From 029980b06e7b0038eb913107951605520d5ea5f4 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 12 Apr 2018 13:15:00 -0300 Subject: [PATCH] Bug 12123: Do not render HTML in notice viewer if invalid If a notice contains malformed HTML it should not be displayed. --- koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt | 8 +++++++- members/notices.pl | 11 ++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt index fecf201ed5..0b4463da29 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt @@ -42,7 +42,13 @@ [% QUEUED_MESSAGE.subject %]
- [% QUEUED_MESSAGE.content FILTER html_line_break %] + [% IF QUEUED_MESSAGE.malformed %] +

Note: This notice does not contain valid HTML elements.

+ [% QUEUED_MESSAGE.content FILTER html_line_break FILTER html %] + [% ELSE %] + [% QUEUED_MESSAGE.content FILTER html_line_break %] + [% END %] +
diff --git a/members/notices.pl b/members/notices.pl index f307393b63..72ec5c8055 100755 --- a/members/notices.pl +++ b/members/notices.pl @@ -20,9 +20,11 @@ # along with Koha; if not, see . use Modern::Perl; +use CGI qw ( -utf8 ); +use XML::Simple; + use C4::Auth; use C4::Output; -use CGI qw ( -utf8 ); use C4::Members; use C4::Letters; use C4::Members::Attributes qw(GetBorrowerAttributes); @@ -74,6 +76,13 @@ if (C4::Context->preference('ExtendedPatronAttributes')) { ); } +for my $m ( @$queued_messages ) { + eval { XML::Simple->new->XMLin($m->{content}); }; + if ( $@ ) { + $m->{malformed} = 1; + } +} + $template->param( patron => $patron, QUEUED_MESSAGES => $queued_messages, -- 2.11.0