[Bug 23978] New: notes field in saved reports should allow HTML
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Bug ID: 23978 Summary: notes field in saved reports should allow HTML Change sponsored?: --- Product: Koha Version: 18.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs@lists.koha-community.org Reporter: theod@lib.auth.gr QA Contact: testopia@bugs.koha-community.org In recent Koha 18.11, parsing of HTML tags was removed from many fields for security reasons. However, as also seen in 22938, 22702, 22501, 23194, 23683 there are places where HTML (or at leas line breaks!) are required, or the output is too messy. The 'notes' field in the "Guided reports wizard › Saved reports" displays the data that is previously entered in a textarea. However, the guided_reports_start.tt does not parse the HTML (nor line breaks), so the output in the resulting table is all in one line! As with the other patches, I propose that we allow HTML in report notes, so one can use strong/italics/colors/urls in notes, and most importantly, line breaks! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Theodoros Theodoropoulos <theod@lib.auth.gr> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22938, | |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22702, | |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=22501, | |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=23194, | |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=23683 Patch complexity|--- |Trivial patch Severity|enhancement |trivial -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #1 from Theodoros Theodoropoulos <theod@lib.auth.gr> --- Created attachment 95107 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=95107&action=edit Allow HTML in saved reports note field -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Theodoros Theodoropoulos <theod@lib.auth.gr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #95107|0 |1 is obsolete| | --- Comment #2 from Theodoros Theodoropoulos <theod@lib.auth.gr> --- Created attachment 95108 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=95108&action=edit Allow HTML in saved reports note field patch based on Koha 18.11.06 code -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Theodoros Theodoropoulos <theod@lib.auth.gr> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |theod@lib.auth.gr |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Theodoros Theodoropoulos <theod@lib.auth.gr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de Version|18.11 |master --- Comment #3 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Hi Theodoros, all patches must be based on the current master branch and if it's a bug will then be backported to the older supported versions. Also, you need to create a patch, not just a diff - the file is missing some necessary information and can't be applied with our tools. Do you want to have another go at this? Please let us know if we can help! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|notes field in saved |Notes field in saved |reports should allow HTML |reports should allow for | |HTML -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Séverine Queune <severine.queune@bulac.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |severine.queune@bulac.fr -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Mirjam Vantieghem <mirjam.vantieghem@etf.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mirjam.vantieghem@etf.edu -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #4 from Mirjam Vantieghem <mirjam.vantieghem@etf.edu> --- +1 We are currently using a custom patch to achieve this. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 161711 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=161711&action=edit Bug 23978: Expose HTML in Reports This patch updates the notes field to a $raw filter to prevent html escaping of the data within it. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|theod@lib.auth.gr |martin.renvoize@ptfs-europe | |.com CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|trivial |normal -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #95108|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Is there a more secure way of doing this rather than just exposing the raw html.. I feel like we're just undoing a security flaw we fixed for a reason. Is it time to use markdown for rich text or perhaps for linebreaks just outputting the note field in a pre/code block? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- (In reply to Martin Renvoize from comment #6)
Is there a more secure way of doing this rather than just exposing the raw html.. I feel like we're just undoing a security flaw we fixed for a reason.
Yeah I don't think we can just expose the raw HTML. One option would be to use the HTML scrubber. I think there are quite a few parts of Koha where people want to use HTML, but could be limited to a fairly small subset of elements and attributes.
Is it time to use markdown for rich text or perhaps for linebreaks just outputting the note field in a pre/code block?
For line breaks, the "html_line_break" filter can be useful. For notes, adding that line break filter would make sense. I don't know that any other HTML features would really needed though. If they were to be added, I think we'd have to scrub them first. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no Status|Needs Signoff |Failed QA --- Comment #8 from Magnus Enger <magnus@libriotech.no> --- (In reply to Martin Renvoize from comment #5)
This patch updates the notes field to a $raw filter to prevent html escaping of the data within it.
(In reply to David Cook from comment #7)
Yeah I don't think we can just expose the raw HTML.
