Bug 41846 - Notes field of routing list displays html characters
Summary: Notes field of routing list displays html characters
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: 25.05
Hardware: All All
: P5 - low minor
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-13 19:17 UTC by Esther Melander
Modified: 2026-02-20 12:44 UTC (History)
3 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
routing list example with html (30.16 KB, image/jpeg)
2026-02-13 19:17 UTC, Esther Melander
Details
Bug 41846: Fix nl2br to happen after html escaping (2.57 KB, patch)
2026-02-19 03:02 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Esther Melander 2026-02-13 19:17:06 UTC
Created attachment 193148 [details]
routing list example with html

To replicate:

1. Be sure the RoutingSerials system preference is enabled.
2. Find a serial with a subscription. Click on Edit Routing List.
3. Add some recipients and add some notes. Be sure the notes are formatted something like this line breaks:

Testing out notes
1-26-26 more notes
2-5-26 = more notes, 3 copies

4. Save.

Notice the text of the note appears in one line with the html notation:

Notes:Testing out notes <br />1-26-26 more notes <br />2-5-26 = more notes, 3 copies

5. Click on Save and preview routing slip.

Notice the text with the html notation carries through to the print preview display. I would expect the html notation to not display.
Comment 1 Lucas Gass (lukeg) 2026-02-18 18:00:07 UTC
CCing David here. I think this is behaving the way we want in that HTML should not be rendered? If it is to be rendered it should be scrubbed first?
Comment 2 Lucas Gass (lukeg) 2026-02-18 18:14:02 UTC
I had forgotten about Bug 9750, perhaps that makes this one invalid?

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9750
Comment 3 Katrin Fischer 2026-02-18 18:57:02 UTC
This is an individual note you can add on the routing list per issue. It would not be affected by the move to a notice template but should still be an option that we can insert into it on the fly.
Comment 4 David Cook 2026-02-19 02:44:39 UTC
So there's an easy explanation for this one.

serials/routing-preview.pl converts newlines to <br />:

137 my $routingnotes = $serials[0]->{'routingnotes'};
138 $routingnotes =~ s/\n/\<br \/\>/g;

I have an idea for this one which might work.
Comment 5 David Cook 2026-02-19 03:02:05 UTC
Created attachment 193371 [details] [review]
Bug 41846: Fix nl2br to happen after html escaping

This patch removes the newline to <br/> (nl2br) handling in the .pl script,
and instead moves it after the Template::Toolkit "html" filter. In this way,
we get the security of the "html" filter while also converting new lines into
safe <br/> elements. We also fix a little style problem. Hurray!

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Ensure the RoutingSerials system preference is enabled
2. Create a "Subscription" for a known biblionumber (e.g. 29) with whatever details
3. On the subscription-detail.pl page for that subscription, click on "Create routing list"
4. Add whatever recipients you want and put the following into Notes:
Testing out notes
1-26-26 more notes
2-5-26 = more notes, 3 copies
<p>Awesome... still safe</p>

5. Click "Save"
6. Observe that your notes are output exactly the same way you put them in. The newlines
appear to be newlines to the human eye, while that pesky <p></p> markup is escaped.
7. Observe that the notes are also neatly lined up with the rest of the routing list
display for an attractive user experience
8. Celebrate again. Hurray!
Comment 6 David Cook 2026-02-19 03:14:24 UTC
So I fixed this problem without even looking at bug 9750... but bug 9750 would make it irrelevant. 

I'll take a look at bug 9750 now...
Comment 7 David Cook 2026-02-19 03:27:33 UTC
(In reply to David Cook from comment #6)
> So I fixed this problem without even looking at bug 9750... but bug 9750
> would make it irrelevant. 
> 
> I'll take a look at bug 9750 now...

The patches on Bug 9750 actually break this even further hehe. So I think we can proceed with this patch. As Katrin said, bug 9750 shouldn't actually overlap with this one anyway after all.
Comment 8 David Cook 2026-02-19 03:28:45 UTC
In terms of the change, basically we stop the controller script doing the newline to <br/> and instead use a Template::Toolkit filter to do it after we apply the "html" filter. Since newline to <br/> is safe and doesn't use HTML in the source before the "html" filter, we're all good. 

Chalk one more up for the good guys :D
Comment 9 David Nind 2026-02-20 12:44:02 UTC
From testing:

1. Before the patch, the notes are shown in a continuous line without the line breaks.

2. After the patch: displays as expected, with new lines shown, the HTML <p> tag is also shown (owning and closing).

3. After you save the routing list:
   - "Save and preview routing slip": back to being on a continuous line,
     without the line breaks
   - Same when you print the routing slip

Questions:

1. Should the HTML markup be shown or stripped out?

2. Should the preview routing slip and printed version be fixed up as well, or is that a separate bug?