Bugzilla – Attachment 179635 Details for
Bug 31165
"Public note" field in course reserve should restrict HTML usage
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[24.05.x] Bug 31165: Scrub "Public note" field for Course Reserves
2405x-Bug-31165-Scrub-Public-note-field-for-Course.patch (text/plain), 7.93 KB, created by
David Cook
on 2025-03-24 05:03:01 UTC
(
hide
)
Description:
[24.05.x] Bug 31165: Scrub "Public note" field for Course Reserves
Filename:
MIME Type:
Creator:
David Cook
Created:
2025-03-24 05:03:01 UTC
Size:
7.93 KB
patch
obsolete
>From cd61e56053a6deb5dc9fdaf08e14e3b5d0d0a3a8 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Mon, 24 Mar 2025 05:02:20 +0000 >Subject: [PATCH] [24.05.x] Bug 31165: Scrub "Public note" field for Course > Reserves > >When displaying the "Public note" for Course Reserves, we scrub the HTML >using the "note" scrubber type. > >Test plan: >0. Apply the patch >1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >2. Click "New course" >3. Fill in required fields >4. In staff note and public note add the following: ><script>alert('boo!')</script><p>Hello!</p> >5. Click Save > >6. Click "Add reserves" >7. Add "39999000001310" to Item barcode >8. Click "Submit" >9. Fill in all required fields >10. Add the following for Staff note and Public note: ><script>alert('boo2!')</script><p>Item!</p> >11. Click "Save" > >12. Go back to your course reserve >13. Note the HTML is scrubbed on "Public note" >14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl >15. Note the HTML is scrubbed on "Public note" > >16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl >17. Note the HTML is scrubbed on "Notes" >18. Click on your course reserves >19. Note the HTML is scrubbed on "Notes" > >Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- > .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- > .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 7 ++++--- > .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- > 4 files changed, 12 insertions(+), 8 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >index 61099da882..815d9a258a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >@@ -5,6 +5,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -102,7 +103,7 @@ > </div> > </li> > <li><span class="label">Staff note</span> [% course.staff_note | html %]</li> >- <li><span class="label">Public note</span> [% course.public_note | $raw %]</li> >+ <li><span class="label">Public note</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li> > <li><span class="label">Student count</span> [% course.students_count | html %]</li> > <li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li> > </ol> >@@ -263,9 +264,9 @@ > [% END %] > </td> > <td>[% IF (cr.public_note) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF (cr.item.itemnotes) %] >- [% cr.item.itemnotes | $raw %] >+ [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] > [% END %] > </td> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >index 8c06c578c8..ab26e62911 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >@@ -2,6 +2,7 @@ > [% USE Asset %] > [% USE AuthorisedValues %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% SET footerjs = 1 %] > [% INCLUDE 'doc-head-open.inc' %] >@@ -75,7 +76,7 @@ > [% END %] > </td> > <td>[% c.staff_note | html %]</td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td>[% c.students_count | html %]</td> > <td> > [% IF c.enabled == 'yes' %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >index 5ce9a87fa4..c34a5cc8de 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >@@ -6,6 +6,7 @@ > [% USE ItemTypes %] > [% USE Branches %] > [% USE TablesSettings %] >+[% USE HtmlScrubber %] > [% PROCESS 'i18n.inc' %] > [% INCLUDE 'doc-head-open.inc' %] > <title>Course reserves for [% course.course_name | html %] › [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title> >@@ -49,7 +50,7 @@ > </ul> > </li> > [% END %] >- [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | $raw %]</li>[% END %] >+ [% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li>[% END %] > </ol> > </div> > >@@ -90,9 +91,9 @@ > </td> > <td data-order="[% cr.issue.date_due | html %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 %]</td> > <td>[% IF ( cr.public_note ) %] >- [% cr.public_note | $raw %] >+ [% cr.public_note | scrub_html type => 'note' | $raw %] > [% ELSIF ( cr.item.itemnotes ) %] >- [% cr.item.itemnotes | $raw %] >+ [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] > [% END %] > </td> > <td>[% IF (cr.item.uri) %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >index b6e67303f3..f6d4085b14 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >@@ -6,6 +6,7 @@ > [% PROCESS 'i18n.inc' %] > > [% INCLUDE 'doc-head-open.inc' %] >+[% USE HtmlScrubber %] > <title>Courses › [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title> > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >@@ -57,7 +58,7 @@ > <div class="instructor"><span class="inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div> > [% END %] > </td> >- <td>[% c.public_note | $raw %]</td> >+ <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> > <td></td> > [% END %] > </tbody> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31165
:
137774
|
174816
|
176386
|
178125
|
178443
| 179635