[Bug 40717] New: Notes scrubber is too strict for some cases
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Bug ID: 40717 Summary: Notes scrubber is too strict for some cases Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: lisette@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Bug 31165 added scrubbing to course reserves public note Many libraries use the public note to link to courses on their website, other resources, etc. Additionally bug 33337 talks about scrubbing patron public notes, but those are also used sometimes for links, such as other patrons that can check out their items but not guarantaurs. I recommend changing it to something like what Lucas did on Bug 38960 https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183774&action=diff which allows for some links but is not all links: a => { href => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i, class => qr/^[\w\s\-_]+$/, title => 1, target => qr/^_(?:blank|self|parent|top)$/, rel => qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/, property => qr/^[\w\s]+$/, typeof => qr/^[\w\s]+$/, resource => qr/^[#\w\-_]+$/, }, -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38960 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=31165 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- GIT URL| |33337 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38498 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #1 from David Cook <dcook@prosentient.com.au> --- *** Bug 38498 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- I opened bug 38498 a while ago to add "id" and "class", but this makes a lot of sense too in terms of attributes. As for the "a" element... I think we'll want to be careful. I created the "note" profile to be re-usable for other types of notes. If it's staff-created notes, it's probably fine. If it's user-created notes, then there's some danger. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |31165 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31165 [Bug 31165] "Public note" field in course reserve should restrict HTML usage -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Btw in this case, I don't think we'd need the "property", "typeof", or "resource" attributes, since those are specific to Schema.org for the record display. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 --- Comment #4 from Lisette Scheer <lisette@bywatersolutions.com> --- (In reply to David Cook from comment #2)
I opened bug 38498 a while ago to add "id" and "class", but this makes a lot of sense too in terms of attributes.
As for the "a" element... I think we'll want to be careful. I created the "note" profile to be re-usable for other types of notes. If it's staff-created notes, it's probably fine. If it's user-created notes, then there's some danger.
I think it would be worth having 2 profiles, one for staff that's slightly more permissive and the current profile or very similar for patron created notes. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Raina <raina@flo.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |raina@flo.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42047 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org