Bug 40717

Summary: Notes scrubber is too strict for some cases
Product: Koha Reporter: Lisette Scheer <lisette>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dcook
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38960
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31165
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38498
GIT URL: 33337 Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 31165    
Bug Blocks:    

Description Lisette Scheer 2025-08-27 21:47:25 UTC
Bug 31165 added scrubbing to course reserves public note
Many libraries use the public note to link to courses on their website, other resources, etc.

Additionally bug 33337 talks about scrubbing patron public notes, but those are also used sometimes for links, such as other patrons that can check out their items but not guarantaurs. 

I recommend changing it to something like what Lucas did on Bug 38960 https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183774&action=diff which allows for some links but is not all links:
 a => {

                href   => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i,

                class  => qr/^[\w\s\-_]+$/,

                title  => 1,

                target => qr/^_(?:blank|self|parent|top)$/,

                rel    =>

                    qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/,

                property => qr/^[\w\s]+$/,

                typeof   => qr/^[\w\s]+$/,

                resource => qr/^[#\w\-_]+$/,


            },
Comment 1 David Cook 2025-08-28 01:20:09 UTC
*** Bug 38498 has been marked as a duplicate of this bug. ***
Comment 2 David Cook 2025-08-28 01:24:50 UTC
I opened bug 38498 a while ago to add "id" and "class", but this makes a lot of sense too in terms of attributes.

As for the "a" element... I think we'll want to be careful. I created the "note" profile to be re-usable for other types of notes. If it's staff-created notes, it's probably fine. If it's user-created notes, then there's some danger.
Comment 3 David Cook 2025-08-28 01:25:35 UTC
Btw in this case, I don't think we'd need the "property", "typeof", or "resource" attributes, since those are specific to Schema.org for the record display.