From c3da280dafbe3c4719946721c31ff2aa3bc07e60 Mon Sep 17 00:00:00 2001
From: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Date: Fri, 20 Dec 2024 09:29:34 -0500
Subject: [PATCH] Bug 38155: (QA follow-up) Fix TT filters and scalar context

data-referer is the url for the current search page, to redirect
back after performing the operation. Since it is a url, variables within
this link all need to use the uri filter, not html or KohaDates.

Also specify scalar context when splitting the input parameter to
prevent param in list context warnings.

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0f01f2b31dd5e3ac99db4eb9a81828e1a9100db8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 acqui/invoice.pl                                          | 4 ++--
 koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/acqui/invoice.pl b/acqui/invoice.pl
index cac30ff265..3b5a647b8b 100755
--- a/acqui/invoice.pl
+++ b/acqui/invoice.pl
@@ -74,7 +74,7 @@ if ( C4::Context->preference('AcqEnableFiles') ) {
 if ( $op && $op eq 'cud-close' ) {
     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
         unless $logged_in_patron->has_permission( { acquisition => 'edit_invoices' } );
-    my @invoiceid = split( ',', $input->param('invoiceid') );
+    my @invoiceid = split( ',', scalar $input->param('invoiceid') );
     foreach my $invoiceid ( @invoiceid ) {
         CloseInvoice($invoiceid);
     }
@@ -87,7 +87,7 @@ if ( $op && $op eq 'cud-close' ) {
 elsif ( $op && $op eq 'cud-reopen' ) {
     output_and_exit( $input, $cookie, $template, 'insufficient_permission' )
         unless $logged_in_patron->has_permission( { acquisition => 'reopen_closed_invoices' } );
-    my @invoiceid = split( ',', $input->param('invoiceid') );
+    my @invoiceid = split( ',', scalar $input->param('invoiceid') );
     foreach my $invoiceid ( @invoiceid ) {
         ReopenInvoice($invoiceid);
     }
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
index 314bbff1b9..8672f4c948 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt
@@ -125,10 +125,10 @@
                             [% IF CAN_user_acquisition_merge_invoices %]
                                 [% IF tab == 'closed' %]
                                     <a class="btn btn-default merge" id="merge_closed" href="#merge_invoices" data-table="closedresultst"><i class="fa fa-compress"></i> Merge selected invoices</a>
-                                    <a class="submit-form-link btn btn-default" id="open_sel" data-table="closedresultst" data-op="cud-reopen" data-action="invoice.pl" data-method="post" data-referer="/cgi-bin/koha/acqui/invoices.pl?op=do_search&invoicenumber=[% invoicenumber | html %]&supplier=[% booksellerid | html %]&shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]&shipmentdateto=[% shipmentdateto | $KohaDates %]&billingdatefrom=[% billingdatefrom | $KohaDates %]&billingdateto=[% billingdateto | $KohaDates %]&isbneanissn=[% isbneanissn | html %]&title=[% title | html %]&author=[% author | html %]&publisher=[% publisher | html %]&publicationyear=[% publicationyear | html %]&branch=[% branch | html %]"><i class="fa-solid fa-rotate"></i> Reopen selected invoices</a>
+                                    <a class="submit-form-link btn btn-default" id="open_sel" data-table="closedresultst" data-op="cud-reopen" data-action="invoice.pl" data-method="post" data-referer="/cgi-bin/koha/acqui/invoices.pl?op=do_search&invoicenumber=[% invoicenumber | uri %]&supplier=[% booksellerid | uri %]&shipmentdatefrom=[% shipmentdatefrom | uri %]&shipmentdateto=[% shipmentdateto | uri %]&billingdatefrom=[% billingdatefrom | uri %]&billingdateto=[% billingdateto | uri %]&isbneanissn=[% isbneanissn | uri %]&title=[% title | uri %]&author=[% author | uri %]&publisher=[% publisher | uri %]&publicationyear=[% publicationyear | uri %]&branch=[% branch | uri %]"><i class="fa-solid fa-rotate"></i> Reopen selected invoices</a>
                                 [% ELSE  %]
                                     <a class="btn btn-default merge" id="merge_open" href="#merge_invoices" data-table="openedresultst"><i class="fa fa-compress"></i> Merge selected invoices</a>
-                                    <a class="submit-form-link btn btn-default" id="close_sel" data-table="openedresultst" data-op="cud-close" data-action="invoice.pl" data-method="post" data-referer="/cgi-bin/koha/acqui/invoices.pl?op=do_search&invoicenumber=[% invoicenumber | html %]&supplier=[% booksellerid | html %]&shipmentdatefrom=[% shipmentdatefrom | $KohaDates %]&shipmentdateto=[% shipmentdateto | $KohaDates %]&billingdatefrom=[% billingdatefrom | $KohaDates %]&billingdateto=[% billingdateto | $KohaDates %]&isbneanissn=[% isbneanissn | html %]&title=[% title | html %]&author=[% author | html %]&publisher=[% publisher | html %]&publicationyear=[% publicationyear | html %]&branch=[% branch | html %]"><i class="fa fa-times-circle"></i> Close selected invoices</a>
+                                    <a class="submit-form-link btn btn-default" id="close_sel" data-table="openedresultst" data-op="cud-close" data-action="invoice.pl" data-method="post" data-referer="/cgi-bin/koha/acqui/invoices.pl?op=do_search&invoicenumber=[% invoicenumber | uri %]&supplier=[% booksellerid | uri %]&shipmentdatefrom=[% shipmentdatefrom | uri %]&shipmentdateto=[% shipmentdateto | uri %]&billingdatefrom=[% billingdatefrom | uri %]&billingdateto=[% billingdateto | uri %]&isbneanissn=[% isbneanissn | uri %]&title=[% title | uri %]&author=[% author | uri %]&publisher=[% publisher | uri %]&publicationyear=[% publicationyear | uri %]&branch=[% branch | uri %]"><i class="fa fa-times-circle"></i> Close selected invoices</a>
                                 [% END # /IF tab == 'closed' %]
                             [% END # /IF CAN_user_acquisition_merge_invoices %]
                         [% END # /BLOCK invoices_table %]