gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
50,234 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
David Cook 54a804b0fe Bug 31165: Scrub "Public note" field for Course Reserves 
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save

6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"

12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"

16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit cf3874f8a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
 		2025-03-24 15:39:28 +00:00
C4 Bug 37784: [24.05] Do not show forbidden columns in reports dictionary 2025-03-24 15:32:38 +00:00
Koha Bug 37784: [24.05] (QA follow-up) Add few tables to Koha::Database::Columns 2025-03-24 15:33:41 +00:00
acqui Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
admin Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
api Bug 28907: REST - Remove allow-owner from public article requests cancel route 2025-02-24 18:37:36 +00:00
authorities Bug 25387: (QA follow-up) Tidy 2024-10-07 19:14:03 +02:00
basket Bug 33102: Display fields from biblioitems in OPAC/staff interface cart 2023-05-12 16:34:19 +01:00
bin
…
catalogue Bug 35294: Fix typos in catalogue code comments 2024-10-07 19:06:09 +02:00
cataloguing Bug 24879: Add check_cookie_auth when missing 2024-03-25 08:23:03 +00:00
circ Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
clubs Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
course_reserves Bug 31893: Use checkauth and do not fetch about.tt template 2023-01-31 14:09:05 +00:00
debian Bug 36149: Unset userenv from middleware 2024-04-24 10:48:12 +00:00
docs Bug 37003: (follow-up) Amend 22.11 RMaint 2024-10-07 19:09:20 +02:00
erm Bug 32922: Remove space in shebang 2023-02-24 07:51:37 +00:00
errors Bug 29420: HTTP status code incorrect when calling error pages directly under Plack/PSGI 2022-04-20 09:03:39 -10:00
etc Bug 30843: Add mfa_range configuration option for TOTP 2023-10-17 16:56:21 +00:00
ill Bug 28909: Allow illview to use backend template 2022-08-09 13:21:39 -03:00
installer increment version for 22.11.24 release 2025-02-26 17:01:39 +00:00
koha-tmpl Bug 31165: Scrub "Public note" field for Course Reserves 2025-03-24 15:39:28 +00:00
labels Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
lib/CGI/Session/Serialize Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
members Bug 34910: (follow-up) alert in patron details 2023-11-13 15:22:12 +00:00
misc generate release notes for 22.11.24 2025-02-26 17:28:39 +00:00
offline_circ Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
opac Bug 37370: Return 400 if OpacExportOptions does not contain the passed format 2024-08-13 11:54:00 -03:00
patron_lists Bug 16446: Add ability to add patrons to list by borrowernumber 2021-10-21 12:24:04 +02:00
patroncards Bug 24001: Fix patron card template edition 2022-04-28 10:49:20 -10:00
plugins Bug 30367: (follow-up) Same adjustment for gitlab 2023-05-12 15:58:09 +01:00
pos Bug 34331: Use register from userenv if parameter not passed 2023-08-31 10:23:50 +00:00
recalls Bug 34013: Recalls awaiting pickup doesn't show count on each tab 2023-07-18 11:21:31 +00:00
reports Bug 37784: [24.05] (QA follow-up) Bail out to new definition 2025-03-24 15:33:19 +00:00
reserve Bug 34634: Show expirationdate of expired holds on reserve/request.pl 2023-09-15 09:33:06 +00:00
reviews Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
rotating_collections Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
serials Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:29:11 +00:00
services Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
skel
…
suggestion Bug 35276: Remove authentication params from suggestion hash 2023-11-16 09:37:10 +00:00
svc Bug 37508: Throw error if password column is detected in SQL report 2024-08-13 11:54:01 -03:00
t Bug 36081: Fix tests 2025-02-26 12:17:35 -03:00
tags Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
tools Bug 39170: Improve validation of report ID 2025-02-24 17:00:49 +00:00
virtualshelves Bug 34650: Remove unnecessary CSRF check on edit_form 2023-09-08 09:47:28 +00:00
xt Bug 37018: Add 400 response definition to all routes 2024-07-23 15:35:16 +02:00
.editorconfig Bug 27375: Set YAML file settings in .editorconfig 2021-11-03 15:40:52 +01:00
.eslintrc.json
…
.gitignore Bug 35174: Add misc/translator/po to .gitignore 2023-11-22 09:37:30 +01:00
.htaccess
…
.mailmap Update .mailmap 2023-07-18 09:22:47 +00:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.perltidyrc Bug 30002: Adjust perltidy 2023-07-12 09:16:19 +00:00
.proverc.dist Bug 19821: Install sample data, ES mappings and Version syspref 2021-10-25 11:27:40 +02:00
.stylelintrc.json Bug 31528: (follow-up) A few additional rules 2022-10-03 08:23:15 -03:00
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm increment version for 22.11.24 release 2025-02-26 17:01:39 +00:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 30002: (QA follow-up) Add .perltidyrc to Makefile.PL mapping 2023-07-12 09:41:28 +00:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 35174: Add a warning to the about page 2023-11-22 09:37:14 +01:00
app.psgi Bug 36149: Add userenv middleware to app.psgi 2024-04-24 10:50:45 +00:00
build-resources.PL Bug 32609: Use the current yarn.lock to generate node_modules 2023-03-10 12:27:47 +00:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 38467: (follow-up) Update cpanfile 2025-02-19 14:33:45 +00:00
cypress.json Bug 33408: Extend defaultCommandTimeout for cypress 2023-05-15 13:15:43 +00:00
fix-perl-path.PL Bug 28606: Remove $DEBUG and $ENV{DEBUG} 2021-06-24 11:53:44 +02:00
gulpfile.js Bug 35174: Don't run gulp po commands if po dir is missing 2023-11-22 09:37:36 +01:00
help.pl Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
kohaversion.pl
…
mainpage.pl Bug 30493: (QA follow-up) Fix for the only_my_library case as well 2024-10-07 19:07:20 +02:00
package.json Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00
rewrite-config.PL Bug 28519: Put CGI::Session::Serialize::yamlxs in lib directory 2021-06-17 10:07:36 +02:00
tsconfig.json Bug 32030: Move cypress to t - fix build_js/watch_js 2022-11-08 09:44:52 -03:00
webpack.config.js Bug 32806: Move main-erm.ts to modules/erm.ts 2023-02-28 18:54:57 +00:00
yarn.lock Bug 33066: Introduce a KohaTable Vue component 2023-05-11 17:01:22 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo