [% lastoverwritten | html %])[% END %]</li>
+        <li>[% alreadyindb | html %] not imported because already in borrowers table and overwrite disabled [% IF ( lastalreadyindb ) %](last was [% lastalreadyindb | html %])[% END %]</li>
+        <li>[% invalid | html %] not imported because they are not in the expected format [% IF ( lastinvalid ) %](last was [% lastinvalid | html %])[% END %]</li>
+        <li>[% total | html %] records parsed</li>
         <li><a href="/cgi-bin/koha/tools/tools-home.pl">Back to Tools</a></li>
     </ul>
 
                     [% FOREACH f IN feedback %]
                         <li>
                             [% IF ( f.filename ) %]
-                                Parsing upload file <span class="filename">[% f.filename %]</span>
+                                Parsing upload file <span class="filename">[% f.filename | html %]</span>
                             [% ELSIF ( f.backend ) %]
-                                Upload parsed using [% f.backend %]
+                                Upload parsed using [% f.backend | html %]
                             [% ELSIF ( f.headerrow ) %]
-                                These fields found: [% f.value %]
+                                These fields found: [% f.value | html %]
                             [% ELSIF ( f.already_in_db ) %]
-                                Patron already in database: [% f.value %]
+                                Patron already in database: [% f.value | html %]
                             [% ELSE %]
-                                [% f.name %] : [% f.value %]
+                                [% f.name | html %] : [% f.value | html %]
                             [% END %]
                         </li>
                     [% END %]
 
                     [% FOREACH missing_critical IN e.missing_criticals %]
                         <li class="line_error">
-                            Line <span class="linenumber">[% missing_critical.line %]</span>
+                            Line <span class="linenumber">[% missing_critical.line | html %]</span>
 
                             [% IF ( missing_critical.badparse ) %]
                                 could not be parsed!
                             [% ELSIF ( missing_critical.bad_date ) %]
-                                has &quot;[% missing_critical.key %]&quot; in unrecognized format: &quot;[% missing_critical.value %]&quot;
+                                has &quot;[% missing_critical.key | html %]&quot; in unrecognized format: &quot;[% missing_critical.value | html %]&quot;
                             [% ELSE %]
-                                Critical field &quot;[% missing_critical.key %]&quot;
+                                Critical field &quot;[% missing_critical.key | html %]&quot;
 
                                 [% IF ( missing_critical.branch_map ) %]
-                                    has unrecognized value &quot;[% missing_critical.value %]&quot;
+                                    has unrecognized value &quot;[% missing_critical.value | html %]&quot;
                                 [% ELSIF ( missing_critical.category_map ) %]
-                                    has unrecognized value &quot;[% missing_critical.value %]&quot;
+                                    has unrecognized value &quot;[% missing_critical.value | html %]&quot;
                                 [% ELSE %]
                                     missing
                                 [% END %]
 
-                                (borrowernumber: [% missing_critical.borrowernumber %]; surname: [% missing_critical.surname %]).
+                                (borrowernumber: [% missing_critical.borrowernumber | html %]; surname: [% missing_critical.surname | html %]).
                             [% END %]
 
                             <br/>
-                            <code>[% missing_critical.lineraw %]</code>
+                            <code>[% missing_critical.lineraw | html %]</code>
                         </li>
                     [% END %]
 
                     [% IF e.invalid_cardnumber %]
                         <li class="line_error">
-                            Cardnumber [% e.cardnumber %] is not a valid cardnumber
-                            [% IF e.borrowernumber %] (for patron with borrowernumber [% e.borrowernumber %])[% END %]
+                            Cardnumber [% e.cardnumber | html %] is not a valid cardnumber
+                            [% IF e.borrowernumber %] (for patron with borrowernumber [% e.borrowernumber | html %])[% END %]
                         </li>
                     [% END %]
                     [% IF e.duplicate_userid %]
                         <li class="line_error">
-                            Userid [% e.userid %] is already used by another patron.
+                            Userid [% e.userid | html %] is already used by another patron.
                         </li>
                     [% END %]
                 [% END %]
         <li>If a cardnumber exists in the table, you can choose whether to ignore the new one or overwrite the old one.</li>
     </ul>
 
-    <form method="post" action="[% SCRIPT_NAME %]" enctype="multipart/form-data">
+    <form method="post" action="[% SCRIPT_NAME | html %]" enctype="multipart/form-data">
         <fieldset class="rows">
             <legend>Import into the borrowers table</legend>
 
                         <option value="cardnumber">Cardnumber</option>
                         <option value="userid">Username</option>
                         [% FOREACH matchpoint IN matchpoints %]
-                            <option value="[% matchpoint.code %]">[% matchpoint.description %]</option>
+                            <option value="[% matchpoint.code | html %]">[% matchpoint.description | html %]</option>
                         [% END %]
                     </select>
                 </li>
                     [% SWITCH borrower_field.field %]
                     [% CASE 'branchcode' %]
                         <li>
-                            <label class="description" for="branchcode">[% borrower_field.description %]: </label>
+                            <label class="description" for="branchcode">[% borrower_field.description | html %]: </label>
                             <select id="branchcode" name="branchcode">
                                 <option value="" selected="selected"></option>
                                 [% FOREACH library IN Branches.all() %]
-                                    <option value="[% library.branchcode %]">[% library.branchname %]</option>
+                                    <option value="[% library.branchcode | html %]">[% library.branchname | html %]</option>
                                 [% END %]
                             </select>
-                            <span class="field_hint">[% borrower_field.field %]</span>
+                            <span class="field_hint">[% borrower_field.field | html %]</span>
                         </li>
                     [% CASE 'categorycode' %]
                         <li>
-                            <label class="description" for="categorycode">[% borrower_field.description %]: </label>
+                            <label class="description" for="categorycode">[% borrower_field.description | html %]: </label>
                             <select id="categorycode" name="categorycode">
                                 <option value="" selected="selected"></option>
                                 [% FOREACH category IN categories %]
-                                    <option value="[% category.categorycode %]">[% category.description %]</option>
+                                    <option value="[% category.categorycode | html %]">[% category.description | html %]</option>
                                 [% END %]
                             </select>
-                            <span class="field_hint">[% borrower_field.field %]</span>
+                            <span class="field_hint">[% borrower_field.field | html %]</span>
                         </li>
                     [% CASE %]
                         <li>
-                            <label class="description" for="[% borrower_field.field %]">[% borrower_field.description %]: </label>
-                            <input id="[% borrower_field.field %]" name="[% borrower_field.field %]" />
-                            <span class="field_hint">[% borrower_field.field %]</span>
+                            <label class="description" for="[% borrower_field.field | html %]">[% borrower_field.description | html %]: </label>
+                            <input id="[% borrower_field.field | html %]" name="[% borrower_field.field | html %]" />
+                            <span class="field_hint">[% borrower_field.field | html %]</span>
                         </li>
                     [% END %]
                 [% END %]
         [% END %]
 
         <fieldset class="action">
-            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
             <input type="submit" value="Import" />
         </fieldset>
     </form>
             OR choose which fields you want to supply from the following list:
             <ul>
                 <li>
-                    [% FOREACH columnkey IN borrower_fields %]'[% columnkey.field %]', [% END %]
+                    [% FOREACH columnkey IN borrower_fields %]'[% columnkey.field | html %]', [% END %]
                 </li>
             </ul>
         </li>
@@ -290,9 +291,9 @@ you can supply dates in ISO format (e.g., '2010-10-28').
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             [%# Make date fields have the datepicker %]
index be5aee5..0b97bf3 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Inventory</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_inventory" class="tools">
     <div id="yui-main">
     <div class="yui-b">
     <h1>Inventory</h1>
-    [% IF (moddatecount) %]<div class="dialog message">[% moddatecount %] items modified : datelastseen set to [% date | $KohaDates %]</div>
-    <div class="dialog alert">Number of potential barcodes read: [% LinesRead %]</div>[% END %]
-    [% IF (errorfile) %]<div class="dialog alert">[% errorfile %] can't be opened</div>[% END %]
+    [% IF (moddatecount) %]<div class="dialog message">[% moddatecount | html %] items modified : datelastseen set to [% date | $KohaDates %]</div>
+    <div class="dialog alert">Number of potential barcodes read: [% LinesRead | html %]</div>[% END %]
+    [% IF (errorfile) %]<div class="dialog alert">[% errorfile | html %] can't be opened</div>[% END %]
     [% IF (err_length && err_length==1) %]<div class="dialog alert">There was 1 barcode that was too long.</div>[% END %]
-    [% IF (err_length && err_length>1) %]<div class="dialog alert">There were [% err_length %] barcodes that were too long.</div>[% END %]
+    [% IF (err_length && err_length>1) %]<div class="dialog alert">There were [% err_length | html %] barcodes that were too long.</div>[% END %]
     [% IF (err_data && err_data==1) %]<div class="dialog alert">There was 1 barcode that contained at least one unprintable character.</div>[% END %]
-    [% IF (err_data && err_data>1) %]<div class="dialog alert">There were [% err_data %] barcodes that contained at least one unprintable character.</div>[% END %]
+    [% IF (err_data && err_data>1) %]<div class="dialog alert">There were [% err_data | html %] barcodes that contained at least one unprintable character.</div>[% END %]
     [% FOREACH error IN errorloop %]
         <div class="dialog alert">
-            [% error.barcode %]
+            [% error.barcode | html %]
             [% IF (error.ERR_BARCODE) %]: barcode not found[% END %]
             [% IF (error.ERR_WTHDRAWN) %]: item withdrawn[% END %]
             [% IF (error.ERR_ONLOAN_RET) %]: item was on loan. It was returned before marked as seen[% END %]
                 <option value="">Filter location</option>
         [% FOREACH value IN authorised_values %]
             [% IF (value.selected) %]
-                <option value="[% value.authorised_value %]" selected="selected">[% value.lib %]</option>
+                <option value="[% value.authorised_value | html %]" selected="selected">[% value.lib | html %]</option>
             [% ELSE %]
-                <option value="[% value.authorised_value %]">[% value.lib %]</option>
+                <option value="[% value.authorised_value | html %]">[% value.lib | html %]</option>
             [% END %]
         [% END %]
         </select>        </li>
         [% END %]
         <li>
             <label for="minlocation">Item callnumber between: </label>
-                <input type="text" name="minlocation" id="minlocation" value="[% minlocation %]" /> (items.itemcallnumber)  </li>
+                <input type="text" name="minlocation" id="minlocation" value="[% minlocation | html %]" /> (items.itemcallnumber)  </li>
            <li><label for="maxlocation">...and: </label>
-                <input type="text" name="maxlocation" id="maxlocation" value="[% maxlocation %]" />
+                <input type="text" name="maxlocation" id="maxlocation" value="[% maxlocation | html %]" />
         </li>
     </ol>
     </fieldset>
                   [% FOREACH status IN statuses %]
                       [% IF (status.values) %]
                           <fieldset style="float: left; padding: 5px; margin: 5px;text-align:right">
-                              <legend>[% status.fieldname %]</legend>
-                              <ul id="statuses-[% fieldname %]" style="display: inline;">
+                              <legend>[% status.fieldname | html %]</legend>
+                              <ul id="statuses-[% fieldname | html %]" style="display: inline;">
                               [% FOREACH value IN status.values %]
                                   [% IF (value.lib) %]
                                     <li>
-                                    <label for="[% value.id %]">
+                                    <label for="[% value.id | html %]">
                                         [% IF value.authorised_value==0 %]
                                             For loan
                                         [% ELSE %]
-                                            [% value.lib %]
+                                            [% value.lib | html %]
                                         [% END %]
                                     </label>
-                                    <input type="checkbox" name="status-[% status.fieldname %]-[% value.authorised_value %]" id="[% value.authorised_value %]" />
+                                    <input type="checkbox" name="status-[% status.fieldname | html %]-[% value.authorised_value | html %]" id="[% value.authorised_value | html %]" />
                                     </li>
                                   [% END %]
                               [% END %]
     [% END %]
     [% IF (op) %]
     <form method="post" action="/cgi-bin/koha/tools/inventory.pl" class="checkboxed">
-    <input type="hidden" name="minlocation" value="[% minlocation %]" />
-    <input type="hidden" name="maxlocation" value="[% maxlocation %]" />
-    <input type="hidden" name="location" value="[% location %]" />
-    <input type="hidden" name="branchcode" value="[% branchcode %]" />
-    <input type="hidden" name="datelastseen" value="[% datelastseen %]" />
+    <input type="hidden" name="minlocation" value="[% minlocation | html %]" />
+    <input type="hidden" name="maxlocation" value="[% maxlocation | html %]" />
+    <input type="hidden" name="location" value="[% location | html %]" />
+    <input type="hidden" name="branchcode" value="[% branchcode | html %]" />
+    <input type="hidden" name="datelastseen" value="[% datelastseen | html %]" />
 
     [% UNLESS uploadedbarcodesflag %]
       <div><a href="#" class="checkall"><i class="fa fa-check"></i> Select all</a> <a href="#" class="clearall"><i class="fa fa-remove"></i> Clear all</a></div>
         <tr>
             [% UNLESS uploadedbarcodesflag %]
               <td>
-                <input type="checkbox" name="SEEN-[% result.itemnumber %]" value="1" />
+                <input type="checkbox" name="SEEN-[% result.itemnumber | html %]" value="1" />
               </td>
             [% END %]
             <td>
             </td>
             <td>[% result.itemcallnumber | html %]</td>
             <td>
-                [% Branches.GetName( result.homebranch ) %]
+                [% Branches.GetName( result.homebranch ) | html %]
                 <span class="shelvingloc">[% result.location | html %]</span>
             </td>
             <td>
-                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% result.biblionumber %]" class="openWin">[% result.title | html %]</a>
+                <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% result.biblionumber | html %]" class="openWin">[% result.title | html %]</a>
                 [% IF ( result.author ) %]
                     by <span class="author">[% result.author | html %]</span>
                 [% END %]
             [% result.withdrawn | html %]
             </td>
             <td>
-            [% result.datelastseen | $KohaDates | html %]
+            [% result.datelastseen | $KohaDates %]
             </td>
             <td>
             [% FOREACH problem IN result.problems %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
     <script type="text/javascript">
         function checkForm() {
             if ( $('#uploadbarcodes').val() ) {
index f50b806..8ca8a11 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% USE Branches %]
@@ -6,7 +7,7 @@
 <title>Koha &rsaquo; Tools &rsaquo; News</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( opac_news_count ) %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 </head>
 
@@ -33,17 +34,17 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
         <div class="dialog alert">Error: Required news title missing!</div>
     [% END %]
 <div id="toolbar" class="btn-toolbar">
-    <a class="btn btn-default btn-sm" id="newentry" href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;lang=[% lang %]"><i class="fa fa-plus"></i> New entry</a>
+    <a class="btn btn-default btn-sm" id="newentry" href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;lang=[% lang | html %]"><i class="fa fa-plus"></i> New entry</a>
 </div>
 [% END %]
 
 [% IF ( add_form ) %]
-    [% IF ( op == 'add' ) %][% default_lang = lang %]
-    [% ELSE %][% default_lang = new_detail.lang %]
+    [% IF ( op == 'add' ) %][% default_lang = lang | html %]
+    [% ELSE %][% default_lang = new_detail.lang | html %]
     [% END %]
         <form name="add_form" method="post" action="/cgi-bin/koha/tools/koha-news.pl" >
-            <input type="hidden" name="op" value="[% op %]" />
-            <input type="hidden" name="id" value="[% id %]" />
+            <input type="hidden" name="op" value="[% op | html %]" />
+            <input type="hidden" name="id" value="[% id | html %]" />
                        <fieldset class="rows">
             <legend>OPAC and Koha news</legend>
            <ol> <li>
@@ -66,9 +67,9 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
                 [% END %]
                 [% FOREACH lang_lis IN lang_list %]
                 [% IF ( lang_lis.language == default_lang ) %]
-                    <option value="[% lang_lis.language %]" selected="selected">OPAC ([% lang_lis.language %])</option>
+                    <option value="[% lang_lis.language | html %]" selected="selected">OPAC ([% lang_lis.language | html %])</option>
                 [% ELSE %]
-                    <option value="[% lang_lis.language %]"                    >OPAC ([% lang_lis.language %])</option>
+                    <option value="[% lang_lis.language | html %]"                    >OPAC ([% lang_lis.language | html %])</option>
                 [% END %]
                 [% END %]
             </select>
@@ -86,28 +87,28 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
             </li>
             <li>
                 <label for="title" class="required">Title: </label>
-                <input id="title" size="30" type="text" name="title" value="[% new_detail.title %]" required="required" class="required" /> <span class="required">Required</span>
+                <input id="title" size="30" type="text" name="title" value="[% new_detail.title | html %]" required="required" class="required" /> <span class="required">Required</span>
             </li>
             <li>
                 <label for="from">Publication date: </label>
-                <input id="from" type="text" name="timestamp" size="15" value="[% new_detail.timestamp %]" class="datepickerfrom" />
+                <input id="from" type="text" name="timestamp" size="15" value="[% new_detail.timestamp | html %]" class="datepickerfrom" />
                                <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
             </li>
             <li>
                 <label for="to">Expiration date: </label>
-                <input id="to" type="text" name="expirationdate" size="15" value="[% new_detail.expirationdate %]" class="datepickerto" />
+                <input id="to" type="text" name="expirationdate" size="15" value="[% new_detail.expirationdate | html %]" class="datepickerto" />
                                <div class="hint">[% INCLUDE 'date-format.inc' %]</div>
             </li>
             <li>
                 <label for="number">Appear in position: </label>
                 [% IF ( new_detail.number ) %]
-                    <input id="number" size="3" name="number" type="text" value="[% new_detail.number %]" />
+                    <input id="number" size="3" name="number" type="text" value="[% new_detail.number | html %]" />
                 [% ELSE %]
                     <input id="number" size="3" name="number" type="text" />
                 [% END %]
             </li>
             <li><label for="content">News: </label>
-            <textarea name="content" id="content"  cols="75" rows="10">[% new_detail.content %]</textarea>
+            <textarea name="content" id="content"  cols="75" rows="10">[% new_detail.content | $raw %]</textarea>
             </li>
             </ol>
                        </fieldset>
@@ -136,9 +137,9 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
             [% END %]
                 [% FOREACH lang_lis IN lang_list %]
                 [% IF ( lang_lis.language == lang ) %]
-                    <option value="[% lang_lis.language %]" selected="selected">OPAC ([% lang_lis.language %])</option>
+                    <option value="[% lang_lis.language | html %]" selected="selected">OPAC ([% lang_lis.language | html %])</option>
                 [% ELSE %]
-                    <option value="[% lang_lis.language %]"         >OPAC ([% lang_lis.language %])</option>
+                    <option value="[% lang_lis.language | html %]"         >OPAC ([% lang_lis.language | html %])</option>
                 [% END %]
                 [% END %]
             </select>
@@ -176,7 +177,7 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
                             <tr>
                             [% END %]
                             <td>
-                                <input type="checkbox" name="ids" value="[% opac_new.idnew %]" />
+                                <input type="checkbox" name="ids" value="[% opac_new.idnew | html %]" />
                             </td>
                             <td>[% SWITCH opac_new.lang %]
                                 [%   CASE "koha" %]
@@ -186,24 +187,24 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
                                 [%   CASE "" %]
                                     All
                                 [%   CASE %]
-                                    OPAC ([% opac_new.lang %])
+                                    OPAC ([% opac_new.lang | html %])
                                 [% END %]
                              </td>
                             <td>[% IF ( opac_new.branchcode == "" ) -%]
                                 All libraries
-                                [% ELSE %][% opac_new.branchname %]
+                                [% ELSE %][% opac_new.branchname | html %]
                                 [% END %]</td>
-                            <td>[% opac_new.number %]</td>
-                            <td><span title="[% opac_new.newdate %]">[% opac_new.newdate | $KohaDates %]</span></td>
-                            <td><span title="[% opac_new.expirationdate %]">[% opac_new.expirationdate | $KohaDates %] [% IF ( opac_new.expired ) %](<span class="expired">expired</span>)[% END %]</span></td>
-                            <td>[% opac_new.title %]</td>
-                            <td>[% opac_new.author_title %] [% opac_new.author_firstname %] [% opac_new.author_surname %]</td>
+                            <td>[% opac_new.number | html %]</td>
+                            <td><span title="[% opac_new.newdate | html %]">[% opac_new.newdate | $KohaDates %]</span></td>
+                            <td><span title="[% opac_new.expirationdate | html %]">[% opac_new.expirationdate | $KohaDates %] [% IF ( opac_new.expired ) %](<span class="expired">expired</span>)[% END %]</span></td>
+                            <td>[% opac_new.title | html %]</td>
+                            <td>[% opac_new.author_title | html %] [% opac_new.author_firstname | html %] [% opac_new.author_surname | html %]</td>
                            <td>
-                                [% opac_new.content %]
+                                [% opac_new.content | $raw %]
                             </td>
                             <td class="actions">
-                                <a href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;id=[% opac_new.idnew %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
-                                <a href="/cgi-bin/koha/tools/koha-news.pl?op=del&amp;ids=[% opac_new.idnew %]" class="delete_news btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
+                                <a href="/cgi-bin/koha/tools/koha-news.pl?op=add_form&amp;id=[% opac_new.idnew | html %]" class="btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</a>
+                                <a href="/cgi-bin/koha/tools/koha-news.pl?op=del&amp;ids=[% opac_new.idnew | html %]" class="delete_news btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</a>
                             </td>
                         </tr>
                     [% END %]</tbody>
@@ -226,7 +227,7 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% IF ( opac_news_count ) %]
         [% INCLUDE 'datatables.inc' %]
         <script type="text/javascript">
@@ -266,15 +267,15 @@ Edit news item[% ELSE %]Add news item[% END %][% ELSE %]News[% END %]</div>
             });
         </script>
     [% END %]
-    [% Asset.js("lib/tiny_mce/tiny_mce.js") %]
+    [% Asset.js("lib/tiny_mce/tiny_mce.js") | $raw %]
     <script type="text/javascript">
-        tinyMCE.baseURL = "[% interface %]/lib/tiny_mce";
+        tinyMCE.baseURL = "[% interface | html %]/lib/tiny_mce";
         tinyMCE.init({
             mode : "textareas",
             theme : "advanced",
             convert_urls : false,
             relative_urls : false,
-            content_css : "[% interface %]/[% theme %]/css/tinymce.css",
+            content_css : "[% interface | html %]/[% theme | html %]/css/tinymce.css",
             plugins : "table,save,advhr,advlink,searchreplace,print,contextmenu",
             theme_advanced_buttons1 : "save,|,bold,italic,|,cut,copy,paste,|,search,replace,|,justifyleft,justifycenter,justifyright,justifyfull,|,formatselect,|,link,unlink,anchor,cleanup,help,code,advhr,|,print",
             theme_advanced_buttons2 : "tablecontrols,|,bullist,numlist,|,outdent,indent,|,undo,redo,|,removeformat,|,visualaid,|,sub,sup,|,charmap",
index 0e12c41..5fc7b80 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -5,7 +6,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Notices[% IF ( add_form or copy_form ) %][% IF ( modify ) %] &rsaquo; Modify notice[% ELSE %] &rsaquo; Add notice[% END %][% END %][% IF ( add_validate or copy_validate) %] &rsaquo; Notice added[% END %][% IF ( delete_confirm ) %] &rsaquo; Confirm deletion[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">#preview_template .modal-dialog { width : 80%; } .spinner { display: none; } @media (max-width: 767px) { #preview_template { margin: 0; width : auto; } }</style>
 </head>
 
@@ -23,7 +24,7 @@
         <h3 id="preview_template_label">Preview notice template</h3>
     </div>
     <div class="modal-body">
-        <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+        <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
     </div>
     <div class="modal-footer">
         <!-- TODO <a href="#" class="btn btn-default" id="preview_template_button" role="button" data-toggle="modal">Convert using the Template Toolkit syntax</a>-->
         <p>You searched for <b>[% searchfield | html %]</b></p>
                [% END %]
                [% IF ( letter && !independant_branch) %]
-            [% select_for_copy = BLOCK %]
+            [% select_for_copy = BLOCK | html %]
             <select name="branchcode">
                 [% FOREACH l IN Branches.all() %]
-                <option value="[% l.branchcode %]">Copy to [% l.branchname %]</option>
+                <option value="[% l.branchcode | html %]">Copy to [% l.branchname | html %]</option>
                 [% END %]
             </select>
             [% END %]
             </thead>
             <tbody>
               [% FOREACH lette IN letter %]
-                [% can_edit = lette.branchcode || !independant_branch %]
+                [% can_edit = lette.branchcode || !independant_branch | html %]
                 <tr>
-                  <td>[% IF lette.branchname %][% lette.branchname %][% ELSE %](All libraries)[% END %]</td>
-                  <td>[% lette.module %]</td>
-                  <td>[% lette.code %]</td>
-                  <td>[% lette.name %]</td>
+                  <td>[% IF lette.branchname %][% lette.branchname | html %][% ELSE %](All libraries)[% END %]</td>
+                  <td>[% lette.module | html %]</td>
+                  <td>[% lette.code | html %]</td>
+                  <td>[% lette.name | html %]</td>
                   <td class="actions">
                     [% IF !independant_branch || !lette.branchcode %]
                       <form method="post" action="/cgi-bin/koha/tools/letter.pl">
                         <input type="hidden" name="op" value="copy_form" />
-                        <input type="hidden" name="oldbranchcode" value="[% lette.branchcode %]" />
-                        <input type="hidden" name="module" value="[% lette.module %]" />
-                        <input type="hidden" name="code" value="[% lette.code %]" />
+                        <input type="hidden" name="oldbranchcode" value="[% lette.branchcode | html %]" />
+                        <input type="hidden" name="module" value="[% lette.module | html %]" />
+                        <input type="hidden" name="code" value="[% lette.code | html %]" />
                         [% IF independant_branch %]
-                          <input type="hidden" name="branchcode" value="[% independant_branch %]" />
+                          <input type="hidden" name="branchcode" value="[% independant_branch | html %]" />
                         [% ELSE %]
-                          [% select_for_copy %]
+                          [% select_for_copy | $raw %]
                         [% END %]
                         <button class="btn btn-default btn-xs"><i class="fa fa-clone"></i> Copy</button>
                       </form>
                   </td>
                   <td class="actions">
                     [% IF can_edit %]
-                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/letter.pl?op=add_form&amp;branchcode=[% lette.branchcode %]&amp;module=[% lette.module %]&amp;code=[% lette.code %]"><i class="fa fa-pencil"></i> Edit</a>
+                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/letter.pl?op=add_form&amp;branchcode=[% lette.branchcode | html %]&amp;module=[% lette.module | html %]&amp;code=[% lette.code | html %]"><i class="fa fa-pencil"></i> Edit</a>
                     [% END %]
                     [% IF !lette.protected && can_edit %]
-                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/letter.pl?op=delete_confirm&amp;branchcode=[%lette.branchcode %]&amp;module=[% lette.module %]&amp;code=[% lette.code %]"><i class="fa fa-trash"></i> Delete</a>
+                      <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/letter.pl?op=delete_confirm&amp;branchcode=[% lette.branchcode | html %]&amp;module=[% lette.module | html %]&amp;code=[% lette.code | html %]"><i class="fa fa-trash"></i> Delete</a>
                     [% END %]
                   </td>
                 </tr>
                <input type="hidden" name="add" value="1" />
                [% END %]
                <fieldset class="rows">
-            <input type="hidden" name="oldbranchcode" value="[% oldbranchcode %]" />
+            <input type="hidden" name="oldbranchcode" value="[% oldbranchcode | html %]" />
             <ol>
             [% IF independant_branch %]
-                <input type="hidden" name="branchcode" value="[% independant_branch %]" />
+                <input type="hidden" name="branchcode" value="[% independant_branch | html %]" />
             [% ELSE %]
             <li>
 
                     </select>
                 [% ELSE %]
                     <span class="label">Library:</span>
-                    <input type="hidden" id="branch" name="branchcode" value="[% branchcode %]" />
+                    <input type="hidden" id="branch" name="branchcode" value="[% branchcode | html %]" />
                     [% IF ( branchcode ) %]
-                       [% Branches.GetName( branchcode ) %]
+                       [% Branches.GetName( branchcode ) | html %]
                     [% ELSE %]
                         All libraries
                     [% END %]
             [% END %]
                        <li>
                                <label for="module">Koha module:</label>
-                               <input type="hidden" name="oldmodule" value="[% module %]" />
+                               <input type="hidden" name="oldmodule" value="[% module | html %]" />
                 [% IF adding  %]
                   <select name="module" id="newmodule">
                 [% ELSE %]
                   <span class="required">Required</span>
               [% ELSE %]
                   <span class="label">Code:</span>
-                  <input type="hidden" id="code" name="code" value="[% code %]" />
-                  [% code %]
+                  <input type="hidden" id="code" name="code" value="[% code | html %]" />
+                  [% code | html %]
               [% END %]
             </li>
             <li>
               <label for="name" class="required">Name:</label>
-              <input type="text" id="name" name="name" size="60" value="[% letter_name %]" required="required" />
+              <input type="text" id="name" name="name" size="60" value="[% letter_name | html %]" required="required" />
               <span class="required">Required</span>
             </li>
             [% IF code and preview_is_available%]
                     [% FOR language IN languages %]
                         [% FOR sublanguage IN language.sublanguages_loop %]
                             [% IF language.plural %]
-                                <li><a href="#lang_[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] [% sublanguage.region_description %] ([% sublanguage.rfc4646_subtag %])</a></li>
+                                <li><a href="#lang_[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] [% sublanguage.region_description | html %] ([% sublanguage.rfc4646_subtag | html %])</a></li>
                             [% ELSE %]
-                                <li><a href="#lang_[% sublanguage.rfc4646_subtag %]">[% sublanguage.native_description %] ([% sublanguage.rfc4646_subtag %])</a></li>
+                                <li><a href="#lang_[% sublanguage.rfc4646_subtag | html %]">[% sublanguage.native_description | html %] ([% sublanguage.rfc4646_subtag | html %])</a></li>
                             [% END %]
                         [% END %]
                     [% END %]
         [% END %]
 
         [% FOREACH lang IN letters.keys %]
-            <div id="lang_[% lang %]">
+            <div id="lang_[% lang | html %]">
         <div class="transport-types" style="clear:both">
         [% FOR mtt IN letters.$lang.templates.keys.sort %]
             [% SET letter = letters.$lang.templates.$mtt %]
                 [% CASE 'phone' %]
                   Phone
                 [% CASE %]
-                  [% letter.message_transport_type %]
+                  [% letter.message_transport_type | html %]
                 [% END %]
             </h3>
             [% IF letter.message_transport_type == "sms" and not Koha.Preference("SMSSendDriver") %]
-              <fieldset class="rows mtt" id="[% letter.message_transport_type %]_[% lang %]" disabled="disabled">
+              <fieldset class="rows mtt" id="[% letter.message_transport_type | html %]_[% lang | html %]" disabled="disabled">
                 <div class="dialog message">You should enable the SMSSendDriver preference to use the SMS templates.</div>
             [% ELSIF letter.message_transport_type == "phone" and not Koha.Preference("TalkingTechItivaPhoneNotification") %]
-              <fieldset class="rows mtt" id="[% letter.message_transport_type %]_[% lang %]" disabled="disabled">
+              <fieldset class="rows mtt" id="[% letter.message_transport_type | html %]_[% lang | html %]" disabled="disabled">
                 <div class="dialog message">You should enable the TalkingTechItivaPhoneNotification preference to use the phone templates.</div>
             [% ELSE %]
-              <fieldset class="rows mtt" id="[% letter.message_transport_type %]_[% lang %]">
+              <fieldset class="rows mtt" id="[% letter.message_transport_type | html %]_[% lang | html %]">
             [% END %]
               <ol>
                 <li>
-                  <input type="hidden" name="message_transport_type" value="[% letter.message_transport_type %]" />
-                  <input type="hidden" name="lang" value="[% lang %]" />
-                  <label for="is_html_[% letter.message_transport_type %]_[% lang %]">HTML message:</label>
+                  <input type="hidden" name="message_transport_type" value="[% letter.message_transport_type | html %]" />
+                  <input type="hidden" name="lang" value="[% lang | html %]" />
+                  <label for="is_html_[% letter.message_transport_type | html %]_[% lang | html %]">HTML message:</label>
                   [% IF letter.is_html %]
-                    <input type="checkbox" name="is_html_[% letter.message_transport_type %]" id="is_html_[% letter.message_transport_type %]_[% lang %]" value="1" checked="checked" />
+                    <input type="checkbox" name="is_html_[% letter.message_transport_type | html %]" id="is_html_[% letter.message_transport_type | html %]_[% lang | html %]" value="1" checked="checked" />
                   [% ELSE %]
-                    <input type="checkbox" name="is_html_[% letter.message_transport_type %]" id="is_html_[% letter.message_transport_type %]_[% lang %]" value="1" />
+                    <input type="checkbox" name="is_html_[% letter.message_transport_type | html %]" id="is_html_[% letter.message_transport_type | html %]_[% lang | html %]" value="1" />
                   [% END %]
                 </li>
                 <li>
-                  <label for="title_[% letter.message_transport_type %]_[% lang %]">Message subject:</label><input type="text" id="title_[% letter.message_transport_type %]_[% lang %]" name="title" size="60" value="[% letter.title %]" />
+                  <label for="title_[% letter.message_transport_type | html %]_[% lang | html %]">Message subject:</label><input type="text" id="title_[% letter.message_transport_type | html %]_[% lang | html %]" name="title" size="60" value="[% letter.title | html %]" />
                 </li>
                 <li>
-                  <label for="SQLfieldname_[% letter.message_transport_type %]_[% lang %]">Message body:</label>
+                  <label for="SQLfieldname_[% letter.message_transport_type | html %]_[% lang | html %]">Message body:</label>
                   [% IF letter.message_transport_type == 'sms' %]
-                    <span class="sms_counter" id="sms_counter_[% lang %]">[% IF letter.content && letter.content.length > 0 %][% letter.content.length %][% ELSE %]0[% END %]/160 characters</span>
+                    <span class="sms_counter" id="sms_counter_[% lang | html %]">[% IF letter.content && letter.content.length > 0 %][% letter.content.length | html %][% ELSE %]0[% END %]/160 characters</span>
                   [% END %]
                   <table>
                     <tr>
                       <td>
-                        <select name="SQLfieldname" id="SQLfieldname_[% letter.message_transport_type %]_[% lang %]" multiple="multiple" size="9">
+                        <select name="SQLfieldname" id="SQLfieldname_[% letter.message_transport_type | html %]_[% lang | html %]" multiple="multiple" size="9">
                           [% FOREACH SQLfieldname IN SQLfieldnames %]
-                            <option value="[% SQLfieldname.value %]">[% SQLfieldname.text %]</option>
+                            <option value="[% SQLfieldname.value | html %]">[% SQLfieldname.text | html %]</option>
                           [% END %]
                         </select>
                       </td>
                         <td class="actions">
-                            <button type="button" data-containerid="[% letter.message_transport_type %]_[% lang %]" class="btn btn-default btn-sm insert">Insert <i class="fa fa-long-arrow-right"></i></button>
+                            <button type="button" data-containerid="[% letter.message_transport_type | html %]_[% lang | html %]" class="btn btn-default btn-sm insert">Insert <i class="fa fa-long-arrow-right"></i></button>
                         </td>
-                      <td><textarea name="content" data-lang="[% lang %]" class="content_[% letter.message_transport_type %]" id="content_[% letter.message_transport_type %]_[% lang %]" cols="80" rows="15">[% letter.content | html %]</textarea></td>
+                      <td><textarea name="content" data-lang="[% lang | html %]" class="content_[% letter.message_transport_type | html %]" id="content_[% letter.message_transport_type | html %]_[% lang | html %]" cols="80" rows="15">[% letter.content | html %]</textarea></td>
                     </tr>
                   </table>
                 </li>
                 [% IF preview_is_available %]
                     <li>
-                        <a href="/cgi-bin/koha/svc/letters/preview" class="preview_template btn btn-default btn-xs" title="Preview this notice template" data-mtt="[% letter.message_transport_type %]" data-lang="[% lang %]"><i class="fa fa-eye"></i> Preview</a>
+                        <a href="/cgi-bin/koha/svc/letters/preview" class="preview_template btn btn-default btn-xs" title="Preview this notice template" data-mtt="[% letter.message_transport_type | html %]" data-lang="[% lang | html %]"><i class="fa fa-eye"></i> Preview</a>
                     </li>
                 [% END %]
               </ol>
         [% IF code.search('DGST') %] <span class="overdue">Warning, this is a template for a Digest, as such, any references to branch data ( e.g. branches.branchname ) will refer to the borrower's home branch.</span> [% END %]
 
         <input type="hidden" id="redirect" name="redirect" value="" />
-        <input type="hidden" name="searchfield" value="[% searchfield %]" />
+        <input type="hidden" name="searchfield" value="[% searchfield | html %]" />
     </form>
 [% END %]
 
 [% IF ( add_validate or copy_validate) %]
        Data recorded
-       <form action="[% action %]" method="post">
+       <form action="[% action | html %]" method="post">
        <input type="submit" value="OK" />
        </form>
 [% END %]
             </tr>
             </thead>
             <tr>
-                <td>[% IF letter.branchcode %][% Branches.GetName( letter.branchcode ) %][% ELSE %](All libraries)[% END %]</td>
-                <td>[% letter.module %]</td>
-                <td>[% letter.code %]</td>
-                <td>[% letter.name %]</td>
+                <td>[% IF letter.branchcode %][% Branches.GetName( letter.branchcode ) | html %][% ELSE %](All libraries)[% END %]</td>
+                <td>[% letter.module | html %]</td>
+                <td>[% letter.code | html %]</td>
+                <td>[% letter.name | html %]</td>
             </tr>
         </table>
-            <form action="[% action %]" method="post">
+            <form action="[% action | html %]" method="post">
             <input type="hidden" name="op" value="delete_confirmed">
-            <input type="hidden" name="branchcode" value="[% letter.branchcode %]" />
-            <input type="hidden" name="code" value="[% letter.code %]" />
-            <input type="hidden" name="module" value="[% letter.module %]" />
+            <input type="hidden" name="branchcode" value="[% letter.branchcode | html %]" />
+            <input type="hidden" name="code" value="[% letter.code | html %]" />
+            <input type="hidden" name="module" value="[% letter.module | html %]" />
             <button type="submit" class="approve"><i class="fa fa-check"></i> Yes, delete</button>
         </form>
 
-        <form action="[% action %]" method="get">
+        <form action="[% action | html %]" method="get">
             <button type="submit" class="deny"><i class="fa fa-times"></i> No, do not delete</button>
         </form>
     </div>
 
 [% IF ( delete_confirmed ) %]
        Data deleted
-       <form action="[% action %]" method="post">
+       <form action="[% action | html %]" method="post">
        <input type="submit" value="OK" />
        </form>
 [% END %]
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.insertatcaret.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.insertatcaret.js") | $raw %]
     <script>
-        var no_op_set = '[% no_op_set %]';
-        var interface = '[% interface %]';
-        var theme = '[% theme %]';
-        var add_form = '[% add_form %]';
-        var copy_form = '[% copy_form %]';
-        var code = '[% code %]';
-        var new_lettercode = '[% new_lettercode %]';
-        var new_branchcode = '[% new_branchcode %]';
+        var no_op_set = '[% no_op_set | html %]';
+        var interface = '[% interface | html %]';
+        var theme = '[% theme | html %]';
+        var add_form = '[% add_form | html %]';
+        var copy_form = '[% copy_form | html %]';
+        var code = '[% code | html %]';
+        var new_lettercode = '[% new_lettercode | html %]';
+        var new_branchcode = '[% new_branchcode | html %]';
         var MSG_CODE_EXISTS = _("A default letter with the code '%s' already exists.");
         var MSG_CODE_EXISTS_FOR_LIBRARY = _("A letter with the code '%s' already exists for '%s'.");
         var MSG_EMPTY_TITLE_AND_CONTENT = _("Please specify title and content for %s");
         var MSG_EMPTY_TEMPLATES = _("Please fill at least one template.");
         var MSG_LOADING = _("Loading");
      </script>
-    [% Asset.js("js/letter.js") %]
+    [% Asset.js("js/letter.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index cff595a..c29dafe 100644 (file)
@@ -1,13 +1,14 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Manage staged MARC records
 [% IF ( import_batch_id ) %]
- &rsaquo; Batch [% import_batch_id %]
+ &rsaquo; Batch [% import_batch_id | html %]
 [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">
     #jobpanel,#jobstatus,#jobfailed { display : none; }
     span.change-status { font-style:italic; color:#666; display:none; }
@@ -20,8 +21,8 @@
 <div id="breadcrumbs"><a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> 
 [% IF ( import_batch_id ) %]
  &rsaquo;
- <a href="[% script_name %]">Manage staged MARC records</a>
- &rsaquo; Batch [% import_batch_id %]
+ <a href="[% script_name | html %]">Manage staged MARC records</a>
+ &rsaquo; Batch [% import_batch_id | html %]
 [% ELSE %]
  &rsaquo; Manage staged MARC records
 [% END %]
@@ -35,7 +36,7 @@
 
 <h1>Manage staged MARC records
 [% IF ( import_batch_id ) %]
- &rsaquo; Batch [% import_batch_id %]
+ &rsaquo; Batch [% import_batch_id | html %]
 [% END %]
 </h1>
 [% IF ( label_batch_msg ) %]
 [% ELSE %]
 <div class="dialog message">
 [% END %]
-<b><p>[% label_batch_msg %]</p></b>
+<b><p>[% label_batch_msg | html %]</p></b>
 </div>
 [% END %]
 
 [% IF ( did_clean ) %]
-  <div class="dialog message">Cleaned import batch #[% import_batch_id %]</div>
+  <div class="dialog message">Cleaned import batch #[% import_batch_id | html %]</div>
 [% END %]
 
 [% IF ( did_delete ) %]
 [% IF ( batch_info ) %]
 
 [% IF ( can_commit ) %]
-<form action="[% script_name %]" method="post">
+<form action="[% script_name | html %]" method="post">
 <input type="hidden" name="op" value="redo-matching" />
-<input type="hidden" name="import_batch_id" value="[% import_batch_id %]" />
-<input type="hidden" name="current_matcher_id" value="[% current_matcher_id %]" />
+<input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
+<input type="hidden" name="current_matcher_id" value="[% current_matcher_id | html %]" />
 [% END %]
 
   [% IF ( rematch_attempted ) %]
@@ -79,7 +80,7 @@
       <div class="dialog alert">Failed to apply different matching rule</div>
     [% ELSE %]
       <div class="dialog message">Applied different matching rule.  Number of records matched now
-       [% num_with_matches %]
+       [% num_with_matches | html %]
       </div>
     [% END %]
   [% END %]
 
 <fieldset class="rows" id="staged-record-matching-rules">
   <ol>
-    <li><span class="label">File name:</span> [% file_name %]</li>
-    <li><span class="label">Comments:</span> [% IF ( comments ) %][% comments %][% ELSE %](none)[% END %]</li>
+    <li><span class="label">File name:</span> [% file_name | html %]</li>
+    <li><span class="label">Comments:</span> [% IF ( comments ) %][% comments | html %][% ELSE %](none)[% END %]</li>
     <li><span class="label">Type:</span> [% IF ( record_type == 'auth' ) %]Authority records[% ELSE %]Bibliographic records[% END %]</li>
-    <li><span class="label">Staged:</span> [% upload_timestamp %]</li>
+    <li><span class="label">Staged:</span> [% upload_timestamp | html %]</li>
     <li><span class="label">Status:</span>
       [% IF ( import_status == 'cleaned' ) %]
          Cleaned
       [% ELSIF ( import_status == 'staged' ) %]
           Staged
       [% ELSE %]
-          [% import_status %]
+          [% import_status | html %]
       [% END %]
       </li>
     <li>
        <option value="">Do not look for matching records</option> 
        [% FOREACH available_matcher IN available_matchers %]
           [% IF ( available_matcher.selected ) %]
-          <option value="[% available_matcher.matcher_id %]" selected="selected">
-             [% available_matcher.code %] ([% available_matcher.description %])
+          <option value="[% available_matcher.matcher_id | html %]" selected="selected">
+             [% available_matcher.code | html %] ([% available_matcher.description | html %])
           </option>
           [% ELSE %]
-          <option value="[% available_matcher.matcher_id %]">
-            [% available_matcher.code %] ([% available_matcher.description %])
+          <option value="[% available_matcher.matcher_id | html %]">
+            [% available_matcher.code | html %] ([% available_matcher.description | html %])
           </option>
           [% END %]
        [% END %]
     </select> <span class="change-status">Changed. <a href="#" class="reset" id="reset_new_matcher_id">Reset</a></span>[% ELSE %]<span class="label">Matching rule applied</span>[% IF ( current_matcher_id ) %]
-  [% current_matcher_code %] ([% current_matcher_description %])
+  [% current_matcher_code | html %] ([% current_matcher_description | html %])
 [% ELSE %]
   No matching rule in effect
 [% END %][% END %]
             [% ELSIF ( overlay_action == 'ignore' ) %]
                 Ignore incoming record (its items may still be processed)
             [% ELSE %]
-                [% overlay_action %]
+                [% overlay_action | html %]
             [% END %]
         [% END %]</li>
      
             [% ELSIF ( nomatch_action == 'ignore' ) %]
                 Ignore incoming record (its items may still be processed)
             [% ELSE %]
-                [% nomatch_action %]
+                [% nomatch_action | html %]
             [% END %]
         [% END %]
     </li>
             [% ELSIF ( item_action == 'ignore' ) %]
                 Ignore items
             [% ELSE %]
-                [% item_action %]
+                [% item_action | html %]
             [% END %]
         [% END %]
     </li>
 
 <div>
   [% IF ( can_commit ) %]
-  <form action="[% script_name %]" method="post" id="import_batch_form">
+  <form action="[% script_name | html %]" method="post" id="import_batch_form">
     <input type="hidden" name="op" value="commit-batch" />
     <input type="hidden" name="runinbackground" value="" />
     <input type="hidden" name="completedJobID" value="" />
-    <input type="hidden" name="import_batch_id" value="[% import_batch_id %]" />
+    <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
     <fieldset class="action">
     [% IF ( record_type != 'auth' ) %]
     Add new bibliographic records into this framework:
     <select name="framework" id="frameworks">
       <option value="">Default</option>
       [% FOREACH framework IN frameworks %]
-          <option value="[% framework.frameworkcode %]">[% framework.frameworktext %]</option>
+          <option value="[% framework.frameworkcode | html %]">[% framework.frameworktext | html %]</option>
       [% END %]
     </select>
     [% END %]
      <div id="jobfailed"></div></div>
   [% END %]
   [% IF ( can_revert ) %]
-  <form action="[% script_name %]" method="post" id="revert_batch_form">
+  <form action="[% script_name | html %]" method="post" id="revert_batch_form">
     <input type="hidden" name="op" value="revert-batch" />
     <input type="hidden" name="runinbackground" value="" />
     <input type="hidden" name="completedJobID" value="" />
-    <input type="hidden" name="import_batch_id" value="[% import_batch_id %]" />
+    <input type="hidden" name="import_batch_id" value="[% import_batch_id | html %]" />
     <fieldset class="action"><input type="submit" class="button" name="mainformsubmit" value="Undo import into catalog" /></fieldset>
   </form>
   <div id="jobpanel"><div id="jobstatus">Job progress: <div id="jobprogress"></div> <span id="jobprogresspercent">0</span>%</div>
   [% IF ( did_commit ) %]
   <div class="dialog message">Completed import of records</div>
   <table>
-  <tr><td>Number of records added</td><td>[% num_added %]</td></tr>
-  <tr><td>Number of records updated</td><td>[% num_updated %]</td></tr>
-  <tr><td>Number of records ignored</td><td>[% num_ignored %]</td></tr>
+  <tr><td>Number of records added</td><td>[% num_added | html %]</td></tr>
+  <tr><td>Number of records updated</td><td>[% num_updated | html %]</td></tr>
+  <tr><td>Number of records ignored</td><td>[% num_ignored | html %]</td></tr>
   [% IF ( record_type == 'biblio' ) %]
-      <tr><td>Number of items added</td><td>[% num_items_added %]</td></tr>
-      <tr><td>Number of items replaced</td><td>[% num_items_replaced %]</td></tr>
-      <tr><td>Number of items ignored because of duplicate barcode</td><td>[% num_items_errored %]</td></tr>
+      <tr><td>Number of items added</td><td>[% num_items_added | html %]</td></tr>
+      <tr><td>Number of items replaced</td><td>[% num_items_replaced | html %]</td></tr>
+      <tr><td>Number of items ignored because of duplicate barcode</td><td>[% num_items_errored | html %]</td></tr>
   [% END %]
   </table>
   [% END %]
   [% IF ( did_revert ) %]
   <div class="dialog message">Success: Import reversed</div>
   <table>
-  <tr><td>Number of records deleted</td><td>[% num_deleted %]</td></tr>
+  <tr><td>Number of records deleted</td><td>[% num_deleted | html %]</td></tr>
   [% IF ( record_type == 'biblio' ) %]
-    <tr><td>Number of items deleted</td><td>[% num_items_deleted %]</td></tr>
-    <tr><td>Number of records not deleted due to items on loan</td><td>[% num_errors %]</td></tr>
+    <tr><td>Number of items deleted</td><td>[% num_items_deleted | html %]</td></tr>
+    <tr><td>Number of records not deleted due to items on loan</td><td>[% num_errors | html %]</td></tr>
   [% END %]
-  <tr><td>Number of records changed back</td><td>[% num_reverted %]</td></tr>
-  <tr><td>Number of records ignored</td><td>[% num_ignored %]</td></tr>
+  <tr><td>Number of records changed back</td><td>[% num_reverted | html %]</td></tr>
+  <tr><td>Number of records ignored</td><td>[% num_ignored | html %]</td></tr>
   </table>
   [% END %]
 [% END %]
 <div class="pages">
     [% FOREACH page IN pages %]
       [% IF ( page.current_page ) %]
-      <span class="current">[% page.page_number %]</span>
+      <span class="current">[% page.page_number | html %]</span>
       [% ELSE %]
-      <a href="[% page.script_name %]?offset=[% page.offset %]">[% page.page_number %]</a>
+      <a href="[% page.script_name | html %]?offset=[% page.offset | html %]">[% page.page_number | html %]</a>
       [% END %]
     [% END %]
 </div>
   </tr>
   [% FOREACH batch_lis IN batch_list %]
     <tr>
-    <td>[% batch_lis.import_batch_id %]</td>
-    <td><a href="[% batch_lis.script_name %]?import_batch_id=[% batch_lis.import_batch_id %]">[% batch_lis.file_name %]</a></td>
-    <td>[% batch_lis.comments %]</td>
+    <td>[% batch_lis.import_batch_id | html %]</td>
+    <td><a href="[% batch_lis.script_name | html %]?import_batch_id=[% batch_lis.import_batch_id | html %]">[% batch_lis.file_name | html %]</a></td>
+    <td>[% batch_lis.comments | html %]</td>
     <td>[% IF ( batch_lis.record_type == 'auth' ) %]Authority[% ELSE %]Bibliographic[% END %]</td>
     <td>
       [% IF ( batch_lis.import_status == 'cleaned' ) %]
       [% ELSIF ( batch_lis.import_status == 'staged' ) %]
           Staged
       [% ELSE %]
-          [% batch_lis.import_status %]
+          [% batch_lis.import_status | html %]
       [% END %]
     </td>
-    <td>[% batch_lis.upload_timestamp %]</td>
-    <td>[% batch_lis.num_records %]</td>
-    <td>[% batch_lis.num_items %][% IF ( batch_lis.num_items ) %] <a href="[% batch_lis.script_name %]?import_batch_id=[% batch_lis.import_batch_id %]&amp;op=create_labels">(Create label batch)</a>[% END %]</td>
+    <td>[% batch_lis.upload_timestamp | html %]</td>
+    <td>[% batch_lis.num_records | html %]</td>
+    <td>[% batch_lis.num_items | html %][% IF ( batch_lis.num_items ) %] <a href="[% batch_lis.script_name | html %]?import_batch_id=[% batch_lis.import_batch_id | html %]&amp;op=create_labels">(Create label batch)</a>[% END %]</td>
     <td class="actions">
         [% IF ( batch_lis.can_clean ) %]
-          <form method="post" action="[% batch_lis.script_name %]" name="clean_batch_[% batch_lis.import_batch_id %]" id="clean_batch_[% batch_lis.import_batch_id %]" class="batch_form batch_clean" >
-            <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id %]" />
+          <form method="post" action="[% batch_lis.script_name | html %]" name="clean_batch_[% batch_lis.import_batch_id | html %]" id="clean_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_clean" >
+            <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
             <input type="hidden" name="op" value="clean-batch" />
             <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-eraser"></i> Clean</button>
           </form>
         [% ELSIF ( batch_lis.import_status == 'cleaned' ) %]
-          <form method="post" action="/cgi-bin/koha/tools/manage-marc-import.pl" name="delete_batch_[% batch_lis.import_batch_id %]" id="delete_batch_[% batch_lis.import_batch_id %]" class="batch_form batch_delete">
-            <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id %]" />
+          <form method="post" action="/cgi-bin/koha/tools/manage-marc-import.pl" name="delete_batch_[% batch_lis.import_batch_id | html %]" id="delete_batch_[% batch_lis.import_batch_id | html %]" class="batch_form batch_delete">
+            <input type="hidden" name="import_batch_id" value="[% batch_lis.import_batch_id | html %]" />
             <input type="hidden" name="op" value="delete-batch" />
             <button type="submit" class="btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button>
           </form>
 <div class="pages">
     [% FOREACH page IN pages %]
       [% IF ( page.current_page ) %]
-      <span class="current">[% page.page_number %]</span>
+      <span class="current">[% page.page_number | html %]</span>
       [% ELSE %]
-      <a href="[% page.script_name %]?offset=[% page.offset %]">[% page.page_number %]</a>
+      <a href="[% page.script_name | html %]?offset=[% page.offset | html %]">[% page.page_number | html %]</a>
       [% END %]
     [% END %]
 </div>
             <h3 id="marcPreviewLabel">MARC preview</h3>
         </div>
         <div class="modal-body">
-            <div id="loading"> <img src="[% interface %]/[% theme %]/img/spinner-small.gif" alt="" /> Loading </div>
+            <div id="loading"> <img src="[% interface | html %]/[% theme | html %]/img/spinner-small.gif" alt="" /> Loading </div>
         </div>
         <div class="modal-footer">
             <button class="btn btn-default" data-dismiss="modal" aria-hidden="true">Close</button>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-[% Asset.js("js/background-job-progressbar.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+[% Asset.js("js/background-job-progressbar.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
                         { "mDataProp": "matched" }
                     ],
                     "fnServerData": function ( sSource, aoData, fnCallback ) {
-                        aoData.push( { "name": "import_batch_id", "value": [% import_batch_id %] } );
+                        aoData.push( { "name": "import_batch_id", "value": [% import_batch_id | html %] } );
 
                         $.ajax({
                             'dataType': 'json',
             });
             $("#marcPreview").on("hidden", function(){
                 $("#marcPreviewLabel").html("");
-                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface %]/[% theme %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
+                $("#marcPreview .modal-body").html("<div id=\"loading\"><img src=\"[% interface | html %]/[% theme | html %]/img/spinner-small.gif\" alt=\"\" /> "+_("Loading")+"</div>");
             });
             $(".batch_form").on("submit",function(){
                 if( $(this).hasClass("batch_delete") ){
index e364588..d380a28 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -25,7 +26,7 @@
     <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo;
     [% IF ( template_name ) %]
         <a href="/cgi-bin/koha/tools/marc_modification_templates.pl">MARC modification templates</a>
-        &rsaquo; [% template_name %]
+        &rsaquo; [% template_name | html %]
     [% ELSE %]
         MARC modification templates
     [% END %]
@@ -53,7 +54,7 @@
 
                 [% IF ( template_id == '' ) %]
 
-                    <h2>MARC modification templates [% template_id %]</h2>
+                    <h2>MARC modification templates [% template_id | html %]</h2>
 
                     <table id="templatest">
                         <thead>
                         <tbody>
                             [% FOREACH TemplatesLoo IN TemplatesLoop %]
                                 <tr>
-                                    <td>[% TemplatesLoo.name %]</td>
+                                    <td>[% TemplatesLoo.name | html %]</td>
                                     <td class="actions">
-                                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/marc_modification_templates.pl?template_id=[% TemplatesLoo.template_id %]&amp;op=select_template" ><i class="fa fa-fw fa-pencil"></i> Edit actions</a>
-                                        <a class="btn btn-default btn-xs duplicate_template" href="#" data-toggle="modal" data-template_id="[% TemplatesLoo.template_id %]" data-target="#createTemplate"><i class="fa fa-fw fa-copy"></i> Duplicate</a>
-                                        <a class="btn btn-default btn-xs delete_template" href="/cgi-bin/koha/tools/marc_modification_templates.pl?template_id=[% TemplatesLoo.template_id %]&amp;op=delete_template"><i class="fa fa-fw fa-trash"></i> Delete</a>
+                                        <a class="btn btn-default btn-xs" href="/cgi-bin/koha/tools/marc_modification_templates.pl?template_id=[% TemplatesLoo.template_id | html %]&amp;op=select_template" ><i class="fa fa-fw fa-pencil"></i> Edit actions</a>
+                                        <a class="btn btn-default btn-xs duplicate_template" href="#" data-toggle="modal" data-template_id="[% TemplatesLoo.template_id | html %]" data-target="#createTemplate"><i class="fa fa-fw fa-copy"></i> Duplicate</a>
+                                        <a class="btn btn-default btn-xs delete_template" href="/cgi-bin/koha/tools/marc_modification_templates.pl?template_id=[% TemplatesLoo.template_id | html %]&amp;op=delete_template"><i class="fa fa-fw fa-trash"></i> Delete</a>
                                     </td>
                                 </tr>
                             [% END %]
@@ -78,7 +79,7 @@
 
                 [% ELSE %]
 
-                    <h2>Actions for <i>[% template_name %]</i></h2>
+                    <h2>Actions for <i>[% template_name | html %]</i></h2>
 
                     [% IF ( ActionsLoop ) %]
 
                                 [% FOREACH ActionsLoo IN ActionsLoop %]
                                     <tr>
                                         <td class="actions">
-                                            <a title="Move action up" href="marc_modification_templates.pl?op=move_action&amp;where=up&amp;template_id=[% ActionsLoo.template_id %]&amp;mmta_id=[% ActionsLoo.mmta_id %]">
+                                            <a title="Move action up" href="marc_modification_templates.pl?op=move_action&amp;where=up&amp;template_id=[% ActionsLoo.template_id | html %]&amp;mmta_id=[% ActionsLoo.mmta_id | html %]">
                                                 <i class="fa fa-arrow-up fa-lg order-control"></i>
                                             </a>
 
-                                            <a title="Move action to top" href="marc_modification_templates.pl?op=move_action&amp;where=top&amp;template_id=[% ActionsLoo.template_id %]&amp;mmta_id=[% ActionsLoo.mmta_id %]">
+                                            <a title="Move action to top" href="marc_modification_templates.pl?op=move_action&amp;where=top&amp;template_id=[% ActionsLoo.template_id | html %]&amp;mmta_id=[% ActionsLoo.mmta_id | html %]">
                                                 <i class="fa fa-arrow-up fa-lg overline order-control"></i>
                                             </a>
 
-                                            <a title="Move action to bottom" href="marc_modification_templates.pl?op=move_action&amp;where=bottom&amp;template_id=[% ActionsLoo.template_id %]&amp;mmta_id=[% ActionsLoo.mmta_id %]">
+                                            <a title="Move action to bottom" href="marc_modification_templates.pl?op=move_action&amp;where=bottom&amp;template_id=[% ActionsLoo.template_id | html %]&amp;mmta_id=[% ActionsLoo.mmta_id | html %]">
                                                 <i class="fa fa-arrow-down fa-lg underline order-control"></i>
                                             </a>
 
-                                            <a title="Move action down" href="marc_modification_templates.pl?op=move_action&amp;where=down&amp;template_id=[% ActionsLoo.template_id %]&amp;mmta_id=[% ActionsLoo.mmta_id %]">
+                                            <a title="Move action down" href="marc_modification_templates.pl?op=move_action&amp;where=down&amp;template_id=[% ActionsLoo.template_id | html %]&amp;mmta_id=[% ActionsLoo.mmta_id | html %]">
                                                 <i class="fa fa-arrow-down fa-lg order-control"></i>
                                             </a>
                                         </td>
 
-                                        <td>[% ActionsLoo.ordering %]</td>
+                                        <td>[% ActionsLoo.ordering | html %]</td>
                                         <td>
                                             [% IF ( ActionsLoo.action_delete_field ) %] Delete [% END %]
                                             [% IF ( ActionsLoo.action_add_field ) %] Add new [% END %]
 
                                             field
 
-                                            [% ActionsLoo.from_field %][% IF ( ActionsLoo.from_subfield ) %]$[% ActionsLoo.from_subfield %][% END %]
+                                            [% ActionsLoo.from_field | html %][% IF ( ActionsLoo.from_subfield ) %]$[% ActionsLoo.from_subfield | html %][% END %]
 
                                             [% IF ( ActionsLoo.field_value ) %]
-                                                with value <i>[% ActionsLoo.field_value %]</i>
+                                                with value <i>[% ActionsLoo.field_value | html %]</i>
                                             [% END %]
 
                                             [% IF ( ActionsLoo.to_field ) %]
-                                                to [% ActionsLoo.to_field %][% IF ( ActionsLoo.to_subfield ) %]$[% ActionsLoo.to_subfield %][% END %]
+                                                to [% ActionsLoo.to_field | html %][% IF ( ActionsLoo.to_subfield ) %]$[% ActionsLoo.to_subfield | html %][% END %]
 
                                                 [% IF ( ActionsLoo.to_regex_search ) %]
-                                                     using RegEx s<strong>/[% ActionsLoo.to_regex_search %]/[% ActionsLoo.to_regex_replace %]/[% ActionsLoo.to_regex_modifiers %]</strong>
+                                                     using RegEx s<strong>/[% ActionsLoo.to_regex_search | html %]/[% ActionsLoo.to_regex_replace | html %]/[% ActionsLoo.to_regex_modifiers | html %]</strong>
                                                 [% END %]
                                             [% END %]
 
                                                 [% IF ( ActionsLoo.conditional_if ) %] if [% END %]
                                                 [% IF ( ActionsLoo.conditional_unless ) %] unless [% END %]
 
-                                                [% ActionsLoo.conditional_field %][% IF ( ActionsLoo.conditional_subfield ) %]$[% ActionsLoo.conditional_subfield %][% END %]
+                                                [% ActionsLoo.conditional_field | html %][% IF ( ActionsLoo.conditional_subfield ) %]$[% ActionsLoo.conditional_subfield | html %][% END %]
 
                                                 [% IF ( ActionsLoo.conditional_comparison_exists ) %] exists [% END %]
                                                 [% IF ( ActionsLoo.conditional_comparison_not_exists ) %] does not exist [% END %]
                                                 [% IF ( ActionsLoo.conditional_comparison_not_equals ) %] does not match [% END %]
 
                                                 [% IF ( ActionsLoo.conditional_regex ) %] RegEx m/[% END %]
-                                                <strong>[% ActionsLoo.conditional_value %]</strong>
+                                                <strong>[% ActionsLoo.conditional_value | html %]</strong>
                                                 [% IF ( ActionsLoo.conditional_regex ) %]/[% END %]
                                             [% END %]
                                         </td>
-                                        <td>[% ActionsLoo.description %]</td>
+                                        <td>[% ActionsLoo.description | html %]</td>
                                         <td>
                                             <a class="btn btn-default btn-xs" href="#modaction" onclick='editAction(
-                                                            "[% ActionsLoo.mmta_id |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.ordering |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.action |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.field_number |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.from_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.from_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.field_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.to_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.to_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.to_regex_search |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.to_regex_replace |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.to_regex_modifiers |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional_comparison |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.conditional_regex |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]",
-                                                            "[% ActionsLoo.description |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]"
+                                                            "[% ActionsLoo.mmta_id |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.ordering |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.action |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.field_number |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.from_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.from_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.field_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.to_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.to_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.to_regex_search |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.to_regex_replace |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.to_regex_modifiers |replace('\\\\', '\\\\') |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional_field |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional_subfield |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional_comparison |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional_value |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.conditional_regex |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]",
+                                                            "[% ActionsLoo.description |replace('\\\\', '\\\\') |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') | html %]"
                                                         );updateAllEvery();'><i class="fa fa-pencil"></i> Edit</a>
                                         </td>
                                         <td>
-                                            <a class="btn btn-default btn-xs" href="marc_modification_templates.pl?template_id=[% ActionsLoo.template_id %]&op=delete_action&mmta_id=[% ActionsLoo.mmta_id %]" onclick="return confirmDeleteAction();"><i class="fa fa-trash"></i> Delete</a>
+                                            <a class="btn btn-default btn-xs" href="marc_modification_templates.pl?template_id=[% ActionsLoo.template_id | html %]&op=delete_action&mmta_id=[% ActionsLoo.mmta_id | html %]" onclick="return confirmDeleteAction();"><i class="fa fa-trash"></i> Delete</a>
                                         </td>
                                     </tr>
                                 [% END # /FOREACH ActionsLoo %]
                                 </span>
                             </span>
 
-                            <input type="hidden" name="template_id" value="[% template_id %]" />
+                            <input type="hidden" name="template_id" value="[% template_id | html %]" />
                             <input type="hidden" name="mmta_id" id="mmta_id" />
                             <input type="hidden" name="op" value="add_action" />
 
                                 <select name="template_id" id="duplicate_a_template">
                                     <option value=""> -- None --</option>
                                     [% FOREACH TemplatesLoo IN TemplatesLoop %]
-                                        <option value="[% TemplatesLoo.template_id %]"> [% TemplatesLoo.name %]</option>
+                                        <option value="[% TemplatesLoo.template_id | html %]"> [% TemplatesLoo.name | html %]</option>
                                     [% END %]
                                 </select>
                                 <input type="hidden" name="duplicate_current_template" id="duplicate_current_template" />
   </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         var MSG_MMT_SUBFIELDS_MATCH = _("Both subfield values should be filled or empty.");
         var MSG_MMT_DESTINATION_REQUIRED = _("The destination should be filled.");
         var MSG_MMT_EDIT_ACTION = _("Edit action %s");
         var MSG_MMT_UPDATE_ACTION = _("Update action");
     </script>
-    [% Asset.js("js/marc_modification_templates.js") %]
+    [% Asset.js("js/marc_modification_templates.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index c00a1a5..94e8050 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,7 +7,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; Tools &rsaquo; Batch patron modification</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_modborrowers" class="tools">
@@ -42,7 +43,7 @@
                                 <select id="patron_list_id" name="patron_list_id">
                                     <option value=""></option>
                                     [% FOREACH pl IN patron_lists %]
-                                        <option value="[% pl.patron_list_id %]">[% pl.name %]</option>
+                                        <option value="[% pl.patron_list_id | html %]">[% pl.name | html %]</option>
                                     [% END %]
                                 </select>
                             </li>
@@ -55,7 +56,7 @@
                         <ol>
                             <li>
                               <label for="cardnumberlist">Card number list (one cardnumber per line): </label>
-                              <textarea rows="10" cols="30" id="cardnumberlist" name="cardnumberlist">[% cardnumberlist %]</textarea>
+                              <textarea rows="10" cols="30" id="cardnumberlist" name="cardnumberlist">[% cardnumberlist | html %]</textarea>
                             </li>
                         </ol>
                     </fieldset>
@@ -68,7 +69,7 @@
                 [% END %]
 
                 [% IF ( op == 'show') && (!borrowers) && (!notfoundcardnumbers) # Alert if no patrons given%]
-                    [% op = 'noshow' # Change op to prevent display in code below %]
+                    [% op = 'noshow' # Change op to prevent display in code below | html %]
                     <h1>Batch patrons modification</h1>
                     <div class="dialog alert">
                         <p>No patron card numbers given.</p>
@@ -92,7 +93,7 @@
                             </thead>
                             <tbody>
                                 [% FOREACH notfoundcardnumber IN notfoundcardnumbers %]
-                                    <tr><td>[% notfoundcardnumber.cardnumber %]</td></tr>
+                                    <tr><td>[% notfoundcardnumber.cardnumber | html %]</td></tr>
                                 [% END %]
                             </tbody>
                         </table>
                             [% FOREACH error IN errors %]
                                 [% IF ( error.error == 'can_not_update' ) %]
                                     <li>Can not update patron.
-                                    [% IF ( error.cardnumber ) %] Cardnumber:  [% error.cardnumber %] [% END %]
-                                    (Borrowernumber: [% error.borrowernumber %])
+                                    [% IF ( error.cardnumber ) %] Cardnumber:  [% error.cardnumber | html %] [% END %]
+                                    (Borrowernumber: [% error.borrowernumber | html %])
                                     </li>
                                 [% ELSE %]
-                                    <li>[% error.error %]</li>
+                                    <li>[% error.error | html %]</li>
                                 [% END %]
                             [% END %]
                             </ul>
                                                 <th>Circulation note</th>
                                                 <th>Opac Note</th>
                                                 [% FOREACH attrh IN attributes_header %]
-                                                    <th>[% attrh.attribute %]</th>
+                                                    <th>[% attrh.attribute | html %]</th>
                                                 [% END %]
                                             </tr>
                                         </thead>
                                             [% FOREACH borrower IN borrowers %]
                                                 <tr>
                                                     [% IF ( op == 'show' ) %]
-                                                        <td><input type="checkbox" name="borrowernumber" value="[% borrower.borrowernumber %]" checked="checked" /></td>
+                                                        <td><input type="checkbox" name="borrowernumber" value="[% borrower.borrowernumber | html %]" checked="checked" /></td>
                                                     [% END %]
-                                                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber %]">[% borrower.cardnumber %]</a></td>
-                                                    <td>[% borrower.surname %]</td>
-                                                    <td>[% borrower.firstname %]</td>
-                                                    <td>[% Branches.GetName( borrower.branchcode ) %]</td>
-                                                    <td>[% borrower.category_description %]</td>
-                                                    <td>[% borrower.city %]</td>
-                                                    <td>[% borrower.state %]</td>
-                                                    <td>[% borrower.zipcode %]</td>
-                                                    <td>[% borrower.country %]</td>
-                                                    <td><span title="[% borrower.dateenrolled %]">[% borrower.dateenrolled | $KohaDates %]</span></td>
-                                                    <td><span title="[% borrower.dateexpiry %]">[% borrower.dateexpiry | $KohaDates %]</span></td>
-                                                    <td>[% borrower.borrowernotes %]</td>
-                                                    <td>[% borrower.opacnote %]</td>
+                                                    <td><a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrower.borrowernumber | html %]">[% borrower.cardnumber | html %]</a></td>
+                                                    <td>[% borrower.surname | html %]</td>
+                                                    <td>[% borrower.firstname | html %]</td>
+                                                    <td>[% Branches.GetName( borrower.branchcode ) | html %]</td>
+                                                    <td>[% borrower.category_description | html %]</td>
+                                                    <td>[% borrower.city | html %]</td>
+                                                    <td>[% borrower.state | html %]</td>
+                                                    <td>[% borrower.zipcode | html %]</td>
+                                                    <td>[% borrower.country | html %]</td>
+                                                    <td><span title="[% borrower.dateenrolled | html %]">[% borrower.dateenrolled | $KohaDates %]</span></td>
+                                                    <td><span title="[% borrower.dateexpiry | html %]">[% borrower.dateexpiry | $KohaDates %]</span></td>
+                                                    <td>[% borrower.borrowernotes | html %]</td>
+                                                    <td>[% borrower.opacnote | html %]</td>
                                                     [% FOREACH pa IN borrower.patron_attributes %]
                                                         [% IF ( pa.code ) %]
-                                                            <td>[% pa.code %]=[% pa.value %]</td>
+                                                            <td>[% pa.code | html %]=[% pa.value | html %]</td>
                                                         [% ELSE %]
                                                             <td></td>
                                                         [% END %]
                                         [% FOREACH field IN fields %]
                                         <li>
                                             [% IF ( field.mandatory ) %]
-                                            <label for="[% field.name %]" class="required">
+                                            <label for="[% field.name | html %]" class="required">
                                             [% ELSE %]
-                                            <label for="[% field.name %]">
+                                            <label for="[% field.name | html %]">
                                             [% END %]
                                             [% SWITCH ( field.name ) %]
                                                 [% CASE 'surname' %]
                                             [% END %]
                                             </label>
                                             [% IF ( field.type == 'text' ) %]
-                                                <input type="text" name="[% field.name %]" value="" />
+                                                <input type="text" name="[% field.name | html %]" value="" />
                                             [% END %]
                                             [% IF ( field.type == 'select' ) %]
                                                 [% IF field.option.size %]
-                                                    <select name="[% field.name %]" >
+                                                    <select name="[% field.name | html %]" >
                                                         [% FOREACH opt IN field.option %]
-                                                            <option value="[% opt.value %]">[% opt.lib %]</option>
+                                                            <option value="[% opt.value | html %]">[% opt.lib | html %]</option>
                                                         [% END %]
                                                     </select>
                                                 [% ELSE %]
-                                                    There is no value defined for [% field.name %]
+                                                    There is no value defined for [% field.name | html %]
                                                 [% END %]
                                             [% END %]
                                             [% IF ( field.type == 'date' ) %]
-                                                <input type="text" name="[% field.name %]" id="[% field.name %]" value="" size="10" maxlength="10" class="datepicker" />
-                                                <a href="#"  class="clear-date" id="clear-date-[% field.name %]" ><i class="fa fa-fw fa-trash"></i> Clear</a>
+                                                <input type="text" name="[% field.name | html %]" id="[% field.name | html %]" value="" size="10" maxlength="10" class="datepicker" />
+                                                <a href="#"  class="clear-date" id="clear-date-[% field.name | html %]" ><i class="fa fa-fw fa-trash"></i> Clear</a>
                                             [% END %]
                                             [% IF field.mandatory %]
-                                                <input type="checkbox" title="This field is mandatory" name="disable_input" value="[% field.name %]" disabled="disabled" readonly="readonly" />
+                                                <input type="checkbox" title="This field is mandatory" name="disable_input" value="[% field.name | html %]" disabled="disabled" readonly="readonly" />
                                                 <span class="required">Required fields cannot be cleared</span>
                                             [% ELSE %]
-                                                <input type="checkbox" title="Check to delete this field" name="disable_input" value="[% field.name %]" />
+                                                <input type="checkbox" title="Check to delete this field" name="disable_input" value="[% field.name | html %]" />
                                             [% END %]
                                         </li>
                                         [% END %]
                                                     <select name="patron_attributes">
                                                         <option value=""></option>
                                                         [% FOREACH pac IN patron_attributes_codes %]
-                                                            <option value="[% pac.attribute_code %]" data-type="[% pac.type %]" data-category="[% pac.category_lib %]">[% pac.attribute_lib %]</option>
+                                                            <option value="[% pac.attribute_code | html %]" data-type="[% pac.type | html %]" data-category="[% pac.category_lib | html %]">[% pac.attribute_lib | html %]</option>
                                                         [% END %]
                                                     </select>
                                                 </label>
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         var patron_attributes_lib = new Array();
         var patron_attributes_values = new Array();
                 values = new Array();
                 lib = new Array();
                 [% FOREACH option IN pav.options %]
-                    values.push("[% option.lib %]");
-                    lib.push("[% option.authorised_value %]");
+                    values.push("[% option.lib | html %]");
+                    lib.push("[% option.authorised_value | html %]");
                 [% END %]
-                patron_attributes_lib["[% pav.attribute_code %]"] = values;
-                patron_attributes_values["[% pav.attribute_code %]"] = lib;
+                patron_attributes_lib["[% pav.attribute_code | html %]"] = values;
+                patron_attributes_values["[% pav.attribute_code | html %]"] = lib;
             [% END %]
 
             $('select[name="patron_attributes"]').change(function() {
index 8dc1df0..2afb535 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
@@ -19,7 +20,7 @@
     <div id="yui-main">
     <div class="yui-b">
 
-        <h1>Defining [% IF ( branch ) %]overdue actions for [% Branches.GetName( branch ) %][% ELSE %]default overdue actions[% END %]</h1>
+        <h1>Defining [% IF ( branch ) %]overdue actions for [% Branches.GetName( branch ) | html %][% ELSE %]default overdue actions[% END %]</h1>
         <div class="help">
             <p>Delay is the number of days after a checkout is due before an action is triggered. </p>
             <p>If you want Koha to trigger an action (send a letter or restrict a member), a delay value is required.</p>
                 <p>The following errors were found. Please correct them and submit again:</p>
                 <ul>
                 [% IF ( ERRORDELAY ) %]
-                    <li>Delay [% ERRORDELAY %] for [% BORERR %] patron category has some unexpected characters. There should be only numerical characters. </li>
+                    <li>Delay [% ERRORDELAY | html %] for [% BORERR | html %] patron category has some unexpected characters. There should be only numerical characters. </li>
                 [% END %]
                 [% IF ( ERRORUSELESSDELAY ) %]
-                    <li>No letter or restriction action specified for delay [% ERRORUSELESSDELAY %] for [% BORERR %] patron category.  If a delay is supplied, either a letter, restrict action, or both should be specified.</li>
+                    <li>No letter or restriction action specified for delay [% ERRORUSELESSDELAY | html %] for [% BORERR | html %] patron category.  If a delay is supplied, either a letter, restrict action, or both should be specified.</li>
                 [% END %]
                 [% IF ( ERRORORDER ) %]
-                    <li>The first notice's delay should be less than the second, which should be less than the third for the <strong>[% BORERR %]</strong> patron category </li>
+                    <li>The first notice's delay should be less than the second, which should be less than the third for the <strong>[% BORERR | html %]</strong> patron category </li>
                 [% END %]
                 </ul>
             </div>
             [% IF ( table ) %]
             <form method="post" action="/cgi-bin/koha/tools/overduerules.pl">
                 <input type="hidden" name="op" value="save" />
-                <input type="hidden" name="branch" value="[% branch %]" />
-                <h3>Rules for overdue actions: [% IF ( branch ) %][% Branches.GetName( branch ) %][% ELSE %] default library [% END %]</h3>
+                <input type="hidden" name="branch" value="[% branch | html %]" />
+                <h3>Rules for overdue actions: [% IF ( branch ) %][% Branches.GetName( branch ) | html %][% ELSE %] default library [% END %]</h3>
                     [% IF ( datasaved ) %]<div class="dialog message">Changes saved.</div> [% END %]
 
   <div id="rulestabs" class="toptabs">
     <ul class="ui-tabs-nav">
       [% FOR tab IN tabs %]
-          <li><a href="#[% tab.id %]" class="tab [% tab.id %]" data-number="[% tab.number %]"></a></li>
+          <li><a href="#[% tab.id | html %]" class="tab [% tab.id | html %]" data-number="[% tab.number | html %]"></a></li>
       [% END %]
     </ul>
     [% FOR tab IN tabs %]
-      <div id="[% tab.id %]">
+      <div id="[% tab.id | html %]">
         <table>
           <thead>
             <tr>
@@ -86,7 +87,7 @@
                   [% CASE 'phone' %]
                     Phone
                   [% CASE %]
-                    [% mtt %]
+                    [% mtt | html %]
                   [% END %]
                 </th>
               [% END %]
           <tbody>
           [% FOREACH value IN tab.values %]
             <tr>
-              <th scope="row">[% value.line %]</th>
+              <th scope="row">[% value.line | html %]</th>
               <td>
-              <input type="number" min="1" name="delay[% tab.number %]-[% value.overduename %]" value="[% value.delay %]" />
+              <input type="number" min="1" name="delay[% tab.number | html %]-[% value.overduename | html %]" value="[% value.delay | html %]" />
               </td>
               <td>
-                <select name="letter[% tab.number %]-[% value.overduename %]">
+                <select name="letter[% tab.number | html %]-[% value.overduename | html %]">
                   <option value="">No notice</option>
                   [% FOREACH letter IN letters %]
                     [% IF letter.code == value.selected_lettercode %]
-                      <option value="[% letter.code %]" selected="selected">[% letter.name %]</option>
+                      <option value="[% letter.code | html %]" selected="selected">[% letter.name | html %]</option>
                     [% ELSE %]
-                      <option value="[% letter.code %]">[% letter.name %]</option>
+                      <option value="[% letter.code | html %]">[% letter.name | html %]</option>
                     [% END %]
                   [% END %]
                 </select>
               </td>
               <td>
               [% IF ( value.debarred ) %]
-                <input type="checkbox" name="debarred[% tab.number %]-[% value.overduename %]" checked="checked" value="1" />
+                <input type="checkbox" name="debarred[% tab.number | html %]-[% value.overduename | html %]" checked="checked" value="1" />
               [% ELSE %]
-                <input type="checkbox" name="debarred[% tab.number %]-[% value.overduename %]" value="1" />
+                <input type="checkbox" name="debarred[% tab.number | html %]-[% value.overduename | html %]" value="1" />
               [% END %]
               </td>
               [% FOREACH mtt IN value.message_transport_types %]
                 <td>
                   [% IF mtt.selected %]
-                    <input type="checkbox" name="mtt[% tab.number %]-[% value.overduename %]" value="[% mtt.value %]" checked="checked" />
+                    <input type="checkbox" name="mtt[% tab.number | html %]-[% value.overduename | html %]" value="[% mtt.value | html %]" checked="checked" />
                   [% ELSE %]
                     [% IF mtt.value == "sms" and not Koha.Preference("SMSSendDriver") %]
-                      <input type="checkbox" name="mtt[% tab.number %]-[% value.overduename %]" value="[% mtt.value %]" disabled="disabled" />
+                      <input type="checkbox" name="mtt[% tab.number | html %]-[% value.overduename | html %]" value="[% mtt.value | html %]" disabled="disabled" />
                     [% ELSIF mtt.value == "phone" and not Koha.Preference("TalkingTechItivaPhoneNotification") %]
-                      <input type="checkbox" name="mtt[% tab.number %]-[% value.overduename %]" value="[% mtt.value %]" disabled="disabled" />
+                      <input type="checkbox" name="mtt[% tab.number | html %]-[% value.overduename | html %]" value="[% mtt.value | html %]" disabled="disabled" />
                     [% ELSE %]
-                      <input type="checkbox" name="mtt[% tab.number %]-[% value.overduename %]" value="[% mtt.value %]" />
+                      <input type="checkbox" name="mtt[% tab.number | html %]-[% value.overduename | html %]" value="[% mtt.value | html %]" />
                     [% END %]
                   [% END %]
                 </td>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     <script type="text/javascript">
         var tab_map = { "1" : _("First"), "2" : _("Second"), "3" : _("Third")};
         $(document).ready(function() {
index d0a69b0..45e3c48 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -34,8 +35,8 @@
             [% END %]
                <ul class="data">
                    <li>Unpacking completed</li>
-                  <li>[% TOTAL %] directories scanned.</li>
-                    <li>[% HANDLED %] directories processed.</li>
+                  <li>[% TOTAL | html %] directories scanned.</li>
+                    <li>[% HANDLED | html %] directories processed.</li>
                 </ul>
 
                 [% FOREACH COUNT IN COUNTS %]
@@ -46,7 +47,7 @@
                             <tr><th>File name</th><th>Card number</th><th>Result</th></tr>
                         </thead>
                         <tbody>
-                        [% IF ( COUNT.TCOUNTS ) %]<li>[% COUNT.TCOUNTS %] image(s) moved into the database:</li>[% END %]
+                        [% IF ( COUNT.TCOUNTS ) %]<li>[% COUNT.TCOUNTS | html %] image(s) moved into the database:</li>[% END %]
                             [% FOREACH filename IN COUNT.filenames %]
                                 <tr>
                                 <td>[% filename.source | html %]</td>
@@ -60,7 +61,7 @@
                                         [% ELSIF ( filerror.CORERR ) %]<b>ERROR:</b> Image not imported because the image file is corrupted.
                                         [% ELSIF ( filerror.OPNERR ) %]<b>ERROR:</b> Image not imported because Koha was unable to open the image for reading.
                                         [% ELSIF ( filerror.OVRSIZ ) %]<b>ERROR:</b> Image not imported because the image file is too big (see online help for maximum size).
-                                        [% ELSIF ( filerror.CRDFIL ) %]<b>ERROR:</b> Image not imported ([% filerror.CRDFIL %] missing).
+                                        [% ELSIF ( filerror.CRDFIL ) %]<b>ERROR:</b> Image not imported ([% filerror.CRDFIL | html %] missing).
                                         [% ELSIF ( filerror.CARDNUMBER_DOES_NOT_EXIST ) %]<b>ERROR:</b> Image not imported because this patron does not exist in the database.
                                         [% ELSE %]<b>ERROR:</b> Image not imported because of an unknown error. Please refer to the error log for more details.
                                         [% END %]
@@ -75,7 +76,7 @@
                 [% END %]
 <ul>
                 [% IF ( borrowernumber ) %]
-                    <li><a id="member" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber %]">Return to patron detail</a></li>
+                    <li><a id="member" href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]">Return to patron detail</a></li>
                 [% ELSE %]
                     <li><a id="uploadmore" href="/cgi-bin/koha/tools/picture-upload.pl">Upload more images</a></li>
                     <li><a id="doneupload" href="/cgi-bin/koha/tools/tools-home.pl">Return to tools</a></li>
                         [% IF ( ERROR.NOTZIP ) %]<li><b>The upload file does not appear to be a zip file.  The extension is not '.zip'.</b></li>
                         [% ELSIF ( ERROR.NOWRITETEMP ) %]<li><b>This script is not able to create/write to the necessary temporary directory.</b></li>
                         [% ELSIF ( ERROR.EMPTYUPLOAD ) %]<li><b>The upload file appears to be empty.</b></li>
-                        [% ELSIF ( ERROR.OPNLINK ) %]<li><b>Cannot open [% ERROR.OPNLINK %] to read.<br />Please verify that it exists.</b></li>
-                        [% ELSIF ( ERROR.OPNIMG ) %]<li><b>Cannot open [% ERROR.OPNIMG %] to read.<br />Please verify that it exists.</b></li>
+                        [% ELSIF ( ERROR.OPNLINK ) %]<li><b>Cannot open [% ERROR.OPNLINK | html %] to read.<br />Please verify that it exists.</b></li>
+                        [% ELSIF ( ERROR.OPNIMG ) %]<li><b>Cannot open [% ERROR.OPNIMG | html %] to read.<br />Please verify that it exists.</b></li>
                         [% ELSIF ( ERROR.DELERR ) %]<li><b>Unrecognized or missing field delimiter.<br />Please verify that you are using either a single quote or a tab.</b></li>
-                        [% ELSIF ( ERROR.UZIPFAIL ) %]<li><b>[% ERROR.UZIPFAIL %] failed to unpack.<br />Please verify the integrity of the ZIP file and retry.</b></li>
-                        [% ELSE %]<li><b>[% ERROR.CORERR %] An unknown error has occurred.<br />Please review the error log for more details.</b></li>[% END %]
+                        [% ELSIF ( ERROR.UZIPFAIL ) %]<li><b>[% ERROR.UZIPFAIL | html %] failed to unpack.<br />Please verify the integrity of the ZIP file and retry.</b></li>
+                        [% ELSE %]<li><b>[% ERROR.CORERR | html %] An unknown error has occurred.<br />Please review the error log for more details.</b></li>[% END %]
                     [% END %]
                 </div>
                 [% END %]
                                 <li id="cardnum" style="display: none">
                             [% END %]
                                 <label for="cardnumber">Enter patron cardnumber: </label>
-                                <input type="text" id="cardnumber" name="cardnumber" value="[% cardnumber %]" size="15" />
+                                <input type="text" id="cardnumber" name="cardnumber" value="[% cardnumber | html %]" size="15" />
                                 <span class="required">Required</span>
                             </li>
                             <li class="required">
                         </ol>
                    </fieldset>
                     <fieldset class="action">
-                        <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                        <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                         <input type="hidden" name="op" value="Upload" />
                         <input type="submit" value="Upload" class="submit" />
                                                <a href="/cgi-bin/koha/tools/tools-home.pl" class="cancel">Cancel</a>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'str/members-menu.inc' %]
-    [% Asset.js("js/members-menu.js") %]
+    [% Asset.js("js/members-menu.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function() {
             $("#zipfile").click(function(){
index 199a958..787cce9 100644 (file)
@@ -6,16 +6,16 @@
         <div id="main">
             [% FOR m IN messages %]
                 [%# FIXME The message block does not appear at the top of the modal! %]
-                <div class="dialog [% m.type %]">
+                <div class="dialog [% m.type | html %]">
                     [% SWITCH m.code %]
                     [% CASE 'no_data_for_preview' %]You did not specify data for preview.
-                    [% CASE 'preview_not_available' %]Preview is not available for letters '[% m.letter_code %]'.
+                    [% CASE 'preview_not_available' %]Preview is not available for letters '[% m.letter_code | html %]'.
                     [% CASE 'not_checked_in_yet' %]Do not forget that the issue has not been checked in yet.
                     [% CASE 'not_checked_out_yet' %]Do not forget that the issue has not been checked out yet.
                     [% CASE 'no_checkout' %]This item is not checked out.
                     [% CASE 'no_item_or_no_patron' %]The item or the patron does not exist.
                     [% CASE 'no_hold' %]No hold is placed by this patron on this bibliographic record.
-                    [% CASE %][% m.code %]
+                    [% CASE %][% m.code | html %]
                     [% END %]
                 </div>
             [% END %]
index 5cf4ade..8f600aa 100644 (file)
@@ -1,11 +1,12 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Quote uploader</title>
     [% INCLUDE 'doc-head-close.inc' %]
-    [% Asset.css("css/uploader.css") %]
-    [% Asset.css("css/quotes.css") %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/uploader.css") | $raw %]
+    [% Asset.css("css/quotes.css") | $raw %]
+    [% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_quotes" class="tools">
@@ -74,9 +75,9 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.jeditable.mini.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.jeditable.mini.js") | $raw %]
     <script type="text/javascript">
         var oTable; //DataTable object
         $(document).ready(function() {
index 4013b3d..f59facc 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
     [% INCLUDE 'doc-head-open.inc' %]
     <title>Koha &rsaquo; Tools &rsaquo; Quote editor</title>
     [% INCLUDE 'doc-head-close.inc' %]
-    [% Asset.css("css/quotes.css") %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/quotes.css") | $raw %]
+    [% Asset.css("css/datatables.css") | $raw %]
 </head>
 
