From b88ade9f40d690048591e8d65562c13ba0e211bd Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 19 Feb 2026 02:58:10 +0000 Subject: [PATCH] Bug 41846: Fix nl2br to happen after html escaping This patch removes the newline to
(nl2br) handling in the .pl script, and instead moves it after the Template::Toolkit "html" filter. In this way, we get the security of the "html" filter while also converting new lines into safe
elements. We also fix a little style problem. Hurray! Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Ensure the RoutingSerials system preference is enabled 2. Create a "Subscription" for a known biblionumber (e.g. 29) with whatever details 3. On the subscription-detail.pl page for that subscription, click on "Create routing list" 4. Add whatever recipients you want and put the following into Notes: Testing out notes 1-26-26 more notes 2-5-26 = more notes, 3 copies

Awesome... still safe

5. Click "Save" 6. Observe that your notes are output exactly the same way you put them in. The newlines appear to be newlines to the human eye, while that pesky

markup is escaped. 7. Observe that the notes are also neatly lined up with the rest of the routing list display for an attractive user experience 8. Celebrate again. Hurray! --- .../intranet-tmpl/prog/en/modules/serials/routing-preview.tt | 2 +- serials/routing-preview.pl | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt index 9b62a615446..36e5cfd5379 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt @@ -46,7 +46,7 @@ [% END %] -
  • Notes:[% routingnotes | html %]
  • +
  • Notes:
    [% routingnotes | html | html_line_break %]
  • diff --git a/serials/routing-preview.pl b/serials/routing-preview.pl index 6c65ec9a7e3..6f4601274e9 100755 --- a/serials/routing-preview.pl +++ b/serials/routing-preview.pl @@ -135,7 +135,6 @@ for my $routing (@routinglist) { } my $routingnotes = $serials[0]->{'routingnotes'}; -$routingnotes =~ s/\n/\
    /g; $template->param( title => $subs->{'bibliotitle'}, -- 2.39.5