From 457fe812b94aee3ef819113635d6a9f7720d46e0 Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 20 Nov 2024 01:09:00 +0000 Subject: [PATCH] Bug 31165: Scrub "Public note" field for Course Reserves When displaying the "Public note" for Course Reserves, we scrub the HTML using the "note" scrubber type. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 2. Click "New course" 3. Fill in required fields 4. In staff note and public note add the following:

Hello!

5. Click Save 6. Click "Add reserves" 7. Add "39999000001310" to Item barcode 8. Click "Submit" 9. Fill in all required fields 10. Add the following for Staff note and Public note:

Item!

11. Click "Save" 12. Go back to your course reserve 13. Note the HTML is scrubbed on "Public note" 14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 15. Note the HTML is scrubbed on "Public note" 16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl 17. Note the HTML is scrubbed on "Notes" 18. Click on your course reserves 19. Note the HTML is scrubbed on "Notes" --- .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 5 +++-- .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt index 929db917c3..f516f5d6d0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt @@ -5,6 +5,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -101,7 +102,7 @@
  • Staff note [% course.staff_note | html %]
  • -
  • Public note [% course.public_note | $raw %]
  • +
  • Public note [% course.public_note | scrub_html type => 'note' | $raw %]
  • Student count [% course.students_count | html %]
  • Status [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]
  • @@ -262,9 +263,9 @@ [% END %] [% IF (cr.public_note) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF (cr.item.itemnotes) %] - [% cr.item.itemnotes | $raw %] + [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt index a789cb06e0..f5d589e0ef 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt @@ -2,6 +2,7 @@ [% USE Asset %] [% USE AuthorisedValues %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -75,7 +76,7 @@ [% END %] [% c.staff_note | html %] - [% c.public_note | $raw %] + [% c.public_note | scrub_html type => 'note' | $raw %] [% c.students_count | html %] [% IF c.enabled == 'yes' %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt index 2ffc06914c..4854ec9652 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt @@ -6,6 +6,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% PROCESS 'html_helpers.inc' %] [% INCLUDE 'doc-head-open.inc' %] @@ -51,7 +52,7 @@ [% END %] - [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | $raw %]
  • [% END %] + [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | scrub_html type => 'note' | $raw %]
  • [% END %] @@ -92,7 +93,7 @@ [% cr.issue.date_due | $KohaDates as_due_date => 1 %] [% IF ( cr.public_note ) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF ( cr.item.itemnotes ) %] [% cr.item.itemnotes | $raw %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt index 0f51bfbe8c..0570764a4d 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt @@ -6,6 +6,7 @@ [% PROCESS 'i18n.inc' %] [% PROCESS 'html_helpers.inc' %] [% INCLUDE 'doc-head-open.inc' %] +[% USE HtmlScrubber %] [% FILTER collapse %] [% t("Course reserves") | html %] › [% PROCESS 'library_name_title' %] @@ -58,7 +59,7 @@ <div class="instructor"><span class="inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div> [% END %] </td> - <td>[% c.public_note | $raw %]</td> + <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> <td></td> [% END %] </tbody> -- 2.39.5