 <body id="tools_quotes" class="tools">
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/dataTables.fnReloadAjax.js") %]
-    [% Asset.js("lib/jquery/plugins/jquery.jeditable.mini.js") %]
+    [% Asset.js("lib/jquery/plugins/dataTables.fnReloadAjax.js") | $raw %]
+    [% Asset.js("lib/jquery/plugins/jquery.jeditable.mini.js") | $raw %]
     <script type="text/javascript">
         var oTable; /* oTable needs to be global */
         var sEmptyTable = _("No quotes available. Please use the 'Add quote' button to add a quote."); /* override the default message in datatables.inc */
index de39e41..94e633d 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -29,7 +30,7 @@
 <fieldset class="rows">
 <legend>Task scheduler</legend><ol>
 <li><span class="label">Current server time is:</span>
-[% time %]</li>
+[% time | html %]</li>
 <li><label for="starttime">Time:</label>
 <input type="text" name="starttime" id="starttime" value="" maxlength="5" size="5" /></li>
 <li><label for="startdate">Date: </label> <input type="text" size="10" id="startdate" name="startdate" value="" />
@@ -39,9 +40,9 @@
 <select name="report" id="report">
 [% FOREACH savedreport IN savedreports %]
     [% IF ( savedreport.selected ) %]
-        <option value="[% savedreport.id %]" selected="selected">[% savedreport.report_name %]</option>
+        <option value="[% savedreport.id | html %]" selected="selected">[% savedreport.report_name | html %]</option>
     [% ELSE %]
-        <option value="[% savedreport.id %]">[% savedreport.report_name %]</option>
+        <option value="[% savedreport.id | html %]">[% savedreport.report_name | html %]</option>
     [% END %]
 [% END %]
 </select>
 <input type="hidden" name="mode" value="job_change" />
 
 <tr>
-<td>[% JOB.TIME %]</td>
-<td>[% JOB.TAG %]</td>
+<td>[% JOB.TIME | html %]</td>
+<td>[% JOB.TAG | html %]</td>
 <td><input type="submit" name="delete" value="Delete" /></td>
 </tr>
-<input type="hidden" name="jobid" value="[% JOB.JOBID %]" />
+<input type="hidden" name="jobid" value="[% JOB.JOBID | html %]" />
 </form>
 [% END %]
 </table>[% END %]
@@ -94,7 +95,7 @@
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'calendar.inc' %]
     <script type="text/javascript">
         $(document).ready(function(){
index 89b71d3..678a9d6 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -16,7 +17,7 @@
 [% INCLUDE 'header.inc' %]
 
 <div id="breadcrumbs">
-    <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tools/manage-marc-import.pl">Manage staged MARC records</a> &rsaquo; <a href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% batchid %]">Batch [% batchid %]</a> &rsaquo; Compare matched records
+    <a href="/cgi-bin/koha/mainpage.pl">Home</a> &rsaquo; <a href="/cgi-bin/koha/tools/tools-home.pl">Tools</a> &rsaquo; <a href="/cgi-bin/koha/tools/manage-marc-import.pl">Manage staged MARC records</a> &rsaquo; <a href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% batchid | html %]">Batch [% batchid | html %]</a> &rsaquo; Compare matched records
 </div>
 
 <div id="doc3">
             <h1>Original</h1>
             [% IF ( ERROR_FORMATTED1 ) %]
                 <div class="dialog alert">
-                    <p>The biblionumber <em>[% BIBLIONUMBER %]</em> doesn't match any existing record.</p>
+                    <p>The biblionumber <em>[% BIBLIONUMBER | html %]</em> doesn't match any existing record.</p>
                 </div>
             [% ELSE %]
-                <h2>[% BIBLIOTITLE %]</h2>
-                <pre>[% MARC_FORMATTED1 %]</pre>
+                <h2>[% BIBLIOTITLE | html %]</h2>
+                <pre>[% MARC_FORMATTED1 | html %]</pre>
             [% END %]
         </div>
         <div id="col2" class="yui-u">
             <h1>Imported</h1>
             [% IF ( ERROR_FORMATTED2 ) %]
                 <div class="dialog alert">
-                    <p>The import id number <em>[% IMPORTID %]</em> doesn't match any existing record.</p>
+                    <p>The import id number <em>[% IMPORTID | html %]</em> doesn't match any existing record.</p>
                 </div>
             [% ELSE %]
-                <h2>[% IMPORTTITLE %]</h2>
-                <pre>[% MARC_FORMATTED2 %] </pre>
+                <h2>[% IMPORTTITLE | html %]</h2>
+                <pre>[% MARC_FORMATTED2 | html %] </pre>
             [% END %]
         </div>
     </div>
 
-<p><a href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% batchid %]">Return to staged MARC batch [% batchid %]</a></p>
+<p><a href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% batchid | html %]">Return to staged MARC batch [% batchid | html %]</a></p>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("lib/jsdiff/jsdiff.min.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("lib/jsdiff/jsdiff.min.js") | $raw %]
     <script type="text/javascript">
         $(document).ready(function(){
           var diff1 = $("#col1 pre").text();
index 29a49a8..58d114d 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -23,7 +24,7 @@
 [% IF ( uploadmarc ) %]
 <div id="toolbar" class="btn-toolbar">
         <a class="btn btn-default btn-sm" href="/cgi-bin/koha/tools/stage-marc-import.pl"><i class="fa fa-plus"></i> Stage MARC records</a>
-        <a class="btn btn-default btn-sm" href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% import_batch_id %]"><i class="fa fa-list-ul"></i> Manage staged records</a>
+        <a class="btn btn-default btn-sm" href="/cgi-bin/koha/tools/manage-marc-import.pl?import_batch_id=[% import_batch_id | html %]"><i class="fa fa-list-ul"></i> Manage staged records</a>
 </div>
 [% END %]
 
     [% CASE 'auth' %]
         <li>Processing authority records</li>
     [% END %]
-       <li>[% total %]  records in file</li>
-       <li>[% import_errors %] records not staged because of MARC error</li>
-       <li>[% staged %] records staged</li>
+       <li>[% total | html %]  records in file</li>
+       <li>[% import_errors | html %] records not staged because of MARC error</li>
+       <li>[% staged | html %] records staged</li>
     [% IF ( checked_matches ) %]
-       <li>[% matched %] records with at least one match in catalog per matching rule 
-        &quot;[% matcher_code %]&quot;</li>
+       <li>[% matched | html %] records with at least one match in catalog per matching rule 
+        &quot;[% matcher_code | html %]&quot;</li>
     [% ELSE %]
         [% IF ( matcher_failed ) %]
           <li>Record matching failed -- unable to retrieve selected matching rule.</li>
         [% END %]
     [% END %]
     [% IF record_type == 'biblio' %]
-        <li>[% num_items %] item records found and staged</li>
+        <li>[% num_items | html %] item records found and staged</li>
     [% END %]
        [% IF ( label_batch ) %]
-         <li>New label batch created: # [% label_batch %] </li>
+         <li>New label batch created: # [% label_batch | html %] </li>
     [% END %]
 </ul>
 [% ELSE %]
@@ -62,7 +63,7 @@
     <li>Select a MARC file to stage in the import reservoir.  It will be parsed, and each valid record staged for later import into the catalog.</li>
     <li>You can enter a name for this import. It may be useful, when creating a record, to remember where the suggested MARC data comes from!</li>
 </ul>
-<form method="post" action="[% SCRIPT_NAME %]" id="uploadfile" enctype="multipart/form-data">
+<form method="post" action="[% SCRIPT_NAME | html %]" id="uploadfile" enctype="multipart/form-data">
 <fieldset class="rows" id="uploadform">
 <legend>Stage records into the reservoir</legend>
 <ol>
@@ -88,7 +89,7 @@
     </div>
 </form>
 
-    <form method="post" id="processfile" action="[% SCRIPT_NAME %]" enctype="multipart/form-data">
+    <form method="post" id="processfile" action="[% SCRIPT_NAME | html %]" enctype="multipart/form-data">
 <fieldset class="rows">
         <input type="hidden" name="uploadedfileid" id="uploadedfileid" value="" />
         <input type="hidden" name="runinbackground" id="runinbackground" value="" />
             <option value='ISO2709'>MARC</option>
             <option value='MARCXML'>MARCXML</option>
             [% FOREACH p IN plugins %]
-                <option value="[% p.metadata.class %]">[% p.metadata.name %] ( other format via plugin)</option>
+                <option value="[% p.metadata.class | html %]">[% p.metadata.name | html %] ( other format via plugin)</option>
             [% END %]
         </select>
     </li>
           <select name="marc_modification_template_id" id="marc_modification_template_id">
             <option value="">Do not use.</option>
               [% FOREACH mmt IN MarcModificationTemplatesLoop %]
-                <option value="[% mmt.template_id %]">[% mmt.name %]</option>
+                <option value="[% mmt.template_id | html %]">[% mmt.name | html %]</option>
               [% END %]
           </select>
         </li>
     <select name="matcher" id="matcher">
        <option value="">Do not look for matching records</option> 
        [% FOREACH available_matcher IN available_matchers %]
-          <option value="[% available_matcher.matcher_id %]">[% available_matcher.code %] ([% available_matcher.description %])
+          <option value="[% available_matcher.matcher_id | html %]">[% available_matcher.code | html %] ([% available_matcher.description | html %])
           </option>
        [% END %]
     </select>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/background-job-progressbar.js") %]
-    [% Asset.js("js/file-upload.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/background-job-progressbar.js") | $raw %]
+    [% Asset.js("js/file-upload.js") | $raw %]
     <script type="text/javascript">
         var xhr;
         $(document).ready(function(){
index 2b0c0e3..a035ee1 100644 (file)
@@ -24,7 +24,7 @@
     [% END %]
 
 [% IF ( CAN_user_tools_moderate_comments ) %]
-    <dt><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments</a> [% IF ( pendingcomments ) %]<span class="number_box"><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">[% pendingcomments %]</a></span>[% END %]</dt>
+    <dt><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments</a> [% IF ( pendingcomments ) %]<span class="number_box"><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">[% pendingcomments | html %]</a></span>[% END %]</dt>
        <dd>Moderate patron comments. </dd>
     [% END %]
     
@@ -59,7 +59,7 @@
     [% END %]
 
     [% IF ( CAN_user_tools_moderate_tags ) %]
-    <dt><a href="/cgi-bin/koha/tags/review.pl">Tags</a> [% IF ( pendingtags ) %]<span class="number_box"><a href="/cgi-bin/koha/tags/review.pl">[% pendingtags %]</a></span>[% END %]</dt>
+    <dt><a href="/cgi-bin/koha/tags/review.pl">Tags</a> [% IF ( pendingtags ) %]<span class="number_box"><a href="/cgi-bin/koha/tags/review.pl">[% pendingtags | html %]</a></span>[% END %]</dt>
        <dd>Moderate patron tags</dd>
     [% END %]
 
index d5f7903..817fee9 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% SET footerjs = 1 %]
 [% INCLUDE 'doc-head-open.inc' %]
@@ -24,7 +25,7 @@
 [% IF ( uploadimage ) %]
 <p>Image upload results :</p>
 <ul>
-    <li>[% total %] images found</li>
+    <li>[% total | html %] images found</li>
     [% IF ( error ) %]
     <div class="dialog alert">
     [% IF ( error == 'UZIPFAIL' ) %]<p><b>Failed to unzip archive.<br />Please ensure you are uploading a valid zip file and try again.</b></p>
@@ -36,7 +37,7 @@
     </div>
     </li>
     [% END %]
-    <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber %]">View final record</a></li>
+    <li><a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% biblionumber | html %]">View final record</a></li>
        <li><a href="/cgi-bin/koha/tools/tools-home.pl">Back</a></li>
 </ul>
 <hr />
@@ -86,7 +87,7 @@
         <label for="image">Image file</label>
       </li>
       <li class="radio">
-        [% IF ( filetype == 'image' ) %]<span id="bibnum">[% ELSE %]<span id="bibnum" style="display: none">[% END %]<label for="biblionumber">Enter cover biblionumber: </label><input type="text" id="biblionumber" name="biblionumber" value="[% biblionumber %]" size="15" /></span>
+        [% IF ( filetype == 'image' ) %]<span id="bibnum">[% ELSE %]<span id="bibnum" style="display: none">[% END %]<label for="biblionumber">Enter cover biblionumber: </label><input type="text" id="biblionumber" name="biblionumber" value="[% biblionumber | html %]" size="15" /></span>
       </li>
     </ol>
   </fieldset>
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
-    [% Asset.js("js/background-job-progressbar.js") %]
-    [% Asset.js("js/file-upload.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
+    [% Asset.js("js/background-job-progressbar.js") | $raw %]
+    [% Asset.js("js/file-upload.js") | $raw %]
     <script type="text/javascript">
         function StartUpload() {
             if( $('#fileToUpload').prop('files').length == 0 ) return;
index 7972f01..5186923 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET footerjs = 1 %]
@@ -8,12 +9,12 @@
     <title>Koha &rsaquo; Tools &rsaquo; Upload</title>
 [% END %]
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 
 [% BLOCK plugin_pars %]
     [% IF plugin %]
         <input type="hidden" name="plugin" value="1" />
-        <input type="hidden" name="index" value="[% index %]" />
+        <input type="hidden" name="index" value="[% index | html %]" />
     [% END %]
 [% END %]
 
@@ -55,7 +56,7 @@
                     <option value=""></option>
                 [% END %]
                 [% FOREACH cat IN uploadcategories %]
-                    <option value="[% cat.code %]">[% cat.name %]</option>
+                    <option value="[% cat.code | html %]">[% cat.name | html %]</option>
                 [% END %]
                 </select>
             </li>
     <tbody>
     [% FOREACH record IN uploads %]
     <tr>
-        <td>[% record.filename %]</td>
-        <td>[% record.filesize %]</td>
-        <td>[% record.hashvalue %]</td>
-        <td>[% record.uploadcategorycode %]</td>
+        <td>[% record.filename | html %]</td>
+        <td>[% record.filesize | html %]</td>
+        <td>[% record.hashvalue | html %]</td>
+        <td>[% record.uploadcategorycode | html %]</td>
         [% IF !plugin %]
             <td>[% IF record.public %]Yes[% ELSE %]No[% END %]</td>
             <td>[% IF record.permanent %]No[% ELSE %]Yes[% END %]</td>
         [% END %]
         <td class="actions">
             [% IF plugin %]
-                <button class="btn btn-default btn-xs choose_entry" data-record-hashvalue="[% record.hashvalue %]"><i class="fa fa-plus"></i> Choose</button>
+                <button class="btn btn-default btn-xs choose_entry" data-record-hashvalue="[% record.hashvalue | html %]"><i class="fa fa-plus"></i> Choose</button>
             [% END %]
-            <button class="btn btn-default btn-xs download_entry" data-record-id="[% record.id %]"><i class="fa fa-download"></i> Download</button>
+            <button class="btn btn-default btn-xs download_entry" data-record-id="[% record.id | html %]"><i class="fa fa-download"></i> Download</button>
             [% IF record.owner == owner || CAN_user_tools_upload_manage %]
-                <button class="btn btn-default btn-xs delete_entry" data-record-id="[% record.id %]"><i class="fa fa-trash"></i> Delete</button>
+                <button class="btn btn-default btn-xs delete_entry" data-record-id="[% record.id | html %]"><i class="fa fa-trash"></i> Delete</button>
             [% END %]
         </td>
    </tr>
 <style type="text/css">
     #fileuploadstatus,#fileuploadfailed { display : none; }
     #fileuploadstatus { margin:.4em; }
-    #fileuploadprogress { width:150px;height:10px;border:1px solid #666;background:url('[% interface %]/[% theme %]/img/progress.png') -300px 0px no-repeat; }
+    #fileuploadprogress { width:150px;height:10px;border:1px solid #666;background:url('[% interface | html %]/[% theme | html %]/img/progress.png') -300px 0px no-repeat; }
 </style>
 
 
 </div>
 
 [% MACRO jsinclude BLOCK %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("js/file-upload.js") %]
+    [% Asset.js("js/file-upload.js") | $raw %]
     <script type="text/javascript">
         function StartUpload() {
             if( $('#fileToUpload').prop('files').length == 0 ) return;
         }
         function ClearField() {
             [% IF plugin %]
-                $(window.opener.document).find('#[% index %]').val( '' );
+                $(window.opener.document).find('#[% index | html %]').val( '' );
             [% END %]
         }
         function Choose(hashval) {
-            var res = '[% Koha.Preference('OPACBaseURL') %]';
+            var res = '[% Koha.Preference('OPACBaseURL') | html %]';
             res = res.replace( /\/$/, '');
             res = res + '/cgi-bin/koha/opac-retrieve-file.pl?id=' + hashval;
             [% IF index %]
-                $(window.opener.document).find('#[% index %]').val( res );
+                $(window.opener.document).find('#[% index | html %]').val( res );
             [% END %]
             window.close();
         }
                 "sPaginationType": "four_button"
             }));
             [% IF msg %]
-                ShowAlerts( [% msg %] );
+                ShowAlerts( [% msg | html %] );
             [% END %]
             $("#fileuploadcancel").hide();
             $("#public_cb").click(function() {
index b183dca..2656d96 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
@@ -33,7 +34,7 @@
 [%        CASE 'SYSTEMPREFERENCE' %]System prefs
 [%        CASE 'CRONJOBS' %]Cron jobs
 [%        CASE 'REPORTS'      %]Reports
-[%        CASE %][% module %]
+[%        CASE %][% module | html %]
 [%    END %]
 [% END %]
 
@@ -53,7 +54,7 @@
 [%        CASE 'ADDCIRCMESSAGE' %]Add circulation message
 [%        CASE 'DELCIRCMESSAGE' %]Delete circulation message
 [%        CASE 'Run'    %]Run
-[%        CASE %][% action %]
+[%        CASE %][% action | html %]
 [%    END %]
 [% END %]
 
@@ -63,7 +64,7 @@
 [%        CASE 'OPAC'        %]OPAC
 [%        CASE 'SIP'         %]SIP
 [%        CASE 'COMMANDLINE' %]Command-line
-[%        CASE %][% log_interface %]
+[%        CASE %][% log_interface | html %]
 [%    END %]
 [% END %]
 
@@ -84,7 +85,7 @@
                                <h1>Browse system logs</h1>
                                <form method="post" action="/cgi-bin/koha/tools/viewlog.pl">
                                        [% IF ( do_it ) %]
-                                               <input type="hidden" name="do_it" value="[% do_it %]" />
+                                               <input type="hidden" name="do_it" value="[% do_it | html %]" />
                                        [% END %]
                     <input type="hidden" name="src" value="[% src | html %]" />
                                        <fieldset class="rows">
                                     [% END %]
                                     [% FOREACH modx IN [ 'CATALOGUING' 'AUTHORITIES' 'MEMBERS' 'ACQUISITIONS' 'SERIAL' 'HOLDS' 'CIRCULATION' 'LETTER' 'FINES' 'SYSTEMPREFERENCE' 'CRONJOBS', 'REPORTS' ] %]
                                         [% IF modules.grep(modx).size %]
-                                            <option value="[% modx %]" selected="selected">[% PROCESS translate_log_module module=modx %]</option>
+                                            <option value="[% modx | html %]" selected="selected">[% PROCESS translate_log_module module=modx %]</option>
                                         [% ELSE %]
-                                            <option value="[% modx %]">[% PROCESS translate_log_module module=modx %]</option>
+                                            <option value="[% modx | html %]">[% PROCESS translate_log_module module=modx %]</option>
                                         [% END %]
                                     [% END %]
                                 </select>
 
                                     [% FOREACH actx IN [ 'ADD' 'DELETE' 'MODIFY' 'ISSUE' 'RETURN' 'RENEW' 'CREATE' 'CANCEL' 'SUSPEND' 'RESUME' 'ADDCIRCMESSAGE' 'DELCIRCMESSAGE' 'CHANGE PASS' 'Run' ] %]
                                         [% IF actions.grep(actx).size %]
-                                            <option value="[% actx %]" selected="selected">[% PROCESS translate_log_action action=actx %]</option>
+                                            <option value="[% actx | html %]" selected="selected">[% PROCESS translate_log_action action=actx %]</option>
                                         [% ELSE %]
-                                                <option value="[% actx %]">[% PROCESS translate_log_action action=actx %]</option>
+                                                <option value="[% actx | html %]">[% PROCESS translate_log_action action=actx %]</option>
                                         [% END %]
                                     [% END %]
                                 </select>
 
                                     [% FOREACH interf IN [ 'INTRANET' 'OPAC' 'SIP' 'COMMANDLINE' ] %]
                                         [% IF interfaces.grep(interf).size %]
-                                            <option value="[% interf %]" selected="selected">[% PROCESS translate_log_interface log_interface=interf %]</option>
+                                            <option value="[% interf | html %]" selected="selected">[% PROCESS translate_log_interface log_interface=interf %]</option>
                                         [% ELSE %]
-                                            <option value="[% interf %]">[% PROCESS translate_log_interface log_interface=interf %]</option>
+                                            <option value="[% interf | html %]">[% PROCESS translate_log_interface log_interface=interf %]</option>
                                         [% END %]
                                     [% END %]
                                 </select>
                                                                <input type="text" name="basename" id="basename" value="Export" />
                                                                <!--
                                                                        <label for="MIME" class="inline">Into an application:</label>
-                                                                       [% CGIextChoice %]
-                                                                       [% CGIsepChoice %]
+                                                                       [% CGIextChoice | html %]
+                                                                       [% CGIsepChoice | html %]
                                                                -->
-                                                               <input type="hidden" name="report_name" value="[% report_name %]" />
+                                                               <input type="hidden" name="report_name" value="[% report_name | html %]" />
                                                        </li>
                                                </ol>
                                        </fieldset>
                 [% END %]
                 [% IF ( do_it ) %]
                     [% IF ( total ) %]
-                        <h4>[% total %] lines found.</h4>
+                        <h4>[% total | html %] lines found.</h4>
                         <table>
                             <thead>
                                 <tr>
                             <tbody>
                             [% FOREACH loopro IN looprow %]
                                 <tr>
-                                    <td>[% loopro.timestamp %]</td>
+                                    <td>[% loopro.timestamp | html %]</td>
                                     <td>
                                         [% IF loopro.librarian %]
-                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopro.librarian.borrowernumber %]" title="display detail for this librarian."> [% IF ( loopro.librarian.firstname ) || ( loopro.librarian.surname ) %][% loopro.librarian.firstname %] [% loopro.librarian.surname %] ([% loopro.librarian.borrowernumber %]) [% ELSE %][% loopro.librarian.borrowernumber %][% END %]</a>
+                                            <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopro.librarian.borrowernumber | html %]" title="display detail for this librarian."> [% IF ( loopro.librarian.firstname ) || ( loopro.librarian.surname ) %][% loopro.librarian.firstname | html %] [% loopro.librarian.surname | html %] ([% loopro.librarian.borrowernumber | html %]) [% ELSE %][% loopro.librarian.borrowernumber | html %][% END %]</a>
                                         [% ELSE %]
-                                            [% loopro.user %]
+                                            [% loopro.user | html %]
                                         [% END %]
                                     </td>
                                     <td>[% PROCESS translate_log_module module=loopro.module %]</td>
                                     <td>
                                         [% IF ( loopro.module == 'MEMBERS' ) || ( loopro.module == 'CIRCULATION' ) || ( loopro.module == 'FINES' ) %]
                                             [% IF loopro.patron %]
-                                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopro.object %]" title="Display member details."> [% IF ( loopro.object ) %][% IF ( loopro.patron.firstname ) || ( loopro.patron.surname ) %][% loopro.patron.firstname %] [% loopro.patron.surname %] ([% loopro.object %]) [% ELSE %]Member [% loopro.object %][% END %][% END %] </a>
+                                                <a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% loopro.object | html %]" title="Display member details."> [% IF ( loopro.object ) %][% IF ( loopro.patron.firstname ) || ( loopro.patron.surname ) %][% loopro.patron.firstname | html %] [% loopro.patron.surname | html %] ([% loopro.object | html %]) [% ELSE %]Member [% loopro.object | html %][% END %][% END %] </a>
                                             [% ELSE %]
-                                                [% loopro.object %]
+                                                [% loopro.object | html %]
                                             [% END %]
                                         [% ELSE %]
                                                 [% IF ( loopro.module == 'CATALOGUING' ) %]
                                                     [% IF ( loopro.info.substr(0, 4) == 'item' ) %]
-                                                        <a href="/cgi-bin/koha/catalogue/moredetail.pl?item=[% loopro.object %]&amp;biblionumber=[% loopro.biblionumber %]&amp;bi=[% loopro.biblioitemnumber %]#item[% loopro.object %]">Item [% loopro.object %]</a>
+                                                        <a href="/cgi-bin/koha/catalogue/moredetail.pl?item=[% loopro.object | html %]&amp;biblionumber=[% loopro.biblionumber | html %]&amp;bi=[% loopro.biblioitemnumber | html %]#item[% loopro.object | html %]">Item [% loopro.object | html %]</a>
                                                     [% ELSIF ( loopro.info.substr(0, 6) == 'biblio' ) %]
-                                                        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopro.object %]" title="Display detail for this biblio">Biblio [% loopro.object %]</a>
+                                                        <a href="/cgi-bin/koha/catalogue/detail.pl?biblionumber=[% loopro.object | html %]" title="Display detail for this biblio">Biblio [% loopro.object | html %]</a>
                                                     [% ELSE %]
-                                                        [% loopro.object %]
+                                                        [% loopro.object | html %]
                                                     [% END %]
                                                 [% ELSE %]
                                                     [% IF ( loopro.module == 'SERIAL' ) %]
-                                                        <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% loopro.object %]">Subscription [% loopro.object %] </a>
+                                                        <a href="/cgi-bin/koha/serials/subscription-detail.pl?subscriptionid=[% loopro.object | html %]">Subscription [% loopro.object | html %] </a>
                                                     [% ELSE %]
                                                         [% IF ( loopro.module == 'AUTHORITIES' ) %]
-                                                            <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% loopro.object %]" title="Display detail for this authority">Authority [% loopro.object %]</a>
+                                                            <a href="/cgi-bin/koha/authorities/detail.pl?authid=[% loopro.object | html %]" title="Display detail for this authority">Authority [% loopro.object | html %]</a>
                                                         [% ELSE %]
-                                                            [% loopro.object %]
+                                                            [% loopro.object | html %]
                                                         [% END %]
                                                     [% END %]
                                                 [% END %]
                                     </td>
                                     <td>
                                         [% IF ( loopro.module == 'CIRCULATION' ) %]
-                                            <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% loopro.info %]&amp;biblionumber=[% loopro.biblionumber %]&amp;bi=[% loopro.biblioitemnumber %]#item[% loopro.info %]" title="Display detail for this item">Item [% loopro.barcode |html %]</a>
+                                            <a href="/cgi-bin/koha/catalogue/moredetail.pl?itemnumber=[% loopro.info | html %]&amp;biblionumber=[% loopro.biblionumber | html %]&amp;bi=[% loopro.biblioitemnumber | html %]#item[% loopro.info | html %]" title="Display detail for this item">Item [% loopro.barcode | html %]</a>
                                         [% ELSE %]
-                                            [% loopro.info |html %]
+                                            [% loopro.info | html %]
                                         [% END %]
                                     </td>
                                     <td>[% PROCESS translate_log_interface log_interface=loopro.interface %]</td>
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'calendar.inc' %]
-    [% Asset.js("js/tools-menu.js") %]
+    [% Asset.js("js/tools-menu.js") | $raw %]
 [% END %]
 
 [% INCLUDE 'intranet-bottom.inc' %]
index ae403c5..3377990 100644 (file)
 [% ELSE %]
 
                 [% IF ( multiple ) %]
-            <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html%]</em>: [% ELSE %]a list:[% END %]</h1>
+            <h1>Add [% total | html %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>: [% ELSE %]a list:[% END %]</h1>
                 [% ELSE %]
                         <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>[% ELSE %]a list:[% END %]</h1>
                 [% END %]
         <ul>
             [% FOREACH biblio IN biblios %]
-            <li> <span class="title">[% biblio.title |html %]</span>
-                [% IF ( biblio.author ) %]<span class="author"> [% biblio.author %] </span>[% END %]
+            <li> <span class="title">[% biblio.title | html %]</span>
+                [% IF ( biblio.author ) %]<span class="author"> [% biblio.author | html %] </span>[% END %]
             </li>
             [% END %]
                 </ul>
 
         <form name="f1" action="/cgi-bin/koha/virtualshelves/addbybiblionumber.pl" method="post">
-                        [% FOREACH biblio IN biblios %] <input type="hidden" name="biblionumber" value="[% biblio.biblionumber %]" />[% END %]
+                        [% FOREACH biblio IN biblios %] <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
             <input type="hidden" name="confirmed" value="1" />
-            [% IF ( shelfnumber ) %]<input type="hidden" name="shelfnumber" value="[% shelfnumber %]" />[% END %]
+            [% IF ( shelfnumber ) %]<input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]" />[% END %]
 
 [% UNLESS ( shelfnumber ) %]
 
                 [% IF private_shelves.count %]
                     <optgroup label="Private lists">
                         [% FOREACH private_shelf IN private_shelves %]
-                            <option value="[% private_shelf.shelfnumber %]">[% private_shelf.shelfname | html%]</option>
+                            <option value="[% private_shelf.shelfnumber | html %]">[% private_shelf.shelfname | html %]</option>
                         [% END %]
                     </optgroup>
                 [% END %]
                 [% IF private_shelves_shared_with_me.count %]
                     <optgroup label="Private lists shared with me">
                         [% FOREACH private_shelf IN private_shelves_shared_with_me %]
-                            <option value="[% private_shelf.shelfnumber %]">[% private_shelf.shelfname | html%]</option>
+                            <option value="[% private_shelf.shelfnumber | html %]">[% private_shelf.shelfname | html %]</option>
                         [% END %]
                     </optgroup>
                 [% END %]
                 [% IF public_shelves.count %]
                     <optgroup label="Public lists">
                         [% FOREACH public_shelf IN public_shelves %]
-                            <option value="[% public_shelf.shelfnumber %]">[% public_shelf.shelfname | html%]</option>
+                            <option value="[% public_shelf.shelfnumber | html %]">[% public_shelf.shelfname | html %]</option>
                         [% END %]
                     </optgroup>
                 [% END %]
             </select>
         </li>
     </ol>
-    [% FOREACH biblio IN biblios %]<input type="hidden" name="biblionumber" value="[% biblio.biblionumber %]" />[% END %]
+    [% FOREACH biblio IN biblios %]<input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
     [% UNLESS ( biblionumbers ) %]
-      <input type="hidden" name="biblionumber" value="[% biblionumber %]" />
+      <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
     [% ELSE %]
-      <input type="hidden" name="biblionumbers" value="[% biblionumbers %]" />
+      <input type="hidden" name="biblionumbers" value="[% biblionumbers | html %]" />
     [% END %]
     </fieldset>
 
         <label for="newvirtualshelf">
         List name:
         </label>
-        [% FOREACH biblio IN biblios %]<input type="hidden" name="biblionumber" value="[% biblio.biblionumber %]" />[% END %]
+        [% FOREACH biblio IN biblios %]<input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />[% END %]
         [% UNLESS ( biblionumbers ) %]
-              <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber %]" />
+              <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblionumber | html %]" />
         [% ELSE %]
-              <input type="hidden" name="biblionumbers" id="biblionumbers" value="[% biblionumbers %]" />
+              <input type="hidden" name="biblionumbers" id="biblionumbers" value="[% biblionumbers | html %]" />
         [% END %]
         <input type="text" name="newvirtualshelf" id="newvirtualshelf" size="40" />
         <input type="hidden" name="confirmed" value="1" />
index 96fa994..be9fd86 100644 (file)
@@ -5,14 +5,14 @@
 <body id="lists_downloadshelf" class="lists" style="padding:1em;">
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'unauthorized' %]
             You do not have permission to view this list.
         [% CASE 'does_not_exist' %]
             This list does not exist.
         [% CASE %]
-            [% m.code %]
+            [% m.code | html %]
         [% END %]
     </div>
 [% END %]
            <option value="ris">RIS</option>
            <option value="bibtex">BibTex</option>
            [% FOREACH csv_profile IN csv_profiles %]
-           <option value="[% csv_profile.export_format_id %]">CSV - [% csv_profile.profile %]</option>
+           <option value="[% csv_profile.export_format_id | html %]">CSV - [% csv_profile.profile | html %]</option>
            [% END %]
        </select>
        </li></ol>
        </fieldset>
-       <fieldset class="action"><input type="hidden" name="shelfid" value="[% shelfid %]" />
+       <fieldset class="action"><input type="hidden" name="shelfid" value="[% shelfid | html %]" />
        <input type="submit" name="save" value="Save" />  <a class="cancel close" href="#">Cancel</a>
        </fieldset>
     </form>
index de330d2..39ae699 100644 (file)
@@ -1,5 +1,6 @@
+[% USE raw %]
 <SUBJECT>
-Your list: [% shelfname %]
+Your list: [% shelfname | $raw %]
 <END_SUBJECT>
 
 [% USE HtmlToText %]
@@ -8,7 +9,7 @@ Your list: [% shelfname %]
 [% FILTER html2text %]
     <p>Hi,</p>
 
-    <p>Here is your list called [% shelfname %], sent from our online catalog.</p>
+    <p>Here is your list called [% shelfname | $raw %], sent from our online catalog.</p>
 
     <p>Please note that the attached file is a MARC bibliographic records file
     which can be imported into personal bibliographic software like EndNote,
@@ -22,30 +23,30 @@ Your list: [% shelfname %]
 [% FILTER html2text %]
 
     [% IF comment %]
-        <p>[% comment %]</p>
+        <p>[% comment | $raw %]</p>
         <hr/>
     [% END %]
     <ol>
     [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
         <li>
             <span>
-                [% BIBLIO_RESULT.title %]
+                [% BIBLIO_RESULT.title | $raw %]
                 [% IF ( BIBLIO_RESULT.subtitle.size ) %]
                   [% FOREACH subtitle IN BIBLIO_RESULT.subtitle %]
-                    [% subtitle.subfield %]
+                    [% subtitle.subfield | $raw %]
                   [% END %]
                 [% END %]
             </span>
 
             <p>
             [% IF ( BIBLIO_RESULT.HASAUTHORS ) %]
-            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author %][% END %]
+            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author | $raw %][% END %]
 
             [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
                 [% IF ( BIBLIO_RESULT.author ) %]; [% END %]
                 [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                     [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                        [% MARCAUTHOR_SUBFIELDS_LOO.separator %][% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                        [% MARCAUTHOR_SUBFIELDS_LOO.separator | $raw %][% MARCAUTHOR_SUBFIELDS_LOO.value | $raw %]
                     [% END %]
                     [% UNLESS ( loop.last ) %];[% END %]
                 [% END %]
@@ -56,7 +57,7 @@ Your list: [% shelfname %]
             [% IF ( BIBLIO_RESULT.ISBN ) %]
             <span>
                 ISBN: [% FOREACH isbn IN BIBLIO_RESULT.ISBN %]
-                          [% isbn %]
+                          [% isbn | $raw %]
                           [% UNLESS ( loop.last ) %]; [% END %]
                       [% END %]
             </span><br/>
@@ -64,92 +65,92 @@ Your list: [% shelfname %]
 
             [% IF BIBLIO_RESULT.publishercode %]
             <span>
-                Published by: [% BIBLIO_RESULT.publishercode %]
+                Published by: [% BIBLIO_RESULT.publishercode | $raw %]
                 [% IF ( BIBLIO_RESULT.publicationyear ) %]
-                    in [% BIBLIO_RESULT.publicationyear %]
+                    in [% BIBLIO_RESULT.publicationyear | $raw %]
                 [% END %]
                 [% IF ( BIBLIO_RESULT.pages ) %]
-                    , [% BIBLIO_RESULT.pages %]
+                    , [% BIBLIO_RESULT.pages | $raw %]
                 [% END %]
                 [% IF BIBLIO_RESULT.item('size') %]
-                , [% BIBLIO_RESULT.item('size') %]
+                , [% BIBLIO_RESULT.item('size') | html %]
                 [% END %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.collection %]
             <span>
-                Collection: [% BIBLIO_RESULT.seriestitle %]
+                Collection: [% BIBLIO_RESULT.seriestitle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.subject ) %]
             <span>
-                Subject: [% BIBLIO_RESULT.subject %]
+                Subject: [% BIBLIO_RESULT.subject | $raw %]
             <span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.copyrightdate ) %]
             <span>
-                Copyright year: [% BIBLIO_RESULT.copyrightdate %]
+                Copyright year: [% BIBLIO_RESULT.copyrightdate | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.notes ) %]
             <span>
-                Notes : [% BIBLIO_RESULT.notes %]
+                Notes : [% BIBLIO_RESULT.notes | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.unititle ) %]
             <span>
-                Unified title: [% BIBLIO_RESULT.unititle %]
+                Unified title: [% BIBLIO_RESULT.unititle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.serial ) %]
             <span>
-                Serial: [% BIBLIO_RESULT.serial %]
+                Serial: [% BIBLIO_RESULT.serial | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.dewey ) %]
             <span>
-                Dewey: [% BIBLIO_RESULT.dewey %]
+                Dewey: [% BIBLIO_RESULT.dewey | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.classification ) %]
             <span>
-                Classification: [% BIBLIO_RESULT.classification %]
+                Classification: [% BIBLIO_RESULT.classification | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.lccn ) %]
             <span>
-                LCCN: [% BIBLIO_RESULT.lccn %]
+                LCCN: [% BIBLIO_RESULT.lccn | $raw %]
             </span><br/>
             [% END %]
             [% IF ( BIBLIO_RESULT.url ) %]
             <span>
-                URL: [% BIBLIO_RESULT.url %]
+                URL: [% BIBLIO_RESULT.url | html %]
             </span>
             [% END %]
             </p>
 
             [% IF ( OPACBaseURL ) %]
             <p>
-                In online catalog: [% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber %]
+                In online catalog: [% OPACBaseURL | $raw %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber | html %]
             </p>
             [% END %]
             [% IF ( BIBLIO_RESULT.ITEM_RESULTS.size ) %]
             <p>Items:
             <ul>
                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]<li>
-                    [% ITEM_RESULT.branchname %]
-                    [% ITEM_RESULT.location %]
-                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber %])[% END %]
-                    [% ITEM_RESULT.barcode %]
+                    [% ITEM_RESULT.branchname | $raw %]
+                    [% ITEM_RESULT.location | $raw %]
+                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber | $raw %])[% END %]
+                    [% ITEM_RESULT.barcode | $raw %]
                 </li>[% END %]
             </ul>
             </p>
index 814384f..ec39927 100644 (file)
@@ -28,7 +28,7 @@
             <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
     </li>
     <li>
-        <input type="hidden" name="shelfid" value="[% shelfid %]" />
+        <input type="hidden" name="shelfid" value="[% shelfid | html %]" />
     </li></ol></fieldset>
        <fieldset class="action"> <input type="submit" value="Send" /> <a class="cancel close" href="#">Cancel</a> </fieldset>
 </form>
index 35a70ff..0c7ee12 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -7,7 +8,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
 <title>Koha &rsaquo; [% IF op == 'view' %]Lists &rsaquo; Contents of [% shelf.shelfname | html %][% ELSE %]Lists[% END %][% IF op == 'add_form' %] &rsaquo; Create new list[% END %][% IF op == 'edit_form' %] &rsaquo; Edit list [% shelf.shelfname | html %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
-[% Asset.css("css/datatables.css") %]
+[% Asset.css("css/datatables.css") | $raw %]
 <style type="text/css">textarea { width: 100%; }</style>
 
 [% BLOCK list_permissions %]
     [% END %]
     [% IF shelf AND shelf.is_private %] &rsaquo;
         [% IF op == 'view' OR op == 'edit_form' %]
-            <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PRIVATE %]">Your lists</a>
+            <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PRIVATE | html %]">Your lists</a>
         [% ELSE %]
             Your lists
         [% END %]
     [% ELSIF shelf AND shelf.is_public %] &rsaquo;
         [% IF op == 'view' %]
-            <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PUBLIC %]">Public lists</a>
+            <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PUBLIC | html %]">Public lists</a>
         [% ELSE %]
             Public lists
         [% END %]
@@ -67,7 +68,7 @@
    </div>
 
 [% FOR m IN messages %]
-    <div class="dialog [% m.type %]">
+    <div class="dialog [% m.type | html %]">
         [% SWITCH m.code %]
         [% CASE 'error_on_update' %]
             <span>An error occurred when updating this list.</span>
@@ -77,9 +78,9 @@
             <span>An error occurred when deleting this list.</span>
         [% CASE 'error_on_add_biblio' %]
             [% IF m.item_barcode %]
-               <span>The item ([% m.item_barcode %]) has not been added to the list. Please verify it is not already in the list.</span>
+               <span>The item ([% m.item_barcode | html %]) has not been added to the list. Please verify it is not already in the list.</span>
             [% ELSE %]
-                <span>The record ([% m.bibnum %]) has not been added to the list. Please verify it is not already in the list.</span>
+                <span>The record ([% m.bibnum | html %]) has not been added to the list. Please verify it is not already in the list.</span>
             [% END %]
         [% CASE 'success_on_update' %]
             <span>List updated.</span>
@@ -89,9 +90,9 @@
             <span>List deleted.</span>
         [% CASE 'success_on_add_biblio' %]
             [% IF m.item_barcode %]
-                <span>The item ([% m.item_barcode %]) has been added to the list.</span>
+                <span>The item ([% m.item_barcode | html %]) has been added to the list.</span>
             [% ELSE %]
-                <span>The record ([% m.bibnum %]) has been added to the list.</span>
+                <span>The record ([% m.bibnum | html %]) has been added to the list.</span>
             [% END %]
         [% CASE 'success_on_remove_biblios' %]
             <span>The item has been removed from the list.</span>
             <span>This list does not exist.</span>
         [% CASE 'item_does_not_exist' %]
             [% IF m.item_barcode %]
-                <span>The item ([% m.item_barcode %]) does not exist.</span>
+                <span>The item ([% m.item_barcode | html %]) does not exist.</span>
             [% ELSE %]
-                <span>The record ([% m.bibnum %]) does not exist.</span>
+                <span>The record ([% m.bibnum | html %]) does not exist.</span>
             [% END %]
         [% CASE 'unauthorized_on_view' %]
             <span>You do not have permission to view this list.</span>
         [% CASE 'no_biblio_removed' %]
             <span>No record was removed.</span>
         [% CASE 'Koha::Exceptions::Virtualshelves::DuplicateObject' %]
-            <span>An error occurred when creating this list. The name [% shelfname %] already exists.</span>
+            <span>An error occurred when creating this list. The name [% shelfname | html %] already exists.</span>
         [% CASE 'Koha::Exceptions::Virtualshelves::UseDbAdminAccount' %]
             <span>List could not be created. (Do not use the database administrator account.)</span>
         [% CASE 'DBIx::Class::Exception' %]
-            [% m.msg %]
+            [% m.msg | html %]
         [% CASE %]
-            [% m.code %] [% m.msg %]
+            [% m.code | html %] [% m.msg | html %]
         [% END %]
     </div>
 [% END %]
     [% IF itemsloop %]
 
     <h3>Contents of <i>[% shelf.shelfname | html %]</i></h3>
-    <div class="pages">[% pagination_bar %]</div>
+    <div class="pages">[% pagination_bar | $raw %]</div>
     <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post" class="checkboxed">
         <input type="hidden" name="op" value="remove_biblios" />
         <input type="hidden" name="referer" value="view" />
-        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber %]" />
+        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
 
 [% IF direction == 'asc' %]
     [% SET new_direction = 'desc' %]
 
                 [% UNLESS ( item_level_itypes ) %]<th>Item type</th>[% END %]
                 <th>
-                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]&amp;sortfield=title&amp;direction=[% IF sortfield != 'title' %]asc[% ELSE %][% new_direction %][% END %]">Title</a>
+                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;sortfield=title&amp;direction=[% IF sortfield != 'title' %]asc[% ELSE %][% new_direction | html %][% END %]">Title</a>
                     [% IF sortfield == 'title' %]
-                        <img src="[% interface %]/[% theme %]/img/[% direction %].gif" alt="[% direction %] sort" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/[% direction | html %].gif" alt="[% direction | html %] sort" />
                     [% ELSE %]
-                        <img src="[% interface %]/[% theme %]/img/ascdesc.gif" alt="" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/ascdesc.gif" alt="" />
                     [% END %]
                 </th>
                 <th>
-                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]&amp;sortfield=author&amp;direction=[% IF sortfield != 'author' %]asc[% ELSE %][% new_direction %][% END %]">Author</a>
+                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;sortfield=author&amp;direction=[% IF sortfield != 'author' %]asc[% ELSE %][% new_direction | html %][% END %]">Author</a>
                    [% IF sortfield == 'author' %]
-                        <img src="[% interface %]/[% theme %]/img/[% direction %].gif" alt="[% direction %] sort" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/[% direction | html %].gif" alt="[% direction | html %] sort" />
                    [% ELSE %]
-                       <img src="[% interface %]/[% theme %]/img/ascdesc.gif" alt="" />
+                       <img src="[% interface | html %]/[% theme | html %]/img/ascdesc.gif" alt="" />
                    [% END %]
                  </th>
                 <th>Date added</th>
                 <th>
-                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]&amp;sortfield=itemcallnumber&amp;direction=[% IF sortfield != 'itemcallnumber' %]asc[% ELSE %][% new_direction %][% END %]">Call number</a>
+                    <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;sortfield=itemcallnumber&amp;direction=[% IF sortfield != 'itemcallnumber' %]asc[% ELSE %][% new_direction | html %][% END %]">Call number</a>
                    [% IF sortfield == 'itemcallnumber' %]
-                        <img src="[% interface %]/[% theme %]/img/[% direction %].gif" alt="[% direction %] sort" />
+                        <img src="[% interface | html %]/[% theme | html %]/img/[% direction | html %].gif" alt="[% direction | html %] sort" />
                    [% ELSE %]
-                       <img src="[% interface %]/[% theme %]/img/ascdesc.gif" alt="" />
+                       <img src="[% interface | html %]/[% theme | html %]/img/ascdesc.gif" alt="" />
                    [% END %]
                  </th>
             </tr>
                 <tr>
             [% IF itemsloop %]
                 <td>
-                    <input type="checkbox" class="selection" value="[% itemsloo.biblionumber %]" name="biblionumber" />
+                    <input type="checkbox" class="selection" value="[% itemsloo.biblionumber | html %]" name="biblionumber" />
                 </td>
             [% END %]
                        [% UNLESS ( item_level_itypes ) %]<td>
-                [% UNLESS ( noItemTypeImages || !itemsloo.imageurl ) %]<img src="[% itemsloo.imageurl %]" alt="[% itemsloo.description %]" title="[% itemsloo.description %]" />[% END %][% itemsloo.description %]
+                [% UNLESS ( noItemTypeImages || !itemsloo.imageurl ) %]<img src="[% itemsloo.imageurl | html %]" alt="[% itemsloo.description | html %]" title="[% itemsloo.description | html %]" />[% END %][% itemsloo.description | html %]
                        </td>[% END %]
                        <td>
                 [% IF ( itemsloo.XSLTBloc ) %]
-                    [% itemsloo.XSLTBloc %]
+                    [% itemsloo.XSLTBloc | $raw %]
                 [% ELSE %]
                     [% INCLUDE 'biblio-default-view.inc' biblionumber = itemsloo.biblionumber %]
-                    [% itemsloo.title |html %][% FOREACH subtitl IN itemsloo.subtitle %] [% subtitl.subfield %][% END %]</a>
+                    [% itemsloo.title | html %][% FOREACH subtitl IN itemsloo.subtitle %] [% subtitl.subfield | html %][% END %]</a>
                 [% END %]
                     <p class="hold">
                         [% IF ( itemsloo.notforloan ) %]
                             <span class="noholdstext">No holds allowed</span>
                         [% ELSE %]
                             [% IF ( itemsloo.ITEM_RESULTS.size ) %]
-                                <a id="reserve_[% itemsloo.biblionumber %]" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% itemsloo.biblionumber %]">Holds</a>
-                                [% IF ( holdfor ) %] <span class="holdforlink">| <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% itemsloo.biblionumber %]&amp;findborrower=[% holdfor_cardnumber %]">Place hold for [% holdfor_firstname %] [% holdfor_surname %] ([% holdfor_cardnumber %])</a></span>[% END %]
+                                <a id="reserve_[% itemsloo.biblionumber | html %]" href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% itemsloo.biblionumber | html %]">Holds</a>
+                                [% IF ( holdfor ) %] <span class="holdforlink">| <a href="/cgi-bin/koha/reserve/request.pl?biblionumber=[% itemsloo.biblionumber | html %]&amp;findborrower=[% holdfor_cardnumber | html %]">Place hold for [% holdfor_firstname | html %] [% holdfor_surname | html %] ([% holdfor_cardnumber | html %])</a></span>[% END %]
                             [% ELSE %]
                                 <span class="noholdstext">No holds allowed</span>
                             [% END %]
                         [% END %]
                         [% IF ( CAN_user_editcatalogue_edit_catalogue ) %]
-                            | <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% itemsloo.biblionumber %]">Edit record</a>
+                            | <a href="/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=[% itemsloo.biblionumber | html %]">Edit record</a>
                         [% END %]
                         [% IF ( CAN_user_editcatalogue_edit_items ) %]
-                            | <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% itemsloo.biblionumber %]">Edit items</a>
+                            | <a href="/cgi-bin/koha/cataloguing/additem.pl?biblionumber=[% itemsloo.biblionumber | html %]">Edit items</a>
                         [% END %]
                     </p>
             </td>
-            <td>[% itemsloo.author %]</td>
+            <td>[% itemsloo.author | html %]</td>
             <td>[% itemsloo.dateadded | $KohaDates%]</td>
             <td>
                 <ul>
                 [% FOREACH result IN itemsloo.ITEM_RESULTS %]
-                    <li>[% result.holdingbranch %] [% IF ( result.location_intranet ) %] ([% result.location_intranet %]) [% END %]
+                    <li>[% result.holdingbranch | html %] [% IF ( result.location_intranet ) %] ([% result.location_intranet | html %]) [% END %]
                         [% IF ( result.itemcallnumber ) %]
-                            [<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% result.itemcallnumber |uri %]%22">[% result.itemcallnumber %]</a>]
+                            [<a href="/cgi-bin/koha/catalogue/search.pl?idx=callnum&amp;q=%22[% result.itemcallnumber |uri %]%22">[% result.itemcallnumber | html %]</a>]
                         [% END %]
                     </li>
                 [% END %]
                        </tr>
                [% END %]<!-- /itemsloop -->
     </table>
-    <div class="pages">[% pagination_bar %]</div>
+    <div class="pages">[% pagination_bar | $raw %]</div>
 </form>
 
        [% END %]
             <input type="hidden" name="op" value="edit" />
         [% END %]
         <input type="hidden" name="referer" value="[% referer | html %]" />
-        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber %]" />
+        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
         <ol>
             <li>
-                <label for="shelfname" class="required">Name: </label><input type="text" id="shelfname" name="shelfname" size="25" value="[% shelf.shelfname |html %]" required="required" class="required" />
+                <label for="shelfname" class="required">Name: </label><input type="text" id="shelfname" name="shelfname" size="25" value="[% shelf.shelfname | html %]" required="required" class="required" />
             <span class="required">Required</span>
             </li>
             <li>
                 <span class="label">Owner: </span>
                 [% IF op == 'add_form' %]
-                    <input type="hidden" name="owner" id="owner" value="[% loggedinusernumber %]" />[% loggedinusername %]</li>
+                    <input type="hidden" name="owner" id="owner" value="[% loggedinusernumber | html %]" />[% loggedinusername | html %]</li>
                 [% ELSE %]
                     [% IF owner %]
-                        <input type="hidden" id="owner" name="owner" value="[% owner.borrowernumber %]" />[% owner.firstname _ ' ' _ owner.surname %]
+                        <input type="hidden" id="owner" name="owner" value="[% owner.borrowernumber | html %]" />[% owner.firstname _ ' ' _ owner.surname | html %]
                     [% ELSE %]
-                        <input type="hidden" id="owner" name="owner" value="[% loggedinusernumber %]" />[% loggedinusername %]
+                        <input type="hidden" id="owner" name="owner" value="[% loggedinusernumber | html %]" />[% loggedinusername | html %]
                     [% END %]
                 [% END %]
             </li>
     <fieldset class="action">
         <input type="submit" value="Save" class="submit" />
         [% IF referer == 'view' %]
-           <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]" class="cancel">Cancel</a>
+           <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]" class="cancel">Cancel</a>
        [% ELSE %]
             [% IF category == PUBLIC %]
-                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PUBLIC %]" class="cancel">Cancel</a>
+                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PUBLIC | html %]" class="cancel">Cancel</a>
             [% ELSE %]
-                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PRIVATE %]" class="cancel">Cancel</a>
+                <a href="/cgi-bin/koha/virtualshelves/shelves.pl?op=list&amp;category=[% PRIVATE | html %]" class="cancel">Cancel</a>
             [% END %]
         [% END %]
     </fieldset>
           <textarea name="barcodes" id="barcodes" class="focus" autocomplete="off" rows="5"></textarea>
           <input type="hidden" name="op" value="add_biblio" />
           <input type="hidden" name="referer" value="view" />
-          <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber %]" />
+          <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
         </li>
         <li>
           <label for="biblionumbers">Biblio numbers:</label>
           <textarea name="biblionumbers" id="biblionumbers" class="focus" autocomplete="off" rows="5"></textarea>
           <input type="hidden" name="op" value="add_biblio" />
           <input type="hidden" name="referer" value="view" />
-          <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber %]" />
+          <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
         </li>
       </ol>
       <fieldset class="action">
 
 [% MACRO jsinclude BLOCK %]
     [% INCLUDE 'datatables.inc' %]
-    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.dataTables.columnFilter.js") | $raw %]
     [% IF print %]
         <script type="text/javascript">
             $( document ).ready(function() {
     [% END %]
 
     [% IF op == 'view' %]
-        [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-        [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") %]
+        [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+        [% Asset.js("lib/jquery/plugins/jquery.fixFloat.js") | $raw %]
     [% END %]
     <script type="text/javascript">
         var MSG_NO_ITEM_SELECTED = _("Nothing is selected.");
         [% IF op == 'list' %]
             $(document).ready(function(){
                 [% IF category == PUBLIC %]
-                    var type = [% PUBLIC %];
+                    var type = [% PUBLIC | html %];
                 [% ELSE %]
-                    var type = [% PRIVATE %];
+                    var type = [% PRIVATE | html %];
                 [% END %]
                 var dtListResults = $("#listresultst").dataTable($.extend(true, {}, dataTablesDefaults, {
 
                     activate: function(e, ui) {
                         var active = tabs.tabs("option", "active" );
                         if ( active == 0 ) {
-                            type = [% PRIVATE %];
+                            type = [% PRIVATE | html %];
                             dtListResults.fnDraw();
                         } else if ( active == 1 ) {
-                            type = [% PUBLIC %];
+                            type = [% PUBLIC | html %];
                             dtListResults.fnDraw();
                         }
                     }
                         [% SET number_of_private_shelves = 0 %]
                         [% FOREACH s IN add_to_some_private_shelves %]
                             [% IF shelfnumber != s.shelfnumber %]
-                                param1 += "<option id=\"s[% s.shelfnumber %]\" value=\"addtolist\">[% s.shelfname |html %]<\/option>";
+                                param1 += "<option id=\"s[% s.shelfnumber | html %]\" value=\"addtolist\">[% s.shelfname | html %]<\/option>";
                                 [% SET number_of_private_shelves = number_of_private_shelves + 1 %]
-                                [% IF number_of_private_shelves == 10 %][% LAST %][% END %]
+                                [% IF number_of_private_shelves == 10 %][% LAST | html %][% END %]
                             [% END %]
                         [% END %]
                         param1 += "<\/optgroup>";
                         [% SET number_of_public_shelves = 0 %]
                         [% FOREACH s IN add_to_some_public_shelves %]
                             [% IF shelfnumber != s.shelfnumber %]
-                                param1 += "<option id=\"s[% s.shelfnumber %]\" value=\"addtolist\">[% s.shelfname |html %]<\/option>";
+                                param1 += "<option id=\"s[% s.shelfnumber | html %]\" value=\"addtolist\">[% s.shelfname | html %]<\/option>";
                                 [% SET number_of_public_shelves = number_of_public_shelves + 1 %]
-                                [% IF number_of_public_shelves == 10 %][% LAST %][% END %]
+                                [% IF number_of_public_shelves == 10 %][% LAST | html %][% END %]
                             [% END %]
                         [% END %]
                         param1 += "<\/optgroup>";
         [% IF op == 'view' %]
 
             function sendList(){
-                open(CGIBIN+'virtualshelves/sendshelf.pl?shelfid=[% shelf.shelfnumber %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100');
+                open(CGIBIN+'virtualshelves/sendshelf.pl?shelfid=[% shelf.shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100');
              }
 
              $(document).ready(function() {
index 2593a7a..a9c4da5 100644 (file)
@@ -1,22 +1,23 @@
+[% USE raw %]
 [% USE KohaDates %]
 [% USE To %]
 {
-    "sEcho": [% sEcho %],
-    "iTotalRecords": [% iTotalRecords %],
-    "iTotalDisplayRecords": [% iTotalDisplayRecords %],
+    "sEcho": [% sEcho | html %],
+    "iTotalRecords": [% iTotalRecords | html %],
+    "iTotalDisplayRecords": [% iTotalDisplayRecords | html %],
     "aaData": [
         [% FOREACH data IN aaData %]
             {
                 "dt_type":
-                    "[% data.type %]",
+                    "[% data.type | html %]",
                 "dt_shelfname":
-                    "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber %]'>[% data.shelfname | html%]</a>",
+                    "<a href='/cgi-bin/koha/virtualshelves/shelves.pl?op=view&shelfnumber=[% data.shelfnumber | html %]'>[% data.shelfname | html %]</a>",
                 "dt_count":
-                    "[% data.count %] item(s)",
+                    "[% data.count | html %] item(s)",
                 "dt_is_shared":
                     "[% IF data.type == 2 %]Public[% ELSIF data.is_shared %]Shared[% ELSE %]Private[% END %]",
                 "dt_owner":
-                    "<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner %]'>[% data.firstname %] [% data.surname %]</a>",
+                    "<a href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% data.owner | html %]'>[% data.firstname | html %] [% data.surname | html %]</a>",
                 "dt_sortby":
                     [% IF data.sortby == "author" %]"Author"[% ELSIF data.sortby == "copyrightdate" %]"Year"[% ELSIF data.sortby == "itemcallnumber" %]"Call number"[% ELSE %]"Title"[% END %],
                 "dt_created_on":
 [%~ SET action_block = '' ~%]
 [%~ IF can_manage_shelf OR can_delete_shelf ~%]
     [%~ IF can_manage_shelf ~%]
-        [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' ~%]
+        [%~ action_block =                '<form action="shelves.pl" method="get">' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' | html ~%]
         [%~ action_block = action_block _ '<button class="editshelf btn btn-default btn-xs"><i class="fa fa-pencil"></i> Edit</button>' ~%]
-        [%~ action_block = action_block _ '</form> ' ~%]
+        [%~ action_block = action_block _ '</form> ' | html ~%]
     [%~ END ~%]
     [%~ IF can_manage_shelf OR can_delete_shelf ~%]
-        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="shelfoff" value="' _ shelfoff _ '" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' ~%]
-        [%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' ~%]
+        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="shelfoff" value="' _ shelfoff _ '" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="category" value="' _ type _ '" />' | html ~%]
+        [%~ action_block = action_block _ '<input type="hidden" name="referer" value="list" />' | html ~%]
         [%~ action_block = action_block _ '<button type="submit" class="deleteshelf btn btn-default btn-xs"><i class="fa fa-trash"></i> Delete</button>' ~%]
-        [%~ action_block = action_block _ '</form>' ~%]
+        [%~ action_block = action_block _ '</form>' | html ~%]
     [%~ END ~%]
 [%~ ELSE ~%]
     [%~ SET action_block = 'None' ~%]
 [%~ END ~%]
-[%~ To.json(action_block) ~%]
+[%~ To.json(action_block) | $raw ~%]
 [%~ END ~%]
index 8934cca..074b87c 100644 (file)
@@ -52,7 +52,7 @@
     [% IF ( summary.label ) %][% summary.label | html %]:[% END %]
     [% IF summary.summary %]
         <div class="authority-summary">
-            [% summary.summary %]
+            [% summary.summary | html %]
         </div>
     [% END %]
     [% UNLESS ( summary.summaryonly ) %]
@@ -82,7 +82,7 @@
                 <div class="authres_otherscript">
                     [% FOREACH other IN summary.otherscript %]
                         [% PROCESS language lang=other.lang | trim %]:
-                        [% other.term %]
+                        [% other.term | html %]
                         [% IF ! loop.last %] ; [% END %]
                     [% END %]
                 </div>
index 917406b..8e88cb5 100644 (file)
 [% DEFAULT class = '' size = 20 %]
 
 [% IF avs %]
-  <select id="[% name %]" name="[% name %]" class="[% class %]" >
+  <select id="[% name | html %]" name="[% name | html %]" class="[% class | html %]" >
   [% FOR av IN avs %]
     [% IF av.authorised_value == default %]
-      <option value="[% av.authorised_value %]" selected="selected">[% av.lib | html_entity %]</option>
+      <option value="[% av.authorised_value | html %]" selected="selected">[% av.lib | html_entity %]</option>
     [% ELSE %]
-      <option value="[% av.authorised_value %]">[% av.lib | html_entity %]</option>
+      <option value="[% av.authorised_value | html %]">[% av.lib | html_entity %]</option>
     [% END %]
   [% END %]
   </select>
 [% ELSE %]
-  <input type="text" id="[% name %]" name="[% name %]" size="[% size %]" value="[% default | html_entity %]" class="[% class %]" />
+  <input type="text" id="[% name | html %]" name="[% name | html %]" size="[% size | html %]" value="[% default | html_entity %]" class="[% class | html %]" />
 [% END %]
index 487d7e9..75c67fc 100644 (file)
@@ -1,15 +1,16 @@
-[% classprop  = 'class="' %]
+[% USE raw %]
+[% classprop  = 'class="' | html %]
 [% IF LoginBranchcode.defined %]
-    [% classprop = classprop _ 'branch-' _ LoginBranchcode %]
+    [% classprop = classprop.raw _ 'branch-' _ LoginBranchcode %]
 [% ELSE %]
-    [% classprop = classprop _ 'branch-default' %]
+    [% classprop = classprop.raw _ 'branch-default' %]
 [% END %]
 [% IF bodyclass.defined %]
-    [% classprop = classprop _ ' ' _ bodyclass %]
+    [% classprop = classprop.raw _ ' ' _ bodyclass %]
 [% END %]
-[% classprop = classprop _ '"' %]
+[% classprop = classprop.raw _ '"' %]
 
 [% IF bodyid.defined %]
-    [% idprop = 'ID="' _ bodyid _ '" ' %]
+    [% idprop = 'ID="' _ bodyid _ '" ' | html %]
 [% END %]
-<body [%idprop%][% classprop %] >
+<body [% idprop | html %][% classprop | $raw %] >
index 058ce86..54bcc6a 100644 (file)
@@ -1,8 +1,8 @@
 [% USE Koha %]
 <script>
     //<![CDATA[
-        var debug    = "[% debug %]";
-        var dformat  = "[% dateformat %]";
+        var debug    = "[% debug | html %]";
+        var dformat  = "[% dateformat | html %]";
         var sentmsg = 0;
         if (debug > 1) {alert("dateformat: " + dformat + "\ndebug is on (level " + debug + ")");}
 
@@ -40,7 +40,7 @@
                 dayNamesMin: [_("Su"),_("Mo"),_("Tu"),_("We"),_("Th"),_("Fr"),_("Sa")],
                 weekHeader: _("Wk"),
                 dateFormat: '[% IF ( dateformat == "us" ) %]mm/dd/yy[% ELSIF ( dateformat == "metric" ) %]dd/mm/yy[% ELSIF ( dateformat == "dmydot" ) %]dd.mm.yy[% ELSE %]yy-mm-dd[% END %]',
-                firstDay: [% Koha.Preference('CalendarFirstDayOfWeek') %],
+                firstDay: [% Koha.Preference('CalendarFirstDayOfWeek') | html %],
                 isRTL: [% IF ( bidi ) %]true[% ELSE %]false[% END %],
                 showMonthAfterYear: false,
                 yearSuffix: ''};
@@ -53,7 +53,7 @@
                 showOn: "both",
                 changeMonth: true,
                 changeYear: true,
-                buttonImage: '[% interface %]/lib/famfamfam/silk/calendar.png',
+                buttonImage: '[% interface | html %]/lib/famfamfam/silk/calendar.png',
                 buttonImageOnly: true,
                 showButtonPanel: true,
                 showOtherMonths: true,
index d440dcd..d711ee5 100644 (file)
@@ -1,5 +1,6 @@
+[% USE raw %]
 [% USE Asset %]
-[% Asset.js("lib/jquery/plugins/jquery.dataTables.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.dataTables.min.js") | $raw %]
 <script>
 //<![CDATA[
     var MSG_DT_FIRST = _("First");
@@ -18,4 +19,4 @@
     var CONFIG_EXCLUDE_ARTICLES_FROM_SORT = _("a an the");
 //]]>
 </script>
-[% Asset.js("js/datatables.js") %]
\ No newline at end of file
+[% Asset.js("js/datatables.js") | $raw %]
index 06eb4fc..480b5a5 100644 (file)
@@ -1,58 +1,59 @@
+[% USE raw %]
 [%- USE KohaPlugins -%]
 [% USE Asset %]
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats -->
+<meta name="generator" content="Koha [% Version | html %]" /> <!-- leave this for stats -->
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
+<link rel="shortcut icon" href="[% IF ( OpacFavicon ) %][% OpacFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/images/favicon.ico[% END %]" type="image/x-icon" />
 [% IF ( bidi ) %]
-    [% Asset.css("lib/bootstrap/css/bootstrap-rtl.min.css") %]
+    [% Asset.css("lib/bootstrap/css/bootstrap-rtl.min.css") | $raw %]
 [% ELSE %]
-    [% Asset.css("lib/bootstrap/css/bootstrap.min.css") %]
+    [% Asset.css("lib/bootstrap/css/bootstrap.min.css") | $raw %]
 [% END %]
 
 [% IF ( bidi ) %]
-    [% Asset.css("lib/jquery/jquery-ui-rtl.css") %]
+    [% Asset.css("lib/jquery/jquery-ui-rtl.css") | $raw %]
 [% ELSE %]
-    [% Asset.css("lib/jquery/jquery-ui.css") %]
+    [% Asset.css("lib/jquery/jquery-ui.css") | $raw %]
 [% END %]
 
 [% SET opaclayoutstylesheet='opac.css' UNLESS opaclayoutstylesheet %]
 [% IF (opaclayoutstylesheet.match('^https?:|^\/')) %]
-    <link rel="stylesheet" type="text/css" href="[% opaclayoutstylesheet %]" />
+    <link rel="stylesheet" type="text/css" href="[% opaclayoutstylesheet | html %]" />
 [% ELSE %]
-    [% Asset.css("css/" _ opaclayoutstylesheet) %]
+    [% Asset.css("css/" _ opaclayoutstylesheet) | $raw %]
 [% END %]
 [% IF ( OpacAdditionalStylesheet ) %]
     [% IF (OpacAdditionalStylesheet.match('^https?:|^\/')) %]
-        <link rel="stylesheet" type="text/css" href="[% OpacAdditionalStylesheet %]" />
+        <link rel="stylesheet" type="text/css" href="[% OpacAdditionalStylesheet | html %]" />
     [% ELSE %]
-        <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/[% OpacAdditionalStylesheet %]" />
+        <link rel="stylesheet" type="text/css" href="[% interface | html %]/[% theme | html %]/css/[% OpacAdditionalStylesheet | html %]" />
     [% END %]
 [% END %]
 [% IF ( opac_css_override ) %]
-    <link rel="stylesheet" type="text/css" href="[% interface %]/[% theme %]/css/[% opac_css_override %]" />
+    <link rel="stylesheet" type="text/css" href="[% interface | html %]/[% theme | html %]/css/[% opac_css_override | html %]" />
 [% END %]
-[% Asset.css("css/print.css", { media = "print" }) %]
+[% Asset.css("css/print.css", { media = "print" }) | $raw %]
 [% IF ( bidi ) %]
-    [% Asset.css("css/right-to-left.css") %]
+    [% Asset.css("css/right-to-left.css") | $raw %]
 [% END %]
-[% IF ( OPACUserCSS ) %]<style>[% OPACUserCSS %]</style>[% END %]
+[% IF ( OPACUserCSS ) %]<style>[% OPACUserCSS | $raw %]</style>[% END %]
 [% IF SCO_login %]
     [% SET SCOUserCSS = Koha.Preference('SCOUserCSS') %]
     [% IF SCOUserCSS %]
-        <style>[% SCOUserCSS %]</style>
+        <style>[% SCOUserCSS | $raw %]</style>
     [% END %]
 [% END %]
-<link rel="unapi-server" type="application/xml" title="unAPI" href="[% OPACBaseURL %]/cgi-bin/koha/unapi" />
+<link rel="unapi-server" type="application/xml" title="unAPI" href="[% OPACBaseURL | html %]/cgi-bin/koha/unapi" />
 [% PROCESS cssinclude %]
 <!-- Respond.js brings responsive layout behavior to IE < v.9 -->
 <!--[if lt IE 9]>
-    <script src="[% interface %]/[% theme %]/lib/respond.min.js"></script>
+    <script src="[% interface | html %]/[% theme | html %]/lib/respond.min.js"></script>
 <![endif]-->
 <script>
     function _(s) { return s } // dummy function for gettext
 </script>
-[% Asset.js("lib/modernizr.min.js") %]
-[% Asset.css("lib/font-awesome/css/font-awesome.min.css") %]
+[% Asset.js("lib/modernizr.min.js") | $raw %]
+[% Asset.css("lib/font-awesome/css/font-awesome.min.css") | $raw %]
 [% PROCESS 'html_helpers.inc' %]
-[% KohaPlugins.get_plugins_opac_head %]
+[% KohaPlugins.get_plugins_opac_head | html %]
index 06e68a3..292b725 100644 (file)
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<!-- TEMPLATE FILE: [% template.name.split('/').last %] -->
+<!-- TEMPLATE FILE: [% template.name.split('/').last | html %] -->
 
 [% USE Koha %]
 [% IF Koha.Preference('DumpTemplateVarsOpac') %]
@@ -9,7 +9,7 @@
         <!--
         [% FILTER replace('<!--', '<!- -') %]
             [% FILTER replace('-->', '- ->') %]
-                [% Dumper.dump( Stash.stash() ) %]
+                [% Dumper.dump( Stash.stash() ) | html %]
             [% END %]
         [% END %]
         -->
@@ -21,5 +21,5 @@
     [% END %]
 [% END %]
 
-[% IF ( bidi ) %]<html lang="[% lang %]" dir="[% bidi %]" class="no-js">[% ELSE %]<html lang="[% lang %]" class="no-js">[% END %]
+[% IF ( bidi ) %]<html lang="[% lang | html %]" dir="[% bidi | html %]" class="no-js">[% ELSE %]<html lang="[% lang | html %]" class="no-js">[% END %]
 <head>
index 44ea957..2c303db 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 <script>
-    var GB_ROOT_DIR = "[% interface %]/[% theme %]/lib/greybox/";
+    var GB_ROOT_DIR = "[% interface | html %]/[% theme | html %]/lib/greybox/";
 </script>
-[% Asset.js("lib/greybox/AJS.js") %]
-[% Asset.js("lib/greybox/AJS_fx.js") %]
-[% Asset.js("lib/greybox/gb_scripts.js") %]
-[% Asset.css("lib/greybox/gb_styles.css") %]
+[% Asset.js("lib/greybox/AJS.js") | $raw %]
+[% Asset.js("lib/greybox/AJS_fx.js") | $raw %]
+[% Asset.js("lib/greybox/gb_scripts.js") | $raw %]
+[% Asset.css("lib/greybox/gb_styles.css") | $raw %]
index 1d38382..2c7d349 100644 (file)
@@ -1,9 +1,9 @@
 [% BLOCK options_for_libraries %]
     [% FOREACH l IN libraries %]
         [% IF l.selected %]
-            <option value="[% l.branchcode %]" selected="selected">[% l.branchname %]</option>
+            <option value="[% l.branchcode | html %]" selected="selected">[% l.branchname | html %]</option>
         [% ELSE %]
-            <option value="[% l.branchcode %]">[% l.branchname %]</option>
+            <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
         [% END%]
     [% END %]
 [% END %]
index 7fd4fd2..55474da 100644 (file)
@@ -8,9 +8,9 @@
 
 [% IF ( item.itemlost ) %]
     [% SET itemavailable = 0 %]
-    [% av_lib_include = AuthorisedValues.GetByCode( 'LOST', item.itemlost, 1 ) %]
+    [% av_lib_include = AuthorisedValues.GetByCode( 'LOST', item.itemlost, 1 ) | html %]
     [% IF ( av_lib_include ) %]
-        <span class="item-status lost">[% av_lib_include %]</span>
+        <span class="item-status lost">[% av_lib_include | html %]</span>
     [% ELSE %]
         <span class="item-status lost">Item lost</span>
     [% END %]
     [% SET itemavailable = 0 %]
     [% IF onsite_checkout %]
         [% IF ( OPACShowCheckoutName ) %]
-            <span class="item-status checkedout">Currently in local use by [% item.firstname %] [% item.surname %] [% IF ( item.cardnumber ) %]([% item.cardnumber %])[% END %]</span>
+            <span class="item-status checkedout">Currently in local use by [% item.firstname | html %] [% item.surname | html %] [% IF ( item.cardnumber ) %]([% item.cardnumber | html %])[% END %]</span>
         [% ELSE %]
             <span class="item-status checkedout">Currently in local use</span>
         [% END %]
     [% ELSE %]
         [% IF ( OPACShowCheckoutName ) %]
-            <span class="item-status checkedout">Checked out to [% item.firstname %] [% item.surname %] [% IF ( item.cardnumber ) %]([% item.cardnumber %])[% END %]</span>
+            <span class="item-status checkedout">Checked out to [% item.firstname | html %] [% item.surname | html %] [% IF ( item.cardnumber ) %]([% item.cardnumber | html %])[% END %]</span>
         [% ELSE %]
             <span class="item-status checkedout">Checked out</span>
         [% END %]
@@ -42,8 +42,8 @@
 
 [% IF NOT ( item.isa('Koha::Item') ) AND item.transfertwhen %] [%# transfertwhen is set in C4::Search, do not have it for course reserves %]
     [% SET itemavailable = 0 %]
-    <span class="item-status intransit">In transit from [% Branches.GetName( item.transfertfrom ) %]
-    to [% Branches.GetName( item.transfertto ) %] since [% item.transfertwhen | $KohaDates %]</span>
+    <span class="item-status intransit">In transit from [% Branches.GetName( item.transfertfrom ) | html %]
+    to [% Branches.GetName( item.transfertto ) | html %] since [% item.transfertwhen | $KohaDates %]</span>
 [% END %]
 
 [% IF NOT( item.isa('Koha::Item') ) AND item.waiting %] [%# Not sure where does come from this waiting flag %]
@@ -53,9 +53,9 @@
 
 [% IF ( item.withdrawn ) %]
     [% SET itemavailable = 0 %]
-    [% av_lib_include = AuthorisedValues.GetByCode( 'WITHDRAWN', item.withdrawn, 1 ) %]
+    [% av_lib_include = AuthorisedValues.GetByCode( 'WITHDRAWN', item.withdrawn, 1 ) | html %]
     [% IF av_lib_include %]
-        <span class="item-status withdrawn">[% av_lib_include %]</span>
+        <span class="item-status withdrawn">[% av_lib_include | html %]</span>
     [% ELSE %]
         <span class="item-status withdrawn">Item withdrawn</span>
     [% END %]
 [% IF NOT ( item.isa('Koha::Item') ) AND item.itemnotforloan %]
     [% SET itemavailable = 0 %]
     [% IF ( item.notforloanvalueopac ) %]
-        <span class="item-status notforloan">[% item.notforloanvalueopac %] [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac %])</span>[% END %]</span>
+        <span class="item-status notforloan">[% item.notforloanvalueopac | html %] [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac | html %])</span>[% END %]</span>
     [% ELSE %]
-        <span class="item-status notforloan">Not for loan [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac %])</span>[% END %]</span>
+        <span class="item-status notforloan">Not for loan [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac | html %])</span>[% END %]</span>
     [% END %]
 [% ELSIF NOT ( item.isa('Koha::Item') ) AND item.notforloan_per_itemtype %]
     [% SET itemavailable = 0 %]
-    <span class="item-status notforloan">Not for loan [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac %])</span>[% END %]</span>
+    <span class="item-status notforloan">Not for loan [% IF ( item.restrictedopac ) %]<span class="restricted">([% item.restrictedopac | html %])</span>[% END %]</span>
 [% END %]
 
 [% IF ( item.damaged ) %]
     [% SET itemavailable = 0 %]
-    [% av_lib_include = AuthorisedValues.GetByCode( 'DAMAGED', item.damaged, 1 ) %]
+    [% av_lib_include = AuthorisedValues.GetByCode( 'DAMAGED', item.damaged, 1 ) | html %]
     [% IF av_lib_include %]
-        <span class="item-status damaged">[% av_lib_include %]</span>
+        <span class="item-status damaged">[% av_lib_include | html %]</span>
     [% ELSE %]
         <span class="item-status damaged">Item damaged</span>
     [% END %]
@@ -91,5 +91,5 @@
 
 [% IF ( itemavailable ) %]
     [% IF NOT item.isa('Koha::Item') %][% SET restrictedopac = item.restrictedopac %][% END %]
-    <span class="item-status available">Available [% IF restrictedopac %]<span class="restricted">([% restrictedopac %])</span>[% END %]</span>
+    <span class="item-status available">Available [% IF restrictedopac %]<span class="restricted">([% restrictedopac | html %])</span>[% END %]</span>
 [% END %]
index 4bd7b21..e0723be 100644 (file)
@@ -9,18 +9,18 @@
                 [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]
                     [% IF ( sublanguages_loo.enabled ) %]
                         [% IF ( sublanguages_loo.sublanguage_current ) %]
-                         <li role="presentation"> <a href="#" tabindex="-1" role="menuitem">[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]&nbsp;<i class="icon-ok"></i></a></li>
+                         <li role="presentation"> <a href="#" tabindex="-1" role="menuitem">[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]&nbsp;<i class="icon-ok"></i></a></li>
                         [% ELSE %]
-                        <li role="presentation"><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag %]"  tabindex="-1" role="menuitem"> [% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %]</a></li>
+                        <li role="presentation"><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag | html %]"  tabindex="-1" role="menuitem"> [% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %]</a></li>
                         [% END %]
                     [% END # / IF sublanguages_loo.enabled %]
                 [% END # / FOREACH sublanguages_loo %]
             [% ELSE %]
                 [% IF ( languages_loo.group_enabled ) %]
                     [% IF ( languages_loo.current ) %]
-                    <li role="presentation"><a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]&nbsp;<i class="icon-ok"></i></a></li>
+                    <li role="presentation"><a href="#" tabindex="-1" class="menu-inactive" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]&nbsp;<i class="icon-ok"></i></a></li>
                     [% ELSE %]
-                    <li role="presentation"><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% languages_loo.rfc4646_subtag %]"  tabindex="-1" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]</a></li>
+                    <li role="presentation"><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% languages_loo.rfc4646_subtag | html %]"  tabindex="-1" role="menuitem">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]</a></li>
                     [% END %]
                 [% END # / IF languages_loo.current %]
             [% END # / IF ( languages_loo.plural ) %]
index e2d707b..5b18006 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Koha %]
 [% SET OpacLangSelectorMode = Koha.Preference('OpacLangSelectorMode') %]
 <div id="wrap">
     <div class="navbar navbar-inverse navbar-static-top">
         <div class="navbar-inner">
             <div class="container-fluid">
-                <a class="brand" href="/cgi-bin/koha/sco/sco-main.pl"><img src="[% interface %]/[% theme %]/images/koha-logo-navbar.png" alt=""></a>
+                <a class="brand" href="/cgi-bin/koha/sco/sco-main.pl"><img src="[% interface | html %]/[% theme | html %]/images/koha-logo-navbar.png" alt=""></a>
                 <div id="checkouthelp">
                     <ul class="nav pull-right">
                         <li><a href="/cgi-bin/koha/sco/help.pl"><i class="icon help"></i> Help</a></li>
@@ -27,7 +28,7 @@
         <div class="container-fluid">
             <div class="row-fluid">
                 <div id="opacheader">
-                    [% opacheader %]
+                    [% opacheader | $raw %]
                 </div>
             </div>
         </div>
index 95b025f..9d543b8 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE Branches %]
 [% SET OpacLangSelectorMode = Koha.Preference('OpacLangSelectorMode') %]
@@ -9,7 +10,7 @@
                     <h1 id="logo">
                         <a class="brand" href="/cgi-bin/koha/opac-main.pl">
                             [% IF ( LibraryNameTitle ) %]
-                                [% LibraryNameTitle %]
+                                [% LibraryNameTitle | html %]
                             [% ELSE %]
                                 Koha online
                             [% END %]
@@ -42,9 +43,9 @@
                                     <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=2" tabindex="-1" role="menuitem"><strong>Public lists</strong></a></li>
                                     [% SET number_of_public_shelves = 0 %]
                                     [% FOREACH s IN some_public_shelves %]
-                                        <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]&amp;sortfield=[% s.sortfield %]" tabindex="-1" role="menuitem">[% s.shelfname |html %]</a></li>
+                                        <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]&amp;sortfield=[% s.sortfield | html %]" tabindex="-1" role="menuitem">[% s.shelfname | html %]</a></li>
                                         [% SET number_of_public_shelves = number_of_public_shelves + 1 %]
-                                        [% IF number_of_public_shelves >= 10 %][% LAST %][% END %]
+                                        [% IF number_of_public_shelves >= 10 %][% LAST | html %][% END %]
                                     [% END %]
                                     [% IF some_public_shelves > 10 %]
                                         <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=2" tabindex="-1" role="menuitem" class="listmenulink">View All</a></li>
@@ -59,9 +60,9 @@
                                         [% IF some_private_shelves.count %]
                                             [% SET number_of_private_shelves = 0 %]
                                             [% FOREACH s IN some_private_shelves %]
-                                                <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]&amp;sortfield=[% s.sortfield %]" tabindex="-1" role="menuitem">[% s.shelfname |html %]</a></li>
+                                                <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]&amp;sortfield=[% s.sortfield | html %]" tabindex="-1" role="menuitem">[% s.shelfname | html %]</a></li>
                                                 [% SET number_of_private_shelves = number_of_private_shelves + 1 %]
-                                                [% IF number_of_private_shelves >= 10 %][% LAST %][% END %]
+                                                [% IF number_of_private_shelves >= 10 %][% LAST | html %][% END %]
                                             [% END %]
                                             [% IF some_private_shelves > 10 %]
                                                 <li role="presentation"><a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=1" tabindex="-1" role="menuitem" class="listmenulink">View All</a></li>
                                         [% END %]
                                     [% END %]
                                     [% IF ( loggedinusername ) %]
-                                        <li><p class="members navbar-text">Welcome, <a class="login-link" href="/cgi-bin/koha/opac-user.pl"><span class="loggedinusername" data-borrowernumber="[% logged_in_user.borrowernumber %]" data-branchcode="[% logged_in_user.branchcode %]" >[% INCLUDE 'patron-title.inc' patron = logged_in_user no_html = 1 %]</span></a></p></li>
+                                        <li><p class="members navbar-text">Welcome, <a class="login-link" href="/cgi-bin/koha/opac-user.pl"><span class="loggedinusername" data-borrowernumber="[% logged_in_user.borrowernumber | html %]" data-branchcode="[% logged_in_user.branchcode | html %]" >[% INCLUDE 'patron-title.inc' patron = logged_in_user no_html = 1 %]</span></a></p></li>
                                         <li class="divider-vertical"></li>
                                     [% END %]
                                 [% END %]
             <div class="container-fluid">
                 <div class="row-fluid">
                     <div id="opacheader">
-                        [% opacheader %]
+                        [% opacheader | $raw %]
                     </div>
                 </div>
             </div>
                                 <label for="masthead_search"> Search
                                     [% UNLESS ( Koha.Preference( 'OpacAddMastheadLibraryPulldown' ) == 1 ) %]
                                         [% IF ( mylibraryfirst ) %]
-                                            (in [% Branches.GetName( mylibraryfirst ) %] only)
+                                            (in [% Branches.GetName( mylibraryfirst ) | html %] only)
                                         [% END %]
                                     [% END %]
                                 </label>
                                     <div class="input-append nolibrarypulldown">
                                 [% END %]
                                 [% IF ( ms_value ) %]
-                                    <input type="text" title="Type search term" class="transl1" id = "translControl1" name="q" value="[% ms_value |html %]" /><span id="translControl"></span>
+                                    <input type="text" title="Type search term" class="transl1" id = "translControl1" name="q" value="[% ms_value | html %]" /><span id="translControl"></span>
                                 [% ELSE %]
                                     <input type="text" title="Type search term" class="transl1" id = "translControl1" name="q" /><span id="translControl"></span>
                                 [% END # /ms_value %]
 
                                             [% FOREACH library IN Branches.all( selected => opac_name ) %]
                                                 [% IF library.selected %]
-                                                    <option selected="selected" value="branch:[% library.branchcode %]">[% library.branchname %]</option>
+                                                    <option selected="selected" value="branch:[% library.branchcode | html %]">[% library.branchname | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="branch:[% library.branchcode %]">[% library.branchname %]</option>
+                                                    <option value="branch:[% library.branchcode | html %]">[% library.branchname | html %]</option>
                                                 [% END %]
                                             [% END %]
 
