https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=29589 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 --- Comment #1 from Fridolin Somers <fridolin.somers@biblibre.com> ---

git grep '$KohaSpan' -- koha-tmpl/ koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt: [% added.library.branchname | $KohaSpan class = 'name' | $raw %] added to group. koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt: Group [% added.title | $KohaSpan class = 'name' | $raw %] created. koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt: Group [% deleted.title | $KohaSpan class = 'name' | $raw %] has been deleted. koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt: [% deleted.library | $KohaSpan class = 'name' | $raw %] has been removed from group. koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt: A group with the title [% error_duplicate_title | $KohaSpan class = 'name' | $raw %] already exists.

We can reproduce in library groups page : Create a new library group with title : Mygrou</div>pe Save the form. You see a message box with : Group Mygrou -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 --- Comment #2 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 129325 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=129325&action=edit Bug 29853: Add HTML filter before KohaSpan filter Usage of Template Toolkit plugin KohaSpan as filter is actually : Group [% added.title | $KohaSpan class = 'name' | $raw %] created. But KohaSpan filter does not escape HTML characters. Whe should filter HTML then KohaSpan. This patch adds TT html filter before KohaSpan. Also replaces in Javascript html() with text() to ensure special caracters are still encoded. See https://api.jquery.com/text/ Test plan : 1) Create a library with name Libra'rie 2) Create a library group with name Grou'pe 3) Play with this group 4) Add library 5) Remove library 6) Edit group 7) Delete group 8) Each time check that &apos, is not interpreted as single quote -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Solene D <solene.desvaux@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #129325|0 |1 is obsolete| | --- Comment #4 from Solene D <solene.desvaux@biblibre.com> --- Created attachment 130547 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130547&action=edit Bug 29853: Add HTML filter before KohaSpan filter Usage of Template Toolkit plugin KohaSpan as filter is actually : Group [% added.title | $KohaSpan class = 'name' | $raw %] created. But KohaSpan filter does not escape HTML characters. Whe should filter HTML then KohaSpan. This patch adds TT html filter before KohaSpan. Also replaces in Javascript html() with text() to ensure special caracters are still encoded. See https://api.jquery.com/text/ Test plan : 1) Create a library with name Libra'rie 2) Create a library group with name Grou'pe 3) Play with this group 4) Add library 5) Remove library 6) Edit group 7) Delete group 8) Each time check that &apos, is not interpreted as single quote Signed-off-by: Solène Desvaux <solene.desvaux@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |22.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable CC| |kyle@bywatersolutions.com Version(s)|22.05.00 |22.05.00,21.11.03 released in| | --- Comment #8 from Kyle M Hall <kyle@bywatersolutions.com> --- Pushed to 21.11.x for 21.11.03 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29853 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |victor@tuxayo.net Status|Pushed to oldstable |RESOLVED --- Comment #10 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.