From 6db2f588280e5181b274cb914050f26f5f265348 Mon Sep 17 00:00:00 2001
From: Bill Erickson <berick@esilibrary.com>
Date: Wed, 17 Aug 2011 15:45:44 -0400
Subject: [PATCH] Tpac: more html output scrubbing

Signed-off-by: Bill Erickson <berick@esilibrary.com>
---
 .../default/opac/parts/result/lowhits.tt2          |  2 +-
 .../templates/default/opac/parts/result/table.tt2  | 40 +++++++++++-----------
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/Open-ILS/src/templates/default/opac/parts/result/lowhits.tt2 b/Open-ILS/src/templates/default/opac/parts/result/lowhits.tt2
index 78679fc7e1..4d29419403 100644
--- a/Open-ILS/src/templates/default/opac/parts/result/lowhits.tt2
+++ b/Open-ILS/src/templates/default/opac/parts/result/lowhits.tt2
@@ -6,7 +6,7 @@
                 <q>[% CGI.param('query') | html %]</q>
                 [% END %]
                 <br />
-                <span id="zero_hits_label1" class="hide_me">Did you mean
+                <span id="zero_hits_label1" class="hide_me">[% l('Did you mean') %]
                     <strong><a id="spell_check_link" href="javascript:;"></a></strong>?</span>
             </p>
             <table cellpadding="0" cellspacing="0" border="0">
diff --git a/Open-ILS/src/templates/default/opac/parts/result/table.tt2 b/Open-ILS/src/templates/default/opac/parts/result/table.tt2
index 07fe359f10..a22308d7cc 100644
--- a/Open-ILS/src/templates/default/opac/parts/result/table.tt2
+++ b/Open-ILS/src/templates/default/opac/parts/result/table.tt2
@@ -45,16 +45,16 @@
                                                 [% ident = attrs.isbn_clean || attrs.upc; IF ident; %]
                                                 <a href="[% mkurl(ctx.opac_root _ '/record/' _ rec.id) %]"><img alt="[% l('Image of item') %]"
                                                         name='item_jacket' class='result_table_pic' width="55"
-                                                        src='[% ctx.media_prefix %]/opac/extras/ac/jacket/small/[% ident %]' /></a><br />
+                                                        src='[% ctx.media_prefix %]/opac/extras/ac/jacket/small/[% ident | uri %]' /></a><br />
                                                 [% END %]
                                             </td>
                                             <td class='result_table_title_cell'
                                                 name='result_table_title_cell'
                                                 valign="top">
                                                 <div class="bold">
-                                                    <a title="[% attrs.title %]" name='item_title'
+                                                    <a title="[% attrs.title | uri %]" name='item_title'
                                                         href="[% mkurl(ctx.opac_root _ '/record/' _ rec.id) %]"
-                                                        class='search_link'>[% attrs.title | html_entity%]</a>
+                                                        class='search_link'>[% attrs.title | html %]</a>
                                                 </div>
                                                 <div style="font-size:11px;">
                                                     <div>
@@ -63,9 +63,9 @@
                                                                 href="[%- 
                                                                     authorquery = attrs.author | replace('[,\.:;]', '');
                                                                     mkurl(ctx.opac_root _ '/results', {qtype => 'author', query => authorquery})
-                                                                    -%]">[% attrs.author | html_entity %]</a></em>
+                                                                    -%]">[% attrs.author | html %]</a></em>
                                                         &nbsp;&nbsp;
-                                                        [% attrs.pubdate %]
+                                                        [% attrs.pubdate | html %]
                                                     </div>
                                                     <table cellpadding="0" cellspacing="0" border="0"
                                                         class="results_info_table">
@@ -74,7 +74,7 @@
                                                             <td valign='top'>
                                                                 <strong>[% l('Call number:') %]</strong>
                                                             </td>
-                                                            <td>[% args.holdings.0.label %]</td>
+                                                            <td>[% args.holdings.0.label | html %]</td>
                                                         </tr>
                                                         [% END %]
 