                                                 <optgroup label="Groups">
                                                     [% FOREACH lsg IN LibrarySearchGroups %]
                                                         [% IF lsg.id == opac_name %]
-                                                            <option selected="selected" value="multibranchlimit-[% lsg.id %]">[% lsg.title %]</option>
+                                                            <option selected="selected" value="multibranchlimit-[% lsg.id | html %]">[% lsg.title | html %]</option>
                                                         [% ELSE %]
-                                                            <option value="multibranchlimit-[% lsg.id %]">[% lsg.title %]</option>
+                                                            <option value="multibranchlimit-[% lsg.id | html %]">[% lsg.title | html %]</option>
                                                         [% END # / bc.selected %]
                                                     [% END %]
                                                 </optgroup>
                                 [% ELSE %]
                                     [% IF ( opac_limit_override ) %]
                                         [% IF ( opac_search_limit ) %]
-                                            <input name="limit" value="[% opac_search_limit %]" type="hidden" />
+                                            <input name="limit" value="[% opac_search_limit | html %]" type="hidden" />
                                         [% END %]
                                     [% ELSE %]
                                         [% IF ( mylibraryfirst ) %]
-                                            <input name="limit" value="branch:[% mylibraryfirst %]" type="hidden" />
+                                            <input name="limit" value="branch:[% mylibraryfirst | html %]" type="hidden" />
                                         [% END %]
                                     [% END # / opac_limit_override %]
                                 [% END # / OpacAddMastheadLibraryPulldown %]
 
                             </form>
                         [% ELSE # / Koha.Preference('OpacCustomSearch') == '' %]
-                            [% Koha.Preference('OpacCustomSearch') %]
+                            [% Koha.Preference('OpacCustomSearch') | $raw %]
                         [% END # / Koha.Preference('OpacCustomSearch') == '' %]
                         </div> <!-- / .mastheadsearch -->
                     [% END # / UNLESS advsearch %]
                         </div>
                     [% ELSE %]
                         <h4>Shibboleth login</h4>
-                        <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
+                        <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl | html %]">click here to login</a>.</p>
                         <h4>Local Login</h4>
                     [% END %]
                 [% END %]
                     <label for="mpassword">Password:</label><input type="password" id="mpassword" name="password" />
                     [% IF Koha.Preference( 'OpacLoginInstructions' ) %]
                         <div id="nologininstructions-modal" class="nologininstructions">
-                            [% Koha.Preference( 'OpacLoginInstructions' ) %]
+                            [% Koha.Preference( 'OpacLoginInstructions' ) | $raw %]
                         </div>
                     [% END %]
                     [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %]
index 1926c1e..d578857 100644 (file)
@@ -1,5 +1,6 @@
-<div id="opacnav">[% OpacNav %]</div>
+[% USE raw %]
+<div id="opacnav">[% OpacNav | $raw %]</div>
 [% IF IsPatronPage %]
     <div id="usermenu">[% INCLUDE usermenu.inc %]</div>
 [% END %]
-<div id="opacnavbottom">[% OpacNavBottom %]</div>
+<div id="opacnavbottom">[% OpacNavBottom | $raw %]</div>
index aed68e5..28518b9 100644 (file)
@@ -7,11 +7,11 @@
 [% BLOCK showtree %]
     <ul class="hierarchy">
         [% FOREACH node IN tree %]
-            <li id="hier[% node.authid %]" class="[% node.class %] authnode">
+            <li id="hier[% node.authid | html %]" class="[% node.class | html %] authnode">
             [% IF ( node.current_value ) %]
                 <span class="currentauth">[% node.value | html %]</span>
             [% ELSE %]
-                <a href="opac-authoritiesdetail.pl?authid=[% node.authid %]" title="Term">[% node.value | html %]</a>
+                <a href="opac-authoritiesdetail.pl?authid=[% node.authid | html %]" title="Term">[% node.value | html %]</a>
             [% END %]
             [% IF ( node.children && node.children.size > 0 ) %]
                 [% PROCESS showtree tree = node.children %]
@@ -30,7 +30,7 @@
         [% CASE 'musical' %]Musical composition
         [% CASE 'broader' %]Broader heading
         [% CASE 'narrower' %]Narrower heading
-        [% CASE %][% type %]
+        [% CASE %][% type | html %]
         [% END %][% END %]</span>
     [% END %]
 [% END %]
     [% FOREACH heading IN headings %]
         [% IF heading.category == wantcategory %]
             [% IF heading.direction == 'ltr' %]
-                <div class="heading otherscript [% heading.category %]">
-                <span class="[% heading.category %]">[% heading.term %]</span>
+                <div class="heading otherscript [% heading.category | html %]">
+                <span class="[% heading.category | html %]">[% heading.term | html %]</span>
                 </div>
             [% ELSIF heading.direction == 'rtl' %]
-                <div class="heading otherscript [% heading.category %] rtl">
-                <span class="[% heading.category %]">[% heading.term %]</span>
+                <div class="heading otherscript [% heading.category | html %] rtl">
+                <span class="[% heading.category | html %]">[% heading.term | html %]</span>
                 </div>
             [% END %]
         [% END %]
@@ -52,9 +52,9 @@
 [% END %]
 
 [% BLOCK authheadingdisplay %]
-    [% IF authid %]<a href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid %]">[% heading %]</a>
-    [% ELSIF search %]<a href="/cgi-bin/koha/opac-authorities-home.pl?op=do_search&amp;type=opac&amp;operator=contains&amp;marclist=mainentry&amp;and_or=and&amp;orderby=HeadingAsc&amp;value=[% search %]">[% heading %]</a>
-    [% ELSE %][% heading %]
+    [% IF authid %]<a href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid | html %]">[% heading | html %]</a>
+    [% ELSIF search %]<a href="/cgi-bin/koha/opac-authorities-home.pl?op=do_search&amp;type=opac&amp;operator=contains&amp;marclist=mainentry&amp;and_or=and&amp;orderby=HeadingAsc&amp;value=[% search | html %]">[% heading | html %]</a>
+    [% ELSE %][% heading | html %]
     [% END %]
 [% END %]
 
@@ -65,6 +65,6 @@
         [% CASE ['it', 'ita'] %]Italian
         [% CASE ['de', 'ger', 'deu'] %]German
         [% CASE ['es', 'spa'] %]Spanish
-        [% CASE %][% lang %]
+        [% CASE %][% lang | html %]
     [% END %]
 [% END %]
index 735cc89..e031acb 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [%- USE KohaPlugins -%]
 [% USE Asset %]
 [% UNLESS ( is_popup ) %]
@@ -7,7 +8,7 @@
             <div class="row-fluid">
                 <div class="span12">
                     <div id="opaccredits" class="noprint">
-                        [% opaccredits %]
+                        [% opaccredits | $raw %]
                     </div>
                 </div>
             </div>
                                 [% IF ( languages_loo.group_enabled ) %]
                                     [% IF ( languages_loo.plural ) %]
                                         <li class="dropdown">
-                                            <a data-toggle="dropdown" class="dropdown-toggle sublangs" id="show[% languages_loo.rfc4646_subtag %]" href="#">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %] <b class="caret"></b></a>
-                                                <ul id="sub[% languages_loo.rfc4646_subtag %]" class="dropdown-menu">
+                                            <a data-toggle="dropdown" class="dropdown-toggle sublangs" id="show[% languages_loo.rfc4646_subtag | html %]" href="#">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %] <b class="caret"></b></a>
+                                                <ul id="sub[% languages_loo.rfc4646_subtag | html %]" class="dropdown-menu">
                                                     [% FOREACH sublanguages_loo IN languages_loo.sublanguages_loop %]
                                                         [% IF ( sublanguages_loo.enabled ) %]
                                                             [% IF ( sublanguages_loo.sublanguage_current ) %]
-                                                                <li> <p>[% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %] ([% sublanguages_loo.rfc4646_subtag %])</p></li>
+                                                                <li> <p>[% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %] ([% sublanguages_loo.rfc4646_subtag | html %])</p></li>
                                                             [% ELSE %]
-                                                                <li><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag %]"> [% sublanguages_loo.native_description %] [% sublanguages_loo.script_description %] [% sublanguages_loo.region_description %] [% sublanguages_loo.variant_description %] ([% sublanguages_loo.rfc4646_subtag %])</a></li>
+                                                                <li><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% sublanguages_loo.rfc4646_subtag | html %]"> [% sublanguages_loo.native_description | html %] [% sublanguages_loo.script_description | html %] [% sublanguages_loo.region_description | html %] [% sublanguages_loo.variant_description | html %] ([% sublanguages_loo.rfc4646_subtag | html %])</a></li>
                                                             [% END %]
                                                         [% END # / IF sublanguages_loo.enabled %]
                                                     [% END # / FOREACH sublanguages_loo %]
@@ -60,9 +61,9 @@
                                     [% ELSE %]
                                         [% IF ( languages_loo.group_enabled ) %]
                                             [% IF ( languages_loo.current ) %]
-                                                <li class="active"><p class="navbar-text">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]</p></li>
+                                                <li class="active"><p class="navbar-text">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]</p></li>
                                             [% ELSE %]
-                                                <li><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% languages_loo.rfc4646_subtag %]">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description %][% ELSE %][% languages_loo.rfc4646_subtag %][% END %]</a></li>
+                                                <li><a href="/cgi-bin/koha/opac-changelanguage.pl?language=[% languages_loo.rfc4646_subtag | html %]">[% IF ( languages_loo.native_description ) %][% languages_loo.native_description | html %][% ELSE %][% languages_loo.rfc4646_subtag | html %][% END %]</a></li>
                                             [% END %]
                                         [% END # / IF languages_loo.current %]
                                     [% END # / IF ( languages_loo.plural ) %]
 
 
 <!-- JavaScript includes -->
-[% Asset.js("lib/jquery/jquery.js") %]
-[% Asset.js("lib/jquery/jquery-ui.js") %]
+[% Asset.js("lib/jquery/jquery.js") | $raw %]
+[% Asset.js("lib/jquery/jquery-ui.js") | $raw %]
 <script>
 // Resolve name collision between jQuery UI and Twitter Bootstrap
 $.widget.bridge('uitooltip', $.ui.tooltip);
 </script>
-[% Asset.js("lib/bootstrap/js/bootstrap.min.js") %]
-[% Asset.js("js/global.js") %]
+[% Asset.js("lib/bootstrap/js/bootstrap.min.js") | $raw %]
+[% Asset.js("js/global.js") | $raw %]
 <script>
     Modernizr.load([
         // Test need for polyfill
         {
             test: window.matchMedia,
-            nope: "[% Asset.url('lib/media.match.min.js') %]"
+            nope: "[% Asset.url('lib/media.match.min.js') | $raw %]"
         },
         // and then load enquire
-        "[% Asset.url('lib/enquire.min.js') %]",
-        "[% Asset.url('js/script.js') %]",
+        "[% Asset.url('lib/enquire.min.js') | $raw %]",
+        "[% Asset.url('js/script.js') | $raw %]",
     ]);
 
     // Fix for datepicker in a modal
@@ -107,13 +108,13 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
         var NO_AMAZON_IMAGE = _("No cover image available");
     //]]>
 </script>
-[% Asset.js("js/amazonimages.js") %]
+[% Asset.js("js/amazonimages.js") | $raw %]
 [% END %]
 
-[% Asset.js("lib/emoji-picker/js/config.js") %]
-[% Asset.js("lib/emoji-picker/js/util.js") %]
-[% Asset.js("lib/emoji-picker/js/jquery.emojiarea.js") %]
-[% Asset.js("lib/emoji-picker/js/emoji-picker.js") %]
+[% Asset.js("lib/emoji-picker/js/config.js") | $raw %]
+[% Asset.js("lib/emoji-picker/js/util.js") | $raw %]
+[% Asset.js("lib/emoji-picker/js/jquery.emojiarea.js") | $raw %]
+[% Asset.js("lib/emoji-picker/js/emoji-picker.js") | $raw %]
 
 <script>
     //<![CDATA[
@@ -179,16 +180,16 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 </script>
 
 [% IF Koha.Preference( 'opacbookbag' ) == 1 %]
-    [% Asset.js("js/basket.js") %]
+    [% Asset.js("js/basket.js") | $raw %]
 [% ELSIF ( Koha.Preference( 'virtualshelves' ) == 1 ) %]
-    [% Asset.js("js/basket.js") %]
+    [% Asset.js("js/basket.js") | $raw %]
 [% ELSE %]
     <script>var readCookie;</script>
 [% END %]
 
-[% IF Koha.Preference( 'opacuserlogin' ) == 1 %][% IF Koha.Preference( 'TagsEnabled' ) == 1 %][% Asset.js("js/tags.js") %][% END %][% ELSE %][% END %]
+[% IF Koha.Preference( 'opacuserlogin' ) == 1 %][% IF Koha.Preference( 'TagsEnabled' ) == 1 %][% Asset.js("js/tags.js") | $raw %][% END %][% ELSE %][% END %]
 [% IF ( GoogleJackets ) %]
-    [% Asset.js("js/google-jackets.js") %]
+    [% Asset.js("js/google-jackets.js") | $raw %]
     <script>
         //<![CDATA[
         var NO_GOOGLE_JACKET = _("No cover image available");
@@ -196,7 +197,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
     </script>
 [% END %]
 [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-    [% Asset.js("js/coce.js") %]
+    [% Asset.js("js/coce.js") | $raw %]
     <script>
         //<![CDATA[
         var NO_COCE_JACKET = _("No cover image available");
@@ -205,7 +206,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 [% END %]
 
 [% IF OpenLibraryCovers || OpenLibrarySearch %]
-    [% Asset.js("js/openlibrary.js") %]
+    [% Asset.js("js/openlibrary.js") | $raw %]
     <script>
     //<![CDATA[
     var NO_OL_JACKET = _("No cover image available");
@@ -215,7 +216,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 [% END %]
 
 [% IF OPACLocalCoverImages %]
-    [% Asset.js("js/localcovers.js") %]
+    [% Asset.js("js/localcovers.js") | $raw %]
     <script>
     //<![CDATA[
     var NO_LOCAL_JACKET = _("No cover image available");
@@ -224,7 +225,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 [% END %]
 
 [% IF ( BakerTaylorEnabled ) %]
-    [% Asset.js("js/bakertaylorimages.js") %]
+    [% Asset.js("js/bakertaylorimages.js") | $raw %]
     <script>
         //<![CDATA[
         var NO_BAKERTAYLOR_IMAGE = _("No cover image available");
@@ -236,7 +237,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 [% END %]
 [% IF ( GoogleIndicTransliteration ) %]
     <script src="https://www.google.com/jsapi"></script>
-    [% Asset.js("js/googleindictransliteration.js") %]
+    [% Asset.js("js/googleindictransliteration.js") | $raw %]
 [% END %]
 
 [% IF Koha.Preference( 'OpacNewsLibrarySelect' ) %]
@@ -247,7 +248,7 @@ $.widget.bridge('uitooltip', $.ui.tooltip);
 </script>
 [% END %]
 
-[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") | $raw %]
 <script>
 $(document).ready(function() {
     if($('#searchsubmit').length) {
@@ -261,7 +262,7 @@ $(document).ready(function() {
 
     window.emojiPicker = new EmojiPicker({
       emojiable_selector: '[data-emojiable=true]',
-      assetsPath: '[% interface %]/lib/emoji-picker/img/',
+      assetsPath: '[% interface | html %]/lib/emoji-picker/img/',
       popupButtonClasses: 'fa fa-smile-o'
     });
     window.emojiPicker.discover();
@@ -271,7 +272,7 @@ $(document).ready(function() {
 [% IF ( OPACUserJS ) %]
     <script>
         //<![CDATA[
-        [% OPACUserJS %]
+        [% OPACUserJS | $raw %]
         //]]>
     </script>
 [% END %]
@@ -280,11 +281,11 @@ $(document).ready(function() {
     [% IF ( SCOUserJS ) %]
         <script>
             //<![CDATA[
-            [% SCOUserJS %]
+            [% SCOUserJS | $raw %]
             //]]>
         </script>
     [% END %]
 [% END %]
-[% KohaPlugins.get_plugins_opac_js %]
+[% KohaPlugins.get_plugins_opac_js | html %]
 </body>
 </html>
index e408d0a..4fa6f50 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Biblio %]
 <ul id="action">
     [% UNLESS ( norequests ) %]
         [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
             [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %]
                 [% IF ( ReservableItems ) %]
-                    <li><a class="reserve" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% biblio.biblionumber %]">Place hold</a></li>
+                    <li><a class="reserve" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% biblio.biblionumber | html %]">Place hold</a></li>
                 [% END %]
             [% END %]
         [% END %]
 
     [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
         [% IF Koha.Preference('ArticleRequests') %]
-            <li><a class="article_request" href="/cgi-bin/koha/opac-request-article.pl?biblionumber=[% biblio.biblionumber %]">Request article</a></li>
+            <li><a class="article_request" href="/cgi-bin/koha/opac-request-article.pl?biblionumber=[% biblio.biblionumber | html %]">Request article</a></li>
         [% END %]
     [% END %]
 
     [% IF Koha.Preference( 'virtualshelves' ) == 1 %]
         [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername ) %]
-            <li><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% biblio.biblionumber %]">Save to your lists</a></li>
+            <li><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% biblio.biblionumber | html %]">Save to your lists</a></li>
         [% END %]
     [% END %]
 
     [% IF Koha.Preference( 'opacbookbag' ) == 1 %]
         [% IF ( incart ) %]
-            <li><a class="incart cart[% biblio.biblionumber %] addrecord" href="#">In your cart</a> <a class="cartRemove cartR[% biblio.biblionumber %]" href="#">(remove)</a></li>
+            <li><a class="incart cart[% biblio.biblionumber | html %] addrecord" href="#">In your cart</a> <a class="cartRemove cartR[% biblio.biblionumber | html %]" href="#">(remove)</a></li>
         [% ELSE %]
-            <li><a class="addtocart cart[% biblio.biblionumber %] addrecord" href="#">Add to your cart</a>  <a style="display:none;" class="cartRemove cartR[% biblio.biblionumber %]" href="#">(remove)</a></li>
+            <li><a class="addtocart cart[% biblio.biblionumber | html %] addrecord" href="#">Add to your cart</a>  <a style="display:none;" class="cartRemove cartR[% biblio.biblionumber | html %]" href="#">(remove)</a></li>
         [% END %]
     [% END %]
 
@@ -51,7 +52,7 @@
                                     <li><a role="menuitem" href="#" data-toggle="modal" data-target="#exportModal_">Dublin Core</a></li>
                                 [% ELSE %]
                                 <li>
-                                    <a role="menuitem" href="/cgi-bin/koha/opac-export.pl?op=export&amp;bib=[% biblio.biblionumber %]&amp;format=[% option %]">
+                                    <a role="menuitem" href="/cgi-bin/koha/opac-export.pl?op=export&amp;bib=[% biblio.biblionumber | html %]&amp;format=[% option | html %]">
                                         [% SWITCH option %]
                                             [% CASE 'bibtex' %]BIBTEX
                                             [% CASE 'endnote' %]EndNote
@@ -80,7 +81,7 @@
                     <a id="furthersearches" class="dropdown-toggle" data-toggle="dropdown" href="#">More searches <b class="caret"></b></a>
                         <ul class="dropdown-menu pull-right" role="menu" aria-labelledby="furthersearches">
                             <li><a href="#" class="menu-inactive">Search for this title in:</a></li>
-                            [% OPACSearchForTitleIn %]
+                            [% OPACSearchForTitleIn | $raw %]
                         </ul>
                 </div>
             </div>
                 <label class="label_dc" for="input-srw">SRW-DC</label>
                 <br>
         <input type="hidden" name="op" value="export">
-        <input type="hidden" name="bib" value="[% biblio.biblionumber %]">
+        <input type="hidden" name="bib" value="[% biblio.biblionumber | html %]">
         </fieldset>
     </div>
     <div class="modal-footer">
index fbab708..db0ba0f 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE AuthorisedValues %]
 [% IF ( opacfacets && facets_loop && total ) %]
     <div id="search-facets">
@@ -7,18 +8,18 @@
                 <ul>
                     <li>
                         [% IF ( available ) %]
-                            <strong>Showing only available items</strong></li><li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi_not_availablity %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Show all items</a>
+                            <strong>Showing only available items</strong></li><li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi_not_availablity | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]">Show all items</a>
                         [% ELSE %]
-                            <a href="/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi |url %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]&amp;limit=available">Limit to currently available items.</a>
+                            <a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi |url %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |url %][% END %]&amp;limit=available">Limit to currently available items.</a>
                         [% END %]
                     </li>
                 </ul>
-                [% IF ( related ) %] <li>(related searches: [% FOREACH relate IN related %][% relate.related_search %][% END %])</li>[% END %]
+                [% IF ( related ) %] <li>(related searches: [% FOREACH relate IN related %][% relate.related_search | html %][% END %])</li>[% END %]
             </li>
 
             [% FOREACH facets_loo IN facets_loop %]
                 [% IF facets_loo.facets.size > 0 %]
-                    <li id="[% facets_loo.type_id %]">
+                    <li id="[% facets_loo.type_id | html %]">
                         [% IF facets_loo.type_label_Authors %]<h5 id="facet-authors">Authors</h5>[% END %]
                         [% IF facets_loo.type_label_Titles %]<h5 id="facet-titles">Titles</h5>[% END %]
                         [% IF facets_loo.type_label_Topics %]<h5 id="facet-topics">Topics</h5>[% END %]
                         <ul>
                             [% SET url = "/cgi-bin/koha/opac-search.pl?" _ query_cgi _ limit_cgi %]
                             [% IF ( sort_by ) %]
-                              [% url = BLOCK %][% url %][% "&amp;sort_by=" _ sort_by |url %][% END %]
+                              [% url = BLOCK | html %][% url | html %][% "&amp;sort_by=" _ sort_by |url %][% END %]
                             [% END %]
                             [% FOREACH facet IN facets_loo.facets %]
                             [% IF facets_loo.type_label_CollectionCodes %][% SET facet.facet_label_value = AuthorisedValues.GetByCode('CCODE',facet.facet_label_value,1) || facet.facet_label_value %][% END %]
                                 <li>
                                   [% IF facet.active %]
                                     [% SET local_url = url _ "&amp;nolimit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-                                    <span class="facet-label">[% facet.facet_label_value %]</span>
-                                    [<a href="[% local_url %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
+                                    <span class="facet-label">[% facet.facet_label_value | html %]</span>
+                                    [<a href="[% local_url | html %]" title="Remove facet [% facet.facet_link_value | html %]">x</a>]
                                   [% ELSE %]
                                     [% SET local_url = url _ "&amp;limit=" _ facet.type_link_value _ ":" _ facet.facet_link_value %]
-                                    <span class="facet-label"><a href="[% local_url %]" title="[% facet.facet_title_value |html %]">[% facet.facet_label_value %]</a></span>
+                                    <span class="facet-label"><a href="[% local_url | html %]" title="[% facet.facet_title_value | html %]">[% facet.facet_label_value | html %]</a></span>
                                     [% IF ( displayFacetCount ) %]
-                                      <span class="facet-count"> ([% facet.facet_count %])</span>
+                                      <span class="facet-count"> ([% facet.facet_count | html %])</span>
                                     [% END %]
                                   [% END %]
                                 </li>
                             [% END %]
                             [% IF ( facets_loo.expandable ) %]
                                 <li class="showmore">
-                                    <a href="[% url %][% IF offset %]&amp;offset=[% offset |url %][% END %]&amp;expand=[% facets_loo.expand |url %]#[% facets_loo.type_id |url %]">Show more</a>
+                                    <a href="[% url | html %][% IF offset %]&amp;offset=[% offset |url %][% END %]&amp;expand=[% facets_loo.expand |url %]#[% facets_loo.type_id |url %]">Show more</a>
                                 </li>
                             [% END %]
                         </ul>
@@ -66,7 +67,7 @@
 
     [% IF ( OPACResultsSidebar ) %]
         <div id="opacresultssidebar">
-            [% OPACResultsSidebar %]
+            [% OPACResultsSidebar | $raw %]
         </div>
     [% END %]
 [% END # / IF opacfacets && facets_loop %]
index e2b3d67..39b6cfd 100644 (file)
@@ -4,12 +4,12 @@
         <ul>
             [% FOREACH message IN patron_messages %]
                 <li>
-                    <strong>[% message.message %]</strong><br>
-                    &nbsp;&nbsp;&nbsp;<i>Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) %]</i>
+                    <strong>[% message.message | html %]</strong><br>
+                    &nbsp;&nbsp;&nbsp;<i>Written on [% message.message_date | $KohaDates %] by [% Branches.GetName(message.branchcode) | html %]</i>
                 </li>
             [% END %]
 
-            [% IF ( opacnote ) %]<li>[% opacnote %]</li>[% END %]
+            [% IF ( opacnote ) %]<li>[% opacnote | html %]</li>[% END %]
         </ul>
     </div>
 [% END %]
index dd44713..5bf505b 100644 (file)
@@ -25,7 +25,7 @@
                             </select></li>
                 [% END %]
 
-                [% AdvancedSearchTypes = Koha.Preference('AdvancedSearchTypes').split('\|') %]
+                [% AdvancedSearchTypes = Koha.Preference('AdvancedSearchTypes').split('\|') | html %]
                 [% IF AdvancedSearchTypes.grep('^itemtypes$').size %]
                     <li>
                         <label for="itemtype">Limit to: </label>
                             <option value="">All item types</option>
                             [% FOREACH itemtype IN ItemTypes.Get() %]
                                 [% IF itemtype.itemtype == selected_itemtype %]
-                                    <option value="[% itemtype.itemtype %]" selected="selected">
+                                    <option value="[% itemtype.itemtype | html %]" selected="selected">
                                 [% ELSE %]
-                                    <option value="[% itemtype.itemtype %]">
+                                    <option value="[% itemtype.itemtype | html %]">
                                 [% END %]
-                                    [% itemtype.translated_description %]
+                                    [% itemtype.translated_description | html %]
                                 </option>
                             [% END %]
                         </select>
                             <option value="">All collections</option>
                             [% FOREACH ccode IN AuthorisedValues.Get('CCODE', 1) %]
                                 [% IF ccode.authorised_value == selected_ccode %]
-                                    <option value="[% ccode.authorised_value %]" selected="selected">
+                                    <option value="[% ccode.authorised_value | html %]" selected="selected">
                                 [% ELSE %]
-                                    <option value="[% ccode.authorised_value %]">
+                                    <option value="[% ccode.authorised_value | html %]">
                                 [% END %]
-                                    [% ccode.lib %]
+                                    [% ccode.lib | html %]
                                 </option>
                             [% END %]
                         </select>
index 91cf4d7..d7fee6c 100644 (file)
@@ -1,4 +1,4 @@
 [%# Input params: bib - search result biblio record %]
 [% IF OpenLibrarySearch && ( bib.normalized_isbn || bib.lccn || bib.normalized_oclc ) %]
-    <div class="ol_readapi_book" isbn="[% bib.normalized_isbn %]" lccn="[% bib.lccn %]" oclc="[% bib.normalized_oclc %]">Open Library: </div>
+    <div class="ol_readapi_book" isbn="[% bib.normalized_isbn | html %]" lccn="[% bib.lccn | html %]" oclc="[% bib.normalized_oclc | html %]">Open Library: </div>
 [% END %]
index 48789a0..01f8a02 100644 (file)
@@ -1,21 +1,21 @@
 [% IF ( PAGE_NUMBERS ) %]
     <div class="pagination pagination-small noprint">
-     [% IF hits_to_paginate < total %]<h6>[% hits_to_paginate %] of [% total %] results loaded, refine your search to view other records</h6>[% END %]
+     [% IF hits_to_paginate < total %]<h6>[% hits_to_paginate | html %] of [% total | html %] results loaded, refine your search to view other records</h6>[% END %]
         <ul>
             [% IF ( previous_page_offset.defined ) %]
-                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">First</a></li>
-                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% previous_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">&laquo; Previous</a></li>
+                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by | html %][% END %]">First</a></li>
+                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;offset=[% previous_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by | html %][% END %]">&laquo; Previous</a></li>
             [% END %]
             [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %]
                 [% IF ( PAGE_NUMBER.highlight ) %]
-                    <li class="active"><a href="#">[% PAGE_NUMBER.pg %]</a></li>
+                    <li class="active"><a href="#">[% PAGE_NUMBER.pg | html %]</a></li>
                 [% ELSE %]
-                    <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% PAGE_NUMBER.offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html%][% END %]">[% PAGE_NUMBER.pg %]</a></li>
+                    <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;offset=[% PAGE_NUMBER.offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by | html %][% END %]">[% PAGE_NUMBER.pg | html %]</a></li>
                 [% END %]
             [% END %]
             [% IF ( next_page_offset ) %]
-                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% next_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">Next &raquo;</a></li>
-                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;offset=[% last_page_offset %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by |html %][% END %]">Last</a></li>
+                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;offset=[% next_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by | html %][% END %]">Next &raquo;</a></li>
+                <li><a href="/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;offset=[% last_page_offset | html %][% IF ( sort_by ) %]&amp;sort_by=[% sort_by | html %][% END %]">Last</a></li>
             [% END %]
         </ul>
     </div>
index 14acd85..1a94309 100644 (file)
@@ -3,13 +3,13 @@
 <script>
     var pwd_title = "";
     var pattern_title = "";
-    var new_password_node_name = "[% new_password %]";
+    var new_password_node_name = "[% new_password | html %]";
     [% IF Koha.Preference('RequireStrongPassword') %]
-        pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength %]);
-        pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength %],}/;
+        pwd_title = _("Password must contain at least %s characters, including UPPERCASE, lowercase and numbers").format([% minPasswordLength | html %]);
+        pattern_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{[% minPasswordLength | html %],}/;
     [% ELSIF minPasswordLength %]
-        pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength %]);
-        pattern_regex = /.{[% minPasswordLength %],}/;
+        pwd_title = _("Password must contain at least %s characters").format([% minPasswordLength | html %]);
+        pattern_regex = /.{[% minPasswordLength | html %],}/;
     [% END %]
     jQuery.validator.addMethod("password_strong", function(value, element){
         return this.optional(element) || pattern_regex.test(value);
index 81a4e72..d77961d 100644 (file)
@@ -1,8 +1,8 @@
 [%- IF patron.category.category_type == 'I' -%]
-    [% patron.surname %][% IF patron.othernames %] ([% patron.othernames %]) [%- END -%]
+    [% patron.surname | html %][% IF patron.othernames %] ([% patron.othernames | html %]) [%- END -%]
 [%- ELSE -%]
     [%- IF patron.title -%]
-        <span class="patron-title">[% patron.title %]</span>
+        <span class="patron-title">[% patron.title | html %]</span>
     [%- END -%]
-    [% patron.firstname %] [% patron.surname %]
+    [% patron.firstname | html %] [% patron.surname | html %]
 [%- END -%]
index d435134..e36ce82 100644 (file)
@@ -2,10 +2,10 @@
     [% IF OpenOPACShelfBrowser %]
         <div id="shelfbrowser">
             <h5 style="text-align: center;">
-                [% IF ( starting_homebranch ) %]Browsing [% starting_homebranch %] Shelves[% END %]
-                [% IF ( starting_location ) %], Shelving location: [% starting_location %][% END %]
-                [% IF ( starting_ccode ) %], Collection code: [% starting_ccode %][% END %]
-                <a style="font-size: 75%;" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]" class="close_shelf" >Close shelf browser</a>
+                [% IF ( starting_homebranch ) %]Browsing [% starting_homebranch | html %] Shelves[% END %]
+                [% IF ( starting_location ) %], Shelving location: [% starting_location | html %][% END %]
+                [% IF ( starting_ccode ) %], Collection code: [% starting_ccode | html %][% END %]
+                <a style="font-size: 75%;" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]" class="close_shelf" >Close shelf browser</a>
             </h5>
 
             <table class="table">
                     <td rowspan="2">
                       [% IF shelfbrowser_prev_item %]
                         <div id="browser_previous">
-                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% shelfbrowser_prev_item.biblionumber %]&amp;shelfbrowse_itemnumber=[% shelfbrowser_prev_item.itemnumber %]#shelfbrowser" data-prev-itemnumber="[% shelfbrowser_prev_item.itemnumber %]">Previous</a>
+                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% shelfbrowser_prev_item.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% shelfbrowser_prev_item.itemnumber | html %]#shelfbrowser" data-prev-itemnumber="[% shelfbrowser_prev_item.itemnumber | html %]">Previous</a>
                         </div>
                       [% END %]
                     </td>
 
                     [% FOREACH item IN shelfbrowser_items %]
                         <td>
-                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% item.biblionumber %]&amp;shelfbrowse_itemnumber=[% item.itemnumber %]#shelfbrowser">
+                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% item.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% item.itemnumber | html %]#shelfbrowser">
                                 [% IF ( OPACLocalCoverImages ) %]
-                                    <div title="[% item.biblionumber |url %]" class="[% item.biblionumber %] thumbnail-shelfbrowser" id="local-thumbnail-shelf-[% item.biblionumber %]"></div>
+                                    <div title="[% item.biblionumber |url %]" class="[% item.biblionumber | html %] thumbnail-shelfbrowser" id="local-thumbnail-shelf-[% item.biblionumber | html %]"></div>
                                 [% END %]
                                 [% IF ( OPACAmazonCoverImages ) %]
                                     [% IF ( item.browser_normalized_isbn ) %]
-                                        <img src="https://images-na.ssl-images-amazon.com/images/P/[% item.browser_normalized_isbn %].01._AA75_PU_PU-5_.jpg" alt="" />
+                                        <img src="https://images-na.ssl-images-amazon.com/images/P/[% item.browser_normalized_isbn | html %].01._AA75_PU_PU-5_.jpg" alt="" />
                                     [% ELSE %]
                                         <span class="no-image">No cover image available</span>
                                     [% END %]
@@ -35,7 +35,7 @@
                                 [% IF ( SyndeticsEnabled ) %]
                                     [% IF ( SyndeticsCoverImages ) %]
                                         [% IF ( content_identifier_exists ) %]
-                                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% item.browser_normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %][% IF ( item.browser_normalized_upc ) %]&amp;upc=[% item.browser_normalized_upc %][% END %][% IF ( item.browser_normalized_oclc ) %]&amp;oclc=[% item.browser_normalized_oclc %][% END %]&amp;type=xw10" alt="" />
+                                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% item.browser_normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %][% IF ( item.browser_normalized_upc ) %]&amp;upc=[% item.browser_normalized_upc | html %][% END %][% IF ( item.browser_normalized_oclc ) %]&amp;oclc=[% item.browser_normalized_oclc | html %][% END %]&amp;type=xw10" alt="" />
                                         [% ELSE %]
                                             <span class="no-image">No cover image available</span>
                                         [% END %]
 
                                 [% IF ( GoogleJackets ) %]
                                     [% IF ( item.browser_normalized_isbn ) %]
-                                        <div title="[% item.biblionumber |url %]" class="[% item.browser_normalized_isbn %]" id="gbs-thumbnail-preview[% loop.count %]"></div>
+                                        <div title="[% item.biblionumber |url %]" class="[% item.browser_normalized_isbn | html %]" id="gbs-thumbnail-preview[% loop.count | html %]"></div>
                                     [% ELSE %]
                                         <span class="no-image">No cover image available</span>
                                     [% END %]
                                 [% END %]
                                 [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                                  [% coce_id = item.browser_normalized_ean || item.browser_normalized_isbn %]
-                                  <div title="[% item.biblionumber |url %]" class="[% coce_id %]" id="coce-thumbnail-preview-[% coce_id %]"></div>
+                                  [% coce_id = item.browser_normalized_ean || item.browser_normalized_isbn | html %]
+                                  <div title="[% item.biblionumber |url %]" class="[% coce_id | html %]" id="coce-thumbnail-preview-[% coce_id | html %]"></div>
                                 [% END %]
                                 [% IF ( BakerTaylorEnabled ) %]
-                                    [% bt_id = ( item.browser_normalized_upc || item.browser_normalized_isbn ) %]
+                                    [% bt_id = ( item.browser_normalized_upc || item.browser_normalized_isbn ) | html %]
                                     [% IF ( bt_id ) %]
-                                        <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" />
+                                        <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" />
                                     [% ELSE %]
                                         <span class="no-image">No cover image available</span>
                                     [% END %]
@@ -67,7 +67,7 @@
                     <td rowspan="2">
                         [% IF shelfbrowser_next_item %]
                             <div id="browser_next">
-                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% shelfbrowser_next_item.biblionumber %]&amp;shelfbrowse_itemnumber=[% shelfbrowser_next_item.itemnumber %]#shelfbrowser" data-next-itemnumber="[% shelfbrowser_next_item.itemnumber %]">Next</a>
+                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% shelfbrowser_next_item.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% shelfbrowser_next_item.itemnumber | html %]#shelfbrowser" data-next-itemnumber="[% shelfbrowser_next_item.itemnumber | html %]">Next</a>
                             </div>
                         [% END %]
                     </td>
                 <tr>
                     [% FOREACH item IN shelfbrowser_items %]
                         <td class="top">
-                            [% item.itemcallnumber %]
-                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% item.biblionumber %]&amp;shelfbrowse_itemnumber=[% item.itemnumber %]#shelfbrowser">
-                                [% item.title |html %]
+                            [% item.itemcallnumber | html %]
+                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% item.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% item.itemnumber | html %]#shelfbrowser">
+                                [% item.title | html %]
                                 [% FOREACH subtitl IN item.subtitle %]
                                     [% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %]
-                                    [% subtitl.subfield |html %]
+                                    [% subtitl.subfield | html %]
                                 [% END %]
                             </a>
                         </td>
index 388e012..63f4bc2 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 <script>
 [% IF ( Koha.Preference('IntranetSlipPrinterJS') ) %]
-    [% Koha.Preference('IntranetSlipPrinterJS') %]
+    [% Koha.Preference('IntranetSlipPrinterJS') | $raw %]
 [% ELSE %]
     $( window ).load(function() {
         window.print();
index 00ce135..bf89be2 100644 (file)
         <tbody>
             [% FOREACH e IN enrollments %]
                 <tr>
-                    <td>[% e.club.name %]</td>
-                    <td>[% e.club.description %]</td>
+                    <td>[% e.club.name | html %]</td>
+                    <td>[% e.club.description | html %]</td>
                     <td>[% e.date_enrolled | $KohaDates %]</td>
                     <td>
                         [% IF e.club.club_template.is_enrollable_from_opac %]
-                            <button class="btn btn-xs btn-default" onclick="cancelEnrollment( [% e.id %] )">
+                            <button class="btn btn-xs btn-default" onclick="cancelEnrollment( [% e.id | html %] )">
                                 <i class="icon-remove"></i> Cancel enrollment
                             </button>
                         [% ELSE %]
         <tbody>
             [% FOREACH c IN clubs %]
                 <tr>
-                    <td>[% c.name %]</td>
-                    <td>[% c.description %]</td>
+                    <td>[% c.name | html %]</td>
+                    <td>[% c.description | html %]</td>
                     <td>
                         [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && borrower.first_valid_email_address ) %]
-                            <button class="btn btn-xs btn-default" onclick="loadEnrollmentForm([% c.id %])">
+                            <button class="btn btn-xs btn-default" onclick="loadEnrollmentForm([% c.id | html %])">
                                 <i class="icon-plus"></i> Enroll
                             </button>
                         [% ELSE %]
@@ -71,7 +71,7 @@
 <script>
 function loadEnrollmentForm( id ) {
     $("body").css("cursor", "progress");
-    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber %]&id=' + id, function() {
+    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber | html %]&id=' + id, function() {
         $("body").css("cursor", "default");
     });
 
@@ -86,7 +86,7 @@ function cancelEnrollment( id ) {
         data: { id: id },
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrower.borrowernumber %]', function() {
+                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrower.borrowernumber | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
index ce9531d..c684626 100644 (file)
@@ -2,28 +2,28 @@
 [% SET AuthorisedValuesCategories = AuthorisedValues.GetCategories %]
 
 <h3>
-    Enroll in <i>[% club.name %]</i>
+    Enroll in <i>[% club.name | html %]</i>
 </h3>
 
 <div class="container">
     <form id="patron-enrollment-form">
-        <input type="hidden" name="id" value="[% club.id %]" />
-        <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+        <input type="hidden" name="id" value="[% club.id | html %]" />
+        <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
         <fieldset class="rows">
             <ol>
                 [% FOREACH f IN club.club_template.club_template_enrollment_fields %]
                     <li>
-                        <label>[% f.name %]</label>
+                        <label>[% f.name | html %]</label>
                         [% IF f.authorised_value_category %]
-                            <select name="[% f.id %]">
+                            <select name="[% f.id | html %]">
                                 [% FOREACH a IN AuthorisedValues.Get( f.authorised_value_category ) %]
-                                    <option value="[% a.authorised_value %]">[% a.lib %]</option>
+                                    <option value="[% a.authorised_value | html %]">[% a.lib | html %]</option>
                                 [% END %]
                             </select>
                         [% ELSE %]
-                            <input type="text" name="[% f.id %]" />
+                            <input type="text" name="[% f.id | html %]" />
                         [% END %]
-                        <span class="hint">[% f.description %]</span>
+                        <span class="hint">[% f.description | html %]</span>
                     </li>
                 [% END %]
 
@@ -45,7 +45,7 @@ function addEnrollment() {
         data: $( "#patron-enrollment-form" ).serialize(),
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber %]&id=[% club.id %]', function() {
+                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
@@ -59,7 +59,7 @@ function addEnrollment() {
 
 function showClubs() {
     $("body").css("cursor", "progress");
-    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber %]&id=[% club.id %]', function() {
+    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
         $("body").css("cursor", "default");
     });
 }
index b0023d8..e1e242d 100644 (file)
@@ -1,15 +1,15 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  An error has occurred</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  An error has occurred</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
-<body id="error[% errno %]" class="error">
+<body id="error[% errno | html %]" class="error">
 [% INCLUDE 'masthead.inc' %]
 
     <div class="main">
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="#">Error [% errno %]</a></li>
+            <li><a href="#">Error [% errno | html %]</a></li>
         </ul>
 
         <div class="container-fluid">
@@ -24,9 +24,9 @@
                 [% ELSE %]
                     <div class="span12">
                 [% END %]
-                    <div id="errormsg[% errno %]">
+                    <div id="errormsg[% errno | html %]">
                         <h3>Sorry, the requested page is not available</h3>
-                        <h4>Error [% errno %]</h4>
+                        <h4>Error [% errno | html %]</h4>
                         <h3>This message can have the following reason(s):</h3>
                         <ul>
                             [% IF ( errno == 400 ) %]
@@ -67,9 +67,9 @@
                         <h3>Report issues and broken links</h3>
                         <ul>
                             <li>To report this error, please contact the Koha Administrator.
-                                    <a href="mailto:[% admin %]">Send email</a>.</li>
+                                    <a href="mailto:[% admin | html %]">Send email</a>.</li>
                         </ul>
-                    </div> <!-- / #errormsg[% errno %] -->
+                    </div> <!-- / #errormsg[% errno | html %] -->
                 </div> <!-- / .span10/12 -->
             </div> <!-- / .row-fluid -->
         </div> <!-- / .container-fluid -->
index f62f310..7dc59da 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;
     [% IF ( GetAvailability ) %]
         ILS-DI &rsaquo; GetAvailability
     [% ELSIF ( GetRecords ) %]
index b7e0f75..3445bbf 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>
 </head>
 <body id="opac_maintenance" class="opac">
     [% IF ( opacheader ) %]
-        [% opacheader %]
+        [% opacheader | $raw %]
     [% END %]
     <div class="container-fluid">
         <div class="row-fluid">
             <div class="span12">
                 <div id="opac-maintenance-message">
                     [% IF Koha.Preference( 'OpacMaintenanceNotice' ) %]
-                        [% Koha.Preference( 'OpacMaintenanceNotice' ) %]
+                        [% Koha.Preference( 'OpacMaintenanceNotice' ) | html %]
                     [% ELSE %]
                         <h2>System Maintenance</h2>
-                          <p>The [% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog is offline for system maintenance. We'll be back soon! If you have any questions, please contact the <a href="mailto:[% KohaAdminEmailAddress %]">site administrator</a></p>
+                          <p>The [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog is offline for system maintenance. We'll be back soon! If you have any questions, please contact the <a href="mailto:[% KohaAdminEmailAddress | html %]">site administrator</a></p>
                     [% END %]
                 </div>
             </div>
index 8371680..8b5cb00 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; ISBD view</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; ISBD view</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -19,9 +20,9 @@
                     <div id="usermarcdetail">
                         <div id="catalogue_detail_biblio">
                             <div id="views">
-                                <span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber %]">Normal view</a></span> <span class="view"><a id="MARCview" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% biblio.biblionumber %]">MARC view</a></span> <span class="view current-view"><span id="ISBDview">ISBD view</span></span></div>
+                                <span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber | html %]">Normal view</a></span> <span class="view"><a id="MARCview" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% biblio.biblionumber | html %]">MARC view</a></span> <span class="view current-view"><span id="ISBDview">ISBD view</span></span></div>
 
-                                <div id="isbdcontents">[% ISBD %]</div>
+                                <div id="isbdcontents">[% ISBD | $raw %]</div>
 
                         </div> <!-- / #catalogue_detail_biblio -->
                     </div> <!-- / #usermarcdetail -->
index c27adb3..3ffb885 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  MARC details for record no. [% biblio.biblionumber %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  MARC details for record no. [% biblio.biblionumber | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -9,7 +10,7 @@
 <div class="main">
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-        <li><a href="#">MARC view: [% bibliotitle %]</a></li>
+        <li><a href="#">MARC view: [% bibliotitle | html %]</a></li>
     </ul>
 
     <div class="container-fluid">
                         <div id="catalogue_detail_biblio">
 
                             <div id="views">
-                                <span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber %]">Normal view</a></span>
+                                <span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber | html %]">Normal view</a></span>
                                 <span class="view current-view"><span id="MARCview">MARC view</span></span>
-                                [% IF ( ISBD ) %]<span class="view"><a id="ISBDview"  href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% biblio.biblionumber %]">ISBD view</a></span>[% END %]
+                                [% IF ( ISBD ) %]<span class="view"><a id="ISBDview"  href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% biblio.biblionumber | html %]">ISBD view</a></span>[% END %]
                             </div>
-                            <h1 class="title">[% bibliotitle %] (Record no. [% biblio.biblionumber %])</h1>
+                            <h1 class="title">[% bibliotitle | html %] (Record no. [% biblio.biblionumber | html %])</h1>
 
                             [% IF ( OPACXSLTDetailsDisplay ) %]
-                                <div id="switchview_div">[ <a id="switchview" href="/cgi-bin/koha/opac-showmarc.pl?id=[% biblio.biblionumber %]&amp;viewas=html">view plain</a> ]</div>
+                                <div id="switchview_div">[ <a id="switchview" href="/cgi-bin/koha/opac-showmarc.pl?id=[% biblio.biblionumber | html %]&amp;viewas=html">view plain</a> ]</div>
                                 <div id="plainmarc"></div>
                             [% END %]
 
                             <div id="labeledmarc">
                                 <table id="marc" class="table table-bordered table-striped">
                                     [% FOREACH tab0X IN tab0XX %]
-                                    <tr><th colspan="2">[% tab0X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab0X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab0X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
                                     [% FOREACH tab1X IN tab1XX %]
-                                    <tr><th colspan="2">[% tab1X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab1X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab1X.subfield %]
                                             <tr>
-                                                <td  >[% subfiel.marc_lib %]</td>
-                                                <td  >[% subfiel.marc_value %]</td>
+                                                <td  >[% subfiel.marc_lib | $raw %]</td>
+                                                <td  >[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab2X IN tab2XX %]
-                                    <tr><th colspan="2">[% tab2X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab2X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab2X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab3X IN tab3XX %]
-                                    <tr><th colspan="2">[% tab3X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab3X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab3X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab4X IN tab4XX %]
-                                    <tr><th colspan="2" >[% tab4X.tag %]</th></tr>
+                                    <tr><th colspan="2" >[% tab4X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab4X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab5X IN tab5XX %]
-                                    <tr><th colspan="2">[% tab5X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab5X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab5X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab6X IN tab6XX %]
-                                    <tr><th colspan="2">[% tab6X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab6X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab6X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab7X IN tab7XX %]
-                                    <tr><th colspan="2">[% tab7X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab7X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab7X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab8X IN tab8XX %]
-                                    <tr><th colspan="2">[% tab8X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab8X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab8X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
 
                                     [% FOREACH tab9X IN tab9XX %]
-                                    <tr><th colspan="2">[% tab9X.tag %]</th></tr>
+                                    <tr><th colspan="2">[% tab9X.tag | html %]</th></tr>
                                     [% FOREACH subfiel IN tab9X.subfield %]
                                             <tr>
-                                                <td>[% subfiel.marc_lib %]</td>
-                                                <td>[% subfiel.marc_value %]</td>
+                                                <td>[% subfiel.marc_lib | $raw %]</td>
+                                                <td>[% subfiel.marc_value | html %]</td>
                                             </tr>
                                         [% END %]
                                     [% END %]
                                     <thead>
                                         <tr>
                                             [% FOREACH header IN item_header_loop %]
-                                                <th>[% header %]</th>
+                                                <th>[% header | html %]</th>
                                             [% END %]
                                         </tr>
                                     </thead>
                                         [% FOREACH item IN item_loop %]
                                             <tr>
                                                 [% FOREACH sf_code IN item_subfield_codes %]
-                                                    <td>[% item.$sf_code %]</td>
+                                                    <td>[% item.$sf_code | html %]</td>
                                                 [% END %]
                                             </tr>
                                         [% END %]
@@ -194,7 +195,7 @@ $(document).ready(function(){
             $(this).text(_("view labeled"));
             $("#labeledmarc").hide();
             if(!loaded){
-                $("#plainmarc").show().html("<div style=\"margin:1em;padding:1em;border:1px solid #EEE;font-size:150%;\"><img src=\"[% interface %]/[% theme %]/images/loading.gif\" /> "+_("Loading")+"...</div>").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblio.biblionumber %]&viewas=html");
+                $("#plainmarc").show().html("<div style=\"margin:1em;padding:1em;border:1px solid #EEE;font-size:150%;\"><img src=\"[% interface | html %]/[% theme | html %]/images/loading.gif\" /> "+_("Loading")+"...</div>").load("/cgi-bin/koha/opac-showmarc.pl","id=[% biblio.biblionumber | html %]&viewas=html");
                 loaded = 1;
             } else {
                 $("#plainmarc").show();
index 712f7bc..11098f8 100644 (file)
@@ -1,4 +1,4 @@
-[% INCLUDE 'doc-head-open.inc' %][% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your payment
+[% INCLUDE 'doc-head-open.inc' %][% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your payment
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
index f381668..8fb0ec4 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -6,10 +7,10 @@
 [% SET ENABLE_OPAC_PAYMENTS = Koha.Preference('EnablePayPalOpacPayments') || plugins %]
 [% SET DISPLAY_PAYMENT_BLOCK = 0 %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your fines and charges</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your fines and charges</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 </head>
 
                     [% IF message %]
                         <div class="alert alert-info">
                             [% IF message == 'valid_payment' %]
-                                <p>Your payment of $[% message_value %] has been processed successfully!</p>
+                                <p>Your payment of $[% message_value | html %] has been processed successfully!</p>
                             [% ELSIF message == 'duplicate_payment' %]
-                                <p>A payment with the transaction id '[% message_value %]' has already been posted to an account.</p>
+                                <p>A payment with the transaction id '[% message_value | html %]' has already been posted to an account.</p>
                                 <p>Please contact a librarian for details.</p>
                             [% ELSIF message == 'invalid_payment' %]
-                                <p>The transaction id '[% message_value %]' for this payment is invalid.</p>
+                                <p>The transaction id '[% message_value | html %]' for this payment is invalid.</p>
                                 <p>Please contact a librarian for details.</p>
                             [% END %]
                         </div>
@@ -61,7 +62,7 @@
                         </div>
                     [% ELSIF payment %]
                         <div class="alert alert-info">
-                            <p><strong>Payment applied:</strong> your payment of [% payment %] has been applied to your account</p>
+                            <p><strong>Payment applied:</strong> your payment of [% payment | html %] has been applied to your account</p>
                         </div>
                     [% END %]
 
@@ -87,8 +88,8 @@
                                 [%- ELSE -%]
                                     [%- SET COLSPAN = 3 -%]
                                 [%- END -%]
-                                <th class="sum" colspan="[% COLSPAN %]">Total due</th>
-                                <td class="sum">[% total | $Price %]</td>
+                                <th class="sum" colspan="[% COLSPAN | html %]">Total due</th>
+                                <td class="sum">[% total | $Price | html %]</td>
                             </tr>
                             </tfoot>
 
                                             <td>
                                                 [% IF ACCOUNT_LINE.amountoutstanding > 0 %]
                                                     [% SET DISPLAY_PAYMENT_BLOCK = 1 %]
-                                                    <input class="checkbox-pay pay-online hidden" name="accountline" type="checkbox" id="checkbox-pay-[% ACCOUNT_LINE.accountlines_id %]" value="[% ACCOUNT_LINE.accountlines_id %]">
-                                                    <input type="hidden" id="amount-[% ACCOUNT_LINE.accountlines_id %]" value="[% ACCOUNT_LINE.amountoutstanding %]" />
+                                                    <input class="checkbox-pay pay-online hidden" name="accountline" type="checkbox" id="checkbox-pay-[% ACCOUNT_LINE.accountlines_id | html %]" value="[% ACCOUNT_LINE.accountlines_id | html %]">
+                                                    <input type="hidden" id="amount-[% ACCOUNT_LINE.accountlines_id | html %]" value="[% ACCOUNT_LINE.amountoutstanding | html %]" />
                                                 [% END %]
                                             </td>
                                         [% END %]
-                                        <td><span title="[% ACCOUNT_LINE.date %]">[% ACCOUNT_LINE.date | $KohaDates %]</span></td>
+                                        <td><span title="[% ACCOUNT_LINE.date | html %]">[% ACCOUNT_LINE.date | $KohaDates %]</span></td>
                                         <td>
                                             [% SWITCH ACCOUNT_LINE.accounttype %]
                                             [% CASE 'Pay' %]Payment, thanks
                                             [% CASE 'WO' %]Writeoff
                                             [% CASE 'C' %]Credit
                                             [% CASE 'CR' %]Credit
-                                            [% CASE %][% ACCOUNT_LINE.accounttype %]
+                                            [% CASE %][% ACCOUNT_LINE.accounttype | html %]
                                           [%- END -%]
-                                          [%- IF ACCOUNT_LINE.payment_type %], [% AuthorisedValues.GetByCode('PAYMENT_TYPE', ACCOUNT_LINE.payment_type, 1) %][% END %]
-                                          [%- IF ACCOUNT_LINE.description %], [% ACCOUNT_LINE.description %][% END %]
-                                          [% IF ACCOUNT_LINE.title %]([% ACCOUNT_LINE.title %])[% END %]
+                                          [%- IF ACCOUNT_LINE.payment_type %], [% AuthorisedValues.GetByCode('PAYMENT_TYPE', ACCOUNT_LINE.payment_type, 1) | html %][% END %]
+                                          [%- IF ACCOUNT_LINE.description %], [% ACCOUNT_LINE.description | html %][% END %]
+                                          [% IF ACCOUNT_LINE.title %]([% ACCOUNT_LINE.title | html %])[% END %]
                                         </td>
-                                        [% IF ( ACCOUNT_LINE.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amount | $Price %]</td>
-                                        [% IF ( ACCOUNT_LINE.amountoutstandingcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amountoutstanding | $Price %]</td>
+                                        [% IF ( ACCOUNT_LINE.amountcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amount | $Price | html %]</td>
+                                        [% IF ( ACCOUNT_LINE.amountoutstandingcredit ) %]<td class="credit">[% ELSE %]<td class="debit">[% END %][% ACCOUNT_LINE.amountoutstanding | $Price | html %]</td>
                                     </tr>
                                 [% END %]
                             </tbody>
                                         [% FOREACH p IN plugins %]
                                             <div class="control-group">
                                                 <label class="radio">
-                                                    <input type="radio" name="payment_method" id="payment_method-[% p.class %]" value="[% p.class %]" checked="checked">
-                                                    [% p.get_metadata.name %]
+                                                    <input type="radio" name="payment_method" id="payment_method-[% p.class | html %]" value="[% p.class | html %]" checked="checked">
+                                                    [% p.get_metadata.name | html %]
                                                 </label>
                                             </div>
                                         [% END %]
index aaa34e1..f418509 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Add to your list</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Add to your list</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                         [% IF ( authorized ) %]
                             [% UNLESS ( newshelf ) %]
                                 [% IF ( multiple ) %]
-                                    <h1>Add [% total %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>: [% ELSE %]a list:[% END %]</h1>
+                                    <h1>Add [% total | html %] items to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>: [% ELSE %]a list:[% END %]</h1>
                                 [% ELSE %]
                                     <h1>Add to [% IF ( singleshelf ) %]<em>[% shelfname | html %]</em>[% ELSE %]a list:[% END %]</h1>
                                 [% END %]
                                 <ul>
                                     [% FOREACH biblio IN biblios %]
-                                        <li> <span class="title">[% biblio.title |html %]</span>
-                                            [% IF ( biblio.author ) %]<span class="author"> [% biblio.author %] </span>[% END %]
+                                        <li> <span class="title">[% biblio.title | html %]</span>
+                                            [% IF ( biblio.author ) %]<span class="author"> [% biblio.author | html %] </span>[% END %]
                                         </li>
                                     [% END %]
                                 </ul>
                                             <label for="shelfnumber">Add to list:</label> <select name="shelfnumber" id="shelfnumber">
                                                 [% IF private_shelves.count %]<optgroup label="Private lists">
                                                     [% FOREACH private_shelf IN private_shelves %]
-                                                    <option value="[% private_shelf.shelfnumber %]">[% private_shelf.shelfname | html%]</option>
+                                                    <option value="[% private_shelf.shelfnumber | html %]">[% private_shelf.shelfname | html %]</option>
                                                     [% END %]
                                                 </optgroup>[% END %]
                                                 [% IF private_shelves_shared_with_me.count %]<optgroup label="Private lists shared with me">
                                                     [% FOREACH private_shelf IN private_shelves_shared_with_me %]
-                                                    <option value="[% private_shelf.shelfnumber %]">[% private_shelf.shelfname | html%]</option>
+                                                    <option value="[% private_shelf.shelfnumber | html %]">[% private_shelf.shelfname | html %]</option>
                                                     [% END %]
                                                 </optgroup>[% END %]
                                                 [% IF public_shelves.count %]<optgroup label="Public lists">
                                                     [% FOREACH public_shelf IN public_shelves %]
-                                                    <option value="[% public_shelf.shelfnumber %]">[% public_shelf.shelfname |html%]</option>
+                                                    <option value="[% public_shelf.shelfnumber | html %]">[% public_shelf.shelfname | html %]</option>
                                                     [% END %]
                                                 </optgroup>[% END %]
                                             </select>
                                             [% FOREACH biblio IN biblios %]
-                                                <input type="hidden" name="biblionumber" value="[% biblio.biblionumber %]" />
+                                                <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />
                                             [% END %]
                                             <input type="hidden" name="modifyshelfcontents" value="1" />
                                         </fieldset>
@@ -59,9 +59,9 @@
                                     [% IF ( singleshelf ) %]
                                         <form name="f1" action="/cgi-bin/koha/opac-addbybiblionumber.pl" method="post">
                                             [% FOREACH biblio IN biblios %]
-                                                <input type="hidden" name="biblionumber" value="[% biblio.biblionumber %]">
+                                                <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]">
                                             [% END %]
-                                            <input type="hidden" name="shelfnumber" value="[% shelfnumber %]" />
+                                            <input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]" />
                                             <input type="hidden" name="modifyshelfcontents" value="1" /></fieldset>
                                             <fieldset class="action">
                                                 <input type="submit" value="Save" class="btn" />
@@ -87,7 +87,7 @@
                                             </select>
                                     </fieldset>
                                     [% FOREACH biblio IN biblios %]
-                                        <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html%]" />
+                                        <input type="hidden" name="biblionumber" value="[% biblio.biblionumber | html %]" />
                                     [% END %]
                                     <fieldset class="action">
                                         <input type="hidden" name="sortfield" value="title" />
index 620d83b..427f737 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Advanced search</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Advanced search</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -33,7 +34,7 @@
                                             </select>
                                         [% END %]
                                     [% ELSE %]
-                                        <label for="search-field_[% loop.index %]">
+                                        <label for="search-field_[% loop.index | html %]">
                                             [% IF loop.index == 0 %]
                                                 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
                                             [% ELSE %]
@@ -41,8 +42,8 @@
                                             [% END %]
                                         </label>
                                     [% END %]
-                                    [% IF ( expanded_options ) %][% left_content %][% END %]
-                                    <select name="idx" id="search-field_[% loop.index %]">
+                                    [% IF ( expanded_options ) %][% left_content | html %][% END %]
+                                    <select name="idx" id="search-field_[% loop.index | html %]">
                                         <option value="kw">Keyword</option>
                                         <option value="su,wrdl">Subject</option>
                                         [% IF ( expanded_options ) %]
                     <div id="advsearches" class="toptabs">
                         <ul>
                             [% FOREACH advsearchloo IN advancedsearchesloop %]
-                                <li id="advsearch-tab-[% advsearchloo.advanced_search_type %]">
-                                <a href="#advsearch-[% advsearchloo.advanced_search_type %]">
+                                <li id="advsearch-tab-[% advsearchloo.advanced_search_type | html %]">
+                                <a href="#advsearch-[% advsearchloo.advanced_search_type | html %]">
                                [% IF ( advsearchloo.advanced_search_type == 'itemtypes' ) %]Item type
                                [% ELSIF ( advsearchloo.advanced_search_type == 'ccode' ) %]Collection
                                [% ELSIF ( advsearchloo.advanced_search_type == 'loc' ) %]Shelving location
                         </ul>
 
                         [% FOREACH advsearchloo IN advancedsearchesloop %]
-                            <div id="advsearch-[% advsearchloo.advanced_search_type %]" class="advsearch">
+                            <div id="advsearch-[% advsearchloo.advanced_search_type | html %]" class="advsearch">
                                 <fieldset>
                                     <legend>Limit to any of the following:</legend>
                                     <div class="row-fluid">
                                             [% IF (advsearchloo.advanced_search_type != 'itemtypes') OR (((!itemtypeloo.searchcategory) AND (itemtypeloo.cat == 0)) OR (itemtypeloo.cat == 1)) %]
                                                 <div class="span3">
                                                     <input type="checkbox"
-                                                        id="[% itemtypeloo.ccl FILTER remove(',') %]-[% itemtypeloo.number %]"
+                                                        id="[% itemtypeloo.ccl FILTER remove(',') | html %]-[% itemtypeloo.number | html %]"
                                                         name="[% IF ( itemtypeloo.cat == 1 ) %]searchcat[% ELSE %]limit[% END %]"
-                                                        value="[% IF ( itemtypeloo.cat == 1 ) %][% itemtypeloo.code %][% ELSE %]mc-[% itemtypeloo.ccl %]:[% itemtypeloo.code %][% END %]"
+                                                        value="[% IF ( itemtypeloo.cat == 1 ) %][% itemtypeloo.code | html %][% ELSE %]mc-[% itemtypeloo.ccl | html %]:[% itemtypeloo.code | html %][% END %]"
                                                     />
-                                                    <label for="[% itemtypeloo.ccl FILTER remove(',') %]-[% itemtypeloo.number %]">
+                                                    <label for="[% itemtypeloo.ccl FILTER remove(',') | html %]-[% itemtypeloo.number | html %]">
                                                         [% UNLESS ( noItemTypeImages ) %]
                                                             [% IF ( itemtypeloo.imageurl ) %]
-                                                                <img src="[% itemtypeloo.imageurl %]" alt="[% itemtypeloo.description %]" />
+                                                                <img src="[% itemtypeloo.imageurl | html %]" alt="[% itemtypeloo.description | html %]" />
                                                             [% END %]
                                                             &nbsp;
                                                         [% END %]
-                                                        [% itemtypeloo.description %]
+                                                        [% itemtypeloo.description | html %]
                                                     </label>
                                                 </div>
                                             [% IF ( loop.last ) %]</div>[% ELSE %][% UNLESS ( loop.count % 4 ) %]</div><div class="row-fluid">[% END %][% END %]
                                             [% END %]
                                         [% END %]
                                 </fieldset>
-                            </div> <!-- / #advsearch-[% advsearchloo.advanced_search_type %] -->
+                            </div> <!-- / #advsearch-[% advsearchloo.advanced_search_type | html %] -->
                         [% END # / FOREACH advancedsearchesloop %]
                     </div> <!-- / #advsearches -->
                 </div> <!-- / .span12 -->
                                         <option value="">No limit</option>
                                             [% FOREACH search_languages_loo IN search_languages_loop %]
                                                 [% IF ( search_languages_loo.selected ) %]
-                                                    <option value="ln,rtrn:[% search_languages_loo.iso639_2_code %]" selected="selected">[% search_languages_loo.language_description %]</option>
+                                                    <option value="ln,rtrn:[% search_languages_loo.iso639_2_code | html %]" selected="selected">[% search_languages_loo.language_description | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="ln,rtrn:[% search_languages_loo.iso639_2_code %]">[% search_languages_loo.language_description %]</option>
+                                                    <option value="ln,rtrn:[% search_languages_loo.iso639_2_code | html %]">[% search_languages_loo.language_description | html %]</option>
                                                 [% END %]
                                             [% END %]
                                     </select>
                                     <option value="">All libraries</option>
                                     [% FOREACH BranchesLoo IN Branches.all( selected => opac_name ) %]
                                         [% IF BranchesLoo.selected %]
-                                            <option value="branch:[% BranchesLoo.branchcode %]" selected="selected">[% BranchesLoo.branchname %]</option>
+                                            <option value="branch:[% BranchesLoo.branchcode | html %]" selected="selected">[% BranchesLoo.branchname | html %]</option>
                                         [% ELSE %]
-                                            <option value="branch:[% BranchesLoo.branchcode %]">[% BranchesLoo.branchname %]</option>
+                                            <option value="branch:[% BranchesLoo.branchcode | html %]">[% BranchesLoo.branchname | html %]</option>
                                         [% END %]
                                     [% END %]
                                     </select>
                                         <select name="multibranchlimit" id="categoryloop">
                                             <option value=""> -- none -- </option>
                                             [% FOREACH sg IN search_groups %]
-                                                <option value="[% sg.id %]">[% sg.title %]</option>
+                                                <option value="[% sg.id | html %]">[% sg.title | html %]</option>
                                             [% END %]
                                         </select>
                                     [% END %]
 [% END %]
 
 [% BLOCK jsinclude %]
-[% Asset.js("lib/jquery/plugins/jquery.deserialize.min.js") %]
-[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.deserialize.min.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.cookie.min.js") | $raw %]
 <script>//<![CDATA[
 $(document).ready(function() {
     $('#advsearches').tabs();
@@ -437,7 +438,7 @@ $(document).ready(function() {
         jQuery.cookie("form_serialized_limits", form_serialized_limits,{ path: '/'});
         [% IF ( expanded_options ) %]
         var numPar = $("#booleansearch fieldset p").size();
-        if (numPar > [% search_boxes_count %]){
+        if (numPar > [% search_boxes_count | html %]){
             jQuery.cookie("num_paragraph", numPar,{ path: '/'});
         }else{
             jQuery.removeCookie("num_paragraph", { path: '/'});
index e616888..806acbf 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  [% IF ( typeissue ) %]Subscribe to a subscription alert [% ELSIF ( typeissuecancel ) %] Unsubscribe from a subscription alert [% END %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  [% IF ( typeissue ) %]Subscribe to a subscription alert [% ELSIF ( typeissuecancel ) %] Unsubscribe from a subscription alert [% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -10,7 +10,7 @@
     <div class="main">
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle %]</a> <span class="divider">&rsaquo;</span></li>
+            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle | html %]</a> <span class="divider">&rsaquo;</span></li>
             <li><a href="#">[% IF ( typeissue ) %]Subscribe to a subscription alert [% ELSIF ( typeissuecancel ) %] Unsubscribe from a subscription alert [% END %]</a></li>
         </ul>
 
                             <h1>Subscribe to a subscription alert</h1>
                             <form action="opac-alert-subscribe.pl" method="post">
                                 <p>Do you want to receive an email when a new issue for this subscription arrives?</p>
-                                <h4>[% bibliotitle %]</h4>
-                                [% IF ( notes ) %]<p>[% notes %]</p>[% END %]
-                                <input type="hidden" name="subscriptionid" value="[% subscriptionid %]">
-                                <input type="hidden" name="referer" value="[% referer %]">
+                                <h4>[% bibliotitle | html %]</h4>
+                                [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
+                                <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]">
+                                <input type="hidden" name="referer" value="[% referer | html %]">
                                 <input type="hidden" name="biblionumber" value="[% biblionumber | html %]">
                                 <input type="hidden" name="op" value="alert_confirmed">
                                 <input type="submit" class="btn" value="Yes">
                             <h1>Unsubscribe from a subscription alert</h1>
                             <form action="opac-alert-subscribe.pl" method="post">
                                 <p>Please confirm that you do not want to receive email when a new issue arrives for this subscription.</p>
-                                <h4>[% bibliotitle %]</h4>
-                                [% IF ( notes ) %]<p>[% notes %]</p>[% END %]
-                                <input type="hidden" name="subscriptionid" value="[% subscriptionid %]">
-                                <input type="hidden" name="referer" value="[% referer %]">
+                                <h4>[% bibliotitle | html %]</h4>
+                                [% IF ( notes ) %]<p>[% notes | html %]</p>[% END %]
+                                <input type="hidden" name="subscriptionid" value="[% subscriptionid | html %]">
+                                <input type="hidden" name="referer" value="[% referer | html %]">
                                 <input type="hidden" name="biblionumber" value="[% biblionumber | html %]">
                                 <input type="hidden" name="op" value="cancel_confirmed">
                                 <input type="submit" value="Yes" class="btn">
index b626aae..696b09d 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% PROCESS 'opac-authorities.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Entry [% authtypetext %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Entry [% authtypetext | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -13,7 +14,7 @@
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
             <li><a href="/cgi-bin/koha/opac-authorities-home.pl">Authority search</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="#">Entry [% authtypetext %]</a></li>
+            <li><a href="#">Entry [% authtypetext | html %]</a></li>
         </ul>
 
         <div class="container-fluid">
@@ -31,7 +32,7 @@
                     <div id="userauthMARCdetails" class="maincontent">
                         <div id="views">
                             <span class="view">
-                                <a id="Normalview" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid %]">Normal view</a>
+                                <a id="Normalview" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid | html %]">Normal view</a>
                             </span>
                             <span class="view">
                                 <span id="MARCview">MARC view</span>
                             </div>
                         [% END %]
 
-                        <h1>Entry [% authtypetext %]</h1>
-                        <p><a href="opac-search.pl?type=opac&amp;q=[% authid %]&amp;idx=an,phr">Number of records used in: [% count %]</a></p>
+                        <h1>Entry [% authtypetext | html %]</h1>
+                        <p><a href="opac-search.pl?type=opac&amp;q=[% authid | html %]&amp;idx=an,phr">Number of records used in: [% count | html %]</a></p>
                             [% FOREACH Tag0X IN Tab0XX %]
-                                <p><b>[% Tag0X.tag %]</b></p>
+                                <p><b>[% Tag0X.tag | html %]</b></p>
                                 <ul>
                                 [% FOREACH subfiel IN Tag0X.subfield %]
-                                    <li><b>[% subfiel.marc_lib %]:</b>
-                                    [% IF subfiel.isurl %]<a href="[% subfiel.marc_value %]">[% subfiel.marc_value %]</a>
-                                    [% ELSE %][% subfiel.marc_value %][% END %]</li>
+                                    <li><b>[% subfiel.marc_lib | $raw %]:</b>
+                                    [% IF subfiel.isurl %]<a href="[% subfiel.marc_value | html %]">[% subfiel.marc_value | html %]</a>
+                                    [% ELSE %][% subfiel.marc_value | html %][% END %]</li>
                                 [% END %]
                                 </ul>
                             [% END %]
@@ -64,7 +65,7 @@
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% Asset.js("lib/jquery/plugins/jquery.jstree.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.jstree.js") | $raw %]
 <script>
     //<![CDATA[
         $(document).ready(function() {
index 1977743..7270021 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% PROCESS 'opac-authorities.inc' %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Authority search &rsaquo; [% summary.mainentry %][% IF authtypetext %] ([% authtypetext %])[% END %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Authority search &rsaquo; [% summary.mainentry | html %][% IF authtypetext %] ([% authtypetext | html %])[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -13,7 +14,7 @@
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
             <li><a href="/cgi-bin/koha/opac-authorities-home.pl">Authority search</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="#">[% summary.mainentry %][% IF authtypetext %] ([% authtypetext %])[% END %]</a></li>
+            <li><a href="#">[% summary.mainentry | html %][% IF authtypetext %] ([% authtypetext | html %])[% END %]</a></li>
         </ul>
 
         <div class="container-fluid">
@@ -34,7 +35,7 @@
                                 <span id="Normalview">Normal view</span>
                             </span>
                             <span class="view">
-                                <a id="MARCview" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid %]&amp;marc=1">MARC view</a>
+                                <a id="MARCview" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% authid | html %]&amp;marc=1">MARC view</a>
                             </span>
                         </div>
 
                             </div>
                         [% END %]
 
-                        <h1>[% summary.mainentry %][% IF authtypetext %] ([% authtypetext %])[% END %]</h1>
+                        <h1>[% summary.mainentry | html %][% IF authtypetext %] ([% authtypetext | html %])[% END %]</h1>
 
                         <div class="usedin">
-                            [% IF count %]<a href="/cgi-bin/koha/opac-search.pl?type=opac&amp;q=[% authid %]&amp;idx=an,phr">Number of records used in: [% count %]</a>[% ELSE %]This authority is not used in any records.[% END %]
+                            [% IF count %]<a href="/cgi-bin/koha/opac-search.pl?type=opac&amp;q=[% authid | html %]&amp;idx=an,phr">Number of records used in: [% count | html %]</a>[% ELSE %]This authority is not used in any records.[% END %]
                         </div>
 
                         <div class="authstanza">
                             [% FOREACH authorize IN summary.authorized %]
-                                <div class="heading authorized auth[% seefro.field %]">
+                                <div class="heading authorized auth[% seefro.field | html %]">
                                     <span class="label">Preferred form: </span>
-                                    <span class="authorized">[% authorize.heading %]</span>
+                                    <span class="authorized">[% authorize.heading | html %]</span>
                                 </div>
                             [% END %]
                             [% PROCESS otherscript headings=summary.otherscript wantcategory='preferred' %]
@@ -65,7 +66,7 @@
                                 <div class="authstanzaheading">Used for/see from:</div>
                                 <ul class="seefrom">
                                     [% FOREACH seefro IN summary.seefrom %]
-                                        <li class="heading seefrom auth[% seefro.field %]">
+                                        <li class="heading seefrom auth[% seefro.field | html %]">
                                             [% IF seefro.type && seefro.type != 'seefrom' %]
                                                 <span class="label">[% PROCESS authtypelabel type=seefro.type | trim %]:</span>
                                             [% END %]
@@ -82,7 +83,7 @@
                                 <div class="authstanzaheading">See also:</div>
                                 <ul class="seelso">
                                     [% FOREACH seeals IN summary.seealso %]
-                                        <li class="heading seealso auth[% seeals.field %]">
+                                        <li class="heading seealso auth[% seeals.field | html %]">
                                             [% IF seeals.type && seeals.type != 'seealso' %]
                                                 <span class="label">[% PROCESS authtypelabel type=seeals.type | trim %]:</span>
                                             [% END %]
                                     [% FOREACH otherscrip IN summary.otherscript %]
                                         <li>
                                             [% PROCESS language lang=otherscrip.lang | trim %]:
-                                            <span class="otherscript">[% otherscrip.term %]</span>
+                                            <span class="otherscript">[% otherscrip.term | html %]</span>
                                         </li>
                                     [% END %]
                                 </ul>
                             <div id="descriptions">
                                 <div class="content_set">
                                     [% FOREACH note IN summary.notes %]
-                                        <p class="note auth[% note.field %]">[% note.note %]</p>
+                                        <p class="note auth[% note.field | html %]">[% note.note | html %]</p>
                                     [% END %]
                                 </div>
                             </div>
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
 [% IF ( displayhierarchy ) %]
-    [% Asset.js("lib/jquery/plugins/jquery.jstree.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.jstree.js") | $raw %]
 [% END %]
 <script>
     //<![CDATA[
index 338ca0a..ccaddde 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;
 [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
     Log in to your account
 [% ELSE %]
@@ -90,7 +91,7 @@
                                     </div>
                             [% ELSE %]
                                 <h4>Shibboleth Login</h4>
-                                <p><a href="[% shibbolethLoginUrl %]">If you have a Shibboleth account, please click here to log in.</a></p>
+                                <p><a href="[% shibbolethLoginUrl | html %]">If you have a Shibboleth account, please click here to log in.</a></p>
                             [% END %]
                             [% IF ( casAuthentication ) %]
                                 <h4>CAS login</h4>
                         [% IF ( casAuthentication ) %]
                             [% IF ( shibbolethAuthentication ) %]
                                 [% IF ( casServerUrl ) %]
-                                    <p><a href="[% casServerUrl %]">Please click here to log in.</a><p>
+                                    <p><a href="[% casServerUrl | html %]">Please click here to log in.</a><p>
                                 [% END %]
 
                                 [% IF ( casServersLoop ) %]
                                     <p>Please choose against which one you would like to authenticate: </p>
                                     <ul>
                                         [% FOREACH casServer IN casServersLoop %]
-                                            <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
+                                            <li><a href="[% casServer.value | html %]">[% casServer.name | html %]</a></li>
                                         [% END %]
                                     </ul>
                                 [% END %]
                                 [% END %]
 
                                 [% IF ( casServerUrl ) %]
-                                   <p><a href="[% casServerUrl %]">If you have a CAS account, please click here to log in.</a><p>
+                                   <p><a href="[% casServerUrl | html %]">If you have a CAS account, please click here to log in.</a><p>
                                 [% END %]
 
                                 [% IF ( casServersLoop ) %]
                                     <p>If you have a CAS account, please choose against which one you would like to authenticate:</p>
                                     <ul>
                                         [% FOREACH casServer IN casServersLoop %]
-                                        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
+                                        <li><a href="[% casServer.value | html %]">[% casServer.name | html %]</a></li>
                                         [% END %]
                                     </ul>
                                 [% END %]
                         [% IF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
                             [% IF ( invalidGoogleOpenIDConnectLogin ) %]
                                 <h4>Google login</h4>
-                                <p>Sorry, your Google login failed. <span class="error">[% invalidGoogleOpenIDConnectLogin %]</span></p>
+                                <p>Sorry, your Google login failed. <span class="error">[% invalidGoogleOpenIDConnectLogin | html %]</span></p>
                                 <p>Please note that the Google login will only work if you are using the e-mail address registered with this library.</p>
                                 <p>If you want to, you can try to <a href="/cgi-bin/koha/svc/auth/googleopenidconnect?reauthenticate=select_account">log in using a different account</a>
                             [% END %]
                         [% ELSIF SCI_login %]
                             <form action="/cgi-bin/koha/sci/sci-main.pl" name="auth" id="auth" method="post" autocomplete="off">
                         [% ELSE %]
-                            <form action="[% script_name %]" name="auth" id="auth" method="post" autocomplete="off">
+                            <form action="[% script_name | html %]" name="auth" id="auth" method="post" autocomplete="off">
                         [% END %]
                             <input type="hidden" name="koha_login_context" value="opac" />
                             <fieldset class="brief">
                             [% FOREACH INPUT IN INPUTS %]
-                                <input type="hidden" name="[% INPUT.name |html %]" value="[% INPUT.value |html %]" />
+                                <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
                             [% END %]
                             <label for="userid">Login</label>
                             <input type="text"  size="25" id="userid"  name="userid" />
                             [% END %]
                             <div id="nologininstructions">
                             [% IF Koha.Preference('OpacLoginInstructions') %]
-                                [% Koha.Preference('OpacLoginInstructions') %]
+                                [% Koha.Preference('OpacLoginInstructions') | $raw %]
                             [% ELSE %]
                                 <h5>Don't have a password yet?</h5>
                                 <p>If you don't have a password yet, stop by the circulation desk the next time you're in the library. We'll happily set one up for you.</p>
                     [% ELSE %]
                         <h4>Logging on to the catalog has not been enabled by the library.</h4>
                         <ul>
-                            <li>To report this error, you can email the Koha Administrator.<a href="mailto:[% admin %]">Email</a></li>
+                            <li>To report this error, you can email the Koha Administrator.<a href="mailto:[% admin | html %]">Email</a></li>
                             <li>Use top menu bar to navigate to another part of Koha.</li>
                         </ul>
                     [% END # / IF opacuserlogin %]
index 25c38b9..9a7c9a9 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Authority search</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Authority search</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -37,9 +37,9 @@
                                         <select name="authtypecode" id="authtypecode">
                                             [% FOREACH authority_type IN authority_types %]
                                                 [% IF authority_type.authtypecode == authtypecode %]
-                                                    <option value="[% authority_type.authtypecode%]" selected="selected">[% authority_type.authtypetext %]</option>
+                                                    <option value="[% authority_type.authtypecode | html %]" selected="selected">[% authority_type.authtypetext | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% authority_type.authtypecode%]">[% authority_type.authtypetext %]</option>
+                                                    <option value="[% authority_type.authtypecode | html %]">[% authority_type.authtypetext | html %]</option>
                                                 [% END %]
                                             [% END %]
                                         </select>
@@ -54,7 +54,7 @@
                                     </li>
                                     <li>
                                         <label for="value">Term(s):</label>
-                                        <input type="text" name="value" id="value" value="[% value %]" />
+                                        <input type="text" name="value" id="value" value="[% value | html %]" />
                                     </li>
                                     <li>
                                         <label for="marclist">Where:</label>
index e6d5e24..18c95f9 100644 (file)
@@ -1,8 +1,34 @@
+[% USE raw %]
 [% USE Koha %]
 [% PROCESS 'opac-authorities.inc' %]
 [% PROCESS 'authorities-search-results.inc' %]
+[% BLOCK pagination %]
+    <div class="pagination">
+        <ul>
+            [% IF ( displayprev ) %]
+                <li>
+                    <a href="opac-authorities-home.pl?startfrom=[% startfromprev | html %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term | html %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage | html %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode | html %]&amp;orderby=[% orderby | html %]">
+                        &laquo;
+                    </a>
+                </li>
+            [% END %]
+            [% FOREACH number IN numbers %]
+                [% IF ( number.highlight ) %]
+                    <li class="active"><a href="#">[% number.number | html %]</a></li>
+                [% ELSE %]
+                    <li><a href="opac-authorities-home.pl?startfrom=[% number.startfrom | html %]&amp;[% FOREACH searchdat IN number.searchdata %][% searchdat.term | html %]=[% searchdat.val |url %]&amp;[% END %]resultsperpage=[% resultsperpage | html %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode | html %]&amp;orderby=[% orderby | html %]">[% number.number | html %]</a></li>
+                [% END %]
+            [% END %]
+            [% IF ( displaynext ) %]
+                <li>
+                    <a href="opac-authorities-home.pl?startfrom=[% startfromnext | html %]&amp;[% FOREACH searchdat IN searchdata %][% searchdat.term | html %]=[% searchdat.val |url %]&amp;[% END %]&amp;resultsperpage=[% resultsperpage | html %]&amp;type=opac&amp;op=do_search&amp;authtypecode=[% authtypecode | html %]&amp;orderby=[% orderby | html %]">&raquo;</a>
+                </li>
+            [% END %]
+        </ul>
+    </div> <!-- / #pages -->
+[% END %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; [% IF ( total ) %]Authority search result[% ELSE %]No results found[% END %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; [% IF ( total ) %]Authority search result[% ELSE %]No results found[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                         <h1>Authority search results</h1>
 
                         [% IF total %]
-                            <div class="pages">[% pagination_bar %]</div>
+                            <div class="pages">[% pagination_bar | $raw %]</div>
                         [% END %]
                         <div id="results">
                             [% IF ( total ) %]
                                 [% IF ( countfuzzy ) %]
-                                    <p><b>Showing [% resultcount %] of about [% total %] results</b></p>
+                                    <p><b>Showing [% resultcount | html %] of about [% total | html %] results</b></p>
                                 [% ELSE %]
-                                    <p><b>Results [% from %] to [% to %] of [% total %]</b></p>
+                                    <p><b>Results [% from | html %] to [% to | html %] of [% total | html %]</b></p>
                                 [% END %]
                             [% ELSE %]
                                 No results found.
                                         [% FOREACH resul IN result %]
                                             <tr>
                                                 <td>[% PROCESS authresult summary=resul.summary %]</td>
-                                                <td><a href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% resul.authid %]">Details</a>
-                                                <td>[% resul.authtype %]</td>
+                                                <td><a href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% resul.authid | html %]">Details</a>
+                                                <td>[% resul.authtype | html %]</td>
                                                 [% UNLESS ( resul.isEDITORS ) %]
                                                     <td>
-                                                         [% IF resul.used > 0 %]<a href="/cgi-bin/koha/opac-search.pl?type=opac&amp;op=do_search&amp;q=an=[% resul.authid %]">[% resul.used %] biblios</a>[% ELSE %]0 biblios[% END %]
+                                                         [% IF resul.used > 0 %]<a href="/cgi-bin/koha/opac-search.pl?type=opac&amp;op=do_search&amp;q=an=[% resul.authid | html %]">[% resul.used | html %] biblios</a>[% ELSE %]0 biblios[% END %]
                                                     </td>
                                                 [% END %]
                                             </tr>
                                 </table>
                             </div> <!-- / .searchresults -->
 
-                            <div class="pages">[% pagination_bar %]</div>
+                            <div class="pages">[% pagination_bar | $raw %]</div>
 
                         [% END # / IF total %]
                     </div> <!-- / #userauthsearchresults -->
index 282c0d8..7533350 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% USE Asset %]
 [% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && TagsEnabled && TagsInputOnList ) %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your cart</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your cart</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]<style type="text/css">.item-status, .dt-buttons { display: inline; } @media print { body { height: 99%; } }</style>[% END %]
 </head>
                             <form action="opac-basket.pl" method="get" name="bookbag_form" id="bookbag_form" class="checkboxed">
                                 [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
                                     <h3>
-                                                <input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]">
-                                                [% BIBLIO_RESULT.title |html %]
-                                                [% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %] [% subtitl.subfield |html %] [% END %][% END %]
-                                                [% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author |html %][% END %]
+                                                <input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber | html %]" name="bib[% BIBLIO_RESULT.biblionumber | html %]" id="bib[% BIBLIO_RESULT.biblionumber | html %]">
+                                                [% BIBLIO_RESULT.title | html %]
+                                                [% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %] [% subtitl.subfield | html %] [% END %][% END %]
+                                                [% IF ( BIBLIO_RESULT.author ) %] [% BIBLIO_RESULT.author | html %][% END %]
                                     </h3>
                                     <!-- COinS / Openurl -->
-                                    <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition %]&amp;rft.series=[% BIBLIO_RESULT.series %]&amp;rft.genre="></span>
+                                    <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author | html %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear | html %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') | html %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place | html %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition | html %]&amp;rft.series=[% BIBLIO_RESULT.series | html %]&amp;rft.genre="></span>
 
                                     <table class="table">
                                         [% IF ( BIBLIO_RESULT.isbn ) %]
                                             <tr>
                                                 <th scope="row">ISBN</th>
-                                                <td>[% BIBLIO_RESULT.isbn %]</td>
+                                                <td>[% BIBLIO_RESULT.isbn | html %]</td>
                                             </tr>
                                         [% END %]
 
                                             <th scope="row">Author(s)</th>
                                             <td>
                                                [% IF ( BIBLIO_RESULT.author ) %]
-                                                   <p>[% BIBLIO_RESULT.author %]</p>
+                                                   <p>[% BIBLIO_RESULT.author | html %]</p>
                                                [% END %]
                                                [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
                                                    [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                                                    <p> [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                                                          [% MARCAUTHOR_SUBFIELDS_LOO.separator %]
-                                                              [% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                                                          [% MARCAUTHOR_SUBFIELDS_LOO.separator | html %]
+                                                              [% MARCAUTHOR_SUBFIELDS_LOO.value | html %]
                                                        [% END %]
                                                    </p>
                                                    [% END %]
                                         [% IF ( BIBLIO_RESULT.publishercode ) %]
                                             <tr>
                                                 <th scope="row">Publisher</th>
-                                                <td>[% BIBLIO_RESULT.place %] [% BIBLIO_RESULT.publishercode %] [% BIBLIO_RESULT.publicationyear %]
+                                                <td>[% BIBLIO_RESULT.place | html %] [% BIBLIO_RESULT.publishercode | html %] [% BIBLIO_RESULT.publicationyear | html %]
                                                 </td>
                                             </tr>
                                         [% END %]
                                         [% IF ( BIBLIO_RESULT.pages ) %]
                                             <tr>
                                                 <th scope="row">Details</th>
-                                                <td>[% BIBLIO_RESULT.pages %] [% BIBLIO_RESULT.illus %] [% BIBLIO_RESULT.item('size') %]</td>
+                                                <td>[% BIBLIO_RESULT.pages | html %] [% BIBLIO_RESULT.illus | html %] [% BIBLIO_RESULT.item('size') | html %]</td>
                                             </tr>
                                         [% END %]
 
