From 19d1db91d241250f42af75c3c7eacea26da13228 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Date: Thu, 11 Jun 2026 17:23:58 +0100
Subject: [PATCH] Bug 42443: (QA follow-up) Fix escaping of branchcode in JS
 context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using | html to embed a TT value inside a JS string literal is
incorrect: it produces HTML entities rather than JS-safe characters.
Store the branchcode in a data attribute (where | html is correct)
and read it from there in JavaScript.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 .../prog/en/modules/circ/transferstoreceive.tt     | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt
index 53cd066749..fa84028a0a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt
@@ -39,7 +39,7 @@
     [% IF ( TransfersMaxDaysWarning ) %]<p>Transfers are <span class="error">considered late</span> after [% TransfersMaxDaysWarning | html %] days.</p>[% END %]
     <div id="resultlist">
         <div class="page-section">
-            <table id="transferstoreceive"></table>
+            <table id="transferstoreceive" data-branchcode="[% branchcode | html %]"></table>
         </div>
         <!-- /.page-section -->
     </div>
@@ -68,7 +68,7 @@
     <script nonce="[% Koha.CSPNonce | $raw %]">
         $(document).ready(function () {
             var additional_filters = {
-                to_library_id: "[% branchcode | html %]",
+                to_library_id: $("#transferstoreceive").data("branchcode"),
                 sent_date: { "!=": null },
                 arrived_date: { "=": null },
                 cancellation_date: { "=": null },
@@ -82,15 +82,7 @@
                     language: {
                         emptyTable: _("No transfers to receive"),
                     },
-                    embed: [
-                        "item+strings",
-                        "item.biblio",
-                        "item.home_library",
-                        "item.item_type",
-                        "item.first_hold.patron",
-                        "item.recall.patron",
-                        "from_library",
-                    ],
+                    embed: ["item+strings", "item.biblio", "item.home_library", "item.item_type", "item.first_hold.patron", "item.recall.patron", "from_library"],
                     order: [[1, "asc"]],
                     columns: [
                         {