Bug 23978 - Notes field in saved reports should allow for HTML
Summary: Notes field in saved reports should allow for HTML
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-06 13:48 UTC by Theodoros Theodoropoulos
Modified: 2024-04-01 11:37 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Allow HTML in saved reports note field (1.24 KB, patch)
2019-11-06 14:08 UTC, Theodoros Theodoropoulos
Details | Diff | Splinter Review
Allow HTML in saved reports note field (2.56 KB, patch)
2019-11-06 14:25 UTC, Theodoros Theodoropoulos
Details | Diff | Splinter Review
Bug 23978: Expose HTML in Reports (4.62 KB, patch)
2024-02-01 06:46 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Theodoros Theodoropoulos 2019-11-06 13:48:58 UTC
In recent Koha 18.11, parsing of HTML tags was removed from many fields for security reasons. However, as also seen in 22938, 22702, 22501, 23194, 23683 there are places where HTML (or at leas line breaks!) are required, or the output is too messy.

The 'notes' field in the "Guided reports wizard › Saved reports" displays the data that is previously entered in a textarea. However, the guided_reports_start.tt does not parse the HTML (nor line breaks), so the output in the resulting table is all in one line!

As with the other patches, I propose that we allow HTML in report notes, so one can use strong/italics/colors/urls in notes, and most importantly, line breaks!
Comment 1 Theodoros Theodoropoulos 2019-11-06 14:08:34 UTC
Created attachment 95107 [details] [review]
Allow HTML in saved reports note field
Comment 2 Theodoros Theodoropoulos 2019-11-06 14:25:51 UTC
Created attachment 95108 [details] [review]
Allow HTML in saved reports note field

patch based on Koha 18.11.06 code
Comment 3 Katrin Fischer 2019-11-24 13:54:34 UTC
Hi Theodoros, 

all patches must be based on the current master branch and if it's a bug will then be backported to the older supported versions. Also, you need to create a patch, not just a diff - the file is missing some necessary information and can't be applied with our tools. 

Do you want to have another go at this? Please let us know if we can help!
Comment 4 Mirjam Vantieghem 2024-01-30 11:02:31 UTC
+1 We are currently using a custom patch to achieve this.
Comment 5 Martin Renvoize 2024-02-01 06:46:29 UTC
Created attachment 161711 [details] [review]
Bug 23978: Expose HTML in Reports

This patch updates the notes field to a $raw filter to prevent html
escaping of the data within it.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize 2024-02-01 06:48:50 UTC
Is there a more secure way of doing this rather than just exposing the raw html.. I feel like we're just undoing a security flaw we fixed for a reason.

Is it time to use markdown for rich text or perhaps for linebreaks just outputting the note field in a pre/code block?
Comment 7 David Cook 2024-02-06 22:35:35 UTC
(In reply to Martin Renvoize from comment #6)
> Is there a more secure way of doing this rather than just exposing the raw
> html.. I feel like we're just undoing a security flaw we fixed for a reason.

Yeah I don't think we can just expose the raw HTML. One option would be to use the HTML scrubber. I think there are quite a few parts of Koha where people want to use HTML, but could be limited to a fairly small subset of elements and attributes. 

> Is it time to use markdown for rich text or perhaps for linebreaks just
> outputting the note field in a pre/code block?

For line breaks, the "html_line_break" filter can be useful. 

For notes, adding that line break filter would make sense. I don't know that any other HTML features would really needed though. If they were to be added, I think we'd have to scrub them first.
Comment 8 Magnus Enger 2024-02-16 14:39:22 UTC
(In reply to Martin Renvoize from comment #5)
> This patch updates the notes field to a $raw filter to prevent html
> escaping of the data within it.

(In reply to David Cook from comment #7)
> Yeah I don't think we can just expose the raw HTML. 

Sounds like a security problem and a FQA to me. Please set back to NSO if you disagree. :-)