https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260
--- Comment #657 from Andrew Fuerste-Henry <[email protected]> --- Created attachment 209967 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209967&action=edit Bug 33260: (QA follow-up) Print notices in sandboxed frames The content of a notice was printed as part of the page of the staff interface, so a script in a notice (the content of notices is not always under the control of the library, it can contain what a patron entered) would run in the session of the staff member printing it. Show each notice in a frame, as the notices management page and the Notices tab of a patron do for the preview: its sandbox does not allow scripts, forms or navigating the page, it is only the same origin so the frame can be sized to its content, which is needed to print it whole. * The notice is shown by html_content, which has the stylesheets, so the scoping of the styles of the notices to the page, which a regular expression got wrong more than once, is no longer needed and is removed. The style of the template of the notice is part of html_content. * The content of a plain text notice is escaped by html_content, as what looks like markup in it was interpreted. To test: 1. Apply the patches, enable NoticesManagement 2. Create an HTML notice for a patron, with a script in its content, for example <script>alert(1)</script><p>Hello</p> and set its status to sent 3. In Tools > Notices management, or the Notices tab of the patron, print it => The notice is printed with no alert, and the browser console says that the script was blocked. Before there was an alert 4. Print a few notices together and confirm the print preview shows all of them in full, separated by page breaks 5. prove t/db_dependent/Koha/Notice/Message.t Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: Andrew Fuerste Henry <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