                                         [% IF ( BIBLIO_RESULT.seriestitle ) %]
                                         <tr>
                                             <th scope="row">Collection</th>
-                                            <td> [% BIBLIO_RESULT.seriestitle %]</td>
+                                            <td> [% BIBLIO_RESULT.seriestitle | html %]</td>
                                         </tr>
                                         [% END %]
 
                                             <th scope="row">Subject(s)</th>
                                             <td>[% FOREACH MARCSUBJCT IN BIBLIO_RESULT.MARCSUBJCTS %]
                                                    <p> [% FOREACH MARCSUBJECT_SUBFIELDS_LOO IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %]
-                                                        [% MARCSUBJECT_SUBFIELDS_LOO.separator %][% MARCSUBJECT_SUBFIELDS_LOO.value %][% END %]
+                                                        [% MARCSUBJECT_SUBFIELDS_LOO.separator | html %][% MARCSUBJECT_SUBFIELDS_LOO.value | html %][% END %]
                                                    </p>
                                                 [% END %]</td>
                                         </tr>
 
                                         [% IF ( BIBLIO_RESULT.copyrightdate ) %]
                                             <tr><th scope="row">Copyright</th>
-                                                <td> [% BIBLIO_RESULT.copyrightdate %]</td>
+                                                <td> [% BIBLIO_RESULT.copyrightdate | html %]</td>
                                             </tr>
                                         [% END %]
 
                                                 [% FOREACH MARCNOTE IN BIBLIO_RESULT.MARCNOTES %]
                                                     <p>
                                                     [% IF MARCNOTE.marcnote.match('^https?://\S+$') %]
-                                                        - <a href="[% MARCNOTE.marcnote %]">[% MARCNOTE.marcnote %]</a>
+                                                        - <a href="[% MARCNOTE.marcnote | html %]">[% MARCNOTE.marcnote | html %]</a>
                                                     [% ELSE %]
-                                                        - [% MARCNOTE.marcnote %]
+                                                        - [% MARCNOTE.marcnote | html %]
                                                     [% END %]
                                                     </p>
                                                 [% END %]
                                         [% IF ( BIBLIO_RESULT.unititle ) %]
                                             <tr>
                                                 <th scope="row">Unified title</th>
-                                                <td> [% BIBLIO_RESULT.unititle %]</td>
+                                                <td> [% BIBLIO_RESULT.unititle | html %]</td>
                                             </tr>
                                         [% END %]
 
                                         [% IF ( BIBLIO_RESULT.serial ) %]
                                             <tr>
                                                 <th scope="row">Serial</th>
-                                                <td>[% BIBLIO_RESULT.serial %]</td>
+                                                <td>[% BIBLIO_RESULT.serial | html %]</td>
                                             </tr>
                                         [% END %]
 
                                         [% IF ( BIBLIO_RESULT.dewey ) %]
                                             <tr>
                                                 <th scope="row">Dewey</th>
-                                                <td>[% BIBLIO_RESULT.dewey %]</td>
+                                                <td>[% BIBLIO_RESULT.dewey | html %]</td>
                                             </tr>
                                         [% END %]
 
                                         [% IF ( BIBLIO_RESULT.classification ) %]
                                             <tr>
                                                 <th scope="row">Classification</th>
-                                                <td> [% BIBLIO_RESULT.classification %]</td>
+                                                <td> [% BIBLIO_RESULT.classification | html %]</td>
                                             </tr>
                                         [% END %]
 
                                         [% IF ( BIBLIO_RESULT.lccn ) %]
                                             <tr>
                                                 <th scope="row">LCCN</th>
-                                                <td> [% BIBLIO_RESULT.lccn %]</td>
+                                                <td> [% BIBLIO_RESULT.lccn | html %]</td>
                                             </tr>
                                         [% END %]
 
                                                 <th scope="row">URL(s)</th>
                                                 <td>
                                                    [% FOREACH MARCurl IN BIBLIO_RESULT.MARCURLS %]
-                                                        [% IF MARCurl.part %]<p>[% MARCurl.part %]</p>[% END %]
+                                                        [% IF MARCurl.part %]<p>[% MARCurl.part | html %]</p>[% END %]
 
                                                         [% IF OPACURLOpenInNewWindow %]
-                                                            <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">[% MARCurl.linktext %]</a>
+                                                            <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]" target="_blank" rel="noreferrer">[% MARCurl.linktext | html %]</a>
                                                         [% ELSE %]
-                                                            <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">[% MARCurl.linktext %]</a>
+                                                            <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]">[% MARCurl.linktext | html %]</a>
                                                         [% END %]
 
-                                                        [% IF MARCurl.notes %][% FOREACH note IN MARCurl.notes %]<p>[% note.note %]</p>[% END %][% END %]
+                                                        [% IF MARCurl.notes %][% FOREACH note IN MARCurl.notes %]<p>[% note.note | html %]</p>[% END %][% END %]
                                                     [% END %]
                                                 </td>
                                             </tr>
                                                     <ul>
                                                         [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
                                                             <li>
-                                                                <strong>[% ITEM_RESULT.branchname %]</strong>[% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac %][% END %]
+                                                                <strong>[% ITEM_RESULT.branchname | html %]</strong>[% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac | html %][% END %]
                                                                 [% IF ( ITEM_RESULT.itemcallnumber ) %]
-                                                                    ([% ITEM_RESULT.itemcallnumber %])
+                                                                    ([% ITEM_RESULT.itemcallnumber | html %])
                                                                 [% END %]
                                                                 ([% INCLUDE 'item-status.inc' item = ITEM_RESULT %])
                                                             </li>
                                     [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
                                         <tr>
                                                 <td class="noprint">
-                                                <input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber %]" name="bib[% BIBLIO_RESULT.biblionumber %]" id="bib[% BIBLIO_RESULT.biblionumber %]">
+                                                <input type="checkbox" class="cb" value="[% BIBLIO_RESULT.biblionumber | html %]" name="bib[% BIBLIO_RESULT.biblionumber | html %]" id="bib[% BIBLIO_RESULT.biblionumber | html %]">
                                                 </td>
                                             <td>
-                                                <a href="#" onclick="openBiblio('[% BIBLIO_RESULT.dest %]',[% BIBLIO_RESULT.biblionumber %])">[% BIBLIO_RESULT.title |html %][% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %][% subtitl.subfield |html %][% END %][% END %]</a>
+                                                <a href="#" onclick="openBiblio('[% BIBLIO_RESULT.dest | html %]',[% BIBLIO_RESULT.biblionumber | html %])">[% BIBLIO_RESULT.title | html %][% IF ( BIBLIO_RESULT.subtitle ) %] [% FOREACH subtitl IN BIBLIO_RESULT.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a>
                                                 <!-- COinS / Openurl -->
-                                                <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition %]&amp;rft.series=[% BIBLIO_RESULT.series %]&amp;rft.genre="></span>
+                                                <span class="Z3988" title="ctx_ver=Z39.88-2004&amp;rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&amp;rft.au=[% BIBLIO_RESULT.author | html %]&amp;rft.btitle=[% BIBLIO_RESULT.title |url %]&amp;rft.date=[% BIBLIO_RESULT.publicationyear | html %]&amp;rft.tpages=[% BIBLIO_RESULT.item('size') | html %]&amp;rft.isbn=[% BIBLIO_RESULT.isbn |url %]&amp;rft.aucorp=&amp;rft.place=[% BIBLIO_RESULT.place | html %]&amp;rft.pub=[% BIBLIO_RESULT.publisher |url %]&amp;rft.edition=[% BIBLIO_RESULT.edition | html %]&amp;rft.series=[% BIBLIO_RESULT.series | html %]&amp;rft.genre="></span>
                                                 [% IF ( TagsInputEnabled && loggedinusername ) %]
-                                                <span id="newtag[% BIBLIO_RESULT.biblionumber %]_status" class="tagstatus results_summary" style="display:none">Tag status here.</span>
+                                                <span id="newtag[% BIBLIO_RESULT.biblionumber | html %]_status" class="tagstatus results_summary" style="display:none">Tag status here.</span>
                                                 [% END %]
                                             </td>
-                                            <td>[% BIBLIO_RESULT.author %]</td>
+                                            <td>[% BIBLIO_RESULT.author | html %]</td>
                                             <td>
                                                 [% IF ( BIBLIO_RESULT.publicationyear ) %]
-                                                    [% BIBLIO_RESULT.publicationyear %]
+                                                    [% BIBLIO_RESULT.publicationyear | html %]
                                                 [% ELSE %]
-                                                    [% BIBLIO_RESULT.copyrightdate %]
+                                                    [% BIBLIO_RESULT.copyrightdate | html %]
                                                 [% END %]
                                             </td>
                                             <td>[% IF ( BIBLIO_RESULT.ITEM_RESULTS ) %]<ul>[% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]
                                                 <li>
-                                                    [% ITEM_RESULT.branchname %][% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac %][% END %]
+                                                    [% ITEM_RESULT.branchname | html %][% IF ( ITEM_RESULT.location_opac ) %], [% ITEM_RESULT.location_opac | html %][% END %]
                                                     [% IF ( ITEM_RESULT.itemcallnumber ) %]
-                                                        ([% ITEM_RESULT.itemcallnumber %])
+                                                        ([% ITEM_RESULT.itemcallnumber | html %])
                                                     [% END %]
                                                     ([% INCLUDE 'item-status.inc' item = ITEM_RESULT %])
                                                 </li>
 [% INCLUDE 'opac-bottom.inc' %]
 
 [% BLOCK jsinclude %]
-    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
         [% INCLUDE 'datatables.inc' %]
         <script>
             //<![CDATA[
index be4776c..ec0a35f 100644 (file)
@@ -1,5 +1,6 @@
+[% USE raw %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -19,7 +20,7 @@
                     <p>You are not authorized to view this record.</p>
                     [% IF ( OpacSuppressionMessage ) %]
                         <div id="opacsuppressionmessage">
-                            [% OpacSuppressionMessage %]
+                            [% OpacSuppressionMessage | $raw %]
                         </div>
                     [% END %]
                 </div>
index 635f8d8..aa04c76 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Browse our catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Browse our catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                     [% IF ( have_hierarchy ) %]
                         <ul>
                             <li>
-                                [% description %] <a href="opac-browser.pl">Top level</a>
+                                [% description | html %] <a href="opac-browser.pl">Top level</a>
                             </li>
                             <li style="list-style-type: none;">
                                 <ul>
                                     [% FOREACH HIERARCHY_LOO IN HIERARCHY_LOOP %]
                                         <li>
-                                            <a href="opac-browser.pl?level=[% HIERARCHY_LOO.level %]&amp;filter=[% HIERARCHY_LOO.classification |uri %]">[% HIERARCHY_LOO.description |html %]</a>
+                                            <a href="opac-browser.pl?level=[% HIERARCHY_LOO.level | html %]&amp;filter=[% HIERARCHY_LOO.classification |uri %]">[% HIERARCHY_LOO.description | html %]</a>
                                         </li>
                                         <li style="list-style-type: none;">
                                     [% END %]
                                                     <td>
                                                         <p>
                                                             [% IF ( LEVEL_LOO.endnode ) %]
-                                                                <a href="opac-search.pl?q=Dewey-classification:[% LEVEL_LOO.classification |uri %]">[% LEVEL_LOO.description |html %]</a>
+                                                                <a href="opac-search.pl?q=Dewey-classification:[% LEVEL_LOO.classification |uri %]">[% LEVEL_LOO.description | html %]</a>
                                                             [% ELSE %]
-                                                                <a href="opac-browser.pl?level=[% LEVEL_LOO.level %]&amp;filter=[% LEVEL_LOO.classification |uri %]">[% LEVEL_LOO.description |html %]</a>
+                                                                <a href="opac-browser.pl?level=[% LEVEL_LOO.level | html %]&amp;filter=[% LEVEL_LOO.classification |uri %]">[% LEVEL_LOO.description | html %]</a>
                                                             [% END %]
                                                         </p>
-                                                        <p style="font-size:0.75em"><i>([% LEVEL_LOO.number %] biblios)</i></p>
+                                                        <p style="font-size:0.75em"><i>([% LEVEL_LOO.number | html %] biblios)</i></p>
                                                     </td>
                                                 [% IF ( LEVEL_LOO.count3 ) %]</tr><tr>[% END %]
                                                 [% END %]
index 8d085b5..e77a9a2 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -5,10 +6,10 @@
 [% USE ItemTypes %]
 [% USE Branches %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Course reserves for [% course.course_name %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Course reserves for [% course.course_name | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 
 </head>
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
         <li><a href="/cgi-bin/koha/opac-course-reserves.pl">Course reserves</a> <span class="divider">&rsaquo;</span></li>
-        <li><a href="#">Course reserves for <i>[% course.course_name %]</i></a></li>
+        <li><a href="#">Course reserves for <i>[% course.course_name | html %]</i></a></li>
     </ul>
 
     <div class="container-fluid">
         <div class="row-fluid">
             <div class="span12">
 
-                <h2>Course reserves for <i>[% course.course_name %]</i></h2>
+                <h2>Course reserves for <i>[% course.course_name | html %]</i></h2>
                 <div class="rows">
                     <ol>
-                        [% IF ( course.term ) %]<li><span class="label">Term:</span> [% AuthorisedValues.GetByCode( 'TERM', course.term ) %]</li>[% END %]
-                        <li><span class="label">Department:</span> [% AuthorisedValues.GetByCode( 'DEPARTMENT', course.department ) %]</li>
-                        [% IF ( course.course_number ) %]<li><span class="label">Course number:</span> [% course.course_number %]</li>[% END %]
-                        [% IF ( course.section ) %]<li><span class="label">Section:</span> [% course.section %]</li>[% END %]
+                        [% IF ( course.term ) %]<li><span class="label">Term:</span> [% AuthorisedValues.GetByCode( 'TERM', course.term ) | html %]</li>[% END %]
+                        <li><span class="label">Department:</span> [% AuthorisedValues.GetByCode( 'DEPARTMENT', course.department ) | html %]</li>
+                        [% IF ( course.course_number ) %]<li><span class="label">Course number:</span> [% course.course_number | html %]</li>[% END %]
+                        [% IF ( course.section ) %]<li><span class="label">Section:</span> [% course.section | html %]</li>[% END %]
                         [% IF ( course.instructors ) %]
                             <li><span class="label">Instructors:</span>
                                 <ul>
                                     [% FOREACH i IN course.instructors %]
-                                        <li><div class="instructor">[% i.firstname %] [% i.surname %]</div></li>
+                                        <li><div class="instructor">[% i.firstname | html %] [% i.surname | html %]</div></li>
                                     [% END %]
                                 </ul>
                             </li>
                         [% END %]
-                        [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note %]</li>[% END %]
+                        [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | html %]</li>[% END %]
                     </ol>
                 </div>
 
                         <tbody>
                             [% FOREACH cr IN course_reserves %]
                                 <tr>
-                                    <td><a href="opac-detail.pl?biblionumber=[% cr.biblio.biblionumber %]">[% cr.biblio.title %]</a></td>
-                                    <td>[% cr.biblio.author %]</td>
-                                    <td>[% ItemTypes.GetDescription( cr.item.itype ) %]</td>
-                                    <td>[% Branches.GetName( cr.item.holdingbranch ) %] <br/> <i>[% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) %]</i></td>
-                                    <td>[% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) %]</td>
-                                    <td>[% cr.item.itemcallnumber %]</td>
-                                    <td>[% cr.item.copynumber %]</td>
+                                    <td><a href="opac-detail.pl?biblionumber=[% cr.biblio.biblionumber | html %]">[% cr.biblio.title | html %]</a></td>
+                                    <td>[% cr.biblio.author | html %]</td>
+                                    <td>[% ItemTypes.GetDescription( cr.item.itype ) | html %]</td>
+                                    <td>[% Branches.GetName( cr.item.holdingbranch ) | html %] <br/> <i>[% AuthorisedValues.GetByCode( 'LOC', cr.item.location ) | html %]</i></td>
+                                    <td>[% AuthorisedValues.GetByCode( 'CCODE', cr.item.ccode ) | html %]</td>
+                                    <td>[% cr.item.itemcallnumber | html %]</td>
+                                    <td>[% cr.item.copynumber | html %]</td>
                                     <td>[% INCLUDE 'item-status.inc' item=cr.item issue=cr.issue %]</td>
-                                    <td><span title="[% cr.issue.date_due %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 %]</span></td>
+                                    <td><span title="[% cr.issue.date_due | html %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 | html %]</span></td>
                                     <td>[% IF ( cr.public_note ) %]
-                                            [% cr.public_note %]
+                                            [% cr.public_note | html %]
                                         [% ELSIF ( cr.item.itemnotes ) %]
-                                            [% cr.item.itemnotes %]
+                                            [% cr.item.itemnotes | html %]
                                         [% END %]
                                     </td>
                                     <td>[% IF (cr.item.uri) %]
-                                            <a href="[% cr.item.uri %]">Item URI</a>
+                                            <a href="[% cr.item.uri | html %]">Item URI</a>
                                         [% ELSIF (cr.biblioitem.url) %]
-                                            <a href="[% cr.biblioitem.url %]">Record URL</a>
+                                            <a href="[% cr.biblioitem.url | html %]">Record URL</a>
                                         [% END %]
                                     </td>
                                 </tr>
index 017cb91..c53e991 100644 (file)
@@ -1,12 +1,13 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE AuthorisedValues %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Courses</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Courses</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 
 </head>
                         <tbody>
                             [% FOREACH c IN courses %]
                                 <tr>
-                                    <td><a href="opac-course-details.pl?course_id=[% c.course_id %]">[% c.course_name %]</a></td>
-                                    <td>[% AuthorisedValues.GetByCode( 'DEPARTMENT', c.department, 1 ) %]</td>
-                                    <td>[% c.course_number %]</td>
-                                    <td>[% c.section %]</td>
-                                    <td>[% AuthorisedValues.GetByCode( 'TERM' c.term ) %]</td>
+                                    <td><a href="opac-course-details.pl?course_id=[% c.course_id | html %]">[% c.course_name | html %]</a></td>
+                                    <td>[% AuthorisedValues.GetByCode( 'DEPARTMENT', c.department, 1 ) | html %]</td>
+                                    <td>[% c.course_number | html %]</td>
+                                    <td>[% c.section | html %]</td>
+                                    <td>[% AuthorisedValues.GetByCode( 'TERM' c.term ) | html %]</td>
                                     <td>
                                       [% FOREACH i IN c.instructors %]
-                                          <div class="instructor"><span class"inst_surname">[% i.surname %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname %]</span>[% END %]</div>
+                                          <div class="instructor"><span class"inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div>
                                       [% END %]
                                     </td>
-                                    <td>[% c.public_note %]</td>
+                                    <td>[% c.public_note | html %]</td>
                             [% END %]
                         </tbody>
                     </table>
index 3278210..62d29fa 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Math %]
 [% USE Koha %]
@@ -8,18 +9,18 @@
 [% SET TagsShowEnabled = ( ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsShowOnDetail ) %]
 [% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsInputOnDetail ) %]
 [% IF Koha.Preference('AmazonAssocTag') %]
-    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') %]
+    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') | html %]
 [% ELSE %]
-    [% AmazonAssocTag = '' %]
+    [% AmazonAssocTag = '' | html %]
 [% END %]
 
-[% ShowCourseReservesHeader = 0 %]
+[% ShowCourseReservesHeader = 0 | html %]
 [% IF Koha.Preference( 'UseCourseReserves' ) == 1 %]
     [% FOREACH ITEM_RESULT IN itemloop %]
        [% IF ITEM_RESULT.course_reserves %]
            [% FOREACH r IN ITEM_RESULT.course_reserves %]
                [% IF r.course.enabled == 'yes' %]
-                   [% ShowCourseReservesHeader = 1 %]
+                   [% ShowCourseReservesHeader = 1 | html %]
                [% END %]
            [% END %]
         [% END %]
 [% END %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Details for: [% title |html %][% FOREACH subtitl IN subtitle %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %] [% subtitl.subfield |html %][% END %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Details for: [% title | html %][% FOREACH subtitl IN subtitle %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %] [% subtitl.subfield | html %][% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( bidi ) %]
-  [% BLOCK cssinclude %][% Asset.css("css/right-to-left.css") %][% END %]
+  [% BLOCK cssinclude %][% Asset.css("css/right-to-left.css").raw %][% END %]
 [% END %]
 [% IF ( OpacStarRatings != 'disable' ) %]
-    [% BLOCK cssinclude %][% Asset.css("css/jquery.rating.css") %][% END %]
+    [% BLOCK cssinclude %][% Asset.css("css/jquery.rating.css") | $raw %][% END %]
 [% END %]
 [% INCLUDE greybox.inc %]
-    [% Asset.css("lib/emoji-picker/css/emoji.css") %]
+    [% Asset.css("lib/emoji-picker/css/emoji.css") | $raw %]
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='opac-detail' bodyclass='scrollto' %]
 [% INCLUDE 'masthead.inc' %]
@@ -44,7 +45,7 @@
 <div class="main">
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-        <li><a href="#"><span>Details for: </span>[% title |html %][% FOREACH subtitl IN subtitle %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %] [% subtitl.subfield |html %][% END %]</a></li>
+        <li><a href="#"><span>Details for: </span>[% title | html %][% FOREACH subtitl IN subtitle %][% IF Koha.Preference('marcflavour')=='UNIMARC' %],[% END %] [% subtitl.subfield | html %][% END %]</a></li>
     </ul>
 
     <div class="container-fluid">
 
                     <div id="bookcover">
                     [% IF ( OPACLocalCoverImages ) %]
-                        <div title="[% biblio.biblionumber %]" class="[% biblio.biblionumber %]" id="local-thumbnail-preview"></div>
+                        <div title="[% biblio.biblionumber | html %]" class="[% biblio.biblionumber | html %]" id="local-thumbnail-preview"></div>
                     [% END %]
                     [% IF ( OPACAmazonCoverImages ) %]
                         [% IF ( OPACURLOpenInNewWindow ) %]
-                            <a href="http://www.amazon[% AmazonTld %]/gp/reader/[% normalized_isbn %][% AmazonAssocTag %]#reader-link" target="_blank" rel="noreferrer">
+                            <a href="http://www.amazon[% AmazonTld | html %]/gp/reader/[% normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link" target="_blank" rel="noreferrer">
                         [% ELSE %]
-                            <a href="http://www.amazon[% AmazonTld %]/dp/[% normalized_isbn %][% AmazonAssocTag %]">
+                            <a href="http://www.amazon[% AmazonTld | html %]/dp/[% normalized_isbn | html %][% AmazonAssocTag | html %]">
                         [% END %]
-                            <img border="0" src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn %].01.MZZZZZZZ.jpg" alt="Cover image" /></a>
+                            <img border="0" src="https://images-na.ssl-images-amazon.com/images/P/[% normalized_isbn | html %].01.MZZZZZZZ.jpg" alt="Cover image" /></a>
                     [% END %]
 
                     [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
                         [% IF ( content_identifier_exists ) %]
-                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/[% SyndeticsCoverImageSize %].GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% normalized_upc %]&amp;oclc=[% normalized_oclc %]" alt="" class="thumbnail" />
+                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn | html %]/[% SyndeticsCoverImageSize | html %].GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% normalized_upc | html %]&amp;oclc=[% normalized_oclc | html %]" alt="" class="thumbnail" />
                         [% ELSE %]
                             <span class="no-image">No cover image available</span>
                         [% END %]
                     [% END %]
 
                     [% IF ( GoogleJackets ) %]
-                        <div title="[% biblio.biblionumber %]" class="[% normalized_isbn %]" id="gbs-thumbnail-preview"></div>
+                        <div title="[% biblio.biblionumber | html %]" class="[% normalized_isbn | html %]" id="gbs-thumbnail-preview"></div>
                     [% END %]
                     [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                      [% coce_id = normalized_ean || normalized_isbn %]
-                      <div title="[% biblio.biblionumber %]" class="[% coce_id %]" id="coce-thumbnail-preview"></div>
+                      [% coce_id = normalized_ean || normalized_isbn | html %]
+                      <div title="[% biblio.biblionumber | html %]" class="[% coce_id | html %]" id="coce-thumbnail-preview"></div>
                     [% END %]
                     [% IF OpenLibraryCovers %]
-                        <div title="[% biblio.biblionumber %]" class="[% normalized_isbn %]" id="openlibrary-thumbnail-preview"></div>
+                        <div title="[% biblio.biblionumber | html %]" class="[% normalized_isbn | html %]" id="openlibrary-thumbnail-preview"></div>
                     [% END %]
-                    [% bt_id = ( normalized_upc || normalized_isbn ) %]
+                    [% bt_id = ( normalized_upc || normalized_isbn ) | html %]
                     [% IF ( BakerTaylorEnabled && bt_id ) %]
                         [% IF BakerTaylorBookstoreURL %]
                             [% IF ( OPACURLOpenInNewWindow ) %]
-                                <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]" target="_blank" rel="noreferrer"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]" target="_blank" rel="noreferrer"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                             [% ELSE %]
-                                <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                             [% END %]
                         [% ELSE %]
-                            <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" />
+                            <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" />
                         [% END %]
                     [% END %]
                     </div><!-- / #bookcover -->
 
-                    <abbr class="unapi-id" title="koha:biblionumber:[% biblio.biblionumber %]"><!-- unAPI --></abbr>
+                    <abbr class="unapi-id" title="koha:biblionumber:[% biblio.biblionumber | html %]"><!-- unAPI --></abbr>
                     [% IF ( ocoins ) # COinS / Openurl %]
-                        <span class="Z3988" title="[% ocoins %]"></span>
+                        <span class="Z3988" title="[% ocoins | html %]"></span>
                     [% END %]
 
                     <div id="views">
                         <span class="view current-view"><span id="Normalview">Normal view</span></span>
-                        <span class="view"><a id="MARCview" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% biblio.biblionumber %]">MARC view</a></span>
-                        [% IF ( ISBD ) %]<span class="view"><a id="ISBDview" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% biblio.biblionumber %]">ISBD view</a></span>[% END %]
+                        <span class="view"><a id="MARCview" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% biblio.biblionumber | html %]">MARC view</a></span>
+                        [% IF ( ISBD ) %]<span class="view"><a id="ISBDview" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% biblio.biblionumber | html %]">ISBD view</a></span>[% END %]
                     </div>
                     [% IF ( OPACXSLTDetailsDisplay ) %]
-                        [% XSLTBloc %]
+                        [% XSLTBloc | $raw %]
                     [% ELSE %]
-                        <h1 class="title">[% title |html %][% IF ( subtitle ) %] <span class="subtitle">[% FOREACH subtitl IN subtitle %][% subtitl.subfield |html %] [% END %]</span>[% END %]</h1>
-                        [% IF ( author ) %]<h5 class="author">by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% author |url %]">[% author |html %]</a></h5>[% END %]
+                        <h1 class="title">[% title | html %][% IF ( subtitle ) %] <span class="subtitle">[% FOREACH subtitl IN subtitle %][% subtitl.subfield | html %] [% END %]</span>[% END %]</h1>
+                        [% IF ( author ) %]<h5 class="author">by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% author |url %]">[% author | html %]</a></h5>[% END %]
 
                         <span class="results_summary">[% UNLESS ( item_level_itypes ) %]
                             [
                             [% IF ( description ) %]
-                                [% description %]
+                                [% description | html %]
                             [% ELSE %]
-                                [% itemtype %]
+                                [% itemtype | html %]
                             [% END %]
                             ] [% END %]
-                            [% IF ( unititle ) %], [% unititle %][% END %]
+                            [% IF ( unititle ) %], [% unititle | html %][% END %]
                         </span>
 
                         [% IF ( MARCAUTHORS ) %]
                                                     <li>
                                                         [% IF (MARCAUTHOR.authoritylink) %]
                                                             <input type="checkbox" name="checkbox"
-                                                                id="author_[% loop.count %]"
+                                                                id="author_[% loop.count | html %]"
                                                                 onclick="makeAuthorRequest()"
-                                                                value="an:[% MARCAUTHOR.authoritylink %]" />
+                                                                value="an:[% MARCAUTHOR.authoritylink | html %]" />
                                                         [% ELSE %]
                                                             <input type="checkbox" name="checkbox"
-                                                                id="author_[% loop.count %]"
+                                                                id="author_[% loop.count | html %]"
                                                                 onclick="makeAuthorRequest()"
                                                                 value="au,wrdl:[% FOREACH SUBFIELD IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %][% SUBFIELD.value |url %][% UNLESS (loop.last) %]+[% END %][% END %]" />
                                                         [% END %]
-                                                        <label for="author_[% loop.count %]">
+                                                        <label for="author_[% loop.count | html %]">
                                                             [% FOREACH SUBFIELD IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                                                                [% SUBFIELD.value %]
+                                                                [% SUBFIELD.value | html %]
                                                             [% END %]
                                                         </label>
                                                     </li>
                                 [% END # /OPACPopupAuthorsSearch %]
 
                                 [% FOREACH MARCAUTHOR IN MARCAUTHORS %]
-                                    [% authorsloop = loop %]
+                                    [% authorsloop = loop | html %]
                                     [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                                        [% MARCAUTHOR_SUBFIELDS_LOO.separator %]
+                                        [% MARCAUTHOR_SUBFIELDS_LOO.separator | html %]
                                         [% IF Koha.Preference( 'OPACPopupAuthorsSearch' ) == 1 %]
-                                            <a role="button" data-toggle="modal" title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code %] [% MARCAUTHOR_SUBFIELDS_LOO.value %]"
-                                            class="showauthors" data-count="[% authorsloop.count %]"
-                                            href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]#authorSearch">[% MARCAUTHOR_SUBFIELDS_LOO.value %]</a>
+                                            <a role="button" data-toggle="modal" title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code | html %] [% MARCAUTHOR_SUBFIELDS_LOO.value | html %]"
+                                            class="showauthors" data-count="[% authorsloop.count | html %]"
+                                            href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]#authorSearch">[% MARCAUTHOR_SUBFIELDS_LOO.value | html %]</a>
                                         [% ELSE %]
-                                            <a title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code %] [% MARCAUTHOR_SUBFIELDS_LOO.value %]"
-                                            class="showauthors" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]">[% MARCAUTHOR_SUBFIELDS_LOO.value %]</a>
+                                            <a title="‡[% MARCAUTHOR_SUBFIELDS_LOO.code | html %] [% MARCAUTHOR_SUBFIELDS_LOO.value | html %]"
+                                            class="showauthors" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN MARCAUTHOR_SUBFIELDS_LOO.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]">[% MARCAUTHOR_SUBFIELDS_LOO.value | html %]</a>
                                         [% END %]
                                     [% END %]
                                     [% IF (MARCAUTHOR.authoritylink) %]
-                                        <a class='authlink' href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% MARCAUTHOR.authoritylink %]"><img style="vertical-align:middle" height="15" width="15" src="[% interface %]/[% theme %]/images/filefind.png"></a>
+                                        <a class='authlink' href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% MARCAUTHOR.authoritylink | html %]"><img style="vertical-align:middle" height="15" width="15" src="[% interface | html %]/[% theme | html %]/images/filefind.png"></a>
                                     [% END %]
                                     [% IF IDREF and MARCAUTHOR.unimarc3 %]
-                                        <a href="/cgi-bin/koha/opac-idref.pl?unimarc3=[% MARCAUTHOR.unimarc3 %]" title="IdRef" rel="gb_page_center[600,500]">IdRef</a>
+                                        <a href="/cgi-bin/koha/opac-idref.pl?unimarc3=[% MARCAUTHOR.unimarc3 | html %]" title="IdRef" rel="gb_page_center[600,500]">IdRef</a>
                                     [% END %]
                                     [% UNLESS ( loop.last ) %]|[% END %]
                                 [% END # /FOREACH MARCAUTHORS %]
                                 [% FOREACH MARCSERIE IN MARCSERIES %]
                                     [% FOREACH MARCSERIES_SUBFIELDS_LOO IN MARCSERIE.MARCSERIES_SUBFIELDS_LOOP %]
                                         [% IF ( MARCSERIES_SUBFIELDS_LOO.value ) %]
-                                            <a href="/cgi-bin/koha/opac-search.pl?q=se:[% MARCSERIES_SUBFIELDS_LOO.value |url %]">[% MARCSERIES_SUBFIELDS_LOO.value %]</a>
+                                            <a href="/cgi-bin/koha/opac-search.pl?q=se:[% MARCSERIES_SUBFIELDS_LOO.value |url %]">[% MARCSERIES_SUBFIELDS_LOO.value | html %]</a>
                                         [% END %]
                                         [% IF ( MARCSERIES_SUBFIELDS_LOO.volumenum ) %]
-                                            . [% MARCSERIES_SUBFIELDS_LOO.volumenum %]
+                                            . [% MARCSERIES_SUBFIELDS_LOO.volumenum | html %]
                                         [% END %]
                                     [% END %]
                                     [% UNLESS ( loop.last ) %]|[% END %]
                         [% END # /MARCSERIES %]
 
                         [% IF ( editionstatement ) %]
-                            <span class="results_summary edition"><span class="label">Edition statement:</span>[% editionstatement %][% IF ( editionresponsibility ) %]/[% editionresponsibility %][% END %]</span>
+                            <span class="results_summary edition"><span class="label">Edition statement:</span>[% editionstatement | html %][% IF ( editionresponsibility ) %]/[% editionresponsibility | html %][% END %]</span>
                         [% END %]
                         [% IF ( publishercode ) %]
                             <span class="results_summary publisher"><span class="label">Published by :</span>
                                 <a href="/cgi-bin/koha/opac-search.pl?q=pb:[% publishercode |url %] ">
-                                    [% publishercode |html %]
-                                </a> [% IF ( place ) %]([% place %])[% END %] [% IF ( publicationyear ) %], [% publicationyear %][% END %]
+                                    [% publishercode | html %]
+                                </a> [% IF ( place ) %]([% place | html %])[% END %] [% IF ( publicationyear ) %], [% publicationyear | html %][% END %]
                             </span>
                         [% END %]
 
                         [% IF ( pages ) %]
-                            <span class="results_summary physical"><span class="label">Physical details:</span> [% pages %] [% illus %] [% size %]</span>
+                            <span class="results_summary physical"><span class="label">Physical details:</span> [% pages | html %] [% illus | html %] [% size | html %]</span>
                         [% END %]
 
                         [% IF ( MARCISBNS ) %]
-                            <span class="results_summary isbn"><span class="label">ISBN:</span>[% FOREACH MARCISBN IN MARCISBNS %][% MARCISBN %][% IF ( loop.last ) %].[% ELSE %]; [% END %][% END %]</span>
+                            <span class="results_summary isbn"><span class="label">ISBN:</span>[% FOREACH MARCISBN IN MARCISBNS %][% MARCISBN | html %][% IF ( loop.last ) %].[% ELSE %]; [% END %][% END %]</span>
                         [% ELSE %]
                             [% IF ( normalized_isbn ) %]
-                                <span class="results_summary isbn"><span class="label">ISBN: </span>[% normalized_isbn %]</span>
+                                <span class="results_summary isbn"><span class="label">ISBN: </span>[% normalized_isbn | html %]</span>
                             [% END %]
                         [% END %]
 
                         [% IF ( issn ) %]
-                            <span class="results_summary issn"><span class="label">ISSN:</span>[% issn %]</span>
+                            <span class="results_summary issn"><span class="label">ISSN:</span>[% issn | html %]</span>
                         [% END %]
 
                         [% IF ( collectiontitle ) %]
                             <span class="results_summary collection"><span class="label">Collection: </span>
-                                [% collectiontitle %]
-                                [% IF ( collectionissn ) %] [% ', ISSN ' _  collectionissn %][% END %]
-                                [% IF ( collectionvolume ) %] [% ' ; ' _ collectionvolume %] [% END %]
+                                [% collectiontitle | html %]
+                                [% IF ( collectionissn ) %] [% ', ISSN ' _  collectionissn | html %][% END %]
+                                [% IF ( collectionvolume ) %] [% ' ; ' _ collectionvolume | html %] [% END %]
 
                             </span>
                         [% END %]
                         [% IF ( unititles ) %]
                             <span class="results_summary unititle"><span class="label">Uniform titles:</span>
                                 [% FOREACH unititle IN unititles %]
-                                    [% unititle.unititle %] ;
+                                    [% unititle.unititle | html %] ;
                                 [% END %]
                             </span>
                         [% END %]
                                                 <b>All</b>
                                             </label>
                                             [% FOREACH MARCSUBJCT IN MARCSUBJCTS %]
-                                                [% subjectsloop = loop %]
+                                                [% subjectsloop = loop | html %]
                                                 [% IF MARCSUBJCT.authoritylink %]
-                                                    <ul id="subjectsList[% loop.count %]" data-authid="[% MARCSUBJCT.authoritylink %]">
+                                                    <ul id="subjectsList[% loop.count | html %]" data-authid="[% MARCSUBJCT.authoritylink | html %]">
                                                 [% ELSE %]
-                                                    <ul id="subjectsList[% loop.count %]">
+                                                    <ul id="subjectsList[% loop.count | html %]">
                                                 [% END %]
                                                 [% FOREACH SUBFIELD IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %]
                                                     <li>
-                                                        <input type="checkbox" onclick="makeSubjectRequest()" name="checkbox" id="subject_[% subjectsloop.count %]_[% loop.count %]" value="su,wrdl:[% SUBFIELD.value |url %]" />
-                                                        <label for="subject_[% subjectsloop.count %]_[% loop.count %]">
-                                                            [% SUBFIELD.value %]
+                                                        <input type="checkbox" onclick="makeSubjectRequest()" name="checkbox" id="subject_[% subjectsloop.count | html %]_[% loop.count | html %]" value="su,wrdl:[% SUBFIELD.value |url %]" />
+                                                        <label for="subject_[% subjectsloop.count | html %]_[% loop.count | html %]">
+                                                            [% SUBFIELD.value | html %]
                                                         </label>
                                                     </li>
                                                 [% END %]
                                 [% END # /OPACPopupAuthorsSearch%]
 
                                 [% FOREACH MARCSUBJCT IN MARCSUBJCTS %]
-                                    [% subjectsloop = loop %]
+                                    [% subjectsloop = loop | html %]
                                     [% FOREACH SUBFIELD IN MARCSUBJCT.MARCSUBJECT_SUBFIELDS_LOOP %]
-                                        [% SUBFIELD.separator %]
+                                        [% SUBFIELD.separator | html %]
                                         [% IF Koha.Preference( 'OPACPopupAuthorsSearch' ) == 1 %]
-                                            <a role="button" data-toggle="modal" title="[% '$' _ SUBFIELD.code _ ' ' _ SUBFIELD.value %]" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN SUBFIELD.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]#subjectSearch" onclick="showSubjects(this, [% subjectsloop.count %], [% loop.count %]); return false;">[% SUBFIELD.value %]</a>
+                                            <a role="button" data-toggle="modal" title="[% '$' _ SUBFIELD.code _ ' ' _ SUBFIELD.value | html %]" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN SUBFIELD.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]#subjectSearch" onclick="showSubjects(this, [% subjectsloop.count | html %], [% loop.count | html %]); return false;">[% SUBFIELD.value | html %]</a>
                                         [% ELSE %]
-                                            <a title="[% '$' _ SUBFIELD.code _ ' ' _ SUBFIELD.value %]" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN SUBFIELD.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]">[% SUBFIELD.value %]</a>
+                                            <a title="[% '$' _ SUBFIELD.code _ ' ' _ SUBFIELD.value | html %]" href="/cgi-bin/koha/opac-search.pl?q=[% FOREACH link_loo IN SUBFIELD.link_loop %][% link_loo.operator |url %][% link_loo.limit |url %]:[% link_loo.link |url %][% END %]">[% SUBFIELD.value | html %]</a>
                                         [% END %]
                                     [% END %]
                                     [% IF (MARCSUBJCT.authoritylink) %]
-                                        <a class="authlink" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% MARCSUBJCT.authoritylink %]"><img style="vertical-align:middle" height="15" width="15" src="[% interface %]/[% theme %]/images/filefind.png" /></a>
+                                        <a class="authlink" href="/cgi-bin/koha/opac-authoritiesdetail.pl?authid=[% MARCSUBJCT.authoritylink | html %]"><img style="vertical-align:middle" height="15" width="15" src="[% interface | html %]/[% theme | html %]/images/filefind.png" /></a>
                                     [% END %]
                                     [% UNLESS ( loop.last ) %] | [% END %]
                                 [% END # / FOREACH MARCSUBJCTS %]
                             </div>
                         [% ELSE # /IF MARCSUBJCTS %]
-                            [% IF ( subjects ) %]<span class="results_summary"><span class="label">Subject(s):</span> [% FOREACH subject IN subjects %]<a href="/cgi-bin/koha/opac-search.pl?q=su:[% subject.subject |url %]">[% subject.subject %]</a> | [% END %]</span>[% END %]
+                            [% IF ( subjects ) %]<span class="results_summary"><span class="label">Subject(s):</span> [% FOREACH subject IN subjects %]<a href="/cgi-bin/koha/opac-search.pl?q=su:[% subject.subject |url %]">[% subject.subject | html %]</a> | [% END %]</span>[% END %]
                         [% END %]
 
                         [% IF ( copyrightdate ) %]
-                            <span class="results_summary year"><span class="label">Year: </span>[% copyrightdate %]</span>
+                            <span class="results_summary year"><span class="label">Year: </span>[% copyrightdate | html %]</span>
                         [% END %]
 
                         [% UNLESS ( item_level_itypes ) %]
                             [% IF ( imgeurl ) %]
-                                <img src="[% imageurl %]" alt="" />
+                                <img src="[% imageurl | html %]" alt="" />
                             [% END %]
                             <span class="results_summary itemtype"><span class="label">Item type: </span>
                                 [% IF ( description ) %]
-                                    [% description %]
+                                    [% description | html %]
                                 [% ELSE %]
-                                    [% itemtype %]
+                                    [% itemtype | html %]
                                 [% END %]
                             </span>
                         [% END %]
                             <div class="results_summary online_resources"><span class="label">Online resources:</span>
                                 <ul>
                                     [% FOREACH MARCurl IN MARCURLS %]
-                                        <li>[% IF ( MARCurl.part ) %][% MARCurl.part %]<br />[% END %]
+                                        <li>[% IF ( MARCurl.part ) %][% MARCurl.part | html %]<br />[% END %]
 
                                         [% IF ( OPACURLOpenInNewWindow ) %]
                                             [% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
-                                                <a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&amp;biblionumber=[% biblio.biblionumber %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">
+                                                <a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&amp;biblionumber=[% biblio.biblionumber | html %]" title="[% MARCurl.MARCURL | html %]" target="_blank" rel="noreferrer">
                                             [% ELSE %]
-                                                <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]" target="_blank" rel="noreferrer">
+                                                <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]" target="_blank" rel="noreferrer">
                                             [% END %]
                                         [% ELSE %]
                                             [% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
-                                                <a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&amp;biblionumber=[% biblio.biblionumber %]" title="[% MARCurl.MARCURL %]">
+                                                <a href="/cgi-bin/koha/tracklinks.pl?uri=[% MARCurl.MARCURL |url%]&amp;biblionumber=[% biblio.biblionumber | html %]" title="[% MARCurl.MARCURL | html %]">
                                             [% ELSE %]
-                                                <a href="[% MARCurl.MARCURL %]" title="[% MARCurl.MARCURL %]">
+                                                <a href="[% MARCurl.MARCURL | html %]" title="[% MARCurl.MARCURL | html %]">
                                             [% END %]
                                         [% END %]
-                                        [% MARCurl.linktext %]</a>
+                                        [% MARCurl.linktext | html %]</a>
                                             [% IF ( MARCurl.notes ) %]
                                                 <ul>
                                                     [% FOREACH note IN MARCurl.notes %]
-                                                        <li>[% note.note %]</li>
+                                                        <li>[% note.note | html %]</li>
                                                     [% END %]
                                                 </ul>
                                             [% END %]
                     [% IF shelves.count %]
                         <span class="results_summary lists"><span class="label">List(s) this item appears in: </span>
                         [% FOREACH s IN shelves %]
-                            <a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]">[% s.shelfname %]</a>
+                            <a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]">[% s.shelfname | html %]</a>
                             [% IF ( loop.last ) %][% ELSE %]|[% END %]
                         [% END %]
                         </span>
                                 <span class="label">Tags from this library:</span>
                                 <ul id="tagslist">
                                     [% FOREACH TagLoo IN TagLoop %]
-                                        <li><a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term |html %]</a> <span class="weight">([% TagLoo.weight_total %])</span>
+                                        <li><a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term | html %]</a> <span class="weight">([% TagLoo.weight_total | html %])</span>
                                         [% IF ( loop.last ) %][% ELSE %], [% END %]
                                         </li>
                                     [% END %]
                             [% END %]
                             [% IF ( TagsInputEnabled ) %]
                                 [% IF ( loggedinusername ) %]
-                                    <form id="tagform[% biblio.biblionumber %]" method="post" action="/cgi-bin/koha/opac-tags.pl" style="display:none;">
-                                        <label for="newtag[% biblio.biblionumber %]">New tag(s), separated by a comma:</label>
+                                    <form id="tagform[% biblio.biblionumber | html %]" method="post" action="/cgi-bin/koha/opac-tags.pl" style="display:none;">
+                                        <label for="newtag[% biblio.biblionumber | html %]">New tag(s), separated by a comma:</label>
                                         <p class="emoji-picker-container">
                                           <input
-                                            name="newtag[% biblio.biblionumber %]"
-                                            id="newtag[% biblio.biblionumber %]"
+                                            name="newtag[% biblio.biblionumber | html %]"
+                                            id="newtag[% biblio.biblionumber | html %]"
                                             type="text"
                                             maxlength="100"
                                             data-emojiable="true"
                                             data-emoji-input="unicode">
                                         </p>
-                                        <input name="tagbutton" class="btn btn-small tagbutton" title="[% biblio.biblionumber %]" type="submit" value="Add" />
-                                        <a class="cancel_tag_add" id="cancel[% biblio.biblionumber %]" href="#">(done)</a>
+                                        <input name="tagbutton" class="btn btn-small tagbutton" title="[% biblio.biblionumber | html %]" type="submit" value="Add" />
+                                        <a class="cancel_tag_add" id="cancel[% biblio.biblionumber | html %]" href="#">(done)</a>
                                     </form>
 
-                                    <span id="newtag[% biblio.biblionumber %]_status" class="tagstatus" style="display:none;">
+                                    <span id="newtag[% biblio.biblionumber | html %]_status" class="tagstatus" style="display:none;">
                                         Tag status here.
                                     </span>
-                                    <a class="tag_add" id="tag_add[% biblio.biblionumber %]" href="#">Add tag(s)</a>
+                                    <a class="tag_add" id="tag_add[% biblio.biblionumber | html %]" href="#">Add tag(s)</a>
                                 [% ELSE %]
                                     <span id="login4tags">
                                         [% IF Koha.Preference('casAuthentication') %]
                         [% IF ( SyndeticsSeries && SyndeticsSERIES1Exists ) %]
                             <span class="results_summary">
                                 <span class="label">Series information:</span>
-                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn %]&amp;type=series&amp;num=1&amp;client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
+                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffseries.aspx?isbn=[% normalized_isbn | html %]&amp;type=series&amp;num=1&amp;client=[% SyndeticsClientCode | html %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc | html %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc | html %][% END %]">Click to open in new window</a>
                             </span>
                         [% END # / IF SyndeticsSeries && SyndeticsSERIES1Exists%]
                         [% IF ( SyndeticsAVPROFILEExists ) %]
                             <span class="results_summary">
                                 <span class="label">Audiovisual profile:</span>
-                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/avprofile.html&amp;client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc %][% END %]&amp;type=xw10">Click to open in new window</a>
+                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn | html %]/avprofile.html&amp;client=[% SyndeticsClientCode | html %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc | html %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc | html %][% END %]&amp;type=xw10">Click to open in new window</a>
                             </span>
                         [% END # / IF SyndeticsAVPROFILEExists %]
 
                         [% IF ( SyndeticsFICTIONExists ) %]
                             <span class="results_summary">
                                 <span class="label">Fiction notes:</span>
-                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn %]/fiction.html&amp;client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc %][% END %]&amp;type=xw10">Click to open in new window</a>
+                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/index.aspx?isbn=[% normalized_isbn | html %]/fiction.html&amp;client=[% SyndeticsClientCode | html %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc | html %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc | html %][% END %]&amp;type=xw10">Click to open in new window</a>
                             </span>
                         [% END # / IF SyndeticsFICTIONExists %]
 
                         [% IF ( SyndeticsAwards && SyndeticsAWARDS1Exists ) %]
                             <span class="results_summary">
                                 <span class="label">Awards:</span>
-                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn %]&amp;type=awards&amp;client=[% SyndeticsClientCode %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc %][% END %]">Click to open in new window</a>
+                                <a target="_blank" rel="noreferrer" href="https://secure.syndetics.com/ffawards.aspx?isbn=[% normalized_isbn | html %]&amp;type=awards&amp;client=[% SyndeticsClientCode | html %][% IF ( normalized_upc ) %]&amp;upc=[% normalized_upc | html %][% END %][% IF ( normalized_oclc ) %]&amp;oclc=[% normalized_oclc | html %][% END %]">Click to open in new window</a>
                             </span>
                         [% END # / IF SyndeticsAwards && SyndeticsAWARDS1Exists %]
                     [% END # / IF SyndeticsEnabled%]
                             <div class="results_summary ratings">
 
                                 [% SET rating_avg = ratings.get_avg_rating() %]
-                                [% rating_avg_int = BLOCK %][% rating_avg | format("%.0f") %][% END %]
+                                [% rating_avg_int = BLOCK | html %][% rating_avg | format("%.0f") %][% END %]
                                 [% FOREACH i  IN [ 1 2 3 4 5  ] %]
                                     [% IF rating_avg_int == i && borrowernumber %]
-                                        <input class="auto-submit-star" type="radio" name="rating"  value="[% i %]"  checked="checked" />
+                                        <input class="auto-submit-star" type="radio" name="rating"  value="[% i | html %]"  checked="checked" />
                                     [% ELSIF rating_avg_int == i %]
-                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i %]" checked="checked" disabled="disabled" />
+                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i | html %]" checked="checked" disabled="disabled" />
                                     [% ELSIF borrowernumber  %]
-                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i %]" />
+                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i | html %]" />
                                     [% ELSE   %]
-                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i %]" disabled="disabled" />
+                                        <input class="auto-submit-star" type="radio" name="rating" value="[% i | html %]" disabled="disabled" />
                                     [% END %]
                                 [% END %]
 
                                 <!-- define some hidden vars for ratings -->
 
-                                <input  type="hidden" name='biblionumber'  value="[% biblio.biblionumber %]" />
-                                <input  type="hidden" name='rating_value' id='rating_value' value="[% my_rating.rating_value %]" />
+                                <input  type="hidden" name='biblionumber'  value="[% biblio.biblionumber | html %]" />
+                                <input  type="hidden" name='rating_value' id='rating_value' value="[% my_rating.rating_value | html %]" />
 
                                 [% UNLESS ( rating_readonly ) %]&nbsp;  <input name="rate_button" type="submit" value="Rate me" />[% END %]&nbsp;
 
                                 [% IF my_rating %]
-                                    <span id="rating_value_text">your rating: [% my_rating.rating_value %], </span>
+                                    <span id="rating_value_text">your rating: [% my_rating.rating_value | html %], </span>
                                 [% ELSE %]
                                     <span id="rating_value_text"></span>
                                 [% END %]
 
-                                <span id="rating_text">average rating: [% rating_avg %] ([% ratings.count %] votes)</span>
+                                <span id="rating_text">average rating: [% rating_avg | html %] ([% ratings.count | html %] votes)</span>
                             </div>
                         </form>
                     [% END # / IF OpacStarRatings != 'disable' %]
                     [% IF ( BakerTaylorContentURL ) %]
                         <span class="results_summary">
                         <span class="label">Enhanced content: </span>
-                              [% IF ( OPACURLOpenInNewWindow ) %]<a href="[% BakerTaylorContentURL |html %]" target="_blank" rel="noreferrer">Content Cafe</a>[% ELSE %]<a href="[% BakerTaylorContentURL |html %]">Content Cafe</a>[% END %]
+                              [% IF ( OPACURLOpenInNewWindow ) %]<a href="[% BakerTaylorContentURL | html %]" target="_blank" rel="noreferrer">Content Cafe</a>[% ELSE %]<a href="[% BakerTaylorContentURL | html %]">Content Cafe</a>[% END %]
                         </span>
                     [% END # / IF BakerTaylorContentURL %]
 
                         [% IF ( NovelistSelectView == 'above') %]
                             <span class="results_summary NovelistSelect" style="display:none;">
                             <span class="label">Novelist Select: </span>
-                            <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]></div>
+                            <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]></div>
 
                             </span>
                         [% END %]
                     [% END # / IF NovelistSelectProfile %]
 
                     [% IF ( Babeltheque ) %]
-                        <input type="hidden" name="BW_id_isbn" id="BW_id_isbn" value="[% normalized_isbn %]"/>
+                        <input type="hidden" name="BW_id_isbn" id="BW_id_isbn" value="[% normalized_isbn | html %]"/>
                         <div id="BW_notes"></div>
                         <div id="BW_critiques"></div>
                         <div id="BW_critiques_pro"></div>
                         [% ELSE %]
                             <li id="tab_holdings">
                         [% END %]
-                        [% BLOCK holding_tab_title %][% IF SeparateHoldings %]<span>[% LoginBranchname %] holdings</span>[% ELSE %]<span>Holdings</span>[% END %][% END %]
-                            <a href="#holdings">[% PROCESS holding_tab_title %] [% UNLESS too_many_items %][% ' ( ' _ (itemloop.size || 0) _ ' )' %][% END %]</a>
+                        [% BLOCK holding_tab_title %][% IF SeparateHoldings %]<span>[% LoginBranchname | html %] holdings</span>[% ELSE %]<span>Holdings</span>[% END %][% END %]
+                            <a href="#holdings">[% PROCESS holding_tab_title %] [% UNLESS too_many_items %][% ' ( ' _ (itemloop.size || 0) _ ' )' | html %][% END %]</a>
                         </li>
                         [% IF (SeparateHoldings) %]
-                            <li><a href="#otherholdings">Other holdings [% ' ( ' _ (otheritemloop.size || 0) _ ' )' %]</a></li>
+                            <li><a href="#otherholdings">Other holdings [% ' ( ' _ (otheritemloop.size || 0) _ ' )' | html %]</a></li>
                         [% END %]
                         [% IF ( MARCNOTES || notes || ( SyndeticsEnabled && SyndeticsSummary && SYNDETICS_SUMMARY )) %]
                             <li id="tab_descriptions"> <a href="#descriptions">Title notes</a></li>
                                 <li id="tab_reviews"> <a href="#reviews">Reviews</a></li>
                                 [% IF ( LibraryThingForLibrariesID ) %]
                                     <li id="tab_LTFLreviews">
-                                        <script src="https://www.librarything.com/forlibraries/widget.js?id=[% LibraryThingForLibrariesID %]"></script>
-                                        <noscript>This page contains enriched content visible when JavaScript is enabled or by clicking <a href="https://www.librarything.com/forlibraries/noscript.php?id=[% LibraryThingForLibrariesID %]&amp;accessibility=1">here</a>.</noscript>
+                                        <script src="https://www.librarything.com/forlibraries/widget.js?id=[% LibraryThingForLibrariesID | html %]"></script>
+                                        <noscript>This page contains enriched content visible when JavaScript is enabled or by clicking <a href="https://www.librarything.com/forlibraries/noscript.php?id=[% LibraryThingForLibrariesID | html %]&amp;accessibility=1">here</a>.</noscript>
                                     </li>
                                 [% END %]
                             [% END %]
 
                         [% IF ( subscriptionsnumber ) %]
                             [% IF ( defaulttab == 'subscriptions' ) %]<li id="tab_subscriptions" class="ui-tabs-active">[% ELSE %]<li id="tab_subscriptions">[% END %]
-                                <a href="#subscriptions">Subscriptions ( [% subscriptionsnumber %] )</a>
+                                <a href="#subscriptions">Subscriptions ( [% subscriptionsnumber | html %] )</a>
                             </li>
                         [% END %]
 
                         [% IF Koha.Preference( 'reviewson' ) == 1 %]
-                            <li id="tab_comments"><a href="#comments">Comments[% ' ( ' _ (reviews.size || 0) _ ' )' %]</a></li>
+                            <li id="tab_comments"><a href="#comments">Comments[% ' ( ' _ (reviews.size || 0) _ ' )' | html %]</a></li>
                         [% END %]
 
                         [% IF ( NovelistSelectProfile && (normalized_isbn || normalized_upc) ) %]
                             <tbody>
                             [% FOREACH serialcollection IN serialcollections %]
                                 <tr>
-                                <td>[% serialcollection.branch %]</td>
-                                <td>[% serialcollection.text %]</td>
-                                <td>[% serialcollection.itemcallnumber %]</td>
+                                <td>[% serialcollection.branch | html %]</td>
+                                <td>[% serialcollection.text | html %]</td>
+                                <td>[% serialcollection.itemcallnumber | html %]</td>
                                 </tr>
                             [% END %]
                             </tbody>
 
                     <div id="holdings">
                         [% IF too_many_items %]
-                            <p>This record has many physical items ([% items_count %]). <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber %]&amp;viewallitems=1">Click here to view them all.</a></p>
+                            <p>This record has many physical items ([% items_count | html %]). <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblio.biblionumber | html %]&amp;viewallitems=1">Click here to view them all.</a></p>
                         [% ELSIF ( itemloop.size ) %]
                             [% INCLUDE items_table items=itemloop tab="holdings" table_id="holdingst" %]
                             [% IF Koha.Preference('OPACAcquisitionDetails') and acquisition_details.total_quantity > 0 %]
                               [% IF acquisition_details.total_quantity == 1 %]
                                 <span>1 item is on order.</span>
                               [% ELSE %]
-                                <span>[% acquisition_details.total_quantity %] items are on order.</span>
+                                <span>[% acquisition_details.total_quantity | html %] items are on order.</span>
                               [% END %]
                             [% END %]
                             [% IF holds_count.defined || priority %]
                                 <div id="bib_holds">
                                     [% IF holds_count.defined %]
-                                        <span>Total holds: [% holds_count %]</span>
+                                        <span>Total holds: [% holds_count | html %]</span>
                                     [% END %]
                                     [% IF priority %]
                                         [% IF holds_count.defined %]
-                                            <span>(priority [% priority %])</span>
+                                            <span>(priority [% priority | html %])</span>
                                         [% ELSE %]
-                                            <span>Overall queue priority: [% priority %]</span>
+                                            <span>Overall queue priority: [% priority | html %]</span>
                                         [% END %]
                                     [% END %]
                                 </div>
                         [% ELSE %]
                             [% IF ( ALTERNATEHOLDINGS ) %]
                                 [% FOREACH ALTERNATEHOLDING IN ALTERNATEHOLDINGS %]
-                                    <div id="alternateholdings"><span class="holdings_label">Holdings:</span> [% ALTERNATEHOLDING.holding %]</div>
+                                    <div id="alternateholdings"><span class="holdings_label">Holdings:</span> [% ALTERNATEHOLDING.holding | html %]</div>
                                 [% END %]
                             [% ELSE %]
                                 [% IF Koha.Preference('OPACAcquisitionDetails') and acquisition_details.total_quantity > 0 %]
                                   [% IF acquisition_details.total_quantity == 1 %]
                                     <span>1 item is on order.</span>
                                   [% ELSE %]
-                                    <span>[% acquisition_details.total_quantity %] items are on order.</span>
+                                    <span>[% acquisition_details.total_quantity | html %] items are on order.</span>
                                   [% END %]
                                 [% ELSE %]
                                     <div id="noitems">No physical items for this record</div>
 
                             [% IF ( SyndeticsEnabled && SyndeticsSummary && SYNDETICS_SUMMARY ) %]
                                 <h4>Enhanced descriptions from Syndetics:</h4>
-                                <p>[% SYNDETICS_SUMMARY %]</p>
+                                <p>[% SYNDETICS_SUMMARY | html %]</p>
                             [% END %]
 
                             [% IF ( MARCNOTES ) %]
                                 [% FOREACH MARCNOTE IN MARCNOTES %]
                                     <p>
                                     [% IF MARCNOTE.marcnote.match('^https?://\S+$') %]
-                                        <a href="[% MARCNOTE.marcnote %]">[% MARCNOTE.marcnote %]</a>
+                                        <a href="[% MARCNOTE.marcnote | html %]">[% MARCNOTE.marcnote | html %]</a>
                                     [% ELSE %]
-                                        [% MARCNOTE.marcnote FILTER html_line_break %]
+                                        [% MARCNOTE.marcnote FILTER html_line_break | html %]
                                     [% END %]
                                     </p>
                                 [% END %]
                                 </div>
                             [% ELSE %]
                                 [% IF ( notes ) %]
-                                    <p>[% notes %]</p>
+                                    <p>[% notes | html %]</p>
                                 [% END %]
                             [% END %]
 
                                     <h3>Table of contents provided by Syndetics</h3>
                                         <ul>
                                             [% FOREACH SYNDETICS_TO IN SYNDETICS_TOC %]
-                                                <li><b>[% SYNDETICS_TO.l %] [% SYNDETICS_TO.t %]</b>[% IF ( SYNDETICS_TO.p ) %] ([% SYNDETICS_TO.p %])[% END %]</li>
+                                                <li><b>[% SYNDETICS_TO.l | html %] [% SYNDETICS_TO.t | html %]</b>[% IF ( SYNDETICS_TO.p ) %] ([% SYNDETICS_TO.p | html %])[% END %]</li>
                                             [% END %]
                                         </ul>
                                 </div>
                             <div id="excerpt">
                                 <div class="content_set">
                                     <h3>Excerpt provided by Syndetics</h3>
-                                    [% SYNDETICS_EXCERPT %]
+                                    [% SYNDETICS_EXCERPT | html %]
                                 </div>
                             </div>
                         [% END # / IF SyndeticsExcerpt && SYNDETICS_EXCERPT %]
                                     <h3>Reviews provided by Syndetics</h3>
                                     [% FOREACH SYNDETICS_REVIEW IN SYNDETICS_REVIEWS %]
                                         [% IF ( SYNDETICS_REVIEW.title ) %]
-                                            <h4>[% SYNDETICS_REVIEW.title %]</h4>
+                                            <h4>[% SYNDETICS_REVIEW.title | html %]</h4>
                                                 [% FOREACH review IN SYNDETICS_REVIEW.reviews %]
 
                                                     [% IF ( review.content ) %]
-                                                        [% review.content %]
+                                                        [% review.content | html %]
                                                     [% END %]
 
                                                 [% END %]
                                     <h3>Author notes provided by Syndetics</h3>
                                     [% FOREACH SYNDETICS_ANOTE IN SYNDETICS_ANOTES %]
                                         [% IF ( SYNDETICS_ANOTE.content ) %]
-                                            [% SYNDETICS_ANOTE.content %]
+                                            [% SYNDETICS_ANOTE.content | html %]
                                         [% END %]
                                     [% END %]
                                 </div>
 
                     [% IF ( NovelistSelectProfile && NovelistSelectView == 'tab' && (normalized_isbn || normalized_upc) ) %]
                        <div id="NovelistSelect" >
-                            <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]></div>
+                            <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]></div>
                        </div>
                     [% END # / IF NovelistSelectProfile && NovelistSelectView == 'tab' %]
 
                     [% IF ( subscriptionsnumber ) %]
                         <div id="subscriptions">
                             <h2>This is a serial</h2>
-                            <p class="subscription_count">There are [% subscriptionsnumber %] subscription(s) associated with this title.</p>
+                            <p class="subscription_count">There are [% subscriptionsnumber | html %] subscription(s) associated with this title.</p>
                             [% FOREACH subscription IN subscriptions %]
                                 [% IF ( subscription.branchcode ) %]
-                                    <h3>At library: [% Branches.GetName( subscription.branchcode ) %]</h3>
+                                    <h3>At library: [% Branches.GetName( subscription.branchcode ) | html %]</h3>
                                 [% ELSE %]
                                     [% IF ( subscription.branchcode ) %]
-                                        <h3>At library: [% subscription.branchcode %]</h3>
+                                        <h3>At library: [% subscription.branchcode | html %]</h3>
                                     [% END %]
                                 [% END %]
                                 [% IF ( subscription.closed ) %]
                                     <p class="subscription_closed">This subscription is closed.</p>
                                 [% END %]
                                 [% IF ( subscription.callnumber ) %]
-                                  <p class="subscription_callnumber">Call number: [% subscription.callnumber %]</p>
+                                  <p class="subscription_callnumber">Call number: [% subscription.callnumber | html %]</p>
                                 [% END %]
                                 [% IF ( subscription.subscriptionnotes ) %]
-                                    <p class="subscription_notes">[% subscription.subscriptionnotes FILTER html_line_break %] </p>
+                                    <p class="subscription_notes">[% subscription.subscriptionnotes FILTER html_line_break | html %] </p>
                                 [% END %]
                                 <p class="subscription_dates">Subscription from: [% subscription.histstartdate | $KohaDates %] to:[% IF ( subscription.histenddate ) %] [% subscription.histenddate | $KohaDates %] [% ELSE %] now (current)[% END %]</p>
                                 [% IF ( subscription.letter ) %]<span class="email_notifications">
                                     [% IF ( loggedinusername ) %]
                                         [% IF ( subscription.hasalert ) %]
-                                            <span>You have subscribed to email notification on new issues. </span><a style="color:#000;" class="btn" title="Cancel email notification" href="/cgi-bin/koha/opac-alert-subscribe.pl?op=cancel&amp;subscriptionid=[% subscription.subscriptionid %]&amp;biblionumber=[% subscription.biblionumber %]">Cancel email notification</a>
+                                            <span>You have subscribed to email notification on new issues. </span><a style="color:#000;" class="btn" title="Cancel email notification" href="/cgi-bin/koha/opac-alert-subscribe.pl?op=cancel&amp;subscriptionid=[% subscription.subscriptionid | html %]&amp;biblionumber=[% subscription.biblionumber | html %]">Cancel email notification</a>
                                         [% ELSE %]
-                                            <a style="color:#000;" class="btn" title="Subscribe to email notification on new issues" href="/cgi-bin/koha/opac-alert-subscribe.pl?subscriptionid=[% subscription.subscriptionid %]&amp;biblionumber=[% subscription.biblionumber %]">Subscribe to email notification on new issues</a>
+                                            <a style="color:#000;" class="btn" title="Subscribe to email notification on new issues" href="/cgi-bin/koha/opac-alert-subscribe.pl?subscriptionid=[% subscription.subscriptionid | html %]&amp;biblionumber=[% subscription.biblionumber | html %]">Subscribe to email notification on new issues</a>
                                         [% END %]
                                     [% ELSE %]
                                         <span>You must log in if you want to subscribe to email notification on new issues</span>
                                     [% END %]
                                 </span>[% END %]
                                 [% IF ( subscription.missinglist ) %]
-                                    <p class="subscription_missing">Missing issues: [% subscription.missinglist %] </p>
+                                    <p class="subscription_missing">Missing issues: [% subscription.missinglist | html %] </p>
                                 [% END %]
                                 [% IF ( subscription.opacnote ) %]
-                                    <p class="subscription_opacnote">[% subscription.opacnote FILTER html_line_break %]</p>
+                                    <p class="subscription_opacnote">[% subscription.opacnote FILTER html_line_break | html %]</p>
                                 [% END %]
                                 [% IF ( subscription.latestserials ) %]
-                                    <p class="subscription_latestissues"> The [% subscription.opacdisplaycount %] latest issues for this subscription:</p>
+                                    <p class="subscription_latestissues"> The [% subscription.opacdisplaycount | html %] latest issues for this subscription:</p>
                                     <table class="table table-bordered table-striped" id="subscriptionst">
                                         <thead>
                                         <tr>
                                         <tbody>
                                         [% FOREACH latestserial IN subscription.latestserials %]
                                             <tr>
-                                                <td class="serialseq">[% latestserial.serialseq %]</td>
-                                                <td class="publisheddate">[% latestserial.publisheddate %]</td>
-                                                <td class="planneddate">[% latestserial.planneddate %]</td>
+                                                <td class="serialseq">[% latestserial.serialseq | html %]</td>
+                                                <td class="publisheddate">[% latestserial.publisheddate | html %]</td>
+                                                <td class="planneddate">[% latestserial.planneddate | html %]</td>
                                                 <td class="serial_status">
                                                     [% IF (latestserial.status1 ) %]<span>Expected</span>[% END %]
                                                     [% IF (latestserial.status2 ) %]<span>Arrived</span>[% END %]
                                                     [% IF (latestserial.status7 ) %]<span>Claimed</span>[% END %]
                                                     [% IF (latestserial.status8 ) %]<span>Stopped</span>[% END %]
                                                 </td>
-                                                <td class="serial_notes">[% latestserial.notes %]</td>
+                                                <td class="serial_notes">[% latestserial.notes | html %]</td>
                                             </tr>
                                         [% END # / FOREACH latestserials %]
                                         </tbody>
                                     </table>
                                 [% END # / IF subscription.latestserials %]
                             [% END # / FOREACH subscriptions %]
-                            <p class="subscription_moredetails"><a href="opac-serial-issues.pl?biblionumber=[% biblio.biblionumber %]">More details</a></p>
+                            <p class="subscription_moredetails"><a href="opac-serial-issues.pl?biblionumber=[% biblio.biblionumber | html %]">More details</a></p>
                         </div> <!-- / #subscriptions -->
                     [% END # IF subscriptionsnumber %]
 
                                 [% IF ( reviews ) %]
                                     [% FOREACH review IN reviews %]
                                         [% IF borrowernumber && review.borrowernumber == borrowernumber %]
-                                            <div class="commentline yours" id="c[% review.reviewid %]">
+                                            <div class="commentline yours" id="c[% review.reviewid | html %]">
                                                 [% IF ( review.avatarurl ) %]
-                                                    <img class="avatar" src="[% review.avatarurl %]" height="80" width="80" alt="" />
+                                                    <img class="avatar" src="[% review.avatarurl | html %]" height="80" width="80" alt="" />
                                                 [% END %]
                                                 [% IF review.approved %]
                                                     <h5>Your comment</h5>
                                                 <small>[% review.datereviewed | $KohaDates %]</small>
                                                 <p>
                                                     [% FILTER html_break %]
-                                                        [% review.review |html %]
+                                                        [% review.review | html %]
                                                     [% END %]
-                                                    <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% review.biblionumber %]&amp;reviewid=[% review.reviewid %]');">Edit</a>
+                                                    <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% review.biblionumber | html %]&amp;reviewid=[% review.reviewid | html %]');">Edit</a>
                                                 </p>
                                             </div>
                                         [% ELSE %]
                                                 [% IF ( ShowReviewer != "none" && review.patron) %]
 
                                                     [% IF ( review.avatarurl ) %]
-                                                        <img class="avatar" src="[% review.avatarurl %]" height="80" width="80" alt="" />
+                                                        <img class="avatar" src="[% review.avatarurl | html %]" height="80" width="80" alt="" />
                                                     [% END %]
                                                     [% SWITCH ShowReviewer %]
                                                     [% CASE 'full' %]
-                                                        <h5>Comment by [% review.patron.title %] [% review.patron.firstname %] [% review.patron.surname %]</h5>
+                                                        <h5>Comment by [% review.patron.title | html %] [% review.patron.firstname | html %] [% review.patron.surname | html %]</h5>
                                                     [% CASE 'first' %]
-                                                        <h5>Comment by [% review.patron.firstname %]</h5>
+                                                        <h5>Comment by [% review.patron.firstname | html %]</h5>
                                                     [% CASE 'surname' %]
-                                                        <h5>Comment by [% review.patron.surname %]</h5>
+                                                        <h5>Comment by [% review.patron.surname | html %]</h5>
                                                     [% CASE 'firstandinitial' %]
-                                                        <h5>Comment by [% review.patron.firstname %] [% review.patron.surname|truncate(2,'.') %]</h5>
+                                                        <h5>Comment by [% review.patron.firstname | html %] [% review.patron.surname|truncate(2,'.') | html %]</h5>
                                                     [% CASE 'username' %]
-                                                        <h5>Comment by [% review.patron.userid %]</h5>
+                                                        <h5>Comment by [% review.patron.userid | html %]</h5>
                                                     [% END %]
 
                                                     <small>[% review.datereviewed | $KohaDates %]</small>
                                                 [% END # / IF ShowReviewer != "none" && review.patron %]
                                                 <p>
                                                   [% FILTER html_break %]
-                                                  [% review.review |html %]
+                                                  [% review.review | html %]
                                                   [% END %]
                                                 </p>
                                             </div> <!-- / .commentline -->
 
                                 [% IF ( loggedinusername ) %]
                                     [% UNLESS ( loggedincommenter ) %]
-                                       <div id="addcomment"> <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% biblio.biblionumber %]'); return false;">
+                                       <div id="addcomment"> <a href="#" onclick="Dopop('/cgi-bin/koha/opac-review.pl?biblionumber=[% biblio.biblionumber | html %]'); return false;">
                                             Post your comments on this item.
                                         </a></div>
                                     [% END %]
                                         <tr>
                                             <td>
                                             [% IF ( OPACAmazonCoverImages ) %]
-                                                <img src="https://images-na.ssl-images-amazon.com/images/P/[% XISBN.normalized_isbn %].01._AA75_PU_PU-5_.jpg" alt="" />
+                                                <img src="https://images-na.ssl-images-amazon.com/images/P/[% XISBN.normalized_isbn | html %].01._AA75_PU_PU-5_.jpg" alt="" />
                                             [% END %]
 
                                             [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
                                                 [% IF ( XISBN.content_identifier_exists ) %]
-                                                    <img src="https://secure.syndetics.com/index.aspx?isbn=[% XISBN.browser_normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %][% IF ( XISBN.browser_normalized_upc ) %]&amp;upc=[% XISBN.browser_normalized_upc %][% END %][% IF ( XISBN.browser_normalized_oclc ) %]&amp;oclc=[% XISBN.browser_normalized_oclc %][% END %]&amp;type=xw10" alt="" />
+                                                    <img src="https://secure.syndetics.com/index.aspx?isbn=[% XISBN.browser_normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %][% IF ( XISBN.browser_normalized_upc ) %]&amp;upc=[% XISBN.browser_normalized_upc | html %][% END %][% IF ( XISBN.browser_normalized_oclc ) %]&amp;oclc=[% XISBN.browser_normalized_oclc | html %][% END %]&amp;type=xw10" alt="" />
                                                 [% ELSE %]
                                                     <span class="no-image">No cover image available</span>
                                                 [% END # / IF  XISBN.content_identifier_exists %]
                                             </td>
 
                                             [% UNLESS ( item_level_itypes ) %]
-                                                <td>[% XISBN.description %]</td>
+                                                <td>[% XISBN.description | html %]</td>
                                             [% END %]
-                                            <td><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% XISBN.biblionumber %]">[% XISBN.title |html %]</a>
-                                                [% IF ( XISBN.author ) %]<span> by </span>[% XISBN.author |html %][% END %]
-                                                [% IF ( XISBN.copyrightdate ) %]<span> &copy;</span>[% XISBN.copyrightdate %][% END %]
+                                            <td><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% XISBN.biblionumber | html %]">[% XISBN.title | html %]</a>
+                                                [% IF ( XISBN.author ) %]<span> by </span>[% XISBN.author | html %][% END %]
+                                                [% IF ( XISBN.copyrightdate ) %]<span> &copy;</span>[% XISBN.copyrightdate | html %][% END %]
                                                 [% IF ( XISBN.publishercode ) %]
-                                                    <p>[% XISBN.publishercode |html %]
-                                                        [% IF ( XISBN.place ) %]([% XISBN.place %])[% END %]
-                                                        [% IF ( XISBN.publicationyear ) %][% ', ' _ XISBN.publicationyear %][% END %]
-                                                        [% IF ( XISBN.pages ) %][% XISBN.pages %] [% XISBN.illus %] [% XISBN.size %][% END %]
+                                                    <p>[% XISBN.publishercode | html %]
+                                                        [% IF ( XISBN.place ) %]([% XISBN.place | html %])[% END %]
+                                                        [% IF ( XISBN.publicationyear ) %][% ', ' _ XISBN.publicationyear | html %][% END %]
+                                                        [% IF ( XISBN.pages ) %][% XISBN.pages | html %] [% XISBN.illus | html %] [% XISBN.size | html %][% END %]
                                                     </p>
                                                 [% END %]
                                             </td>
                               [% FOREACH HTML5MediaSet IN HTML5MediaSets %]
                                 <p>
                                   [% SET ctrl_preload = ' controls preload=none' #translatability %]
-                                  <[% HTML5MediaParent _ ctrl_preload %] >
-                                    <[% HTML5MediaSet.child _ ' src="' _  HTML5MediaSet.srcblock _'"' _ HTML5MediaSet.typeblock %] />
-                                    <span>[[% HTML5MediaParent %] tag not supported by your browser.]</span>
-                                  </[% HTML5MediaParent %]>
+                                  <[% HTML5MediaParent _ ctrl_preload | html %] >
+                                    <[% HTML5MediaSet.child _ ' src="' _  HTML5MediaSet.srcblock _'"' _ HTML5MediaSet.typeblock | html %] />
+                                    <span>[[% HTML5MediaParent | html %] tag not supported by your browser.]</span>
+                                  </[% HTML5MediaParent | html %]>
                                 </p>
                               [% END %]
                             </div>
                                 <p>Click on an image to view it in the image viewer</p>
                                 [% FOREACH image IN localimages %]
                                     [% IF image %]
-                                        <a class="localimage" href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblio.biblionumber %]&amp;imagenumber=[% image %]"><img alt="" src="/cgi-bin/koha/opac-image.pl?thumbnail=1&amp;imagenumber=[% image %]" /></a>
+                                        <a class="localimage" href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblio.biblionumber | html %]&amp;imagenumber=[% image | html %]"><img alt="" src="/cgi-bin/koha/opac-image.pl?thumbnail=1&amp;imagenumber=[% image | html %]" /></a>
                                     [% END %]
                                 [% END %]
                             </div><!-- / #images -->
                 [% IF ( NovelistSelectProfile && NovelistSelectView == 'below' && ( normalized_isbn || normalized_upc ) ) %]
                     <div id="NovelistSelect">
                         <h3>Novelist Select</h3>
-                        <div data-novelist-novelistselect="[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]"></div>
+                        <div data-novelist-novelistselect="[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]"></div>
                     </div>
                 [% END %]
 
                         <ul class="pg_menu clearfix">
                             <li class="left_results">
                                 [% IF ( previousBiblionumber ) %]
-                                    <a href="opac-detail.pl?biblionumber=[% previousBiblionumber %][% IF ( query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]" title="See: [% IF ( previousTitle ) %][% previousTitle |html %][% ELSE %]previous biblio[% END %]">&laquo; Previous</a>
+                                    <a href="opac-detail.pl?biblionumber=[% previousBiblionumber | html %][% IF ( query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]" title="See: [% IF ( previousTitle ) %][% previousTitle | html %][% ELSE %]previous biblio[% END %]">&laquo; Previous</a>
                                 [% ELSE %]
                                     <span>Previous</span>
                                 [% END %]
                             </li>
                             [%# busc is already URI encoded %]
-                            <li class="back_results"><a href="opac-search.pl?[% busc %]" title="Back to the results search list">Back to results</a></li>
+                            <li class="back_results"><a href="opac-search.pl?[% busc | html %]" title="Back to the results search list">Back to results</a></li>
                             <li class="right_results">
                                 [% IF ( nextBiblionumber ) %]
-                                    <a href="opac-detail.pl?biblionumber=[% nextBiblionumber %][% IF ( query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]" title="See: [% IF ( nextTitle ) %][% nextTitle |html %][% ELSE %]next biblio[% END %]">Next &raquo;</a>
+                                    <a href="opac-detail.pl?biblionumber=[% nextBiblionumber | html %][% IF ( query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]" title="See: [% IF ( nextTitle ) %][% nextTitle | html %][% ELSE %]next biblio[% END %]">Next &raquo;</a>
                                 [% ELSE %]
                                     <span>Next</span>
                                 [% END %]
                 [% IF ( NovelistSelectProfile && NovelistSelectView == 'right' && ( normalized_isbn || normalized_upc ) ) %]
                     <div id="NovelistSelect">
                         <h4>Novelist Select</h4>
-                        <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]></div>
+                        <div data-novelist-novelistselect=[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]></div>
                     </div>
                 [% END %]
 
                         <div><a id="linkedin" href="http://www.linkedin.com/shareArticle?mini=true&amp;url=[% current_url |url %]&amp;title=[% title |url %]" title="Share on LinkedIn">LinkedIn</a></div>
                         <div><a id="email" href="mailto:?subject=[% title |url %]&amp;body=[% title |url %]%20([% current_url |url %])" title="Share by email">Email</a></div>
                         <div><div class="g-plusone" data-size="small" data-count="false"></div></div>
-                        <div><a id="twitter" href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-text="[% title |url %]" data-lang="[% lang %]">Tweet</a></div>
+                        <div><a id="twitter" href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-text="[% title |url %]" data-lang="[% lang | html %]">Tweet</a></div>
                     </div>
                 [% END %]
             </div> <!-- / .ulactioncontainer -->
     </div> <!-- / .row-fluid -->
     <div class="row-fluid">
         [% IF ( LibraryThingForLibrariesID ) %]
-            <script src="https://ltfl.librarything.com/forlibraries/widget.js?systype=koha&amp;id=[% LibraryThingForLibrariesID %]"></script>
+            <script src="https://ltfl.librarything.com/forlibraries/widget.js?systype=koha&amp;id=[% LibraryThingForLibrariesID | html %]"></script>
             <noscript>This page contains enriched content visible when JavaScript is enabled or by clicking
-            <a href="https://www.librarything.com/forlibraries/noscript.php?id=[% LibraryThingForLibrariesID %]&amp;accessibility=1">here</a>.</noscript>
+            <a href="https://www.librarything.com/forlibraries/noscript.php?id=[% LibraryThingForLibrariesID | html %]&amp;accessibility=1">here</a>.</noscript>
         [% END %]
 
         [% IF ( NovelistSelectProfile && ( normalized_isbn || normalized_upc ) ) %]
         [% END %]
 
         [% IF ( Babeltheque ) %]
-            <script src="[% Babeltheque_url_js %]"></script>
+            <script src="[% Babeltheque_url_js | html %]"></script>
         [% END %]
     </div> <!-- / .row-fluid -->
 </div> <!-- / .container-fluid -->
 [%# End of template %]
 
 [% BLOCK items_table %]
-    <table class="table table-bordered table-striped" id="[% table_id %]">
+    <table class="table table-bordered table-striped" id="[% table_id | html %]">
         <thead>
             <tr>
         [% IF ( item_level_itypes ) %]
                         <td class="itype">
                             [% UNLESS ( noItemTypeImages ) %]
                                 [% IF ( ITEM_RESULT.imageurl ) %]
-                                    <img src="[% ITEM_RESULT.imageurl %]" title="[% ITEM_RESULT.description %]" alt="[% ITEM_RESULT.description %]" />
+                                    <img src="[% ITEM_RESULT.imageurl | html %]" title="[% ITEM_RESULT.description | html %]" alt="[% ITEM_RESULT.description | html %]" />
                                 [% END %]
                             [% END %]
-                            [% ITEM_RESULT.description %]
+                            [% ITEM_RESULT.description | html %]
                         </td>
                     [% END %]
                     [% IF ( OpacLocationBranchToDisplay == 'holding' || OpacLocationBranchToDisplay == 'both' ) %]
                             <link property="businessFunction" href="http://purl.org/goodrelations/v1#LeaseOut">
                             <span class="[% ITEM_RESULT.holding_branch_opac_info ? 'branch-info-tooltip-trigger' : '' %]" title="">
                                 [% IF ( ITEM_RESULT.branchurl ) %]
-                                    <a href="[% ITEM_RESULT.branchurl %]">[% ITEM_RESULT.branchname %]</a>
+                                    <a href="[% ITEM_RESULT.branchurl | html %]">[% ITEM_RESULT.branchname | html %]</a>
                                 [% ELSE %]
-                                    <span>[% ITEM_RESULT.branchname %]</span>
+                                    <span>[% ITEM_RESULT.branchname | html %]</span>
                                 [% END %]
                             </span>
-                            <div class="branch-info-tooltip">[% ITEM_RESULT.holding_branch_opac_info %]</div>
+                            <div class="branch-info-tooltip">[% ITEM_RESULT.holding_branch_opac_info | $raw %]</div>
 
                             [% IF ( Koha.Preference('OpacLocationOnDetail') == 'holding' || Koha.Preference('OpacLocationOnDetail') == 'both' ) %]
-                                <span class="shelvingloc">[% ITEM_RESULT.location_description %]</span>
+                                <span class="shelvingloc">[% ITEM_RESULT.location_description | html %]</span>
                             [% END %]
 
                         </td>
                             <link property="businessFunction" href="http://purl.org/goodrelations/v1#LeaseOut">
                             <span class="[% ITEM_RESULT.home_branch_opac_info ? 'branch-info-tooltip-trigger' : '' %]" title="">
                                 [% IF Branches.GetURL( ITEM_RESULT.homebranch ) %]
-                                    [% home_branch_url = Branches.GetURL( ITEM_RESULT.homebranch ) %]
+                                    [% home_branch_url = Branches.GetURL( ITEM_RESULT.homebranch ) | html %]
                                     [% IF ( home_branch_url ) %]
-                                         <a href="[% home_branch_url %]">[% Branches.GetName( ITEM_RESULT.homebranch ) %]</a>
+                                         <a href="[% home_branch_url | html %]">[% Branches.GetName( ITEM_RESULT.homebranch ) | html %]</a>
                                     [% ELSE %]
-                                        <span>[% Branches.GetName( ITEM_RESULT.homebranch ) %]</span>
+                                        <span>[% Branches.GetName( ITEM_RESULT.homebranch ) | html %]</span>
                                     [% END %]
                                 [% ELSE %]
-                                    <span>[% Branches.GetName( ITEM_RESULT.homebranch ) %]</span>
+                                    <span>[% Branches.GetName( ITEM_RESULT.homebranch ) | html %]</span>
                                 [% END %]
                             </span>
-                            <div class="branch-info-tooltip">[% ITEM_RESULT.home_branch_opac_info %]</div>
+                            <div class="branch-info-tooltip">[% ITEM_RESULT.home_branch_opac_info | $raw %]</div>
 
                             [% IF ( Koha.Preference('OpacLocationOnDetail') == 'home' || Koha.Preference('OpacLocationOnDetail') == 'both' ) %]
-                                <span class="shelvingloc">[% ITEM_RESULT.location_description %]</span>
+                                <span class="shelvingloc">[% ITEM_RESULT.location_description | html %]</span>
                             [% END %]
 
                         </td>
                     [% END %]
 
                     [% IF ( itemdata_ccode ) %]
-                        <td class="collection">[% ITEM_RESULT.ccode %]</td>
+                        <td class="collection">[% ITEM_RESULT.ccode | html %]</td>
                     [% END %]
 
                     [% IF ( Koha.Preference('OpacLocationOnDetail') == 'column' && itemdata_location ) %]
-                        <td class="shelving_location">[% ITEM_RESULT.location_description %]</td>
+                        <td class="shelving_location">[% ITEM_RESULT.location_description | html %]</td>
                     [% END %]
 
