From cd61e56053a6deb5dc9fdaf08e14e3b5d0d0a3a8 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 24 Mar 2025 05:02:20 +0000 Subject: [PATCH] [24.05.x] Bug 31165: Scrub "Public note" field for Course Reserves When displaying the "Public note" for Course Reserves, we scrub the HTML using the "note" scrubber type. Test plan: 0. Apply the patch 1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 2. Click "New course" 3. Fill in required fields 4. In staff note and public note add the following:

Hello!

5. Click Save 6. Click "Add reserves" 7. Add "39999000001310" to Item barcode 8. Click "Submit" 9. Fill in all required fields 10. Add the following for Staff note and Public note:

Item!

11. Click "Save" 12. Go back to your course reserve 13. Note the HTML is scrubbed on "Public note" 14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl 15. Note the HTML is scrubbed on "Public note" 16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl 17. Note the HTML is scrubbed on "Notes" 18. Click on your course reserves 19. Note the HTML is scrubbed on "Notes" Signed-off-by: Brendan Lawlor Signed-off-by: Marcel de Rooy --- .../prog/en/modules/course_reserves/course-details.tt | 7 ++++--- .../prog/en/modules/course_reserves/course-reserves.tt | 3 ++- .../opac-tmpl/bootstrap/en/modules/opac-course-details.tt | 7 ++++--- .../opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt | 3 ++- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt index 61099da882..815d9a258a 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt @@ -5,6 +5,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -102,7 +103,7 @@
  • Staff note [% course.staff_note | html %]
  • -
  • Public note [% course.public_note | $raw %]
  • +
  • Public note [% course.public_note | scrub_html type => 'note' | $raw %]
  • Student count [% course.students_count | html %]
  • Status [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]
  • @@ -263,9 +264,9 @@ [% END %] [% IF (cr.public_note) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF (cr.item.itemnotes) %] - [% cr.item.itemnotes | $raw %] + [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt index 8c06c578c8..ab26e62911 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt @@ -2,6 +2,7 @@ [% USE Asset %] [% USE AuthorisedValues %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] @@ -75,7 +76,7 @@ [% END %] [% c.staff_note | html %] - [% c.public_note | $raw %] + [% c.public_note | scrub_html type => 'note' | $raw %] [% c.students_count | html %] [% IF c.enabled == 'yes' %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt index 5ce9a87fa4..c34a5cc8de 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt @@ -6,6 +6,7 @@ [% USE ItemTypes %] [% USE Branches %] [% USE TablesSettings %] +[% USE HtmlScrubber %] [% PROCESS 'i18n.inc' %] [% INCLUDE 'doc-head-open.inc' %] Course reserves for [% course.course_name | html %] › [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog @@ -49,7 +50,7 @@ [% END %] - [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | $raw %]
  • [% END %] + [% IF ( course.public_note ) %]
  • Notes: [% course.public_note | scrub_html type => 'note' | $raw %]
  • [% END %] @@ -90,9 +91,9 @@ [% cr.issue.date_due | $KohaDates as_due_date => 1 %] [% IF ( cr.public_note ) %] - [% cr.public_note | $raw %] + [% cr.public_note | scrub_html type => 'note' | $raw %] [% ELSIF ( cr.item.itemnotes ) %] - [% cr.item.itemnotes | $raw %] + [% cr.item.itemnotes | scrub_html type => 'note' | $raw %] [% END %] [% IF (cr.item.uri) %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt index b6e67303f3..f6d4085b14 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt @@ -6,6 +6,7 @@ [% PROCESS 'i18n.inc' %] [% INCLUDE 'doc-head-open.inc' %] +[% USE HtmlScrubber %] Courses › [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog [% INCLUDE 'doc-head-close.inc' %] [% BLOCK cssinclude %] @@ -57,7 +58,7 @@
    [% i.surname | html %][% IF i.firstname %], [% i.firstname | html %][% END %]
    [% END %] - [% c.public_note | $raw %] + [% c.public_note | scrub_html type => 'note' | $raw %] [% END %] -- 2.39.5