From f74a13ac587cd4e6fdf9ca321882e448dfa765cc Mon Sep 17 00:00:00 2001
From: Thomas Berezansky <tsbere@mvlc.org>
Date: Mon, 11 Mar 2013 15:09:51 -0400
Subject: [PATCH] Escape barcode completion button labels

Some characters piss off the XML parser.

Signed-off-by: Thomas Berezansky <tsbere@mvlc.org>
Signed-off-by: Ben Shum <bshum@biblio.org>
---
 Open-ILS/xul/staff_client/chrome/content/main/menu.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Open-ILS/xul/staff_client/chrome/content/main/menu.js b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
index 55a36826ce..de871cdc7a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/menu.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
@@ -2586,7 +2586,7 @@ commands:
                 if(context != valid_r[i].type && offlineStrings.testString('barcode_choice.' + valid_r[i].type + '_label'))
                     button_label = offlineStrings.getFormattedString('barcode_choice.' + valid_r[i].type + '_label', [button_label]);
 
-                xml += '<button label="' + button_label + '" name="fancy_submit" value="' + i + '"/>';
+                xml += '<button label="' + button_label.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;') + '" name="fancy_submit" value="' + i + '"/>';
             }
         }
         xml += '<button label="' + offlineStrings.getString('barcode_choice.none') + '" name="fancy_cancel"/>';
-- 
2.11.0