bug 3652 fixing XSS vulnerabilities in opac-search

[koha.git] / koha-tmpl / opac-tmpl / prog / en / modules / opac-results-grouped.tt

diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
index 9e1b855..222d841 100644 (file)
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-results-grouped.tt
@@ -1,7 +1,7 @@
 [% INCLUDE 'doc-head-open.inc' %]
-[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha Online[% END %] Catalog ›
+[% IF ( LibraryNameTitle ) %][% LibraryNameTitle %][% ELSE %]Koha online[% END %] catalog ›
 [% IF ( searchdesc ) %]
-       Results of Search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %]
+    Results of search [% IF ( query_desc ) %]for '[% query_desc | html %]'[% END %][% IF ( limit_desc ) %] with limit(s): '[% limit_desc | html %]'[% END %]
 [% ELSE %]
     You did not specify any search criteria.
 [% END %]
@@ -15,13 +15,19 @@ href="/cgi-bin/koha/opac-rss.pl?[% query_cgi %][% limit_cgi |html %]" />
 var q_array = new Array();  // will hold the search terms, if possible
 
 $(document).ready(function(){
+    [% IF ( OpacHighlightedWords ) %]
+        $('a.title').each(function() {
+            $(this).attr('href', $(this).attr('href') + '&query_desc=[% query_desc | url %]');
+        });
+    [% END %]
+
        $('#sortsubmit').hide();
     $('#sort_by').change(function() {
         $('#bookbag_form').submit();
     });
-       $("span.clearall").html("<a id=\"CheckNone\" href=\"#\">Clear All</a>");
-       $("span.checkall").html("<a id=\"CheckAll\" href=\"#\">Select All</a>");
-       $("span.addto").html("<label for=\"addto\">Add to: </label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF ( opacbookbag ) %]<option value=\"addtocart\">Cart</option>[% END %][% IF ( virtualshelves ) %][% IF ( loggedinusername ) %]<optgroup label=\"Lists:\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber %]\" value=\"addtolist\">[% barshelvesloo.shelfname %]</option>[% END %][% END %][% END %]<option value=\"newlist\">[ New List ]</option></optgroup>[% ELSE %]<option value=\"newlist\">List</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"Save\" />");
+    $("span.clearall").html("<a id=\"CheckNone\" href=\"#\">Clear all</a>");
+    $("span.checkall").html("<a id=\"CheckAll\" href=\"#\">Select all</a>");
+    $("span.addto").html("<label for=\"addto\">Add to: </label><select name=\"addto\" id=\"addto\"><option value=\"\"></option>[% IF ( opacbookbag ) %]<option value=\"addtocart\">Cart</option>[% END %][% IF ( virtualshelves ) %][% IF ( loggedinusername ) %]<optgroup label=\"Lists:\">[% IF ( barshelves ) %][% FOREACH barshelvesloo IN barshelvesloop %][% IF ( category == 1 ) %]<option id=\"s[% barshelvesloo.shelfnumber %]\" value=\"addtolist\">[% barshelvesloo.shelfname %]</option>[% END %][% END %][% END %]<option value=\"newlist\">[ New list ]</option></optgroup>[% ELSE %]<option value=\"newlist\">List</option>[% END %][% END %]</select> <input type=\"submit\" class=\"submit\" value=\"Save\" />");
        $("#addto").change(function(){
                cartList();
        });
@@ -56,8 +62,13 @@ $(document).ready(function(){
         return false;
     });
     [% IF ( query_desc ) %]
-    var query_desc = "[% query_desc |replace("'", "\'") |replace('"', '\"') |replace('\n', '\\n') |replace('\r', '\\r') %]";
+    var query_desc = "[% query_desc |replace("'", "\'") |replace('\n', '\\n') |replace('\r', '\\r') |html %]";
     q_array = query_desc.split(" ");
+    // ensure that we don't have "" at the end of the array, which can
+    // break the highlighter
+    while (q_array.length > 0 && q_array[q_array.length-1] == "") {
+        q_array = q_array.splice(0,-1);
+    }
     highlightOn();
     $("#highlight_toggle_on" ).hide().click(function() {highlightOn() ;});
     $("#highlight_toggle_off").show().click(function() {highlightOff();});
@@ -108,25 +119,25 @@ function highlightOn() {
 <!-- Search Results Table -->
 [% IF ( total ) %]
 [% IF ( scan ) %]
-    <h1>Scan Index:</h1>
+    <h1>Scan index:</h1>
     <form action="/cgi-bin/koha/opac-search.pl" method="get">
         <table>
             <tr>
                 <td>
-                    Scan Index for: <input type="text" name="q" id="scan-index" size="35" value="" />
+                    Scan index for: <input type="text" name="q" id="scan-index" size="35" value="" />
                 </td>
             </tr>
             <tr>
                 <td>
                     <label for="scan-index">Indexed in:</label>
                     <select name="idx" id="scan-index">
-                        <option value="">Any Word</option>
-                        <option value="kw,phr:">Any Phrase</option>
+                        <option value="">Any word</option>
+                        <option value="kw,phr:">Any phrase</option>
                         <option value="ti:">Title</option>
-                        <option value="ti,phr:">Title Phrase</option>
+                        <option value="ti,phr:">Title phrase</option>
                         <option value="au,phr:">Author</option>
                         <option value="su:">Subject</option>
-                        <option value="su,phr:">Subject Phrase</option>
+                        <option value="su,phr:">Subject phrase</option>
                         <option value="se:">Series</option>
                         <option value="pb:">Publisher</option>
                         <option value="nt:">Notes</option>
@@ -198,7 +209,7 @@ function highlightOn() {
             [% ELSE %]
                 <tr>
             [% END %]
-                    <td>[% IF ( OPACAmazonEnabled ) %]
+                    <td>[% IF ( OPACAmazonCoverImages ) %]
                         <a class="p1" href="/cgi-bin/koha/opac-detail.pl?biblionumber=[% GROUP_RESULT.biblionumber |url %]">[% IF ( GROUP_RESULT.isbn ) %]<img src="http://images.amazon.com/images/P/[% GROUP_RESULT.isbn %].01.TZZZZZZZ.jpg" alt="" class="thumbnail" />[% ELSE %]<img src="http://g-images.amazon.com/images/G/01/x-site/icons/no-img-sm.gif" alt="" class="thumbnail" />[% END %]
                         </a>
                         [% ELSE %]
@@ -261,10 +272,10 @@ function highlightOn() {
                                        [% UNLESS ( GROUP_RESULT.norequests ) %]
                                                [% IF ( opacuserlogin ) %]
                                                        [% IF ( AllowOnShelfHolds ) %]
-                                                               <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber %]">Place Hold</a><!-- add back when available 0 holds in queue-->
+                                <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber %]">Place hold</a><!-- add back when available 0 holds in queue-->
                                                        [% ELSE %]
                                                                [% IF ( GROUP_RESULT.itemsissued ) %]
-                                                                       <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber %]">Place Hold</a><!-- add back when available 0 holds in queue-->
+                                    <a class="hold" href="/cgi-bin/koha/opac-reserve.pl?biblionumber=[% GROUP_RESULT.biblionumber %]">Place hold</a><!-- add back when available 0 holds in queue-->
                                                                [% END %]
                                                        [% END %]
                                                [% END %]