                     <td class="call_no" property="sku">
                         [% IF ( ITEM_RESULT.itemcallnumber ) %]
-                            [% ITEM_RESULT.itemcallnumber %]
+                            [% ITEM_RESULT.itemcallnumber | html %]
                             [% IF ( OPACShelfBrowser ) %]
                                 [% IF ( ITEM_RESULT.itemnumber == starting_itemnumber ) %]
-                                    (<a class="close_shelf" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ITEM_RESULT.biblionumber %]&amp;shelfbrowse_itemnumber=[% ITEM_RESULT.itemnumber %]#[% tab %]">Browse shelf</a>)
+                                    (<a class="close_shelf" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ITEM_RESULT.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% ITEM_RESULT.itemnumber | html %]#[% tab | html %]">Browse shelf</a>)
                                 [% ELSE %]
-                                    (<a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ITEM_RESULT.biblionumber %]&amp;shelfbrowse_itemnumber=[% ITEM_RESULT.itemnumber %]#[% tab %]">Browse shelf</a>)
+                                    (<a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ITEM_RESULT.biblionumber | html %]&amp;shelfbrowse_itemnumber=[% ITEM_RESULT.itemnumber | html %]#[% tab | html %]">Browse shelf</a>)
                                 [% END %]
                             [% END %]
                         [% END %]
                     [% IF ( itemdata_enumchron ) %]
                         <td class="vol_info">
                             [% IF ITEM_RESULT.enumchron && ITEM_RESULT.serialseq %]
-                                <span class="enum">[% ITEM_RESULT.enumchron %]</span>
+                                <span class="enum">[% ITEM_RESULT.enumchron | html %]</span>
                                 [% IF ( ITEM_RESULT.serialseq && ITEM_RESULT.enumchron!=ITEM_RESULT.serialseq ) %]
                                     <span class="sep"> -- </span>
                                     <span class="serialseq">[% ITEM_RESULT.serialseq | html %]</span>
                             [% IF ITEM_RESULT.uri %]
                                 [% IF trackclicks == 'track' || trackclicks == 'anonymous' %]
                                     [% IF Koha.Preference("OPACURLOpenInNewWindow") %]
-                                    <a target="_blank" rel="noreferrer" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | uri %]&amp;biblionumber=[% biblio.biblionumber %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
+                                    <a target="_blank" rel="noreferrer" href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | uri %]&amp;biblionumber=[% biblio.biblionumber | html %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
                                     [% ELSE %]
-                                    <a href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | uri %]&amp;biblionumber=[% biblio.biblionumber %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
+                                    <a href="/cgi-bin/koha/tracklinks.pl?uri=[% ITEM_RESULT.uri | uri %]&amp;biblionumber=[% biblio.biblionumber | html %]&amp;itemnumber=[% ITEM_RESULT.itemnumber | url %]" property="url"> Link to resource </a>
                                     [% END %]
 
                                 [% ELSE %]
                                     [% IF Koha.Preference("OPACURLOpenInNewWindow") %]
-                                    <a target="_blank" rel="noreferrer" href="[% ITEM_RESULT.uri %]" property="url">[% ITEM_RESULT.uri %]</a>
+                                    <a target="_blank" rel="noreferrer" href="[% ITEM_RESULT.uri | html %]" property="url">[% ITEM_RESULT.uri | html %]</a>
                                     [% ELSE %]
-                                    <a href="[% ITEM_RESULT.uri %]" property="url">[% ITEM_RESULT.uri %]</a>
+                                    <a href="[% ITEM_RESULT.uri | html %]" property="url">[% ITEM_RESULT.uri | html %]</a>
                                     [% END %]
                                 [% END %]
                             [% END %]
                         </td>
                     [% END %]
-                    [% IF ( itemdata_copynumber ) %]<td class="copynumber">[% ITEM_RESULT.copynumber %]</td>[% END %]
+                    [% IF ( itemdata_copynumber ) %]<td class="copynumber">[% ITEM_RESULT.copynumber | html %]</td>[% END %]
                     <td class="status">[% INCLUDE 'item-status-schema-org.inc' item = ITEM_RESULT %][% INCLUDE 'item-status.inc' item = ITEM_RESULT %]</td>
-                    [% IF ( itemdata_itemnotes ) %]<td class="notes" property="description">[% ITEM_RESULT.itemnotes %]</td>[% END %]
-                    <td class="date_due"><span title="[% ITEM_RESULT.datedue %]">[% ITEM_RESULT.datedue | $KohaDates as_due_date => 1 %]</span></td>
-                        <td class="barcode" property="serialNumber">[% ITEM_RESULT.barcode %]</td>
+                    [% IF ( itemdata_itemnotes ) %]<td class="notes" property="description">[% ITEM_RESULT.itemnotes | html %]</td>[% END %]
+                    <td class="date_due"><span title="[% ITEM_RESULT.datedue | html %]">[% ITEM_RESULT.datedue | $KohaDates as_due_date => 1 | html %]</span></td>
+                        <td class="barcode" property="serialNumber">[% ITEM_RESULT.barcode | html %]</td>
                     [% IF holds_count.defined || show_priority %]
                         <td class="holds_count">
-                            [% IF holds_count.defined %] [% ITEM_RESULT.holds_count %] [% END %]
+                            [% IF holds_count.defined %] [% ITEM_RESULT.holds_count | html %] [% END %]
                             [% IF ITEM_RESULT.priority %]
                                 [% IF holds_count.defined %]
-                                    <span>(priority [% ITEM_RESULT.priority %])</span>
+                                    <span>(priority [% ITEM_RESULT.priority | html %])</span>
                                 [% ELSE %]
-                                    <span>[% ITEM_RESULT.priority %]</span>
+                                    <span>[% ITEM_RESULT.priority | html %]</span>
                                 [% END %]
                             [% END %]
                         </td>
                                 [% FOREACH r IN ITEM_RESULT.course_reserves %]
                                     [% IF r.course.enabled == 'yes' %]
                                         <p>
-                                            <a href="opac-course-details.pl?course_id=[% r.course.course_id %]">
-                                            [% r.course.course_name %]
-                                            <!--[% IF r.course.course_number %] [% r.course.course_number %] [% END %]-->
-                                            [% IF r.course.section %] [% r.course.section %] [% END %]
-                                            [% IF r.course.term %] [% AuthorisedValues.GetByCode( 'TERM', r.course.term ) %] [% END %]
+                                            <a href="opac-course-details.pl?course_id=[% r.course.course_id | html %]">
+                                            [% r.course.course_name | html %]
+                                            <!--[% IF r.course.course_number %] [% r.course.course_number | html %] [% END %]-->
+                                            [% IF r.course.section %] [% r.course.section | html %] [% END %]
+                                            [% IF r.course.term %] [% AuthorisedValues.GetByCode( 'TERM', r.course.term ) | html %] [% END %]
                                             </a>
                                         </p>
                                     [% END %]
 [% IF ( SocialNetworks ) %]
     <script src="https://apis.google.com/js/plusone.js"></script>
     //<![CDATA[
-      {lang: '[% lang %]'}
+      {lang: '[% lang | html %]'}
     //]]>
     </script>
     <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script>
 [% END %]
-[% IF ( OpacStarRatings != 'disable' ) %][% Asset.js("lib/jquery/plugins/jquery.rating.js") %][% END %]
+[% IF ( OpacStarRatings != 'disable' ) %][% Asset.js("lib/jquery/plugins/jquery.rating.js") | $raw %][% END %]
 
-[% IF ( OpacHighlightedWords ) %][% Asset.js("lib/jquery/plugins/jquery.highlight-3.js") %][% END %]
+[% IF ( OpacHighlightedWords ) %][% Asset.js("lib/jquery/plugins/jquery.highlight-3.js").raw %][% END %]
 
 <script>
 //<![CDATA[
 
     [% IF ( OpacBrowseResults && busc ) %]
         var arrPagination = new Array();
-        var pag_index_ini = [% indexPag %];
+        var pag_index_ini = [% indexPag | html %];
         [% IF ( listResults ) %]
             [% FOREACH listResult IN listResults %]
-                arrPagination[[% listResult.index %]] = {
-                    url:"[% listResult.url %][% IF ( listResult.url && query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]",
-                    title:"[% listResult.title|remove('\n')|html %]",
-                    author:"[% listResult.author|html %]",
-                    biblionumber:[% listResult.biblionumber %]
+                arrPagination[[% listResult.index | html %]] = {
+                    url:"[% listResult.url | html %][% IF ( listResult.url && query_desc && OpacHighlightedWords ) %]&query_desc=[% query_desc |uri %][% END %]",
+                    title:"[% listResult.title|remove('\n') | html %]",
+                    author:"[% listResult.author | html %]",
+                    biblionumber:[% listResult.biblionumber | html %]
                 };
            [% END %]
         [% END %]
                 if ( q_array[x].length > 0 ) {
                     q_array[x] = q_array[x].replace(/\w*:([\w])/, "$1");
                     q_array[x] = q_array[x].toLowerCase();
-                    var myStopwords = "[% Koha.Preference('NotHighlightedWords') %]".toLowerCase().split('|');
+                    var myStopwords = "[% Koha.Preference('NotHighlightedWords') | html %]".toLowerCase().split('|');
                     if( $.inArray(q_array[x], myStopwords) == -1 ) {
                         $(".title").highlight(q_array[x]);
                         $(".author").highlight(q_array[x]);
             }
         });
 
-        var columns_settings = [% ColumnsSettings.GetColumns( 'opac', 'biblio-detail', 'holdingst', 'json' ) %];
+        var columns_settings = [% ColumnsSettings.GetColumns( 'opac', 'biblio-detail', 'holdingst', 'json' ).raw %];
 
         KohaTable("#holdingst", {
             dom: '<"clearfix">t',
             "bKohaColumnsUseNames": true
         }, columns_settings);
 
-        var serial_column_settings = [% ColumnsSettings.GetColumns( 'opac', 'biblio-detail', 'subscriptionst', 'json' ) %];
+        var serial_column_settings = [% ColumnsSettings.GetColumns( 'opac', 'biblio-detail', 'subscriptionst', 'json' ).raw %];
 
         KohaTable("#subscriptionst", {
             dom: '<"clearfix">t',
             var default_order_index = 0;
         [% END %]
 
-        [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
+        [% IF ( query_desc ) %][% IF ( OpacHighlightedWords ) %]var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
             q_array = query_desc.split(" ");
             q_array = q_array.filter(function(n){ return n }); // Remove empty strings
             highlightOn();
             $("#highlight_toggle_on" ).hide().click(function() {highlightOn() ; return false;});
             $("#highlight_toggle_off").show().click(function() {highlightOff(); return false;});[% END %][% END %]
     [% IF ( GoogleJackets ) %]
-        KOHA.Google.GetCoverFromIsbn([% covernewwindow %]);
+        KOHA.Google.GetCoverFromIsbn([% covernewwindow | html %]);
     [% END %]
     [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-        KOHA.coce.getURL('[% Koha.Preference('CoceHost') %]', '[% Koha.Preference('CoceProviders') %]',[% covernewwindow %]);
+        KOHA.coce.getURL('[% Koha.Preference('CoceHost') | html %]', '[% Koha.Preference('CoceProviders') | html %]',[% covernewwindow | html %]);
     [% END %]
 
     [% IF OpenLibraryCovers %]
     [% IF ( NovelistSelectProfile && ( normalized_isbn || normalized_upc ) ) %]
         novSelect.loadContentForQuery(
             {
-                ClientIdentifier : '[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]',
-                ISBN : '[% IF normalized_isbn %][% normalized_isbn %][% ELSE %][% normalized_upc %][% END %]',
+                ClientIdentifier : '[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]',
+                ISBN : '[% IF normalized_isbn %][% normalized_isbn | html %][% ELSE %][% normalized_upc | html %][% END %]',
                 version : '2.1'
             },
-            '[% NovelistSelectProfile %]',
-            '[% NovelistSelectPassword %]',
+            '[% NovelistSelectProfile | html %]',
+            '[% NovelistSelectPassword | html %]',
             function(d){
                 if ( d.length > 0 ){ //If no content
                     $(".NovelistSelect").show();
     [% END %]
 
     [% IF ( OpacBrowseResults && busc ) %]
-        var list_title_showmsg = _("Show pagination list (%s-%s / %s)").format([% indexPag %], [% indexPagEnd %], [% totalPag %]);
-        var list_title_hidemsg = _("Hide pagination list (%s-%s / %s)").format([% indexPag %], [% indexPagEnd %], [% totalPag %]);
+        var list_title_showmsg = _("Show pagination list (%s-%s / %s)").format([% indexPag | html %], [% indexPagEnd | html %], [% totalPag | html %]);
+        var list_title_hidemsg = _("Hide pagination list (%s-%s / %s)").format([% indexPag | html %], [% indexPagEnd | html %], [% totalPag | html %]);
         if (arrPagination.length > 0) {
             renderPagIndexList(pag_index_ini, $("#listResults"));
             var reslist = $("#a_listResults");
                 success: function(data){
                     $("#shelfbrowser").replaceWith(data);
                     [% IF ( GoogleJackets ) %]
-                      KOHA.Google.GetCoverFromIsbn([% covernewwindow %]);
+                      KOHA.Google.GetCoverFromIsbn([% covernewwindow | html %]);
                     [% END %]
                     [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                      KOHA.coce.getURL('[% Koha.Preference('CoceHost') %]', '[% Koha.Preference('CoceProviders') %]',[% covernewwindow %]);
+                      KOHA.coce.getURL('[% Koha.Preference('CoceHost') | html %]', '[% Koha.Preference('CoceProviders') | html %]',[% covernewwindow | html %]);
                     [% END %]
                     [% IF OpenLibraryCovers %]
                       KOHA.OpenLibrary.GetCoverFromIsbn();
                 success: function(data){
                     $("#shelfbrowser").replaceWith(data);
                     [% IF ( GoogleJackets ) %]
-                      KOHA.Google.GetCoverFromIsbn([% covernewwindow %]);
+                      KOHA.Google.GetCoverFromIsbn([% covernewwindow | html %]);
                     [% END %]
                     [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                      KOHA.coce.getURL('[% Koha.Preference('CoceHost') %]', '[% Koha.Preference('CoceProviders') %]',[% covernewwindow %]);
+                      KOHA.coce.getURL('[% Koha.Preference('CoceHost') | html %]', '[% Koha.Preference('CoceProviders') | html %]',[% covernewwindow | html %]);
                     [% END %]
                     [% IF OpenLibraryCovers %]
                       KOHA.OpenLibrary.GetCoverFromIsbn();
 
               $.post("/cgi-bin/koha/opac-ratings-ajax.pl", {
                 rating_old_value: $("#rating_value").attr("value"),
-                borrowernumber: "[% borrowernumber %]",
-                biblionumber: "[% biblio.biblionumber %]",
+                borrowernumber: "[% borrowernumber | html %]",
+                biblionumber: "[% biblio.biblionumber | html %]",
                 rating_value: value,
                 auth_error: value
               }, function (data) {
index 5cc5c4c..92479ac 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Discharge</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Discharge</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -24,7 +24,7 @@
                 <div id="discharge" class="maincontainer">
                     <h1>Discharge</h1>
                     [% FOR message IN messages %]
-                        <div class="dialog [% message.type %]">
+                        <div class="dialog [% message.type | html %]">
                         [% IF message.code == "unable_to_generate_pdf" %]
                             An error occurs when generating the pdf file.
                             Please contact the staff to resolve this problem.
index f7eebd8..89091e1 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Download cart</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Download cart</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -18,7 +18,7 @@
                                 <option value="isbd">ISBD</option>
                                 <option value="iso2709">MARC</option>
                                 [% FOREACH csv_profile IN csv_profiles %]
-                                    <option value="[% csv_profile.export_format_id %]">CSV - [% csv_profile.profile %]</option>
+                                    <option value="[% csv_profile.export_format_id | html %]">CSV - [% csv_profile.profile | html %]</option>
                                 [% END %]
                             </select>
                             <fieldset class="action">
index e47844e..cfeae25 100644 (file)
@@ -1,7 +1,7 @@
 [% USE Koha %]
 [% IF ( fullpage ) %]
     [% INCLUDE 'doc-head-open.inc' %]
-    <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Download list [% shelf.shelfname | html %]</title>[% INCLUDE 'doc-head-close.inc' %]
+    <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Download list [% shelf.shelfname | html %]</title>[% INCLUDE 'doc-head-close.inc' %]
     [% BLOCK cssinclude %][% END %]
     </head>
     [% INCLUDE 'bodytag.inc' bodyid='opac-downloadlist' %]
@@ -57,7 +57,7 @@
                                             <option value="isbd">ISBD</option>
                                             <option value="iso2709">MARC</option>
                                             [% FOREACH csv_profile IN csv_profiles %]
-                                            <option value="[% csv_profile.export_format_id |html %]">CSV - [% csv_profile.profile |html %]</option>
+                                            <option value="[% csv_profile.export_format_id | html %]">CSV - [% csv_profile.profile | html %]</option>
                                             [% END %]
                                         </select>
                                         <span class="required">Required</span>
index ea2ef17..b034c8f 100644 (file)
@@ -2,7 +2,7 @@
 [% USE KohaDates %]
 [% USE Branches %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Full subscription history for [% bibliotitle %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Full subscription history for [% bibliotitle | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>
@@ -16,7 +16,7 @@
     <div class="main">
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle %]</a> <span class="divider">&rsaquo;</span></li>
+            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle | html %]</a> <span class="divider">&rsaquo;</span></li>
             <li><a href="#">Full subscription history</a></li>
         </ul>
 
@@ -46,7 +46,7 @@
                 <div class="span10">
                     <div id="fullserialissues" class="maincontent">
                         [% UNLESS ( popup ) %]
-                            <h2>Full subscription history for [% bibliotitle %]</h2>
+                            <h2>Full subscription history for [% bibliotitle | html %]</h2>
                             <div id="views">
                                 <span class="view"><a id="Normalview" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Normal view</a></span>
                                 <span class="view"><a id="Briefhistory" href="/cgi-bin/koha/opac-serial-issues.pl?biblionumber=[% biblionumber | html %]&amp;selectview=small">Brief history</a></span>
                             <strong>Show year: </strong>
                             [% FOREACH year IN years %]
                                 [% IF ( year.year ) %]
-                                    <a class="tabsubs" href="#" onclick="showlayer([% year.year %]); return false;">[% year.year %]</a>
+                                    <a class="tabsubs" href="#" onclick="showlayer([% year.year | html %]); return false;">[% year.year | html %]</a>
                                 [% END %]
                             [% END %]
                         </div>
 
                         [% FOREACH year IN years %]
                             [% IF loop.first %]
-                                <div class="yeardata tabsub" id="show[% year.year %]" style="display:block">
+                                <div class="yeardata tabsub" id="show[% year.year | html %]" style="display:block">
                             [% ELSE %]
-                                <div class="yeardata tabsub" id="show[% year.year %]" style="display:none">
+                                <div class="yeardata tabsub" id="show[% year.year | html %]" style="display:none">
                             [% END %]
                                 <table class="subscriptionstclass table table-bordered table-striped">
                                     <thead>
@@ -86,9 +86,9 @@
                                             <tr>
                                                 <td>
                                                     [% IF ( serial.publisheddate ) %]
-                                                        <span title="[% serial.publisheddate %]">
+                                                        <span title="[% serial.publisheddate | html %]">
                                                             [% IF serial.publisheddatetext %]
-                                                                [% serial.publisheddatetext %]
+                                                                [% serial.publisheddatetext | html %]
                                                             [% ELSE %]
                                                                 [% serial.publisheddate | $KohaDates %]
                                                             [% END %]
                                                         &nbsp;
                                                     [% END %]
                                                 </td>
-                                                <td class="libraryfilterclass">[% Branches.GetName( serial.branchcode ) %]</td>
-                                                <td>[% serial.notes %]</td>
+                                                <td class="libraryfilterclass">[% Branches.GetName( serial.branchcode ) | html %]</td>
+                                                <td>[% serial.notes | html %]</td>
                                                 <td>
                                                     [% IF ( serial.status2 && serial.planneddate ) %]
-                                                        <span title="[% serial.planneddate %]">[% serial.planneddate | $KohaDates %]</span>
+                                                        <span title="[% serial.planneddate | html %]">[% serial.planneddate | $KohaDates %]</span>
                                                     [% ELSE %]
                                                         <span title="9999-12-31">&nbsp;</span>
                                                     [% END %]
                                                 </td>
-                                                <td>[% serial.serialseq %]</td>
+                                                <td>[% serial.serialseq | html %]</td>
                                                 <td>
                                                     [% IF ( serial.status1 ) %]Expected[% END %]
                                                     [% IF ( serial.status2 ) %]Arrived[% END %]
                                                     [% IF ( serial.status7 ) %]Claimed[% END %]
                                                     [% IF ( serial.status8 ) %]Stopped[% END %]
                                                 </td>
-                                                <td class="subscriptionidfilterclass">[% serial.subscriptionid %]</td>
+                                                <td class="subscriptionidfilterclass">[% serial.subscriptionid | html %]</td>
                                             </tr>
                                         [% END %]
                                     </tbody>
 <script>
     //<![CDATA[
         $(document).ready(function(){
-            showlayer([% yearmin %]);
+            showlayer([% yearmin | html %]);
             $("a.tabsubs:first").addClass("currentsubtab");
             $("#filterform").submit(function(){
                 filterByLibrary();
index 67518ca..8ba6fc7 100644 (file)
@@ -1,9 +1,9 @@
 [%# First line will be summary, second line will be description. Avoid indenting. Var newline added to avoid translating problems. -%]
-[%- newline="\n" -%]
+[%- newline="\n" | html -%]
 [%- IF overdue == 1 -%]
-[% title %] is overdue
-[%- newline -%]Your copy of [% title %] (barcode [% barcode %]) is overdue
+[% title | html %] is overdue
+[%- newline | html -%]Your copy of [% title | html %] (barcode [% barcode | html %]) is overdue
 [%- ELSE -%]
-[% title %] is due
-[%- newline -%]Your copy of [% title %] (barcode [% barcode %]) is due back at the library today
+[% title | html %] is due
+[%- newline | html -%]Your copy of [% title | html %] (barcode [% barcode | html %]) is due back at the library today
 [%- END -%]
index 0c8b158..cf38cb7 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search IDREF for ppn [% unimarc3 %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search IDREF for ppn [% unimarc3 | html %]</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
@@ -23,7 +23,7 @@
   [% ELSE %]
     [% FOREACH role IN content %]
       <div>
-        <h2 class="role" title="Click to expand this role">[% role.role_name %] ([% role.count %])</h2>
+        <h2 class="role" title="Click to expand this role">[% role.role_name | html %] ([% role.count | html %])</h2>
           <div class="docs">
             <table>
               <thead>
@@ -36,9 +36,9 @@
               <tbody>
                 [% FOREACH doc IN role.docs %]
                   <tr>
-                    <td>[% doc.citation %]</td>
-                    <td><a href="/cgi-bin/koha/opac-search.pl?q=ident:[% doc.ppn %]" target="_blank">Koha</a></td>
-                    <td><a href="http://www.sudoc.fr/[% doc.ppn %]" target="_blank" rel="noreferrer">Sudoc</a></td>
+                    <td>[% doc.citation | html %]</td>
+                    <td><a href="/cgi-bin/koha/opac-search.pl?q=ident:[% doc.ppn | html %]" target="_blank">Koha</a></td>
+                    <td><a href="http://www.sudoc.fr/[% doc.ppn | html %]" target="_blank" rel="noreferrer">Sudoc</a></td>
                   </tr>
                 [% END %]
               </tbody>
index 2ad7d56..838f827 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE Branches %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;   Your Interlibrary loan requests</title>[% INCLUDE 'doc-head-close.inc' %]
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;   Your Interlibrary loan requests</title>[% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='opac-illrequests' bodyclass='scrollto' %]
@@ -58,9 +59,9 @@
                         [% INCLUDE messages %]
                         <div>
                             <p>
-                                [% Koha.Preference('ILLModuleCopyrightClearance') %]
+                                [% Koha.Preference('ILLModuleCopyrightClearance') | $raw %]
                             </p>
-                            <a href="?method=create&stage=copyrightclearance&backend=[% whole.value.backend %]"
+                            <a href="?method=create&stage=copyrightclearance&backend=[% whole.value.backend | html %]"
                                class="btn btn-sm btn-default"><i class="fa fa-check"></i> Yes</a>
                             <a href="/cgi-bin/koha/opac-illrequests.pl"
                                class="btn btn-sm btn-default"><i class="fa fa-times"></i> No</a>
@@ -73,7 +74,7 @@
                                     <label for="backend">Provider:</label>
                                     <select name="backend">
                                         [% FOREACH backend IN backends %]
-                                            <option value="[% backend %]">[% backend %]</option>
+                                            <option value="[% backend | html %]">[% backend | html %]</option>
                                         [% END %]
                                     </select>
                                 </fieldset>
                                 </button>
                                 <ul id="backend-dropdown-options" class="dropdown-menu nojs" aria-labelledby="ill-backend-dropdown">
                                     [% FOREACH backend IN backends %]
-                                        <li><a href="/cgi-bin/koha/opac-illrequests.pl?method=create&amp;backend=[% backend %]">[% backend %]</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-illrequests.pl?method=create&amp;backend=[% backend | html %]">[% backend | html %]</a></li>
                                     [% END %]
                                 </ul>
                         [% ELSE %]
-                            <a id="ill-new" class="btn btn-default" href="/cgi-bin/koha/opac-illrequests.pl?method=create&amp;backend=[% backends.0 %]">
+                            <a id="ill-new" class="btn btn-default" href="/cgi-bin/koha/opac-illrequests.pl?method=create&amp;backend=[% backends.0 | html %]">
                                 <i class="fa fa-plus"></i> Create a new request
                             </a>
                         [% END %]
                         </thead>
                         <tbody>
                             [% FOREACH request IN requests %]
-                                [% status = request.status %]
+                                [% status = request.status | html %]
                                 <tr>
-                                    <td>[% request.metadata.Author || 'N/A' %]</td>
-                                    <td>[% request.metadata.Title || 'N/A' %]</td>
-                                    <td>[% request.backend %]</td>
-                                    <td>[% request.medium %]</td>
-                                    <td>[% request.capabilities.$status.name %]</td>
-                                    <td>[% request.placed %]</td>
-                                    <td>[% request.updated %]</td>
+                                    <td>[% request.metadata.Author || 'N/A' | html %]</td>
+                                    <td>[% request.metadata.Title || 'N/A' | html %]</td>
+                                    <td>[% request.backend | html %]</td>
+                                    <td>[% request.medium | html %]</td>
+                                    <td>[% request.capabilities.$status.name | html %]</td>
+                                    <td>[% request.placed | html %]</td>
+                                    <td>[% request.updated | html %]</td>
                                     <td>
-                                        <a href="/cgi-bin/koha/opac-illrequests.pl?method=view&amp;illrequest_id=[% request.id %]" class="btn btn-default btn-small pull-right">View</a>
+                                        <a href="/cgi-bin/koha/opac-illrequests.pl?method=view&amp;illrequest_id=[% request.id | html %]" class="btn btn-default btn-small pull-right">View</a>
                                     </td>
                                 </tr>
                             [% END %]
                 [% ELSIF method == 'view' %]
                     <h2>View Interlibrary loan request</h2>
                     [% INCLUDE messages %]
-                    [% status = request.status %]
+                    [% status = request.status | html %]
                     <form method="post" action="?method=update" id="illrequestupdate-form" novalidate="novalidate">
                             <fieldset class="rows">
                                 <legend id="library_legend">Details from library</legend>
                                 <ol>
                                     <li>
                                         <label for="backend">Requested from:</label>
-                                        [% request.backend %]
+                                        [% request.backend | html %]
                                     </li>
                                     [% IF request.biblio_id %]
                                         <li>
                                             <label for="biblio">Requested item:</label>
-                                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% request.biblio_id %]">Click here to view</a>
+                                            <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% request.biblio_id | html %]">Click here to view</a>
                                         </li>
                                     [% END %]
                                     <li>
                                         <label for="branchcode">Collection library:</label>
-                                        [% Branches.GetName(request.branchcode) %]
+                                        [% Branches.GetName(request.branchcode) | html %]
                                     </li>
                                     <li>
                                         <label for="status">Status:</label>
-                                        [% request.capabilities.$status.name %]
+                                        [% request.capabilities.$status.name | html %]
                                     </li>
                                     <li>
                                         <label for="medium">Request type:</label>
-                                        [% request.medium %]
+                                        [% request.medium | html %]
                                     </li>
                                     <li>
                                         <label for="placed">Request placed:</label>
-                                        [% request.placed %]
+                                        [% request.placed | html %]
                                     </li>
                                     <li>
                                         <label for="updated">Last updated:</label>
-                                        [% request.updated %]
+                                        [% request.updated | html %]
                                     </li>
                                     <li>
                                         <label for="notesopac">Notes:</label>
                                 </ol>
                             </fieldset>
                             <div class="rows">
-                                <legend id="backend_legend">Details from [% request.backend %]</legend>
+                                <legend id="backend_legend">Details from [% request.backend | html %]</legend>
                                 [% FOREACH meta IN request.metadata %]
-                                    <div class="requestattr-[% meta.key %]">
-                                        <span class="label">[% meta.key %]:</span>
-                                        [% meta.value || 'N/A' %]
+                                    <div class="requestattr-[% meta.key | html %]">
+                                        <span class="label">[% meta.key | html %]:</span>
+                                        [% meta.value || 'N/A' | html %]
                                     </div>
                                 [% END %]
                             </div>
                             <fieldset class="action illrequest-actions">
-                                <input type="hidden" name="illrequest_id" value="[% request.illrequest_id %]">
+                                <input type="hidden" name="illrequest_id" value="[% request.illrequest_id | html %]">
                                 <input type="hidden" name="method" value="update">
                                 [% IF !request.completed %]
                                     [% IF request.status == "NEW" %]
-                                        <a class="cancel-illrequest btn btn-danger" href="/cgi-bin/koha/opac-illrequests.pl?method=cancreq&amp;illrequest_id=[% request.illrequest_id %]">Request cancellation</a>
+                                        <a class="cancel-illrequest btn btn-danger" href="/cgi-bin/koha/opac-illrequests.pl?method=cancreq&amp;illrequest_id=[% request.illrequest_id | html %]">Request cancellation</a>
                                     [% END %]
                                     <input type="submit" class="update-illrequest btn btn-default" value="Submit modifications">
                                 [% END %]
index 09c95c0..bc4fe2e 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Images for: [% biblio.title |html %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Images for: [% biblio.title | html %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>
@@ -47,7 +47,7 @@
                     [% ELSE %]
                         <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber |url %]">
                     [% END %]
-                [% END %][% biblio.title %]</a> <span class="divider">&rsaquo;</span>
+                [% END %][% biblio.title | html %]</a> <span class="divider">&rsaquo;</span>
             </li>
             <li><a href="#">Images</a></li>
         </ul>
@@ -75,7 +75,7 @@
                                     [% ELSE %]
                                         <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber |url %]" title="View details for this title">
                                     [% END %]
-                                [% END %][% biblio.title %]</a> [% biblio.author %]
+                                [% END %][% biblio.title | html %]</a> [% biblio.author | html %]
                             </h1>
                         </div> <!-- / .span9 -->
                     </div> <!-- / .row-fluid -->
                                 <div id="thumbnails">
                                     [% FOREACH img IN images %]
                                         [% IF img %]
-                                            <a href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblionumber | url %]&amp;imagenumber=[% img %]" onclick="showCover([% img %]); return false;">
+                                            <a href="/cgi-bin/koha/opac-imageviewer.pl?biblionumber=[% biblionumber | url %]&amp;imagenumber=[% img | html %]" onclick="showCover([% img | html %]); return false;">
                                             [% IF ( imagenumber == img ) %]
-                                                <img class="thumbnail selected" id="[% img %]" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% img %]&amp;thumbnail=1" alt="Thumbnail"/>
+                                                <img class="thumbnail selected" id="[% img | html %]" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% img | html %]&amp;thumbnail=1" alt="Thumbnail"/>
                                             [% ELSE %]
-                                                <img class="thumbnail" id="[% img %]" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% img %]&amp;thumbnail=1" alt="Thumbnail"/>
+                                                <img class="thumbnail" id="[% img | html %]" src="/cgi-bin/koha/opac-image.pl?imagenumber=[% img | html %]&amp;thumbnail=1" alt="Thumbnail"/>
                                             [% END %]
                                             </a>
                                         [% END %]
 <script>
     //<![CDATA[
         $(document).ready(function(){
-            $("#largeCoverImg").attr("src","[% interface %]/[% theme %]/images/loading.gif");
+            $("#largeCoverImg").attr("src","[% interface | html %]/[% theme | html %]/images/loading.gif");
             showCover([% imagenumber | html %]);
         });
 
index f8ecf55..5c009b1 100644 (file)
@@ -2,7 +2,7 @@
 [% USE KohaDates %]
 [% USE Branches %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your library home</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your library home</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -13,7 +13,7 @@
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
         <li><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a><span class="divider">&rsaquo;</span></li>
-        <li><a href="#">Editing issue note for [% ISSUE.title %] - [% ISSUE.author %]</a></li>
+        <li><a href="#">Editing issue note for [% ISSUE.title | html %] - [% ISSUE.author | html %]</a></li>
     </ul>
 
     <div class="container-fluid">
             </div>
             <div class="span10">
                 <div id="issuenote" class="maincontent">
-                    <h3>Editing issue note for [% title %] [% author %]</h3>
+                    <h3>Editing issue note for [% title | html %] [% author | html %]</h3>
                         [% IF not(Koha.Preference("AllowCheckoutNotes")) %]
                             Issue notes have not been enabled. Please contact the library.
                         [% ELSE %]
                             <form id="issue-note" action="/cgi-bin/koha/opac-issue-note.pl" method="post">
                                 <fieldset>
                                     <label for="note" class="required">Note:</label>
-                                    <input type="text" name="note" value="[% note %]">
-                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber %]">
-                                    <input type="hidden" name="itemnumber" value="[% itemnumber %]">
-                                    <input type="hidden" name="issue_id" value="[% issue_id %]">
+                                    <input type="text" name="note" value="[% note | html %]">
+                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]">
+                                    <input type="hidden" name="itemnumber" value="[% itemnumber | html %]">
+                                    <input type="hidden" name="issue_id" value="[% issue_id | html %]">
                                     <input type="hidden" name="action" value="issuenote">
                                 </fieldset>
                                 <fieldset class="action">
index 24c3d43..4d1b1fc 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE Branches %]
 [% USE Price %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                 [% SET newsdisp = ( Koha.Preference('NewsAuthorDisplay') ) %]
                 [% FOREACH koha_new IN koha_news %]
                     <div class="newsitem">
-                        <a name="newsitem[% koha_new.idnew %]"></a><h4 class="newsheader">[% koha_new.title %]</h4>
-                        <div class="newsbody">[% koha_new.content %]</div>
-                        <div class="newsfooter">(published on [% koha_new.newdate %][% IF ( (newsdisp == 'opac' || newsdisp == 'both') && koha_new.borrowernumber ) %] by <span class="newsauthor_title">[% koha_new.author_title %] </span>[% koha_new.author_firstname %] [% koha_new.author_surname %][% END %])</div>
+                        <a name="newsitem[% koha_new.idnew | html %]"></a><h4 class="newsheader">[% koha_new.title | html %]</h4>
+                        <div class="newsbody">[% koha_new.content | $raw %]</div>
+                        <div class="newsfooter">(published on [% koha_new.newdate | html %][% IF ( (newsdisp == 'opac' || newsdisp == 'both') && koha_new.borrowernumber ) %] by <span class="newsauthor_title">[% koha_new.author_title | html %] </span>[% koha_new.author_firstname | html %] [% koha_new.author_surname | html %][% END %])</div>
                     </div>
                 [% END %]
             </div>
             <div id="rssnews-container">
                 <!-- Logged in users have a branch code or it could be explicitly set -->
-                <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-news-rss.pl?branchcode=[% branchcode %]"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png"></a>
+                <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-news-rss.pl?branchcode=[% branchcode | html %]"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png"></a>
                 [% IF Branches.all.size == 1 %]
                     [% IF branchcode %]
-                        RSS feed for [% Branches.GetName( branchcode ) %] library news.
+                        RSS feed for [% Branches.GetName( branchcode ) | html %] library news.
                     [% ELSE %]
                         RSS feed for library news.
                     [% END %]
                 [% ELSE %]
                     [% IF branchcode %]
-                        RSS feed for [% Branches.GetName( branchcode ) %] and system-wide library news.
+                        RSS feed for [% Branches.GetName( branchcode ) | html %] and system-wide library news.
                     [% ELSE %]
                         RSS feed for system-wide library news.
                     [% END %]
             <div id="daily-quote">
                 <h3>Quote of the day</h3>
                 <div>
-                    <span id="daily-quote-text">[% daily_quote.text %]</span><span id="daily-quote-sep"> ~ </span><span id="daily-quote-source">[% daily_quote.source %]</span>
+                    <span id="daily-quote-text">[% daily_quote.text | html %]</span><span id="daily-quote-sep"> ~ </span><span id="daily-quote-source">[% daily_quote.source | html %]</span>
                 </div>
             </div>
         [% END %]
 
-        [% IF ( OpacMainUserBlock ) %]<div id="opacmainuserblock">[% OpacMainUserBlock %]</div>[% END %]
+        [% IF ( OpacMainUserBlock ) %]<div id="opacmainuserblock">[% OpacMainUserBlock | $raw %]</div>[% END %]
         </div> <!-- / .span 7/9 -->
 
         [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) || OpacNavRight ) %]
                                         </fieldset>
                                         [% IF Koha.Preference( 'OpacLoginInstructions' ) %]
                                             <div id="nologininstructions-main" class="nologininstructions">
-                                                [% Koha.Preference( 'OpacLoginInstructions' ) %]
+                                                [% Koha.Preference( 'OpacLoginInstructions' ) | $raw %]
                                             </div>
                                         [% END %]
                                         [% IF Koha.Preference('OpacPasswordChange') && Koha.Preference('OpacResetPassword') %]
                                 <h3>Welcome, <a href="/cgi-bin/koha/opac-user.pl"><span class="loggedinusername">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</span></a></h3>
                                 <ul id="user_summary_shortcuts">
                                     [% IF checkouts && checkouts > 0 %]
-                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-checkouts"><span class="user_checkouts_count count_label">[% checkouts %]</span> checkout(s)</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-checkouts"><span class="user_checkouts_count count_label">[% checkouts | html %]</span> checkout(s)</a></li>
                                     [% END %]
                                     [% IF overdues && overdues > 0 %]
-                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-overdues"><span class="user_overdues_count count_label">[% overdues %]</span> overdue(s)</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-overdues"><span class="user_overdues_count count_label">[% overdues | html %]</span> overdue(s)</a></li>
                                     [% END %]
                                     [% IF holds_pending && holds_pending > 0 %]
-                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-holds"><span class="user_holds_pending_count count_label">[% holds_pending %]</span> hold(s) pending</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-holds"><span class="user_holds_pending_count count_label">[% holds_pending | html %]</span> hold(s) pending</a></li>
                                     [% END %]
                                     [% IF holds_waiting && holds_waiting > 0 %]
-                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-holds"><span class="user_holds_waiting_count count_label">[% holds_waiting %]</span> hold(s) waiting</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-user.pl#opac-user-holds"><span class="user_holds_waiting_count count_label">[% holds_waiting | html %]</span> hold(s) waiting</a></li>
                                     [% END %]
                                     [% IF total_owing && total_owing > 0 %]
-                                        <li><a href="/cgi-bin/koha/opac-account.pl"><span class="user_fines_count count_label">[% total_owing | $Price with_symbol => 1 %]</span> due in fines and charges</a></li>
+                                        <li><a href="/cgi-bin/koha/opac-account.pl"><span class="user_fines_count count_label">[% total_owing | $Price with_symbol => 1 | html %]</span> due in fines and charges</a></li>
                                     [% END %]
                                 </ul>
                             </div>
                 [% END # /opacuserlogin %]
                 [% IF ( OpacNavRight ) %]
                     <div id="opacnavright">
-                        [% OpacNavRight %]
+                        [% OpacNavRight | $raw %]
                     </div>
                 [% END # /OpacNavRight %]
             </div> <!-- / .span3 -->
index a92a01e..acb4725 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Updates submitted</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Updates submitted</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
index f72274a..6c645c9 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE AuthorisedValues %]
 [% USE Categories %]
@@ -8,7 +9,7 @@
 [% SET userupdateview = 1 %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-    <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; [% IF action == 'edit' %]Update your personal details[% ELSE %]Register a new account[% END %]</title>
+    <title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; [% IF action == 'edit' %]Update your personal details[% ELSE %]Register a new account[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -67,7 +68,7 @@
                                 [% IF field == "B_email" %]<li>Alternate address information: <a href="#borrower_B_email">email address</a></li>[% END %]
                                 [% IF field == "password_match" %]<li>Passwords do not match! <a href="#password">password</a></li>[% END %]
                                 [% IF field == "password_too_short" %]
-                                    <li>Password must be at least [% minPasswordLength %] characters long.</li>
+                                    <li>Password must be at least [% minPasswordLength | html %] characters long.</li>
                                 [% END %]
                                 [% IF field == "password_too_weak" %]
                                     <li>Password must contain at least one digit, one lowercase and one uppercase.</li>
                                     <span id="update_privacy_guarantor_checkouts_message" class="alert" style="display:none"></span>
                                 </span>
                                 <span class="hint">
-                                    Your guarantor is <i>[% guarantor.firstname %] [% guarantor.surname %]</i>
+                                    Your guarantor is <i>[% guarantor.firstname | html %] [% guarantor.surname | html %]</i>
                                 </span>
                             </li>
                         </ol>
                     </fieldset>
                 [% END %]
                 [% IF ( extended_unique_id_failed_code ) %]
-                    <div class="alert" id="extended_unique_id_failed"><a href="#patron-attr-start-[% extended_unique_id_failed_code %]">[% extended_unique_id_failed_description _ ': ' %]</a> Value is already in use ([% extended_unique_id_failed_value %])</div>
+                    <div class="alert" id="extended_unique_id_failed"><a href="#patron-attr-start-[% extended_unique_id_failed_code | html %]">[% extended_unique_id_failed_description _ ': ' | html %]</a> Value is already in use ([% extended_unique_id_failed_value | html %])</div>
                 [% END %]
 
                 <form method="post" action="/cgi-bin/koha/opac-memberentry.pl" id="memberentry-form" autocomplete="off">
                                         <label for="borrower_cardnumber">Library card number:</label>
                                     [% END %]
                                     [% IF borrower && !(cardnumber_wrong_length || cardnumber_already_exists) %]
-                                        [% borrower.cardnumber %]
+                                        [% borrower.cardnumber | html %]
                                     [% ELSE %]
                                         [% IF minlength_cardnumber == maxlength_cardnumber %]
-                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber %]" minlength="[% minlength_cardnumber %]" maxlength="[% maxlength_cardnumber %]" />
+                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber | html %]" minlength="[% minlength_cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
                                             [% IF ( mandatory.defined('cardnumber') ) %]<span class="required">Required</span>[% END %]
-                                            <div class="hint">Card number must be exactly [% minlength_cardnumber %] characters.</div>
+                                            <div class="hint">Card number must be exactly [% minlength_cardnumber | html %] characters.</div>
                                         [% ELSIF minlength_cardnumber && maxlength_cardnumber %]
-                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber %]" minlength="[% minlength_cardnumber %]" maxlength="[% maxlength_cardnumber %]" />
+                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber | html %]" minlength="[% minlength_cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
                                             [% IF ( mandatory.defined('cardnumber') ) %]<span class="required">Required</span>[% END %]
-                                            <div class="hint">Card number must be between [% minlength_cardnumber %] and [% maxlength_cardnumber %] characters.</div>
+                                            <div class="hint">Card number must be between [% minlength_cardnumber | html %] and [% maxlength_cardnumber | html %] characters.</div>
                                         [% ELSIF maxlength_cardnumber %]
-                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber %]" maxlength="[% maxlength_cardnumber %]" />
+                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber | html %]" maxlength="[% maxlength_cardnumber | html %]" />
                                             [% IF ( mandatory.defined('cardnumber') ) %]<span class="required">Required</span>[% END %]
-                                            <div class="hint">Card number can be up to [% maxlength_cardnumber %] characters.</div>
+                                            <div class="hint">Card number can be up to [% maxlength_cardnumber | html %] characters.</div>
                                         [% ELSE %]
-                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber %]" />
+                                            <input type="text" id="borrower_cardnumber" name="borrower_cardnumber" size="20" value="[% borrower.cardnumber | html %]" />
                                             [% IF ( mandatory.defined('cardnumber') ) %]<span class="required">Required</span>[% END %]
                                             <div class="hint">There is no minimum or maximum character length.</div>
                                         [% END %]
                                 [% UNLESS hidden.defined('dateexpiry') %]
                                 <li>
                                     <label>Expiration date:</label>
-                                    [% borrower.dateexpiry | $KohaDates  %]
+                                    [% borrower.dateexpiry | $KohaDates | html %]
                                 </li>
                                 [% END %]
 
                                         <select id="borrower_branchcode" name="borrower_branchcode">
                                             [% FOREACH l IN libraries %]
                                                 [% IF l.branchcode == borrower.branchcode %]
-                                                    <option value="[% l.branchcode | html %]" selected="selected">[% l.branchname %]</option>
+                                                    <option value="[% l.branchcode | html %]" selected="selected">[% l.branchname | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% l.branchcode | html %]">[% l.branchname %]</option>
+                                                    <option value="[% l.branchcode | html %]">[% l.branchname | html %]</option>
                                                 [% END %]
                                             [% END %]
                                         </select>
                                         Category:</label>
 
                                         [% IF borrower %]
-                                            [% Categories.GetName( borrower.categorycode ) %]
-                                            <input type="hidden" name="borrower_categorycode" value="[% borrower.categorycode %]" />
+                                            [% Categories.GetName( borrower.categorycode ) | html %]
+                                            <input type="hidden" name="borrower_categorycode" value="[% borrower.categorycode | html %]" />
                                         [% ELSE %]
                                             <select id="borrower_categorycode" name="borrower_categorycode">
                                                 [% FOREACH c IN Categories.all() %]
                                                     [% IF c.categorycode == Koha.Preference('PatronSelfRegistrationDefaultCategory') %]
-                                                        <option value="[% c.categorycode %]" selected="selected">[% c.description %]</option>
+                                                        <option value="[% c.categorycode | html %]" selected="selected">[% c.description | html %]</option>
                                                     [% ELSE %]
-                                                        <option value="[% c.categorycode %]">[% c.description %]</option>
+                                                        <option value="[% c.categorycode | html %]">[% c.description | html %]</option>
                                                     [% END %]
                                                 [% END %]
                                             </select>
                                                 <option value=""></option>
                                                 [% FOREACH mt IN Koha.Preference('BorrowersTitles').split('\|') %]
                                                     [% IF mt == borrower.title %]
-                                                        <option value="[% mt %]" selected="selected">[% mt %]</option>
+                                                        <option value="[% mt | html %]" selected="selected">[% mt | html %]</option>
                                                     [% ELSE %]
-                                                        <option value="[% mt %]">[% mt %]</option>
+                                                        <option value="[% mt | html %]">[% mt | html %]</option>
                                                     [% END %]
                                                 [% END %]
                                             </select>
                                                 <label for="borrower_surname">Surname:</label>
                                             [% END %]
 
-                                            <input type="text" id="borrower_surname" name="borrower_surname" value="[% borrower.surname %]" />
+                                            <input type="text" id="borrower_surname" name="borrower_surname" value="[% borrower.surname | html %]" />
                                             [% IF mandatory.defined('surname') %]<span class="required">Required</span>[% END %]
                                         </li>
                                     [% END %]
                                                 <label for="borrower_firstname">First name:</label>
                                             [% END %]
 
-                                            <input type="text" id="borrower_firstname" name="borrower_firstname" value="[% borrower.firstname %]" />
+                                            <input type="text" id="borrower_firstname" name="borrower_firstname" value="[% borrower.firstname | html %]" />
                                             [% IF mandatory.defined('firstname') %]<span class="required">Required</span>[% END %]
                                         </li>
                                     [% END %]
                                                 <label for="borrower_initials">Initials:</label>
                                             [% END %]
 
-                                            <input type="text" id="borrower_initials" name="borrower_initials" value="[% borrower.initials %]" />
+                                            <input type="text" id="borrower_initials" name="borrower_initials" value="[% borrower.initials | html %]" />
                                             [% IF mandatory.defined('initials') %]<span class="required">Required</span>[% END %]
                                         </li>
                                     [% END %]
                                                 <label for="borrower_othernames">Other names:</label>
                                             [% END %]
 
-                                            <input type="text" id="borrower_othernames" name="borrower_othernames" value="[% borrower.othernames %]" />
+                                            <input type="text" id="borrower_othernames" name="borrower_othernames" value="[% borrower.othernames | html %]" />
                                             [% IF mandatory.defined('othernames') %]<span class="required">Required</span>[% END %]
                                         </li>
                                     [% END %]
                                         <label for="borrower_streetnumber">Street number:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_streetnumber" name="borrower_streetnumber" value="[% borrower.streetnumber %]" />
+                                    <input type="text" id="borrower_streetnumber" name="borrower_streetnumber" value="[% borrower.streetnumber | html %]" />
                                     [% IF mandatory.defined('streetnumber') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_address">Address:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_address" name="borrower_address" value="[% borrower.address %]" />
+                                    <input type="text" id="borrower_address" name="borrower_address" value="[% borrower.address | html %]" />
                                     [% IF mandatory.defined('address') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_address2">Address 2:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_address2" name="borrower_address2" value="[% borrower.address2 %]" />
+                                    <input type="text" id="borrower_address2" name="borrower_address2" value="[% borrower.address2 | html %]" />
                                     [% IF mandatory.defined('address2') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_city">City:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_city" name="borrower_city" value="[% borrower.city %]" />
+                                    <input type="text" id="borrower_city" name="borrower_city" value="[% borrower.city | html %]" />
                                     [% IF mandatory.defined('city') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_state">State:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_state" name="borrower_state" value="[% borrower.state %]" />
+                                    <input type="text" id="borrower_state" name="borrower_state" value="[% borrower.state | html %]" />
                                     [% IF mandatory.defined('state') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_zipcode">ZIP/Postal code:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_zipcode" name="borrower_zipcode" value="[% borrower.zipcode %]" />
+                                    <input type="text" id="borrower_zipcode" name="borrower_zipcode" value="[% borrower.zipcode | html %]" />
                                     [% IF mandatory.defined('zipcode') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_country">Country:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_country" name="borrower_country" value="[% borrower.country %]" />
+                                    <input type="text" id="borrower_country" name="borrower_country" value="[% borrower.country | html %]" />
                                     [% IF mandatory.defined('country') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_phone">Primary phone:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_phone" name="borrower_phone" value="[% borrower.phone %]" />
+                                    <input type="text" id="borrower_phone" name="borrower_phone" value="[% borrower.phone | html %]" />
                                     [% IF mandatory.defined('phone') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_phonepro">Secondary phone:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_phonepro" name="borrower_phonepro" value="[% borrower.phonepro %]" />
+                                    <input type="text" id="borrower_phonepro" name="borrower_phonepro" value="[% borrower.phonepro | html %]" />
                                     [% IF mandatory.defined('phonepro') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_mobile">Other phone:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_mobile" name="borrower_mobile" value="[% borrower.mobile %]" />
+                                    <input type="text" id="borrower_mobile" name="borrower_mobile" value="[% borrower.mobile | html %]" />
                                     [% IF mandatory.defined('mobile') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_email">Primary email:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_email" name="borrower_email" value="[% borrower.email %]" />
+                                    <input type="text" id="borrower_email" name="borrower_email" value="[% borrower.email | html %]" />
                                     [% IF mandatory.defined('email') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_emailpro">Secondary email:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_emailpro" name="borrower_emailpro" value="[% borrower.emailpro %]" />
+                                    <input type="text" id="borrower_emailpro" name="borrower_emailpro" value="[% borrower.emailpro | html %]" />
                                     [% IF mandatory.defined('emailpro') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_fax">Fax:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_fax" name="borrower_fax" value="[% borrower.fax %]" />
+                                    <input type="text" id="borrower_fax" name="borrower_fax" value="[% borrower.fax | html %]" />
                                     [% IF mandatory.defined('fax') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_address">Address:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_address" name="borrower_B_address" value="[% borrower.B_address %]" />
+                                    <input type="text" id="borrower_B_address" name="borrower_B_address" value="[% borrower.B_address | html %]" />
                                     [% IF mandatory.defined('B_address') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_address2">Address 2:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_address2" name="borrower_B_address2" value="[% borrower.B_address2 %]" />
+                                    <input type="text" id="borrower_B_address2" name="borrower_B_address2" value="[% borrower.B_address2 | html %]" />
                                     [% IF mandatory.defined('B_address2') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_city">City:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_city" name="borrower_B_city" value="[% borrower.B_city %]" />
+                                    <input type="text" id="borrower_B_city" name="borrower_B_city" value="[% borrower.B_city | html %]" />
                                     [% IF mandatory.defined('B_city') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_state">State:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_state" name="borrower_B_state" value="[% borrower.B_state %]" />
+                                    <input type="text" id="borrower_B_state" name="borrower_B_state" value="[% borrower.B_state | html %]" />
                                     [% IF mandatory.defined('B_state') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_zipcode">ZIP/Postal code:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_zipcode" name="borrower_B_zipcode" value="[% borrower.B_zipcode %]" />
+                                    <input type="text" id="borrower_B_zipcode" name="borrower_B_zipcode" value="[% borrower.B_zipcode | html %]" />
                                     [% IF mandatory.defined('B_zipcode') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_country">Country:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_country" name="borrower_B_country" value="[% borrower.B_country %]" />
+                                    <input type="text" id="borrower_B_country" name="borrower_B_country" value="[% borrower.B_country | html %]" />
                                     [% IF mandatory.defined('B_country') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_phone">Phone:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_phone" name="borrower_B_phone" value="[% borrower.B_phone %]" />
+                                    <input type="text" id="borrower_B_phone" name="borrower_B_phone" value="[% borrower.B_phone | html %]" />
                                     [% IF mandatory.defined('B_phone') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_B_email">Email:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_B_email" name="borrower_B_email" value="[% borrower.B_email %]" />
+                                    <input type="text" id="borrower_B_email" name="borrower_B_email" value="[% borrower.B_email | html %]" />
                                     [% IF mandatory.defined('B_email') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_contactnote">Contact note:</label>
                                     [% END %]
 
-                                    <textarea id="borrower_contactnote" name="borrower_contactnote" cols="30" rows="2">[% borrower.contactnote %]</textarea>
+                                    <textarea id="borrower_contactnote" name="borrower_contactnote" cols="30" rows="2">[% borrower.contactnote | html %]</textarea>
                                     [% IF mandatory.defined('contactnote') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactsurname">Surname:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactsurname" name="borrower_altcontactsurname" value="[% borrower.altcontactsurname %]" />
+                                    <input type="text" id="borrower_altcontactsurname" name="borrower_altcontactsurname" value="[% borrower.altcontactsurname | html %]" />
                                     [% IF mandatory.defined('altcontactsurname') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactfirstname">First name:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactfirstname" name="borrower_altcontactfirstname" value="[% borrower.altcontactfirstname %]" />
+                                    <input type="text" id="borrower_altcontactfirstname" name="borrower_altcontactfirstname" value="[% borrower.altcontactfirstname | html %]" />
                                     [% IF mandatory.defined('altcontactfirstname') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactaddress1">Address:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactaddress1" name="borrower_altcontactaddress1" value="[% borrower.altcontactaddress1 %]" />
+                                    <input type="text" id="borrower_altcontactaddress1" name="borrower_altcontactaddress1" value="[% borrower.altcontactaddress1 | html %]" />
                                     [% IF mandatory.defined('altcontactaddress1') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactaddress2">Address 2:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactaddress2" name="borrower_altcontactaddress2" value="[% borrower.altcontactaddress2 %]" />
+                                    <input type="text" id="borrower_altcontactaddress2" name="borrower_altcontactaddress2" value="[% borrower.altcontactaddress2 | html %]" />
                                     [% IF mandatory.defined('altcontactaddress2') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactaddress3">City:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactaddress3" name="borrower_altcontactaddress3" value="[% borrower.altcontactaddress3 %]" />
+                                    <input type="text" id="borrower_altcontactaddress3" name="borrower_altcontactaddress3" value="[% borrower.altcontactaddress3 | html %]" />
                                     [% IF mandatory.defined('altcontactaddress3') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactstate">State:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactstate" name="borrower_altcontactstate" value="[% borrower.altcontactstate %]" />
+                                    <input type="text" id="borrower_altcontactstate" name="borrower_altcontactstate" value="[% borrower.altcontactstate | html %]" />
                                     [% IF mandatory.defined('altcontactstate') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactzipcode">ZIP/Postal code:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactzipcode" name="borrower_altcontactzipcode" value="[% borrower.altcontactzipcode %]" />
+                                    <input type="text" id="borrower_altcontactzipcode" name="borrower_altcontactzipcode" value="[% borrower.altcontactzipcode | html %]" />
                                     [% IF mandatory.defined('altcontactzipcode') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactcountry">Country:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactcountry" name="borrower_altcontactcountry" value="[% borrower.altcontactcountry %]" />
+                                    <input type="text" id="borrower_altcontactcountry" name="borrower_altcontactcountry" value="[% borrower.altcontactcountry | html %]" />
                                     [% IF mandatory.defined('altcontactcountry') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                                         <label for="borrower_altcontactphone">Phone:</label>
                                     [% END %]
 
-                                    <input type="text" id="borrower_altcontactphone" name="borrower_altcontactphone" value="[% borrower.altcontactphone %]" />
+                                    <input type="text" id="borrower_altcontactphone" name="borrower_altcontactphone" value="[% borrower.altcontactphone | html %]" />
                                     [% IF mandatory.defined('altcontactphone') %]<span class="required">Required</span>[% END %]
                                 </li>
                             [% END %]
                     <fieldset class="rows" id="memberentry_password">
                         <legend id="contact_legend">Password</legend>
                         <div class="alert alert-info">
-                            <p>Your password must be at least [% Koha.Preference('minPasswordLength') %] characters long.</p>
+                            <p>Your password must be at least [% Koha.Preference('minPasswordLength') | html %] characters long.</p>
                             [% UNLESS mandatory.defined('password') %]
                                 <div>If you do not enter a password a system generated password will be created.</div>
                             [% END %]
                 [% IF ( Koha.Preference('ExtendedPatronAttributes') && patron_attribute_classes.size && !Koha.Preference('PatronSelfRegistrationVerifyByEmail') ) %]
                     [% FOREACH pa_class IN patron_attribute_classes %]
                         [% IF pa_class.class %]
-                            <fieldset id="aai_[% pa_loo.class %]" class="rows patron-attributes">
-                            <legend>[% pa_class.lib %]</legend>
+                            <fieldset id="aai_[% pa_loo.class | html %]" class="rows patron-attributes">
+                            <legend>[% pa_class.lib | html %]</legend>
                         [% ELSE %]
                             <fieldset class="rows patron-attributes">
                             <legend>Additional information</legend>
                         <ol class="attributes_table">
                             [% FOREACH pa IN pa_class.items %]
                                 [% FOREACH pa_value IN pa.values %]
-                                    [% IF loop.first %]<a name="patron-attr-start-[% pa.type.code %]"></a>[% END %]
+                                    [% IF loop.first %]<a name="patron-attr-start-[% pa.type.code | html %]"></a>[% END %]
                                     [% form_id = 'patron-attr-' _ Math.int( Math.rand(1000000) ) %]
-                                    <li data-category_code="[% pa.type.category_code %]">
-                                        <label for="[% form_id %]">[% pa.type.description %]: </label>
+                                    <li data-category_code="[% pa.type.category_code | html %]">
+                                        <label for="[% form_id | html %]">[% pa.type.description | html %]: </label>
                                         [% IF pa.type.opac_editable %]
-                                            <input type="hidden" name="patron_attribute_code" value="[% pa.type.code |html %]" />
+                                            <input type="hidden" name="patron_attribute_code" value="[% pa.type.code | html %]" />
                                             [% IF ( pa.type.authorised_value_category ) %]
-                                                <select id="[% form_id %]" name="patron_attribute_value">
+                                                <select id="[% form_id | html %]" name="patron_attribute_value">
                                                     <option value=""></option>
                                                     [% FOREACH auth_val IN AuthorisedValues.Get( pa.type.authorised_value_category, 1 ) %]
                                                         [% IF ( auth_val.authorised_value == pa_value ) %]
-                                                            <option value="[% auth_val.authorised_value %]" selected="selected">
-                                                                [% auth_val.lib %]
+                                                            <option value="[% auth_val.authorised_value | html %]" selected="selected">
+                                                                [% auth_val.lib | html %]
                                                             </option>
                                                         [% ELSE %]
-                                                            <option value="[% auth_val.authorised_value %]" >
-                                                                [% auth_val.lib %]
+                                                            <option value="[% auth_val.authorised_value | html %]" >
+                                                                [% auth_val.lib | html %]
                                                             </option>
                                                         [% END %]
                                                     [% END %]
                                                 </select>
                                             [% ELSE %]
-                                                <textarea rows="2" cols="30" id="[% form_id %]" name="patron_attribute_value">[% pa_value %]</textarea>
+                                                <textarea rows="2" cols="30" id="[% form_id | html %]" name="patron_attribute_value">[% pa_value | html %]</textarea>
                                             [% END %]
                                             <a href="#" class="clear-attribute">Clear</a>
                                             [% IF ( pa.type.repeatable ) %]
                                 <label for="captcha" class="required">Verification:</label>
 
                                 <input type="text" name="captcha" id="captcha" />
-                                <input type="hidden" name="captcha_digest" value="[% captcha_digest %]" />
+                                <input type="hidden" name="captcha_digest" value="[% captcha_digest | html %]" />
 
-                                <span class="hint">Please type the following characters into the preceding box: <strong>[% captcha %]</strong></span>
+                                <span class="hint">Please type the following characters into the preceding box: <strong>[% captcha | html %]</strong></span>
                             </li>
                         </ol>
                     </fieldset>
                     [% IF OPACPatronDetails %]
                         <fieldset class="action">
                             <input type="hidden" name="action" value="update" />
-                            <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                             <input type="submit" class="btn" value="Submit update request" />
                         </fieldset>
                     [% END %]
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %]
     [% PROCESS 'password_check.inc' %]
     [% PROCESS 'add_password_check' new_password => 'borrower_password' %]
     <script>
index c12b0f8..e08754f 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your messaging settings</title>
+<title>[% IF ( LibraryNameTitle ) %][% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your messaging settings</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                                               [% ELSIF ( messaging_preference.Item_Checkout ) %]Item checkout
                                               [% ELSE %]Unknown [% END %]</td>
                                         [% IF ( messaging_preference.takes_days ) %]
-                                            <td><select class="input-mini" name="[% messaging_preference.message_attribute_id %]-DAYS">
+                                            <td><select class="input-mini" name="[% messaging_preference.message_attribute_id | html %]-DAYS">
                                             [% FOREACH select_day IN messaging_preference.select_days %]
                                                 [% IF ( select_day.selected ) %]
-                                                    <option value="[% select_day.day %]" selected="selected">[% select_day.day %]</option>
+                                                    <option value="[% select_day.day | html %]" selected="selected">[% select_day.day | html %]</option>
                                                 [% ELSE %]
-                                                    <option value="[% select_day.day %]">[% select_day.day %]</option>
+                                                    <option value="[% select_day.day | html %]">[% select_day.day | html %]</option>
                                                 [% END %]
                                             [% END %]
                                             </select></td>
@@ -70,9 +70,9 @@
                                             [% IF ( messaging_preference.transport_sms ) %]
                                                 <td>
                                                     [% IF ( messaging_preference.transports_sms ) %]
-                                                      <input type="checkbox" id="sms[% messaging_preference.message_attribute_id %]" name="[% messaging_preference.message_attribute_id %]" value="sms" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                      <input type="checkbox" id="sms[% messaging_preference.message_attribute_id | html %]" name="[% messaging_preference.message_attribute_id | html %]" value="sms" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                     [% ELSE %]
-                                                        <input type="checkbox" id="sms[% messaging_preference.message_attribute_id %]" name="[% messaging_preference.message_attribute_id %]" value="sms" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                        <input type="checkbox" id="sms[% messaging_preference.message_attribute_id | html %]" name="[% messaging_preference.message_attribute_id | html %]" value="sms" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                     [% END %]
                                                 </td>
                                             [% ELSE %]
                                             <td>
                                               [% IF ( messaging_preference.transports_phone ) %]
                                               <input type="checkbox"
-                                                         id="phone[% messaging_preference.message_attribute_id %]"
-                                                         name="[% messaging_preference.message_attribute_id %]"
-                                                         value="phone" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                         id="phone[% messaging_preference.message_attribute_id | html %]"
+                                                         name="[% messaging_preference.message_attribute_id | html %]"
+                                                         value="phone" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                               [% ELSE %]
                                               <input type="checkbox"
-                                                         id="phone[% messaging_preference.message_attribute_id %]"
-                                                         name="[% messaging_preference.message_attribute_id %]"
-                                                         value="phone" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                         id="phone[% messaging_preference.message_attribute_id | html %]"
+                                                         name="[% messaging_preference.message_attribute_id | html %]"
+                                                         value="phone" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                               [% END %]
                                             </td>
                                             [% ELSE %]
                                         [% IF ( messaging_preference.transport_email ) %]
                                             <td>
                                                 [% IF ( messaging_preference.transports_email ) %]
-                                                    <input type="checkbox" id="email[% messaging_preference.message_attribute_id %]" name="[% messaging_preference.message_attribute_id %]" value="email" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                    <input type="checkbox" id="email[% messaging_preference.message_attribute_id | html %]" name="[% messaging_preference.message_attribute_id | html %]" value="email" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                 [% ELSE %]
-                                                    <input type="checkbox" id="email[% messaging_preference.message_attribute_id %]" name="[% messaging_preference.message_attribute_id %]" value="email" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                    <input type="checkbox" id="email[% messaging_preference.message_attribute_id | html %]" name="[% messaging_preference.message_attribute_id | html %]" value="email" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                 [% END %]
                                             </td>
                                         [% ELSE %]
                                         [% IF ( messaging_preference.has_digest ) %]
                                             <td>
                                                 [% IF ( messaging_preference.digest ) %]
-                                                    <input type="checkbox" id="digest[% messaging_preference.message_attribute_id %]" value="[% messaging_preference.message_attribute_id %]" name="digest" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                    <input type="checkbox" id="digest[% messaging_preference.message_attribute_id | html %]" value="[% messaging_preference.message_attribute_id | html %]" name="digest" checked="checked" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                 [% ELSE %]
-                                                    <input type="checkbox" id="digest[% messaging_preference.message_attribute_id %]" value="[% messaging_preference.message_attribute_id %]" name="digest" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id %].checked=false;" />
+                                                    <input type="checkbox" id="digest[% messaging_preference.message_attribute_id | html %]" value="[% messaging_preference.message_attribute_id | html %]" name="digest" onclick = "document.opacmessaging.none[% messaging_preference.message_attribute_id | html %].checked=false;" />
                                                 [% END %]
                                             </td>
                                         [% ELSE %]
                                         <td>-</td>
                                         [% END %]
 
-                                        <td><input type="checkbox" class="none" id="none[% messaging_preference.message_attribute_id %]" /></td>
+                                        <td><input type="checkbox" class="none" id="none[% messaging_preference.message_attribute_id | html %]" /></td>
                                     </tr>
                                 [% END # / FOREACH messaging_preferences%]
                             </tbody>
                             [% IF ( SMSSendDriver ) %]
                                 <ol><li><label>Notice:</label>Some charges for text messages may be incurred when using this service. Please check with your mobile service provider if you have questions.</li></ol>
                                 <ol><li>
-                                    <label for="SMSnumber">SMS number:</label> <input type="text" id="SMSnumber" name="SMSnumber" value="[% SMSnumber %]" />
+                                    <label for="SMSnumber">SMS number:</label> <input type="text" id="SMSnumber" name="SMSnumber" value="[% SMSnumber | html %]" />
                                     <i>Please enter numbers only. <b>(123) 456-7890</b> would be entered as <b>1234567890</b>.</i>
                                 </li></ol>
                             [% END %]
                                         <option value="">Unknown</option>
                                         [% FOREACH s IN sms_providers %]
                                             [% IF s.id == sms_provider_id %]
-                                                <option value="[% s.id %]" selected="selected">[% s.name %]</option>
+                                                <option value="[% s.id | html %]" selected="selected">[% s.name | html %]</option>
                                             [% ELSE %]
-                                                <option value="[% s.id %]">[% s.name %]</option>
+                                                <option value="[% s.id | html %]">[% s.name | html %]</option>
                                             [% END %]
                                         [% END %]
                                     </select>
index 53550af..839f26a 100644 (file)
       <webMaster></webMaster>
       [% FOREACH message_lis IN message_list %]
       <item>
-        <title>[% message_lis.subject |html %]</title>
-        <link>[% message_lis.title |html %]</link>
-        <description>[% message_lis.content |html %]</description>
-        <pubDate>[% message_lis.time_queued |html %]</pubDate>
-        <guid>[% message_lis.title |html %]</guid>
+        <title>[% message_lis.subject | html %]</title>
+        <link>[% message_lis.title | html %]</link>
+        <description>[% message_lis.content | html %]</description>
+        <pubDate>[% message_lis.time_queued | html %]</pubDate>
+        <guid>[% message_lis.title | html %]</guid>
       </item>
       [% END %]
    </channel>
index aa18011..64a4a47 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 <?xml version="1.0"?>
 <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
    <channel>
-      <atom:link href="[% OPACBaseURL %]/cgi-bin/koha/opac-main.pl" rel="self" type="application/rss+xml" />
-      <title>News from [% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]the library[% END %]</title>
-      <link>[% OPACBaseURL %]/cgi-bin/koha/opac-main.pl</link>
+      <atom:link href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-main.pl" rel="self" type="application/rss+xml" />
+      <title>News from [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]the library[% END %]</title>
+      <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-main.pl</link>
       <description></description>
       [% FOREACH newsitem IN koha_news %]
       <item>
-        <title>[% newsitem.title |html %]</title>
-        <description>[% newsitem.content |html %]</description>
-        <guid>[% OPACBaseURL %]/cgi-bin/koha/opac-main.pl#newsitem[% newsitem.idnew |html %]</guid>
+        <title>[% newsitem.title | html %]</title>
+        <description>[% newsitem.content | $raw %]</description>
+        <guid>[% OPACBaseURL | html %]/cgi-bin/koha/opac-main.pl#newsitem[% newsitem.idnew | html %]</guid>
       </item>
       [% END %]
    </channel>
index ce887f6..c577c50 100644 (file)
@@ -2,12 +2,12 @@
 [% USE Koha %]
 [% IF ( opensearchdescription ) %]
 <OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/">
-   <ShortName>[% LibraryName |html %] Search</ShortName>
-   <Description>Search the [% LibraryName |html %]</Description>
-   <Tags>koha opac [% LibraryName |html %]</Tags>
-   <Contact>[% KohaAdminEmailAddress |html %]</Contact>
+   <ShortName>[% LibraryName | html %] Search</ShortName>
+   <Description>Search the [% LibraryName | html %]</Description>
+   <Tags>koha opac [% LibraryName | html %]</Tags>
+   <Contact>[% KohaAdminEmailAddress | html %]</Contact>
    <Url type="application/rss+xml"
-        template="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?q={searchTerms}&amp;pw={startPage?}&amp;format=rss2"/>
+        template="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?q={searchTerms}&amp;pw={startPage?}&amp;format=rss2"/>
 </OpenSearchDescription>
 
 [% ELSE %]
       xmlns:dc="http://purl.org/dc/elements/1.1/"
       xmlns:atom="http://www.w3.org/2005/Atom">
    <channel>
-     <title><![CDATA[[% LibraryName |html %] Search [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc |html %]'[% END %]]]></title>
-     <link>[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;format=rss2</link>
-     <atom:link rel="self" type="application/rss+xml" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |uri %][% limit_cgi |uri %]&amp;sort_by=[% sort_by | uri %]&amp;format=rss2"/>
-     <description><![CDATA[ Search results [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc |html %]'[% END %] at [% LibraryName |html %]]]></description>
-     <opensearch:totalResults>[% total %]</opensearch:totalResults>
-     <opensearch:startIndex>[% offset %]</opensearch:startIndex>
+     <title><![CDATA[[% LibraryName | html %] Search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %]]]></title>
+     <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;format=rss2</link>
+     <atom:link rel="self" type="application/rss+xml" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi |uri %][% limit_cgi |uri %]&amp;sort_by=[% sort_by | uri %]&amp;format=rss2"/>
+     <description><![CDATA[ Search results [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %] at [% LibraryName | html %]]]></description>
+     <opensearch:totalResults>[% total | html %]</opensearch:totalResults>
+     <opensearch:startIndex>[% offset | html %]</opensearch:startIndex>
      [% IF ( results_per_page ) %]
-       <opensearch:itemsPerPage>[% results_per_page |html%]</opensearch:itemsPerPage>
+       <opensearch:itemsPerPage>[% results_per_page | html %]</opensearch:itemsPerPage>
      [% ELSE %]
        <opensearch:itemsPerPage>20</opensearch:itemsPerPage>
      [% END %]
         [% FOREACH SEARCH_RESULT IN SEARCH_RESULTS %]
-     <atom:link rel="search" type="application/opensearchdescription+xml" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% SEARCH_RESULT.query_cgi |uri %][% SEARCH_RESULT.limit_cgi |uri %]&amp;sort_by=[% SEARCH_RESULT.sort_by |uri %]&amp;format=opensearchdescription"/>
-     <opensearch:Query role="request" searchTerms="[% SEARCH_RESULT.query_desc |uri %][% SEARCH_RESULT.limit_desc |uri %]" startPage="[% SEARCH_RESULT.page %]" />
+     <atom:link rel="search" type="application/opensearchdescription+xml" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% SEARCH_RESULT.query_cgi |uri %][% SEARCH_RESULT.limit_cgi |uri %]&amp;sort_by=[% SEARCH_RESULT.sort_by |uri %]&amp;format=opensearchdescription"/>
+     <opensearch:Query role="request" searchTerms="[% SEARCH_RESULT.query_desc |uri %][% SEARCH_RESULT.limit_desc |uri %]" startPage="[% SEARCH_RESULT.page | html %]" />
      <item>
-       <title>[% SEARCH_RESULT.title |html %] [% FOREACH subtitl IN SEARCH_RESULT.subtitle %], [% subtitl.subfield |html %][% END %]</title>
-       <dc:identifier>ISBN [% SEARCH_RESULT.isbn |html %]</dc:identifier>
-       <link>[% IF ( SEARCH_RESULT.BiblioDefaultViewmarc ) %][% OPACBaseURL %]/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %][% ELSE %][% IF ( SEARCH_RESULT.BiblioDefaultViewisbd ) %][% OPACBaseURL %]/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %][% ELSE %][% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %][% END %][% END %]</link>
+       <title>[% SEARCH_RESULT.title | html %] [% FOREACH subtitl IN SEARCH_RESULT.subtitle %], [% subtitl.subfield | html %][% END %]</title>
+       <dc:identifier>ISBN [% SEARCH_RESULT.isbn | html %]</dc:identifier>
+       <link>[% IF ( SEARCH_RESULT.BiblioDefaultViewmarc ) %][% OPACBaseURL | html %]/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %][% ELSE %][% IF ( SEARCH_RESULT.BiblioDefaultViewisbd ) %][% OPACBaseURL | html %]/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %][% ELSE %][% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %][% END %][% END %]</link>
        <description><![CDATA[
-[% IF ( OPACAmazonCoverImages ) %][% IF ( SEARCH_RESULT.normalized_isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" />[% END %][% END %]
-[% IF ( SyndeticsEnabled ) %][% IF ( SyndeticsCoverImages ) %][% IF ( SEARCH_RESULT.content_identifier_exists ) %]<img src="http://www.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn %]/SC.GIF&amp;client=[% SEARCH_RESULT.SyndeticsClientCode %]&amp;type=xw10[% IF ( SEARCH_RESULT.normalized_upc ) %]&amp;upc=[% SEARCH_RESULT.normalized_upc %][% END %][% IF ( SEARCH_RESULT.normalized_oclc ) %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc %][% END %]" alt="" />
+[% IF ( OPACAmazonCoverImages ) %][% IF ( SEARCH_RESULT.normalized_isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" />[% END %][% END %]
+[% IF ( SyndeticsEnabled ) %][% IF ( SyndeticsCoverImages ) %][% IF ( SEARCH_RESULT.content_identifier_exists ) %]<img src="http://www.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn | html %]/SC.GIF&amp;client=[% SEARCH_RESULT.SyndeticsClientCode | html %]&amp;type=xw10[% IF ( SEARCH_RESULT.normalized_upc ) %]&amp;upc=[% SEARCH_RESULT.normalized_upc | html %][% END %][% IF ( SEARCH_RESULT.normalized_oclc ) %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc | html %][% END %]" alt="" />
 [% ELSE %]
-<img src="http://www.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% SEARCH_RESULT.normalized_upc %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc %]" alt="" />
+<img src="http://www.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% SEARCH_RESULT.normalized_upc | html %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc | html %]" alt="" />
 [% END %][% END %][% END %]
 
-[% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) %]
-[% IF ( BakerTaylorEnabled ) %][% IF bt_id %]<a href="https://[% BakerTaylorBookstoreURL |url %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |url %][% bt_id %]" /></a>[% END %][% END %]
-          <p>[% IF ( SEARCH_RESULT.author ) %]By [% SEARCH_RESULT.author |html %]. [% END %]
-          [% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place |html %] [% END %][% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode |html %][% END %][% IF ( SEARCH_RESULT.publicationyear ) %] [% SEARCH_RESULT.publicationyear |html %]
-                    [% ELSE %][% IF ( SEARCH_RESULT.copyrightdate ) %] [% SEARCH_RESULT.copyrightdate |html %][% END %][% END %]
-                        [% IF ( SEARCH_RESULT.pages ) %]. [% SEARCH_RESULT.pages |html %][% END %]
-                        [% IF ( SEARCH_RESULT.notes ) %], [% SEARCH_RESULT.notes |html %][% END %]
-                        [% IF ( SEARCH_RESULT.size ) %] [% SEARCH_RESULT.size |html %]. [% END %]
-                        [% IF ( SEARCH_RESULT.isbn ) %] [% SEARCH_RESULT.isbn |html %][% END %]
+[% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) | html %]
+[% IF ( BakerTaylorEnabled ) %][% IF bt_id %]<a href="https://[% BakerTaylorBookstoreURL |url %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |url %][% bt_id | html %]" /></a>[% END %][% END %]
+          <p>[% IF ( SEARCH_RESULT.author ) %]By [% SEARCH_RESULT.author | html %]. [% END %]
+          [% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place | html %] [% END %][% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode | html %][% END %][% IF ( SEARCH_RESULT.publicationyear ) %] [% SEARCH_RESULT.publicationyear | html %]
+                    [% ELSE %][% IF ( SEARCH_RESULT.copyrightdate ) %] [% SEARCH_RESULT.copyrightdate | html %][% END %][% END %]
+                        [% IF ( SEARCH_RESULT.pages ) %]. [% SEARCH_RESULT.pages | html %][% END %]
+                        [% IF ( SEARCH_RESULT.notes ) %], [% SEARCH_RESULT.notes | html %][% END %]
+                        [% IF ( SEARCH_RESULT.size ) %] [% SEARCH_RESULT.size | html %]. [% END %]
+                        [% IF ( SEARCH_RESULT.isbn ) %] [% SEARCH_RESULT.isbn | html %][% END %]
        </p>
 [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %]
-<p><a href="[% OPACBaseURL %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Place Hold on <i>[% SEARCH_RESULT.title %]</i></a></p>
+<p><a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Place Hold on <i>[% SEARCH_RESULT.title | html %]</i></a></p>
 [% END %]
                                                ]]></description>
-       <guid>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]</guid>
+       <guid>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]</guid>
      </item>
         [% END %]
    </channel>
 [% IF ( atom ) %]
 <feed xmlns="http://www.w3.org/2005/Atom"
        xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
-   <id>[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html %][% limit_cgi |html %]&amp;format=atom</id>
-   <title>[% LibraryName |html %] Search [% IF ( query_desc ) %]for '[% query_desc |html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc |html %]'[% END %]</title>
-    <link href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |uri %][% limit_cgi |uri %]&amp;format=rss2"/>
-   <updated>[% timestamp %]</updated>
+   <id>[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;format=atom</id>
+   <title>[% LibraryName | html %] Search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]</title>
+    <link href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi |uri %][% limit_cgi |uri %]&amp;format=rss2"/>
+   <updated>[% timestamp | html %]</updated>
    <author>
-     <name>[% LibraryName |html %]</name>
+     <name>[% LibraryName | html %]</name>
    </author>
    <!-- <id>urn:uuid:60a76c80-d399-11d9-b93C-0003939e0af6</id> -->
-   <opensearch:totalResults>[% total %]</opensearch:totalResults>
-   <opensearch:startIndex>[% page %]</opensearch:startIndex>
+   <opensearch:totalResults>[% total | html %]</opensearch:totalResults>
+   <opensearch:startIndex>[% page | html %]</opensearch:startIndex>
    [% IF ( results_per_page ) %]
-     <opensearch:itemsPerPage>[% results_per_page %]</opensearch:itemsPerPage>
+     <opensearch:itemsPerPage>[% results_per_page | html %]</opensearch:itemsPerPage>
    [% ELSE %]
      <opensearch:itemsPerPage>20</opensearch:itemsPerPage>
    [% END %]
-   <opensearch:Query role="request" searchTerms="[% query_desc |html %] [% limit_desc |html %]" startPage="[% page |html %]" />
-   <link rel="alternate" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]pw=[% page %]&amp;format=atom" type="application/atom+xml"/>
-   <link rel="self" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]&amp;format=atom" type="application/atom+xml"/>
-   <link rel="first" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]pw=1&amp;format=atom" type="application/atom+xml"/>
-   <link rel="previous" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]pw=2&amp;format=atom" type="application/atom+xml"/>
-   <link rel="next" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]pw=4&amp;format=atom" type="application/atom+xml"/>
-   <link rel="last" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi %][% limit_cgi %]pw=42299&amp;format=atom" type="application/atom+xml"/>
-   <link rel="search" type="application/opensearchdescription+xml" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?format=opensearchdescription"/>
+   <opensearch:Query role="request" searchTerms="[% query_desc | html %] [% limit_desc | html %]" startPage="[% page | html %]" />
+   <link rel="alternate" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]pw=[% page | html %]&amp;format=atom" type="application/atom+xml"/>
+   <link rel="self" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]&amp;format=atom" type="application/atom+xml"/>
+   <link rel="first" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]pw=1&amp;format=atom" type="application/atom+xml"/>
+   <link rel="previous" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]pw=2&amp;format=atom" type="application/atom+xml"/>
+   <link rel="next" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]pw=4&amp;format=atom" type="application/atom+xml"/>
+   <link rel="last" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | html %][% limit_cgi | html %]pw=42299&amp;format=atom" type="application/atom+xml"/>
+   <link rel="search" type="application/opensearchdescription+xml" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?format=opensearchdescription"/>
 
    [% FOREACH SEARCH_RESULT IN SEARCH_RESULTS %]
    <entry>
-     <title>[% SEARCH_RESULT.title |html %]</title>
-     <link href="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]"/>
+     <title>[% SEARCH_RESULT.title | html %]</title>
+     <link href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]"/>
      <!-- <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a</id> -->
-     <updated>[% SEARCH_RESULT.timestamp %]</updated>
+     <updated>[% SEARCH_RESULT.timestamp | html %]</updated>
      <content type="text"><!-- put content here -->
      </content>
-     <id>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]</id>
+     <id>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]</id>
    </entry>
    [% END %]
  </feed>
index f67c558..f4154f9 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; OverDrive search for '[% q | html %]'</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; OverDrive search for '[% q | html %]'</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
-[% Asset.css("css/jquery.rating.css") %]
+[% Asset.css("css/jquery.rating.css") | $raw %]
 <style>
 .actions a.addtocart {
     display: inline;
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% Asset.js("js/overdrive.js") %]
-[% Asset.js("lib/jquery/plugins/jquery.rating.js") %]
+[% Asset.js("js/overdrive.js") | $raw %]
+[% Asset.js("lib/jquery/plugins/jquery.rating.js") | $raw %]
 <script>
-var querystring = "[% q |replace( "'", "\'" ) |replace( '\n', '\\n' ) |replace( '\r', '\\r' ) |html %]";
-var results_per_page = [% OPACnumSearchResults %];
+var querystring = "[% q |replace( "'", "\'" ) |replace( '\n', '\\n' ) |replace( '\r', '\\r' ) | html %]";
+var results_per_page = [% OPACnumSearchResults | html %];
 
 function fetch_availability( prod, $tr ) {
     var $availability_summary = $( '<span class="results_summary availability"></span>' );
@@ -91,9 +92,9 @@ function fetch_availability( prod, $tr ) {
 }
 
 function search( offset ) {
-    $( '#overdrive-status' ).html( _("Searching OverDrive...") + ' <img class="throbber" src="[% interface %]/lib/jquery/plugins/themes/classic/throbber.gif" /></span>' );
+    $( '#overdrive-status' ).html( _("Searching OverDrive...") + ' <img class="throbber" src="[% interface | html %]/lib/jquery/plugins/themes/classic/throbber.gif" /></span>' );
 
-    KOHA.OverDrive.Search( "[% OverDriveLibraryID %]", querystring, results_per_page, offset, function( data ) {
+    KOHA.OverDrive.Search( "[% OverDriveLibraryID | html %]", querystring, results_per_page, offset, function( data ) {
         if ( data.error ) {
             $( '#overdrive-status' ).html( '<strong class="unavailable">' + _("Error searching OverDrive collection.") + '</strong>' );
             return;
@@ -185,7 +186,7 @@ $( document ).ready( function() {
     });
 
     [% IF ( overdrive_error ) %]
-    KOHA.OverDriveCirculation.display_error("#breadcrumbs", "[% overdrive_error.dquote %]");
+    KOHA.OverDriveCirculation.display_error("#breadcrumbs", "[% overdrive_error.dquote | html %]");
     [% END %]
     [% IF ( loggedinusername and OverDriveCirculation ) %]
     KOHA.OverDriveCirculation.with_account_details("#breadcrumbs", function() {
index 07ba100..264f1e9 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Change your password</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Change your password</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -34,7 +35,7 @@
                                 Passwords do not match.  Please re-type your new password.
                                 [% END %]
                                 [% IF password_too_short %]
-                                    Password must be at least [% minPasswordLength %] characters long.
+                                    Password must be at least [% minPasswordLength | html %] characters long.
                                 [% END %]
                                 [% IF password_too_weak %]
                                     Password must contain at least one digit, one lowercase and one uppercase.
@@ -55,7 +56,7 @@
 
