Typically, we use C4::Scrubber during data processing, but there are times where it is more practical to scrub the HTML at the display/view layer (ie when generating the output using Template::Toolkit).
Created attachment 174815 [details] [review] Bug 38488: Add Template::Toolkit filter for C4::Scrubber This change adds a Template::Toolkit filter which is invoked via " | scrub_html type => 'note' ". Test plan: 0. Apply the patch 1. prove t/Koha/Plugins/HtmlScrubber.t
Created attachment 176879 [details] [review] Bug 38488: Add Template::Toolkit filter for C4::Scrubber This change adds a Template::Toolkit filter which is invoked via " | scrub_html type => 'note' ". Test plan: 0. Apply the patch 1. prove t/Koha/Plugins/HtmlScrubber.t Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
t/Koha/Plugins/HtmlScrubber.t .. ok All tests successful. Files=1, Tests=2, 1 wallclock secs ( 0.00 usr 0.01 sys + 0.31 cusr 0.06 csys = 0.38 CPU) Result: PASS
Strictly speaking, adding a plugin module and a test would not be a security report? Not mentioning 31165..
Created attachment 178076 [details] [review] Bug 38488: Add Template::Toolkit filter for C4::Scrubber This change adds a Template::Toolkit filter which is invoked via " | scrub_html type => 'note' ". Test plan: 0. Apply the patch 1. prove t/Koha/Plugins/HtmlScrubber.t Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(In reply to Marcel de Rooy from comment #4) > Strictly speaking, adding a plugin module and a test would not be a security > report? Not mentioning 31165.. I think I was hoping that when I raised it I'd get more input from others about ideas on ways it could be improved or used for other security tasks heh.
Applied to 24.05.x-security
Applied to 24.11.x-security
Please rebase for 22.11.x
Applied to 22.11.x-security