Bug 20675

Summary: Bad html in message_queue.content corrupts members/notices.pl
Product: Koha Reporter: Barton Chittenden <barton>
Component: NoticesAssignee: Bugs List <koha-bugs>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: katrin.fischer
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Barton Chittenden 2018-04-27 20:22:17 UTC
Bad html in letter.content will be written to message_queue.content, which can corrupt the display of members/notices.pl

To re-create:

1) Edit a notice which will show up in the message queue.
2) Make sure 'HTML message' is checked.
3) Add <a href="http://example.com>example.com</a>
   (notice the missing quotes at the end of 
    http://example.com>example.com in the 
    href attribute)
4) Trigger the notice for a given patron
5) Go to the patron's notices tab
6) Trying to expand any of the notices is now broken due to html corruption.

This affects users directly, furthermore, simply fixing the letter template isn't enough because the corrupted html stays in message_queue.content. It can only be fixed by updating message_queue.content directly via the database.

We should validate html on any page where the 'HTML message' box is checked in tools/letter.pl.
Comment 1 Katrin Fischer 2018-04-29 22:18:00 UTC
This was just fixed recently (bug 12123)

*** This bug has been marked as a duplicate of bug 12123 ***