[open-ils-commits] [GIT] Evergreen ILS branch rel_2_12 updated. 854322f75b0203a57e6d00b9fb5fa8bc62fe0fa6

[Evergreen Git]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Evergreen ILS".

The branch, rel_2_12 has been updated
       via  854322f75b0203a57e6d00b9fb5fa8bc62fe0fa6 (commit)
       via  63b8ca3abea5ae2f6078ee5a8a09ad376e0c05dd (commit)
      from  a91faae8bc5da244251d0b05841c5612b2a29180 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 854322f75b0203a57e6d00b9fb5fa8bc62fe0fa6
Author: Galen Charlton <gmc at equinoxinitiative.org>
Date:   Tue Nov 7 14:33:16 2017 -0500

    LP#1671635: escape some values to avoid XSS
    
    Signed-off-by: Galen Charlton <gmc at equinoxinitiative.org>

diff --git a/Open-ILS/src/templates/opac/parts/place_hold.tt2 b/Open-ILS/src/templates/opac/parts/place_hold.tt2
index 18eb427..5ebf1ef 100644
--- a/Open-ILS/src/templates/opac/parts/place_hold.tt2
+++ b/Open-ILS/src/templates/opac/parts/place_hold.tt2
@@ -35,9 +35,9 @@
 
         <!-- Adding hidden fields so that parameters are maintained in
         searchbar throughout the place hold process. -->
-        <input type="hidden" name="locg" value="[% CGI.param('locg') %]" />
-        <input type="hidden" name="qtype" value="[% CGI.param('qtype') %]" />
-        <input type="hidden" name="query" value="[% CGI.param('query') %]" />
+        <input type="hidden" name="locg" value="[% CGI.param('locg') | html %]" />
+        <input type="hidden" name="qtype" value="[% CGI.param('qtype') | html %]" />
+        <input type="hidden" name="query" value="[% CGI.param('query') | html %]" />
         [%
             usr_barcode = CGI.param('usr_barcode') | html;
             is_requestor = CGI.param('is_requestor');

commit 63b8ca3abea5ae2f6078ee5a8a09ad376e0c05dd
Author: Kathy Lussier <klussier at masslnc.org>
Date:   Fri Sep 22 15:18:12 2017 -0400

    LP#1671635: Maintain search parameters throughout place hold process
    
    Add hidden fields to the Place Hold form for the search query, type
    and locg fields so that they will appear correctly in the search bar
    on the holds confirmation page. This commit also keeps the query
    parameter in the URL after clicking the Place Hold link from the search
    results page.
    
    Test Plan:
    Log into the public catalog and perform a search that is limited to a library
    that differs from the user's preferred search library and using a search type
    that is not keyword (e.g. title or author). Place a hold on any title from
    either the search results or record page. After submitting the form, look
    at the search parameters in the search bar on the hold confirmation page.
    
    Pre-patch, the query terms will not appear, the search type will revert back
    to the default of keyword, and the search library will be the user's preferred
    search library.
    
    Post-patch, the query parameters will be maintained in the search bar.
    
    Signed-off-by: Kathy Lussier <klussier at masslnc.org>
    Signed-off-by: Cesar Velez <cesar.velez at equinoxinitiative.org>
    Signed-off-by: Galen Charlton <gmc at equinoxinitiative.org>

diff --git a/Open-ILS/src/templates/opac/parts/place_hold.tt2 b/Open-ILS/src/templates/opac/parts/place_hold.tt2
index 9ca96f9..18eb427 100644
--- a/Open-ILS/src/templates/opac/parts/place_hold.tt2
+++ b/Open-ILS/src/templates/opac/parts/place_hold.tt2
@@ -32,6 +32,12 @@
         %]
         <input type="hidden" name="redirect_to" value="[% redirect | html %]" />
         <input type="hidden" name="hold_source_page" value="[% CGI.param('hold_source_page') | html %]" />
+
+        <!-- Adding hidden fields so that parameters are maintained in
+        searchbar throughout the place hold process. -->
+        <input type="hidden" name="locg" value="[% CGI.param('locg') %]" />
+        <input type="hidden" name="qtype" value="[% CGI.param('qtype') %]" />
+        <input type="hidden" name="query" value="[% CGI.param('query') %]" />
         [%
             usr_barcode = CGI.param('usr_barcode') | html;
             is_requestor = CGI.param('is_requestor');
diff --git a/Open-ILS/src/templates/opac/parts/result/table.tt2 b/Open-ILS/src/templates/opac/parts/result/table.tt2
index 21210b1..9781b70 100644
--- a/Open-ILS/src/templates/opac/parts/result/table.tt2
+++ b/Open-ILS/src/templates/opac/parts/result/table.tt2
@@ -389,7 +389,7 @@ END;
                                                         <div class="results_aux_utils place_hold"><a
                                                                 href="[% mkurl(ctx.opac_root _ '/place_hold',
                                                                     {hold_target => rec.id, hold_type => hold_type, 
-                                                                      hold_source_page => mkurl()}, ['query','tag','subfield','term','_special','sort','page']) %]"
+                                                                      hold_source_page => mkurl()}, ['tag','subfield','term','_special','sort','page']) %]"
                                                                 [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) %]
                                                                     class="no-dec" rel="nofollow" vocab=""><img
                                                                 src="[% ctx.media_prefix %]/images/green_check.png"

-----------------------------------------------------------------------

Summary of changes:
 Open-ILS/src/templates/opac/parts/place_hold.tt2   |    6 ++++++
 Open-ILS/src/templates/opac/parts/result/table.tt2 |    2 +-
 2 files changed, 7 insertions(+), 1 deletions(-)


hooks/post-receive
-- 
Evergreen ILS