From: Jeff Davis <jdavis@sitka.bclibraries.ca>
Date: Mon, 9 Nov 2020 23:45:24 +0000 (-0800)
Subject: LP#1902965: HTML filter on Bootstrap OPAC search results and record display
X-Git-Url: https://old-git.evergreen-ils.org/?a=commitdiff_plain;h=c31d052576e7ff961c6d973b5a1e9297fc4d3152;p=Evergreen.git

LP#1902965: HTML filter on Bootstrap OPAC search results and record display

Signed-off-by: Jeff Davis <jdavis@sitka.bclibraries.ca>
Signed-off-by: Jason Boyer <JBoyer@equinoxinitiative.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
Signed-off-by: Galen Charlton <gmc@equinoxinitiative.org>
Signed-off-by: Jane Sandberg <sandbej@linnbenton.edu>
---

diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/record/body.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/record/body.tt2
index 081e1034b1..b884b1b45a 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/record/body.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/record/body.tt2
@@ -7,10 +7,10 @@
 %]
 <div id='canvas_main' class='container mx-auto p-3' vocab="http://schema.org/" typeof='[% args.schema.itemtype %] Product' resource="#schemarecord">
 [%- FOREACH link IN args.links.sameAs; %]
-    <link property="sameAs" href="[% link %]">
+    <link property="sameAs" href="[% link | html %]">
 [%- END; %]
 [%- FOREACH link IN args.links.exampleOfWork; %]
-    <link property="exampleOfWork" href="[% link %]">
+    <link property="exampleOfWork" href="[% link | html %]">
 [%- END; %]
     [%- INCLUDE "opac/parts/record/navigation.tt2" %]
     [%- IF ctx.bib_is_dead %]
diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/record/contents.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/record/contents.tt2
index 022bdd723b..4daf3be527 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/record/contents.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/record/contents.tt2
@@ -190,7 +190,12 @@ BLOCK render_all_contents;
         content = '';
         df = cont.display_field;
         IF df AND attrs.hl.$df.size;
-            content = '<!-- highlighted -->' _ attrs.hl.$df.join('<br/>');
+            filtered_hl_df = [];
+            FOR hl_df IN attrs.hl.$df;
+                hl_df = hl_df | html;
+                filtered_hl_df.push(hl_df);
+            END;
+            content = '<!-- highlighted -->' _ filtered_hl_df.join('<br/>');
         ELSE;
             content = PROCESS render_contents(xpath=cont.xpath);
         END;
diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/record/series.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/record/series.tt2
index c6894574a8..8f3e57cc19 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/record/series.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/record/series.tt2
@@ -12,7 +12,8 @@ BLOCK render_series;
             url = mkurl(ctx.opac_root _ '/results',
                 { qtype=>'series', query=>search_term }, stop_parms.merge(expert_search_parms, general_search_parms, browse_search_parms, facet_search_parms)
             );
-            series = '<a href="' _ url _ '">' _ s.$hl_field _ '</a> ';
+            filtered_hl_field = s.$hl_field | html;
+            series = '<a href="' _ url _ '">' _ filtered_hl_field _ '</a> ';
             results.push(series);
         END;
     ELSE;
diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/record/subjects.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/record/subjects.tt2
index 7f0f58e11f..9128190245 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/record/subjects.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/record/subjects.tt2
@@ -91,7 +91,7 @@
         '<span property="about"><!-- highlighted -->';
         %]<a href="[%-
                mkurl(ctx.opac_root _ '/results', {qtype=>'subject', query=>total_term}, stop_parms.merge(expert_search_parms, general_search_parms, browse_search_parms, facet_search_parms))
-        -%]">[% s.$f %]</a> [%-
+        -%]">[% s.$f | html %]</a> [%-
         '</span>';
     END;
 %]
diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/record/summary.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/record/summary.tt2
index 8d4d810831..37fcdf626e 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/record/summary.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/record/summary.tt2
@@ -28,12 +28,12 @@ ctx.metalinks.push('
             END;
             %]
             <a href='http://obalkyknih.cz/view?isbn=[% isbnissn %]'>
-                <img alt="[% attrs.title _ ' Cover Image' %]" class='img-thumbnail w-auto'
+                <img alt="[% attrs.title _ ' Cover Image' | html %]" class='img-thumbnail w-auto'
                     src='[% ctx.media_prefix %]/opac/extras/ac/jacket/[% record.summary.jacket_size %]/r/[% ctx.bre_id | uri %]' />
             </a>
             [% ELSE %]
             <a href='[% ctx.media_prefix %]/opac/extras/ac/jacket/large/r/[% ctx.bre_id | uri %]'><img