                             <form action="/cgi-bin/koha/opac-passwd.pl" name="mainform" id="mainform" method="post" autocomplete="off">
                                 <fieldset>
-                                    [% UNLESS ( ShortPass ) %]<div class="alert alert-info">Your password must be at least [% minPasswordLength%] characters long.</div>[% END %]
+                                    [% UNLESS ( ShortPass ) %]<div class="alert alert-info">Your password must be at least [% minPasswordLength | html %] characters long.</div>[% END %]
                                     <label for="Oldkey">Current password:</label> <input type="password" id="Oldkey" size="25"  name="Oldkey" />
                                     <label for="Newkey">New password:</label> <input type="password" id="Newkey"  size="25"  name="Newkey" />
                                     <label for="Confirm">Re-type new password:</label> <input type="password"  id="Confirm" size="25" name="Confirm" />
@@ -73,7 +74,7 @@
                             Your password has been changed
                         </div>
                         <form action="/cgi-bin/koha/opac-user.pl" method="post" autocomplete="off">
-                            <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+                            <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                             <p><input type="submit" class="btn" value="Return to your record" /></p>
                         </form>
                     [% END # /IF password_updated %]
@@ -87,7 +88,7 @@
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") %]
+    [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %]
     [% PROCESS 'password_check.inc' %]
     [% PROCESS 'add_password_check' new_password => 'Newkey' %]
     <script>
index e1b4ba0..5216160 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %] - Forgotten password recovery[% ELSE %]Koha online[% END %] catalog - Forgotten password recovery</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %] - Forgotten password recovery[% ELSE %]Koha online[% END %] catalog - Forgotten password recovery</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 [% BLOCK jsinclude %]
                     [% ELSIF (errAlreadyStartRecovery) %]
                         The process of password recovery has already been started for this account
                         [% IF username %]
-                            ("<strong>[% username %]</strong>")
+                            ("<strong>[% username | html %]</strong>")
                         [% ELSIF email %]
-                            ("<strong>[% email %]</strong>")
+                            ("<strong>[% email | html %]</strong>")
                         [% END %]
                         <br/>You should have received an email with a link to reset your password.
-                        <br/>If you did not receive this email, you can request a new one: <a href="/cgi-bin/koha/opac-password-recovery.pl?resendEmail=true&email=[% email %]&username=[% username %]">Get new password recovery link</a>
+                        <br/>If you did not receive this email, you can request a new one: <a href="/cgi-bin/koha/opac-password-recovery.pl?resendEmail=true&email=[% email | html %]&username=[% username | html %]">Get new password recovery link</a>
                     [% ELSIF (errPassNotMatch) %]
                         The passwords do not match.
                     [% ELSIF password_too_short %]
-                        <li>Password must be at least [% minPasswordLength %] characters long.</li>
+                        <li>Password must be at least [% minPasswordLength | html %] characters long.</li>
                     [% ELSIF password_too_weak %]
                         <li>Password must contain at least one digit, one lowercase and one uppercase.</li>
                     [% ELSIF password_has_whitespaces %]
@@ -91,9 +91,9 @@
                         <fieldset>
                             <p>To reset your password, enter your login or your email address.
                             <label for="username">Login:</label>
-                            <input type="text" id="username" size="40" name="username" value="[% username %]" />
+                            <input type="text" id="username" size="40" name="username" value="[% username | html %]" />
                             <label for="email">Email:</label>
-                            <input type="text" id="email" size="40" name="email" value="[% email %]" />
+                            <input type="text" id="email" size="40" name="email" value="[% email | html %]" />
                             <fieldset class="action">
                                 <input type="submit" value="Submit" class="btn" name="sendEmail" />
                             </fieldset>
                     <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
                         <input type="hidden" name="koha_login_context" value="opac" />
                         <fieldset>
-                            <div class="alert alert-info">The password must contain at least [% minPasswordLength %] characters.</div>
+                            <div class="alert alert-info">The password must contain at least [% minPasswordLength | html %] characters.</div>
                             <label for="password">New password:</label>
                             <input type="password" id="password" size="40" name="password" />
                             <label for="repeatPassword">Confirm new password:</label>
                             <input type="password" id="repeatPassword" size="40" name="repeatPassword" />
                             <fieldset class="action">
-                                <input type="hidden" name="username" value="[% username %]" />
-                                <input type="hidden" name="uniqueKey" value="[% uniqueKey %]" />
+                                <input type="hidden" name="username" value="[% username | html %]" />
+                                <input type="hidden" name="uniqueKey" value="[% uniqueKey | html %]" />
                                 <input type="submit" value="Submit" class="btn" name="passwordReset" />
                             </fieldset>
                          </fieldset>
                     </div>
 [% ELSIF (password_reset_done) %]
                     <div class="alert alert-success">
-                        <p>The password has been changed for user "[% username %]".</p>
+                        <p>The password has been changed for user "[% username | html %]".</p>
                         <a href="/cgi-bin/koha/opac-user.pl">Click here to login.</a>
                     </div>
 [% END %]
index b776289..84a2519 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your privacy management</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your privacy management</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -84,7 +84,7 @@
                                                 [% END %]
                                             </select>
                                             <span class="hint">
-                                                Your guarantor is <i>[% borrower.guarantor.firstname %] [% borrower.guarantor.surname %]</i>
+                                                Your guarantor is <i>[% borrower.guarantor.firstname | html %] [% borrower.guarantor.surname | html %]</i>
                                             </span>
                                         </div>
                                     [% END %]
index bf7f413..f571ebf 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your checkout history</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your checkout history</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>ul.ui-tabs-nav li a, ul.ui-tabs-nav li span.a  { padding:0.6em 1em; }</style>
@@ -11,9 +12,9 @@
 [% INCLUDE 'masthead.inc' %]
 
 [% IF Koha.Preference('AmazonAssocTag') %]
-    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') %]
+    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') | html %]
 [% ELSE %]
-    [% AmazonAssocTag = '' %]
+    [% AmazonAssocTag = '' | html %]
 [% END %]
 
 <div class="main">
                                             [% FOREACH issue IN READING_RECORD %]
                                                 <tr>
                                                     <td style="display:none;">
-                                                      [% IF issue.onsite_checkout %][% issuetype = 'onsite_checkout' %]
-                                                      [% ELSE %][% issuetype = 'standard_checkout' %]
+                                                      [% IF issue.onsite_checkout %][% issuetype = 'onsite_checkout' | html %]
+                                                      [% ELSE %][% issuetype = 'standard_checkout' | html %]
                                                       [% END %]
-                                                      [% issuetype %]
+                                                      [% issuetype | html %]
                                                     </td>
                                                 <td>
                                                     [% IF  OPACAmazonCoverImages %]
                                                         [% IF  issue.normalized_isbn %]
-                                                            <a href="http://www.amazon.com/gp/reader/[% issue.normalized_isbn %][% AmazonAssocTag %]#reader-link"><img border="0" src="https://images-na.ssl-images-amazon.com/images/P/[% issue.normalized_isbn %].01.THUMBZZZ.jpg" alt="" class="item-thumbnail" /></a>
+                                                            <a href="http://www.amazon.com/gp/reader/[% issue.normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link"><img border="0" src="https://images-na.ssl-images-amazon.com/images/P/[% issue.normalized_isbn | html %].01.THUMBZZZ.jpg" alt="" class="item-thumbnail" /></a>
                                                         [% ELSE %]
                                                              <span class="no-image">No cover image available</span>
                                                         [% END %]
 
                                                 [% IF GoogleJackets %]
                                                     [% IF  issue.normalized_isbn %]
-                                                        <div title="[% issue.biblionumber |url %]" class="[% issue.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></div>
+                                                        <div title="[% issue.biblionumber |url %]" class="[% issue.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                                     [% ELSE %]
                                                        <span class="no-image">No cover image available</span>
                                                     [% END %]
                                                 [% END %]
 
                                                 [% IF BakerTaylorEnabled %]
-                                                    [% bt_id = ( issue.normalized_upc || issue.normalized_isbn ) %]
+                                                    [% bt_id = ( issue.normalized_upc || issue.normalized_isbn ) | html %]
                                                     [% IF ( bt_id ) %]
-                                                       <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                                       <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                                                     [% ELSE %]
                                                        <span class="no-image">No cover image available</span>
                                                     [% END %]
                                                 [% END %]
 
                                                 [% IF SyndeticsEnabled && SyndeticsCoverImages %]
-                                                    <img src="https://secure.syndetics.com/index.aspx?isbn=[% issue.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% issue.normalized_upc %]&amp;oclc=[% issue.normalized_oclc %]" alt="" class="item-thumbnail" />
+                                                    <img src="https://secure.syndetics.com/index.aspx?isbn=[% issue.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% issue.normalized_upc | html %]&amp;oclc=[% issue.normalized_oclc | html %]" alt="" class="item-thumbnail" />
                                                 [% END %]
                                                 </td>
                                                 <td>
                                                 [% IF  issue.BiblioDefaultViewmarc %]
-                                                     <a class="title" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title |html %] [% IF  issue.subtitle  %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield %][% END %][% END %]</a>
+                                                     <a class="title" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title | html %] [% IF  issue.subtitle  %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a>
                                                 [% ELSIF issue.BiblioDefaultViewisbd %]
-                                                     <a class="title" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title |html %] [% IF issue.subtitle %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield %][% END %][% END %]</a>
+                                                     <a class="title" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title | html %] [% IF issue.subtitle %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a>
                                                 [% ELSE %]
-                                                     <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title |html %] [% IF issue.subtitle %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield %][% END %][% END %]</a>
+                                                     <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% issue.biblionumber |url %]">[% issue.title | html %] [% IF issue.subtitle %][% FOREACH subtitl IN issue.subtitle %][% subtitl.subfield | html %][% END %][% END %]</a>
                                                 [% END %]
-                                                <span class="item-details">[% issue.author %]</span>
+                                                <span class="item-details">[% issue.author | html %]</span>
                                                 </td>
                                                 <td>
                                                 [% UNLESS ( noItemTypeImages ) %]
                                                     [% IF ( issue.imageurl ) %]
-                                                        <img src="[% issue.imageurl %]" alt="" />
+                                                        <img src="[% issue.imageurl | html %]" alt="" />
                                                     [% END %]
                                                 [% END %]
                                                 <span class="tdlabel">Item type:</span>
-                                                [% issue.translated_description %]</td>
+                                                [% issue.translated_description | html %]</td>
                                                 <td>
                                                 <span class="tdlabel">Call number:</span>
-                                                [% issue.itemcallnumber %]
+                                                [% issue.itemcallnumber | html %]
                                                 </td>
                                                 <td>
                                                     [% IF issue.returndate %]
                                                         <span class="tdlabel">Check-in date:</span>
-                                                        <span title="[% issue.returndate %]">[% issue.returndate | $KohaDates %]</span>
+                                                        <span title="[% issue.returndate | html %]">[% issue.returndate | $KohaDates %]</span>
                                                     [% ELSE %]
                                                         <span title="Checked out"><em>(Checked out)</em></span>
                                                     [% END %]
                                                 </td>
                                                 [% IF OPACMySummaryHTML %]
-                                                    <td>[% issue.MySummaryHTML %]</td>
+                                                    <td>[% issue.MySummaryHTML | $raw %]</td>
                                                 [% END %]
                                                 </tr>
                                             [% END # / FOREACH issue %]
index 464505d..c788de1 100644 (file)
@@ -1,6 +1,7 @@
+[% USE raw %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -38,7 +39,7 @@
 
                             <p id="patron-userid-p">
                                 <span id="patron-userid-label">Username:</span>
-                                <span id="patron-userid">[% borrower.userid %]</span>
+                                <span id="patron-userid">[% borrower.userid | html %]</span>
                             </p>
                             <p id="patron-password-p">
                                 <span id="patron-password-label">Password:</span>
                             [% IF borrower.cardnumber %]
                                 <p id="patron-cardnumber-p">
                                     <span id="patron-cardnumber-label">Card number:</span>
-                                    <span id="patron-cardnumber">[% borrower.cardnumber %]</span>
+                                    <span id="patron-cardnumber">[% borrower.cardnumber | html %]</span>
                                 </p>
                             [% END %]
 
                             <p id="patron-instructions">For your convenience, the login box on this page has been pre-filled with this data. Please log in[% IF OpacPasswordChange %] and change your password[% END %].</p>
                         [% END %]
 
-                        <div id="PatronSelfRegistrationAdditionalInstructions">[% PatronSelfRegistrationAdditionalInstructions %]</div>
+                        <div id="PatronSelfRegistrationAdditionalInstructions">[% PatronSelfRegistrationAdditionalInstructions | $raw %]</div>
                     </div>
 
                 </div> <!-- / .span7/9 -->
@@ -72,7 +73,7 @@
                                                     <legend>Log in to your account:</legend>
                                                     <label for="userid">Login:</label>
                                                     [% IF Koha.Preference('PatronSelfRegistrationPrefillForm') %]
-                                                        <input type="text" id="userid" size="10" name="userid" value="[% borrower.userid %]" />
+                                                        <input type="text" id="userid" size="10" name="userid" value="[% borrower.userid | html %]" />
                                                     [% ELSE %]
                                                         <input type="text" id="userid" size="10" name="userid" value="" />
                                                     [% END %]
@@ -94,7 +95,7 @@
                             [% END # /opacuserlogin %]
                             [% IF ( OpacNavRight ) %]
                                 <div id="opacnavright">
-                                    [% OpacNavRight %]
+                                    [% OpacNavRight | $raw %]
                                 </div>
                             [% END # /OpacNavRight %]
                         </div> <!-- / .span3 -->
index 7b4238a..1a4bdce 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Please confirm your registration</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Please confirm your registration</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -29,7 +29,7 @@
                         <div id="confirmation-pending" class="alert alert-info">
                             <h1>Please confirm your registration</h1>
 
-                            <p>A confirmation email will be sent shortly to the email address <strong>[% email %]</strong>.</p>
+                            <p>A confirmation email will be sent shortly to the email address <strong>[% email | html %]</strong>.</p>
 
                             <p>Your account will not be activated until you follow the link provided in the confirmation email.</p>
                         </div>
index 92a28ae..7647b0d 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
index 53b547d..69e4527 100644 (file)
@@ -2,7 +2,7 @@
 [% USE Branches %]
 [% USE ItemTypes %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Request article</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Request article</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
             [% IF article_request_type == 'bib_only' %]  [% SET mandatory_fields = Koha.Preference('ArticleRequestsMandatoryFieldsRecordOnly') %] [% END %]
             [% IF article_request_type == 'item_only' %] [% SET mandatory_fields = Koha.Preference('ArticleRequestsMandatoryFieldsItemOnly') %]   [% END %]
 
-            <h3>Place article request for [% biblio.title %]</h3>
+            <h3>Place article request for [% biblio.title | html %]</h3>
 
             <form id="place-article-request" method="post" action="/cgi-bin/koha/opac-request-article.pl">
                 <input type="hidden" name="action" value="create" />
-                <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber %]" />
+                <input type="hidden" name="biblionumber" id="biblionumber" value="[% biblio.biblionumber | html %]" />
 
                 <fieldset class="rows">
                     <ul>
                             <select name="branchcode" id="branchcode">
                                 [% FOREACH b IN Branches.all %]
                                     [% IF b.branchcode == Branches.GetLoggedInBranchcode %]
-                                        <option value="[% b.branchcode %]" selected="selected">[% b.branchname %]</option>
+                                        <option value="[% b.branchcode | html %]" selected="selected">[% b.branchname | html %]</option>
                                     [% ELSE %]
-                                        <option value="[% b.branchcode %]">[% b.branchname %]</option>
+                                        <option value="[% b.branchcode | html %]">[% b.branchname | html %]</option>
                                     [% END %]
                                 [% END %]
                             </select>
                                         <td>
                                             [% IF article_request_type == 'item_only' && !checked %]
                                                 [% SET checked = 1 %]
-                                                <input type="radio" name="itemnumber" value="[% item.itemnumber %]" checked="checked" />
+                                                <input type="radio" name="itemnumber" value="[% item.itemnumber | html %]" checked="checked" />
                                             [% ELSE %]
-                                                <input type="radio" name="itemnumber" value="[% item.itemnumber %]" />
+                                                <input type="radio" name="itemnumber" value="[% item.itemnumber | html %]" />
                                             [% END %]
                                         </td>
                                         <td>
-                                            [% ItemTypes.GetDescription( item.itype ) %]
+                                            [% ItemTypes.GetDescription( item.itype ) | html %]
                                         </td>
                                         <td>
-                                            [% item.barcode %]
+                                            [% item.barcode | html %]
                                         </td>
                                         <td>
-                                            [% Branches.GetName( item.homebranch ) %]
+                                            [% Branches.GetName( item.homebranch ) | html %]
                                         </td>
                                         <td>
-                                            [% item.itemcallnumber %]
+                                            [% item.itemcallnumber | html %]
                                         </td>
                                         <td>
-                                            [% item.enumchron %]
+                                            [% item.enumchron | html %]
                                         </td>
                                     </tr>
                                 [% END %]
                 }
             [% END %]
 
-            var mandatory_fields = "[% mandatory_fields %]";
+            var mandatory_fields = "[% mandatory_fields | html %]";
             var m = new Array();
             if ( mandatory_fields ) m = mandatory_fields.split(",");
             var f = new Array();
index ae417ba..1e389a5 100644 (file)
@@ -4,7 +4,7 @@
 [% USE Price %]
 [% USE ItemTypes %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Placing a hold</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Placing a hold</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
 
                         [% IF ( too_much_oweing ) %]
                             <li id="too_much_oweing">
-                                You have unpaid fines. Amount: [% too_much_oweing | $Price %].
+                                You have unpaid fines. Amount: [% too_much_oweing | $Price | html %].
                             </li>
                         [% END %]
 
                         [% IF ( too_many_reserves ) %]
                             <li id="too_many_reserves">
-                                Sorry, you cannot place more than [% too_many_reserves %] holds.
+                                Sorry, you cannot place more than [% too_many_reserves | html %] holds.
                             </li>
                         [% END %]
 
                         [% IF ( bad_biblionumber ) %]
                             <li id="bad_biblionumber">
-                                ERROR: No record found for record id [% bad_biblionumber %].
+                                ERROR: No record found for record id [% bad_biblionumber | html %].
                             </li>
                         [% END %]
 
 
                     [% UNLESS ( message ) %]
                         [% UNLESS ( none_available ) %]
-                            <h3>Confirm holds for:[% INCLUDE 'patron-title.inc' patron = logged_in_user %] ([% logged_in_user.cardnumber %])</h3>
+                            <h3>Confirm holds for:[% INCLUDE 'patron-title.inc' patron = logged_in_user %] ([% logged_in_user.cardnumber | html %])</h3>
                         [% END # / UNLESS none_available %]
 
                         [% IF (RESERVE_CHARGE) %]
                             <div class="alert" id="reserve_fee">
                                 [% IF Koha.Preference('HoldFeeMode') == 'any_time_is_collected' %]
-                                    You will be charged a hold fee of [% RESERVE_CHARGE %] when you collect this item
+                                    You will be charged a hold fee of [% RESERVE_CHARGE | html %] when you collect this item
                                 [% ELSE %]
-                                    You will be charged a hold fee of [% RESERVE_CHARGE %] for placing this hold
+                                    You will be charged a hold fee of [% RESERVE_CHARGE | html %] for placing this hold
                                 [% END %]
                             </div>
                         [% END %]
 
                         [% IF ( new_reserves_allowed ) %]
                             <div id="new_reserves_allowed" class="alert">
-                                <strong>Sorry,</strong> you can only place [% new_reserves_allowed %] more holds. Please uncheck the checkboxes for the items you wish to not place holds on.
+                                <strong>Sorry,</strong> you can only place [% new_reserves_allowed | html %] more holds. Please uncheck the checkboxes for the items you wish to not place holds on.
                             </div>
                         [% END %]
 
                                         <p>
                                             [% IF ( bibitemloo.holdable ) %]
                                                 <input class="reserve_mode" name="reserve_mode" type="hidden" value="single"/>
-                                                <input class="single_bib" name="single_bib" type="hidden" value="[% bibitemloo.biblionumber %]"/>
-                                                <span class="confirmjs_hold" title="[% bibitemloo.biblionumber %]" style="padding:.3em"></span>
+                                                <input class="single_bib" name="single_bib" type="hidden" value="[% bibitemloo.biblionumber | html %]"/>
+                                                <span class="confirmjs_hold" title="[% bibitemloo.biblionumber | html %]" style="padding:.3em"></span>
                                                 <span class="confirm_nonjs">
-                                                    <input type="radio" class="confirmbox checkitem [% bibitemloo.biblionumber %]" name="[% bibitemloo.biblionumber %]" checked="checked" id="single_[% bibitemloo.biblionumber %]" value="any" />
-                                                    <label class="confirm_label" for="single_[% bibitemloo.biblionumber %]">Place a hold on </label>
+                                                    <input type="radio" class="confirmbox checkitem [% bibitemloo.biblionumber | html %]" name="[% bibitemloo.biblionumber | html %]" checked="checked" id="single_[% bibitemloo.biblionumber | html %]" value="any" />
+                                                    <label class="confirm_label" for="single_[% bibitemloo.biblionumber | html %]">Place a hold on </label>
                                                 </span>
                                             [% END # / bibitemloo.holdable %]
 
-                                            <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% bibitemloo.biblionumber %]">
-                                                [% bibitemloo.title |html %]
+                                            <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% bibitemloo.biblionumber | html %]">
+                                                [% bibitemloo.title | html %]
                                                 [% IF ( bibitemloo.subtitle ) %]
                                                     [% FOREACH subtitl IN bibitemloo.subtitle %]
-                                                        [% subtitl.subfield %]
+                                                        [% subtitl.subfield | html %]
                                                     [% END %]
                                                 [% END %]
                                             </a>
-                                            [% IF ( bibitemloo.author ) %],  by [% bibitemloo.author %][% END %]
+                                            [% IF ( bibitemloo.author ) %],  by [% bibitemloo.author | html %][% END %]
                                         </p>
 
                                         [% UNLESS ( bibitemloo.holdable ) %]
                                                     [% UNLESS ( item_level_itypes ) %]
                                                         <li class="itype">
                                                             <span class="label">Item type: </span>
-                                                            [% IF ( bibitemloo.imageurl ) %]<img src="[% bibitemloo.imageurl %]" alt="" />[% END %]
-                                                            [% bibitemloo.translated_description %]
+                                                            [% IF ( bibitemloo.imageurl ) %]<img src="[% bibitemloo.imageurl | html %]" alt="" />[% END %]
+                                                            [% bibitemloo.translated_description | html %]
                                                         </li>
                                                     [% END %]
 
                                                     [% IF OPACShowHoldQueueDetails == 'holds_priority' || OPACShowHoldQueueDetails == 'priority' %]
                                                         <li class="priority">
                                                             <span class="label">Your priority: </span>
-                                                            [% bibitemloo.rank %]
+                                                            [% bibitemloo.rank | html %]
                                                         </li>
                                                     [% END %]
 
                                                     [% IF OPACShowHoldQueueDetails == 'holds_priority' || OPACShowHoldQueueDetails == 'holds' %]
                                                         <li class="holds-count">
                                                             <span class="label">Number of holds: </span>
-                                                            [% bibitemloo.reservecount %]
+                                                            [% bibitemloo.reservecount | html %]
                                                         </li>
                                                     [% END %]
 
                                                     [% UNLESS ( singleBranchMode ) %]
                                                         [% IF ( bibitemloo.holdable && choose_branch ) %]
                                                             <li class="branch">
-                                                                <label for="branch_[% bibitemloo.biblionumber %]">Pick up location:</label>
+                                                                <label for="branch_[% bibitemloo.biblionumber | html %]">Pick up location:</label>
                                                                 [% UNLESS ( bibitemloo.holdable ) %]
-                                                                    <select name="branch" id="branch_[% bibitemloo.biblionumber %]" disabled="disabled">
+                                                                    <select name="branch" id="branch_[% bibitemloo.biblionumber | html %]" disabled="disabled">
                                                                         [% PROCESS options_for_libraries libraries => Branches.all( selected => branch ) %]
                                                                     </select>
                                                                 [% ELSE %]
                                                                     [% SET at_least_one_library_not_available_for_pickup = 0 %]
-                                                                    <select name="branch" id="branch_[% bibitemloo.biblionumber %]">
+                                                                    <select name="branch" id="branch_[% bibitemloo.biblionumber | html %]">
                                                                         [% FOREACH library IN Branches.all( selected => branch) %]
                                                                             [% SET pickup_available_at = bibitemloo.not_available_at.grep(library.branchcode).size ? 0 : 1 %]
                                                                             [% IF library.selected AND pickup_available_at %]
-                                                                                <option value="[% library.branchcode %]" selected="selected" >[% library.branchname %]</option>
+                                                                                <option value="[% library.branchcode | html %]" selected="selected" >[% library.branchname | html %]</option>
                                                                             [% ELSIF pickup_available_at %]
-                                                                                <option value="[% library.branchcode %]">[% library.branchname %]</option>
+                                                                                <option value="[% library.branchcode | html %]">[% library.branchname | html %]</option>
                                                                             [% ELSE %]
                                                                                 [% SET at_least_one_library_not_available_for_pickup = 1 %]
-                                                                                <option value="[% library.branchcode %]" disabled="disabled" title="At least one item is available at this library">[% library.branchname %]</option>
+                                                                                <option value="[% library.branchcode | html %]" disabled="disabled" title="At least one item is available at this library">[% library.branchname | html %]</option>
                                                                             [% END %]
                                                                         [% END %]
                                                                     </select>
                                                     [% END # / UNLESS singleBranchMode %]
                                                 </ul>
 
-                                                <a class="toggle-hold-options" id="toggle-hold-options-[% bibitemloo.biblionumber %]" style="display:none;" href="#">Show more options</a>
+                                                <a class="toggle-hold-options" id="toggle-hold-options-[% bibitemloo.biblionumber | html %]" style="display:none;" href="#">Show more options</a>
 
-                                                <div id="hold-options-[% bibitemloo.biblionumber %]" class="hold-options">
+                                                <div id="hold-options-[% bibitemloo.biblionumber | html %]" class="hold-options">
 
                                                     <ul>
                                                         [% IF ( reserve_in_future ) %]
                                                             <li>
-                                                                <label for="from[% bibitemloo.biblionumber %]">Hold starts on date:</label>
-                                                                <input name="reserve_date_[% bibitemloo.biblionumber %]" id="from[% bibitemloo.biblionumber %]" size="10" class="holddatefrom"/>
-                                                                <span class="date-format from" data-biblionumber="[% bibitemloo.biblionumber %]">[% INCLUDE 'date-format.inc' %]</span>
+                                                                <label for="from[% bibitemloo.biblionumber | html %]">Hold starts on date:</label>
+                                                                <input name="reserve_date_[% bibitemloo.biblionumber | html %]" id="from[% bibitemloo.biblionumber | html %]" size="10" class="holddatefrom"/>
+                                                                <span class="date-format from" data-biblionumber="[% bibitemloo.biblionumber | html %]">[% INCLUDE 'date-format.inc' %]</span>
                                                             </li>
                                                         [% END %]
 
                                                         <li>
-                                                            <label for="to[% bibitemloo.biblionumber %]">Hold not needed after:</label>
-                                                            <input name="expiration_date_[% bibitemloo.biblionumber %]" id="to[% bibitemloo.biblionumber %]" size="10" class="holddateto" />
-                                                            <span class="date-format to" data-biblionumber="[% bibitemloo.biblionumber %]">[% INCLUDE 'date-format.inc' %]</span>
+                                                            <label for="to[% bibitemloo.biblionumber | html %]">Hold not needed after:</label>
+                                                            <input name="expiration_date_[% bibitemloo.biblionumber | html %]" id="to[% bibitemloo.biblionumber | html %]" size="10" class="holddateto" />
+                                                            <span class="date-format to" data-biblionumber="[% bibitemloo.biblionumber | html %]">[% INCLUDE 'date-format.inc' %]</span>
                                                         </li>
 
                                                         [% IF Koha.Preference('AllowHoldItemTypeSelection') %]
-                                                            [% itemtypes = [] %]
+                                                            [% itemtypes = [] | html %]
                                                             [% FOREACH item IN bibitemloo.itemLoop %]
-                                                                [% itemtypes.push( item.itype ) %]
+                                                                [% itemtypes.push( item.itype ) | html %]
                                                             [%- END %]
                                                             <li>
                                                                 <label for="itemtype">Request specific item type:</label>
                                                                 <select name="itemtype" size="1" id="itemtype">
                                                                     <option value="">Any item type</option>
                                                                     [% FOREACH i IN itemtypes.unique.sort %]
-                                                                        <option value="[% i %]">[% ItemTypes.GetDescription( i ) %]</option>
+                                                                        <option value="[% i | html %]">[% ItemTypes.GetDescription( i ) | html %]</option>
                                                                     [%- END %]
                                                                 </select>
                                                             </li>
 
                                                         [% IF ( OpacHoldNotes ) %]
                                                             <li>
-                                                                <div class="notesrow" id="notesrow_[% bibitemloo.biblionumber %]">
-                                                                    <label for="holdnotes_[% bibitemloo.biblionumber %]">Hold notes:</label>
+                                                                <div class="notesrow" id="notesrow_[% bibitemloo.biblionumber | html %]">
+                                                                    <label for="holdnotes_[% bibitemloo.biblionumber | html %]">Hold notes:</label>
                                                                     [% IF bibitemloo.reqholdnotes %]
-                                                                        <span id="reqholdnotes_[% bibitemloo.biblionumber %]">Please enter additional information about the requested item:</span>
+                                                                        <span id="reqholdnotes_[% bibitemloo.biblionumber | html %]">Please enter additional information about the requested item:</span>
                                                                     [% END %]
-                                                                    <textarea id="holdnotes_[% bibitemloo.biblionumber %]" rows="2" cols="30" name="notes_[% bibitemloo.biblionumber %]" >[% bibitemloo.holdnotes %]</textarea>
+                                                                    <textarea id="holdnotes_[% bibitemloo.biblionumber | html %]" rows="2" cols="30" name="notes_[% bibitemloo.biblionumber | html %]" >[% bibitemloo.holdnotes | html %]</textarea>
                                                                 </div>
                                                             </li>
                                                         [% END # / IF OpacHoldNotes %]
                                                             <!-- ITEM HOLDS -->
                                                             <li class="lradio place_on_type" style="display:none;">
                                                                 [% IF NOT bibitemloo.force_hold %]
-                                                                    <label class="radio inline" for="reqany_[% bibitemloo.biblionumber %]">Next available item</label>
-                                                                    <input type="radio" name="reqtype_[% bibitemloo.biblionumber %]"
-                                                                            id="reqany_[% bibitemloo.biblionumber %]"
+                                                                    <label class="radio inline" for="reqany_[% bibitemloo.biblionumber | html %]">Next available item</label>
+                                                                    <input type="radio" name="reqtype_[% bibitemloo.biblionumber | html %]"
+                                                                            id="reqany_[% bibitemloo.biblionumber | html %]"
                                                                             class="selectany"
                                                                             value="Any"
                                                                             checked="checked"
                                                                     />
                                                                 [% END %]
-                                                                <label class="radio inline" for="reqspecific_[% bibitemloo.biblionumber %]">A specific item</label>
-                                                                <input type="radio" name="reqtype_[% bibitemloo.biblionumber %]"
-                                                                       id="reqspecific_[% bibitemloo.biblionumber %]"
+                                                                <label class="radio inline" for="reqspecific_[% bibitemloo.biblionumber | html %]">A specific item</label>
+                                                                <input type="radio" name="reqtype_[% bibitemloo.biblionumber | html %]"
+                                                                       id="reqspecific_[% bibitemloo.biblionumber | html %]"
                                                                        class="selectspecific"
                                                                        value="Specific"
                                                                 />
                                                     </ul>
 
                                                     [% IF bibitemloo.itemholdable %]
-                                                        <table class="copiesrow table table-bordered table-striped" id="copiesrow_[% bibitemloo.biblionumber %]">
+                                                        <table class="copiesrow table table-bordered table-striped" id="copiesrow_[% bibitemloo.biblionumber | html %]">
                                                             <caption>Select a specific item:</caption>
                                                             <tr>
                                                                 <th>Copy number</th>
                                                             </tr>
 
                                                             [% FOREACH itemLoo IN bibitemloo.itemLoop %]
-                                                                <tr class="[% itemLoo.backgroundcolor %]">
+                                                                <tr class="[% itemLoo.backgroundcolor | html %]">
                                                                     <td class="copynumber">
                                                                         [% IF ( itemLoo.available ) %]
-                                                                            <input type="radio" class="checkitem checkitem_[% bibitemloo.biblionumber %]" name="checkitem_[% bibitemloo.biblionumber %]" value="[% itemLoo.itemnumber %]" />
+                                                                            <input type="radio" class="checkitem checkitem_[% bibitemloo.biblionumber | html %]" name="checkitem_[% bibitemloo.biblionumber | html %]" value="[% itemLoo.itemnumber | html %]" />
                                                                         [% ELSE %]
-                                                                            <input disabled="disabled" type="radio" class="checkitem" name="checkitem" value="[% itemLoo.itemnumber %]"
+                                                                            <input disabled="disabled" type="radio" class="checkitem" name="checkitem" value="[% itemLoo.itemnumber | html %]"
                                                                                    style="display:none;" />
-                                                                            <img src="[% interface %]/lib/famfamfam/silk/cross.png" alt="Cannot be put on hold" title="Cannot be put on hold" />
+                                                                            <img src="[% interface | html %]/lib/famfamfam/silk/cross.png" alt="Cannot be put on hold" title="Cannot be put on hold" />
                                                                         [% END %]
 
                                                                         [% IF ( itemLoo.copynumber ) %]
-                                                                            [% itemLoo.copynumber %]
+                                                                            [% itemLoo.copynumber | html %]
                                                                         [% END %]
                                                                     </td>
 
                                                                         <td class="itype">
                                                                             [% UNLESS ( noItemTypeImages ) %]
                                                                                 [% IF ( itemLoo.imageurl ) %]
-                                                                                    <img src="[% itemLoo.imageurl %]" alt="" />
+                                                                                    <img src="[% itemLoo.imageurl | html %]" alt="" />
                                                                                 [% END %]
                                                                             [% END %]
-                                                                            [% itemLoo.translated_description %]
+                                                                            [% itemLoo.translated_description | html %]
                                                                         </td>
                                                                     [% END %]
 
-                                                                    <td class="barcode">[% itemLoo.barcode %]</td>
+                                                                    <td class="barcode">[% itemLoo.barcode | html %]</td>
                                                                     [% UNLESS ( singleBranchMode ) %]
-                                                                        <td class="homebranch">[% Branches.GetName( itemLoo.homeBranchName ) %]</td>
-                                                                        <td class="holdingbranch">[% Branches.GetName( itemLoo.holdingBranchName ) %]</td>
+                                                                        <td class="homebranch">[% Branches.GetName( itemLoo.homeBranchName ) | html %]</td>
+                                                                        <td class="holdingbranch">[% Branches.GetName( itemLoo.holdingBranchName ) | html %]</td>
                                                                     [% END %]
-                                                                    <td class="call_no">[% itemLoo.callNumber %]</td>
+                                                                    <td class="call_no">[% itemLoo.callNumber | html %]</td>
                                                                     [% IF ( itemdata_enumchron ) %]
-                                                                        <td class="vol_info">[% itemLoo.enumchron %]</td>
+                                                                        <td class="vol_info">[% itemLoo.enumchron | html %]</td>
                                                                     [% END %]
                                                                     <td class="information">
                                                                         [% IF ( itemLoo.dateDue ) %]
-                                                                            <span class="checkedout">Due [% itemLoo.dateDue %]</span>
+                                                                            <span class="checkedout">Due [% itemLoo.dateDue | html %]</span>
                                                                         [% ELSIF ( itemLoo.transfertwhen ) %]
-                                                                            <span class="intransit">In transit from [% Branches.GetName( itemLoo.transfertfrom ) %] to [% Branches.GetName( itemLoo.transfertto ) %] since [% itemLoo.transfertwhen %]</span>
+                                                                            <span class="intransit">In transit from [% Branches.GetName( itemLoo.transfertfrom ) | html %] to [% Branches.GetName( itemLoo.transfertto ) | html %] since [% itemLoo.transfertwhen | html %]</span>
                                                                         [% END %]
 
                                                                         [% IF ( itemLoo.message ) %]
                                                                         [% END %]
 
                                                                         [% IF ( itemLoo.notforloan ) %]
-                                                                            <span class="notforloan">Not for loan ([% itemLoo.notforloanvalue %])</span>
+                                                                            <span class="notforloan">Not for loan ([% itemLoo.notforloanvalue | html %])</span>
                                                                         [% END %]
 
                                                                         [% IF ( itemLoo.reservedate ) %]
                                                                                 [% ELSE %]
                                                                                     expected at
                                                                                 [% END %]
-                                                                                [% itemLoo.ExpectedAtLibrary %] since
+                                                                                [% itemLoo.ExpectedAtLibrary | html %] since
                                                                                 [% IF ( itemLoo.waitingdate ) %]
                                                                                     [% itemLoo.waitingdate | $KohaDates %]
                                                                                 [% ELSE %]
                                                                                     [% IF ( itemLoo.reservedate ) %]
-                                                                                        [% itemLoo.reservedate %]
+                                                                                        [% itemLoo.reservedate | html %]
                                                                                     [% END %]
                                                                                 [% END %].
                                                                             </span>
                                                                     </td>
                                                                 </tr>
                                                             [% END # / FOREACH itemLoo IN bibitemloo.itemLoop%]
-                                                        </table> <!-- / #copiesrow_[% bibitemloo.biblionumber %] -->
+                                                        </table> <!-- / #copiesrow_[% bibitemloo.biblionumber | html %] -->
                                                     [% END # / IF ( bibitemloo.itemholdable )%]
-                                                </div> <!-- / #hold-options-[% bibitemloo.biblionumber %] -->
+                                                </div> <!-- / #hold-options-[% bibitemloo.biblionumber | html %] -->
                                             </fieldset>
                                         [% END # / IF ( bibitemloo.holdable ) %]
                                     </div> <!-- / .holdrow -->
 
         [% FOREACH bibitemloo IN bibitemloop %]
           [% IF bibitemloo.force_hold %]
-            $("#toggle-hold-options-[% bibitemloo.biblionumber %]").click();
-            $("#reqspecific_[% bibitemloo.biblionumber %]").click();
-            $("#copiesrow_[% bibitemloo.biblionumber %]").show();
+            $("#toggle-hold-options-[% bibitemloo.biblionumber | html %]").click();
+            $("#reqspecific_[% bibitemloo.biblionumber | html %]").click();
+            $("#copiesrow_[% bibitemloo.biblionumber | html %]").show();
           [% END %]
           [% IF bibitemloo.reqholdnotes %]
-              $("#holdnotes_[% bibitemloo.biblionumber %]").attr( 'required', true );
+              $("#holdnotes_[% bibitemloo.biblionumber | html %]").attr( 'required', true );
           [% END %]
         [% END %]
 
             var selections = "";
 
             [% IF new_reserves_allowed %]
-                if ($(".confirmjs:checked").size() > [% new_reserves_allowed %] ) {
+                if ($(".confirmjs:checked").size() > [% new_reserves_allowed | html %] ) {
                     alert(MSG_MAX_HOLDS_EXCEEDED);
                     return false;
                 }
         [% FOREACH bibitemloo IN bibitemloop %]
             [% IF ( bibitemloo.holdable ) %]
                 // http://jqueryui.com/demos/datepicker/#date-range
-                var dates[% bibitemloo.biblionumber %] = $( "#from[% bibitemloo.biblionumber %], #to[% bibitemloo.biblionumber %]" ).datepicker({
+                var dates[% bibitemloo.biblionumber | html %] = $( "#from[% bibitemloo.biblionumber | html %], #to[% bibitemloo.biblionumber | html %]" ).datepicker({
                     minDate: 0,
                     changeMonth: true,
                     numberOfMonths: 1,
                     onSelect: function( selectedDate ) {
-                        var option = this.id == "from[% bibitemloo.biblionumber %]" ? "minDate" : "maxDate",
+                        var option = this.id == "from[% bibitemloo.biblionumber | html %]" ? "minDate" : "maxDate",
                             instance = $( this ).data( "datepicker" );
                             date = $.datepicker.parseDate(
                                 instance.settings.dateFormat ||
                                 $.datepicker._defaults.dateFormat,
                                 selectedDate, instance.settings );
-                        dates[% bibitemloo.biblionumber %].not( this ).datepicker( "option", option, date );
+                        dates[% bibitemloo.biblionumber | html %].not( this ).datepicker( "option", option, date );
                     }
                 });
             [% END %]
index fbb63a2..6a50b1b 100644 (file)
@@ -1,15 +1,16 @@
+[% USE raw %]
 [% USE Koha %]
 
 [% INCLUDE 'doc-head-open.inc' %]
 <title>
     [% IF ( LibraryNameTitle ) %]
-        [% LibraryNameTitle %]
+        [% LibraryNameTitle | html %]
     [% ELSE %]
         Koha online
     [% END %]
     catalog
     [% IF RestrictedPageTitle %]
-        &rsaquo; [% RestrictedPageTitle %]
+        &rsaquo; [% RestrictedPageTitle | html %]
     [% END %]
 </title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -22,7 +23,7 @@
     <ul class="breadcrumb">
         <li><a href="/cgi-bin/koha/opac-main.pl">Home</a></li>
         [% IF Koha.Preference('RestrictedPageTitle') %]
-            <li> <span class="divider">&rsaquo;</span> [% Koha.Preference('RestrictedPageTitle') %]</li>
+            <li> <span class="divider">&rsaquo;</span> [% Koha.Preference('RestrictedPageTitle') | html %]</li>
         [% END %]
     </ul>
 
@@ -36,9 +37,9 @@
             <div class="span10">
                 <div id="restrictedcontent" class="maincontent">
                     [% IF Koha.Preference('RestrictedPageTitle') %]
-                        <h1>[% Koha.Preference('RestrictedPageTitle') %]</h1>
+                        <h1>[% Koha.Preference('RestrictedPageTitle') | html %]</h1>
                     [% END %]
-                    [% Koha.Preference('RestrictedPageContent') %]
+                    [% Koha.Preference('RestrictedPageContent') | $raw %]
                 </div>
             </div> <!-- / .span10 -->
         </div> <!-- / .row-fluid -->
index f12ef5d..25c5bb5 100644 (file)
@@ -1,7 +1,8 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;
 [% IF ( searchdesc ) %]
     Results of search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]
 [% ELSE %]
@@ -10,7 +11,7 @@
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 <link rel="alternate" type="application/rss+xml" title="Koha - RSS"
-href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
+href="/cgi-bin/koha/opac-rss.pl?[% query_cgi | html %][% limit_cgi | html %]" />
 
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='results-grouped' %]
@@ -34,7 +35,7 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
                     <div class="span12">
                         <div class="alert">
                             <h4>Error:</h4>
-                            <p>[% query_error %]</p>
+                            <p>[% query_error | html %]</p>
                         </div>
                     </div> <!-- / .span12 -->
                 </div> <!-- / .row-fluid -->
@@ -105,11 +106,11 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
                                                 [% FOREACH SEARCH_RESULT IN SEARCH_RESULTS %]
                                                 <tr>
                                                     <td>
-                                                        <a href="/cgi-bin/koha/opac-search.pl?q=[% SEARCH_RESULT.scan_use |url %]&quot;[% SEARCH_RESULT.title |url %]&quot;">[% SEARCH_RESULT.title |html %]</a>
+                                                        <a href="/cgi-bin/koha/opac-search.pl?q=[% SEARCH_RESULT.scan_use |url %]&quot;[% SEARCH_RESULT.title |url %]&quot;">[% SEARCH_RESULT.title | html %]</a>
                                                     </td>
                                                     <td>
                                                         [% FOREACH subtitl IN SEARCH_RESULT.subtitle %]
-                                                            [% subtitl.subfield %]
+                                                            [% subtitl.subfield | html %]
                                                         [% END %]
                                                     </td>
                                                 </tr>
@@ -123,10 +124,10 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
                                     <form action="/cgi-bin/koha/opac-search.pl" method="get" name="bookbag_form" id="bookbag_form">
                                         [% IF ( searchdesc ) %]
                                             [% FOREACH QUERY_INPUT IN QUERY_INPUTS %]
-                                                <input type="hidden" name="[% QUERY_INPUT.input_name |html %]" value="[% QUERY_INPUT.input_value |html %]"/>
+                                                <input type="hidden" name="[% QUERY_INPUT.input_name | html %]" value="[% QUERY_INPUT.input_value | html %]"/>
                                             [% END %]
                                             [% FOREACH LIMIT_INPUT IN LIMIT_INPUTS %]
-                                                <input type="hidden" name="[% LIMIT_INPUT.input_name |html %]" value="[% LIMIT_INPUT.input_value |html %]"/>
+                                                <input type="hidden" name="[% LIMIT_INPUT.input_name | html %]" value="[% LIMIT_INPUT.input_value | html %]"/>
                                             [% END %]
                                         [% END %]
 
@@ -149,7 +150,7 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
                                             </tr>
                                             <!-- Actual Search Results -->
                                             [% FOREACH SEARCH_RESULT IN SEARCH_RESULTS %]
-                                                <tr class="grouplabel"><td colspan="3">[% SEARCH_RESULT.group_label %]</td></tr>
+                                                <tr class="grouplabel"><td colspan="3">[% SEARCH_RESULT.group_label | html %]</td></tr>
                                                 [% FOREACH GROUP_RESULT IN SEARCH_RESULT.GROUP_RESULTS %]
                                                     [% IF ( GROUP_RESULT.even ) %]
                                                         <tr class="highlight">
@@ -158,89 +159,89 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
                                                     [% END %]
                                                         <td>
                                                             [% IF ( OPACAmazonCoverImages ) %]
-                                                                <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]">[% IF ( GROUP_RESULT.isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% GROUP_RESULT.isbn %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />[% ELSE %]<img src="http://g-images.amazon.com/images/G/01/x-site/icons/no-img-sm.gif" alt="" class="thumbnail" />[% END %]
+                                                                <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]">[% IF ( GROUP_RESULT.isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% GROUP_RESULT.isbn | html %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />[% ELSE %]<img src="http://g-images.amazon.com/images/G/01/x-site/icons/no-img-sm.gif" alt="" class="thumbnail" />[% END %]
                                                             </a>
                                                         [% ELSE %]
                                                             [% UNLESS ( noItemTypeImages ) %]
                                                                 [% IF ( GROUP_RESULT.imageurl ) %]
-                                                                    <img src="[% GROUP_RESULT.imageurl %]" title="[% GROUP_RESULT.description %]" />
+                                                                    <img src="[% GROUP_RESULT.imageurl | html %]" title="[% GROUP_RESULT.description | html %]" />
                                                                 [% END %]
                                                             [% END %]
-                                                            [% GROUP_RESULT.description %]
+                                                            [% GROUP_RESULT.description | html %]
                                                         [% END %]
                                                         </td>
                                                         <td>
-                                                            [% GROUP_RESULT.result_number %].
+                                                            [% GROUP_RESULT.result_number | html %].
                                                             [% IF ( GROUP_RESULT.BiblioDefaultViewmarc ) %]
-                                                                <a class="title" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title %]
+                                                                <a class="title" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title | html %]
                                                             [% ELSE %]
                                                                 [% IF ( GROUP_RESULT.BiblioDefaultViewisbd ) %]
-                                                                    <a class="title" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title %]
+                                                                    <a class="title" href="/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title | html %]
                                                                 [% ELSE %]
-                                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title %]
+                                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]" title="View details for this title">[% GROUP_RESULT.title | html %]
                                                                 [% END %]
                                                                 [% FOREACH subtitl IN GROUP_RESULT.subtitle %]
-                                                                    [% subtitl.subfield %]
+                                                                    [% subtitl.subfield | html %]
                                                                 [% END %]
                                                                 </a>
                                                             [% END # / IF GROUP_RESULT.BiblioDefaultViewmarc %]
                                                             [% IF ( GROUP_RESULT.author ) %]
-                                                                by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% GROUP_RESULT.author |url %]" title="Search for works by this author">[% GROUP_RESULT.author %]</a>
+                                                                by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% GROUP_RESULT.author |url %]" title="Search for works by this author">[% GROUP_RESULT.author | html %]</a>
                                                             [% ELSE %]
                                                                 &nbsp;
                                                             [% END %]
                                                             <p>
-                                                                [% IF ( GROUP_RESULT.publicationyear ) %] - [% GROUP_RESULT.publicationyear %][% END %]
-                                                                [% IF ( GROUP_RESULT.publishercode ) %]- [% GROUP_RESULT.publishercode %][% END %]
-                                                                [% IF ( GROUP_RESULT.place ) %] ; [% GROUP_RESULT.place %][% END %]
-                                                                [% IF ( GROUP_RESULT.pages ) %] - [% GROUP_RESULT.pages %][% END %]
-                                                                [% IF ( GROUP_RESULT.notes ) %] : [% GROUP_RESULT.notes %][% END %]
-                                                                [% IF ( GROUP_RESULT.size ) %] ; [% GROUP_RESULT.size %][% END %]
-                                                                [% IF ( GROUP_RESULT.timestamp ) %] <i>(modified on [% GROUP_RESULT.timestamp %])</i>[% END %]
+                                                                [% IF ( GROUP_RESULT.publicationyear ) %] - [% GROUP_RESULT.publicationyear | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.publishercode ) %]- [% GROUP_RESULT.publishercode | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.place ) %] ; [% GROUP_RESULT.place | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.pages ) %] - [% GROUP_RESULT.pages | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.notes ) %] : [% GROUP_RESULT.notes | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.size ) %] ; [% GROUP_RESULT.size | html %][% END %]
+                                                                [% IF ( GROUP_RESULT.timestamp ) %] <i>(modified on [% GROUP_RESULT.timestamp | html %])</i>[% END %]
                                                             </p>
                                                             [% IF ( GROUP_RESULT.searchhighlightblob ) %]
-                                                                <p class="searchhighlightblob">[% GROUP_RESULT.searchhighlightblob %]</p>
+                                                                <p class="searchhighlightblob">[% GROUP_RESULT.searchhighlightblob | html %]</p>
                                                             [% END %]
                                                             <p class="availability">
                                                                 [% IF ( GROUP_RESULT.available_items_loop ) %]
                                                                     <span class="available"><strong>Items available at:</strong>
                                                                         [% FOREACH available_items_loo IN GROUP_RESULT.available_items_loop %]
-                                                                            [% IF ( available_items_loo.branchname ) %][% available_items_loo.branchname %][% END %]
+                                                                            [% IF ( available_items_loo.branchname ) %][% available_items_loo.branchname | html %][% END %]
                                                                             [% IF ( OPACItemsResultsDisplay ) %]
-                                                                                [% IF ( available_items_loo.location ) %][% available_items_loo.location %][% END %]
-                                                                                [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/opac-search.pl?q=callnum:[% available_items_loo.itemcallnumber |url %]">[% available_items_loo.itemcallnumber %]</a>][% END %]
+                                                                                [% IF ( available_items_loo.location ) %][% available_items_loo.location | html %][% END %]
+                                                                                [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/opac-search.pl?q=callnum:[% available_items_loo.itemcallnumber |url %]">[% available_items_loo.itemcallnumber | html %]</a>][% END %]
                                                                             [% END %]
-                                                                            ([% available_items_loo.count %]),
+                                                                            ([% available_items_loo.count | html %]),
                                                                         [% END # / FOREACH available_items_loo %]
                                                                     </span>
                                                                 [% ELSE %]
                                                                     <span class="unavailable">No items available:</span>
                                                                 [% END # / IF GROUP_RESULT.available_items_loop %]
                                                                 <span class="unavailable">
-                                                                    [% IF ( GROUP_RESULT.onloancount ) %] Checked out ([% GROUP_RESULT.onloancount %]), [% END %]
-                                                                    [% IF ( GROUP_RESULT.withdrawncount ) %] Withdrawn ([% GROUP_RESULT.withdrawncount %]), [% END %]
-                                                                    [% IF ( GROUP_RESULT.itemlostcount ) %] Lost ([% GROUP_RESULT.itemlostcount %]),[% END %]
-                                                                    [% IF ( GROUP_RESULT.damagedcount ) %] Damaged ([% GROUP_RESULT.damagedcount %]),[% END %]
-                                                                    [% IF ( GROUP_RESULT.orderedcount ) %] On order ([% GROUP_RESULT.orderedcount %]),[% END %]
-                                                                    [% IF ( GROUP_RESULT.intransitcount ) %] In transit ([% GROUP_RESULT.intransitcount %]),[% END %]
+                                                                    [% IF ( GROUP_RESULT.onloancount ) %] Checked out ([% GROUP_RESULT.onloancount | html %]), [% END %]
+                                                                    [% IF ( GROUP_RESULT.withdrawncount ) %] Withdrawn ([% GROUP_RESULT.withdrawncount | html %]), [% END %]
+                                                                    [% IF ( GROUP_RESULT.itemlostcount ) %] Lost ([% GROUP_RESULT.itemlostcount | html %]),[% END %]
+                                                                    [% IF ( GROUP_RESULT.damagedcount ) %] Damaged ([% GROUP_RESULT.damagedcount | html %]),[% END %]
+                                                                    [% IF ( GROUP_RESULT.orderedcount ) %] On order ([% GROUP_RESULT.orderedcount | html %]),[% END %]
+                                                                    [% IF ( GROUP_RESULT.intransitcount ) %] In transit ([% GROUP_RESULT.intransitcount | html %]),[% END %]
                                                                 </span>
                                                             </p>
                                                             <p>
                                                                 [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %]
                                                                     [% UNLESS ( GROUP_RESULT.norequests ) %]
                                                                         [% IF Koha.Preference( 'opacuserlogin' ) == 1 && GROUP_RESULT.holdable %]
-                                                                            <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber %]">Place hold</a><!-- add back when available 0 holds in queue-->
+                                                                            <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber | html %]">Place hold</a><!-- add back when available 0 holds in queue-->
                                                                         [% END %]
                                                                     [% END %]
                                                                 [% END %]
 
                                                                 [% IF ( ( Koha.Preference( 'opacbookbag' ) == 1 ) || ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %]
-                                                                    <input type="checkbox" name="biblionumber" value="[% GROUP_RESULT.biblionumber %]" title="Click to add to cart" /> <label for="bib[% GROUP_RESULT.biblionumber %]">
+                                                                    <input type="checkbox" name="biblionumber" value="[% GROUP_RESULT.biblionumber | html %]" title="Click to add to cart" /> <label for="bib[% GROUP_RESULT.biblionumber | html %]">
                                                                 [% END %]
-                                                                <img src="[% themelang %]/images/[% GROUP_RESULT.itemtype %].gif" alt="[% GROUP_RESULT.ccode %]" title="[% GROUP_RESULT.ccode %]" />
+                                                                <img src="[% themelang | html %]/images/[% GROUP_RESULT.itemtype | html %].gif" alt="[% GROUP_RESULT.ccode | html %]" title="[% GROUP_RESULT.ccode | html %]" />
                                                                 [% IF ( ( Koha.Preference( 'opacbookbag' ) = 1 ) || ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %]</label>[% END %]
                                                                 [% IF ( GROUP_RESULT.classification ) %]
-                                                                    <a href="/cgi-bin/koha/opac-search.pl?q=callnum:[% GROUP_RESULT.classification |url %]"> [% GROUP_RESULT.classification %] </a>
+                                                                    <a href="/cgi-bin/koha/opac-search.pl?q=callnum:[% GROUP_RESULT.classification |url %]"> [% GROUP_RESULT.classification | html %] </a>
                                                                 [% END %]
                                                             </p>
                                                         </td>
@@ -279,7 +280,7 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 <script>
 //<![CDATA[
 
@@ -298,7 +299,7 @@ $(document).ready(function(){
     });
     $("span.clearall").html("<a id=\"CheckNone\" href=\"#\">" + _("Clear all") + "</a>");
     $("span.checkall").html("<a id=\"CheckAll\" href=\"#\">" + _("Select all") + "</a>");
-    $("span.addto").html("<label for=\"addto\">" + _("Add to: ") + "</label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF Koha.Preference( 'opacbookbag' ) == 1 %]<option value=\"addtocart\">" + _("Cart") + "</option>[% END %][% IF Koha.Preference( 'virtualshelves' ) == 1 %][% IF ( loggedinusername ) %]<optgroup label=\"" + _("Lists:") + "\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber %]\" value=\"addtolist\">[% barshelvesloo.shelfname | html %]</option>[% END %][% END %][% END %]<option value=\"newlist\">" + _("[ New list ]") + "</option></optgroup>[% ELSE %]<option value=\"newlist\">" + _("List") + "</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"" + _("Save") + "\" />");
+    $("span.addto").html("<label for=\"addto\">" + _("Add to: ") + "</label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF Koha.Preference( 'opacbookbag' ) == 1 %]<option value=\"addtocart\">" + _("Cart") + "</option>[% END %][% IF Koha.Preference( 'virtualshelves' ) == 1 %][% IF ( loggedinusername ) %]<optgroup label=\"" + _("Lists:") + "\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber | html %]\" value=\"addtolist\">[% barshelvesloo.shelfname | html %]</option>[% END %][% END %][% END %]<option value=\"newlist\">" + _("[ New list ]") + "</option></optgroup>[% ELSE %]<option value=\"newlist\">" + _("List") + "</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"" + _("Save") + "\" />");
     $("#addto").change(function(){
         cartList();
     });
@@ -333,7 +334,7 @@ $(document).ready(function(){
         return false;
     });
     [% IF ( query_desc ) %]
-    var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
+    var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
     q_array = query_desc.split(" ");
     // ensure that we don't have "" at the end of the array, which can
     // break the highlighter
@@ -355,7 +356,7 @@ function highlightOn() {
     for (x in q_array) {
         q_array[x] = q_array[x].replace(/\w*:([\w])/, "$1");
         q_array[x] = q_array[x].toLowerCase();
-        var myStopwords = "[% Koha.Preference('NotHighlightedWords') %]".toLowerCase().split('|');
+        var myStopwords = "[% Koha.Preference('NotHighlightedWords') | html %]".toLowerCase().split('|');
         if ( (q_array[x].length > 0) && ($.inArray(q_array[x], myStopwords) == -1) ) {
             $("td").highlight(q_array[x]);
         }
index a091575..34d4d97 100644 (file)
@@ -1,23 +1,24 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET TagsShowEnabled = ( ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsShowOnList ) %]
 [% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && TagsInputOnList ) %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;
 [% IF ( searchdesc ) %]
-    Results of search [% IF ( query_desc ) %]for '[% query_desc | html%]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]
+    Results of search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]
 [% ELSE %]
     You did not specify any search criteria.
 [% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% IF ( OpacStarRatings == 'all' || Koha.Preference('Babeltheque') ) %]
     [% BLOCK cssinclude %]
-        [% Asset.css("css/jquery.rating.css") %]
+        [% Asset.css("css/jquery.rating.css") | $raw %]
     [% END %]
 [% END %]
 
-<link rel="alternate" type="application/rss+xml" title="[% LibraryName |html %] Search RSS feed" href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi |uri %]&amp;count=[% countrss |uri %]&amp;sort_by=acqdate_dsc&amp;format=rss2" />
+<link rel="alternate" type="application/rss+xml" title="[% LibraryName | html %] Search RSS feed" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi |uri %]&amp;count=[% countrss |uri %]&amp;sort_by=acqdate_dsc&amp;format=rss2" />
 </head>
 
 [% INCLUDE 'bodytag.inc' bodyid='results' bodyclass='scrollto' %]
@@ -28,7 +29,7 @@
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
             <li>
                 [% IF ( searchdesc ) %]
-                    <a href="#">Results of search [% IF ( query_desc ) %]for '[% query_desc | html%]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]</a>
+                    <a href="#">Results of search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %]&nbsp;with limit(s):&nbsp;'[% limit_desc | html %]'[% END %]</a>
                 [% ELSE %]
                     <a href="#">You did not specify any search criteria</a>
                 [% END %]
                         <strong>No results found!</strong>
                         <p>
                             [% IF ( searchdesc ) %]
-                                No results found for that in [% LibraryName %] catalog. <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi | html | url %]&amp;format=rss2" class="rsssearchlink noprint"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" border="0" class="rsssearchicon"/></a>
+                                No results found for that in [% LibraryName | html %] catalog. <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi | html | url %]&amp;format=rss2" class="rsssearchlink noprint"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" border="0" class="rsssearchicon"/></a>
                             [% ELSE %]
                                 You did not specify any search criteria.
                             [% END %]
                         </p>
                         [% IF ( ReturnPath ) %]
                            <div class="returntosearch">
-                                <p><a href="[% ReturnPath %]">Return to the last advanced search</a></p>
+                                <p><a href="[% ReturnPath | html %]">Return to the last advanced search</a></p>
                             </div>
                         [% END %]
                         [% IF ( OPACNoResultsFound ) %]
                             <div id="noresultsfound">
-                                [% OPACNoResultsFound %]
+                                [% OPACNoResultsFound | $raw %]
                             </div>
                         [% END %]
                     </div> <!-- / .span12 -->
 
                 [% IF ( searchdesc ) %]
                     <p id="numresults">
-                    [% IF ( total ) %]<strong>Your search returned [% total |html %] results.</strong>
+                    [% IF ( total ) %]<strong>Your search returned [% total | html %] results.</strong>
                         [% IF ( related ) %]
                             (related searches:
                                 [% FOREACH relate IN related %]
-                                    [% relate.related_search %]
+                                    [% relate.related_search | html %]
                                 [% END %]
                             ).
                         [% END %]
-                        <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi |html | url %]&amp;count=[% countrss |html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink noprint"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a>
+                        <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi | url %][% limit_cgi |html | url %]&amp;count=[% countrss | html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink noprint"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a>
                     [% END # / IF total %]
                     </p>
                 [% END # / IF searchdesc %]
                         <ul style="list-style: none;">
                             [% FOREACH SPELL_SUGGES IN SPELL_SUGGEST %]
                             <li>
-                                <a href="/cgi-bin/koha/opac-search.pl?q=[% SPELL_SUGGES.spsuggestion %]">[% SPELL_SUGGES.spsuggestion %]</a>
+                                <a href="/cgi-bin/koha/opac-search.pl?q=[% SPELL_SUGGES.spsuggestion | html %]">[% SPELL_SUGGES.spsuggestion | html %]</a>
                             </li>
                             [% END %]
                         </ul>
                     [% IF ( total ) %]
                         [% IF ( ReturnPath ) %]
                             <div class="returntosearch">
-                                <p><a href="[% ReturnPath %]">Return to the last advanced search</a></p>
+                                <p><a href="[% ReturnPath | html %]">Return to the last advanced search</a></p>
                             </div>
                         [% END %]
                     [% END %]
                     [% IF ( query_error ) %]
                         <div class="dialog alert">
                             <h4>Error:</h4>
-                            [% query_error %]
+                            [% query_error | html %]
                         </div>
                     [% END %]
 
                             <form action="/cgi-bin/koha/opac-search.pl" method="get" name="bookbag_form" id="bookbag_form" class="checkboxed">
                                 [% IF ( searchdesc ) %]
                                     [% FOREACH QUERY_INPUT IN QUERY_INPUTS %]
-                                        <input type="hidden" name="[% QUERY_INPUT.input_name |html %]" value="[% QUERY_INPUT.input_value |html %]"/>
+                                        <input type="hidden" name="[% QUERY_INPUT.input_name | html %]" value="[% QUERY_INPUT.input_value | html %]"/>
                                     [% END %]
                                     [% FOREACH LIMIT_INPUT IN LIMIT_INPUTS %]
-                                        <input type="hidden" name="[% LIMIT_INPUT.input_name |html %]" value="[% LIMIT_INPUT.input_value |html %]"/>
+                                        <input type="hidden" name="[% LIMIT_INPUT.input_name | html %]" value="[% LIMIT_INPUT.input_value | html %]"/>
                                     [% END %]
                                 [% END # IF /searchdesc %]
 
                                             [% # Cell 1: Checkbox %]
                                             <td class="select selectcol">
                                                 [% IF Koha.Preference( 'opacbookbag' ) == 1 %]
-                                                    <input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber %]" /> <label for="bib[% SEARCH_RESULT.biblionumber %]"></label>
+                                                    <input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber | html %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber | html %]" /> <label for="bib[% SEARCH_RESULT.biblionumber | html %]"></label>
                                                 [% ELSE %]
                                                     [% IF Koha.Preference( 'virtualshelves' ) == 1 %]
-                                                        <input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber %]" /> <label for="bib[% SEARCH_RESULT.biblionumber %]"></label>
+                                                        <input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber | html %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber | html %]" /> <label for="bib[% SEARCH_RESULT.biblionumber | html %]"></label>
                                                     [% ELSE %]
                                                         [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %]
                                                             [% UNLESS ( SEARCH_RESULT.norequests ) %]
-                                                                [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]<input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber %]" /> <label for="bib[% SEARCH_RESULT.biblionumber %]"></label>
+                                                                [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]<input type="checkbox" class="cb" id="bib[% SEARCH_RESULT.biblionumber | html %]" name="biblionumber" value="[% SEARCH_RESULT.biblionumber | html %]" /> <label for="bib[% SEARCH_RESULT.biblionumber | html %]"></label>
                                                                 [% END %]
                                                             [% END %]
                                                         [% END # IF RequestOnOpac %]
                                             [% # Cell 2: Show result number if OpacHiddenItems is empty %]
                                             <td class="select selectcol">
                                                 [% UNLESS suppress_result_number %]
-                                                    [% SEARCH_RESULT.result_number %].
+                                                    [% SEARCH_RESULT.result_number | html %].
                                                 [% END %]
                                             </td>
 
                                                 [% # Cell 3: Show item type image %]
                                                 <td class="itypecol">
                                                     [% IF ( SEARCH_RESULT.imageurl ) %]
-                                                        <img src="[% SEARCH_RESULT.imageurl %]" title="[% SEARCH_RESULT.description %]" alt="[% SEARCH_RESULT.description %]" />
+                                                        <img src="[% SEARCH_RESULT.imageurl | html %]" title="[% SEARCH_RESULT.description | html %]" alt="[% SEARCH_RESULT.description | html %]" />
                                                     [% END %]
                                                     [% IF ( SEARCH_RESULT.score_avg ) %]
-                                                        <img src="[% themelang %]/../images/bonus.png" title="bonus" style="max-height: 35px;"/>
+                                                        <img src="[% themelang | html %]/../images/bonus.png" title="bonus" style="max-height: 35px;"/>
                                                     [% END %]
                                                 </td>
                                             [% END %]
 
                                             [% # Cell 4: Search result details and controls %]
                                             <td class="bibliocol">
-                                                <div class="coverimages itemtype_[% SEARCH_RESULT.itemtype %]">
-                                                    <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">
+                                                <div class="coverimages itemtype_[% SEARCH_RESULT.itemtype | html %]">
+                                                    <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">
                                                         [% IF ( OPACLocalCoverImages ) %]
-                                                            <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.biblionumber %]" id="local-thumbnail[% loop.count %]"></span>
+                                                            <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.biblionumber | html %]" id="local-thumbnail[% loop.count | html %]"></span>
                                                         [% END %]
                                                         [% IF ( OPACAmazonCoverImages ) %]
                                                             [% IF ( SEARCH_RESULT.normalized_isbn ) %]
-                                                                    <span title="[% SEARCH_RESULT.biblionumber %]" id="amazon-thumbnail[% loop.count %]"><img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" class="item-thumbnail" /></span>
+                                                                    <span title="[% SEARCH_RESULT.biblionumber | html %]" id="amazon-thumbnail[% loop.count | html %]"><img src="https://images-na.ssl-images-amazon.com/images/P/[% SEARCH_RESULT.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" class="item-thumbnail" /></span>
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
 
                                                         [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
                                                             [% IF ( SEARCH_RESULT.normalized_isbn || SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_oclc ) %]
-                                                                    <span title="[% SEARCH_RESULT.biblionumber %]" id="syndetics-thumbnail[% loop.count %]"><img src="https://secure.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% SEARCH_RESULT.normalized_upc %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc %]" alt="" class="item-thumbnail" /></span>
+                                                                    <span title="[% SEARCH_RESULT.biblionumber | html %]" id="syndetics-thumbnail[% loop.count | html %]"><img src="https://secure.syndetics.com/index.aspx?isbn=[% SEARCH_RESULT.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% SEARCH_RESULT.normalized_upc | html %]&amp;oclc=[% SEARCH_RESULT.normalized_oclc | html %]" alt="" class="item-thumbnail" /></span>
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
 
                                                         [% IF ( GoogleJackets ) %]
                                                             [% IF ( SEARCH_RESULT.normalized_isbn ) %]
-                                                                <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></span>
+                                                                <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% SEARCH_RESULT.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></span>
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
                                                         [% END %]
 
                                                         [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                                                          [% coce_id = SEARCH_RESULT.normalized_ean || SEARCH_RESULT.normalized_isbn %]
+                                                          [% coce_id = SEARCH_RESULT.normalized_ean || SEARCH_RESULT.normalized_isbn | html %]
                                                           [% IF ( coce_id ) %]
-                                                            <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% coce_id %]" id="coce-thumbnail[% loop.count %]"></span>
+                                                            <span title="[% SEARCH_RESULT.biblionumber |url %]" class="[% coce_id | html %]" id="coce-thumbnail[% loop.count | html %]"></span>
                                                           [% ELSE %]
                                                             <span class="no-image">No cover image available</span>
                                                           [% END %]
 
                                                         [% IF OpenLibraryCovers %]
                                                             [% IF SEARCH_RESULT.normalized_isbn %]
-                                                                <span title="[% SEARCH_RESULT.biblionumber %]" class="[% SEARCH_RESULT.normalized_isbn %]" id="openlibrary-thumbnail[% loop.count %]"></span>
+                                                                <span title="[% SEARCH_RESULT.biblionumber | html %]" class="[% SEARCH_RESULT.normalized_isbn | html %]" id="openlibrary-thumbnail[% loop.count | html %]"></span>
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
                                                         [% END %]
 
                                                         [% IF ( BakerTaylorEnabled && !BakerTaylorBookstoreURL ) %]
-                                                            [% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) %]
+                                                            [% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) | html %]
                                                             [% IF ( bt_id ) %]
-                                                                <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" />
+                                                                <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" />
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
                                                     </a>
 
                                                     [% IF ( BakerTaylorEnabled && BakerTaylorBookstoreURL ) %]
-                                                        [% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) %]
+                                                        [% bt_id = ( SEARCH_RESULT.normalized_upc || SEARCH_RESULT.normalized_isbn ) | html %]
                                                         [% IF ( bt_id ) %]
-                                                            <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]">
-                                                                <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" />
+                                                            <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]">
+                                                                <img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" />
                                                             </a>
                                                         [% ELSE %]
                                                             <span class="no-image">No cover image available</span>
                                                     [% IF ( IDreamBooksResults && SEARCH_RESULT.normalized_isbn ) %]
                                                         <div class="idbresult" style="display: none;">
                                                             [% IF ( IDreamBooksReviews ) %]
-                                                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]#idb_critic_reviews">
+                                                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]#idb_critic_reviews">
                                                             [% ELSE %]
-                                                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">
+                                                                <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">
                                                             [% END %]
-                                                            [% SEARCH_RESULT.normalized_isbn %]</a>
+                                                            [% SEARCH_RESULT.normalized_isbn | html %]</a>
                                                         </div>
                                                     [% END %]
                                                 </div>
                                                 [% IF ( COinSinOPACResults && SEARCH_RESULT.coins ) %]
                                                     <!-- COinS / Openurl -->
-                                                    <span class="Z3988" title="[% SEARCH_RESULT.coins %]"></span>
+                                                    <span class="Z3988" title="[% SEARCH_RESULT.coins | html %]"></span>
                                                 [% END %]
 
                                                 [% IF ( OPACXSLTResultsDisplay ) %]
-                                                    [% SEARCH_RESULT.XSLTResultsRecord %]
+                                                    [% SEARCH_RESULT.XSLTResultsRecord | $raw %]
                                                 [% ELSE %]
                                                     [% IF ( BiblioDefaultViewmarc ) %]
                                                         <a class="title" href="/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=[% SEARCH_RESULT.biblionumber |url %]" title="View details for this title">
                                                     [% END %]
 
                                                     [% IF ( SEARCH_RESULT.title ) %]
-                                                        [% SEARCH_RESULT.title |html %]
+                                                        [% SEARCH_RESULT.title | html %]
                                                     [% ELSE %]
                                                         No title
                                                     [% END %]
 
                                                     [% FOREACH subtitl IN SEARCH_RESULT.subtitle %]
-                                                        , [% subtitl.subfield|html %]
+                                                        , [% subtitl.subfield | html %]
                                                     [% END %]</a>
 
                                                     [% IF ( SEARCH_RESULT.author ) %]
-                                                        by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% SEARCH_RESULT.author |url %]" title="Search for works by this author" class="author">[% SEARCH_RESULT.author %]</a>
+                                                        by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% SEARCH_RESULT.author |url %]" title="Search for works by this author" class="author">[% SEARCH_RESULT.author | html %]</a>
                                                     [% ELSE %]
                                                         &nbsp;
                                                     [% END %]
 
                                                     <span class="results_summary publisher">
                                                         <span class="label">Publication:</span>
-                                                            [% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place %] [% END %]
-                                                            [% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode|html %][% END %]
+                                                            [% IF ( SEARCH_RESULT.place ) %][% SEARCH_RESULT.place | html %] [% END %]
+                                                            [% IF ( SEARCH_RESULT.publishercode ) %][% SEARCH_RESULT.publishercode | html %][% END %]
                                                             [% IF ( SEARCH_RESULT.publicationyear ) %]
-                                                                [% SEARCH_RESULT.publicationyear %]
+                                                                [% SEARCH_RESULT.publicationyear | html %]
                                                             [% ELSE %]
                                                                 [% IF ( SEARCH_RESULT.copyrightdate ) %]
-                                                                    [% SEARCH_RESULT.copyrightdate %]
+                                                                    [% SEARCH_RESULT.copyrightdate | html %]
                                                                 [% END %]
                                                             [% END %]
-                                                            [% IF ( SEARCH_RESULT.pages ) %]. [% SEARCH_RESULT.pages %][% END %]
-                                                            [% IF ( SEARCH_RESULT.notes ) %], [% SEARCH_RESULT.notes|html %][% END %]
-                                                            [% IF ( SEARCH_RESULT.size ) %] [% SEARCH_RESULT.size %][% END %]
-                                                            [% IF ( SEARCH_RESULT.timestamp ) %] <i>(modified on [% SEARCH_RESULT.timestamp %])</i>[% END %]
+                                                            [% IF ( SEARCH_RESULT.pages ) %]. [% SEARCH_RESULT.pages | html %][% END %]
+                                                            [% IF ( SEARCH_RESULT.notes ) %], [% SEARCH_RESULT.notes | html %][% END %]
+                                                            [% IF ( SEARCH_RESULT.size ) %] [% SEARCH_RESULT.size | html %][% END %]
+                                                            [% IF ( SEARCH_RESULT.timestamp ) %] <i>(modified on [% SEARCH_RESULT.timestamp | html %])</i>[% END %]
                                                     </span>
 
                                                     [% IF ( SEARCH_RESULT.summary ) %]
                                                         <span class="result_summary">
-                                                            [% SEARCH_RESULT.summary %]
+                                                            [% SEARCH_RESULT.summary | html %]
                                                         </span>
                                                     [% END %]
 
                                                     [% IF ( SEARCH_RESULT.copyrightdate ) %]
                                                         <span class="results_summary date">
                                                             <span class="label">Date:</span>
-                                                            [% SEARCH_RESULT.copyrightdate %]
+                                                            [% SEARCH_RESULT.copyrightdate | html %]
                                                         </span>
                                                     [% END %]
 
                                                                         [% END %]
 
                                                                         [% IF ( singleBranchMode ) %]
-                                                                            [% available_items_loo.location %]
+                                                                            [% available_items_loo.location | html %]
                                                                         [% ELSE %]
-                                                                            [% available_items_loo.branchname %]
+                                                                            [% available_items_loo.branchname | html %]
                                                                         [% END %]
 
                                                                         [% IF ( OPACItemsResultsDisplay ) %]
-                                                                            [% UNLESS ( singleBranchMode ) %][% available_items_loo.location %][% END %]
-                                                                            [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/opac-search.pl?q=callnum:%22[% available_items_loo.itemcallnumber |url %]%22">[% available_items_loo.itemcallnumber %]</a>][% END %]
+                                                                            [% UNLESS ( singleBranchMode ) %][% available_items_loo.location | html %][% END %]
+                                                                            [% IF ( available_items_loo.itemcallnumber ) %][<a href="/cgi-bin/koha/opac-search.pl?q=callnum:%22[% available_items_loo.itemcallnumber |url %]%22">[% available_items_loo.itemcallnumber | html %]</a>][% END %]
                                                                         [% END %]
-                                                                        ([% available_items_loo.count %]),
+                                                                        ([% available_items_loo.count | html %]),
                                                                         </span>
                                                                     [% END # / FOREACH available_items_loo %]
                                                                 </span>
                                                             [% ELSE %]
                                                                 [% IF ( SEARCH_RESULT.ALTERNATEHOLDINGS ) %]
                                                                     [% FOREACH ALTERNATEHOLDING IN SEARCH_RESULT.ALTERNATEHOLDINGS %]
-                                                                        &nbsp;<span id="alternateholdings">[% ALTERNATEHOLDING.holding %]</span>,
+                                                                        &nbsp;<span id="alternateholdings">[% ALTERNATEHOLDING.holding | html %]</span>,
                                                                     [% END %]
                                                                 [% ELSE %]
                                                                     <span class="unavailable">No items available:</span>
                                                             [% END # / IF SEARCH_RESULT.available_items_loop.size %]
 
                                                             <span class="unavailable">
-                                                                [% IF ( SEARCH_RESULT.onloancount ) %] Checked out ([% SEARCH_RESULT.onloancount %]), [% END %]
-                                                                [% IF ( SEARCH_RESULT.withdrawncount ) %] Withdrawn ([% SEARCH_RESULT.withdrawncount %]), [% END %]
-                                                                [% UNLESS ( SEARCH_RESULT.hidelostitems ) %][% IF ( SEARCH_RESULT.itemlostcount ) %] Lost ([% SEARCH_RESULT.itemlostcount %]),[% END %][% END %]
-                                                                [% IF ( SEARCH_RESULT.damagedcount ) %] Damaged ([% SEARCH_RESULT.damagedcount %]),[% END %]
-                                                                [% IF ( SEARCH_RESULT.orderedcount ) %] On order ([% SEARCH_RESULT.orderedcount %]),[% END %]
-                                                                [% IF ( SEARCH_RESULT.onholdcount ) %] On hold ([% SEARCH_RESULT.onholdcount %]),[% END %]
-                                                                [% IF ( SEARCH_RESULT.intransitcount ) %] In transit ([% SEARCH_RESULT.intransitcount %]),[% END %]
+                                                                [% IF ( SEARCH_RESULT.onloancount ) %] Checked out ([% SEARCH_RESULT.onloancount | html %]), [% END %]
+                                                                [% IF ( SEARCH_RESULT.withdrawncount ) %] Withdrawn ([% SEARCH_RESULT.withdrawncount | html %]), [% END %]
+                                                                [% UNLESS ( SEARCH_RESULT.hidelostitems ) %][% IF ( SEARCH_RESULT.itemlostcount ) %] Lost ([% SEARCH_RESULT.itemlostcount | html %]),[% END %][% END %]
+                                                                [% IF ( SEARCH_RESULT.damagedcount ) %] Damaged ([% SEARCH_RESULT.damagedcount | html %]),[% END %]
+                                                                [% IF ( SEARCH_RESULT.orderedcount ) %] On order ([% SEARCH_RESULT.orderedcount | html %]),[% END %]
+                                                                [% IF ( SEARCH_RESULT.onholdcount ) %] On hold ([% SEARCH_RESULT.onholdcount | html %]),[% END %]
+                                                                [% IF ( SEARCH_RESULT.intransitcount ) %] In transit ([% SEARCH_RESULT.intransitcount | html %]),[% END %]
                                                             </span>
                                                     </span> <!-- / .results_summary -->
                                                 [% END # / IF OPACXSLTResultsDisplay %]
                                                     <div class="results_summary">
                                                         [% FOREACH i  IN [ 1 2 3 4 5  ] %]
                                                             [% IF ( SEARCH_RESULT.score_int >= i ) %]
-                                                                <div class="star-rating rater-[% i %] star star-rating-applied star-rating-readonly star-rating-on"><a title="[% i %]">[% i %]</a></div>
+                                                                <div class="star-rating rater-[% i | html %] star star-rating-applied star-rating-readonly star-rating-on"><a title="[% i | html %]">[% i | html %]</a></div>
                                                             [% ELSE   %]
-                                                                <div class="star-rating rater-[% i %] star star-rating-applied star-rating-readonly"><a title="[% i %]">[% i %]</a></div>
+                                                                <div class="star-rating rater-[% i | html %] star star-rating-applied star-rating-readonly"><a title="[% i | html %]">[% i | html %]</a></div>
                                                             [% END %]
                                                         [% END %]
-                                                        <span id="babeltheque-rating_total_[% SEARCH_RESULT.biblionumber %]">&nbsp;&nbsp; [% SEARCH_RESULT.score_avg %] / 5 (on [% SEARCH_RESULT.num_scores %] rates)</span>
+                                                        <span id="babeltheque-rating_total_[% SEARCH_RESULT.biblionumber | html %]">&nbsp;&nbsp; [% SEARCH_RESULT.score_avg | html %] / 5 (on [% SEARCH_RESULT.num_scores | html %] rates)</span>
 
                                                         [% IF ( SEARCH_RESULT.num_critics ) %]
-                                                            <span class="social_data">[% SEARCH_RESULT.num_critics %] Internet user critics</span>
+                                                            <span class="social_data">[% SEARCH_RESULT.num_critics | html %] Internet user critics</span>
                                                         [% END %]
                                                         [% IF ( SEARCH_RESULT.num_critics_pro ) %]
-                                                            <span class="social_data">[% SEARCH_RESULT.num_critics_pro %] Professional critics</span>
+                                                            <span class="social_data">[% SEARCH_RESULT.num_critics_pro | html %] Professional critics</span>
                                                         [% END %]
                                                         [% IF ( SEARCH_RESULT.num_videos ) %]
-                                                            <span class="social_data">[% SEARCH_RESULT.num_videos %] Video extracts</span>
+                                                            <span class="social_data">[% SEARCH_RESULT.num_videos | html %] Video extracts</span>
                                                         [% END %]
                                                         [% IF ( SEARCH_RESULT.num_quotations ) %]
-                                                            <span class="social_data">[% SEARCH_RESULT.num_quotations %] Quotations</span>
+                                                            <span class="social_data">[% SEARCH_RESULT.num_quotations | html %] Quotations</span>
                                                         [% END %]
                                                     </div> <!-- / .results_summary -->
                                                 [% END # / IF SEARCH_RESULT.score_avg %]
                                                         <ul>
                                                             [% FOREACH TagLoo IN SEARCH_RESULT.TagLoop %]
                                                                 <li>
-                                                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term %]</a>
-                                                                    <span class="weight">([% TagLoo.weight_total %])</span>
+                                                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term | html %]</a>
+                                                                    <span class="weight">([% TagLoo.weight_total | html %])</span>
                                                                 </li>
                                                             [% END %]
                                                         </ul>
                                                         <span class="label">Lists:</span>
                                                             <ul>
                                                                 [% FOREACH shelf IN SEARCH_RESULT.shelves %]
-                                                                    <li><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]">[% shelf.shelfname %]</a></li>
+                                                                    <li><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]">[% shelf.shelfname | html %]</a></li>
                                                                     [%~ UNLESS loop.last %], [% ELSE %].[% END ~%]
                                                                 [% END %]
                                                             </ul>
                                                 [% IF ( SEARCH_RESULT.searchhighlightblob ) %]
                                                     <span class="results_summary">
                                                         <span class="label">Match:</span>
-                                                        [% SEARCH_RESULT.searchhighlightblob %]
+                                                        [% SEARCH_RESULT.searchhighlightblob | html %]
                                                     </span>
                                                 [% END %]
 
                                                 [% IF ( OpacStarRatings == 'all' ) %]
                                                     <div class="results_summary ratings">
                                                       [% SET rating_avg = SEARCH_RESULT.ratings.get_avg_rating() %]
-                                                      [% rating_avg_int = BLOCK %][% rating_avg | format("%.0f") %][% END %]
+                                                      [% rating_avg_int = BLOCK | html %][% rating_avg | format("%.0f") %][% END %]
                                                         [% FOREACH i  IN [ 1 2 3 4 5  ] %]
                                                             [% IF rating_avg_int == i %]
-                                                                <input class="star" type="radio"  name="rating-[% SEARCH_RESULT.biblionumber %]" value="[% i %]" checked="checked" disabled="disabled"   />
+                                                                <input class="star" type="radio"  name="rating-[% SEARCH_RESULT.biblionumber | html %]" value="[% i | html %]" checked="checked" disabled="disabled"   />
                                                             [% ELSE %]
-                                                                <input class="star" type="radio"  name="rating-[% SEARCH_RESULT.biblionumber %]" value="[% i %]" disabled="disabled"   />
+                                                                <input class="star" type="radio"  name="rating-[% SEARCH_RESULT.biblionumber | html %]" value="[% i | html %]" disabled="disabled"   />
                                                             [% END %]
                                                         [% END %]
 
                                                         [% IF SEARCH_RESULT.ratings.count > 0  %]
-                                                            <span id="rating_total_[% SEARCH_RESULT.biblionumber %]">&nbsp;&nbsp;([% SEARCH_RESULT.ratings.count %] votes)</span>
+                                                            <span id="rating_total_[% SEARCH_RESULT.biblionumber | html %]">&nbsp;&nbsp;([% SEARCH_RESULT.ratings.count | html %] votes)</span>
                                                         [% ELSE %]
                                                             <br />
                                                         [% END %]
                                                         [% IF Koha.Preference( 'RequestOnOpac' ) == 1 %]
                                                             [% UNLESS ( SEARCH_RESULT.norequests ) %]
                                                                 [% IF ( Koha.Preference( 'opacuserlogin' ) == 1 ) %]
-                                                                    <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Place hold</a></span><!-- add back when available 0 holds in queue-->
+                                                                    <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Place hold</a></span><!-- add back when available 0 holds in queue-->
                                                                 [% END # / IF opacuserlogin && holdable %]
                                                             [% END # UNLESS SEARCH_RESULT.norequests %]
                                                         [% END # IF RequestOnOpac %]
 
                                                         [% IF ( Koha.Preference( 'opacuserlogin' ) == 1 ) %]
                                                             [% IF Koha.Preference('ArticleRequests') %]
-                                                                <span class="actions"><a class="article_request" href="/cgi-bin/koha/opac-request-article.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]">Request article</a></span>
+                                                                <span class="actions"><a class="article_request" href="/cgi-bin/koha/opac-request-article.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]">Request article</a></span>
                                                             [% END %]
                                                         [% END %]
 
                                                         [% IF ( TagsInputEnabled ) %]
                                                             [% IF ( loggedinusername ) %]
-                                                                <span class="actions"><a class="tag_add" id="tag_add[% SEARCH_RESULT.biblionumber %]" href="#">Add tag</a></span>
-                                                                <div id="tagform[% SEARCH_RESULT.biblionumber %]" class="tag_results_input" style="display:none;">
-                                                                        <label for="newtag[% SEARCH_RESULT.biblionumber %]">New tag(s), separated by a comma:</label>
-                                                                        <input type="text" name="newtag[% SEARCH_RESULT.biblionumber %]" id="newtag[% SEARCH_RESULT.biblionumber %]" class="newtag" maxlength="100" />
-                                                                        <input name="tagbutton" class="btn btn-small tagbutton" title="[% SEARCH_RESULT.biblionumber %]" type="submit" value="Add" />
-                                                                        <a class="cancel_tag_add" id="cancel[% SEARCH_RESULT.biblionumber %]" href="#">(done)</a>
+                                                                <span class="actions"><a class="tag_add" id="tag_add[% SEARCH_RESULT.biblionumber | html %]" href="#">Add tag</a></span>
+                                                                <div id="tagform[% SEARCH_RESULT.biblionumber | html %]" class="tag_results_input" style="display:none;">
+                                                                        <label for="newtag[% SEARCH_RESULT.biblionumber | html %]">New tag(s), separated by a comma:</label>
+                                                                        <input type="text" name="newtag[% SEARCH_RESULT.biblionumber | html %]" id="newtag[% SEARCH_RESULT.biblionumber | html %]" class="newtag" maxlength="100" />
+                                                                        <input name="tagbutton" class="btn btn-small tagbutton" title="[% SEARCH_RESULT.biblionumber | html %]" type="submit" value="Add" />
+                                                                        <a class="cancel_tag_add" id="cancel[% SEARCH_RESULT.biblionumber | html %]" href="#">(done)</a>
                                                                 </div>
-                                                                <span id="newtag[% SEARCH_RESULT.biblionumber %]_status" class="tagstatus" style="display:none;">
+                                                                <span id="newtag[% SEARCH_RESULT.biblionumber | html %]_status" class="tagstatus" style="display:none;">
                                                                     Tag status here.
                                                                 </span>
                                                             [% ELSIF ( loop.first ) %]
                                                         [% END # if TagsInputEnabled %]
 
                                                         [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername && ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %]
-                                                            <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber %]'); return false;">Save to Lists</a></span>
+                                                            <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% SEARCH_RESULT.biblionumber | html %]'); return false;">Save to Lists</a></span>
                                                         [% END %]
 
