From 61056b323e98ad55cd8d596d2d3f6cc421e2a2f7 Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Tue, 31 Mar 2026 12:04:58 +0200
Subject: [PATCH] Bug 42224: (Bug 40524 follow-up) [24.11.x] Fix XSS in
 columns_settings.inc

Bug 40524 fixed XSS issue in koha-tmpl/intranet-tmpl/prog/js/datatables.js

But in 24.11 and lower, DataTable are also build with koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
So same fix needs to applied.

Also in 24.11.x and lower the columns use "noExport" instead of "no-export"

Test plan:
Use the one from Bug 40524

Signed-off-by: David Cook <dcook@prosentient.com.au>
---
 .../prog/en/includes/columns_settings.inc     | 22 ++++++++++++++++++-
 koha-tmpl/intranet-tmpl/prog/js/datatables.js |  4 ++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
index 7015e5f0fd..21e80e63a0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
@@ -89,6 +89,26 @@ function KohaTable(id_selector, dt_parameters, table_settings, add_filters, defa
         }
     }
 
+    const export_format_print = {
+        body: function (data, row, column, node) {
+            const newnode = node.cloneNode(true);
+            const no_export_nodes = newnode.querySelectorAll(".noExport");
+            no_export_nodes.forEach(child => {
+                child.parentNode.removeChild(child);
+            });
+            //Note: innerHTML is the same thing as the data variable,
+            //minus the ".noExport" nodes that we've removed
+            //Note: See dataTables.buttons.js for original function usage
+            const str = DataTable.Buttons.stripData(newnode.innerHTML, {
+                decodeEntities: false,
+                stripHtml: true,
+                stripNewlines: true,
+                trim: true,
+            });
+            return str;
+        },
+    };
+
     var export_format = {
         body: function ( data, row, column, node ) {
             var newnode = $(node);
@@ -141,7 +161,7 @@ function KohaTable(id_selector, dt_parameters, table_settings, add_filters, defa
             exportOptions: {
                 columns: exportColumns,
                 rows: exportRows,
-                format:  export_format
+                format:  export_format_print
             },
         }
     ];
diff --git a/koha-tmpl/intranet-tmpl/prog/js/datatables.js b/koha-tmpl/intranet-tmpl/prog/js/datatables.js
index 4af6726e48..a2fe06c95f 100644
--- a/koha-tmpl/intranet-tmpl/prog/js/datatables.js
+++ b/koha-tmpl/intranet-tmpl/prog/js/datatables.js
@@ -705,12 +705,12 @@ function _dt_buttons(params){
     const export_format_print = {
         body: function (data, row, column, node) {
             const newnode = node.cloneNode(true);
-            const no_export_nodes = newnode.querySelectorAll(".no-export");
+            const no_export_nodes = newnode.querySelectorAll(".noExport");
             no_export_nodes.forEach(child => {
                 child.parentNode.removeChild(child);
             });
             //Note: innerHTML is the same thing as the data variable,
-            //minus the ".no-export" nodes that we've removed
+            //minus the ".noExport" nodes that we've removed
             //Note: See dataTables.buttons.js for original function usage
             const str = DataTable.Buttons.stripData(newnode.innerHTML, {
                 decodeEntities: false,