-                    alt="[% attrs.title _ ' Cover Image' %]" class='img-thumbnail w-auto'
+                    alt="[% attrs.title _ ' Cover Image' | html %]" class='img-thumbnail w-auto'
                     src='[% ctx.media_prefix %]/opac/extras/ac/jacket/[% record.summary.jacket_size %]/r/[% ctx.bre_id | uri %]' />
             </a>
             [%- END %]
@@ -56,7 +56,7 @@ ctx.metalinks.push('
     <div class="col-lg-9">
         <div class="row h-100">
             <div class="col-lg-8">
-                <h1 class='h1' property="name">[% IF attrs.hl.title; attrs.hl.title; ELSE; attrs.title_extended | html; END %]</h1>
+                <h1 class='h1' property="name">[% IF attrs.hl.title; attrs.hl.title | html; ELSE; attrs.title_extended | html; END %]</h1>
                 [%-
                 FOR link880 IN attrs.graphic_titles;
                 FOR alt IN link880.graphic;
@@ -77,7 +77,7 @@ ctx.metalinks.push('
                         <ul class="list-unstyled">
                             [%- IF attrs.hl.isbn.size; FOR isbn IN attrs.hl.isbn %]
                             <li class='rdetail_isbns'>
-                                <strong class='rdetail_label'>[% l('ISBN:'); %]</strong> [% isbn %]
+                                <strong class='rdetail_label'>[% l('ISBN:'); %]</strong> [% isbn | html %]
                             </li>
                             [%- END; ELSIF attrs.isbns.0;
                             FOR isbn IN attrs.isbns;
@@ -96,7 +96,7 @@ ctx.metalinks.push('
                             [%- END %]
                             [%- IF attrs.hl.issn.size; FOR issn IN attrs.hl.issn %]
                             <li class='rdetail_issns'>
-                                <strong class='rdetail_label'>[% l('ISSN:'); %]</strong> [% issn %]
+                                <strong class='rdetail_label'>[% l('ISSN:'); %]</strong> [% issn | html %]
                             </li>
                             [%- END; ELSIF attrs.issns.0; FOR issn IN attrs.issns %]
                             <li class='rdetail_issns'>
@@ -106,10 +106,17 @@ ctx.metalinks.push('
                             [%- END %]
                             [%- END %]
                             [%- IF attrs.hl.physical_description.size %]
+                            [%-
+                                filtered_hl_phys_desc = [];
+                                FOR hl_phys_desc IN attrs.hl.physical_description;
+                                    hl_phys_desc = hl_phys_desc | html;
+                                    filtered_hl_phys_desc.push(hl_phys_desc);
+                                END;
+                            -%]
                             <li id='rdetail_phys_desc'>
                                 <strong class='rdetail_label'>[% l("Physical Description:") %]</strong>
                                 <span class='rdetail_value' highlighted='true'>[%
-                                    attrs.hl.physical_description.join('<br />') %]</span>
+                                    filtered_hl_phys_desc.join('<br/>') %]</span>
                             </li>
                             [%- ELSIF attrs.phys_desc %]
                             <li id='rdetail_phys_desc'>
@@ -120,7 +127,7 @@ ctx.metalinks.push('
                             [%- IF attrs.hl.edition %]
                             <li id='rdetail_edition'>
                                 <strong class='rdetail_label'>[% l("Edition:") %]</strong>
-                                <span class='rdetail_value' highlighted='true'>[% attrs.hl.edition %]</span>
+                                <span class='rdetail_value' highlighted='true'>[% attrs.hl.edition | html %]</span>
                                 [%- ELSIF attrs.edition %]
                             <li id='rdetail_edition'>
                                 <strong class='rdetail_label'>[% l("Edition:") %]</strong>
@@ -145,7 +152,7 @@ ctx.metalinks.push('
                             [%- IF attrs.hl.publisher %]
                             <li id='rdetail_publisher'>
                                 <strong class='rdetail_label'>[% l("Publisher:") %]</strong>
-                                <span class='rdetail_value' highlighted='true'>[% attrs.hl.publisher %]</span>
+                                <span class='rdetail_value' highlighted='true'>[% attrs.hl.publisher | html %]</span>
                             </li>
                             [%- ELSIF attrs.publisher %]
                             <li id='rdetail_publisher'>
@@ -385,14 +392,14 @@ ctx.metalinks.push('
                     <a href="[% addhref %]" id="mylist_add_[% ctx.bre_id %]"
                         data-recid="[% ctx.bre_id %]" data-action="add" role="button"
                         class="btn btn-action mylist_action [% IF ctx.mylist.grep('^' _ ctx.bre_id _ '$').size %]hidden[% END %]"
