LP#1902965: HTML filter on OPAC search results and record display

Signed-off-by: Jeff Davis <jdavis@sitka.bclibraries.ca>
Signed-off-by: Jason Boyer <JBoyer@equinoxinitiative.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
Signed-off-by: Jane Sandberg <sandbej@linnbenton.edu>

diff --git a/Open-ILS/src/templates/opac/parts/record/body.tt2 b/Open-ILS/src/templates/opac/parts/record/body.tt2
index 2801670..11cb1ee 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/body.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/body.tt2
@@ -7,10 +7,10 @@
 %]
 <div id='canvas_main' class='canvas' vocab="http://schema.org/" typeof='[% args.schema.itemtype %] Product' resource="#schemarecord">
 [%- FOREACH link IN args.links.sameAs; %]
-    <link property="sameAs" href="[% link %]">
+    <link property="sameAs" href="[% link | html %]">
 [%- END; %]
 [%- FOREACH link IN args.links.exampleOfWork; %]
-    <link property="exampleOfWork" href="[% link %]">
+    <link property="exampleOfWork" href="[% link | html %]">
 [%- END; %]
     [%- INCLUDE "opac/parts/record/navigation.tt2" %]
     [%- IF ctx.bib_is_dead %]

diff --git a/Open-ILS/src/templates/opac/parts/record/contents.tt2 b/Open-ILS/src/templates/opac/parts/record/contents.tt2
index 38f6271..c9c3856 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/contents.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/contents.tt2
@@ -190,7 +190,12 @@ BLOCK render_all_contents;
         content = '';
         df = cont.display_field;
         IF df AND attrs.hl.$df.size;
-            content = '<!-- highlighted -->' _ attrs.hl.$df.join('<br/>');
+            filtered_hl_df = [];
+            FOR hl_df IN attrs.hl.$df;
+                hl_df = hl_df | html;
+                filtered_hl_df.push(hl_df);
+            END;
+            content = '<!-- highlighted -->' _ filtered_hl_df.join('<br/>');
         ELSE;
             content = PROCESS render_contents(xpath=cont.xpath);
         END;

diff --git a/Open-ILS/src/templates/opac/parts/record/series.tt2 b/Open-ILS/src/templates/opac/parts/record/series.tt2
index a5ad664..473e754 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/series.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/series.tt2
@@ -12,7 +12,8 @@ BLOCK render_series;
             url = mkurl(ctx.opac_root _ '/results',
                 { qtype=>'series', query=>search_term }, stop_parms.merge(expert_search_parms, general_search_parms, browse_search_parms, facet_search_parms)
             );
-            series = '<a href="' _ url _ '">' _ s.$hl_field _ '</a> ';
+            filtered_hl_field = s.$hl_field | html;
+            series = '<a href="' _ url _ '">' _ filtered_hl_field _ '</a> ';
             results.push(series);
         END;
     ELSE;

diff --git a/Open-ILS/src/templates/opac/parts/record/subjects.tt2 b/Open-ILS/src/templates/opac/parts/record/subjects.tt2
index f987125..9011853 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/subjects.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/subjects.tt2
@@ -91,7 +91,7 @@
         '<span property="about"><!-- highlighted -->';
         %]<a href="[%-
                mkurl(ctx.opac_root _ '/results', {qtype=>'subject', query=>total_term}, stop_parms.merge(expert_search_parms, general_search_parms, browse_search_parms, facet_search_parms))
-        -%]">[% s.$f %]</a> [%-
+        -%]">[% s.$f | html %]</a> [%-
         '</span>';
     END;
 %]

