Bug 40717 - Notes scrubber is too strict for some cases
Summary: Notes scrubber is too strict for some cases
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
: 38498 (view as bug list)
Depends on: 31165
Blocks:
  Show dependency treegraph
 
Reported: 2025-08-27 21:47 UTC by Lisette Scheer
Modified: 2025-08-28 01:25 UTC (History)
1 user (show)

See Also:
GIT URL: 33337
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lisette Scheer 2025-08-27 21:47:25 UTC
Bug 31165 added scrubbing to course reserves public note
Many libraries use the public note to link to courses on their website, other resources, etc.

Additionally bug 33337 talks about scrubbing patron public notes, but those are also used sometimes for links, such as other patrons that can check out their items but not guarantaurs. 

I recommend changing it to something like what Lucas did on Bug 38960 https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183774&action=diff which allows for some links but is not all links:
 a => {

                href   => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i,

                class  => qr/^[\w\s\-_]+$/,

                title  => 1,

                target => qr/^_(?:blank|self|parent|top)$/,

                rel    =>

                    qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/,

                property => qr/^[\w\s]+$/,

                typeof   => qr/^[\w\s]+$/,

                resource => qr/^[#\w\-_]+$/,


            },
Comment 1 David Cook 2025-08-28 01:20:09 UTC
*** Bug 38498 has been marked as a duplicate of this bug. ***
Comment 2 David Cook 2025-08-28 01:24:50 UTC
I opened bug 38498 a while ago to add "id" and "class", but this makes a lot of sense too in terms of attributes.

As for the "a" element... I think we'll want to be careful. I created the "note" profile to be re-usable for other types of notes. If it's staff-created notes, it's probably fine. If it's user-created notes, then there's some danger.
Comment 3 David Cook 2025-08-28 01:25:35 UTC
Btw in this case, I don't think we'd need the "property", "typeof", or "resource" attributes, since those are specific to Schema.org for the record display.