-                        title="[% l(" Add [_1] to basket", attrs.title) %]" rel="nofollow" vocab="">
+                        title="[% l(" Add [_1] to basket", attrs.title) | html %]" rel="nofollow" vocab="">
                         <i class="fas fa-shopping-basket" aria-hidden="true"></i>
                         [% l("Add to basket") %]
                     </a>
                     <a href="[% delhref %]" id="mylist_delete_[% ctx.bre_id %]"
                         data-recid="[% ctx.bre_id %]" data-action="delete" role="button"
                         class="btn btn-action mylist_action [% IF !ctx.mylist.grep('^' _ ctx.bre_id _ '$').size %]hidden[% END %]"
-                        title="[% l(" Remove [_1] from basket", attrs.title) %]" rel="nofollow" vocab="">
+                        title="[% l(" Remove [_1] from basket", attrs.title) | html %]" rel="nofollow" vocab="">
                         <i class="fas fa-minus-circle" aria-hidden="true"></i>
                         [% l("Remove from basket") %]
                     </a>
@@ -533,21 +540,26 @@ ctx.metalinks.push('
         <div class="rdetail_uris">
             [%- IF num_uris > 1 %]<ul>[% END %]
                 [%- FOR uri IN merged_uris %]
+                [%-
+                    filtered_href = uri.href | html;
+                    filtered_link = uri.link ? uri.link : '' | html;
+                    filtered_note = uri.note ? uri.note : '' | html;
+                -%]
                 [%- IF num_uris == 1 -%]
                 <p class="rdetail_uri" property="offers" vocab="http://schema.org/" typeof="Offer">
                     [%- ELSE -%]
                     <li class="rdetail_uri" property="offers" vocab="http://schema.org/" typeof="Offer">
                         [%- END -%]
-                        <a href="[% uri.href %]" class="uri_link" property="url">
-                            [%- IF uri.href != uri.link;
-                            '<span property="description">' _ uri.link _ '</span>';
+                        <a href="[% filtered_href %]" class="uri_link" property="url">
+                            [%- IF filtered_href != filtered_link;
+                            '<span property="description">' _ filtered_link _ '</span>';
                             ELSE;
-                            uri.link;
+                            filtered_link;
                             END;
                             END;
                             -%]
                         </a>
-                        [%-# ' - <span property="description">' _ uri.note _ '</span>' IF uri.note %]
+                        [%-# ' - <span property="description">' _ filtered_note _ '</span>' IF filtered_note %]
                         <link property="availability" href="http://schema.org/OnlineOnly" />
                         [%- IF attrs.gtin13; '
                         <meta property="gtin13" content="' _ attrs.gtin13 _ '" />'; END; %]
diff --git a/Open-ILS/src/templates-bootstrap/opac/parts/result/table.tt2 b/Open-ILS/src/templates-bootstrap/opac/parts/result/table.tt2
index 6b0726ac56..db2df3384d 100755
--- a/Open-ILS/src/templates-bootstrap/opac/parts/result/table.tt2
+++ b/Open-ILS/src/templates-bootstrap/opac/parts/result/table.tt2
@@ -104,7 +104,7 @@
                                     [% END %]
                                     <a class='record_title search_link' id='record_[% rec.id %]'
                                         href="[% mkurl(record_url_path, add_parms, del_parms); %]"
-                                        [% html_text_attr('title', l('Display record details for "[_1]"', attrs.title)) %]>
+                                        [% html_text_attr('title', l('Display record details for "[_1]"', attrs.title)) | html %]>
                                         [% IF attrs.hl.title; attrs.hl.title; ELSE; attrs.title | html; END %]
                                     </a>
                                     <span class="mx-2">
@@ -277,7 +277,7 @@
                                             [% FOR uri IN args.uris %]
                                                 <tr class='result_table_title_cell row'>
                                                     <td valign='top'><strong>[% l('Electronic resource') %]</strong></td>
-                                                    <td><a href="[% uri.href %]" class="uri_link" target="_blank">[% uri.link | html %]</a>[% ' - ' _ uri.note | html IF uri.note %]</td>
+                                                    <td><a href="[% uri.href | html %]" class="uri_link" target="_blank">[% uri.link | html %]</a>[% ' - ' _ uri.note | html IF uri.note %]</td>
                                                 </tr>
                                             [% END %]
                                             [% END %]
@@ -379,7 +379,7 @@
                                         <!--Place Hold Button -->
                                        
