From 1065ec6aabb4f6a8d07f0ec960367456d1452ca6 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Mon, 18 Nov 2024 04:14:37 +0000
Subject: [PATCH] Bug 38468: Add double quotes to some template strings

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
   On the left of the page. Just bellow the breadcrumb and
   left of the record title.
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 6456c0b98d5f1767c8e4d9b389a5ca11264effdc)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc | 4 ++--
 koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
index fc88b79abf..c38f8ee8ef 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc
@@ -2,7 +2,7 @@
 <!-- catalog-strings.inc -->
 <script>
     /* Some required variables from the template */
-    var biblionumber = [% biblionumber | html %];
+    var biblionumber = "[% biblionumber | html %]";
     var count = [% count || 0 | html %];
     var holdcount = [% holdcount || 0 | html %];
     [% SET orders = biblio.orders %]
@@ -11,7 +11,7 @@
     var countorders = [% current.count || 0 | html %];
     var countdeletedorders = [% cancelled.count || 0 | html %];
     var subscriptionscount = [% biblio.subscriptions.count || 0 | html %];
-    var searchid = '[% searchid | html %]';
+    var searchid = "[% searchid | html %]";
 
     /* provide Z3950 search points */
     function GetZ3950Terms(){
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
index c56cc3b918..f0aabd56fd 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt
@@ -1826,7 +1826,7 @@
     [% Asset.js("js/place_booking_modal.js") | $raw %]
     <script>
         var browser;
-        browser = KOHA.browser('[% searchid | html %]', parseInt(biblionumber, 10));
+        browser = KOHA.browser("[% searchid | html %]", parseInt(biblionumber, 10));
         browser.show();
 
         [% IF bundlesEnabled %]