Bugzilla – Attachment 178443 Details for
Bug 31165
"Public note" field in course reserve should restrict HTML usage
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31165: Scrub "Public note" field for Course Reserves
Bug-31165-Scrub-Public-note-field-for-Course-Reser.patch (text/plain), 7.08 KB, created by
Marcel de Rooy
on 2025-02-21 07:25:19 UTC
(
hide
)
Description:
Bug 31165: Scrub "Public note" field for Course Reserves
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2025-02-21 07:25:19 UTC
Size:
7.08 KB
patch
obsolete
>From 9b78abde47072abb324c54e33db210f39a530d84 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 20 Nov 2024 01:09:00 +0000 >Subject: [PATCH] Bug 31165: Scrub "Public note" field for Course Reserves >Content-Type: text/plain; charset=utf-8 > >When displaying the "Public note" for Course Reserves, we scrub the HTML >using the "note" scrubber type. > >Test plan: >0. Apply the patch >1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >2. Click "New course" >3. Fill in required fields >4. In staff note and public note add the following: ><script>alert('boo!')</script><p>Hello!</p> >5. Click Save > >6. Click "Add reserves" >7. Add "39999000001310" to Item barcode >8. Click "Submit" >9. Fill in all required fields >10. Add the following for Staff note and Public note: ><script>alert('boo2!')</script><p>Item!</p> >11. Click "Save" > >12. Go back to your course reserve >13. Note the HTML is scrubbed on "Public note" >14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >15. Note the HTML is scrubbed on "Public note" > >16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl >17. Note the HTML is scrubbed on "Notes" >18. Click on your course reserves >19. Note the HTML is scrubbed on "Notes" > >Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- > .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- > .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 5 +++-- > .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- > 4 files changed, 11 insertions(+), 7 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >index e2d3fb9655..b0508d8ece 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >@@ -6,6 +6,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -99,7 +100,7 @@ > </div> > </li> > <li><span class="label">Staff note</span> [% course.staff_note | html %]</li> >- <li><span class="label">Public note</span> [% course.public_note | $raw %]</li> >+ <li><span class="label">Public note</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li> > <li><span class="label">Student count</span> [% course.students_count | html %]</li> > <li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li> > </ol> >@@ -265,9 +266,9 @@ > </td> > <td > >[% IF (cr.public_note) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF (cr.item.itemnotes) %] >- [% cr.item.itemnotes | $raw %] >+ [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] > [% END %] > </td> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >index 1725a18520..2d1dd5014f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >@@ -3,6 +3,7 @@ > [% USE Asset %] > [% USE AuthorisedValues %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -74,7 +75,7 @@ > [% END %] > </td> > <td>[% c.staff_note | html %]</td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td>[% c.students_count | html %]</td> > <td> > [% IF c.enabled == 'yes' %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >index 053d647a48..ac1d73646c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >@@ -6,6 +6,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% PROCESS 'html_helpers.inc' %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -54,7 +55,7 @@ > </ul> > </li> > [% END %] >- [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | $raw %]</li>[% END %] >+ [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li>[% END %] > </ol> > </div> > >@@ -99,7 +100,7 @@ > <td data-order="[% cr.issue.date_due | html %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 %]</td> > <td > >[% IF ( cr.public_note ) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF ( cr.item.itemnotes ) %] > [% cr.item.itemnotes | $raw %] > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >index 0059a7b0a4..d9144c02fa 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >@@ -6,6 +6,7 @@ > [% PROCESS 'i18n.inc' %] > [% PROCESS 'html_helpers.inc' %] > [% INCLUDE 'doc-head-open.inc' %] >+[% USE HtmlScrubber %] > <title > >[% FILTER collapse %] > [% t("Course reserves") | html %] >@@ -63,7 +64,7 @@ > > > [% END %] > </td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td></td> > </tr> > [% END %] >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31165
:
137774
|
174816
|
176386
|
178125
| 178443 |
179635