                                         <a role="button" href="[% mkurl(ctx.opac_root _ '/place_hold', add_parms, del_parms) %]"
-                                            [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) %]
+                                            [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) | html %]
                                             class="btn btn-action" rel="nofollow" vocab="">
                                             <i class="fas fa-check" aria-hidden="true"></i>
                                             <span class="result_place_hold">[% l('Place Hold') %]</span>
@@ -393,14 +393,14 @@
                                             <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_checkout',
                                                 {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'checkout'},
                                                 ['query','tag','subfield','term','_special','sort','page']) %]"
-                                                [% html_text_attr('title', l('Check Out [_1]', attrs.title)) %]
+                                                [% html_text_attr('title', l('Check Out [_1]', attrs.title)) | html %]
                                                     class="btn btn-action" role="button" rel="nofollow" vocab=""><i class="fas fa-atlas" aria-hidden="true"></i> <span class="result_place_hold">[% l('Check Out E-Item') %]</span></a>
                                        
                                        
                                             <a href="[% mkurl(ctx.opac_root _ '/myopac/ebook_place_hold',
                                                 {title => args.ebook.ebook_id, vendor => args.ebook.vendor, action => 'place_hold'},
                                                 ['query','tag','subfield','term','_special','sort','page']) %]"
-                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) %]
+                                                [% html_text_attr('title', l('Place Hold on [_1]', attrs.title)) | html %]
                                                     class="btn btn-action" role="button" rel="nofollow" vocab=""><i class="fas fa-book-reader" aria-hidden="true"></i> <span class="result_place_hold">[% l('Place Hold on E-Item') %]</span></a>
                                        
                                         [%- END -%]
@@ -418,7 +418,7 @@
                                                 <a href="[% addhref %]" id="mylist_add_[% rec.id %]"
                                                     data-recid="[% rec.id %]" data-action="add"
                                                     role="button" class="mylist_action btn btn-action [% IF ctx.mylist.grep('^' _ rec.id _ '$').size %]hidden[% END %]"
-                                                    title="[% l("Add [_1] to basket", attrs.title) %]" rel="nofollow" vocab="">
+                                                    title="[% l("Add [_1] to basket", attrs.title | html) %]" rel="nofollow" vocab="">
                                                     <i class="fas fa-shopping-basket" aria-hidden="true"></i>
                                                     [% l("Add to basket") %]
                                                 </a>
@@ -426,7 +426,7 @@
                                                 <a href="[% delhref %]" id="mylist_delete_[% rec.id %]"
                                                     data-recid="[% rec.id %]" data-action="delete" role="button"
                                                     class="mylist_action btn btn-action [% IF !ctx.mylist.grep('^' _ rec.id _ '$').size %]hidden[% END %]"
-                                                    title="[% l("Remove [_1] from basket", attrs.title) %]" rel="nofollow" vocab="">
+                                                    title="[% l("Remove [_1] from basket", attrs.title | html) %]" rel="nofollow" vocab="">
                                                     <i class="fas fa-minus-circle" aria-hidden="true"></i>
                                                     [% l("Remove from basket") %]
                                                 </a>
@@ -443,7 +443,7 @@
                                         [% ident = attrs.isbn_clean || attrs.upc %]
                                          
                                                 <a target='_blank'
-                                                    [% html_text_attr('title', l('Reviews and More for [_1]', attrs.title)) %]
+                                                    [% html_text_attr('title', l('Reviews and More for [_1]', attrs.title)) | html %]
                                                     href="[% ctx.ext_proto %]://contentcafe2.btol.com/ContentCafeClient/ContentCafe.aspx?UserID=[%-
                                                         ENV.OILS_CONTENT_CAFE_USER %]&amp;Password=[%-
                                                         ENV.OILS_CONTENT_CAFE_PASS %]&amp;ItemKey=[% ident | uri %]&amp;Options=Y" rel="nofollow" vocab="">