diff --git a/Open-ILS/src/templates/opac/parts/record/summary.tt2 b/Open-ILS/src/templates/opac/parts/record/summary.tt2
index fb6f84a..43cd0ea 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/summary.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/summary.tt2
@@ -39,7 +39,7 @@
                 isbnissn=attrs.issns.0;
             END;
         %]
-        <a href='http://obalkyknih.cz/view?isbn=[% isbnissn %]'>
+        <a href='http://obalkyknih.cz/view?isbn=[% isbnissn | html %]'>
             <img
               alt="[% l('Image of item') %]" id='rdetail_image'
               src='[% ctx.media_prefix %]/opac/extras/ac/jacket/[% record.summary.jacket_size %]/r/[% ctx.bre_id | uri %]' />
@@ -75,7 +75,7 @@
                 <a href="[% mkurl(ctx.opac_root _ '/place_hold', 
                     {hold_target => ctx.bre_id, hold_type => 'T', hold_source_page => mkurl()}, stop_parms) %]" 
                 class="no-dec" rel="nofollow" vocab=""><img src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
-                    [% img_alt(l('Place Hold on [_1]', attrs.title)) %]/>
+                    [% img_alt(l('Place Hold on [_1]', attrs.title)) | html %]/>
                 <span class="place_hold">[% l('Place Hold') %]</span></a>
             </div>
             [%- END -%]
@@ -85,14 +85,14 @@
                 <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_checkout',
                     {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'checkout'}, stop_parms) %]"
                 class="no-dec" rel="nofollow" vocab=""><img src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
-                    [% img_alt(l('Check Out [_1]', attrs.title)) %]/>
+                    [% img_alt(l('Check Out [_1]', attrs.title)) | html %]/>
                 <span class="place_hold">[% l('Check Out E-Item') %]</span></a>
             </div>
             <div id="[%- ctx.bre_id -%]_ebook_place_hold" class="rdetail_aux_utils ebook_action hidden">
                 <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_place_hold',
                     {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'place_hold'}, stop_parms) %]"
                 class="no-dec" rel="nofollow" vocab=""><img src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
-                    [% img_alt(l('Place Hold on [_1]', attrs.title)) %]/>
+                    [% img_alt(l('Place Hold on [_1]', attrs.title)) | html %]/>
                 <span class="place_hold">[% l('Place Hold on E-Item') %]</span></a>
             </div>
             [%- END -%]
@@ -107,7 +107,7 @@
                     rel="nofollow" vocab=""
                     data-recid="[% ctx.bre_id %]" data-action="add"
                     class="no-dec mylist_action [% IF ctx.mylist.grep('^' _ ctx.bre_id _ '$').size %]hidden[% END %]"
-                    title="[% l("Add [_1] to basket", attrs.title) %]" rel="nofollow" vocab="">
+                    title="[% l("Add [_1] to basket", attrs.title) | html %]" rel="nofollow" vocab="">
                     <img src="[% ctx.media_prefix %]/images/add-to-cart.png[% ctx.cache_key %]" alt="" />
                     [% l("Add to basket") %]
                 </a>
@@ -115,7 +115,7 @@
                      rel="nofollow" vocab=""
                     data-recid="[% ctx.bre_id %]" data-action="delete"
                     class="mylist_action [% IF !ctx.mylist.grep('^' _ ctx.bre_id _ '$').size %]hidden[% END %]"
-                    title="[% l("Remove [_1] from basket", attrs.title) %]" rel="nofollow" vocab="">
+                    title="[% l("Remove [_1] from basket", attrs.title) | html %]" rel="nofollow" vocab="">
                     <img src="[% ctx.media_prefix %]/images/add-to-cart.png[% ctx.cache_key %]" alt="" />
                     [% l("Remove from basket") %]
                 </a>
@@ -213,20 +213,25 @@ IF num_uris > 0;
 <div class="rdetail_uris">
     [%- IF num_uris > 1 %]<ul>[% END %]
     [%- FOR uri IN merged_uris %]
+        [%-
+            filtered_href = uri.href | html;
