From 0dbea746d7effbe09a53c92f2faca3680e127c6b Mon Sep 17 00:00:00 2001 From: Lucas Gass Date: Wed, 7 May 2025 22:24:49 +0000 Subject: [PATCH] Bug 39860: Use HTML scrubber to sanitize HTML --- C4/XSLT.pm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/C4/XSLT.pm b/C4/XSLT.pm index 9f77968299b..04dad6ca486 100644 --- a/C4/XSLT.pm +++ b/C4/XSLT.pm @@ -33,6 +33,7 @@ use Koha::XSLT::Base; use Koha::Libraries; use Koha::Recalls; use Koha::TemplateUtils qw( process_tt ); +use C4::Scrubber; my $engine; #XSLT Handler object @@ -243,9 +244,12 @@ sub XSLTParse4Display { # Check if we should add extra content based on system preference if ( C4::Context->preference('ExtraContentForXSLTDisplay') ) { + + my $scrubber = C4::Scrubber->new(); my $extracontentvalue = C4::Context->preference('ExtraContentForXSLTDisplay'); my $extracontentproccessed = process_tt( $extracontentvalue, { record => $record } ); - $extracontentxml = "" . $extracontentproccessed . ""; + my $cleanxml = $scrubber->scrub($extracontentproccessed); + $extracontentxml = "" . $cleanxml . ""; } # embed variables -- 2.39.5