View | Details | Raw Unified | Return to bug 38488
Collapse All | Expand All

(-)a/Koha/Template/Plugin/HtmlScrubber.pm (+77 lines)
Line 0 Link Here
1
package Koha::Template::Plugin::HtmlScrubber;
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
use base 'Template::Plugin::Filter';
20
21
use C4::Scrubber;
22
23
sub init {
24
    my $self = shift;
25
    my $name = 'scrub_html';
26
    $self->{_DYNAMIC} = 1;
27
    $self->install_filter($name);
28
    $self->{cached_filters} = {};
29
    return $self;
30
}
31
32
sub filter {
33
    my ( $self, $text, $args, $config ) = @_;
34
    my $type = $config->{type} || 'default';
35
    if ($type) {
36
        if ( !$self->{cached_filters}->{$type} ) {
37
            my $new_scrubber = C4::Scrubber->new($type);
38
            if ($new_scrubber) {
39
                $self->{cached_filters}->{$type} = $new_scrubber;
40
            }
41
        }
42
        my $scrubber = $self->{cached_filters}->{$type};
43
        if ($scrubber) {
44
            my $scrubbed = $scrubber->scrub($text);
45
            return $scrubbed;
46
        }
47
    }
48
49
    #NOTE: If you don't have a scrubber, just return what was passed in
50
    return $text;
51
}
52
53
1;
54
55
=head1 NAME
56
57
Koha::Template::Plugin::HtmlScrubber - TT plugin for scrubbing HTML to limited elements and attributes
58
59
=head1 SYNOPSIS
60
61
[% USE HtmlScrubber %]
62
63
[% content.note | scrub_html type => 'note' %]
64
65
This filter scrubs HTML using profiles predefined in C4::Scrubber
66
67
=head1 METHODS
68
69
=head2 init
70
71
This method installs the filter name and declares it as a dynamic filter
72
73
=head2 filter
74
75
Returns a scrubbed version of HTML content
76
77
=cut
(-)a/t/Koha/Plugins/HtmlScrubber.t (-1 / +59 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Test::More tests => 2;
21
use Template;
22
23
subtest 'test scrubbing using default scrubber' => sub {
24
    plan tests => 1;
25
    my $template = Template->new(
26
        {
27
            PLUGIN_BASE => 'Koha::Template::Plugin',
28
        }
29
    );
30
31
    my $tt = <<EOF;
32
[%- USE HtmlScrubber %]
33
[%- '<script>alert("boo!")</script><p>Hello!</p>' | scrub_html -%]
34
[%- '<div id="stuff">Hello!</div>' | scrub_html -%]
35
EOF
36
37
    my $output;
38
    $template->process( \$tt, {}, \$output );
39
    is( $output, 'Hello!Hello!', 'Default scrubber removes all HTML' );
40
};
41
42
subtest 'test scrubbing using "note" type' => sub {
43
    plan tests => 1;
44
    my $template = Template->new(
45
        {
46
            PLUGIN_BASE => 'Koha::Template::Plugin',
47
        }
48
    );
49
50
    my $tt = <<EOF;
51
[%- USE HtmlScrubber %]
52
[%- '<script>alert("boo!")</script><p>Hello!</p>' | scrub_html type => 'note' -%]
53
[%- '<div id="stuff">Hello!</div>' | scrub_html type => 'note' -%]
54
EOF
55
56
    my $output;
57
    $template->process( \$tt, {}, \$output );
58
    is( $output, '<p>Hello!</p><div>Hello!</div>', '<script> element and "id" attribute stripped out' );
59
};

Return to bug 38488