+            filtered_link = uri.link ? uri.link : '' | html;
+            filtered_note = uri.note ? uri.note : '' | html;
+        -%]
         [%- IF num_uris == 1 -%]
             <p class="rdetail_uri" property="offers" vocab="http://schema.org/" typeof="Offer">
         [%- ELSE -%]
             <li class="rdetail_uri" property="offers" vocab="http://schema.org/" typeof="Offer">
         [%- END -%]
-        <a href="[% uri.href %]" class="uri_link" property="url" target="_blank" rel="noopener">
-        [%- IF uri.href != uri.link;
-                '<span property="description">' _ uri.link _ '</span>';
+        <a href="[% filtered_href %]" class="uri_link" property="url" target="_blank" rel="noopener">
+        [%- IF filtered_href != filtered_link;
+                '<span property="description">' _ filtered_link _ '</span>';
             ELSE;
-                uri.link;
+                filtered_link;
             END;
         -%]
         </a>
-        [%- ' - <span property="description">' _ uri.note _ '</span>' IF uri.note %]
+        [%- ' - <span property="description">' _ filtered_note _ '</span>' IF filtered_note %]
         <link property="availability" href="http://schema.org/OnlineOnly" />
         [%- IF attrs.gtin13; '<meta property="gtin13" content="' _ attrs.gtin13 _ '" />'; END; %]
         [%- IF num_uris == 1 %]</p>[% ELSE %]</li>[% END %]
@@ -329,14 +334,14 @@ END;
 <ul>
     [%- IF attrs.hl.isbn.size; FOR isbn IN attrs.hl.isbn %]
     <li class='rdetail_isbns'>
-        <strong class='rdetail_label'>[% l('ISBN:'); %]</strong> [% isbn %]
+        <strong class='rdetail_label'>[% l('ISBN:'); %]</strong> [% isbn | html %]
     </li>
     [%- END; ELSIF attrs.isbns.0;
           FOR isbn IN attrs.isbns;
             isbn_extra = '';
             IF (matches = isbn.match('^(.+?)(\s.+)$'));
-              isbn = matches.0;
-              isbn_extra = matches.1;
+              isbn = matches.0 | html;
+              isbn_extra = matches.1 | html;
             END;
     %]
     <li class='rdetail_isbns'>
@@ -347,7 +352,7 @@ END;
     [%- END %]
     [%- IF attrs.hl.issn.size; FOR issn IN attrs.hl.issn %]
     <li class='rdetail_issns'>
-        <strong class='rdetail_label'>[% l('ISSN:'); %]</strong> [% issn %]
+        <strong class='rdetail_label'>[% l('ISSN:'); %]</strong> [% issn | html %]
     </li>
     [%- END; ELSIF attrs.issns.0; FOR issn IN attrs.issns %]
     <li class='rdetail_issns'>
@@ -357,9 +362,16 @@ END;
         [%- END %]
     [%- END %]
     [%- IF attrs.hl.physical_description.size %]
+    [%-
+        filtered_hl_phys_desc = [];
+        FOR hl_phys_desc IN attrs.hl.physical_description;
+            hl_phys_desc = hl_phys_desc | html;
+            filtered_hl_phys_desc.push(hl_phys_desc);
+        END;
+    -%]
     <li id='rdetail_phys_desc'>
         <strong class='rdetail_label'>[% l("Physical Description:") %]</strong>
-        <span class='rdetail_value' highlighted='true'>[% attrs.hl.physical_description.join('<br/>') %]</span>
+        <span class='rdetail_value' highlighted='true'>[% filtered_hl_phys_desc.join('<br/>') %]</span>
     </li>
     [%- ELSIF attrs.phys_desc %]
     <li id='rdetail_phys_desc'>
@@ -370,7 +382,7 @@ END;
     [%- IF attrs.hl.edition %]
     <li id='rdetail_edition'>
         <strong class='rdetail_label'>[% l("Edition:") %]</strong>
-        <span class='rdetail_value' highlighted='true'>[% attrs.hl.edition %]</span>
+        <span class='rdetail_value' highlighted='true'>[% attrs.hl.edition | html %]</span>
     [%- ELSIF attrs.edition %]
     <li id='rdetail_edition'>
         <strong class='rdetail_label'>[% l("Edition:") %]</strong>
@@ -395,7 +407,7 @@ END;
     [%- IF attrs.hl.publisher %]
     <li id='rdetail_publisher'>
         <strong class='rdetail_label'>[% l("Publisher:") %]</strong>
-        <span class='rdetail_value' highlighted='true'>[% attrs.hl.publisher %]</span>
+        <span class='rdetail_value' highlighted='true'>[% attrs.hl.publisher | html %]</span>
     </li>
     [%- ELSIF attrs.publisher %]
     <li id='rdetail_publisher'>

