gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 31165: Scrub "Public note" field for Course Reserves 

When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save

6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"

12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"

16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This commit is contained in:
David Cook 2025-03-24 05:02:20 +00:00 committed by Alex Buckley
parent 39be4f7911
commit cf3874f8a8
4 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt
View File

@ -5,6 +5,7 @@
[% USE ItemTypes %]
[% USE Branches %]
[% USE TablesSettings %]
[% USE HtmlScrubber %]
[% PROCESS 'i18n.inc' %]
[% SET footerjs = 1 %]
[% INCLUDE 'doc-head-open.inc' %]
@ -102,7 +103,7 @@
</div>
</li>
<li><span class="label">Staff note</span> [% course.staff_note | html %]</li>
<li><span class="label">Public note</span> [% course.public_note | $raw %]</li>
<li><span class="label">Public note</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li>
<li><span class="label">Student count</span> [% course.students_count | html %]</li>
<li><span class="label">Status</span> [% IF course.enabled == 'yes' %]Active[% ELSE %]Inactive[% END %]</li>
</ol>
@ -263,9 +264,9 @@
[% END %]
</td>
<td>[% IF (cr.public_note) %]
[% cr.public_note | $raw %]
[% cr.public_note | scrub_html type => 'note' | $raw %]
[% ELSIF (cr.item.itemnotes) %]
[% cr.item.itemnotes | $raw %]
[% cr.item.itemnotes | scrub_html type => 'note' | $raw %]
[% END %]
</td>

3
koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt
View File

@ -2,6 +2,7 @@
[% USE Asset %]
[% USE AuthorisedValues %]
[% USE TablesSettings %]
[% USE HtmlScrubber %]
[% PROCESS 'i18n.inc' %]
[% SET footerjs = 1 %]
[% INCLUDE 'doc-head-open.inc' %]
@ -75,7 +76,7 @@
[% END %]
</td>
<td>[% c.staff_note | html %]</td>
<td>[% c.public_note | $raw %]</td>
<td>[% c.public_note | scrub_html type => 'note' | $raw %]</td>
<td>[% c.students_count | html %]</td>
<td>
[% IF c.enabled == 'yes' %]

7
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt
View File

@ -6,6 +6,7 @@
[% USE ItemTypes %]
[% USE Branches %]
[% USE TablesSettings %]
[% USE HtmlScrubber %]
[% PROCESS 'i18n.inc' %]
[% INCLUDE 'doc-head-open.inc' %]
<title>Course reserves for [% course.course_name | html %] &rsaquo; [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
@ -49,7 +50,7 @@
</ul>
</li>
[% END %]
[% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | $raw %]</li>[% END %]
[% IF ( course.public_note ) %]<li><span class="label">Notes:</span> [% course.public_note | scrub_html type => 'note' | $raw %]</li>[% END %]
</ol>
</div>
@ -90,9 +91,9 @@
</td>
<td data-order="[% cr.issue.date_due | html %]">[% cr.issue.date_due | $KohaDates as_due_date => 1 %]</td>
<td>[% IF ( cr.public_note ) %]
[% cr.public_note | $raw %]
[% cr.public_note | scrub_html type => 'note' | $raw %]
[% ELSIF ( cr.item.itemnotes ) %]
[% cr.item.itemnotes | $raw %]
[% cr.item.itemnotes | scrub_html type => 'note' | $raw %]
[% END %]
</td>
<td>[% IF (cr.item.uri) %]

3
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt
View File

@ -6,6 +6,7 @@
[% PROCESS 'i18n.inc' %]
[% INCLUDE 'doc-head-open.inc' %]
[% USE HtmlScrubber %]
<title>Courses &rsaquo; [% IF ( LibraryNameTitle ) %][% LibraryNameTitle | html %][% ELSE %]Koha online[% END %] catalog</title>
[% INCLUDE 'doc-head-close.inc' %]
[% BLOCK cssinclude %]
@ -57,7 +58,7 @@
<div class="instructor"><span class="inst_surname">[% i.surname | html %]</span>[% IF i.firstname %]<span class="instr_separator">, </span><span class="instr_firstname">[% i.firstname | html %]</span>[% END %]</div>
[% END %]
</td>
<td>[% c.public_note | $raw %]</td>
<td>[% c.public_note | scrub_html type => 'note' | $raw %]</td>
<td></td>
[% END %]
</tbody>