                                                         [% IF Koha.Preference( 'opacbookbag' ) == 1 %]
                                                             [% IF ( SEARCH_RESULT.incart ) %]
-                                                                <span class="actions"><a class="addtocart cart[% SEARCH_RESULT.biblionumber %]" href="#" onclick="addRecord('[% SEARCH_RESULT.biblionumber %]'); return false;">In your cart</a> <a class="cartRemove cartR[% SEARCH_RESULT.biblionumber %]" href="#" onclick="delSingleRecord('[% SEARCH_RESULT.biblionumber %]'); return false;">(remove)</a></span>
+                                                                <span class="actions"><a class="addtocart cart[% SEARCH_RESULT.biblionumber | html %]" href="#" onclick="addRecord('[% SEARCH_RESULT.biblionumber | html %]'); return false;">In your cart</a> <a class="cartRemove cartR[% SEARCH_RESULT.biblionumber | html %]" href="#" onclick="delSingleRecord('[% SEARCH_RESULT.biblionumber | html %]'); return false;">(remove)</a></span>
                                                             [% ELSE %]
-                                                                <span class="actions"><a class="addtocart cart[% SEARCH_RESULT.biblionumber %]" href="#" onclick="addRecord('[% SEARCH_RESULT.biblionumber %]'); return false;">Add to cart</a> <a style="display:none;" class="cartRemove cartR[% SEARCH_RESULT.biblionumber %]" href="#" onclick="delSingleRecord('[% SEARCH_RESULT.biblionumber %]'); return false;">(remove)</a></span>
+                                                                <span class="actions"><a class="addtocart cart[% SEARCH_RESULT.biblionumber | html %]" href="#" onclick="addRecord('[% SEARCH_RESULT.biblionumber | html %]'); return false;">Add to cart</a> <a style="display:none;" class="cartRemove cartR[% SEARCH_RESULT.biblionumber | html %]" href="#" onclick="delSingleRecord('[% SEARCH_RESULT.biblionumber | html %]'); return false;">(remove)</a></span>
                                                             [% END %]
                                                         [% END # / IF opacbookbag %]
                                                 </div>
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
 [% IF ( LibraryThingForLibrariesID ) %]
-    <script src="https://ltfl.librarything.com/forlibraries/widget.js?id=[% LibraryThingForLibrariesID %]&amp;systype=koha"></script>
+    <script src="https://ltfl.librarything.com/forlibraries/widget.js?id=[% LibraryThingForLibrariesID | html %]&amp;systype=koha"></script>
 [% END %]
-[% IF ( OpacStarRatings == 'all' || Koha.Preference('Babeltheque') ) %][% Asset.js("lib/jquery/plugins/jquery.rating.js") %][% END %]
-[% IF ( OverDriveEnabled ) %][% Asset.js("js/overdrive.js") %][% END %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
-[% Asset.js("js/authtoresults.js") %]
-[% IF ( OpacHighlightedWords ) %][% Asset.js("lib/jquery/plugins/jquery.highlight-3.js") %]
+[% IF ( OpacStarRatings == 'all' || Koha.Preference('Babeltheque') ) %][% Asset.js("lib/jquery/plugins/jquery.rating.js") | $raw %][% END %]
+[% IF ( OverDriveEnabled ) %][% Asset.js("js/overdrive.js") | $raw %][% END %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
+[% Asset.js("js/authtoresults.js") | $raw %]
+[% IF ( OpacHighlightedWords ) %][% Asset.js("lib/jquery/plugins/jquery.highlight-3.js").raw %]
 [% END %]<script>
 //<![CDATA[
 [% IF ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'RequestOnOpac' ) == 1 ) %]
@@ -689,7 +690,7 @@ function highlightOn() {
     for (x in q_array) {
         q_array[x] = q_array[x].replace(/\w*:([\w])/, "$1");
         q_array[x] = q_array[x].toLowerCase();
-        var myStopwords = "[% Koha.Preference('NotHighlightedWords') %]".toLowerCase().split('|');
+        var myStopwords = "[% Koha.Preference('NotHighlightedWords') | html %]".toLowerCase().split('|');
         if ( (q_array[x].length > 0) && ($.inArray(q_array[x], myStopwords) == -1) ) {
             $(".title").highlight(q_array[x]);
             $(".author").highlight(q_array[x]);
@@ -761,9 +762,9 @@ $(document).ready(function(){
             [% SET number_of_private_shelves = 0 %]
             [% FOREACH s IN add_to_some_private_shelves %]
                 [% IF shelfnumber != s.shelfnumber %]
-                    param1 += "<option id=\"s[% s.shelfnumber %]\" value=\"addtolist\">[% s.shelfname |html %]<\/option>";
+                    param1 += "<option id=\"s[% s.shelfnumber | html %]\" value=\"addtolist\">[% s.shelfname | html %]<\/option>";
                     [% SET number_of_private_shelves = number_of_private_shelves + 1 %]
-                    [% IF number_of_private_shelves == 10 %][% LAST %][% END %]
+                    [% IF number_of_private_shelves == 10 %][% LAST | html %][% END %]
                 [% END %]
             [% END %]
             param1 += "<\/optgroup>";
@@ -773,9 +774,9 @@ $(document).ready(function(){
             [% SET number_of_public_shelves = 0 %]
             [% FOREACH s IN add_to_some_public_shelves %]
                 [% IF shelfnumber != s.shelfnumber %]
-                    param1 += "<option id=\"s[% s.shelfnumber %]\" value=\"addtolist\">[% s.shelfname |html %]<\/option>";
+                    param1 += "<option id=\"s[% s.shelfnumber | html %]\" value=\"addtolist\">[% s.shelfname | html %]<\/option>";
                     [% SET number_of_public_shelves = number_of_public_shelves + 1 %]
-                    [% IF number_of_public_shelves == 10 %][% LAST %][% END %]
+                    [% IF number_of_public_shelves == 10 %][% LAST | html %][% END %]
                 [% END %]
             [% END %]
             param1 += "<\/optgroup>";
@@ -871,8 +872,8 @@ $(document).ready(function(){
 [% END %]
 
 [% IF ( query_desc ) %]
-    var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
-    var querystring = "[% querystring |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
+    var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
+    var querystring = "[% querystring |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') | html %]";
     [% IF ( OpacHighlightedWords ) %]
         q_array = query_desc.split(" ");
         // ensure that we don't have "" at the end of the array, which can
@@ -885,10 +886,10 @@ $(document).ready(function(){
         $("#highlight_toggle_off").show().click(function() {highlightOff();});
     [% END %]
     [% IF ( OverDriveEnabled ) %]
-        var $overdrive_results = $( '<div id="overdrive-results">' + _( 'Searching OverDrive...' ) + ' <img class="throbber" src="[% interface %]/lib/jquery/plugins/themes/classic/throbber.gif" /></div>' );
+        var $overdrive_results = $( '<div id="overdrive-results">' + _( 'Searching OverDrive...' ) + ' <img class="throbber" src="[% interface | html %]/lib/jquery/plugins/themes/classic/throbber.gif" /></div>' );
         $( '#numresults' ) .append( ' ' )
             .append( $overdrive_results );
-        KOHA.OverDrive.Search( "[% OverDriveLibraryID %]", querystring, 1, 0, function( data ) {
+        KOHA.OverDrive.Search( "[% OverDriveLibraryID | html %]", querystring, 1, 0, function( data ) {
             if ( data.error ) {
                 $overdrive_results.html( _( 'Error searching OverDrive collection' ) );
                 return;
@@ -902,7 +903,7 @@ $(document).ready(function(){
         } );
     [% END %]
     [% IF ( OpenLibrarySearch ) %]
-        var $openlibrary_results = $( '<div id="openlibrary-results">' + _( 'Searching Open Library...' ) + ' <img class="throbber" src="[% interface %]/lib/jquery/plugins/themes/classic/throbber.gif" /></div>' );
+        var $openlibrary_results = $( '<div id="openlibrary-results">' + _( 'Searching Open Library...' ) + ' <img class="throbber" src="[% interface | html %]/lib/jquery/plugins/themes/classic/throbber.gif" /></div>' );
         $( '#numresults' ) .append( ' ' )
             .append( $openlibrary_results );
         KOHA.OpenLibrary.search( querystring, null, function( data ) {
@@ -968,7 +969,7 @@ $(document).ready(function(){
 [% IF OPACLocalCoverImages %]KOHA.LocalCover.GetCoverFromBibnumber(false);[% END %]
 [% IF ( GoogleJackets ) %]KOHA.Google.GetCoverFromIsbn();[% END %]
 [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-    KOHA.coce.getURL('[% Koha.Preference('CoceHost') %]', '[% Koha.Preference('CoceProviders') %]');
+    KOHA.coce.getURL('[% Koha.Preference('CoceHost') | html %]', '[% Koha.Preference('CoceProviders') | html %]');
 [% END %]
 
 [% IF ( DidYouMean ) %]
index 8bc9060..6aea8f7 100644 (file)
@@ -1,6 +1,6 @@
 [%# This template is called only for a very simple error message %]
 <html>
 <body id="opac-retrieve-file" class="scrollto">
-Your search [% IF hash %]for [% hash %][% END %] was not successful.
+Your search [% IF hash %]for [% hash | html %][% END %] was not successful.
 </body>
 </html>
index 1e0667f..affccce 100644 (file)
@@ -1,5 +1,5 @@
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Comments on [% title |html %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Comments on [% title | html %]</title>
 <style>
   #custom-doc { width:37.08em;*width:36.16em;min-width:485px; margin:1em auto; text-align:left; }
 </style>
                             </div>
                         [% END # / ERRORs %]
 
-                        <h1>Comments on <i>[% title |html %] [% subtitle %]</i></h1>
-                        [% IF ( author ) %]<h3>[% author |html %]</h3>[% END %]
+                        <h1>Comments on <i>[% title | html %] [% subtitle | html %]</i></h1>
+                        [% IF ( author ) %]<h3>[% author | html %]</h3>[% END %]
                         <form id="reviewf" action="/cgi-bin/koha/opac-review.pl[% IF ( cgi_debug ) %]?debug=1[% END %]" method="post">
-                            <input type="hidden" name="biblionumber" value="[% biblionumber | html%]" />
-                            [% IF ( reviewid ) %]<input type="hidden" name="reviewid" value="[% reviewid | html%]" />[% END %]
+                            <input type="hidden" name="biblionumber" value="[% biblionumber | html %]" />
+                            [% IF ( reviewid ) %]<input type="hidden" name="reviewid" value="[% reviewid | html %]" />[% END %]
                             <fieldset>
-                                <textarea id="review" name="review" cols="60" rows="8">[% review %]</textarea>
+                                <textarea id="review" name="review" cols="60" rows="8">[% review | html %]</textarea>
                             </fieldset>
                             <p>Note: Your comment must be approved by a librarian. </p>
                             <fieldset class="action">
index c2b42ee..a51642c 100644 (file)
@@ -1,11 +1,12 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your routing lists</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your routing lists</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
-    [% Asset.css("css/datatables.css") %]
+    [% Asset.css("css/datatables.css") | $raw %]
 [% END %]
 </head>
 
@@ -47,8 +48,8 @@
                             [% FOREACH routinglist IN routinglists %]
                                 [% IF ( titles_loop.odd ) %]<tr class="highlight">[% ELSE %]<tr>[% END %]
                                     <td>
-                                        <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% routinglist.subscription.biblio.biblionumber %]">
-                                            [% routinglist.subscription.biblio.title %]
+                                        <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% routinglist.subscription.biblio.biblionumber | html %]">
+                                            [% routinglist.subscription.biblio.title | html %]
                                         </a>
                                     </td>
                                 </tr>
index 8fac44a..2849553 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search history</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your search history</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                                             <tbody>
                                                 [% FOREACH s IN current_biblio_searches %]
                                                     <tr>
-                                                        <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                                                        <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                                                        <td><a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html |url %][% limit_cgi |html | url %]&amp;[% s.query_cgi |html %]&amp;count=[% countrss |html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a> <a href="/cgi-bin/koha/opac-search.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                                                        <td>[% s.total %]</td>
+                                                        <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                                                        <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                                                        <td><a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html |url %][% limit_cgi |html | url %]&amp;[% s.query_cgi | html %]&amp;count=[% countrss | html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a> <a href="/cgi-bin/koha/opac-search.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                                                        <td>[% s.total | html %]</td>
                                                     </tr>
                                                 [% END %]
                                             </tbody>
                                             <tbody>
                                             [% FOREACH s IN previous_biblio_searches %]
                                                 <tr>
-                                                    <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                                                    <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                                                    <td><a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html |url %][% limit_cgi |html | url %]&amp;[% s.query_cgi |html %]&amp;count=[% countrss |html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a> <a href="/cgi-bin/koha/opac-search.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                                                    <td>[% s.total %]</td>
+                                                    <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                                                    <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                                                    <td><a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?[% query_cgi |html |url %][% limit_cgi |html | url %]&amp;[% s.query_cgi | html %]&amp;count=[% countrss | html %]&amp;sort_by=acqdate_dsc&amp;format=rss2" class="rsssearchlink"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to this search" title="Subscribe to this search" class="rsssearchicon"/></a> <a href="/cgi-bin/koha/opac-search.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                                                    <td>[% s.total | html %]</td>
                                                 </tr>
                                             [% END %]
                                             </tbody>
                                             <tbody>
                                                 [% FOREACH s IN current_authority_searches %]
                                                     <tr>
-                                                        <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                                                        <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                                                        <td><a href="/cgi-bin/koha/opac-authorities-home.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                                                        <td>[% s.total %]</td>
+                                                        <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                                                        <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                                                        <td><a href="/cgi-bin/koha/opac-authorities-home.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                                                        <td>[% s.total | html %]</td>
                                                     </tr>
                                                 [% END %]
                                             </tbody>
                                             <tbody>
                                                 [% FOREACH s IN previous_authority_searches %]
                                                     <tr>
-                                                        <td><input type="checkbox" name="id" value="[% s.id %]" /></td>
-                                                        <td><span title="[% s.time %]">[% s.time |$KohaDates with_hours => 1 %]</span></td>
-                                                        <td><a href="/cgi-bin/koha/opac-authorities-home.pl?[% s.query_cgi |html %]">[% s.query_desc |html %]</a></td>
-                                                        <td>[% s.total %]</td>
+                                                        <td><input type="checkbox" name="id" value="[% s.id | html %]" /></td>
+                                                        <td><span title="[% s.time | html %]">[% s.time |$KohaDates with_hours => 1 | html %]</span></td>
+                                                        <td><a href="/cgi-bin/koha/opac-authorities-home.pl?[% s.query_cgi | html %]">[% s.query_desc | html %]</a></td>
+                                                        <td>[% s.total | html %]</td>
                                                     </tr>
                                                 [% END %]
                                             </tbody>
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
 [% INCLUDE 'datatables.inc' %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 <script>
 //<![CDATA[
     var MSG_CONFIRM_DELETE_HISTORY = _("Are you sure you want to delete selected search history entries?");
index 47d03f1..8f9a98a 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE HtmlToText %]
 [% USE Koha %]
 
@@ -10,7 +11,7 @@ Your cart
 [% FILTER html2text %]
     <p>Hi,</p>
 
-    <p>[% firstname %] [% surname %] sent you a cart from our online catalog.</p>
+    <p>[% firstname | $raw %] [% surname | $raw %] sent you a cart from our online catalog.</p>
 
     <p>Please note that the attached file is a MARC bibliographic records file
     which can be imported into personal bibliographic software like EndNote,
@@ -23,26 +24,26 @@ Your cart
 [% FILTER html2text %]
 
     [% IF comment %]
-        <p>[% comment %]</p>
+        <p>[% comment | $raw %]</p>
         <hr/>
     [% END %]
     <ol>
     [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
         <li>
             <span>
-                [% BIBLIO_RESULT.title %]
-                [% IF ( BIBLIO_RESULT.subtitle ) %] [% BIBLIO_RESULT.subtitle %][% END %]
+                [% BIBLIO_RESULT.title | $raw %]
+                [% IF ( BIBLIO_RESULT.subtitle ) %] [% BIBLIO_RESULT.subtitle | $raw %][% END %]
             </span>
 
             <p>
             [% IF ( BIBLIO_RESULT.HASAUTHORS ) %]
-            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author %][% END %]
+            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author | $raw %][% END %]
 
             [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
-                [% IF ( BIBLIO_RESULT.author ) %]; [% END %]
+                [% IF ( BIBLIO_RESULT.author.raw ) %]; [% END %]
                 [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                     [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                        [% MARCAUTHOR_SUBFIELDS_LOO.separator %][% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                        [% MARCAUTHOR_SUBFIELDS_LOO.separator | $raw %][% MARCAUTHOR_SUBFIELDS_LOO.value | $raw %]
                     [% END %]
                     [% UNLESS ( loop.last ) %];[% END %]
                 [% END %]
@@ -52,81 +53,81 @@ Your cart
 
             [% IF ( BIBLIO_RESULT.ISBN ) %]
             <span>
-                ISBN: [% BIBLIO_RESULT.ISBN %]
+                ISBN: [% BIBLIO_RESULT.ISBN | $raw %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.publishercode %]
             <span>
-                Published by: [% BIBLIO_RESULT.publishercode %]
+                Published by: [% BIBLIO_RESULT.publishercode | $raw %]
                 [% IF ( BIBLIO_RESULT.publicationyear ) %]
-                    in [% BIBLIO_RESULT.publicationyear %]
+                    in [% BIBLIO_RESULT.publicationyear | $raw %]
                 [% END %]
                 [% IF ( BIBLIO_RESULT.pages ) %]
-                    , [% BIBLIO_RESULT.pages %]
+                    , [% BIBLIO_RESULT.pages | $raw %]
                 [% END %]
                 [% IF BIBLIO_RESULT.item('size') %]
-                , [% BIBLIO_RESULT.item('size') %]
+                , [% BIBLIO_RESULT.item('size') | $raw %]
                 [% END %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.collection %]
             <span>
-                Collection: [% BIBLIO_RESULT.seriestitle %]
+                Collection: [% BIBLIO_RESULT.seriestitle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.subject ) %]
             <span>
-                Subject: [% BIBLIO_RESULT.subject %]
+                Subject: [% BIBLIO_RESULT.subject | $raw %]
             <span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.copyrightdate ) %]
             <span>
-                Copyright year: [% BIBLIO_RESULT.copyrightdate %]
+                Copyright year: [% BIBLIO_RESULT.copyrightdate | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.notes ) %]
             <span>
-                Notes : [% BIBLIO_RESULT.notes %]
+                Notes : [% BIBLIO_RESULT.notes | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.unititle ) %]
             <span>
-                Unified title: [% BIBLIO_RESULT.unititle %]
+                Unified title: [% BIBLIO_RESULT.unititle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.serial ) %]
             <span>
-                Serial: [% BIBLIO_RESULT.serial %]
+                Serial: [% BIBLIO_RESULT.serial | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.dewey ) %]
             <span>
-                Dewey: [% BIBLIO_RESULT.dewey %]
+                Dewey: [% BIBLIO_RESULT.dewey | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.classification ) %]
             <span>
-                Classification: [% BIBLIO_RESULT.classification %]
+                Classification: [% BIBLIO_RESULT.classification | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.lccn ) %]
             <span>
-                LCCN: [% BIBLIO_RESULT.lccn %]
+                LCCN: [% BIBLIO_RESULT.lccn | $raw %]
             </span><br/>
             [% END %]
             [% IF ( BIBLIO_RESULT.url ) %]
             <span>
-                URL: [% BIBLIO_RESULT.url %]
+                URL: [% BIBLIO_RESULT.url | html %]
             </span>
             [% END %]
             </p>
@@ -134,17 +135,17 @@ Your cart
             [% SET OPACBaseURL = Koha.Preference('OPACBaseURL') %]
             [% IF ( OPACBaseURL ) %]
             <p>
-                In online catalog: [% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber %]
+                In online catalog: [% OPACBaseURL | $raw %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber | html %]
             </p>
             [% END %]
             [% IF ( BIBLIO_RESULT.ITEM_RESULTS.size ) %]
             <p>Items:
             <ul>
                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]<li>
-                    [% ITEM_RESULT.branchname %]
-                    [% ITEM_RESULT.location %]
-                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber %])[% END %]
-                    [% ITEM_RESULT.barcode %]
+                    [% ITEM_RESULT.branchname | $raw %]
+                    [% ITEM_RESULT.location | $raw %]
+                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber | $raw %])[% END %]
+                    [% ITEM_RESULT.barcode | $raw %]
                 </li>[% END %]
             </ul>
             </p>
index 2cab418..a1106f5 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your cart</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your cart</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -34,8 +34,8 @@
                                     <input type="text" id="email_add" name="email_add" size="43" class="focus" />
                                     <label for="comment">Comment:</label>
                                     <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
-                                    <input type="hidden" name="bib_list" value="[% bib_list %]" />
-                                    <input type="hidden" name="csrf_token" value="[% csrf_token %]" />
+                                    <input type="hidden" name="bib_list" value="[% bib_list | html %]" />
+                                    <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                                 </fieldset>
                                 [% IF Koha.Preference('RequestOnOpac') || Koha.Preference('OpacRenewalAllowed') %]<p id="donotrequestbymail">Please do not use this mail to request or renew books.</p>[% END %]
                                 <fieldset class="action">
index 13efe3b..d883320 100644 (file)
@@ -1,5 +1,6 @@
+[% USE raw %]
 <SUBJECT>
-Your list : [% shelfname %]
+Your list : [% shelfname | $raw %]
 <END_SUBJECT>
 
 [% USE HtmlToText %]
@@ -8,8 +9,8 @@ Your list : [% shelfname %]
 [% FILTER html2text %]
     <p>Hi,</p>
 
-    <p>[% firstname %] [% surname %] sent you from our online catalog, the
-    virtual shelf called : [% shelfname %].</p>
+    <p>[% firstname | $raw %] [% surname | $raw %] sent you from our online catalog, the
+    virtual shelf called : [% shelfname | $raw %].</p>
 
     <p>Please note that the attached file is a MARC bibliographic records file
     which can be imported into personal bibliographic software like EndNote,
@@ -23,30 +24,30 @@ Your list : [% shelfname %]
 [% FILTER html2text %]
 
     [% IF comment %]
-        <p>[% comment %]</p>
+        <p>[% comment | $raw %]</p>
         <hr/>
     [% END %]
     <ol>
     [% FOREACH BIBLIO_RESULT IN BIBLIO_RESULTS %]
         <li>
             <span>
-                [% BIBLIO_RESULT.title %]
+                [% BIBLIO_RESULT.title | $raw %]
                 [% IF ( BIBLIO_RESULT.subtitle.size ) %]
                   [% FOREACH subtitle IN BIBLIO_RESULT.subtitle %]
-                    [% subtitle.subfield %]
+                    [% subtitle.subfield | $raw %]
                   [% END %]
                 [% END %]
             </span>
 
             <p>
             [% IF ( BIBLIO_RESULT.HASAUTHORS ) %]
-            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author %][% END %]
+            <span>Author(s): [% IF ( BIBLIO_RESULT.author ) %][% BIBLIO_RESULT.author | $raw %][% END %]
 
             [% IF ( BIBLIO_RESULT.MARCAUTHORS ) %]
                 [% IF ( BIBLIO_RESULT.author ) %]; [% END %]
                 [% FOREACH MARCAUTHOR IN BIBLIO_RESULT.MARCAUTHORS %]
                     [% FOREACH MARCAUTHOR_SUBFIELDS_LOO IN MARCAUTHOR.MARCAUTHOR_SUBFIELDS_LOOP %]
-                        [% MARCAUTHOR_SUBFIELDS_LOO.separator %][% MARCAUTHOR_SUBFIELDS_LOO.value %]
+                        [% MARCAUTHOR_SUBFIELDS_LOO.separator | $raw %][% MARCAUTHOR_SUBFIELDS_LOO.value | $raw %]
                     [% END %]
                     [% UNLESS ( loop.last ) %];[% END %]
                 [% END %]
@@ -57,7 +58,7 @@ Your list : [% shelfname %]
             [% IF ( BIBLIO_RESULT.ISBN ) %]
             <span>
                 ISBN: [% FOREACH isbn IN BIBLIO_RESULT.ISBN %]
-                          [% isbn %]
+                          [% isbn | $raw %]
                           [% UNLESS ( loop.last ) %]; [% END %]
                       [% END %]
             </span><br/>
@@ -65,92 +66,92 @@ Your list : [% shelfname %]
 
             [% IF BIBLIO_RESULT.publishercode %]
             <span>
-                Published by: [% BIBLIO_RESULT.publishercode %]
+                Published by: [% BIBLIO_RESULT.publishercode | $raw %]
                 [% IF ( BIBLIO_RESULT.publicationyear ) %]
-                    in [% BIBLIO_RESULT.publicationyear %]
+                    in [% BIBLIO_RESULT.publicationyear | $raw %]
                 [% END %]
                 [% IF ( BIBLIO_RESULT.pages ) %]
-                    , [% BIBLIO_RESULT.pages %]
+                    , [% BIBLIO_RESULT.pages | $raw %]
                 [% END %]
                 [% IF BIBLIO_RESULT.item('size') %]
-                , [% BIBLIO_RESULT.item('size') %]
+                , [% BIBLIO_RESULT.item('size') | html %]
                 [% END %]
             </span><br/>
             [% END %]
 
             [% IF BIBLIO_RESULT.collection %]
             <span>
-                Collection: [% BIBLIO_RESULT.seriestitle %]
+                Collection: [% BIBLIO_RESULT.seriestitle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.subject ) %]
             <span>
-                Subject: [% BIBLIO_RESULT.subject %]
+                Subject: [% BIBLIO_RESULT.subject | $raw %]
             <span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.copyrightdate ) %]
             <span>
-                Copyright year: [% BIBLIO_RESULT.copyrightdate %]
+                Copyright year: [% BIBLIO_RESULT.copyrightdate | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.notes ) %]
             <span>
-                Notes : [% BIBLIO_RESULT.notes %]
+                Notes : [% BIBLIO_RESULT.notes | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.unititle ) %]
             <span>
-                Unified title: [% BIBLIO_RESULT.unititle %]
+                Unified title: [% BIBLIO_RESULT.unititle | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.serial ) %]
             <span>
-                Serial: [% BIBLIO_RESULT.serial %]
+                Serial: [% BIBLIO_RESULT.serial | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.dewey ) %]
             <span>
-                Dewey: [% BIBLIO_RESULT.dewey %]
+                Dewey: [% BIBLIO_RESULT.dewey | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.classification ) %]
             <span>
-                Classification: [% BIBLIO_RESULT.classification %]
+                Classification: [% BIBLIO_RESULT.classification | $raw %]
             </span><br/>
             [% END %]
 
             [% IF ( BIBLIO_RESULT.lccn ) %]
             <span>
-                LCCN: [% BIBLIO_RESULT.lccn %]
+                LCCN: [% BIBLIO_RESULT.lccn | $raw %]
             </span><br/>
             [% END %]
             [% IF ( BIBLIO_RESULT.url ) %]
             <span>
-                URL: [% BIBLIO_RESULT.url %]
+                URL: [% BIBLIO_RESULT.url | html %]
             </span>
             [% END %]
             </p>
 
             [% IF ( OPACBaseURL ) %]
             <p>
-                In online catalog: [% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber %]
+                In online catalog: [% OPACBaseURL | $raw %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% BIBLIO_RESULT.biblionumber | html %]
             </p>
             [% END %]
             [% IF ( BIBLIO_RESULT.ITEM_RESULTS.size ) %]
             <p>Items:
             <ul>
                 [% FOREACH ITEM_RESULT IN BIBLIO_RESULT.ITEM_RESULTS %]<li>
-                    [% ITEM_RESULT.branchname %]
-                    [% ITEM_RESULT.location %]
-                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber %])[% END %]
-                    [% ITEM_RESULT.barcode %]
+                    [% ITEM_RESULT.branchname | $raw %]
+                    [% ITEM_RESULT.location | $raw %]
+                    [% IF ITEM_RESULT.itemcallnumber %]([% ITEM_RESULT.itemcallnumber | $raw %])[% END %]
+                    [% ITEM_RESULT.barcode | $raw %]
                 </li>[% END %]
             </ul>
             </p>
index bc901b1..e113b3f 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your list</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Sending your list</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -16,7 +16,7 @@
                                 <div class="alert alert-success">
                                     <p>The list was sent to: [% email | html %]</p>
                                 </div>
-                                <p><a class="focus close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid %]">Back to lists</a></p>
+                                <p><a class="focus close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Back to lists</a></p>
                             [% END %]
                             [% IF ( error ) %]
                                 <div class="alert">
@@ -28,7 +28,7 @@
                                 <div class="alert">
                                     <p>You do not have permission to send this list.</p>
                                 </div>
-                                <p><a class="button close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid %]">Back to lists</a></p>
+                                <p><a class="button close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Back to lists</a></p>
                             [% ELSE %]
                                 <h1>Sending your list</h1>
                                 <form action="/cgi-bin/koha/opac-sendshelf.pl" method="post" id="sendshelfform">
                                         <label for="comment">Comment:</label>
                                         <textarea id="comment" name="comment" rows="4" cols="40"></textarea>
 
-                                        <input type="hidden" name="shelfid" value="[% shelfid %]" />
+                                        <input type="hidden" name="shelfid" value="[% shelfid | html %]" />
                                     </fieldset>
                                     [% IF Koha.Preference('RequestOnOpac') || Koha.Preference('OpacRenewalAllowed') %]<p id="donotrequestbymail">Please do not use this mail to request or renew books.</p>[% END %]
                                     <fieldset class="action">
                                         <input type="submit" value="Send" class="btn" />
-                                        <a class="cancel close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid %]">Cancel</a>
+                                        <a class="cancel close" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelfid | html %]">Cancel</a>
                                     </fieldset>
                                 </form>
 
index 7cee2fd..da453bc 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Issues for a subscription</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;  Issues for a subscription</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -10,7 +10,7 @@
     <div class="main">
         <ul class="breadcrumb">
             <li><a href="/cgi-bin/koha/opac-main.pl">Home</a> <span class="divider">&rsaquo;</span></li>
-            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle %]</a> <span class="divider">&rsaquo;</span></li>
+            <li><a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">Details for [% bibliotitle | html %]</a> <span class="divider">&rsaquo;</span></li>
             <li><a href="#">Issues for a subscription</a></li>
         </ul>
 
                                 <a id="Normalview" href="opac-detail.pl?biblionumber=[% biblionumber | html %]" class="button">Normal view</a>
                             </span>
                             <span class="view"><span id="Briefhistory">Brief history</span></span>
-                            <span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=[% biblionumber | html%]" class="button">Full history</a></span>
+                            <span class="view"><a id="Fullhistory" href="opac-serial-issues.pl?selectview=full&amp;biblionumber=[% biblionumber | html %]" class="button">Full history</a></span>
                         </div>
                         <form method="post" name="f">
                             [% FOREACH subscription_LOO IN subscription_LOOP %]
-                                <div id="subscriptionline[% subscription_LOO.subscriptionid %]" style="border-bottom:1px solid #EEE;">
-                                    <h3>Subscription information for [% subscription_LOO.bibliotitle %]</h3>
+                                <div id="subscriptionline[% subscription_LOO.subscriptionid | html %]" style="border-bottom:1px solid #EEE;">
+                                    <h3>Subscription information for [% subscription_LOO.bibliotitle | html %]</h3>
                                     <p>
-                                        The current subscription began on [% subscription_LOO.startdate %] and is issued
+                                        The current subscription began on [% subscription_LOO.startdate | html %] and is issued
                                         [% IF ( subscription_LOO.periodicity1 ) %]
                                                 twice per day
                                         [% END %]
                                         [% END %]
 
                                         for
-                                            [% IF ( subscription_LOO.numberlength ) %][% subscription_LOO.numberlength %] issues[% END %]
-                                            [% IF ( subscription_LOO.weeklength ) %][% subscription_LOO.weeklength %] weeks[% END %]
-                                            [% IF ( subscription_LOO.monthlength ) %][% subscription_LOO.monthlength %] months[% END %]
+                                            [% IF ( subscription_LOO.numberlength ) %][% subscription_LOO.numberlength | html %] issues[% END %]
+                                            [% IF ( subscription_LOO.weeklength ) %][% subscription_LOO.weeklength | html %] weeks[% END %]
+                                            [% IF ( subscription_LOO.monthlength ) %][% subscription_LOO.monthlength | html %] months[% END %]
                                     </p>
-                                    <p>The first subscription was started on  [% subscription_LOO.histstartdate %]</p>
+                                    <p>The first subscription was started on  [% subscription_LOO.histstartdate | html %]</p>
                                     [% IF ( subscription_LOO.histenddate ) %]
-                                        <p>The subscription expired on [% subscription_LOO.histenddate %]</p>
+                                        <p>The subscription expired on [% subscription_LOO.histenddate | html %]</p>
                                     [% END %]
 
-                                    <h4>[% subscription_LOO.branchname %]</h4>
+                                    <h4>[% subscription_LOO.branchname | html %]</h4>
 
                                     [% IF ( subscription_LOO.notes ) %]
-                                        <p>[% subscription_LOO.notes FILTER html_line_break %]</p>
+                                        <p>[% subscription_LOO.notes FILTER html_line_break | html %]</p>
                                     [% END %]
 
                                     [% IF ( subscription_LOO.recievedlist ) %]
                                         <h5>Available issues</h5>
-                                            <p>[% subscription_LOO.recievedlist %]</p>
+                                            <p>[% subscription_LOO.recievedlist | html %]</p>
                                     [% END %]
 
                                     [% IF ( subscription_LOO.missinglist ) %]
                                         <h5>Unavailable issues</h5>
-                                        <p>[% subscription_LOO.missinglist %]</p>
+                                        <p>[% subscription_LOO.missinglist | html %]</p>
                                     [% END %]
 
                                     [% IF ( subscription_LOO.opacnote ) %]
                                         <h5>Issues summary</h5>
                                         <p>
-                                            [% subscription_LOO.opacnote FILTER html_line_break %]
+                                            [% subscription_LOO.opacnote FILTER html_line_break | html %]
                                         </p>
                                     [% END %]
                                     [% IF ( subscription_LOO.letter ) %]
                                         [% IF ( loggedinusername ) %]
                                             [% IF ( subscription_LOO.hasalert ) %]
-                                                You have subscribed to email notification on new issues <a href="opac-alert-subscribe.pl?op=cancel&amp;subscriptionid=[% subscription_LOO.subscriptionid %]&amp;referer=serial&amp;biblionumber=[% subscription_LOO.biblionumber %]" class="btn" title="Cancel email notification">
+                                                You have subscribed to email notification on new issues <a href="opac-alert-subscribe.pl?op=cancel&amp;subscriptionid=[% subscription_LOO.subscriptionid | html %]&amp;referer=serial&amp;biblionumber=[% subscription_LOO.biblionumber | html %]" class="btn" title="Cancel email notification">
                                                     Cancel email notification
                                                 </a>
                                             [% ELSE %]
-                                                <a href="opac-alert-subscribe.pl?subscriptionid=[% subscription_LOO.subscriptionid %]&amp;referer=serial&amp;biblionumber=[% subscription_LOO.biblionumber %]" class="btn" title="Subscribe to email notification on new issues">
+                                                <a href="opac-alert-subscribe.pl?subscriptionid=[% subscription_LOO.subscriptionid | html %]&amp;referer=serial&amp;biblionumber=[% subscription_LOO.biblionumber | html %]" class="btn" title="Subscribe to email notification on new issues">
                                                     Subscribe to email notification on new issues
                                                 </a>
                                             [% END %]
index cffc687..6963588 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Share a list</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Share a list</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -51,7 +51,7 @@
         <fieldset class="rows">
             <ol>
             <input type="hidden" name="op" value="conf_invite"/>
-            <input type="hidden" name="shelfnumber" value="[% shelfnumber %]"/>
+            <input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]"/>
             <li><label for="name">List name:</label> [% shelfname | html %]</li>
             <li>
                 <label for="invite_address">Email address:</label>
     [% ELSIF op=='conf_invite' %]
         <div id="conf_invite">
         [% IF approvedaddress %]
-        <p>An invitation to share list <i>[% shelfname | html %]</i> will be sent shortly to [% approvedaddress %].</p>
+        <p>An invitation to share list <i>[% shelfname | html %]</i> will be sent shortly to [% approvedaddress | html %].</p>
         [% END %]
         [% IF failaddress %]
-            <p>Something went wrong while processing the following addresses. Please check them. These are: [% failaddress %]</p>
+            <p>Something went wrong while processing the following addresses. Please check them. These are: [% failaddress | html %]</p>
         [% END %]
         [% IF approvedaddress %]
         <p>You will receive an email notification if someone accepts your share within two weeks.</p>
index 5e01834..3886aec 100644 (file)
@@ -4,7 +4,7 @@
 
 <channel>
  <title>[% shelf.shelfname | html %]</title>
- <link>[% OPACBaseURL %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;viewshelf=[% shelf.shelfnumber %]</link>
+ <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;viewshelf=[% shelf.shelfnumber | html %]</link>
  <description>RSS feed for public list [% shelf.shelfname | html %]</description>
 
 [% FOREACH i IN itemsloop %]
@@ -15,7 +15,7 @@
         by [% i.author | html %]
     [% END %]
   </title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber %]</link>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber | html %]</link>
  </item>
 [% END %]
 
index 004937f..5dce617 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% SET PRIVATE = 1 %]
@@ -6,7 +7,7 @@
 [% SET TagsInputEnabled = ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && ( Koha.Preference( 'TagsEnabled' ) == 1 ) && Koha.Preference('TagsInputOnList') ) %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;   [% IF op == 'view' %]Contents of [% shelf.shelfname |html %][% ELSE %]Your lists[% END %]</title>[% INCLUDE 'doc-head-close.inc' %]
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;   [% IF op == 'view' %]Contents of [% shelf.shelfname | html %][% ELSE %]Your lists[% END %]</title>[% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
 [% IF ( loggedinusername ) %][% INCLUDE 'bodytag.inc' bodyid='opac-userlists' bodyclass='scrollto' %][% ELSE %][% INCLUDE 'bodytag.inc' bodyid='opac-lists' bodyclass='scrollto' %][% END %]
 
         [% IF shelf and shelf.is_private %]
             [% IF op == 'view' OR op == 'edit_form' %]
-                <li><span class="divider">&rsaquo;</span> <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE %]">Your lists</a></li>
+                <li><span class="divider">&rsaquo;</span> <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE | html %]">Your lists</a></li>
             [% ELSE %]
                 <li><span class="divider">&rsaquo;</span> Your lists</li>
             [% END %]
         [% ELSIF shelf AND shelf.is_public %]
             [% IF op == 'view' %]
-                <li><span class="divider">&rsaquo;</span> <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC %]">Public lists</a></li>
+                <li><span class="divider">&rsaquo;</span> <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC | html %]">Public lists</a></li>
             [% ELSE %]
                 <li><span class="divider">&rsaquo;</span> Public lists</li>
             [% END %]
                     [% CASE 'no_biblio_removed' %]
                         <span>No record was removed.</span>
                     [% CASE 'Koha::Exceptions::Virtualshelves::DuplicateObject' %]
-                        <span>An error occurred when creating the list. The name [% shelfname %] already exists.</span>
+                        <span>An error occurred when creating the list. The name [% shelfname | html %] already exists.</span>
                     [% CASE 'DBIx::Class::Exception' %]
-                        [% m.msg %]
+                        [% m.msg | html %]
                     [% CASE %]
-                        [% m.code %]
-                        [% m.msg %]
+                        [% m.code | html %]
+                        [% m.msg | html %]
                     [% END %]
                     </div>
                 [% END %]
 
                     [% IF shelf AND op == 'view' %]
                         <h3>
-                            [% shelf.shelfname |html %]
-                            <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;op=view&amp;shelfnumber=[% shelf.shelfnumber %]" class="rss-list-link noprint">
-                                <img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to this list" title="Subscribe to this list" border="0" class="rsssearchicon"/>
+                            [% shelf.shelfname | html %]
+                            <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-shelves.pl?rss=1&amp;op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]" class="rss-list-link noprint">
+                                <img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to this list" title="Subscribe to this list" border="0" class="rsssearchicon"/>
                             </a>
                         </h3>
 
-                        [% IF ( itemsloop ) %]
-                            <div id="toolbar" class="toolbar clearfix">
-                                <div class="list-actions">
+                         [% IF ( itemsloop ) %]
+                             <div id="toolbar" class="toolbar clearfix">
+                                 <div class="list-actions">
                                     <a class="newshelf" href="/cgi-bin/koha/opac-shelves.pl?op=add_form">New list</a> <span class="sep">|</span>
                                     <a href="/cgi-bin/koha/opac-downloadshelf.pl?shelfnumber=[% shelf.shelfnumber | html %]" class="download" data-toggle="modal" data-target="#modalWin">Download list</a>
 
                                         <span class="sendlist"><a href="/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelf.shelfnumber | html %]" class="send" onclick="open('/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelf.shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100'); return false; ">Send list</a></span>
                                     [% END %]
 
-                                    <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]&sortfield=[% sortfield %]&direction=[% direction |uri %]&print=1">Print list</a>
+                                    <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]&sortfield=[% sortfield | html %]&direction=[% direction |uri %]&print=1">Print list</a>
 
                                     [% IF can_manage_shelf %]
                                         <span class="sep">|</span>
                                         <tbody>
                                         [% FOREACH itemsloo IN itemsloop %]
                                             <tr>
-                                                <td class="select selectcol"><input type="checkbox" class="cb" name="biblionumber" value="[% itemsloo.biblionumber %]" /></td>
+                                                <td class="select selectcol"><input type="checkbox" class="cb" name="biblionumber" value="[% itemsloo.biblionumber | html %]" /></td>
                                                 [% UNLESS ( item_level_itypes ) %]
                                                     <td>
                                                         [% UNLESS ( noItemTypeImages ) %]
-                                                            <img src="[% itemsloo.imageurl %]" alt="[% itemsloo.description %]" title="[% itemsloo.description %]" />
+                                                            <img src="[% itemsloo.imageurl | html %]" alt="[% itemsloo.description | html %]" title="[% itemsloo.description | html %]" />
                                                         [% END %]
-                                                        [% itemsloo.description %]
+                                                        [% itemsloo.description | html %]
                                                     </td>
                                                 [% END %]
                                                 <td>
                                                     <div class="coverimages">
-                                                        <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% itemsloo.biblionumber %]">
+                                                        <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% itemsloo.biblionumber | html %]">
                                                             [% IF ( OPACLocalCoverImages ) %]
-                                                                <span title="[% itemsloo.biblionumber |url %]" class="[% itemsloo.biblionumber %]" id="local-thumbnail[% loop.count %]"></span>
+                                                                <span title="[% itemsloo.biblionumber |url %]" class="[% itemsloo.biblionumber | html %]" id="local-thumbnail[% loop.count | html %]"></span>
                                                             [% END %]
 
                                                             [% IF ( OPACAmazonCoverImages ) %]
                                                                 [% IF ( itemsloo.normalized_isbn ) %]
-                                                                    <span title="[% itemsloo.biblionumber %]" id="amazon-thumbnail[% loop.count %]"><img src="https://images-na.ssl-images-amazon.com/images/P/[% itemsloo.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" /></span>
+                                                                    <span title="[% itemsloo.biblionumber | html %]" id="amazon-thumbnail[% loop.count | html %]"><img src="https://images-na.ssl-images-amazon.com/images/P/[% itemsloo.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" /></span>
                                                                 [% ELSE %]
                                                                     <span class="no-image">No cover image available</span>
                                                                 [% END %]
                                                             [% END %]
 
                                                             [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
-                                                                <span title="[% itemsloo.biblionumber %]" id="syndetics-thumbnail[% loop.count %]"><img src="https://secure.syndetics.com/index.aspx?isbn=[% itemsloo.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% itemsloo.normalized_upc %]&amp;oclc=[% itemsloo.normalized_oclc %]" alt="" /></span>
+                                                                <span title="[% itemsloo.biblionumber | html %]" id="syndetics-thumbnail[% loop.count | html %]"><img src="https://secure.syndetics.com/index.aspx?isbn=[% itemsloo.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% itemsloo.normalized_upc | html %]&amp;oclc=[% itemsloo.normalized_oclc | html %]" alt="" /></span>
                                                             [% END %]
 
                                                             [% IF ( GoogleJackets ) %]
                                                                 [% IF ( itemsloo.normalized_isbn ) %]
-                                                                    <div title="[% itemsloo.biblionumber |url %]" class="[% itemsloo.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></div>
+                                                                    <div title="[% itemsloo.biblionumber |url %]" class="[% itemsloo.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                                                 [% ELSE %]
                                                                     <span class="no-image">No cover image available</span>
                                                                 [% END %]
                                                             [% END %]
 
                                                             [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-                                                                [% coce_id = itemsloo.normalized_ean || itemsloo.normalized_isbn %]
+                                                                [% coce_id = itemsloo.normalized_ean || itemsloo.normalized_isbn | html %]
                                                                 [% IF ( coce_id ) %]
-                                                                    <span title="[% itemsloo.biblionumber |url %]" class="[% coce_id %]" id="coce-thumbnail[% loop.count %]"></span>
+                                                                    <span title="[% itemsloo.biblionumber |url %]" class="[% coce_id | html %]" id="coce-thumbnail[% loop.count | html %]"></span>
                                                                 [% ELSE %]
                                                                     <span class="no-image">No cover image available</span>
                                                                 [% END %]
 
                                                             [% IF OpenLibraryCovers %]
                                                                 [% IF itemsloo.normalized_isbn %]
-                                                                    <span title="[% itemsloo.biblionumber %]" class="[% itemsloo.normalized_isbn %]" id="openlibrary-thumbnail[% loop.count %]"></span>
+                                                                    <span title="[% itemsloo.biblionumber | html %]" class="[% itemsloo.normalized_isbn | html %]" id="openlibrary-thumbnail[% loop.count | html %]"></span>
                                                                 [% ELSE %]
                                                                     <span class="no-image">No cover image available</span>
                                                                 [% END %]
 
                                                         </a> <!-- / .p1 -->
                                                         [% IF ( BakerTaylorEnabled ) %]
-                                                            [% bt_id = ( itemsloo.normalized_upc || itemsloo.normalized_isbn ) %]
+                                                            [% bt_id = ( itemsloo.normalized_upc || itemsloo.normalized_isbn ) | html %]
                                                             [% IF ( bt_id ) %]
-                                                                <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                                                <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                                                             [% ELSE %]
                                                                 <span class="no-image">No cover image available</span>
                                                             [% END %]
                                                         [% END %]
                                                     </div>
                                                     [% IF ( itemsloo.XSLTBloc ) %]
-                                                        [% itemsloo.XSLTBloc %]
+                                                        [% itemsloo.XSLTBloc | $raw %]
                                                     [% ELSE %]
 
                                                         [% IF ( itemsloo.BiblioDefaultViewmarc ) %]
                                                         [% END %]
 
                                                         [% IF ( itemsloo.title ) %]
-                                                            [% itemsloo.title |html %]
+                                                            [% itemsloo.title | html %]
                                                         [% ELSE %]
                                                             No title
                                                         [% END %]
 
                                                         [% FOREACH subtitl IN itemsloo.subtitle %]
-                                                            [% subtitl.subfield|html %]
+                                                            [% subtitl.subfield | html %]
                                                         [% END %]
                                                         </a>
 
                                                         [% IF ( itemsloo.author ) %]
-                                                            by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% itemsloo.author |url %]" title="Search for works by this author" class="author">[% itemsloo.author %]</a>
+                                                            by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% itemsloo.author |url %]" title="Search for works by this author" class="author">[% itemsloo.author | html %]</a>
                                                         [% ELSE %]
                                                             &nbsp;
                                                         [% END %]
                                                         <span class="results_summary">
                                                             <span class="label">Publication:</span>
                                                             [% IF ( itemsloo.place ) %]
-                                                                [% itemsloo.place %]
+                                                                [% itemsloo.place | html %]
                                                             [% END %]
                                                             [% IF ( itemsloo.publishercode ) %]
-                                                                [% itemsloo.publishercode|html %]
+                                                                [% itemsloo.publishercode | html %]
                                                             [% END %]
                                                             [% IF ( itemsloo.publicationyear ) %]
-                                                                [% itemsloo.publicationyear %]
+                                                                [% itemsloo.publicationyear | html %]
                                                             [% ELSE %]
                                                                 [% IF ( itemsloo.copyrightdate ) %]
-                                                                    [% itemsloo.copyrightdate %]
+                                                                    [% itemsloo.copyrightdate | html %]
                                                                 [% END %]
                                                             [% END %]
-                                                            [% IF ( itemsloo.pages ) %]. [% itemsloo.pages %][% END %]
-                                                            [% IF ( itemsloo.notes ) %], [% itemsloo.notes|html %][% END %]
-                                                            [% IF ( itemsloo.item('size') ) %] [% itemsloo.item('size') %][% END %]
+                                                            [% IF ( itemsloo.pages ) %]. [% itemsloo.pages | html %][% END %]
+                                                            [% IF ( itemsloo.notes ) %], [% itemsloo.notes | html %][% END %]
+                                                            [% IF ( itemsloo.item('size') ) %] [% itemsloo.item('size') | html %][% END %]
                                                         </span>
                                                         <span class="results_summary">
                                                             <span class="label">Holdings:</span>
                                                             [% IF ( itemsloo.ITEM_RESULTS ) %]
                                                                 [% FOREACH ITEM_RESULT IN itemsloo.ITEM_RESULTS %]
-                                                                    [% ITEM_RESULT.homebranch %]
+                                                                    [% ITEM_RESULT.homebranch | html %]
                                                                     [% IF ( ITEM_RESULT.location_opac ) %]
-                                                                        , [% ITEM_RESULT.location_opac %]
+                                                                        , [% ITEM_RESULT.location_opac | html %]
                                                                     [% END %]
                                                                     [% IF ( ITEM_RESULT.itemcallnumber ) %]
-                                                                        ([% ITEM_RESULT.itemcallnumber %])
+                                                                        ([% ITEM_RESULT.itemcallnumber | html %])
                                                                             [% IF ( loop.last ) %].[% ELSE %],[% END %]
                                                                     [% END %]
                                                                 [% END %]
                                                             <span class="label">Tags:</span>
                                                             <ul>
                                                                 [% FOREACH TagLoo IN itemsloo.TagLoop %]
-                                                                    <li><a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term %]</a> <span class="weight">([% TagLoo.weight_total %])</span></li>
+                                                                    <li><a href="/cgi-bin/koha/opac-search.pl?tag=[% TagLoo.term |url %]&amp;q=[% TagLoo.term |url %]">[% TagLoo.term | html %]</a> <span class="weight">([% TagLoo.weight_total | html %])</span></li>
                                                                 [% END %]
                                                             </ul>
                                                         </div>
                                                             [% UNLESS ( itemsloo.norequests ) %]
                                                                 [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
                                                                     [% IF ( itemsloo.allow_onshelf_holds ) %]
-                                                                        <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% itemsloo.biblionumber %]">Place hold</a><!-- add back when available 0 holds in queue--></span>
+                                                                        <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% itemsloo.biblionumber | html %]">Place hold</a><!-- add back when available 0 holds in queue--></span>
                                                                     [% ELSE %]
                                                                         [% IF ( itemsloo.itemsissued ) %]
-                                                                            <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% itemsloo.biblionumber %]">Place hold</a><!-- add back when available 0 holds in queue--></span>
+                                                                            <span class="actions"><a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% itemsloo.biblionumber | html %]">Place hold</a><!-- add back when available 0 holds in queue--></span>
                                                                         [% END %]
                                                                     [% END %]
                                                                 [% END # / IF opacuserlogin %]
 
                                                         [% IF ( TagsInputEnabled ) %]
                                                             [% IF ( loggedinusername ) %]
-                                                                <span class="actions"><a class="tag_add hidden" id="tag_add[% itemsloo.biblionumber %]" href="#">Add tag</a></span>
-                                                                <div id="tagform[% itemsloo.biblionumber %]" class="tag_results_input" style="display:none;">
-                                                                    <label for="newtag[% itemsloo.biblionumber %]">New tag(s), separated by a comma:</label>
-                                                                    <input name="newtag[% itemsloo.biblionumber %]" id="newtag[% itemsloo.biblionumber %]" maxlength="100" />
-                                                                    <input name="tagbutton" class="tagbutton btn btn-small" title="[% itemsloo.biblionumber %]" type="submit" value="Add" />
-                                                                    <a class="cancel_tag_add" id="cancel[% itemsloo.biblionumber %]" href="#">(done)</a>
+                                                                <span class="actions"><a class="tag_add hidden" id="tag_add[% itemsloo.biblionumber | html %]" href="#">Add tag</a></span>
+                                                                <div id="tagform[% itemsloo.biblionumber | html %]" class="tag_results_input" style="display:none;">
+                                                                    <label for="newtag[% itemsloo.biblionumber | html %]">New tag(s), separated by a comma:</label>
+                                                                    <input name="newtag[% itemsloo.biblionumber | html %]" id="newtag[% itemsloo.biblionumber | html %]" maxlength="100" />
+                                                                    <input name="tagbutton" class="tagbutton btn btn-small" title="[% itemsloo.biblionumber | html %]" type="submit" value="Add" />
+                                                                    <a class="cancel_tag_add" id="cancel[% itemsloo.biblionumber | html %]" href="#">(done)</a>
                                                                 </div>
-                                                                <div id="newtag[% itemsloo.biblionumber %]_status" class="tagstatus" style="display:none;">
+                                                                <div id="newtag[% itemsloo.biblionumber | html %]_status" class="tagstatus" style="display:none;">
                                                                 Tag status here.
                                                                 </div>
                                                             [% ELSIF ( loop.first ) %]
                                                         [% END # / IF TagsInputEnabled %]
 
                                                         [% IF ( ( Koha.Preference( 'opacuserlogin' ) == 1 ) && loggedinusername && ( Koha.Preference( 'virtualshelves' ) == 1 ) ) %]
-                                                            <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber %]'); return false;">Save to another list</a></span>
+                                                            <span class="actions"><a class="addtoshelf" href="/cgi-bin/koha/opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | html %]" onclick="Dopop('opac-addbybiblionumber.pl?biblionumber=[% itemsloo.biblionumber | html %]'); return false;">Save to another list</a></span>
                                                         [% END %]
 
                                                         [% IF can_remove_biblios %]
-                                                            <span class="actions"><a class="removefromlist" href="/cgi-bin/koha/opac-shelves.pl?op=remove_biblios&amp;shelfnumber=[% shelf.shelfnumber %]&amp;biblionumber=[% itemsloo.biblionumber %]">Remove from this list</a></span>
+                                                            <span class="actions"><a class="removefromlist" href="/cgi-bin/koha/opac-shelves.pl?op=remove_biblios&amp;shelfnumber=[% shelf.shelfnumber | html %]&amp;biblionumber=[% itemsloo.biblionumber | html %]">Remove from this list</a></span>
                                                         [% END %]
 
                                                         [% IF Koha.Preference( 'opacbookbag' ) == 1 %]
                                                             [% IF ( itemsloo.incart ) %]
-                                                                <span class="actions"><a class="addtocart cart[% itemsloo.biblionumber %] hidden" href="#" onclick="addRecord('[% itemsloo.biblionumber %]'); return false;">In your cart</a> <a class="cartRemove cartR[% itemsloo.biblionumber %] hidden" href="#" onclick="delSingleRecord('[% itemsloo.biblionumber %]'); return false;">(remove)</a></span>
+                                                                <span class="actions"><a class="addtocart cart[% itemsloo.biblionumber | html %] hidden" href="#" onclick="addRecord('[% itemsloo.biblionumber | html %]'); return false;">In your cart</a> <a class="cartRemove cartR[% itemsloo.biblionumber | html %] hidden" href="#" onclick="delSingleRecord('[% itemsloo.biblionumber | html %]'); return false;">(remove)</a></span>
                                                             [% ELSE %]
-                                                                <span class="actions"><a class="addtocart cart[% itemsloo.biblionumber %] hidden" href="#" onclick="addRecord('[% itemsloo.biblionumber %]'); return false;">Add to cart</a> <a style="display:none;" class="cartRemove cartR[% itemsloo.biblionumber %] hidden" href="#" onclick="delSingleRecord('[% itemsloo.biblionumber %]'); return false;">(remove)</a></span>
+                                                                <span class="actions"><a class="addtocart cart[% itemsloo.biblionumber | html %] hidden" href="#" onclick="addRecord('[% itemsloo.biblionumber | html %]'); return false;">Add to cart</a> <a style="display:none;" class="cartRemove cartR[% itemsloo.biblionumber | html %] hidden" href="#" onclick="delSingleRecord('[% itemsloo.biblionumber | html %]'); return false;">(remove)</a></span>
                                                             [% END %]
                                                         [% END # / IF opacbookbag %]
                                                     </span> <!-- / .results_summary .actions -->
 
                                                     <!-- COinS / Openurl -->
-                                                    <span class="Z3988" title="[% itemsloo.coins %]"></span>
+                                                    <span class="Z3988" title="[% itemsloo.coins | html %]"></span>
                                                 </td>
                                             </tr>
                                         [% END # / FOREACH itemsloop %]
                                 </div><!-- / .searchresults -->
 
                             [% IF ( pagination_bar ) %]
-                                <div class="pages">[% pagination_bar %]</div>
+                                <div class="pages">[% pagination_bar | $raw %]</div>
                             [% END %]
 
                         [% ELSE %]
 
                                         <form method="post" action="/cgi-bin/koha/opac-shelves.pl" class="form-inline">
                                             <input type="hidden" name="op" value="delete" />
-                                            <input type="hidden" name="shelfnumber" value="[% shelfnumber | html  %]"/>
+                                            <input type="hidden" name="shelfnumber" value="[% shelfnumber | html %]"/>
                                             <input type="hidden" name="category" value="category" />
                                             <input type="submit" class="deleteshelf" value="Delete list" onclick="return confirmDelete(MSG_CONFIRM_DELETE_LIST);"/>
                                         </form>
                                 [% END %]
                             </div>
                         [% END # / IF itemsloop %]
-                    [% END %]
-
+                      [% END %]
                     [% IF itemsloop && can_remove_biblios %]
                         <input type="hidden" name="op" value="remove_biblios" />
                         <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
                         <form method="post" action="opac-shelves.pl">
                         <input type="hidden" name="op" value="delete" />
                         <input type="hidden" name="referer" value="list" />
-                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html  %]"/>
+                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]"/>
                         <input type="submit" class="btn btn-danger" value="Delete this list" onclick="return confirmDelete(MSG_CONFIRM_DELETE_LIST)" />
                         </form>
                     [% END %]
                                     <legend>Create a new list</legend>
                                     <input type="hidden" name="op" value="add" />
                                 [% ELSE %]
-                                    <legend>Editing <em>[% shelf.shelfname |html %]</em></legend>
+                                    <legend>Editing <em>[% shelf.shelfname | html %]</em></legend>
                                     <input type="hidden" name="op" value="edit" />
                                     <input type="hidden" name="referer" value="[% referer | html %]" />
                                     <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
                                 [% END %]
-                                <input type="hidden" name="owner" id="owner" value="[% loggedinusernumber %]" />
+                                <input type="hidden" name="owner" id="owner" value="[% loggedinusernumber | html %]" />
                                 <ol>
                                     <li>
                                         <label class="required" for="shelfname">List name: </label>
-                                        <input type="text" id="shelfname" name="shelfname" maxlength="255" value="[% shelf.shelfname |html %]" required="required" class="required"/> <span class="required">Required</span></li>
+                                        <input type="text" id="shelfname" name="shelfname" maxlength="255" value="[% shelf.shelfname | html %]" required="required" class="required"/> <span class="required">Required</span></li>
                                     <li>
                                         <label for="sortfield" >Sort this list by: </label>
                                         <select name="sortfield" id="sortfield">
                                     [% INCLUDE list_permissions %]
                                 </ol>
                                 [% UNLESS Koha.Preference('OpacAllowPublicListCreation') OR category == PUBLIC %]
-                                    <input type="hidden" name="category" value="[% PRIVATE %]" />
+                                    <input type="hidden" name="category" value="[% PRIVATE | html %]" />
                                 [% END %]
                             </fieldset>
 
                             <fieldset class="action">
                                 <input type="submit" value="Save" class="btn" />
                                 [% IF referer == 'view' %]
-                                    <a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber %]" class="cancel">Cancel</a>
+                                    <a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% shelf.shelfnumber | html %]" class="cancel">Cancel</a>
                                 [% ELSE %]
-                                     <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE %]" class="cancel">Cancel</a>
+                                     <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE | html %]" class="cancel">Cancel</a>
                                  [% END %]
 
                             </fieldset>
                         <ul class="ui-tabs-nav ui-helper-reset ui-helper-clearfix ui-widget-header ui-corner-all">
                             [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
                                 [% IF category == PRIVATE %]
-                                    <li id="privateshelves_tab" class="ui-state-default ui-corner-top ui-tabs-active ui-state-active"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=listamp;category=[% PRIVATE %]">Your lists</a></li>
+                                    <li id="privateshelves_tab" class="ui-state-default ui-corner-top ui-tabs-active ui-state-active"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=listamp;category=[% PRIVATE | html %]">Your lists</a></li>
                                 [% ELSE %]
-                                    <li id="privateshelves_tab" class="ui-state-default ui-corner-top"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE %]">Your lists</a></li>
+                                    <li id="privateshelves_tab" class="ui-state-default ui-corner-top"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PRIVATE | html %]">Your lists</a></li>
                                 [% END %]
                             [% END %]
                             [% IF category == PUBLIC %]
-                                <li id="publicshelves_tab" class="ui-state-default ui-corner-top ui-tabs-active ui-state-active"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC %]">Public lists</a></li>
+                                <li id="publicshelves_tab" class="ui-state-default ui-corner-top ui-tabs-active ui-state-active"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC | html %]">Public lists</a></li>
                             [% ELSE %]
-                                <li id="publicshelves_tab" class="ui-state-default ui-corner-top"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC %]">Public lists</a></li>
+                                <li id="publicshelves_tab" class="ui-state-default ui-corner-top"><a class="ui-tabs-anchor" href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;category=[% PUBLIC | html %]">Public lists</a></li>
                             [% END %]
                         </ul>
 
                                         [% FOREACH s IN shelves %]
                                             [% SET contents = s.get_contents %]
                                             <tr>
-                                                <td><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber %]">[% s.shelfname |html %]</a></td>
-                                                <td>[% IF contents.count %][% contents.count %] [% IF contents.count == 1 %]item[% ELSE %]items[% END %][% ELSE %]Empty[% END %]</td>
+                                                <td><a href="/cgi-bin/koha/opac-shelves.pl?op=view&amp;shelfnumber=[% s.shelfnumber | html %]">[% s.shelfname | html %]</a></td>
+                                                <td>[% IF contents.count %][% contents.count | html %] [% IF contents.count == 1 %]item[% ELSE %]items[% END %][% ELSE %]Empty[% END %]</td>
                                                 <td>
                                                     [% IF s.is_private %]
                                                         [% IF s.is_shared %]Shared[% ELSE %]Private[% END %]
                                                 <td>
                                                     [% IF s.can_be_managed( loggedinusernumber ) %]
                                                         <form action="/cgi-bin/koha/opac-shelves.pl" method="get" class="form-inline">
-                                                            <input type="hidden" name="shelfnumber" value="[% s.shelfnumber |html %]" />
-                                                            <input type="hidden" name="category" value="[% s.category %]" />
+                                                            <input type="hidden" name="shelfnumber" value="[% s.shelfnumber | html %]" />
+                                                            <input type="hidden" name="category" value="[% s.category | html %]" />
                                                             <input type="hidden" name="op" value="edit_form" />
                                                             <input type="hidden" name="referer" value="list" />
                                                             <input type="submit" class="editshelf" value="Edit" />
                                                         </form>
                                                     [% END %]
                                                     [% IF s.is_private AND s.can_be_managed( loggedinusernumber ) AND Koha.Preference('OpacAllowSharingPrivateLists') %]
-                                                        <a href="/cgi-bin/koha/opac-shareshelf.pl?op=invite&shelfnumber=[% s.shelfnumber |html %]" class="sharelist">Share</a>
+                                                        <a href="/cgi-bin/koha/opac-shareshelf.pl?op=invite&shelfnumber=[% s.shelfnumber | html %]" class="sharelist">Share</a>
                                                     [% END %]
                                                     [% IF s.is_shared_with( loggedinusernumber ) %]
                                                         <form action="opac-shelves.pl" method="post" class="form-inline">
                                         [% END %]
                                     </tbody>
                                 </table>
-                                <div class="pages">[% pagination_bar %]</div>
+                                <div class="pages">[% pagination_bar | $raw %]</div>
                             [% ELSE %]
                                 [% IF category == PUBLIC %]
                                     <p>No public lists.</p>
     <div class="modal-content">
         <div class="modal-body">
             <div style="margin:1em;padding:1em;font-size:150%;">
-                <img src="[% interface %]/[% theme %]/images/loading.gif" /> Loading
+                <img src="[% interface | html %]/[% theme | html %]/images/loading.gif" /> Loading
             </div>
         </div>
     </div>
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 <script>
 //<![CDATA[
 var MSG_REMOVE_FROM_LIST = _("Are you sure you want to remove these items from the list?");
@@ -936,7 +936,7 @@ $(function() {
     [% IF OPACLocalCoverImages %]KOHA.LocalCover.GetCoverFromBibnumber(false);[% END %]
     [% IF ( GoogleJackets ) %]KOHA.Google.GetCoverFromIsbn();[% END %]
     [% IF ( Koha.Preference('Coce') && Koha.Preference('CoceProviders') ) %]
-        KOHA.coce.getURL('[% Koha.Preference('CoceHost') %]', '[% Koha.Preference('CoceProviders') %]');
+        KOHA.coce.getURL('[% Koha.Preference('CoceHost') | html %]', '[% Koha.Preference('CoceProviders') | html %]');
     [% END %]
 
     $('#sort-submit').hide();
index f2b3c8e..b689ff6 100644 (file)
@@ -4,7 +4,7 @@
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='opac-showmarc' %]
 <div id="main">
-<pre>[% MARC_FORMATTED %]</pre>
+<pre>[% MARC_FORMATTED | html %]</pre>
 </div>
 </body>
 </html>
index 2761ba6..19900ab 100644 (file)
@@ -1,34 +1,34 @@
 [% USE KohaDates # XML declaration should have no white space before it %]<?xml version="1.0" encoding="utf-8"?>
 <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
 <channel>
-     <title><![CDATA[[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] Catalog Recent Comments]]></title>
-     <link>[% OPACBaseURL %]/cgi-bin/koha/opac-showreviews.pl&amp;format=rss2</link>
-     <description><![CDATA[ The most recent comments from [% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] Catalog. Comments can be made by logged in users and are moderated by library staff.]]></description>
-     <atom:link href="[% OPACBaseURL %]/cgi-bin/koha/opac-showreviews.pl&amp;format=rss2" rel="self" type="application/rss+xml" />
-     <lastBuildDate>[% timestamp %]</lastBuildDate>
+     <title><![CDATA[[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] Catalog Recent Comments]]></title>
+     <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-showreviews.pl&amp;format=rss2</link>
+     <description><![CDATA[ The most recent comments from [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] Catalog. Comments can be made by logged in users and are moderated by library staff.]]></description>
+     <atom:link href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-showreviews.pl&amp;format=rss2" rel="self" type="application/rss+xml" />
+     <lastBuildDate>[% timestamp | html %]</lastBuildDate>
         [% FOREACH review IN reviews %]
      <item>
-       <title>New comment on [% review.title |html %] [% FOREACH subtitl IN review.subtitle %], [% subtitl.subfield |html %][% END %]</title>
-       <link>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% review.biblionumber %]#comments</link>
+       <title>New comment on [% review.title | html %] [% FOREACH subtitl IN review.subtitle %], [% subtitl.subfield | html %][% END %]</title>
+       <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% review.biblionumber | html %]#comments</link>
        <description><![CDATA[
-[% IF ( OPACAmazonCoverImages ) %][% IF ( review.normalized_isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% review.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" />[% END %][% END %]
+[% IF ( OPACAmazonCoverImages ) %][% IF ( review.normalized_isbn ) %]<img src="https://images-na.ssl-images-amazon.com/images/P/[% review.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" />[% END %][% END %]
 
-[% IF ( SyndeticsEnabled ) %][% IF ( SyndeticsCoverImages ) %][% IF ( review.content_identifier_exists ) %]<img src="https://secure.syndetics.com/index.aspx?isbn=[% review.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% review.normalized_upc %]&amp;oclc=[% review.normalized_oclc %]" alt="" />
+[% IF ( SyndeticsEnabled ) %][% IF ( SyndeticsCoverImages ) %][% IF ( review.content_identifier_exists ) %]<img src="https://secure.syndetics.com/index.aspx?isbn=[% review.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% review.normalized_upc | html %]&amp;oclc=[% review.normalized_oclc | html %]" alt="" />
 [% END %][% END %][% END %]
 
-[% bt_id = ( review.normalized_upc || review.normalized_isbn ) %]
-[% IF ( BakerTaylorEnabled && bt_id ) %]<a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>[% END %]
-          [% IF ( review.author ) %]<p>By [% review.author |html %].</p> [% END %]
-          <p>[% IF ( review.place ) %][% review.place |html %] [% END %][% IF ( review.publishercode ) %][% review.publishercode |html %][% END %][% IF ( review.publicationyear ) %] [% review.publicationyear |html %]
-                    [% ELSE %][% IF ( review.copyrightdate ) %] [% review.copyrightdate |html %][% END %][% END %]
-                        [% IF ( review.pages ) %]. [% review.pages |html %][% END %]
-                        [% IF ( review.notes ) %], [% review.notes |html %][% END %]
-                        [% IF ( review.size ) %] [% review.size |html %]. [% END %]
-                        [% IF ( review.isbn ) %] [% review.isbn |html %][% END %] </p>
-<p>[% IF ( review.borrowernumber && ShowReviewer ) %][% review.firstname %] [% review.surname %] commented[% ELSE %]Comment[% END %] on [% review.datereviewed | $KohaDates %]: [% review.review |html %]</p>
+[% bt_id = ( review.normalized_upc || review.normalized_isbn ) | html %]
+[% IF ( BakerTaylorEnabled && bt_id ) %]<a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>[% END %]
+        [% IF ( review.author ) %]<p>By [% review.author | html %].</p> [% END %]
+        <p>[% IF ( review.place ) %][% review.place | html %] [% END %][% IF ( review.publishercode ) %][% review.publishercode | html %][% END %][% IF ( review.publicationyear ) %] [% review.publicationyear | html %]
+                    [% ELSE %][% IF ( review.copyrightdate ) %] [% review.copyrightdate | html %][% END %][% END %]
+                        [% IF ( review.pages ) %]. [% review.pages | html %][% END %]
+                        [% IF ( review.notes ) %], [% review.notes | html %][% END %]
+                        [% IF ( review.size ) %] [% review.size | html %]. [% END %]
+                        [% IF ( review.isbn ) %] [% review.isbn | html %][% END %] </p>
+<p>[% IF ( review.borrowernumber && ShowReviewer ) %][% review.firstname | html %] [% review.surname | html %] commented[% ELSE %]Comment[% END %] on [% review.datereviewed | $KohaDates %]: [% review.review | html %]</p>
                                                ]]></description>
-       <guid>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% review.biblionumber %]&amp;reviewid=[% review.reviewid %]</guid>
-       <pubDate>[% review.timestamp %]</pubDate>
+       <guid>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% review.biblionumber | html %]&amp;reviewid=[% review.reviewid | html %]</guid>
+       <pubDate>[% review.timestamp | html %]</pubDate>
      </item>
         [% END %]
    </channel>
index efbfcab..e33f098 100644 (file)
@@ -2,10 +2,10 @@
 [% USE KohaDates %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Recent comments</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Recent comments</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
-<link rel="alternate" type="application/rss+xml" title="[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog recent comments" href="[% OPACBaseURL %]/cgi-bin/koha/opac-showreviews.pl?format=rss" />
+<link rel="alternate" type="application/rss+xml" title="[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog recent comments" href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-showreviews.pl?format=rss" />
 </head>
 [% INCLUDE 'bodytag.inc' bodyid='opac-showreviews' bodyclass='scrollto' %]
 [% INCLUDE 'masthead.inc' %]
@@ -29,7 +29,7 @@
                     <div class="span12">
                 [% END %]
                    <div id="showreviews" class="searchresults maincontent">
-                        <h3>Recent comments <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-showreviews.pl?format=rss" class="rsssearchlink"><img src="[% interface %]/[% theme %]/images/feed-icon-16x16.png" alt="Subscribe to recent comments" title="Subscribe to recent comments" border="0" class="rsssearchicon"/></a></h3>
+                        <h3>Recent comments <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-showreviews.pl?format=rss" class="rsssearchlink"><img src="[% interface | html %]/[% theme | html %]/images/feed-icon-16x16.png" alt="Subscribe to recent comments" title="Subscribe to recent comments" border="0" class="rsssearchicon"/></a></h3>
                         <table class="table table-striped">
                             [% FOREACH review IN reviews %]
                                 <tr>
                                                     <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% review.biblionumber |url %]#comments" title="View details for this title">
                                                 [% END %]
                                             [% END %]
-                                            [% IF ( review.title ) %][% review.title %][% ELSE %]No title[% END %]
-                                            [% FOREACH subtitl IN review.subtitle %] [% subtitl.subfield |html %][% END %]
+                                            [% IF ( review.title ) %][% review.title | html %][% ELSE %]No title[% END %]
+                                            [% FOREACH subtitl IN review.subtitle %] [% subtitl.subfield | html %][% END %]
                                             </a>
                                             [% IF ( review.author ) %]
-                                                by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% review.author |url %]" title="Search for works by this author" class="author">[% review.author %]</a>
+                                                by <a href="/cgi-bin/koha/opac-search.pl?q=au:[% review.author |url %]" title="Search for works by this author" class="author">[% review.author | html %]</a>
                                             [% END %]
                                         </p>
                                         <p>
                                             <span class="results_summary">
                                                 <span class="label">Publication:</span>
-                                                [% IF ( review.place ) %][% review.place %] [% END %]
-                                                [% IF ( review.publishercode ) %][% review.publishercode %][% END %]
+                                                [% IF ( review.place ) %][% review.place | html %] [% END %]
+                                                [% IF ( review.publishercode ) %][% review.publishercode | html %][% END %]
                                                 [% IF ( review.publicationyear ) %]
-                                                    [% review.publicationyear %]
+                                                    [% review.publicationyear | html %]
                                                 [% ELSE %]
                                                     [% IF ( review.copyrightdate ) %]
-                                                        [% review.copyrightdate %]
+                                                        [% review.copyrightdate | html %]
                                                     [% END %]
                                                 [% END %]
-                                                [% IF ( review.pages ) %]. [% review.pages %][% END %]
-                                                [% IF ( review.notes ) %], [% review.notes %][% END %]
-                                                [% IF ( review.size ) %] [% review.size %][% END %]
+                                                [% IF ( review.pages ) %]. [% review.pages | html %][% END %]
+                                                [% IF ( review.notes ) %], [% review.notes | html %][% END %]
+                                                [% IF ( review.size ) %] [% review.size | html %][% END %]
                                             </span>
                                             [% IF ( review.summary ) %]
                                                 <span class="result_summary">
-                                                    [% review.summary %]
+                                                    [% review.summary | html %]
                                                 </span>
                                             [% END %]
                                             [% IF ( review.copyrightdate ) %]
                                                 <span class="results_summary">
                                                     <span class="label">Date:</span>
-                                                    [% review.copyrightdate %]</span>
+                                                    [% review.copyrightdate | html %]</span>
                                             [% END %]
                                         </p>
 
                                         <p class="commentline[% IF ( review.your_comment ) %] yours[% END %]">
                                             [% IF ( review.avatarurl ) %]
-                                                <img class="avatar" src="[% review.avatarurl %]" height="40" width="40" alt="" />
+                                                <img class="avatar" src="[% review.avatarurl | html %]" height="40" width="40" alt="" />
                                             [% END %]
                                             [% FILTER html_break %]
-                                                [% review.review |html %]
+                                                [% review.review | html %]
                                             [% END %]
                                         <span style="font-size:87%;font-color:#CCC;">
                                         [% IF review.your_comment %]
                                             Added [% review.datereviewed | $KohaDates %] by
                                             [% SWITCH ShowReviewer %]
                                             [% CASE 'full' %]
-                                                [% review.borrtitle %] [% review.firstname %] [% review.surname %]
+                                                [% review.borrtitle | html %] [% review.firstname | html %] [% review.surname | html %]
                                             [% CASE 'first' %]
-                                                [% review.firstname %]
+                                                [% review.firstname | html %]
                                             [% CASE 'surname' %]
-                                                [% review.surname %]
+                                                [% review.surname | html %]
                                             [% CASE 'firstandinitial' %]
-                                                [% review.firstname %] [% review.surname|truncate(2,'.') %]
+                                                [% review.firstname | html %] [% review.surname|truncate(2,'.') | html %]
                                             [% CASE 'username' %]
-                                                [% review.userid %]
+                                                [% review.userid | html %]
                                             [% END %]
                                         [% END %][% END %]</span></p>
                                     </td>
 
                                         [% IF ( OPACAmazonCoverImages ) %]
                                             [% IF ( review.normalized_isbn ) %]
-                                                <img src="https://images-na.ssl-images-amazon.com/images/P/[% review.normalized_isbn %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />
+                                                <img src="https://images-na.ssl-images-amazon.com/images/P/[% review.normalized_isbn | html %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />
                                             [% ELSE %]
                                                 <span class="no-image">No cover image available</span>
                                             [% END %]
                                         [% END %]
 
                                         [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
-                                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% review.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% review.normalized_upc %]&amp;oclc=[% review.normalized_oclc %]" alt="" class="thumbnail" />
+                                            <img src="https://secure.syndetics.com/index.aspx?isbn=[% review.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% review.normalized_upc | html %]&amp;oclc=[% review.normalized_oclc | html %]" alt="" class="thumbnail" />
                                         [% END %]
 
                                         [% IF ( GoogleJackets ) %]
                                             [% IF ( review.normalized_isbn ) %]
-                                                <div title="[% review.biblionumber |url %]" class="[% review.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></div>
+                                                <div title="[% review.biblionumber |url %]" class="[% review.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                             [% ELSE %]
                                                 <span class="no-image">No cover image available</span>
                                             [% END %]
                                         [% END %]
                                             </a>
-                                        [% bt_id = ( review.normalized_upc || review.normalized_isbn ) %]
+                                        [% bt_id = ( review.normalized_upc || review.normalized_isbn ) | html %]
                                         [% IF ( BakerTaylorEnabled ) %]
                                             [% IF ( bt_id ) %]
-                                                <a href="https://[% review.BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% review.BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                                <a href="https://[% review.BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% review.BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                                             [% ELSE %]
                                                 <span class="no-image">No cover image available</span>
                                             [% END %]
                             <div class="pages">
                                 <!-- Row of numbers corresponding to showreviews result pages -->
                                 [% IF ( previous_page_offset ) %]
-                                    <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% previous_page_offset %]&count=[% results_per_page %]">&lt;&lt; Previous</a>
+                                    <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% previous_page_offset | html %]&count=[% results_per_page | html %]">&lt;&lt; Previous</a>
                                 [% ELSE %]
                                     [% IF ( previous_page_first ) %]
-                                        <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=0&count=[% results_per_page %]">&lt;&lt; Previous</a>
+                                        <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=0&count=[% results_per_page | html %]">&lt;&lt; Previous</a>
                                     [% END %]
                                 [% END %]
                                 [% FOREACH PAGE_NUMBER IN PAGE_NUMBERS %]
                                     [% IF ( PAGE_NUMBER.highlight ) %]
-                                        <span class="currentPage">[% PAGE_NUMBER.pg %]</span>
+                                        <span class="currentPage">[% PAGE_NUMBER.pg | html %]</span>
                                     [% ELSE %]
-                                        <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% PAGE_NUMBER.offset %]&count=[% results_per_page %]">[% PAGE_NUMBER.pg %]</a>
+                                        <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% PAGE_NUMBER.offset | html %]&count=[% results_per_page | html %]">[% PAGE_NUMBER.pg | html %]</a>
                                     [% END %]
                                 [% END %]
                                 [% IF ( next_page_offset ) %]
-                                    <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% next_page_offset %]&count=[% results_per_page %]">Next &gt;&gt;</a>
+                                    <a class="nav" href="/cgi-bin/koha/opac-showreviews.pl?offset=[% next_page_offset | html %]&count=[% results_per_page | html %]">Next &gt;&gt;</a>
                                 [% END %]
                             </div>
                         [% END # / IF PAGE_NUMBERS %]
index 06c851c..7cfdc8f 100644 (file)
@@ -1,10 +1,11 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE Branches %]
 [% USE AuthorisedValues %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo;
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo;
 [% IF ( op_add ) %]Enter a new purchase suggestion[% END %]
 [% IF ( op_else ) %]Purchase Suggestions[% END %]</title>
 [% INCLUDE 'doc-head-close.inc' %]
@@ -32,7 +33,7 @@
                         [% IF ( op_add ) %]
                             [% IF ( Koha.Preference('MaxOpenSuggestions') != '' && patrons_pending_suggestions_count >= Koha.Preference('MaxOpenSuggestions') ) %]
                                     <h1 class="TooManySuggestions">You cannot place any more suggestions</h1>
-                                    <h2 class="TooManySuggestionsText">You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') %]). Once the library has processed those suggestions you will be able to place more.</h2>
+                                    <h2 class="TooManySuggestionsText">You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') | html %]). Once the library has processed those suggestions you will be able to place more.</h2>
                             [% ELSE %]
                             <h1>Enter a new purchase suggestion</h1>
 
@@ -70,7 +71,7 @@
                                                 <select name="patronreason" id="patronreason">
                                                     <option value="">-- Choose --</option>
                                                     [% FOREACH patron_reason_loo IN patron_reason_loop %]
-                                                        <option value="[% patron_reason_loo.authorised_value %]">[% patron_reason_loo.lib %]</option>
+                                                        <option value="[% patron_reason_loo.authorised_value | html %]">[% patron_reason_loo.lib | html %]</option>
                                                     [% END %]
                                                 </select>
                                             </li>
@@ -88,7 +89,7 @@
                                     </ol>
                                 </fieldset>
                                 <fieldset class="action">
-                                    <input type="hidden" name="suggested_by_anyone" value="[% suggested_by_anyone %]" />
+                                    <input type="hidden" name="suggested_by_anyone" value="[% suggested_by_anyone | html %]" />
                                     <input type="hidden" name="op" value="add_confirm" />
                                     <input type="submit" class="btn" value="Submit your suggestion" /> <a class="action" href="/cgi-bin/koha/opac-suggestions.pl">Cancel</a>
                                 </fieldset>
                                 [% END %]
                             </h1>
                             [% FOR m IN messages %]
-                                <div class="alert alert-[% m.type %]">
+                                <div class="alert alert-[% m.type | html %]">
                                     [% SWITCH m.code %]
                                     [% CASE 'too_many' %]
-                                        The suggestion has not been added. You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') %]). Once the library has processed those suggestions you will be able to place more.
+                                        The suggestion has not been added. You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') | html %]). Once the library has processed those suggestions you will be able to place more.
                                     [% CASE 'already_exists' %]
                                         The suggestion has not been added. A suggestion with this title already exists.
                                     [% CASE 'success_on_inserted' %]
                                         Your suggestion has been submitted.
                                     [% CASE %]
-                                        [% m.code %]
+                                        [% m.code | html %]
                                     [% END %]
                                 </div>
                             [% END %]
                                 <form action="/cgi-bin/koha/opac-suggestions.pl" class="form-inline" method="get">
                                     <fieldset>
                                         <label for="title">Search for:</label>
-                                        <input type="text" name="title" id="title" value="[% title |html %]" />
+                                        <input type="text" name="title" id="title" value="[% title | html %]" />
                                         [% IF Koha.Preference( 'OPACViewOthersSuggestions' ) == 1 %]
                                             [% IF loggedinusername %]
                                                 <label for="suggested_by_anyone">Suggested by:</label>
                                     [% IF ( loggedinusername || ( Koha.Preference( 'AnonSuggestions' ) == 1 ) ) %]
                                         <div id="toolbar" class="toolbar clearfix">
                                         [% IF ( Koha.Preference('MaxOpenSuggestions') != '' && patrons_pending_suggestions_count >= Koha.Preference('MaxOpenSuggestions') ) %]
-                                                <p class="TooManySuggestionsText">You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') %]).</br>Once the library has processed those suggestions you will be able to place more.</p>
+                                                <p class="TooManySuggestionsText">You have reached your limit of suggestions you can place at this time ([% Koha.Preference('MaxOpenSuggestions') | html %]).</br>Once the library has processed those suggestions you will be able to place more.</p>
                                         [% ELSE %]
                                                 <a class="new" href="/cgi-bin/koha/opac-suggestions.pl?op=add">New purchase suggestion</a>
                                         [% END %]
                                                     [% IF ( loggedinusername ) %]
                                                         <td>
                                                             [% IF ( suggestions_loo.showcheckbox ) %]
-                                                                <input type="checkbox" class="cb" name="delete_field" value="[% suggestions_loo.suggestionid %]" />
+                                                                <input type="checkbox" class="cb" name="delete_field" value="[% suggestions_loo.suggestionid | html %]" />
                                                             [% END %]
                                                         </td>
                                                     [% END %]
                                                     <td>
-                                                        <p><strong>[% suggestions_loo.title |html %]</strong></p>
-                                                            <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author |html %],[% END %]
-                                                                [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate |html %],[% END %]
-                                                                [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode |html %][% END %]
-                                                                [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place |html %])[% END %]
-                                                                [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle |html %][% END %]
-                                                                [% IF ( suggestions_loo.itemtype ) %] - [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', suggestions_loo.itemtype, 1 ) %][% END %]
+                                                        <p><strong>[% suggestions_loo.title | html %]</strong></p>
+                                                            <p>[% IF ( suggestions_loo.author ) %][% suggestions_loo.author | html %],[% END %]
+                                                                [% IF ( suggestions_loo.copyrightdate ) %] - [% suggestions_loo.copyrightdate | html %],[% END %]
+                                                                [% IF ( suggestions_loo.publishercode ) %] - [% suggestions_loo.publishercode | html %][% END %]
+                                                                [% IF ( suggestions_loo.place ) %]([% suggestions_loo.place | html %])[% END %]
+                                                                [% IF ( suggestions_loo.collectiontitle ) %] , [% suggestions_loo.collectiontitle | html %][% END %]
+                                                                [% IF ( suggestions_loo.itemtype ) %] - [% AuthorisedValues.GetByCode( 'SUGGEST_FORMAT', suggestions_loo.itemtype, 1 ) | html %][% END %]
                                                         </p>
                                                     </td>
                                                     <td>
                                                     <td>
                                                         [% IF ( suggestions_loo.note ) %]
                                                             <span class="tdlabel">Note: </span>
-                                                            [% suggestions_loo.note |html %]
+                                                            [% suggestions_loo.note | html %]
                                                         [% END %]
                                                     </td>
                                                     [% IF Koha.Preference( 'OPACViewOthersSuggestions' ) == 1 %]
                                                         <td>
                                                             [% IF ( suggestions_loo.branchcodesuggestedby ) %]
                                                                 <span class="tdlabel">Suggested for:</span>
-                                                                [% suggestions_loo.branchcodesuggestedby %]
+                                                                [% suggestions_loo.branchcodesuggestedby | html %]
                                                             [% END %]
                                                         </td>
                                                     [% END %]
                                                     <td>
                                                         [% IF ( suggestions_loo.surnamemanagedby ) %]
                                                             <span class="tdlabel">Managed by:</span>
-                                                            [% suggestions_loo.surnamemanagedby %]
-                                                            [% IF ( suggestions_loo.firstnamemanagedby ) %]    , [% suggestions_loo.firstnamemanagedby %]
+                                                            [% suggestions_loo.surnamemanagedby | html %]
+                                                            [% IF ( suggestions_loo.firstnamemanagedby ) %]    , [% suggestions_loo.firstnamemanagedby | html %]
                                                             [% END %]
                                                         [% END %]
                                                     </td>
                                                         [% ELSIF ( suggestions_loo.ORDERED ) %]Ordered by the library
                                                         [% ELSIF ( suggestions_loo.REJECTED ) %]Suggestion declined
                                                         [% ELSIF ( suggestions_loo.AVAILABLE ) %]Available in the library
-                                                        [% ELSE %] [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS, 1 ) %] [% END %]
-                                                        [% IF ( suggestions_loo.reason ) %]([% suggestions_loo.reason |html %])[% END %]
+                                                        [% ELSE %] [% AuthorisedValues.GetByCode( 'SUGGEST_STATUS', suggestions_loo.STATUS, 1 ) | html %] [% END %]
+                                                        [% IF ( suggestions_loo.reason ) %]([% suggestions_loo.reason | html %])[% END %]
                                                     </td>
                                                 </tr>
                                             [% END # / FOREACH suggestions_loo %]
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") %]
+[% Asset.js("lib/jquery/plugins/jquery.checkboxes.min.js") | $raw %]
 [% INCLUDE 'datatables.inc' %]
 <script>
     //<![CDATA[
         [% END %]
         [% IF ( op_add && mandatoryfields ) %]
         {
-            var FldsRequired = [[% mandatoryfields %]];
+            var FldsRequired = [[% mandatoryfields | html %]];
             for (var i = 0; i < FldsRequired.length; i++) {
                 var rq_input = $('#' + FldsRequired[i]);
                 if (rq_input.length != 1) continue;
index 30d9af4..5316f57 100644 (file)
@@ -1,8 +1,9 @@
+[% USE raw %]
 [% USE Koha %]
 [% USE KohaDates %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Tags</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Tags</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>
                                     [% IF ( ERROR.tagsdisabled ) %]
                                         Sorry, tags are not enabled on this system.
                                     [% ELSIF ( ERROR.badparam ) %]
-                                        ERROR: illegal parameter [% ERROR.badparam %]
+                                        ERROR: illegal parameter [% ERROR.badparam | html %]
                                     [% ELSIF ( ERROR.login ) %]
                                         ERROR: You must log in to complete that action.
                                     [% ELSIF ( ERROR.failed_delete ) %]
-                                        ERROR: You cannot delete the tag [% ERROR.failed_delete %].
+                                        ERROR: You cannot delete the tag [% ERROR.failed_delete | html %].
                                         <br />Note: you can only delete your own tags.
                                     [% ELSIF ( ERROR.scrubbed ) %]
                                         Note: your tag contained markup code that was removed.
-                                        <br />The tag was added as &quot;[% ERROR.scrubbed %]&quot;.
+                                        <br />The tag was added as &quot;[% ERROR.scrubbed | html %]&quot;.
                                     [% ELSIF ( ERROR.scrubbed_all_bad ) %]
                                         Note: your tag was entirely markup code.  It was NOT added.
                                         <br />Please try again with plain text.
@@ -85,7 +86,7 @@
                                     [% END %]:
                                 </label>
                                 <div class="input-append">
-                                    <input type="text" name="limit" style="text-align: right;" maxlength="4" size="4" value="[% limit or "100" %]" />
+                                    <input type="text" name="limit" style="text-align: right;" maxlength="4" size="4" value="[% limit or "100" | html %]" />
                                     <input type="submit" value="OK" class="btn" />
                                 </div>
                                 [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]
                         [% IF ( TAGLOOP ) %]
                             <div id="tagcloud">
                                 [% FOREACH TAGLOO IN TAGLOOP %]
-                                    <span class="tag tagweight[% TAGLOO.stratum %]" id="tag[% loop.count %]" style="display:inline;">
-                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% TAGLOO.term |url %]&amp;q=[% TAGLOO.term |url %]">[% TAGLOO.term |html %]</a>
-                                    <span class="tagweight">[% TAGLOO.weight_total %]</span>
+                                    <span class="tag tagweight[% TAGLOO.stratum | html %]" id="tag[% loop.count | html %]" style="display:inline;">
+                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% TAGLOO.term |url %]&amp;q=[% TAGLOO.term |url %]">[% TAGLOO.term | html %]</a>
+                                    <span class="tagweight">[% TAGLOO.weight_total | html %]</span>
                                     </span>
                                 [% END %]
                             </div>
                         [% END # / TAGLOOP%]
                         [% IF ( add_op ) %]
                             [% IF ( added_count ) %]
-                                <div class="dialog message">[% added_count %] [% IF ( added_count == 1 ) %]tag[% ELSE %]tags[% END %] successfully added.</div>
+                                <div class="dialog message">[% added_count | html %] [% IF ( added_count == 1 ) %]tag[% ELSE %]tags[% END %] successfully added.</div>
                             [% END %]
                             [% IF ( deleted_count ) %]
-                            <div class="dialog message">[% deleted_count %] [% IF ( deleted_count == 1 ) %]tag[% ELSE %]tags[% END %] successfully deleted.</div>
+                            <div class="dialog message">[% deleted_count | html %] [% IF ( deleted_count == 1 ) %]tag[% ELSE %]tags[% END %] successfully deleted.</div>
                             [% END %]
                         [% END # /add_op %]
 
