From bugzilla-daemon@bugs.koha-community.org Thu Sep  3 21:50:47 2026
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 43468] New: script tags in additional-contents
 should be scrubbed/disallowed
Date: Thu, 03 Sep 2026 21:50:45 +0000
Message-ID: <bug-43468-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6079718017503178086=="

--===============6079718017503178086==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43468

            Bug ID: 43468
           Summary: script tags in additional-contents should be
                    scrubbed/disallowed
   Initiative type: ---
        Sponsorship ---
            status:
           Product: Koha
           Version: Main
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5 - low
         Component: Staff interface
          Assignee: koha-bugs@lists.koha-community.org
          Reporter: lucas@bywatersolutions.com
        QA Contact: testopia@bugs.koha-community.org
                CC: gmcharlt@gmail.com
  Target Milestone: ---

to recreate:

1. add a news item like:
<script>
console.log('hello world')
</script>

2. go to the main page and see in the console, hello world 

Is there a reason to allow this? Shouldn't all JS go in via the UserJS system
prefs?

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============6079718017503178086==--