diff --git a/Open-ILS/src/templates/opac/parts/result/table.tt2 b/Open-ILS/src/templates/opac/parts/result/table.tt2
index de5e443..b4c3de2 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/result/table.tt2
+++ b/Open-ILS/src/templates/opac/parts/result/table.tt2
@@ -132,7 +132,7 @@
                                                     [% END %]
                                                     <a class='record_title search_link' name='record_[% rec.id %]'
                                                         href="[% mkurl(record_url_path, add_parms, del_parms); %]"
-                                                        [% html_text_attr('title', l('Display record details for "[_1]"', attrs.title)) %]>
+                                                        [% html_text_attr('title', l('Display record details for "[_1]"', attrs.title)) | html%]>
                                                         [% IF attrs.hl.title; attrs.hl.title; ELSE; attrs.title | html; END %]
                                                      </a>
                                                      [% IF rec.mr_constituent_count.defined && rec.mr_constituent_count > 1 %]
@@ -348,7 +348,7 @@ END;
                                                                 <td valign='top'>
                                                                     <strong>[% l('Electronic resource') %]</strong>
                                                                 </td>
-                                                                <td><a href="[% uri.href %]" class="uri_link" target="_blank" rel="noopener">[% uri.link | html %]</a>[% ' - ' _ uri.note | html IF uri.note %]</td>
+                                                                <td><a href="[% uri.href | html %]" class="uri_link" target="_blank" rel="noopener">[% uri.link | html %]</a>[% ' - ' _ uri.note | html IF uri.note %]</td>
                                                             </tr>
                                                             [% END %]
                                                          [% END %]
@@ -448,7 +448,7 @@ END;
                                                         <div class="results_aux_utils place_hold"><a
                                                                 href="[% mkurl(ctx.opac_root _ '/place_hold',
                                                                     add_parms, del_parms) %]"
-                                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) %]
+                                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) | html %]
                                                                     class="no-dec" rel="nofollow" vocab=""><img
                                                                 src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
                                                                 alt=""/><span class="result_place_hold">[% l('Place Hold') %]</span></a>
@@ -460,7 +460,7 @@ END;
                                                             <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_checkout',
                                                                 {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'checkout'},
                                                                 ['query','tag','subfield','term','_special','sort','page']) %]"
-                                                                [% html_text_attr('title', l('Check Out [_1]', attrs.title)) %]
+                                                                [% html_text_attr('title', l('Check Out [_1]', attrs.title)) | html %]
                                                                     class="no-dec" rel="nofollow" vocab=""><img
                                                                 src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
                                                                 alt=""/><span class="result_place_hold">[% l('Check Out E-Item') %]</span></a>
@@ -469,7 +469,7 @@ END;
                                                             <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_place_hold',
                                                                 {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'place_hold'},
                                                                 ['query','tag','subfield','term','_special','sort','page']) %]"
-                                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) %]
+                                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) | html %]
                                                                     class="no-dec" rel="nofollow" vocab=""><img
                                                                 src="[% ctx.media_prefix %]/images/green_check.png[% ctx.cache_key %]"
                                                                 alt=""/><span class="result_place_hold">[% l('Place Hold on E-Item') %]</span></a>
@@ -488,14 +488,14 @@ END;
                                                             <a href="[% addhref %]" id="mylist_add_[% rec.id %]"
                                                                 data-recid="[% rec.id %]" data-action="add"
                                                                 class="mylist_action [% IF ctx.mylist.grep('^' _ rec.id _ '$').size %]hidden[% END %]"
-                                                                title="[% l("Add [_1] to basket", attrs.title) %]" rel="nofollow" vocab="">
+                                                                title="[% l("Add [_1] to basket", attrs.title) | html %]" rel="nofollow" vocab="">
                                                                 <img src="[% ctx.media_prefix %]/images/add-to-cart.png[% ctx.cache_key %]" alt="" />
                                                                 [% l("Add to basket") %]
                                                             </a>
                                                             <a href="[% delhref %]" id="mylist_delete_[% rec.id %]"
                                                                 data-recid="[% rec.id %]" data-action="delete"
                                                                 class="mylist_action [% IF !ctx.mylist.grep('^' _ rec.id _ '$').size %]hidden[% END %]"
-                                                                title="[% l("Remove [_1] from basket", attrs.title) %]" rel="nofollow" vocab="">
+                                                                title="[% l("Remove [_1] from basket", attrs.title) | html %]" rel="nofollow" vocab="">
                                                                 <img src="[% ctx.media_prefix %]/images/add-to-cart.png[% ctx.cache_key %]" alt="" />
                                                                 [% l("Remove from basket") %]
                                                             </a>
@@ -510,7 +510,7 @@ END;
                                                         [% ident = attrs.isbn_clean || attrs.upc %]
                                                         <div class="results_aux_utils result_util">
                                                             <a target='_blank' 
-                                                               [% html_text_attr('title', l('Reviews and More for [_1]', attrs.title)) %]
+                                                               [% html_text_attr('title', l('Reviews and More for [_1]', attrs.title)) | html %]
                                                                 href="[% ctx.ext_proto %]://contentcafe2.btol.com/ContentCafeClient/ContentCafe.aspx?UserID=[%- 
                                                                     ENV.OILS_CONTENT_CAFE_USER %]&amp;Password=[%-
                                                                     ENV.OILS_CONTENT_CAFE_PASS %]&amp;ItemKey=[% ident | uri %]&amp;Options=Y" rel="noopener nofollow" vocab="">