From d1f8eb6460d459e8b598e12bd28bf41cf493a2ee Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Wed, 27 May 2026 01:39:35 +0000
Subject: [PATCH] Bug 42224: [22.11.x] (follow-up) Additional follow-up needed
 for 22.11.x

Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
---
 .../prog/en/includes/columns_settings.inc     |  20 +--
 .../prog/en/includes/datatables.inc           |   1 +
 .../prog/js/datatables_buttons_shim.js        | 124 ++++++++++++++++++
 3 files changed, 126 insertions(+), 19 deletions(-)
 create mode 100644 koha-tmpl/intranet-tmpl/prog/js/datatables_buttons_shim.js

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
index 4a28e1ffeb..b4d83285fa 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
@@ -52,25 +52,7 @@ function KohaTable(id_selector, dt_parameters, table_settings, add_filters) {
         }
     }
 
-    const export_format_print = {
-        body: function (data, row, column, node) {
-            const newnode = node.cloneNode(true);
-            const no_export_nodes = newnode.querySelectorAll(".noExport");
-            no_export_nodes.forEach(child => {
-                child.parentNode.removeChild(child);
-            });
-            //Note: innerHTML is the same thing as the data variable,
-            //minus the ".noExport" nodes that we've removed
-            //Note: See dataTables.buttons.js for original function usage
-            const str = DataTable.Buttons.stripData(newnode.innerHTML, {
-                decodeEntities: false,
-                stripHtml: true,
-                stripNewlines: true,
-                trim: true,
-            });
-            return str;
-        },
-    };
+    const export_format_print = ButtonsShim.export_format_print;
 
     var export_format = {
         body: function ( data, row, column, node ) {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc
index a545868ce7..109d16dc20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc
@@ -3,3 +3,4 @@
 [% INCLUDE 'format_price.inc' %]
 [% Asset.js("lib/datatables/datatables.min.js") | $raw %]
 [% Asset.js("js/datatables.js") | $raw %]
+[% Asset.js("js/datatables_buttons_shim.js") | $raw %]
diff --git a/koha-tmpl/intranet-tmpl/prog/js/datatables_buttons_shim.js b/koha-tmpl/intranet-tmpl/prog/js/datatables_buttons_shim.js
new file mode 100644
index 0000000000..a51d69ee6d
--- /dev/null
+++ b/koha-tmpl/intranet-tmpl/prog/js/datatables_buttons_shim.js
@@ -0,0 +1,124 @@
+window.ButtonsShim = {};
+
+ButtonsShim.export_format_print = {
+    body: function (data, row, column, node) {
+        const newnode = node.cloneNode(true);
+        const no_export_nodes = newnode.querySelectorAll(".noExport");
+        no_export_nodes.forEach(child => {
+            child.parentNode.removeChild(child);
+        });
+        //Note: innerHTML is the same thing as the data variable,
+        //minus the ".no-export" nodes that we've removed
+        //Note: See dataTables.buttons.js for original function usage
+        const str = ButtonsShim.stripData(newnode.innerHTML, {
+            decodeEntities: false,
+            stripHtml: true,
+            stripNewlines: true,
+            trim: true,
+        });
+        return str;
+    },
+};
+
+
+ButtonsShim._stripHtml = function (input) {
+    var _max_str_len = Math.pow(2, 28);
+    var _re_html = /<([^>]*>)/g;
+    if (! input || typeof input !== 'string') {
+        return input;
+    }
+    // Irrelevant check to workaround CodeQL's false positive on the regex
+    if (input.length > _max_str_len) {
+        throw new Error('Exceeded max str len');
+    }
+    var previous;
+    input = input.replace(_re_html, ''); // Complete tags
+    // Safety for incomplete script tag - use do / while to ensure that
+    // we get all instances
+    do {
+        previous = input;
+        input = input.replace(/<script/i, '');
+    } while (input !== previous);
+    return previous;
+};
+
+ButtonsShim.stripHtml = function (mixed) {
+    var type = typeof mixed;
+
+    if (type === 'function') {
+        ButtonsShim._stripHtml = mixed;
+        return;
+    }
+    else if (type === 'string') {
+        return ButtonsShim._stripHtml(mixed);
+    }
+    return mixed;
+};
+ButtonsShim.stripHtmlScript = function (input) {
+    var previous;
+    do {
+        previous = input;
+        input = input.replace(/<script\b[^<]*(?:(?!<\/script[^>]*>)<[^<]*)*<\/script[^>]*>/gi, '');
+    } while (input !== previous);
+    return input;
+};
+ButtonsShim.stripHtmlComments = function (input) {
+    var previous;
+    do {
+        previous = input;
+        input = input.replace(/(<!--.*?--!?>)|(<!--[\S\s]+?--!?>)|(<!--[\S\s]*?$)/g, '');
+    } while (input !== previous);
+    return input;
+};
+ButtonsShim.stripData = function (str, config) {
+    // If the input is an HTML element, we can use the HTML from it (HTML might be stripped below).
+    if (str !== null && typeof str === 'object' && str.nodeName && str.nodeType) {
+        str = str.innerHTML;
+    }
+
+    if (typeof str !== 'string') {
+        return str;
+    }
+
+    // Always remove script tags
+    //str = Buttons.stripHtmlScript(str);
+    str = ButtonsShim.stripHtmlScript(str);
+
+    // Always remove comments
+    //str = Buttons.stripHtmlComments(str);
+    str = ButtonsShim.stripHtmlComments(str);
+
+    if (!config || config.stripHtml) {
+        //str = DataTable.util.stripHtml(str);
+        str = ButtonsShim.stripHtml(str);
+    }
+
+    if (!config || config.trim) {
+        str = str.trim();
+    }
+
+    if (!config || config.stripNewlines) {
+        str = str.replace(/\n/g, ' ');
+    }
+
+/*
+    if (!config || config.decodeEntities) {
+        if (_entityDecoder) {
+            str = _entityDecoder(str);
+        }
+        else {
+            _exportTextarea.innerHTML = str;
+            str = _exportTextarea.value;
+        }
+    }
+*/
+
+    // Prevent Excel from running a formula
+    if (!config || config.escapeExcelFormula) {
+        if (str.match(/^[=@\t\r]/)) {
+            str = "'" + str;
+        }
+    }
+
+    return str;
+};