https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|12123 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12123 [Bug 12123] HTML notices can break the notice viewer -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Brendan Lawlor <blawlor@clamsnet.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188143|0 |1 is obsolete| | --- Comment #2 from Brendan Lawlor <blawlor@clamsnet.org> --- Created attachment 188404 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188404&action=edit Bug 41053: Move notice contents to hidden div With thanks to Jonathan for suggesting this direction. Test plan: Go to patron detail, notices tab for a patron with some notices. Look for a string that only occurs in the notice text of some notice. Without this patch, you should not find that one. With this patch, you should find it. Manipulate the text of a notice to check display of bad html. (Click title.) * Like: update message_queue set content='<p>test</p><a href="' where message_id=X; Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 --- Comment #4 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Brendan Lawlor from comment #2)

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Great. Thx -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Katie Bliss <kebliss@dmpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kebliss@dmpl.org -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@openfifth.c |y.org |o.uk Depends on|39410 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39410 [Bug 39410] Notice display modal should use shadow dom -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 --- Comment #6 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Adding some history I found whilst digging into this.. I'm slightly concerned we're removing sandboxing with this patch. --- Bug 12123 (2014) - Iframe introduced - Problem: HTML notices with malformed HTML (unclosed tags, invalid nesting like <blockquote> inside <p>) were breaking the notice viewer interface - Solution: Used <iframe srcdoc="..."> to sandbox the HTML content and prevent it from affecting the parent page structure - Key quote: "Depending on the content of an html notice, it can cause the notice to either not be collapsible, be uncollapsible, or to be permanently collapsed." Bug 39410 (March 2025) - Shadow DOM added - Problem: Notice previews in the staff interface showed Bootstrap styles that wouldn't actually appear in emails/prints sent to patrons - Solution: When displaying the notice modal, the content from the iframe's srcdoc is loaded into a Shadow DOM to isolate CSS - Result: More accurate preview showing what patrons actually see Bug 41053 (This bug) - Changed the iframe to a hidden div - Problem: Browser search (Ctrl+F) couldn't find text in the iframe's srcdoc attribute - Solution: Changed from iframe to <div style="display:none;"> with content as innerHTML - Benefit: Search now works again - users can search notice content - Note: Shadow DOM is still used when displaying the modal, maintaining CSS isolation Potential Disadvantages of the Current Approach 1. Loss of HTML Isolation in the DOM The iframe provided complete sandboxing - malformed HTML couldn't escape and affect the page. With a div, even though the content is HTML-escaped ([% QUEUED_MESSAGE.html_content | html %]), there's theoretically more risk if: - The Template Toolkit escaping fails - There's a bug in the escaping mechanism - Extremely malformed HTML somehow breaks through 2. Security Considerations - The iframe's srcdoc provided an additional layer of XSS protection - The current approach relies on Template Toolkit's | html filter being robust All in all, I "think" the Change is Likely Safe, but i want to test with some really malformed notices before passing qa -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #7 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- OK.. I've tried throwing in a bunch of weird and wonderful html in the welcome notice and sent it to my test user.. so far I'm unable to break the display in chrome.. I reckon lets go with this. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00 |25.11.00,25.05.06 released in| | Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41053 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting CC| |fridolin.somers@biblibre.co | |m --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- Depends on Bug 39410 not in 24.11.x -- You are receiving this mail because: You are watching all bug changes.