Bug 23341 - Hold Notes should allow for HTML tags
Summary: Hold Notes should allow for HTML tags
Status: CLOSED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: Hold requests (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Lucas Gass (lukeg)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-18 16:28 UTC by Kelly
Modified: 2020-11-30 21:45 UTC (History)
5 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Crowdfunding committed: 0
Crowdfunding contact:
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 23341: Hold Notes should allow for HTML tags (974 bytes, patch)
2019-07-18 18:19 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 23341: Hold Notes should allow for HTML tags (1017 bytes, patch)
2019-07-19 17:13 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 23341: Hold Notes should allow for HTML tags (1.05 KB, patch)
2019-07-19 18:56 UTC, Frédérik Chénier
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly 2019-07-18 16:28:47 UTC
In Koha version in 18.11, HTML tags should be allowed in Hold Notes. THis is similar to bug 23194, 22702, 22501.
Comment 1 Lucas Gass (lukeg) 2019-07-18 18:19:51 UTC
Created attachment 91609 [details] [review]
Bug 23341: Hold Notes should allow for HTML tags

TEST PLAN:
1. place a hold
2. make sure you add a note that includes HTML like "<a href="www.google.com">yolo</a>"
3. notice that HTML displays literally
4. apply patch
5. Now the note field should render the HTML
Comment 2 ByWater Sandboxes 2019-07-19 17:13:28 UTC
Created attachment 91658 [details] [review]
Bug 23341: Hold Notes should allow for HTML tags

Signed-off-by: Jessica Ofsa <jofsa@vt.edu>
Comment 3 Jessica Ofsa 2019-07-19 17:21:06 UTC
HTML tested: 
TN 149xxxx
<br>
Title: 
<br>
Call Number: BF721 .P8 V. 58
<br>
Year: 20030101
<br>
V. 58
<br>
Issue/Part:  
<br>
pg. 35- 
<br>
Article Title: Margo and me. Gender as a cause and solution to unmet needs. 
<br>
Article Author: Knight, Rona,  
<br>

Resulting hold note: 
TN 149xxxx
Title: 
Call Number: BF721 .P8 V. 58 
Year: 20030101 
V. 58 
Issue/Part: 
pg. 35- 
Article Title: Margo and me. Gender as a cause and solution to unmet needs. 
Article Author: Knight, Rona,
Comment 4 Frédérik Chénier 2019-07-19 18:56:03 UTC
Created attachment 91661 [details] [review]
Bug 23341: Hold Notes should allow for HTML tags

Signed-off-by: Jessica Ofsa <jofsa@vt.edu>
Signed-off-by: frederik chenier <frederik.chenier@inlibro.com>
Comment 5 Nick Clemens (kidclamp) 2019-07-26 14:15:31 UTC
This has one caveat - patrons can enter these notes, not just staff, so this would open possibility of XSS attack

Talking internally we think we could filter the patron note on entry

Alternatively, we can split the note into a public_note and private_note - filter the public and display it to patrons, but don't filter the private_note and keep it only for staff
Comment 6 Katrin Fischer 2019-08-09 07:39:15 UTC
(In reply to Nick Clemens from comment #5)
> This has one caveat - patrons can enter these notes, not just staff, so this
> would open possibility of XSS attack
> 
> Talking internally we think we could filter the patron note on entry
> 
> Alternatively, we can split the note into a public_note and private_note -
> filter the public and display it to patrons, but don't filter the
> private_note and keep it only for staff

Do we know more about the use case for this? If it's about handling line breaks like in the example from Jessica we could handle this easily without allowing line breaks.

Otherwise I really like the idea of splitting into internal and public notes as this would allow for more flexible use. Right now if you use the note publicly, you don't have any way to make internal notes and this could easily go wrong. 

Should we reset status here to "In discussion"?
Comment 7 Katrin Fischer 2019-08-15 19:25:03 UTC
Moving this to discussion for now.
Comment 8 Joy Nelson 2020-05-12 15:52:18 UTC
see bz 25468 for new approach to solving the problem