gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
54,972 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook cf3874f8a8 Bug 31165: Scrub "Public note" field for Course Reserves 
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save

6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"

12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"

16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
 		2025-03-24 07:37:51 +00:00
C4 Merge remote-tracking branch 'upstream/24.05.x' into HEAD 2025-03-24 17:11:13 +13:00
Koha Merge remote-tracking branch 'upstream/24.05.x' into HEAD 2025-03-24 17:11:13 +13:00
acqui Bug 38680: Dont convert the copynumber 2024-12-18 22:56:59 +00:00
admin Bug 37954: Fix barcode column name 2024-11-18 23:16:08 +00:00
api Bug 39007: [24.05] Update API spec and unit test 2025-02-17 22:27:53 +00:00
authorities Bug 38200: Remove dead code to delete authorities in authorities/authorities.pl 2024-11-20 18:34:52 +00:00
basket Bug 34478: Add 'op' to sendbasketform 2024-03-01 10:58:53 +01:00
bin
…
bookings Bug 35574: Bookings tab from biblio details should only require manage_bookings permission 2023-12-18 15:21:04 +01:00
catalogue Bug 38000: Update imports 2024-11-18 22:49:20 +00:00
cataloguing Bug 38030: (QA follow-up) Move csrf_token to POST body from URL 2024-11-21 14:34:53 +00:00
circ Bug 38246: [24.05.x] Only check unresolved claims 2025-03-20 04:45:06 +00:00
clubs Bug 34478: Manual fix - add op clubs/templates-add-modify 2024-03-01 10:57:55 +01:00
course_reserves Bug 28762: Use Koha::Course in course-details controller 2024-08-28 20:20:33 +00:00
debian Bug 33018: debian package tidy-up 2025-03-20 01:42:26 +00:00
docs Bug 38517: Add the 25.05 release team 2024-12-17 00:21:37 +00:00
erm
…
errors Bug 37741: Do not send cookie back from error pages 2024-11-15 20:31:16 +00:00
etc Bug 37087: Add TCP keepalive support to SIP server 2024-12-31 16:51:59 +13:00
ill Bug 35106: CSRF fix 2024-04-29 18:53:09 +02:00
installer Bug 38707: Patron restriction types from installer files not translatable 2025-03-20 02:27:40 +00:00
koha-tmpl Bug 31165: Scrub "Public note" field for Course Reserves 2025-03-24 07:37:51 +00:00
labels Bug 37206: Removing an item from a label batch should be a CSRF-protected POST operation 2024-11-18 17:41:08 +00:00
lib Bug 35681: Use ::Bootstrap version of FromANSI 2024-05-02 16:47:39 +02:00
members Bug 37365: (QA follow-up) Add error checking around AddFile call 2024-12-05 21:49:10 +00:00
misc Bug 38382: Fresh connection when connexion CSRF token expires 2025-03-20 00:42:42 +00:00
offline_circ Bug 34478: Changes for offline_circ 2024-03-01 10:58:34 +01:00
opac Bug 28478: Make opac-*detail.pl scripts use Koha::Biblio->opac_suppressed() 2025-02-24 21:20:19 +00:00
patron_lists Bug 37266: [24.05.x] patron_lists/delete.pl should have CSRF protection 2025-02-25 19:21:07 +00:00
patroncards Bug 37614: Printing patron cards from patron lists should be a GET 2024-09-11 16:37:03 +00:00
plugins Bug 30897: Add option to disable automated restart 2024-04-11 16:53:42 +02:00
pos Bug 33478: Apply formatting to RECEIPT 2024-04-26 20:15:44 +02:00
preservation Bug 38089: (follow-up) More fixes for errors in original submission 2024-11-18 22:53:55 +00:00
recalls Bug 38089: (follow-up) More fixes for errors in original submission 2024-11-18 22:53:55 +00:00
reports Bug 37784: [24.05] (QA follow-up) Bail out to new definition 2025-03-21 01:41:34 +00:00
reserve Bug 37587: (QA follow-up) Tidy reserve/placerequest.pl 2024-10-09 19:34:22 +00:00
reviews Bug 37074: Comment approval and un-approval should be CSRF-protected 2024-07-25 14:08:54 +00:00
rotating_collections Bug 34478: Manual fix - add op - rotating_collections/addItems 2024-03-01 10:57:33 +01:00
serials Bug 29818: Cannot save subscription frequency without display order 2024-12-05 23:05:45 +00:00
services
…
skel
…
suggestion Bug 37246: Use the same dropdown for filtering and editing/adding budgets 2024-11-18 17:52:00 +00:00
svc Bug 37056: Mount a new intranet_svc api to avoid redirects 2024-11-18 17:42:23 +00:00
t Bug 36662: Move test files to the correct folder structure 2025-03-20 20:43:11 +00:00
tags Bug 34478: Add 'op' to tags/review 2024-03-01 10:58:25 +01:00
tools Bug 38452: Use lc() for case insensitivity 2025-03-13 21:29:31 +00:00
virtualshelves Bug 37285: (QA follow-up) Perl Tidy 2024-08-29 15:06:09 +00:00
xt Bug 37490: Add a test to detect when yarn.lock is not updated 2024-11-15 20:43:22 +00:00
.editorconfig
…
.eslintrc.json Bug 36400: Centralize {js,ts,vue} formatting config in .prettierrc.js 2024-04-22 08:57:39 +02:00
.gitignore Bug 36546: (QA follow-up) Add bundle spec to .gitignore 2024-04-30 15:55:37 -03:00
.htaccess
…
.mailmap Bug 36943: (follow-up) 24.05.00 - Update .mailmap 2024-05-24 15:36:40 +02:00
.perlcriticrc
…
.perltidyrc
…
.prettierrc.js Bug 36400: (follow-up) remove option editorconfig from .prettierrc.js 2024-04-22 08:57:40 +02:00
.proverc.dist
…
.stylelintrc.json
…
INSTALL
…
Koha.pm Increment version for 24.05.07 release 2025-02-26 11:03:46 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 38779: Add built record sources assets on install 2025-02-19 14:28:04 +13:00
README
…
README.md
…
README.robots
…
about.pl Bug 37509: Check Elasticsearch info for both 'about' and 'sysinfo' tabs 2024-09-06 16:52:55 +00:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-05-14 15:04:37 -03:00
build-resources.PL
…
changelanguage.pl
…
cpanfile Bug 33018: debian package tidy-up (2) 2025-03-20 01:42:27 +00:00
cypress.config.ts Bug 36012: Extend cypress's requestTimeout value 2024-03-22 15:07:36 +01:00
fix-perl-path.PL
…
gulpfile.js Bug 36730: (Bug 35428 follow-up) po files (sometimes) fail to update 2024-05-07 15:53:44 +02:00
help.pl
…
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-07-18 19:31:50 +00:00
package.json Bug 37824: Replace webpack with rspack for fun and profit 2024-12-05 18:54:16 +00:00
rewrite-config.PL
…
rspack.config.js Bug 37824: (QA follow-up) Fix improper handling of jQuery and DataTables libraries by marking them as externals 2024-12-05 18:54:16 +00:00
tsconfig.json
…
webpack.config.js Bug 35919: Add record sources admin page 2024-04-26 17:06:04 +02:00
yarn.lock Bug 37824: Replace webpack with rspack for fun and profit 2024-12-05 18:54:16 +00:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo