From 187c4fbb2cb80393f8026006d2a68b9be80550cf Mon Sep 17 00:00:00 2001 From: Andrii Nugged Date: Wed, 27 May 2026 23:58:33 +0300 Subject: [PATCH] Bug 42702: Fix malformed cancel links on parcel.pl The pending orders table builds the two cancel order links with the link text concatenated immediately after the invoice_id value. This leaves the href attribute unclosed and makes the browser absorb the link text and following escaped HTML into the href. Add the missing separator after invoice_id for both cancel link builders. Test plan: 1. Create a closed acquisition basket with a pending order. 2. Open an invoice receive page for the vendor. 3. Inspect the Cancel order link in the pending orders table. 4. Confirm the href ends after invoiceid and the link text is outside the href. Signed-off-by: Owen Leonard Signed-off-by: Jonathan Druart Signed-off-by: Lucas Gass --- koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt index f6cad34032..1dd850d099 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt @@ -623,6 +623,7 @@ encodeURIComponent(row.biblio_id) + "&referrer=/cgi-bin/koha/acqui/parcel.pl?invoiceid=" + invoice_id + + '">' + _("Cancel order") + "
"; } @@ -639,6 +640,7 @@ encodeURIComponent(row.biblio_id) + "&del_biblio=1&referrer=/cgi-bin/koha/acqui/parcel.pl?invoiceid=" + invoice_id + + '">' + _("Cancel order and catalog record") + "
"; }