Bugzilla – Attachment 176386 Details for
Bug 31165
"Public note" field in course reserve should restrict HTML usage
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31165: Scrub "Public note" field for Course Reserves
Bug-31165-Scrub-Public-note-field-for-Course-Reser.patch (text/plain), 7.46 KB, created by
Brendan Lawlor
on 2025-01-10 18:49:23 UTC
(
hide
)
Description:
Bug 31165: Scrub "Public note" field for Course Reserves
Filename:
MIME Type:
Creator:
Brendan Lawlor
Created:
2025-01-10 18:49:23 UTC
Size:
7.46 KB
patch
obsolete
>From 676a72e659f6f420df121428ab8deb39a5f9395a Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 20 Nov 2024 01:09:00 +0000 >Subject: [PATCH] Bug 31165: Scrub "Public note" field for Course Reserves > >When displaying the "Public note" for Course Reserves, we scrub the HTML >using the "note" scrubber type. > >Test plan: >0. Apply the patch >1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >2. Click "New course" >3. Fill in required fields >4. In staff note and public note add the following: ><script>alert('boo!')</script><p>Hello!</p> >5. Click Save > >6. Click "Add reserves" >7. Add "39999000001310" to Item barcode >8. Click "Submit" >9. Fill in all required fields >10. Add the following for Staff note and Public note: ><script>alert('boo2!')</script><p>Item!</p> >11. Click "Save" > >12. Go back to your course reserve >13. Note the HTML is scrubbed on "Public note" >14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >15. Note the HTML is scrubbed on "Public note" > >16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl >17. Note the HTML is scrubbed on "Notes" >18. Click on your course reserves >19. Note the HTML is scrubbed on "Notes" > >Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> >--- > .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- > .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- > .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 5 +++-- > .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- > 4 files changed, 11 insertions(+), 7 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >index 79b74086ee..c800701582 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >@@ -6,6 +6,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -102,7 +103,7 @@ > </div> > </li> > <li><span class="label">Staff note</span> [% course.staff_note | html %]</li> >- <li><span class="label">Public note</span> [% course.public_note | $raw %]</li> >+ <li><span class="label">Public note</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li> > <li><span class="label">Student count</span> [% course.students_count | html %]</li> > <li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li> > </ol> >@@ -263,9 +264,9 @@ > [% END %] > </td> > <td>[% IF (cr.public_note) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF (cr.item.itemnotes) %] >- [% cr.item.itemnotes | $raw %] >+ [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] > [% END %] > </td> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >index b5ef855ee9..16c5bc9985 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >@@ -3,6 +3,7 @@ > [% USE Asset %] > [% USE AuthorisedValues %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -76,7 +77,7 @@ > [% END %] > </td> > <td>[% c.staff_note | html %]</td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td>[% c.students_count | html %]</td> > <td> > [% IF c.enabled == 'yes' %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >index 27836cf3c6..de5c507244 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >@@ -6,6 +6,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% PROCESS 'html_helpers.inc' %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -51,7 +52,7 @@ > </ul> > </li> > [% END %] >- [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | $raw %]</li>[% END %] >+ [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li>[% END %] > </ol> > </div> > >@@ -92,7 +93,7 @@ > </td> > <td data-order="[% cr.issue.date_due | html %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 %]</td> > <td>[% IF ( cr.public_note ) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF ( cr.item.itemnotes ) %] > [% cr.item.itemnotes | $raw %] > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >index ee3c7f95df..3de18bfc76 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >@@ -6,6 +6,7 @@ > [% PROCESS 'i18n.inc' %] > [% PROCESS 'html_helpers.inc' %] > [% INCLUDE 'doc-head-open.inc' %] >+[% USE HtmlScrubber %] > <title>[% FILTER collapse %] > [% t("Course reserves") | html %] › > [% PROCESS 'library_name_title' %] >@@ -58,7 +59,7 @@ > <div class="instructor"><span class="inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div> > [% END %] > </td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td></td> > [% END %] > </tbody> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31165
:
137774
|
174816
|
176386
|
178125
|
178443
|
179635