Sounds like a security problem and a FQA to me. Please set back to NSO if you disagree. :-) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=19613 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #161711|0 |1 is obsolete| | --- Comment #9 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 182627 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182627&action=edit Bug 23978: Expose HTML in Reports This patch updates the notes field to a $raw filter to prevent html escaping of the data within it. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #10 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 182628 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182628&action=edit Bug 23978: (QA follow-up) Use html_scrubber This followup replaces the $raw filter with `scrub_html type => 'note' | $raw`. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|martin.renvoize@openfifth.c |theod@lib.auth.gr |o.uk | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #11 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- I added a QA follow-up here which should hopefully resolve the security side of it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- I'm guessing one of the rebase scripts was this and it's altered the authorship. I'll look at fixing that... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182628|0 |1 is obsolete| | --- Comment #13 from David Cook <dcook@prosentient.com.au> --- Created attachment 182642 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182642&action=edit Bug 23978: (QA follow-up) Use html_scrubber This followup replaces the $raw filter with `scrub_html type => 'note' | $raw`. Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Notes field in saved |Notes field in saved |reports should allow for |reports should allow for |HTML |(scrubbed) HTML -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182627|0 |1 is obsolete| | --- Comment #14 from David Cook <dcook@prosentient.com.au> --- Created attachment 182643 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182643&action=edit Bug 23978: Expose HTML in Reports This patch updates the notes field to a $raw filter to prevent html escaping of the data within it. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #182642|0 |1 is obsolete| | --- Comment #15 from David Cook <dcook@prosentient.com.au> --- Created attachment 182644 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=182644&action=edit Bug 23978: (QA follow-up) Use html_scrubber This followup replaces the $raw filter with `scrub_html type => 'note' | $raw`. Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|martin.renvoize@openfifth.c |dcook@prosentient.com.au |o.uk | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_25_11_candidate -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #16 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Mirjam Vantieghem <mirjam.vantieghem@etf.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40079 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|25.11.00 |25.11.00,25.05.01 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #17 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x for 25.05.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This enhancement to the release notes| |notes field for saved SQL | |reports now allows the use | |of selected HTML in the | |field. CC| |david@davidnind.com --- Comment #18 from David Nind <david@davidnind.com> --- I had a go at a release note, but I'm not sure that I got what this does right. Some things I noticed - should these be separate bugs? 1. In the table listing saved reports, the HTML code is shown in the notes column. 2. When you view the report (list of reports > Actions > View), the notes text is all over the place: - The "Notes" label is indented - None of the note text is aligned properly, even if you use paragraph tags for every line in the note 3. When you run the report, the notes text is formatted correctly above the report results (as expected). -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |baptiste.wojtkowski@biblibr | |e.com Status|Pushed to stable |Needs documenting --- Comment #19 from Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski@biblibre.com> --- Enhancement, not backported to 24.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Ray Delahunty <raymund.delahunty@outlook.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=41529 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_25_11_candidate | CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #20 from David Cook <dcook@prosentient.com.au> --- (In reply to David Nind from comment #18)
I had a go at a release note, but I'm not sure that I got what this does right.
Some things I noticed - should these be separate bugs?
1. In the table listing saved reports, the HTML code is shown in the notes column.
2. When you view the report (list of reports > Actions > View), the notes text is all over the place: - The "Notes" label is indented - None of the note text is aligned properly, even if you use paragraph tags for every line in the note
3. When you run the report, the notes text is formatted correctly above the report results (as expected).
Just noticed your comments now, David. Are these bugs still valid? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #21 from David Nind <david@davidnind.com> --- (In reply to David Cook from comment #20)
(In reply to David Nind from comment #18)
I had a go at a release note, but I'm not sure that I got what this does right.
Some things I noticed - should these be separate bugs?
1. In the table listing saved reports, the HTML code is shown in the notes column.
2. When you view the report (list of reports > Actions > View), the notes text is all over the place: - The "Notes" label is indented - None of the note text is aligned properly, even if you use paragraph tags for every line in the note
3. When you run the report, the notes text is formatted correctly above the report results (as expected).
Just noticed your comments now, David. Are these bugs still valid?
Just tested, and they still exist. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 --- Comment #22 from David Cook <dcook@prosentient.com.au> --- (In reply to David Nind from comment #21)
(In reply to David Cook from comment #20)
(In reply to David Nind from comment #18)
I had a go at a release note, but I'm not sure that I got what this does right.
Some things I noticed - should these be separate bugs?
1. In the table listing saved reports, the HTML code is shown in the notes column.
2. When you view the report (list of reports > Actions > View), the notes text is all over the place: - The "Notes" label is indented - None of the note text is aligned properly, even if you use paragraph tags for every line in the note
3. When you run the report, the notes text is formatted correctly above the report results (as expected).
Just noticed your comments now, David. Are these bugs still valid?
Just tested, and they still exist.
Yeah I think those should probably be separate bug reports. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |raymund.delahunty@outlook.c | |om --- Comment #23 from David Cook <dcook@prosentient.com.au> --- *** Bug 41529 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org