From 676a72e659f6f420df121428ab8deb39a5f9395a Mon Sep 17 00:00:00 2001 From: David Cook Date: Wed, 20 Nov 2024 01:09:00 +0000 Subject: [PATCH] Bug 31165: Scrub "Public note" field for Course Reserves When displaying the "Public note" for Course Reserves, we scrub the HTML using the "note" scrubber type. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 2. Click "New course" 3. Fill in required fields 4. In staff note and public note add the following:

Hello!

5. Click Save 6. Click "Add reserves" 7. Add "39999000001310" to Item barcode 8. Click "Submit" 9. Fill in all required fields 10. Add the following for Staff note and Public note:

Item!

11. Click "Save" 12. Go back to your course reserve 13. Note the HTML is scrubbed on "Public note" 14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 15. Note the HTML is scrubbed on "Public note" 16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl 17. Note the HTML is scrubbed on "Notes" 18. Click on your course reserves 19. Note the HTML is scrubbed on "Notes" Signed-off-by: Brendan Lawlor --- .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 5 +++-- .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt index 79b74086ee..c800701582 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt @@ -6,6 +6,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -102,7 +103,7 @@
  • Staff note [% course.staff_note | html %]
  • -
  • Public note [% course.public_note | $raw %]
  • +
  • Public note [% course.public_note | scrub_html type => 'note' | $raw %]
  • Student count [% course.students_count | html %]
  • Status [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]
  • @@ -263,9 +264,9 @@ [% END %] [% IF (cr.public_note) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF (cr.item.itemnotes) %] - [% cr.item.itemnotes | $raw %] + [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt index b5ef855ee9..16c5bc9985 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt @@ -3,6 +3,7 @@ [% USE Asset %] [% USE AuthorisedValues %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -76,7 +77,7 @@ [% END %] [% c.staff_note | html %] - [% c.public_note | $raw %] + [% c.public_note | scrub_html type => 'note' | $raw %] [% c.students_count | html %] [% IF c.enabled == 'yes' %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt index 27836cf3c6..de5c507244 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt @@ -6,6 +6,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% PROCESS 'html_helpers.inc' %] [% INCLUDE 'doc-head-open.inc' %] @@ -51,7 +52,7 @@ [% END %] - [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | $raw %]
  • [% END %] + [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | scrub_html type => 'note' | $raw %]
  • [% END %] @@ -92,7 +93,7 @@ [% cr.issue.date_due | $KohaDates as_due_date => 1 %] [% IF ( cr.public_note ) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF ( cr.item.itemnotes ) %] [% cr.item.itemnotes | $raw %] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt index ee3c7f95df..3de18bfc76 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt @@ -6,6 +6,7 @@ [% PROCESS 'i18n.inc' %] [% PROCESS 'html_helpers.inc' %] [% INCLUDE 'doc-head-open.inc' %] +[% USE HtmlScrubber %] [% FILTER collapse %] [% t("Course reserves") | html %] › [% PROCESS 'library_name_title' %] @@ -58,7 +59,7 @@ <div class="instructor"><span class="inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div> [% END %] </td> - <td>[% c.public_note | $raw %]</td> + <td>[% c.public_note | scrub_html type => 'note' | $raw %]</td> <td></td> [% END %] </tbody> -- 2.39.5