In recent Koha 18.11, parsing of HTML tags was removed from many fields for security reasons. However, as also seen in 22938, 22702, 22501, 23194, 23683 there are places where HTML (or at leas line breaks!) are required, or the output is too messy. The 'notes' field in the "Guided reports wizard › Saved reports" displays the data that is previously entered in a textarea. However, the guided_reports_start.tt does not parse the HTML (nor line breaks), so the output in the resulting table is all in one line! As with the other patches, I propose that we allow HTML in report notes, so one can use strong/italics/colors/urls in notes, and most importantly, line breaks!
Created attachment 95107 [details] [review] Allow HTML in saved reports note field
Created attachment 95108 [details] [review] Allow HTML in saved reports note field patch based on Koha 18.11.06 code
Hi Theodoros, all patches must be based on the current master branch and if it's a bug will then be backported to the older supported versions. Also, you need to create a patch, not just a diff - the file is missing some necessary information and can't be applied with our tools. Do you want to have another go at this? Please let us know if we can help!
+1 We are currently using a custom patch to achieve this.
Created attachment 161711 [details] [review] Bug 23978: Expose HTML in Reports This patch updates the notes field to a $raw filter to prevent html escaping of the data within it. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Is there a more secure way of doing this rather than just exposing the raw html.. I feel like we're just undoing a security flaw we fixed for a reason. Is it time to use markdown for rich text or perhaps for linebreaks just outputting the note field in a pre/code block?
(In reply to Martin Renvoize from comment #6) > Is there a more secure way of doing this rather than just exposing the raw > html.. I feel like we're just undoing a security flaw we fixed for a reason. Yeah I don't think we can just expose the raw HTML. One option would be to use the HTML scrubber. I think there are quite a few parts of Koha where people want to use HTML, but could be limited to a fairly small subset of elements and attributes. > Is it time to use markdown for rich text or perhaps for linebreaks just > outputting the note field in a pre/code block? For line breaks, the "html_line_break" filter can be useful. For notes, adding that line break filter would make sense. I don't know that any other HTML features would really needed though. If they were to be added, I think we'd have to scrub them first.
(In reply to Martin Renvoize from comment #5) > This patch updates the notes field to a $raw filter to prevent html > escaping of the data within it. (In reply to David Cook from comment #7) > Yeah I don't think we can just expose the raw HTML. Sounds like a security problem and a FQA to me. Please set back to NSO if you disagree. :-)