                                     [% FOREACH MY_TAG IN MY_TAGS %]
                                         <tr>
                                             <td>
-                                                <input type="checkbox" name="del[% MY_TAG.tag_id %]" value="del[% MY_TAG.tag_id %]">
+                                                <input type="checkbox" name="del[% MY_TAG.tag_id | html %]" value="del[% MY_TAG.tag_id | html %]">
                                             </td>
                                             <td class="tagterm">
                                                 <span class="tdlabel">Tag:</span>
                                                 [% IF MY_TAG.approved == 1 %]
-                                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% MY_TAG.term |url %]&amp;q=[% MY_TAG.term |url %]">[% MY_TAG.term |html %]</a>
+                                                    <a href="/cgi-bin/koha/opac-search.pl?tag=[% MY_TAG.term |url %]&amp;q=[% MY_TAG.term |url %]">[% MY_TAG.term | html %]</a>
                                                 [% ELSE %]
-                                                    [% MY_TAG.term |html %] (not approved)
+                                                    [% MY_TAG.term | html %] (not approved)
                                                 [% END %]
                                             </td>
                                             <td>
                                                 [% IF ( MY_TAG.XSLTBloc ) %]
-                                                    [% MY_TAG.XSLTBloc %]
+                                                    [% MY_TAG.XSLTBloc | $raw %]
                                                 [% ELSE %]
                                                     <span class="tdlabel">Title:</span>
-                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% MY_TAG.biblionumber %]">
-                                                        [% MY_TAG.title |html %]
+                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% MY_TAG.biblionumber | html %]">
+                                                        [% MY_TAG.title | html %]
                                                         [% IF ( MY_TAG.subtitle ) %]
                                                             [% FOREACH subtitle IN MY_TAG.subtitle %]
-                                                                [% subtitle.subfield |html %]
+                                                                [% subtitle.subfield | html %]
                                                             [% END %]
                                                         [% END %]
                                                     </a>
                                                     [% IF ( MY_TAG.author ) %]
-                                                        by [% MY_TAG.author %]
+                                                        by [% MY_TAG.author | html %]
                                                     [% END %]
                                                 [% END # /IF MY_TAG.XSLTBloc %]
                                             </td>
                                             <td>
-                                                <span title="[% MY_TAG.date_created %]">
+                                                <span title="[% MY_TAG.date_created | html %]">
                                                     <span class="tdlabel">Date added:</span>
                                                     [% MY_TAG.date_created | $KohaDates %]
                                                 </span>
index f3194b2..d1cb6f6 100644 (file)
@@ -1,6 +1,6 @@
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Subject cloud</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Subject cloud</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
                                     <fieldset>
                                         <legend>Show</legend>
                                         <form class="form-inline" action="/cgi-bin/koha/opac-tags_subject.pl" method="post">
-                                            <p>up to <input type="text" name="number" value="[% number %]" size="4" maxlength="4" /> subjects <input type="submit" class="btn" value="OK" /></p>
+                                            <p>up to <input type="text" name="number" value="[% number | html %]" size="4" maxlength="4" /> subjects <input type="submit" class="btn" value="OK" /></p>
                                         </form>
                                     </fieldset>
 
                                     [% FOREACH LOO IN LOOP %]
-                                        <a href="/cgi-bin/koha/opac-search.pl?idx=su&amp;q=&quot;[% LOO.entry |html %]&quot;" style="font-size:[% LOO.weight %]px;">[% LOO.entry %]</a>
+                                        <a href="/cgi-bin/koha/opac-search.pl?idx=su&amp;q=&quot;[% LOO.entry | html %]&quot;" style="font-size:[% LOO.weight | html %]px;">[% LOO.entry | html %]</a>
                                     [% END %]
                                 [% ELSE %]
                                     <p>Note: This feature only available to French catalogs where ISBD subjects have been populated, and an index built by separate script.</p>
index a0f4e6e..2d2bee6 100644 (file)
@@ -3,7 +3,7 @@
 [% USE AuthorisedValues %]
 [% USE ItemTypes %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Most popular titles</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Most popular titles</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %]
     <style>
                         [% IF ( results ) %]
                             <table id="topissuest" class="table table-bordered table-striped">
                                 <caption>
-                                    The [% limit %] most checked-out
+                                    The [% limit | html %] most checked-out
                                     [% IF selected_itemtype %]
-                                        [% ItemTypes.GetDescription(selected_itemtype) %]
+                                        [% ItemTypes.GetDescription(selected_itemtype) | html %]
                                     [% END %]
                                     [% IF ( branch ) %]
                                     at
-                                    [% Branches.GetName( branch ) %]
+                                    [% Branches.GetName( branch ) | html %]
                                     [% END %]
                                     [% IF ( timeLimit != 999 ) %]
-                                    in the past [% timeLimit |html %] months
+                                    in the past [% timeLimitFinite | html %] months
                                     [% ELSE %] of all time[% END %]
                                 </caption>
                                 <thead>
                                 <tbody>
                                     [% FOREACH result IN results %]
                                         <tr>
-                                            <td><a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% result.biblionumber %]">[% result.title |html %]</a><p>[% result.author %]
-                                            [% IF ( result.publishercode ) %]- [% result.publishercode %][% END %]
-                                            [% IF ( result.place ) %][% result.place %][% END %]
+                                            <td><a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% result.biblionumber | html %]">[% result.title | html %]</a><p>[% result.author | html %]
+                                            [% IF ( result.publishercode ) %]- [% result.publishercode | html %][% END %]
+                                            [% IF ( result.place ) %][% result.place | html %][% END %]
                                             [% IF ( result.publicationyear ) %]
-                                                [% result.publicationyear %]
+                                                [% result.publicationyear | html %]
                                             [% ELSIF ( result.copyrightdate ) %]
-                                                [% result.copyrightdate %]
+                                                [% result.copyrightdate | html %]
                                             [% END %]
-                                            [% IF ( result.pages ) %] - [% result.pages %][% END %]
-                                            [% IF ( result.item('size') ) %][% result.item('size') %][% END %]</p>
+                                            [% IF ( result.pages ) %] - [% result.pages | html %][% END %]
+                                            [% IF ( result.item('size') ) %][% result.item('size') | html %][% END %]</p>
                                             </td>
                                             <td>
                                               [% IF Koha.Preference('AdvancedSearchTypes') == 'ccode' %]
                                                 <span class="tdlabel">Collection</span>
-                                                [% AuthorisedValues.GetByCode('ccode', result.ccode, 1) %]
+                                                [% AuthorisedValues.GetByCode('ccode', result.ccode, 1) | html %]
                                               [% ELSE %]
                                                 <span class="tdlabel">Item type</span>
-                                                [% ItemTypes.GetDescription(result.itemtype) %]
+                                                [% ItemTypes.GetDescription(result.itemtype) | html %]
                                               [% END %]
                                             </td>
-                                            <td><span class="tdlabel">Checkouts: </span> <span title="[% result.count %]">[% result.count %]</span></td>
-                                            [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]<td>[% IF Koha.Preference( 'RequestOnOpac' ) == 1 %][% UNLESS ( result.norequests ) %]<a href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% result.biblionumber %]">Place hold</a>[% END %][% END %]</td>[% END %]
+                                            <td><span class="tdlabel">Checkouts: </span> <span title="[% result.count | html %]">[% result.count | html %]</span></td>
+                                            [% IF Koha.Preference( 'opacuserlogin' ) == 1 %]<td>[% IF Koha.Preference( 'RequestOnOpac' ) == 1 %][% UNLESS ( result.norequests ) %]<a href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% result.biblionumber | html %]">Place hold</a>[% END %][% END %]</td>[% END %]
                                             </tr>
                                     [% END %]
                                 </tbody>
index 5fc9a1a..2ea2295 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
@@ -9,7 +10,7 @@
 [% SET borrower_enrollable_clubs = logged_in_user.get_enrollable_clubs(1,1) %]
 
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your library home</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog &rsaquo; Your library home</title>
 [% INCLUDE 'doc-head-close.inc' %]
 [% BLOCK cssinclude %][% END %]
 </head>
@@ -17,9 +18,9 @@
 [% INCLUDE 'masthead.inc' %]
 
 [% IF Koha.Preference('AmazonAssocTag') %]
-    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') %]
+    [% AmazonAssocTag = '?tag=' _ Koha.Preference('AmazonAssocTag') | html %]
 [% ELSE %]
-    [% AmazonAssocTag = '' %]
+    [% AmazonAssocTag = '' | html %]
 [% END %]
 
 <div class="main">
                                     <li id="lost"><strong>Please note: </strong> Your library card has been marked as lost or stolen. <em>If this is an error, please contact the library.</em></li>
                                 [% END %]
                                 [% IF ( renewal_blocked_fines.defined ) && ( OpacRenewalAllowed ) %]
-                                    <li id="renewal_blocked_fines"><strong>Please note: </strong>You cannot renew your books online. Reason: [% IF ( renewal_blocked_fines ) > 0  %]Your fines exceed <span id="renewal_blocked_fines_amount">[% renewal_blocked_fines | $Price %]</span>.[% ELSE %]You have fines.[% END %]
+                                    <li id="renewal_blocked_fines"><strong>Please note: </strong>You cannot renew your books online. Reason: [% IF ( renewal_blocked_fines ) > 0  %]Your fines exceed <span id="renewal_blocked_fines_amount">[% renewal_blocked_fines | $Price | html %]</span>.[% ELSE %]You have fines.[% END %]
                                 [% END %]
                             </ul>
                         </div>
 
                     <div class="alert alert-info" id="notesaved" style="display:none;"></div>
 
-                    [% SET OPACMySummaryNote = Koha.Preference('OPACMySummaryNote') %]
-                    [% IF OPACMySummaryNote %][% OPACMySummaryNote %][% END %]
+                    [% IF OPACMySummaryNote %][% Koha.Preference('OPACMySummaryNote') | $raw %][% END %]
 
                     <div id="opac-user-views" class="toptabs">
                         <ul>
-                            <li><a href="#opac-user-checkouts">Checked out ([% issues_count %])</a></li>
+                            <li><a href="#opac-user-checkouts">Checked out ([% issues_count | html %])</a></li>
                             [% IF relatives %]<li><a href="#opac-user-relative-issues">Relatives' checkouts</a></li>[% END %]
-                            [% IF ( overdues_count ) %]<li><a href="#opac-user-overdues">Overdue ([% overdues_count %])</a></li>[% END %]
+                            [% IF ( overdues_count ) %]<li><a href="#opac-user-overdues">Overdue ([% overdues_count | html %])</a></li>[% END %]
                             [% IF ( OPACFinesTab ) %]
-                                [% IF ( borrower.amountoverfive ) %]<li><a href="#opac-user-fines">Fines ([% amountoutstanding | $Price %])</a></li>[% END %]
-                                [% IF ( borrower.amountoverzero ) %]<li><a href="#opac-user-fines">Fines ([% amountoutstanding | $Price %])</a></li>[% END %]
-                                [% IF ( borrower.amountlessthanzero ) %]<li><a href="#opac-user-fines">Credits ([% amountoutstanding | $Price %])</a></li>[% END %]
+                                [% IF ( borrower.amountoverfive ) %]<li><a href="#opac-user-fines">Fines ([% amountoutstanding | $Price | html %])</a></li>[% END %]
+                                [% IF ( borrower.amountoverzero ) %]<li><a href="#opac-user-fines">Fines ([% amountoutstanding | $Price | html %])</a></li>[% END %]
+                                [% IF ( borrower.amountlessthanzero ) %]<li><a href="#opac-user-fines">Credits ([% amountoutstanding | $Price | html %])</a></li>[% END %]
                             [% END %]
 
                             [% IF borrower_club_enrollments.count || borrower_enrollable_clubs.count %]
                                 <li>
                                     <a id="opac-user-clubs-tab-link" href="#opac-user-clubs">
-                                        Clubs ([% borrower_club_enrollments.count || 0 %]/[% borrower_enrollable_clubs.count || 0 %])
+                                        Clubs ([% borrower_club_enrollments.count || 0 | html %]/[% borrower_enrollable_clubs.count || 0 | html %])
                                     </a>
                                 </li>
                             [% END %]
 
-                            [% IF ( RESERVES.count ) %]<li><a href="#opac-user-holds">Holds ([% RESERVES.count %])</a></li>[% END %]
-                            [% IF Koha.Preference('ArticleRequests') && logged_in_user.article_requests_current %]<li><a href="#opac-user-article-requests">Article requests ([% logged_in_user.article_requests_current.count %])</a></li>[% END %]
+                            [% IF ( RESERVES.count ) %]<li><a href="#opac-user-holds">Holds ([% RESERVES.count | html %])</a></li>[% END %]
+                            [% IF Koha.Preference('ArticleRequests') && logged_in_user.article_requests_current %]<li><a href="#opac-user-article-requests">Article requests ([% logged_in_user.article_requests_current.count | html %])</a></li>[% END %]
                             [% IF ( OverDriveCirculation ) %]
                             <li><a href="#opac-user-overdrive">OverDrive Account</a></li>
                             [% END %]
                         <div id="opac-user-checkouts">
                             [% IF ( issues_count ) %]
                                 <form id="renewselected" action="/cgi-bin/koha/opac-renew.pl" method="post">
-                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber %]">
+                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]">
                                     <input type="hidden" name="from" value="opac_user" />
                                     <table id="checkoutst" class="table table-bordered table-striped">
-                                        <caption>[% issues_count %] Item(s) checked out</caption>
+                                        <caption>[% issues_count | html %] Item(s) checked out</caption>
                                         <thead>
                                             <tr>
                                                 [% IF ( JacketImages ) %]<th class="nosort">&nbsp;</th>[% END %]
 
                                                     [% IF ( OPACAmazonCoverImages ) %]
                                                         [% IF ( ISSUE.normalized_isbn ) %]
-                                                            <a href="http://www.amazon.com/gp/reader/[% ISSUE.normalized_isbn %][% AmazonAssocTag %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% ISSUE.normalized_isbn %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail"/></a>
+                                                            <a href="http://www.amazon.com/gp/reader/[% ISSUE.normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% ISSUE.normalized_isbn | html %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail"/></a>
                                                         [% ELSE %]
                                                             <a href="#"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
 
                                                     [% IF ( GoogleJackets ) %]
                                                         [% IF ( ISSUE.normalized_isbn ) %]
-                                                            <div style="display:block;" title="Click to view in Google Books" class="[% ISSUE.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></div>
+                                                            <div style="display:block;" title="Click to view in Google Books" class="[% ISSUE.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                                         [% ELSE %]
                                                             <a href="http://books.google.com/books?q=[% ISSUE.title |url %]"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( BakerTaylorEnabled ) %]
-                                                        [% bt_id = ( ISSUE.normalized_upc || ISSUE.normalized_isbn ) %]
+                                                        [% bt_id = ( ISSUE.normalized_upc || ISSUE.normalized_isbn ) | html %]
                                                         [% IF ( bt_id ) %]
-                                                            <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                                            <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                                                         [% ELSE %]
                                                             <span class="no-image">No cover image available</span><!-- BakerTaylor needs normalized_upc or normalized_isbn! -->
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( SyndeticsEnabled && SyndeticsCoverImages ) %]
-                                                        <img src="https://secure.syndetics.com/index.aspx?isbn=[% ISSUE.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;type=xw10&amp;upc=[% ISSUE.normalized_upc %]&amp;oclc=[% ISSUE.normalized_oclc %]" alt="" class="item-thumbnail" />
+                                                        <img src="https://secure.syndetics.com/index.aspx?isbn=[% ISSUE.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;type=xw10&amp;upc=[% ISSUE.normalized_upc | html %]&amp;oclc=[% ISSUE.normalized_oclc | html %]" alt="" class="item-thumbnail" />
                                                     [% END %]
 
                                                 </td>[% END # / IF JacketImages %]
 
                                                 <td class="title">
-                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ISSUE.biblionumber %]">[% ISSUE.title |html %] [% FOREACH subtitl IN ISSUE.subtitle %] [% subtitl.subfield %][% END %]</a>
-                                                    [% IF ( ISSUE.enumchron ) %] [% ISSUE.enumchron %][% END %]
+                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ISSUE.biblionumber | html %]">[% ISSUE.title | html %] [% FOREACH subtitl IN ISSUE.subtitle %] [% subtitl.subfield | html %][% END %]</a>
+                                                    [% IF ( ISSUE.enumchron ) %] [% ISSUE.enumchron | html %][% END %]
                                                 </td>
 
-                                                <td class="author">[% ISSUE.author %]</td>
+                                                <td class="author">[% ISSUE.author | html %]</td>
                                                 [% IF ( ISSUE.overdue ) %]
                                                     <td class="date_due overdue">
-                                                        <span title="[% ISSUE.date_due %]">
+                                                        <span title="[% ISSUE.date_due | html %]">
                                                             <span class="tdlabel">Date due:</span>
-                                                            [% ISSUE.date_due | $KohaDates as_due_date => 1 %]
+                                                            [% ISSUE.date_due | $KohaDates as_due_date => 1 | html %]
                                                         </span>
                                                     </td>
                                                 [% ELSE %]
                                                     <td class="date_due">
-                                                        <span title="[% ISSUE.date_due %]">
+                                                        <span title="[% ISSUE.date_due | html %]">
                                                             <span class="tdlabel">Date due:</span>
-                                                            [% ISSUE.date_due | $KohaDates as_due_date => 1 %]
+                                                            [% ISSUE.date_due | $KohaDates as_due_date => 1 | html %]
                                                         </span>
                                                     </td>
                                                 [% END %]
                                                     <td class="itype">
                                                         <span class="tdlabel">Item type:</span>
                                                         [% IF ( ISSUE.imageurl ) %]
-                                                            <img src="[% ISSUE.imageurl %]" title="[% ISSUE.description %]" alt="[% ISSUE.description %]" />
-                                                        [% END %] [% ISSUE.description %]
+                                                            <img src="[% ISSUE.imageurl | html %]" title="[% ISSUE.description | html %]" alt="[% ISSUE.description | html %]" />
+                                                        [% END %] [% ISSUE.description | html %]
                                                     </td>
                                                 [% END %]
                                                 [% IF ( show_barcode ) %]
                                                     <td class="barcode">
                                                         <span class="tdlabel">Barcode:</span>
-                                                        [% ISSUE.barcode %]
+                                                        [% ISSUE.barcode | html %]
                                                     </td>
                                                 [% END %]
                                                 <td class="call_no">
                                                     <span class="tdlabel">Call no.:</span>
-                                                    [% ISSUE.itemcallnumber %]
+                                                    [% ISSUE.itemcallnumber | html %]
                                                 </td>
                                                 [% IF ( OpacRenewalAllowed && !( logged_in_user.is_expired && logged_in_user.category.effective_BlockExpiredPatronOpacActions ) ) %]
                                                     <td class="renew">
                                                     [% IF ISSUE.renewed %]<span class="blabel label-success">Renewed!</span><br />[% END %]
                                                     [% IF ( ISSUE.status ) %]
                                                         [% IF ( canrenew ) %]
-                                                            <input type="checkbox" name="item" value="[% ISSUE.itemnumber %]"/> <a href="/cgi-bin/koha/opac-renew.pl?from=opac_user&amp;item=[% ISSUE.itemnumber %]&amp;borrowernumber=[% ISSUE.borrowernumber %]">Renew</a>
+                                                            <input type="checkbox" name="item" value="[% ISSUE.itemnumber | html %]"/> <a href="/cgi-bin/koha/opac-renew.pl?from=opac_user&amp;item=[% ISSUE.itemnumber | html %]&amp;borrowernumber=[% ISSUE.borrowernumber | html %]">Renew</a>
                                                         [% END %]
                                                         [% IF ISSUE.renewalfee > 0 %]
-                                                            <span class="renewalfee">Fee for item type '[% ItemTypes.GetDescription( ISSUE.renewalitemtype) %]': [% ISSUE.renewalfee | $Price %]</span>
+                                                            <span class="renewalfee">Fee for item type '[% ItemTypes.GetDescription( ISSUE.renewalitemtype) | html %]': [% ISSUE.renewalfee | $Price | html %]</span>
                                                         [% END %]
-                                                        <span class="renewals">([% ISSUE.renewsleft %] of [% ISSUE.renewsallowed %] renewals remaining)</span>
+                                                        <span class="renewals">([% ISSUE.renewsleft | html %] of [% ISSUE.renewsallowed | html %] renewals remaining)</span>
                                                     [% ELSIF ( ISSUE.on_reserve ) %]
                                                         Not renewable <span class="renewals">(on hold)</span>
                                                     [% ELSIF ( ISSUE.too_many ) %]
                                                         No longer renewable
                                                     [% ELSIF ISSUE.auto_too_much_oweing %]
                                                         Automatic renewal failed, you have unpaid fines.
-                                                        <span class="renewals">([% ISSUE.renewsleft %] of [% ISSUE.renewsallowed %] renewals remaining)</span>
+                                                        <span class="renewals">([% ISSUE.renewsleft | html %] of [% ISSUE.renewsallowed | html %] renewals remaining)</span>
                                                     [% ELSIF ISSUE.auto_account_expired %]
                                                         Automatic renewal failed, your account is expired.
-                                                        <span class="renewals">([% ISSUE.renewsleft %] of [% ISSUE.renewsallowed %] renewals remaining)</span>
+                                                        <span class="renewals">([% ISSUE.renewsleft | html %] of [% ISSUE.renewsallowed | html %] renewals remaining)</span>
                                                     [% ELSIF ( ISSUE.auto_renew || ISSUE.auto_too_soon ) %]
                                                         Automatic renewal
-                                                        <span class="renewals">([% ISSUE.renewsleft %] of [% ISSUE.renewsallowed %] renewals remaining)</span>
+                                                        <span class="renewals">([% ISSUE.renewsleft | html %] of [% ISSUE.renewsallowed | html %] renewals remaining)</span>
                                                     [% ELSIF ( ISSUE.too_soon ) %]
-                                                        No renewal before [% ISSUE.soonestrenewdate %]
-                                                        <span class="renewals">([% ISSUE.renewsleft %] of [% ISSUE.renewsallowed %] renewals remaining)</span>
+                                                        No renewal before [% ISSUE.soonestrenewdate | html %]
+                                                        <span class="renewals">([% ISSUE.renewsleft | html %] of [% ISSUE.renewsallowed | html %] renewals remaining)</span>
                                                     [% END %]
                                                     </td>
                                                 [% END %]
                                                     </td>
                                                 [% END %]
                                                 [% IF ( OPACMySummaryHTML ) %]
-                                                    <td class="links">[% ISSUE.MySummaryHTML %]</td>
+                                                    <td class="links">[% ISSUE.MySummaryHTML | $raw %]</td>
                                                 [% END %]
                                                 [% IF ( Koha.Preference('AllowCheckoutNotes') ) %]
                                                     <td class="note">
-                                                        <input type="text" name="note" data-issue_id="[% ISSUE.issue_id %]" data-origvalue="[% ISSUE.note %]" value="[% ISSUE.note %]" readonly>
-                                                        <a class="btn" name="js_submitnote" id="save_[% ISSUE.issue_id %]" style="display:none;">Submit note</a>
+                                                        <input type="text" name="note" data-issue_id="[% ISSUE.issue_id | html %]" data-origvalue="[% ISSUE.note | html %]" value="[% ISSUE.note | html %]" readonly>
+                                                        <a class="btn" name="js_submitnote" id="save_[% ISSUE.issue_id | html %]" style="display:none;">Submit note</a>
                                                         <a class="btn" name="nonjs_submitnote" href="/cgi-bin/koha/opac-issue-note.pl?issue_id=[% ISSUE.issue_id | url %]">Edit / Create note</a>
                                                     </td>
                                                 [% END %]
                                 [% IF ( canrenew && !userdebarred && OpacRenewalAllowed && !( logged_in_user.is_expired && logged_in_user.category.effective_BlockExpiredPatronOpacActions ) ) %]
                                 <form id="renewall" action="/cgi-bin/koha/opac-renew.pl" method="post">
                                     <input type="hidden" name="from" value="opac_user" />
-                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" />
+                                    <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
                                     [% FOREACH ISSUE IN ISSUES %]
-                                        <input type="hidden" name="item" value="[% ISSUE.itemnumber %]" />
+                                        <input type="hidden" name="item" value="[% ISSUE.itemnumber | html %]" />
                                     [% END %]
                                     <input type="submit" class="btn" value="Renew all" />
                                 </form>
                                         <tbody>
                                             <tr>
                                                 <td>You currently owe fines and charges amounting to:</td>
-                                                <td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price %]</a></td>
+                                                <td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price | html %]</a></td>
                                             </tr>
                                         </tbody>
                                     </table>
                                         <tbody>
                                             <tr>
                                                 <td>You currently owe fines and charges amounting to:</td>
-                                                <td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price %]</a></td>
+                                                <td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price | html %]</a></td>
                                             </tr>
                                         </tbody>
                                     </table>
                                         <thead><tr><th colspan="2">Amount</th></tr></thead>
                                         <tbody>
                                             <tr>
-                                                <td>You have a credit of:</td><td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price %]</a></td>
+                                                <td>You have a credit of:</td><td><a href="/cgi-bin/koha/opac-account.pl">[% amountoutstanding | $Price | html %]</a></td>
                                             </tr>
                                         </tbody>
                                     </table>
                                             [% FOREACH i IN r.issues %]
                                                 <tr>
                                                     <td>
-                                                        <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.item.biblio.biblionumber %]">
-                                                            [% i.item.biblio.title %][% IF ( i.item.enumchron ) %] [% i.item.enumchron %][% END %]
+                                                        <a href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.item.biblio.biblionumber | html %]">
+                                                            [% i.item.biblio.title | html %][% IF ( i.item.enumchron ) %] [% i.item.enumchron | html %][% END %]
                                                         </a>
                                                     </td>
 
                                                     </td>
 
                                                     <td>
-                                                        [% i.item.barcode %]
+                                                        [% i.item.barcode | html %]
                                                     </td>
 
                                                     <td>
-                                                        [% i.item.itemcallnumber %]
+                                                        [% i.item.itemcallnumber | html %]
                                                     </td>
 
                                                     <td>
-                                                        [% r.firstname %] [% r.surname %]
+                                                        [% r.firstname | html %] [% r.surname | html %]
                                                     </td>
                                                 </tr>
                                             [% END %]
                         [% IF ( overdues_count ) %]
                             <div id="opac-user-overdues">
                                 <table id="overduest" class="table table-bordered table-striped">
-                                    <caption>Overdues <span class="count">([% overdues_count %] total)</span></caption>
+                                    <caption>Overdues <span class="count">([% overdues_count | html %] total)</span></caption>
                                     <!-- OVERDUES TABLE ROWS -->
                                     <thead>
                                         <tr>
                                                     <td class="jacketcell">
                                                     [% IF ( OPACAmazonCoverImages ) %]
                                                         [% IF ( OVERDUE.normalized_isbn ) %]
-                                                            <a href="http://www.amazon.com/gp/reader/[% OVERDUE.normalized_isbn %][% AmazonAssocTag %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% OVERDUE.normalized_isbn %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail" /></a>
+                                                            <a href="http://www.amazon.com/gp/reader/[% OVERDUE.normalized_isbn | html %][% AmazonAssocTag | html %]#reader-link" title="View on Amazon.com"><img src="https://images-na.ssl-images-amazon.com/images/P/[% OVERDUE.normalized_isbn | html %].01.THUMBZZZ.jpg" alt="View on Amazon.com" class="item-thumbnail" /></a>
                                                         [% ELSE %]
                                                             <a href="#"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
 
                                                     [% IF ( GoogleJackets ) %]
                                                         [% IF ( OVERDUE.normalized_isbn ) %]
-                                                            <div style="display:block;" title="Click to view in Google Books" class="[% OVERDUE.normalized_isbn %]" id="gbs-thumbnail[% loop.count %]"></div>
+                                                            <div style="display:block;" title="Click to view in Google Books" class="[% OVERDUE.normalized_isbn | html %]" id="gbs-thumbnail[% loop.count | html %]"></div>
                                                         [% ELSE %]
                                                             <a href="http://books.google.com/books?q=[% OVERDUE.title |url %]"><span class="no-image">No cover image available</span></a>
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( BakerTaylorEnabled ) %]
-                                                        [% bt_id = ( OVERDUE.normalized_upc || OVERDUE.normalized_isbn ) %]
+                                                        [% bt_id = ( OVERDUE.normalized_upc || OVERDUE.normalized_isbn ) | html %]
                                                         [% IF ( bt_id ) %]
-                                                            <a href="https://[% BakerTaylorBookstoreURL |html %][% bt_id %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL |html %][% bt_id %]" /></a>
+                                                            <a href="https://[% BakerTaylorBookstoreURL | html %][% bt_id | html %]"><img alt="See Baker &amp; Taylor" src="[% BakerTaylorImageURL | html %][% bt_id | html %]" /></a>
                                                         [% ELSE %]
                                                             <span class="no-image">No cover image available</span><!-- BakerTaylor needs normalized_upc or normalized_isbn! -->
                                                         [% END %]
                                                     [% END %]
 
                                                     [% IF ( SyndeticsCoverImages ) %]
-                                                        <img src="https://secure.syndetics.com/index.aspx?isbn=[% OVERDUE.normalized_isbn %]/SC.GIF&amp;client=[% SyndeticsClientCode %]&amp;upc=[% OVERDUE.normalized_upc %]&amp;oclc=[% OVERDUE.normalized_oclc %]&amp;type=xw10" alt="" class="item-thumbnail" />
+                                                        <img src="https://secure.syndetics.com/index.aspx?isbn=[% OVERDUE.normalized_isbn | html %]/SC.GIF&amp;client=[% SyndeticsClientCode | html %]&amp;upc=[% OVERDUE.normalized_upc | html %]&amp;oclc=[% OVERDUE.normalized_oclc | html %]&amp;type=xw10" alt="" class="item-thumbnail" />
                                                     [% END %]
                                                     </td>
                                                 [% END # /IF jacketcell %]
 
                                                 <td>
-                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?bib=[% OVERDUE.biblionumber %]">[% OVERDUE.title |html %] [% FOREACH subtitl IN OVERDUE.subtitle %] [% subtitl.subfield %][% END %]
+                                                    <a class="title" href="/cgi-bin/koha/opac-detail.pl?bib=[% OVERDUE.biblionumber | html %]">[% OVERDUE.title | html %] [% FOREACH subtitl IN OVERDUE.subtitle %] [% subtitl.subfield | html %][% END %]
                                                     </a>
-                                                    <span class="item-details">[% OVERDUE.author %]</span></td>
+                                                    <span class="item-details">[% OVERDUE.author | html %]</span></td>
 
                                                 [% UNLESS ( item_level_itypes ) %]
                                                     <td>
                                                         [% IF ( OVERDUE.imageurl ) %]
-                                                            <img src="[% OVERDUE.imageurl %]" title="[% OVERDUE.description %]" alt="[% OVERDUE.description %]" />
-                                                        [% END %] [% OVERDUE.description %]
+                                                            <img src="[% OVERDUE.imageurl | html %]" title="[% OVERDUE.description | html %]" alt="[% OVERDUE.description | html %]" />
+                                                        [% END %] [% OVERDUE.description | html %]
                                                     </td>
                                                 [% END %]
                                                 [% IF ( show_barcode ) %]
                                                     <td>
                                                         <span class="tdlabel">Barcode:</span>
-                                                        [% OVERDUE.barcode %]
+                                                        [% OVERDUE.barcode | html %]
                                                     </td>
                                                 [% END %]
                                                 <td>
                                                     <span class="tdlabel">Call no.:</span>
-                                                    [% OVERDUE.itemcallnumber %]
+                                                    [% OVERDUE.itemcallnumber | html %]
                                                 </td>
                                                 <td>
-                                                    <span title="[% OVERDUE.date_due %]">
+                                                    <span title="[% OVERDUE.date_due | html %]">
                                                         <span class="tdlabel">Date due:</span>
-                                                        [% OVERDUE.date_due | $KohaDates as_due_date => 1 %]
+                                                        [% OVERDUE.date_due | $KohaDates as_due_date => 1 | html %]
                                                     </span>
                                                 </td>
                                                 [% IF ( OpacRenewalAllowed ) %]
                                                             Account frozen
                                                         [% ELSIF ( OVERDUE.status ) %]
                                                             [% IF ( canrenew ) %]
-                                                                <a href="/cgi-bin/koha/opac-renew.pl?from=opac_user&amp;item=[% OVERDUE.itemnumber %]&amp;bornum=[% OVERDUE.borrowernumber %]">Renew</a>
+                                                                <a href="/cgi-bin/koha/opac-renew.pl?from=opac_user&amp;item=[% OVERDUE.itemnumber | html %]&amp;bornum=[% OVERDUE.borrowernumber | html %]">Renew</a>
                                                             [% END %]
-                                                                <span class="renewals">([% OVERDUE.renewsleft %] of [% OVERDUE.renewsallowed %] renewals remaining)</span>
+                                                                <span class="renewals">([% OVERDUE.renewsleft | html %] of [% OVERDUE.renewsallowed | html %] renewals remaining)</span>
                                                         [% ELSIF ( OVERDUE.norenew_overdue ) %]
                                                             Not allowed<span class="renewals">(overdue)</span>
                                                         [% ELSIF ( OVERDUE.onreserve ) %]
                         [% IF ( RESERVES.count ) %]
                             <div id="opac-user-holds">
                                 <table id="holdst" class="table table-bordered table-striped">
-                                    <caption>Holds <span class="count">([% RESERVES.count %] total)</span></caption>
+                                    <caption>Holds <span class="count">([% RESERVES.count | html %] total)</span></caption>
                                     <!-- RESERVES TABLE ROWS -->
                                     <thead>
                                         <tr>
                                             <tr>
                                         [% END %]
                                             <td class="title">
-                                                <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RESERVE.biblionumber %]">
-                                                    [% RESERVE.biblio.title %]
+                                                <a class="title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% RESERVE.biblionumber | html %]">
+                                                    [% RESERVE.biblio.title | html %]
                                                     [% FOREACH s IN RESERVE.biblio.subtitles %]
-                                                        [% s %]
+                                                        [% s | html %]
                                                     [% END %]
-                                                    [% RESERVE.item.enumchron %]
+                                                    [% RESERVE.item.enumchron | html %]
                                                 </a>
-                                                [% RESERVE.biblio.author %]
+                                                [% RESERVE.biblio.author | html %]
                                             </td>
                                             <td class="reservedate">
-                                                <span title="[% RESERVE.reservedate %]">
+                                                <span title="[% RESERVE.reservedate | html %]">
                                                     <span class="tdlabel">Hold date:</span>
                                                     [% RESERVE.reservedate | $KohaDates %]
                                                 </span>
                                             <td class="expirationdate">
                                                 [% IF ! RESERVE.found %]
                                                     [% IF ( RESERVE.expirationdate ) %]
-                                                        <span title="[% RESERVE.expirationdate %]">
+                                                        <span title="[% RESERVE.expirationdate | html %]">
                                                             <span class="tdlabel">Expiration:</span>
                                                                 [% RESERVE.expirationdate | $KohaDates %]
                                                         </span>
                                             [% UNLESS( singleBranchMode) %]
                                                 <td class="branch">
                                                     <span class="tdlabel">Pick up location:</span>
-                                                    [% RESERVE.branch.branchname %]
+                                                    [% RESERVE.branch.branchname | html %]
                                                 </td>
                                             [% END %]
                                             [% IF ( showpriority ) %]
-                                                 <td data-order="[% RESERVE.priority %]" class="priority">
+                                                 <td data-order="[% RESERVE.priority | html %]" class="priority">
                                                     <span class="tdlabel">Priority:</span>
-                                                    [% RESERVE.priority %]
+                                                    [% RESERVE.priority | html %]
                                                 </td>
                                             [% END %]
                                             <td class="status">
                                                 [% IF ( RESERVE.is_waiting ) %]
                                                     [% IF ( RESERVE.is_at_destination ) %]
                                                         [% IF ( RESERVE.found ) %]
-                                                            Item waiting at <b> [% RESERVE.branch.branchname %]</b>
+                                                            Item waiting at <b> [% RESERVE.branch.branchname | html %]</b>
                                                             [% IF ( RESERVE.waitingdate ) %]
                                                                 since [% RESERVE.waitingdate | $KohaDates %]
                                                                 [% IF RESERVE.expirationdate %]
                                                                     until [% RESERVE.expirationdate | $KohaDates %]
                                                                 [% END %]
                                                             [% END %]
-                                                            <input type="hidden" name="pickup" value="[% RESERVE.branchcode %]" />
+                                                            <input type="hidden" name="pickup" value="[% RESERVE.branchcode | html %]" />
                                                         [% ELSE %]
-                                                            Item waiting to be pulled from <b> [% Branches.GetName( RESERVE.branchcode ) %]</b>
+                                                            Item waiting to be pulled from <b> [% Branches.GetName( RESERVE.branchcode ) | html %]</b>
                                                         [% END %]
                                                     [% ELSE %]
-                                                        Item in transit to <b> [% Branches.GetName( RESERVE.branchcode ) %]</b> <input type="hidden" name="pickup" value="[% RESERVE.branchcode %]" />
+                                                        Item in transit to <b> [% Branches.GetName( RESERVE.branchcode ) | html %]</b> <input type="hidden" name="pickup" value="[% RESERVE.branchcode | html %]" />
                                                     [% END %]
                                                 [% ELSE %]
                                                     [% IF ( RESERVE.is_in_transit ) %]
                                                         [% SET transfer = RESERVE.item.get_transfer %]
-                                                        Item in transit from <b> [% Branches.GetName( transfer.frombranch ) %]</b> since
+                                                        Item in transit from <b> [% Branches.GetName( transfer.frombranch ) | html %]</b> since
                                                         [% transfer.datesent | $KohaDates %]
                                                     [% ELSIF ( RESERVE.suspend ) %]
-                                                        Suspended [% IF ( RESERVE.suspend_until ) %] until [% RESERVE.suspend_until %] [% END %]
+                                                        Suspended [% IF ( RESERVE.suspend_until ) %] until [% RESERVE.suspend_until | html %] [% END %]
                                                     [% ELSE %]
                                                         [% IF RESERVE.itemtype %]
-                                                            Pending for next available item of item type '[% ItemTypes.GetDescription( RESERVE.itemtype ) %]'
+                                                            Pending for next available item of item type '[% ItemTypes.GetDescription( RESERVE.itemtype ) | html %]'
                                                         [% ELSE %]
                                                             Pending
                                                         [% END %]
                                                     [% IF ( RESERVE.is_cancelable_from_opac ) %]
                                                         [% IF RESERVE.suspend %]
                                                             <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
-                                                                <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id %]" />
+                                                                <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id | html %]" />
                                                                 <button class="btn btn-link" type="submit" name="submit"><i class="icon-play"></i> Resume</button>
                                                             </form>
                                                         [% ELSE %]
                                                             [% IF AutoResumeSuspendedHolds %]
-                                                                <a class="btn btn-link js-show" href="#suspendModal[% RESERVE.reserve_id %]" role="button" data-toggle="modal"><i class="icon-pause"></i> Suspend</a>
+                                                                <a class="btn btn-link js-show" href="#suspendModal[% RESERVE.reserve_id | html %]" role="button" data-toggle="modal"><i class="icon-pause"></i> Suspend</a>
                                                                 [% # hold suspend modal form %]
-                                                                <div id="suspendModal[% RESERVE.reserve_id %]" class="modal-nojs" tabindex="-1" role="dialog" aria-labelledby="suspendModal[% RESERVE.reserve_id %]Label" aria-hidden="true">
+                                                                <div id="suspendModal[% RESERVE.reserve_id | html %]" class="modal-nojs" tabindex="-1" role="dialog" aria-labelledby="suspendModal[% RESERVE.reserve_id | html %]Label" aria-hidden="true">
                                                                     <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
                                                                         <div class="modal-header">
                                                                             <button type="button" class="closebtn" data-dismiss="modal" aria-hidden="true">×</button>
                                                                             [% IF RESERVE.suspend %]
-                                                                                <h3 id="suspendModal[% RESERVE.reserve_id %]Label">Resume your hold on <i>[% RESERVE.biblio.title %]</i></h3>
+                                                                                <h3 id="suspendModal[% RESERVE.reserve_id | html %]Label">Resume your hold on <i>[% RESERVE.biblio.title | html %]</i></h3>
                                                                             [% ELSE %]
-                                                                                <h3 id="suspendModal[% RESERVE.reserve_id %]Label">Suspend your hold on <i>[% RESERVE.biblio.title %]</i></h3>
+                                                                                <h3 id="suspendModal[% RESERVE.reserve_id | html %]Label">Suspend your hold on <i>[% RESERVE.biblio.title | html %]</i></h3>
                                                                             [% END %]
                                                                         </div>
                                                                         <div class="modal-body">
-                                                                            <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id %]" />
-                                                                            <label for="suspend_until_[% RESERVE.reserve_id %]">Suspend until:</label>
-                                                                            <input name="suspend_until" id="suspend_until_[% RESERVE.reserve_id %]" class="suspend-until" size="10" />
+                                                                            <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id | html %]" />
+                                                                            <label for="suspend_until_[% RESERVE.reserve_id | html %]">Suspend until:</label>
+                                                                            <input name="suspend_until" id="suspend_until_[% RESERVE.reserve_id | html %]" class="suspend-until" size="10" />
                                                                             [% INCLUDE 'date-format.inc' %]
-                                                                            <p class="js-show"><a href="#" onclick="document.getElementById('suspend_until_[% RESERVE.reserve_id %]').value='';return false;">Clear date to suspend indefinitely</a></p>
+                                                                            <p class="js-show"><a href="#" onclick="document.getElementById('suspend_until_[% RESERVE.reserve_id | html %]').value='';return false;">Clear date to suspend indefinitely</a></p>
                                                                             <button class="btn btn-mini js-hide" type="submit" name="submit">Suspend</button>
                                                                         </div>
                                                                         <div class="modal-footer">
                                                                             <a href="#" data-dismiss="modal" aria-hidden="true" class="cancel">Cancel</a>
                                                                         </div>
                                                                     </form>
-                                                                </div>  <!-- /#suspendModal[% RESERVE.reserve_id %] -->
+                                                                </div>  <!-- /#suspendModal[% RESERVE.reserve_id | html %] -->
                                                             [% ELSE %]
                                                                 <form class="form-inline" action="/cgi-bin/koha/opac-modrequest-suspend.pl" method="post">
-                                                                    <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id %]" />
+                                                                    <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id | html %]" />
                                                                     <button class="btn btn-link" type="submit" name="submit"><i class="icon-pause"></i> Suspend</button>
                                                                 </form>
                                                             [% END # / IF AutoResumeSuspendedHolds %]
                                             <td class="modify">
                                                 [% IF ( RESERVE.is_cancelable_from_opac ) %]
                                                     <form action="/cgi-bin/koha/opac-modrequest.pl" method="post">
-                                                    <input type="hidden" name="biblionumber" value="[% RESERVE.biblionumber %]" />
-                                                    <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id %]" />
+                                                    <input type="hidden" name="biblionumber" value="[% RESERVE.biblionumber | html %]" />
+                                                    <input type="hidden" name="reserve_id" value="[% RESERVE.reserve_id | html %]" />
                                                     <button type="submit" name="submit" class="btn btn-mini btn-danger" onclick="return confirmDelete(MSG_CONFIRM_DELETE_HOLD);"><i class="icon-remove icon-white"></i> Cancel</button></form>
                                                 [% END %]
                                             </td>
                             <div id="opac-user-article-requests">
                                 [% IF logged_in_user.article_requests_current.count %]
                                     <table id="article-requests-table" class="table table-bordered table-striped">
-                                        <caption>Article requests <span class="count">([% logged_in_user.article_requests_current.count %] total)</span></caption>
+                                        <caption>Article requests <span class="count">([% logged_in_user.article_requests_current.count | html %] total)</span></caption>
                                         <thead>
                                             <tr>
                                                 <th class="anti-the article-request-record-title">Record title</th>
                                         <tbody>
                                         [% FOREACH ar IN logged_in_user.article_requests_current %]
                                                 <td class="article-request-record-title">
-                                                    <a class="article-request-title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ar.biblionumber %]">
-                                                        [% ar.biblio.title %]
-                                                        [% ar.item.enumchron %]
+                                                    <a class="article-request-title" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% ar.biblionumber | html %]">
+                                                        [% ar.biblio.title | html %]
+                                                        [% ar.item.enumchron | html %]
                                                     </a>
-                                                    [% ar.biblio.author %]
-                                                    [% IF ar.itemnumber %] <i>(only [% ar.item.barcode %])</i>[% END %]
+                                                    [% ar.biblio.author | html %]
+                                                    [% IF ar.itemnumber %] <i>(only [% ar.item.barcode | html %])</i>[% END %]
                                                 </td>
 
                                                 <td class="article-request-created_on">
                                                 </td>
 
                                                 <td class="article-request-title">
-                                                    [% ar.title %]
+                                                    [% ar.title | html %]
                                                 </td>
 
                                                 <td class="article-request-author">
-                                                    [% ar.author %]
+                                                    [% ar.author | html %]
                                                 </td>
 
                                                 <td class="article-request-volume">
-                                                    [% ar.volume %]
+                                                    [% ar.volume | html %]
                                                 </td>
 
                                                 <td class="article-request-issue">
-                                                    [% ar.issue %]
+                                                    [% ar.issue | html %]
                                                 </td>
 
                                                 <td class="article-request-date">
-                                                    [% ar.date %]
+                                                    [% ar.date | html %]
                                                 </td>
 
                                                 <td class="article-request-pages">
-                                                    [% ar.pages %]
+                                                    [% ar.pages | html %]
                                                 </td>
 
                                                 <td class="article-request-chapters">
-                                                    [% ar.chapters %]
+                                                    [% ar.chapters | html %]
                                                 </td>
 
                                                 <td class="article-request-patron-notes">
-                                                    [% ar.patron_notes %]
+                                                    [% ar.patron_notes | html %]
                                                 </td>
 
                                                 <td class="article-request-status">
                                                 </td>
 
                                                 <td class="article-request-branchcode">
-                                                    [% ar.branch.branchname %]
+                                                    [% ar.branch.branchname | html %]
                                                 </td>
 
                                                 <td class="article-request-cancel">
                                                     <span class="tdlabel">Cancel:</span>
-                                                    <a class="btn btn-mini btn-danger" href="opac-article-request-cancel.pl?id=[% ar.id %]" onclick="return confirmDelete(MSG_CONFIRM_DELETE_ARTREQ);"><i class="icon-remove icon-white"></i> Cancel</a>
+                                                    <a class="btn btn-mini btn-danger" href="opac-article-request-cancel.pl?id=[% ar.id | html %]" onclick="return confirmDelete(MSG_CONFIRM_DELETE_ARTREQ);"><i class="icon-remove icon-white"></i> Cancel</a>
                                                 </td>
                                             </tr>
                                         [% END %]
             if ( $('#opac-user-clubs').length ) {
                 $('#opac-user-clubs-tab-link').on('click', function() {
                     $('#opac-user-clubs').text(_("Loading..."));
-                    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber %]');
+                    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]');
                 });
             }
         });
         //]]>
     </script>
     [% IF Koha.Preference('OverDriveCirculation') %]
-    [% Asset.js("js/overdrive.js") %]
+    [% Asset.js("js/overdrive.js") | $raw %]
     <script>
     $(document).ready(function() {
         [% IF ( overdrive_error ) %]
-            KOHA.OverDriveCirculation.display_error("#opac-user-overdrive", "[% overdrive_error.dquote %]");
+            KOHA.OverDriveCirculation.display_error("#opac-user-overdrive", "[% overdrive_error.dquote | html %]");
         [% END %]
 
         [% IF ( overdrive_tab ) %]
index 3674bbe..6a96883 100644 (file)
@@ -1,3 +1,4 @@
+[% USE raw %]
 [% USE Asset %]
 [%# Includes %]
 [% USE Koha %]
 
 [% INCLUDE 'doc-head-open.inc' %]
 
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha [% END %] &rsaquo; Self check-in</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha [% END %] &rsaquo; Self check-in</title>
 
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats -->
+<meta name="generator" content="Koha [% Version | html %]" /> <!-- leave this for stats -->
 
 [% IF ( Koha.Preference('OpacFavicon') ) %]
-<link rel="shortcut icon" href="[% Koha.Preference('OpacFavicon') %]" type="image/x-icon" />
+<link rel="shortcut icon" href="[% Koha.Preference('OpacFavicon') | html %]" type="image/x-icon" />
 [% ELSE %]
-<link rel="shortcut icon" href="[% interface %]/[% theme %]/images/favicon.ico" type="image/x-icon" />
+<link rel="shortcut icon" href="[% interface | html %]/[% theme | html %]/images/favicon.ico" type="image/x-icon" />
 [% END %]
-[% Asset.css("lib/bootstrap/css/bootstrap.min.css") %]
-[% Asset.css("lib/jquery/jquery-ui.css") %]
-[% Asset.css("lib/font-awesome/css/font-awesome.min.css") %]
-[% Asset.css("css/sci.css") %]
-[% IF ( Koha.Preference('OPACUserCSS') ) %]<style type="text/css">[% Koha.Preference('OPACUserCSS') %]</style>[% END %]
-[% IF ( Koha.Preference('SelfCheckInUserCSS') ) %]<style type="text/css">[% Koha.Preference('SelfCheckInUserCSS') %]</style>[% END %]
+[% Asset.css("lib/bootstrap/css/bootstrap.min.css") | $raw %]
+[% Asset.css("lib/jquery/jquery-ui.css") | $raw %]
+[% Asset.css("lib/font-awesome/css/font-awesome.min.css") | $raw %]
+[% Asset.css("css/sci.css") | $raw %]
+[% IF ( Koha.Preference('OPACUserCSS') ) %]<style type="text/css">[% Koha.Preference('OPACUserCSS') | $raw %]</style>[% END %]
+[% IF ( Koha.Preference('SelfCheckInUserCSS') ) %]<style type="text/css">[% Koha.Preference('SelfCheckInUserCSS') | $raw %]</style>[% END %]
 <!--[if lt IE 9]>
-    <script src="[% interface %]/[% theme %]/lib/respond.min.js"></script>
+    <script src="[% interface | html %]/[% theme | html %]/lib/respond.min.js"></script>
 <![endif]-->
 <script>
     function _(s) { return s } // dummy function for gettext
 </script>
-[% Asset.js("lib/modernizr.min.js") %]
+[% Asset.js("lib/modernizr.min.js") | $raw %]
 </head>
 <body id="sci_main" class="sci" onload="dofocus();" onunload="mungeHistory();">
 
@@ -50,7 +51,7 @@
     <div class="navbar navbar-inverse navbar-static-top">
         <div class="navbar-inner">
             <div class="container-fluid">
-                <a class="brand" href="/cgi-bin/koha/sci/sci-main.pl"><img src="[% interface %]/[% theme %]/images/koha-logo-navbar.png" alt=""></a>
+                <a class="brand" href="/cgi-bin/koha/sci/sci-main.pl"><img src="[% interface | html %]/[% theme | html %]/images/koha-logo-navbar.png" alt=""></a>
                 <div id="checkouthelp">
                     <ul class="nav pull-right">
                         <li><a href="/cgi-bin/koha/sci/sci-main.pl" class="helpModal-trigger" role="button" data-toggle="modal"><i class="icon help"></i> Help</a></li>
@@ -74,7 +75,7 @@
     <div class="container-fluid">
         <div class="row-fluid">
             <div id="opacheader">
-                [% Koha.Preference( 'opacheader' ) %]
+                [% Koha.Preference( 'opacheader' ) | $raw %]
             </div>
         </div>
     </div>
@@ -84,7 +85,7 @@
         <div class="container-fluid">
             <div class="row-fluid">
                 <div id="masthead">
-                    <h1>[% LibraryName %] Self check-in</h1>
+                    <h1>[% LibraryName | html %] Self check-in</h1>
                 [% IF ( nopermission ) %]
                     [%# This is what is displayed if user doesn't have permission %]
                     <div class="alert">
                                   </thead>
                                   <tbody>
                                 [% FOREACH success_line IN success %]
-                                    <tr><td>[% success_line.barcode %]</td><td>Checked in</td></tr>
+                                    <tr><td>[% success_line.barcode | html %]</td><td>Checked in</td></tr>
                                 [% END %]
                                 [% FOREACH error IN errors %]
                                     <tr>
-                                      <td>[% error.barcode %]</td>
+                                      <td>[% error.barcode | html %]</td>
                                       <td>Not checked in [% PROCESS error_message messages=error.messages %]</td>
                                     </tr>
                                 [% END %]
         </div> <!-- / .container-fluid -->
 
         [% IF ( Koha.Preference('SelfCheckInMainUserBlock') ) %]
-            <div id="SelfCheckInMainUserBlock">[% Koha.Preference('SelfCheckInMainUserBlock' ) %]</div>
+            <div id="SelfCheckInMainUserBlock">[% Koha.Preference('SelfCheckInMainUserBlock' ) | $raw %]</div>
         [% END %]
     </div> <!-- / .main -->
 
         function timerIncrement() {
             if ( $("#sci_finish_button").is(":visible") || $("#sci_refresh_button").is(":visible") ) {
                 idleTime = idleTime + 1;
-                idleTimeout = [% refresh_timeout %];
+                idleTimeout = [% refresh_timeout | html %];
                 if (idleTime >= idleTimeout ) {
                     location.href = '/cgi-bin/koha/sci/sci-main.pl';
                 }
         }
     </script>
 
-    [% IF ( Koha.Preference('SelfCheckInUserJS') ) %]<script>[% Koha.Preference('SelfCheckInUserJS') %]</script>[% END %]
+    [% IF ( Koha.Preference('SelfCheckInUserJS') ) %]<script>[% Koha.Preference('SelfCheckInUserJS') | $raw %]</script>[% END %]
 [% END %]
index 0497dbd..ca8ad5f 100644 (file)
@@ -1,22 +1,23 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE KohaDates %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha [% END %] &rsaquo; Self checkout help</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha [% END %] &rsaquo; Self checkout help</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats -->
-<link rel="shortcut icon" href="[% IF ( OpacFavicon  ) %][% OpacFavicon  %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
- [% Asset.css("lib/bootstrap/css/bootstrap.min.css") %]
-[% Asset.css("lib/jquery/jquery-ui.css") %]
-[% Asset.css("css/sco.css") %]
-[% IF ( OPACUserCSS ) %]<style>[% OPACUserCSS %]</style>[% END %]
-[% IF ( SCOUserCSS ) %]<style>[% SCOUserCSS %]</style>[% END %]
+<meta name="generator" content="Koha [% Version | html %]" /> <!-- leave this for stats -->
+<link rel="shortcut icon" href="[% IF ( OpacFavicon  ) %][% OpacFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/images/favicon.ico[% END %]" type="image/x-icon" />
+ [% Asset.css("lib/bootstrap/css/bootstrap.min.css") | $raw %]
+[% Asset.css("lib/jquery/jquery-ui.css") | $raw %]
+[% Asset.css("css/sco.css") | $raw %]
+[% IF ( OPACUserCSS ) %]<style>[% OPACUserCSS | $raw %]</style>[% END %]
+[% IF ( SCOUserCSS ) %]<style>[% SCOUserCSS | $raw %]</style>[% END %]
 <!--[if lt IE 9]>
-    <script src="[% interface %]/[% theme %]/lib/respond.min.js"></script>
+    <script src="[% interface | html %]/[% theme | html %]/lib/respond.min.js"></script>
 <![endif]-->
 <script>
     function _(s) { return s } // dummy function for gettext
 </script>
-[% Asset.js("lib/modernizr.min.js") %]
+[% Asset.js("lib/modernizr.min.js") | $raw %]
 </head>
 <body id="sco_help" class="sco">
 [% INCLUDE 'masthead-sco.inc' %]
@@ -29,7 +30,7 @@
 
 [% IF ( SelfCheckHelpMessage ) %]
 <div id="selfcheckhelpmessage">
-[% SelfCheckHelpMessage %]
+[% SelfCheckHelpMessage | $raw %]
 </div>
 [% END %]
 
@@ -48,7 +49,7 @@ The Submit button only needs to be clicked if you enter the barcode manually.</p
 
 <h3>Step three: Click the 'Finish' button</h3>
 <p>If you do not click the 'Finish' button, your session will automatically expire in
-[% SelfCheckTimeout %] seconds.</p>
+[% SelfCheckTimeout | html %] seconds.</p>
 
     <div class="button">
         <a href="javascript:history.go(-1)">Return to the self-checkout</a>
@@ -62,5 +63,5 @@ The Submit button only needs to be clicked if you enter the barcode manually.</p
 
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
-[% IF ( SCOUserJS ) %]<script>[% SCOUserJS %]</script>[% END %]
+[% IF ( SCOUserJS ) %]<script>[% SCOUserJS | $raw %]</script>[% END %]
 [% END %]
index 191548a..d090809 100644 (file)
@@ -1,17 +1,18 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha [% END %] &rsaquo; Self checkout &rsaquo; Print Receipt for [% borrowernumber %]</title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha [% END %] &rsaquo; Self checkout &rsaquo; Print Receipt for [% borrowernumber | html %]</title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<link rel="shortcut icon" href="[% IF ( OpacFavicon  ) %][% OpacFavicon  %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("css/print.css") %]
+<link rel="shortcut icon" href="[% IF ( OpacFavicon  ) %][% OpacFavicon | html %][% ELSE %][% interface | html %]/[% theme | html %]/images/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("css/print.css") | $raw %]
 [% IF stylesheet %]
-<link rel="stylesheet" type="text/css" href="[% stylesheet %]" />
+<link rel="stylesheet" type="text/css" href="[% stylesheet | html %]" />
 [% END %]
 
 <!-- JavaScript includes -->
-[% Asset.js("lib/jquery/jquery.js") %]
-[% Asset.js("js/global.js") %]
+[% Asset.js("lib/jquery/jquery.js") | $raw %]
+[% Asset.js("js/global.js") | $raw %]
 
 [% INCLUDE 'slip-print.inc' %]
 
     <div id="receipt">
         [% IF plain %]
             <pre>
-                [% slip %]
+                [% slip | html %]
             </pre>
         [% ELSE %]
-            [% slip %]
+            [% slip | html %]
         [% END %]
 
     </div>
index ccc503e..dcfdb08 100644 (file)
@@ -1,25 +1,26 @@
+[% USE raw %]
 [% USE Asset %]
 [% USE Koha %]
 [% USE KohaDates %]
 [% USE AudioAlerts %]
 [% USE Price %]
 [% INCLUDE 'doc-head-open.inc' %]
-<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha [% END %] &rsaquo; Self checkout </title>
+<title>[% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha [% END %] &rsaquo; Self checkout </title>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<meta name="generator" content="Koha [% Version %]" /> <!-- leave this for stats -->
-<link rel="shortcut icon" href="[% IF ( Koha.Preference('OpacFavicon') ) %][% Koha.Preference('OpacFavicon') %][% ELSE %][% interface %]/[% theme %]/images/favicon.ico[% END %]" type="image/x-icon" />
-[% Asset.css("lib/bootstrap/css/bootstrap.min.css") %]
-[% Asset.css("lib/jquery/jquery-ui.css") %]
-[% Asset.css("css/sco.css") %]
-[% IF ( Koha.Preference('OPACUserCSS') ) %]<style>[% Koha.Preference('OPACUserCSS') %]</style>[% END %]
-[% IF ( Koha.Preference('SCOUserCSS') ) %]<style>[% Koha.Preference('SCOUserCSS') %]</style>[% END %]
+<meta name="generator" content="Koha [% Version | html %]" /> <!-- leave this for stats -->
+<link rel="shortcut icon" href="[% IF ( Koha.Preference('OpacFavicon') ) %][% Koha.Preference('OpacFavicon') | html %][% ELSE %][% interface | html %]/[% theme | html %]/images/favicon.ico[% END %]" type="image/x-icon" />
+[% Asset.css("lib/bootstrap/css/bootstrap.min.css") | $raw %]
+[% Asset.css("lib/jquery/jquery-ui.css") | $raw %]
+[% Asset.css("css/sco.css") | $raw %]
+[% IF ( Koha.Preference('OPACUserCSS') ) %]<style>[% Koha.Preference('OPACUserCSS') | $raw %]</style>[% END %]
+[% IF ( Koha.Preference('SCOUserCSS') ) %]<style>[% Koha.Preference('SCOUserCSS') | $raw %]</style>[% END %]
 <!--[if lt IE 9]>
-    <script src="[% interface %]/[% theme %]/lib/respond.min.js"></script>
+    <script src="[% interface | html %]/[% theme | html %]/lib/respond.min.js"></script>
 <![endif]-->
 <script>
     function _(s) { return s } // dummy function for gettext
 </script>
-[% Asset.js("lib/modernizr.min.js") %]
+[% Asset.js("lib/modernizr.min.js") | $raw %]
 </head>
 <body id="sco_main" class="sco" onload="dofocus();" onunload="mungeHistory();">
 [% INCLUDE 'masthead-sco.inc' %]
                     <div class="span12">
                 [% END %]
 
-                    <div id="masthead"><h1>[% LibraryName %] Self checkout system</h1></div>
+                    <div id="masthead"><h1>[% LibraryName | html %] Self checkout system</h1></div>
 
                     [% IF ( impossible ) %]<!-- We tried to issue, but failed. -->
                         <div class="alert">
                             <h3>Item cannot be checked out.</h3>
                             <p>Sorry, this item cannot be checked out at this station.</p>
                             [% IF ( title ) %]
-                                <p>Title: <em>[% title |html %]</em> </p>
+                                <p>Title: <em>[% title | html %]</em> </p>
                             [% END %]
 
                             <p>
@@ -55,7 +56,7 @@
                                 [% ELSIF ( circ_error_NOT_FOR_LOAN ) %]
                                     This item is not for loan.
                                 [% ELSIF ( circ_error_DEBT ) %]
-                                    You owe the library [% DEBT | $Price %] and cannot check out.
+                                    You owe the library [% DEBT | $Price | html %] and cannot check out.
                                 [% ELSIF ( circ_error_WTHDRAWN ) %]
                                     This item has been withdrawn from the collection.
                                 [% ELSIF ( circ_error_RESTRICTED ) %]
                             [% IF ( returnitem && Koha.Preference('AllowSelfCheckReturns') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
                                     <input type="hidden" name="op" value="returnbook" />
-                                    <input type="hidden" name="patronid" value="[% patronid %]" />
-                                    <input type="hidden" name="barcode" value="[% barcode %]" />
+                                    <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                    <input type="hidden" name="barcode" value="[% barcode | html %]" />
                                     <button type="submit" name="returnbook" class="btn"><i class="return"></i> Return this item</button>
                                 </form>
                             [% END %]
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="errorForm" class="inline" method="post">
                                 <input type="hidden" name="op" value="" />
-                                <input type="hidden" name="patronid" value="[% patronid %]" />
-                                <input type="hidden" name="barcode" value="[% barcode %]" />
+                                <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                <input type="hidden" name="barcode" value="[% barcode | html %]" />
                                 <input type="submit" name= "confirm" value="Return to account summary" class="btn back focus" />
                             </form>
                         </div> <!-- / .alert -->
                             [% IF ( renew && Koha.Preference('AllowSelfCheckReturns') ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
                                     <input type="hidden" name="op" value="returnbook" />
-                                    <input type="hidden" name="patronid" value="[% patronid %]" />
-                                    <input type="hidden" name="barcode" value="[% barcode %]" />
+                                    <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                    <input type="hidden" name="barcode" value="[% barcode | html %]" />
                                     <input type="hidden" name="confirmed" value="" />
                                     <button type="submit" name="returnbook" class="btn"><i class="icon return"></i> Return this item</button>
                                 </form>
                             [% UNLESS ( renew ) %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
                                     <input type="hidden" name="op" value="checkout" />
-                                    <input type="hidden" name="patronid" value="[% patronid %]" />
-                                    <input type="hidden" name="barcode" value="[% barcode %]" />
+                                    <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                    <input type="hidden" name="barcode" value="[% barcode | html %]" />
                                     <input type="hidden" name="confirmed" value="1" />
                                     <button type="submit" name="confirm" class="btn"><i class="icon renew"></i> Renew item</button>
                                   </form>
                             [% ELSE %]
                                 <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
                                     <input type="hidden" name="op" value="checkout" />
-                                    <input type="hidden" name="patronid" value="[% patronid %]" />
-                                    <input type="hidden" name="barcode" value="[% barcode %]" />
+                                    <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                    <input type="hidden" name="barcode" value="[% barcode | html %]" />
                                     <input type="hidden" name="confirmed" value="1" />
                                     <button type="submit" class="btn"><i class="icon renew"></i> Renew item</button>
                                 </form>
 
                             <form action="/cgi-bin/koha/sco/sco-main.pl" name="confirmForm" class="inline" method="post">
                                 <input type="hidden" name="op" value="" />
-                                <input type="hidden" name="patronid" value="[% patronid %]" />
+                                <input type="hidden" name="patronid" value="[% patronid | html %]" />
                                 <button type="submit" class="btn"><i class="icon cancel"></i> Cancel</button>
                             </form>
                         </div>
 
                         [% IF ( patronid ) %]
                             [% IF ( validuser ) %]
-                                <div class="alert alert-info">You are logged in as [% borrowername %].</div>
+                                <div class="alert alert-info">You are logged in as [% borrowername | html %].</div>
                                 [% INCLUDE 'opac-note.inc' %]
                                 [% IF patron_has_hold_fee %]
                                     <div class="alert">A hold fee was charged to your account for collecting this item.</div>
                             [% IF ( nouser ) %]
                                 <div class="alert">
                                     <h4>Sorry</h4>
-                                    <p>The userid <strong>[% patronid %]</strong> was not found in the database.  Please try again.</p>
+                                    <p>The userid <strong>[% patronid | html %]</strong> was not found in the database.  Please try again.</p>
                                 </div>
                             [% END %]
                         [% END # / IF patronid %]
 
                         [% IF ( validuser ) %]
                             <div id="newcheckout" class="sco_entry">
-                                <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sco/sco-main.pl" onsubmit="return checkout_confirm('[% patronid %]');">
+                                <form id="scan_form" name="scan_form" method="post" action="/cgi-bin/koha/sco/sco-main.pl" onsubmit="return checkout_confirm('[% patronid | html %]');">
                                     <fieldset>
                                         <legend>Check out[% IF ( Koha.Preference('AllowSelfCheckReturns') ) %], return[% END %] or renew an item: </legend>
                                         <div class="input-append">
                                             <button type="submit" class="btn">Submit</button>
                                         </div>
                                         <input type="hidden" name="op" value="checkout" />
-                                        <input type="hidden" name="patronid" value="[% patronid %]" />
+                                        <input type="hidden" name="patronid" value="[% patronid | html %]" />
                                     </fieldset>
                                 </form>
 
                 </div> <!-- / .span12/12 -->
                 [% IF ( display_patron_image ) %]
                     <div class="span2">
-                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber %]&csrf_token=[% csrf_token %]" alt="" />
+                        <img src="/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=[% borrowernumber | html %]&csrf_token=[% csrf_token | html %]" alt="" />
                     </div>
                 [% END %]
             </div> <!-- / .row-fluid -->
                         <div id="borrowerdetails">
                             [% IF ( issues_count ) %]
                                 <table id="loanTable" class="table table-bordered table-striped">
-                                    <caption>Checkouts for [% borrowername %] <span class="count">([%   issues_count %] total)</span></caption>
+                                    <caption>Checkouts for [% borrowername | html %] <span class="count">([% issues_count | html %] total)</span></caption>
                                     <!-- ISSUES TABLE ROWS -->
                                     <thead>
                                         <tr>
                                     <tbody>
                                         [% FOREACH ISSUE IN ISSUES %]
                                             <tr>
-                                                <td>[% ISSUE.issuedate %]</td>
+                                                <td>[% ISSUE.issuedate | html %]</td>
                                                 <td>
                                                     [% UNLESS ( noitemlinks ) %]
-                                                        <a href="/cgi-bin/koha/opac-detail.pl?bib=[% ISSUE.  biblionumber %]">[% ISSUE.title |html %]</a>
+                                                        <a href="/cgi-bin/koha/opac-detail.pl?bib=[% ISSUE.  biblionumber | html %]">[% ISSUE.title | html %]</a>
                                                     [% ELSE %]
-                                                        <strong>[% ISSUE.title |html %]</strong>
+                                                        <strong>[% ISSUE.title | html %]</strong>
                                                     [% END %]
-                                                    <span class="item-details">[% ISSUE.author %]</span>
-                                                    ([% ISSUE.barcode %])
+                                                    <span class="item-details">[% ISSUE.author | html %]</span>
+                                                    ([% ISSUE.barcode | html %])
                                                 </td>
-                                                <td>[% ISSUE.itemcallnumber %]</td>
+                                                <td>[% ISSUE.itemcallnumber | html %]</td>
                                                 [% IF ( ISSUE.overdue ) %]
-                                                    <td class="overdue"><span title="[% ISSUE.date_due %]">[% ISSUE.date_due | $KohaDates as_due_date => 1 %]</span></td>
+                                                    <td class="overdue"><span title="[% ISSUE.date_due | html %]">[% ISSUE.date_due | $KohaDates as_due_date => 1 | html %]</span></td>
                                                 [% ELSE   %]
-                                                    <td><span title="[% ISSUE.date_due %]">[% ISSUE.date_due | $KohaDates as_due_date => 1 %]</span></td>
+                                                    <td><span title="[% ISSUE.date_due | html %]">[% ISSUE.date_due | $KohaDates as_due_date => 1 | html %]</span></td>
                                                 [% END %]
                                                 <td>
                                                     <form action="/cgi-bin/koha/sco/sco-main.pl" method="post">
-                                                        <input type="hidden" name="patronid" value="[% patronid %]" />
-                                                        <input type="hidden" name="barcode" value="[% ISSUE.barcode %]" />
+                                                        <input type="hidden" name="patronid" value="[% patronid | html %]" />
+                                                        <input type="hidden" name="barcode" value="[% ISSUE.barcode | html %]" />
                                                         [% IF ISSUE.can_be_renewed %]
                                                             <input type="hidden" name="op" value="checkout" />
                                                             <input type="hidden" name="confirmed" value="1" />
                                         [% END %]
 
                                         [% FOREACH INPUT IN INPUTS %]
-                                            <input type="hidden" name="[% INPUT.name |html %]" value="[% INPUT.value |html %]">
+                                            <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]">
                                         [% END %]
                                         <input type="hidden" name="op" value="login" />
                                     </fieldset>
                             </div> <!-- / .sco_entry -->
                         [% END # / IF validuser %]
                     [% END # / UNLESS ( hide_main %]
-                    [% IF ( Koha.Preference('SCOMainUserBlock' ) ) %]<div id="scomainuserblock">[% Koha.Preference('SCOMainUserBlock' ) %]</div>[% END %]
+                    [% IF ( Koha.Preference('SCOMainUserBlock' ) ) %]<div id="scomainuserblock">[% Koha.Preference('SCOMainUserBlock' ) | $raw %]</div>[% END %]
                 </div> <!-- / .span12 -->
             </div> <!-- / .row-fluid -->
         </div> <!-- / .container-fluid -->
         function sco_init() {
             mainTimeout = setTimeout(function() {
                 location.href = '/cgi-bin/koha/sco/sco-main.pl?op=logout';
-            }, [% SelfCheckTimeout %]);
+            }, [% SelfCheckTimeout | html %]);
         }
         function dofocus() {    // named function req'd for body onload event by some FF and IE7 security models
             // alert("dofocus called");
             return true;
         }
         [% IF Koha.Preference('AudioAlerts') %]
-            var AUDIO_ALERTS = JSON.parse( '[% AudioAlerts.AudioAlerts | replace( "'", "\\'" ) | replace( '"', '\\"' ) %]' );
+            var AUDIO_ALERTS = JSON.parse( '[% AudioAlerts.AudioAlerts | replace( "'", "\\'" ) | replace( '"', '\\"' ) | html %]' );
             $( document ).ready(function() {
                 if ( AUDIO_ALERTS ) {
                     for ( var k in AUDIO_ALERTS ) {
                 [% IF Koha.Preference('SelfCheckReceiptPrompt') %]
                     var confirmStart = Date.now();
                     if(confirm(_("Would you like to print a receipt?"))){
-                        if ( (Date.now() - confirmStart) < [% SelfCheckTimeout %] ) {
-                            window.open("/cgi-bin/koha/sco/printslip.pl?borrowernumber=[% borrowernumber %]&amp;print=qslip");
+                        if ( (Date.now() - confirmStart) < [% SelfCheckTimeout | html %] ) {
+                            window.open("/cgi-bin/koha/sco/printslip.pl?borrowernumber=[% borrowernumber | html %]&amp;print=qslip");
                         } else {
                             alert(_("Timeout while waiting for print confirmation"));
                         }
     //]]>
     </script>
 
-    [% IF ( Koha.Preference('SCOUserJS') ) %]<script>[% Koha.Preference('SCOUserJS') %]</script>[% END %]
+    [% IF ( Koha.Preference('SCOUserJS') ) %]<script>[% Koha.Preference('SCOUserJS') | $raw %]</script>[% END %]
 [% END %]
index 3e62d0e..404dd35 100644 (file)
@@ -34,7 +34,7 @@
     <div>
         <span class="suggestionlabel">Did you mean:</span>
         [% FOREACH suggestion IN suggestions %]
-            <span class="searchsuggestion"><a href="/cgi-bin/koha/opac-search.pl?q=[% suggestion.search |uri %]">[% suggestion.label |html %]</a></span>
+            <span class="searchsuggestion"><a href="/cgi-bin/koha/opac-search.pl?q=[% suggestion.search |uri %]">[% suggestion.label | html %]</a></span>
         [% END %]
     </div>
 [% ELSE %]
index c6ff6f7..0f1a5e2 100644 (file)
@@ -4,35 +4,35 @@
  xmlns="http://purl.org/rss/1.0/"
  xmlns:dc="http://purl.org/dc/elements/1.1/"
 >
-  <channel rdf:about="[% CHANNELLINK %]">
-    <title>[% CHANNELTITLE %]</title>
-    <link>[% CHANNELLINK %]</link>
-    <description>[% CHANNELDESC %]</description>
-    <language>[% CHANNELLANG %]</language>
-    <lastBuildDate>[% CHANNELLASTBUILD %]</lastBuildDate>
-     <image rdf:about="[% IMAGEURL %]">
-      <title>[% IMAGETITLE %]</title>
-      <url>[% IMAGEURL %]</url>
-      <link>[% IMAGELINK %]</link>
+  <channel rdf:about="[% CHANNELLINK | html %]">
+    <title>[% CHANNELTITLE | html %]</title>
+    <link>[% CHANNELLINK | html %]</link>
+    <description>[% CHANNELDESC | html %]</description>
+    <language>[% CHANNELLANG | html %]</language>
+    <lastBuildDate>[% CHANNELLASTBUILD | html %]</lastBuildDate>
+     <image rdf:about="[% IMAGEURL | html %]">
+      <title>[% IMAGETITLE | html %]</title>
+      <url>[% IMAGEURL | html %]</url>
+      <link>[% IMAGELINK | html %]</link>
      </image>
     <items>
       <rdf:Seq>
       [% FOREACH i IN ITEMS %]
-        <rdf:li resource="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% ibiblionumber %]"/>
+        <rdf:li resource="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% ibiblionumber | html %]"/>
       [% END %]
       </rdf:Seq>
     </items>
 </channel>
 
   [% FOREACH i IN ITEMS %]
-  <item rdf:about="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]">
-  <title>[% i.TITLE %][% IF i.AUTHOR %] by [% i.AUTHOR %][% END %]</title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber %]</link>
-<description><![CDATA[[% TITLE %][% IF i.AUTHOR %] by [% i.AUTHOR %][% END %]
-<br>[% place %] [% i.publishercode %] [% i.publicationyear %]
-<br>[% pages %] [% i.illus %] [% i.size %]
-[% IF i.notes %]<br><br>[% i.notes %][% END %]<br>
-<a href="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber %]">View Details</a> | <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% i.biblionumber %]">Reserve this Item</a>[% IF i.author %] | <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?marclist=biblio.author&amp;and_or=and&amp;excluding=&amp;operator=contains&amp;value=[% i.author %]&amp;resultsperpage=20&amp;orderby=biblio.title&amp;op=do_search">More by this Author</a>[% END %]
+  <item rdf:about="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]">
+  <title>[% i.TITLE | html %][% IF i.AUTHOR %] by [% i.AUTHOR | html %][% END %]</title>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% biblionumber | html %]</link>
+<description><![CDATA[[% TITLE | html %][% IF i.AUTHOR %] by [% i.AUTHOR | html %][% END %]
+<br>[% place | html %] [% i.publishercode | html %] [% i.publicationyear | html %]
+<br>[% pages | html %] [% i.illus | html %] [% i.size | html %]
+[% IF i.notes %]<br><br>[% i.notes | html %][% END %]<br>
+<a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber | html %]">View Details</a> | <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% i.biblionumber | html %]">Reserve this Item</a>[% IF i.author %] | <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?marclist=biblio.author&amp;and_or=and&amp;excluding=&amp;operator=contains&amp;value=[% i.author | html %]&amp;resultsperpage=20&amp;orderby=biblio.title&amp;op=do_search">More by this Author</a>[% END %]
 ]]></description>
  </item>
 [% END %]
index 820b26d..5067fa4 100644 (file)
@@ -1,31 +1,31 @@
 <?xml version="1.0"?>
 <rss version="2.0">
     <channel>
-        <title>[% CHANNELTITLE %]</title>
-        <link>[% CHANNELLINK %]</link>
-        <description>[% CHANNELDESC %]</description>
-        <language>[% CHANNELLANG %]</language>
-        <lastBuildDate>[% CHANNELLASTBUILD %]</lastBuildDate>
+        <title>[% CHANNELTITLE | html %]</title>
+        <link>[% CHANNELLINK | html %]</link>
+        <description>[% CHANNELDESC | html %]</description>
+        <language>[% CHANNELLANG | html %]</language>
+        <lastBuildDate>[% CHANNELLASTBUILD | html %]</lastBuildDate>
         <docs>http://blogs.law.harvard.edu/tech/rss</docs>
         <generator>Koha</generator>
         <image>
-            <title>[% IMAGETITLE %]</title>
-            <url>[% IMAGEURL %]</url>
-            <link>[% IMAGELINK %]</link>
-            <width>[% IMAGEWIDTH %]</width>
-            <height>[% IMAGEHEIGHT %]</height>
-            <description>[% IMAGEDESCRIPTION %]</description>
+            <title>[% IMAGETITLE | html %]</title>
+            <url>[% IMAGEURL | html %]</url>
+            <link>[% IMAGELINK | html %]</link>
+            <width>[% IMAGEWIDTH | html %]</width>
+            <height>[% IMAGEHEIGHT | html %]</height>
+            <description>[% IMAGEDESCRIPTION | html %]</description>
         </image>
 
 [% FOREACH i IN ITEMS %]
  <item>
-  <title>[% i.TITLE %][% IF i.AUTHOR %] by [% i.AUTHOR %][% END %]</title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber %]</link>
-<description><![CDATA[[% i.TITLE %][% IF i.AUTHOR %] by [%  i.AUTHOR %][% END %]
-<br>[% IF i.publishercode %][% i.place %] [%  i.publishercode %] [%  publicationyear %]<br>[% END %]
-[% IF i.pages %][% i.pages %][% i.illus %][% i.size %][% END %]
-[% IF i.notes %]<p>[% i.notes %]</p>[% END %]<br>
-<a href="[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber %]">View Details</a> | <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% i.biblionumber %]">Reserve this Item</a>[% IF i.author %] | <a href="[% OPACBaseURL %]/cgi-bin/koha/opac-search.pl?marclist=biblio.author&amp;and_or=and&amp;excluding=&amp;operator=contains&amp;value=[% i.author %]&amp;resultsperpage=20&amp;orderby=biblio.title&amp;op=do_search">More by this Author</a>[% END %]
+  <title>[% i.TITLE | html %][% IF i.AUTHOR %] by [% i.AUTHOR | html %][% END %]</title>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber | html %]</link>
+<description><![CDATA[[% i.TITLE | html %][% IF i.AUTHOR %] by [% i.AUTHOR | html %][% END %]
+<br>[% IF i.publishercode %][% i.place | html %] [% i.publishercode | html %] [% publicationyear | html %]<br>[% END %]
+[% IF i.pages %][% i.pages | html %][% i.illus | html %][% i.size | html %][% END %]
+[% IF i.notes %]<p>[% i.notes | html %]</p>[% END %]<br>
+<a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber | html %]">View Details</a> | <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-reserve.pl?biblionumber=[% i.biblionumber | html %]">Reserve this Item</a>[% IF i.author %] | <a href="[% OPACBaseURL | html %]/cgi-bin/koha/opac-search.pl?marclist=biblio.author&amp;and_or=and&amp;excluding=&amp;operator=contains&amp;value=[% i.author | html %]&amp;resultsperpage=20&amp;orderby=biblio.title&amp;op=do_search">More by this Author</a>[% END %]
 ]]></description>
  </item>
 [% END %]
index c06413f..762ff92 100644 (file)
@@ -6,22 +6,22 @@
 <rss version="0.91">
 
 <channel>
- <title>[% CHANNELTITLE %]</title>
- <link>[% CHANNELLINK %]</link>
- <description>[% CHANNELDESC %]</description>
- <language>[% CHANNELLANG %]</language>
- <lastBuildDate>[% CHANNELLASTBUILD %]</lastBuildDate>
+ <title>[% CHANNELTITLE | html %]</title>
+ <link>[% CHANNELLINK | html %]</link>
+ <description>[% CHANNELDESC | html %]</description>
+ <language>[% CHANNELLANG | html %]</language>
+ <lastBuildDate>[% CHANNELLASTBUILD | html %]</lastBuildDate>
 
  <image>
-  <title>[% IMAGETITLE %]</title>
-  <url>[% IMAGEURL %]</url>
-  <link>[% IMAGELINK %]</link>
+  <title>[% IMAGETITLE | html %]</title>
+  <url>[% IMAGEURL | html %]</url>
+  <link>[% IMAGELINK | html %]</link>
  </image>
 
 [% FOREACH i IN ITEMS %]
  <item>
-  <title>[% i.TITLE %], by [% i.AUTHOR %]</title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber %]</link>
+  <title>[% i.TITLE | html %], by [% i.AUTHOR | html %]</title>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-detail.pl?biblionumber=[% i.biblionumber | html %]</link>
 
  </item>
 [% END %]
index 8e2395a..857a8c2 100644 (file)
@@ -6,22 +6,22 @@
 <rss version="0.91">
 
 <channel>
- <title>[% CHANNELTITLE %]</title>
- <link>[% CHANNELLINK %]</link>
- <description>[% CHANNELDESC %]</description>
- <language>[% CHANNELLANG %]</language>
- <lastBuildDate>[% CHANNELLASTBUILD %]</lastBuildDate>
+ <title>[% CHANNELTITLE | html %]</title>
+ <link>[% CHANNELLINK | html %]</link>
+ <description>[% CHANNELDESC | html %]</description>
+ <language>[% CHANNELLANG | html %]</language>
+ <lastBuildDate>[% CHANNELLASTBUILD | html %]</lastBuildDate>
 
  <image>
-  <title>[% IMAGETITLE %]</title>
-  <url>[% IMAGEURL %]</url>
-  <link>[% IMAGELINK %]</link>
+  <title>[% IMAGETITLE | html %]</title>
+  <url>[% IMAGEURL | html %]</url>
+  <link>[% IMAGELINK | html %]</link>
  </image>
 
 [% FOREACH i IN ITEMS %]
  <item>
-  <title>[% i.TITLE %], by [% i.AUTHOR %]</title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-searchresults.pl?isbn=[% i.ISBN %]</link>
+  <title>[% i.TITLE | html %], by [% i.AUTHOR | html %]</title>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-searchresults.pl?isbn=[% i.ISBN | html %]</link>
 
  </item>
 [% END %]
index d25205a..5f0c20b 100644 (file)
@@ -6,22 +6,22 @@
 <rss version="0.91">
 
 <channel>
- <title>[% CHANNELTITLE %]</title>
- <link>[% CHANNELLINK %]</link>
- <description>[% CHANNELDESC %]</description>
- <language>[% CHANNELLANG %]</language>
- <lastBuildDate>[% CHANNELLASTBUILD %]</lastBuildDate>
+ <title>[% CHANNELTITLE | html %]</title>
+ <link>[% CHANNELLINK | html %]</link>
+ <description>[% CHANNELDESC | html %]</description>
+ <language>[% CHANNELLANG | html %]</language>
+ <lastBuildDate>[% CHANNELLASTBUILD | html %]</lastBuildDate>
 
  <image>
-  <title>[% IMAGETITLE %]</title>
-  <url>[% IMAGEURL %]</url>
-  <link>[% IMAGELINK %]</link>
+  <title>[% IMAGETITLE | html %]</title>
+  <url>[% IMAGEURL | html %]</url>
+  <link>[% IMAGELINK | html %]</link>
  </image>
 
 [% FOREACH i IN ITEMS %]
  <item>
-  <title>[% TITLE %], by [% AUTHOR %]</title>
-  <link>[% OPACBaseURL %]/cgi-bin/koha/opac-searchresults.pl?isbn=[% ISBN %]</link>
+  <title>[% TITLE | html %], by [% AUTHOR | html %]</title>
+  <link>[% OPACBaseURL | html %]/cgi-bin/koha/opac-searchresults.pl?isbn=[% ISBN | html %]</link>
 
  </item>
 [% END %]