Description
Theodoros Theodoropoulos
2019-11-06 13:48:58 UTC
Created attachment 95107 [details] [review] Allow HTML in saved reports note field Created attachment 95108 [details] [review] Allow HTML in saved reports note field patch based on Koha 18.11.06 code Hi Theodoros, all patches must be based on the current master branch and if it's a bug will then be backported to the older supported versions. Also, you need to create a patch, not just a diff - the file is missing some necessary information and can't be applied with our tools. Do you want to have another go at this? Please let us know if we can help! +1 We are currently using a custom patch to achieve this. Created attachment 161711 [details] [review] Bug 23978: Expose HTML in Reports This patch updates the notes field to a $raw filter to prevent html escaping of the data within it. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Is there a more secure way of doing this rather than just exposing the raw html.. I feel like we're just undoing a security flaw we fixed for a reason. Is it time to use markdown for rich text or perhaps for linebreaks just outputting the note field in a pre/code block? (In reply to Martin Renvoize from comment #6) > Is there a more secure way of doing this rather than just exposing the raw > html.. I feel like we're just undoing a security flaw we fixed for a reason. Yeah I don't think we can just expose the raw HTML. One option would be to use the HTML scrubber. I think there are quite a few parts of Koha where people want to use HTML, but could be limited to a fairly small subset of elements and attributes. > Is it time to use markdown for rich text or perhaps for linebreaks just > outputting the note field in a pre/code block? For line breaks, the "html_line_break" filter can be useful. For notes, adding that line break filter would make sense. I don't know that any other HTML features would really needed though. If they were to be added, I think we'd have to scrub them first. (In reply to Martin Renvoize from comment #5) > This patch updates the notes field to a $raw filter to prevent html > escaping of the data within it. (In reply to David Cook from comment #7) > Yeah I don't think we can just expose the raw HTML. Sounds like a security problem and a FQA to me. Please set back to NSO if you disagree. :-) |