Bug 42904: Prevent XSS in patron restriction comments

Test plan

1. Search for a patron and open the patron details page.
2. Under "Patron restrictions", add a manual restriction with the following comment:
   <img src=x onerror="alert(document.domain)">
3. Save the restriction.
4. Navigate to the patron checkouts page:
   /cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx
   Verify that the JavaScript payload executes.
5. Edit the patron record:
   /cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx
   Verify that the JavaScript payload executes.
6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl
7. Apply the patch.
8. Repeat steps 4, 5 and 6.
9. Verify that:
   1. No JavaScript is executed.
   2. The page loads normally without any alert dialog. Applicable for both the staff and opac.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>

koha-tmpl/intranet-tmpl/prog/en/includes/patron-restrictions-tab.inc

@@ -1,5 +1,6 @@
 [% USE raw %]
 [% USE Koha %]
+[% USE HtmlScrubber %]
 [% PROCESS 'restriction-types.inc' %]
 
 [% IF ( patron.restrictions.count == 0 ) %]
@@ -23,9 +24,9 @@
                     <td> [% PROCESS restriction_type_description restriction_type=restriction.type %] </td>
                     <td>
                         [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                            <span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]</span>
+                            <span>Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]</span>
                         [% ELSE %]
-                            [% restriction.comment | $raw %]
+                            [% restriction.comment | scrub_html type => 'comment' | $raw %]
                         [% END %]
                     </td>
                     <td>

koha-tmpl/intranet-tmpl/prog/en/includes/patron_messages.inc

@@ -1,5 +1,6 @@
 [% USE raw %]
 [% USE Branches %]
+[% USE HtmlScrubber %]
 [% USE Categories %]
 [% SET ClaimReturnedWarningThreshold = Koha.Preference('ClaimReturnedWarningThreshold') || 0 %]
 [% SET return_claims = patron.return_claims %]
@@ -104,10 +105,10 @@
                                 [% END %]
                             </span>
                             [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]
+                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]
                             [% ELSE %]
                                 [% IF restriction.comment %]
-                                    <span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
+                                    <span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
                                 [% END %]
                             [% END %]
                             <span class="restriction_type">([%- restriction.type.display_text | html -%])</span>

koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt

@@ -3,6 +3,7 @@
 [% USE To %]
 [% USE Koha %]
 [% USE KohaDates %]
+[% USE HtmlScrubber %]
 [% USE Branches %]
 [% PROCESS 'member-main-address-style.inc' %]
 [% PROCESS 'member-alt-address-style.inc' %]
@@ -1390,9 +1391,9 @@
                                                         <td>[% PROCESS restriction_type_description restriction_type=restriction.type %]</td>
                                                         <td>
                                                             [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                                                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw %]
+                                                                Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw %]
                                                             [% ELSE %]
-                                                                [% restriction.comment | $raw %]
+                                                                [% restriction.comment | scrub_html type => 'comment' | $raw %]
                                                             [% END %]
                                                         </td>
                                                         <td>

koha-tmpl/opac-tmpl/bootstrap/en/includes/patron-restrictions.inc

@@ -1,3 +1,4 @@
+[% USE HtmlScrubber %]
 <li class="userdebarred blocker">
     <strong>Your account has been frozen</strong>
     <ul>
@@ -11,10 +12,10 @@
                     [% END %]
                 </span>
                 [% IF restriction.comment.search('OVERDUES_PROCESS') %]
-                    <span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | $raw | html_line_break %]</span>
+                    <span class="restriction_detail">Restriction added by overdues process [% restriction.comment.remove('OVERDUES_PROCESS ') | scrub_html type => 'comment' | $raw | html_line_break %]</span>
                 [% ELSE %]
                     [% IF restriction.comment %]
-                        <span class="restriction_detail">[%- restriction.comment | html_line_break -%]</span>
+                        <span class="restriction_detail">[%- restriction.comment | scrub_html type => 'comment' | html_line_break -%]</span>
                     [% END %]
                 [% END %]
             </li>