View | Details | Raw Unified | Return to bug 39860
Collapse All | Expand All

(-)a/C4/Scrubber.pm (-4 / +77 lines)
Lines 27-39 use HTML::Scrubber; Link Here
27
use C4::Context;
27
use C4::Context;
28
28
29
my %scrubbertypes = (
29
my %scrubbertypes = (
30
    default => {},    # place holder, default settings are below as fallbacks in call to constructor
30
    default        => {},    # place holder, default settings are below as fallbacks in call to constructor
31
    comment => { allow => [qw( br b i em big small strong )], },
31
    comment        => { allow => [qw( br b i em big small strong )], },
32
    note    => { allow => [qw[ br b i em big small strong u hr span div p ol ul li dl dt dd ]] },
32
    note           => { allow => [qw[ br b i em big small strong u hr span div p ol ul li dl dt dd ]] },
33
    record_display => {
34
        allow => [
35
            qw(
36
                div span h1 h2 h3 h4 h5 h6 p br
37
                ul ol li dl dt dd
38
                a img
39
                strong b em i u s strike del ins sup sub
40
                blockquote cite q abbr acronym dfn
41
                table thead tbody tfoot tr td th caption
42
                pre code kbd samp var
43
                hr
44
                address
45
            )
46
        ],
47
        rules => [
48
            div => {
49
                class    => qr/^[\w\s\-_]+$/,
50
                id       => qr/^[\w\-_]+$/,
51
                vocab    => qr/^https?:\/\/[\w\.\-\/]+$/,
52
                typeof   => qr/^[\w\s]+$/,
53
                resource => qr/^[#\w\-_]+$/,
54
            },
55
56
            span => {
57
                class    => qr/^[\w\s\-_]+$/,
58
                id       => qr/^[\w\-_]+$/,
59
                property => qr/^[\w\s]+$/,
60
                typeof   => qr/^[\w\s]+$/,
61
                resource => qr/^[#\w\-_]+$/,
62
            },
63
64
            'h1|h2|h3|h4|h5|h6' => {
65
                class    => qr/^[\w\s\-_]+$/,
66
                property => qr/^[\w\s]+$/,
67
            },
68
69
            p => {
70
                class    => qr/^[\w\s\-_]+$/,
71
                property => qr/^[\w\s]+$/,
72
            },
73
74
            a => {
75
                href   => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i,
76
                class  => qr/^[\w\s\-_]+$/,
77
                title  => 1,
78
                target => qr/^_(?:blank|self|parent|top)$/,
79
                rel    =>
80
                    qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/,
81
                property => qr/^[\w\s]+$/,
82
                typeof   => qr/^[\w\s]+$/,
83
                resource => qr/^[#\w\-_]+$/,
84
            },
85
86
            'ul|ol' => {
87
                class => qr/^[\w\s\-_]+$/,
88
                type  => qr/^(?:disc|circle|square|decimal|lower-roman|upper-roman|lower-alpha|upper-alpha|1|a|A|i|I)$/,
89
            },
90
91
            li => {
92
                class => qr/^[\w\s\-_]+$/,
93
                value => qr/^\d+$/,
94
            },
95
96
            'strong|b|em|i|u|s|strike|del|ins|sup|sub' => {
97
                class => qr/^[\w\s\-_]+$/,
98
            },
99
100
            i => {
101
                class        => qr/^[\w\s\-_]+$/,
102
                'aria-label' => 1,
103
            },
104
        ],
105
    },
33
);
106
);
34
107
35
sub new {
108
sub new {
36
    shift;            # ignore our class we are wrapper
109
    shift;    # ignore our class we are wrapper
37
    my $type = (@_) ? shift : 'default';
110
    my $type = (@_) ? shift : 'default';
38
    $type = 'default' if !defined $type;
111
    $type = 'default' if !defined $type;
39
    if ( !exists $scrubbertypes{$type} ) {
112
    if ( !exists $scrubbertypes{$type} ) {
(-)a/C4/XSLT.pm (-2 / +1 lines)
Lines 277-283 sub XSLTParse4Display { Link Here
277
    }
277
    }
278
278
279
    if ($extracontent) {
279
    if ($extracontent) {
280
        my $scrubber               = C4::Scrubber->new('staff');
280
        my $scrubber               = C4::Scrubber->new('record_display');
281
        my $extracontentproccessed = process_tt( $extracontent, { record => $record } );
281
        my $extracontentproccessed = process_tt( $extracontent, { record => $record } );
282
        $extracontent = $scrubber->scrub($extracontentproccessed);
282
        $extracontent = $scrubber->scrub($extracontentproccessed);
283
    }
283
    }
284
- 

Return to bug 39860