TPAC: Escape single quotes in MFHD record location

If an MFHD record contains an 852 field with a subfield containing a
single quote, the unescaped single quote is introduced directly into the
value of the JavaScript hash that uses single quotes as delimiters -
thereby generating a JS exception and preventing the staff client from
properly populating the MFHD Editor menu.

This commit escapes incoming single quotes from the MFHD location field
to prevent that from happening. The other fields in the JS hash are
numeric and therefore should not need escaping.

Signed-off-by: Dan Scott <dscott@laurentian.ca>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Dan Wells <dbw2@calvin.edu>
Signed-off-by: Ben Shum <bshum@biblio.org>

diff --git a/Open-ILS/src/templates/opac/parts/js.tt2 b/Open-ILS/src/templates/opac/parts/js.tt2
index 72f0caa..fb500c7 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/js.tt2
+++ b/Open-ILS/src/templates/opac/parts/js.tt2
@@ -23,7 +23,7 @@
                 [% FOR summary IN ctx.mfhd_summaries %]
                 {
                     'id' : '[% summary.sre_id %]', 
-                    'label' : '[% summary.location %]',
+                    'label' : '[% summary.location | replace("'", "\\'") %]',
                     'entryNum' : '[% loop.index %]',
                     'owning_lib' : '[% summary.owning_lib %]'
                 },