Bug 38488

Summary: Add TT filter using HTML scrubber
Product: Koha Reporter: David Cook <dcook>
Component: TemplatesAssignee: David Cook <dcook>
Status: RESOLVED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: enhancement    
Priority: P5 - low CC: blawlor, dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, paul.derscheid, philippe.blouin, tomascohen, wainuiwitikapark
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36328
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.02,24.05.07,23.11.12,22.11.24
Circulation function:
Bug Depends on:    
Bug Blocks: 31165    
Attachments: Bug 38488: Add Template::Toolkit filter for C4::Scrubber
Bug 38488: Add Template::Toolkit filter for C4::Scrubber
Bug 38488: Add Template::Toolkit filter for C4::Scrubber

Description David Cook 2024-11-19 22:40:09 UTC
Typically, we use C4::Scrubber during data processing, but there are times where it is more practical to scrub the HTML at the display/view layer (ie when generating the output using Template::Toolkit).
Comment 1 David Cook 2024-11-20 00:33:03 UTC Comment hidden (obsolete)
Comment 2 Brendan Lawlor 2025-01-21 17:56:20 UTC Comment hidden (obsolete)
Comment 3 Brendan Lawlor 2025-01-21 17:57:22 UTC
t/Koha/Plugins/HtmlScrubber.t .. ok   
All tests successful.
Files=1, Tests=2,  1 wallclock secs ( 0.00 usr  0.01 sys +  0.31 cusr  0.06 csys =  0.38 CPU)
Result: PASS
Comment 4 Marcel de Rooy 2025-02-14 07:45:50 UTC
Strictly speaking, adding a plugin module and a test would not be a security report? Not mentioning 31165..
Comment 5 Marcel de Rooy 2025-02-14 07:58:04 UTC
Created attachment 178076 [details] [review]
Bug 38488: Add Template::Toolkit filter for C4::Scrubber

This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 David Cook 2025-02-16 23:09:30 UTC
(In reply to Marcel de Rooy from comment #4)
> Strictly speaking, adding a plugin module and a test would not be a security
> report? Not mentioning 31165..

I think I was hoping that when I raised it I'd get more input from others about ideas on ways it could be improved or used for other security tasks heh.
Comment 7 Wainui Witika-Park 2025-02-17 22:41:54 UTC
Applied to 24.05.x-security
Comment 8 Paul Derscheid 2025-02-22 18:15:49 UTC
Applied to 24.11.x-security
Comment 9 Jesse Maseto 2025-02-24 16:28:33 UTC
Please rebase for 22.11.x
Comment 10 Jesse Maseto 2025-02-24 17:07:37 UTC
Applied to 22.11.x-security