Bug 29853 - Text needs HTML filter before KohaSpan filter
Summary: Text needs HTML filter before KohaSpan filter
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Fridolin Somers
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-01-11 22:48 UTC by Fridolin Somers
Modified: 2022-12-12 21:24 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.03,21.05.13


Attachments
Bug 29853: Add HTML filter before KohaSpan filter (3.42 KB, patch)
2022-01-12 05:51 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 29853: Add HTML filter before KohaSpan filter (3.57 KB, patch)
2022-02-14 13:12 UTC, Solene D
Details | Diff | Splinter Review
Bug 29853: Add HTML filter before KohaSpan filter (3.65 KB, patch)
2022-02-18 09:17 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin Somers 2022-01-11 22:48:55 UTC
Usage of Template Toolkit plugin KohaSpan as filter is actually :
  Group [% added.title | $KohaSpan class = 'name' | $raw %] created.

But KohaSpan filter does not escape HTML characters.
Whe should filter HTML then KohaSpan.
Comment 1 Fridolin Somers 2022-01-11 22:56:21 UTC
 > git grep '$KohaSpan' -- koha-tmpl/
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt:            [% added.library.branchname | $KohaSpan class = 'name' | $raw %] added to group.
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt:            Group [% added.title | $KohaSpan class = 'name' | $raw %] created.
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt:            Group [% deleted.title | $KohaSpan class = 'name' | $raw %] has been deleted.
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt:            [% deleted.library | $KohaSpan class = 'name' | $raw %] has been removed from group.
koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt:            A group with the title [% error_duplicate_title | $KohaSpan class = 'name' | $raw %] already exists.

We can reproduce in library groups page :

Create a new library group with title : Mygrou</div>pe
Save the form.
You see a message box with : Group Mygrou
Comment 2 Fridolin Somers 2022-01-12 05:51:57 UTC
Created attachment 129325 [details] [review]
Bug 29853: Add HTML filter before KohaSpan filter

Usage of Template Toolkit plugin KohaSpan as filter is actually :
  Group [% added.title | $KohaSpan class = 'name' | $raw %] created.

But KohaSpan filter does not escape HTML characters.
Whe should filter HTML then KohaSpan.

This patch adds TT html filter before KohaSpan.
Also replaces in Javascript html() with text()
to ensure special caracters are still encoded.
See https://api.jquery.com/text/

Test plan :
1) Create a library with name Libra&apos;rie
2) Create a library group with name Grou&apos;pe
3) Play with this group
4) Add library
5) Remove library
6) Edit group
7) Delete group
8) Each time check that &apos, is not interpreted as single quote
Comment 3 Fridolin Somers 2022-01-12 05:55:35 UTC
Maybe we should have a coding guide line for this.

Is see it is quite different for SMTP servers :
$("#delete_confirm_dialog").html(
    _("You are about to delete the '%s' SMTP server.").format(smtp_server_name)
);

https://git.koha-community.org/Koha-community/Koha/src/commit/a6ef152db9e71805efe8e7dd6b2f8549da0f65b4/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt#L392

Looks better for translation.
Comment 4 Solene D 2022-02-14 13:12:48 UTC
Created attachment 130547 [details] [review]
Bug 29853: Add HTML filter before KohaSpan filter

Usage of Template Toolkit plugin KohaSpan as filter is actually :
  Group [% added.title | $KohaSpan class = 'name' | $raw %] created.

But KohaSpan filter does not escape HTML characters.
Whe should filter HTML then KohaSpan.

This patch adds TT html filter before KohaSpan.
Also replaces in Javascript html() with text()
to ensure special caracters are still encoded.
See https://api.jquery.com/text/

Test plan :
1) Create a library with name Libra&apos;rie
2) Create a library group with name Grou&apos;pe
3) Play with this group
4) Add library
5) Remove library
6) Edit group
7) Delete group
8) Each time check that &apos, is not interpreted as single quote

Signed-off-by: Solène Desvaux <solene.desvaux@biblibre.com>
Comment 5 Solene D 2022-02-14 13:14:50 UTC
I have executed the test plan, it is working for me
Comment 6 Jonathan Druart 2022-02-18 09:17:07 UTC
Created attachment 130813 [details] [review]
Bug 29853: Add HTML filter before KohaSpan filter

Usage of Template Toolkit plugin KohaSpan as filter is actually :
  Group [% added.title | $KohaSpan class = 'name' | $raw %] created.

But KohaSpan filter does not escape HTML characters.
Whe should filter HTML then KohaSpan.

This patch adds TT html filter before KohaSpan.
Also replaces in Javascript html() with text()
to ensure special caracters are still encoded.
See https://api.jquery.com/text/

Test plan :
1) Create a library with name Libra&apos;rie
2) Create a library group with name Grou&apos;pe
3) Play with this group
4) Add library
5) Remove library
6) Edit group
7) Delete group
8) Each time check that &apos, is not interpreted as single quote

Signed-off-by: Solène Desvaux <solene.desvaux@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 7 Fridolin Somers 2022-02-22 01:14:28 UTC
Pushed to master for 22.05, thanks to everybody involved 🦄
Comment 8 Kyle M Hall 2022-02-25 13:20:23 UTC
Pushed to 21.11.x for 21.11.03
Comment 9 Andrew Fuerste-Henry 2022-03-07 20:28:16 UTC
Pushed to 21.05.x for 21.05.12
Comment 10 Victor Grousset/tuxayo 2022-03-18 02:37:51 UTC
Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed.