https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43468 Bug ID: 43468 Summary: script tags in additional-contents should be scrubbed/disallowed Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff interface Assignee: koha-bugs@lists.koha-community.org Reporter: lucas@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com Target Milestone: --- to recreate: 1. add a news item like: <script> console.log('hello world') </script> 2. go to the main page and see in the console, hello world Is there a reason to allow this? Shouldn't all JS go in via the UserJS system prefs? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.