@@ -86,7 +86,7 @@
                                                                 <td valign="top">
                                                                     <strong>[% l('Publisher:') %]</strong>
                                                                 </td>
-                                                                <td>[% attrs.publisher; %]</td>
+                                                                <td>[% attrs.publisher | html %]</td>
                                                             </tr>
                                                         [% END %]
                                                         [% IF attrs.isbns.size > 0 %]
@@ -94,7 +94,7 @@
                                                                 <td valign="top">
                                                                     <strong>[% l('ISBN:') %]</strong>
                                                                 </td>
-                                                                <td>[% attrs.isbns.0 %]</td>
+                                                                <td>[% attrs.isbns.0 | html %]</td>
                                                             </tr>
                                                         [% END %]
                                                         [% IF openurl.enabled == 'true';
@@ -105,9 +105,9 @@
                                                         <tr name="results_issn_tr">
                                                             <td valign="top">
                                                                 <strong><a href="[% res.target_url %]">
-                                                                [% res.public_name %]</a></strong>
+                                                                [% res.public_name | html %]</a></strong>
                                                             </td>
-                                                            <td>[% res.target_coverage %]</td>
+                                                            <td>[% res.target_coverage | html %]</td>
                                                         </tr>
                                                                 [% END %]
                                                             [% END %]
@@ -118,7 +118,7 @@
                                                                 <td valign="top">
                                                                     <strong>[% l('Edition:') %]</strong>
                                                                 </td>
-                                                                <td>[% attrs.edition %]</td>
+                                                                <td>[% attrs.edition | html %]</td>
                                                             </tr>
                                                         [% END %]
                                                         [% IF attrs.phys_desc %]
@@ -127,7 +127,7 @@
                                                                     <strong>[% l('Phys. Desc.:') %]</strong>
                                                                 </td>
                                                                 <td>
-                                                                    [% args.phys_desc %]
+                                                                    [% args.phys_desc | html %]
                                                                 </td>
                                                             </tr>
                                                         [% END %]
@@ -136,7 +136,7 @@
                                                                 <td valign='top'>
                                                                     <strong>[% l('Electronic resource') %]</strong>
                                                                 </td>
-                                                                <td><a href="[% uri.href %]">[% uri.link %]</a>[% ' - ' _ uri.note IF uri.note %]</td>
+                                                                <td><a href="[% uri.href %]">[% uri.link | html %]</a>[% ' - ' _ uri.note | html IF uri.note %]</td>
                                                             </tr>
                                                             [% END %]
                                                             [% IF args.holdings.size > 0 %]
@@ -152,10 +152,10 @@
                                                                         <tbody>
                                                                 [% FOR copy IN args.holdings %]
                                                                         <tr>
-                                                                            <td>[% copy.library %]</td>
-                                                                            <td>[% copy.location %]</td>
-                                                                            <td>[% copy.label %]</td>
-                                                                            <td>[% copy.status %]</td>
+                                                                            <td>[% copy.library | html %]</td>
+                                                                            <td>[% copy.location | html %]</td>
+                                                                            <td>[% copy.label | html %]</td>
+                                                                            <td>[% copy.status | html %]</td>
                                                                         </tr>
                                                                 [% END %]
                                                                         </tbody>
@@ -188,7 +188,7 @@
                                             <td name='result_table_format_cell' class='result_table_format_cell' width="1">
 
                                                 [% IF attrs.format_icon %]
-                                                <img title="[% attrs.format_label %]" alt="[% attrs.format_label %]" src="[% attrs.format_icon %]" />
+                                                <img title="[% attrs.format_label | html %]" alt="[% attrs.format_label | html %]" src="[% attrs.format_icon %]" />
                                                 [% END %]
 
                                                 <!-- unAPI link -->
@@ -228,13 +228,13 @@
                                         <tr>
                                             <td/>
                                             <td align='center'> <!-- Chilifresh reviews link --> 
-                                                <div class="chili_review" id="isbn_[% attrs.isbn_clean %]"> </div>
+                                                <div class="chili_review" id="isbn_[% attrs.isbn_clean | html %]"> </div>
                                             </td>
                                         </tr>
                                         <tr>
                                             <td/>
                                             <td colspan='5'> <!-- Chilifresh reviews panel -->
-                                                <div id="chili_review_[% attrs.isbn_clean %]" style="display: none;" align="center" width="100%"></div>
+                                                <div id="chili_review_[% attrs.isbn_clean | html %]" style="display: none;" align="center" width="100%"></div>
                                             </td>
                                         </tr>
                                         <tr><td colspan="5"><div style="height:0px;border-top:1px solid #b7b7b7;border-bottom:1px solid #d4d4d4;margin:15px 0px;"></div></td></tr>
-- 
2.11.0