From 0c6f65d138fd7b3aac93e759e73d707e8b65b12e Mon Sep 17 00:00:00 2001 From: ivis-inoue Date: Wed, 19 Aug 2026 13:19:54 +0900 Subject: [PATCH] fix 61534 --- modules/weko-admin/tests/test_utils.py | 22 +- modules/weko-admin/weko_admin/utils.py | 28 + modules/weko-search-ui/tests/conftest.py | 128 ++++- modules/weko-search-ui/tests/test_rest.py | 519 ++++++++++++++++++ modules/weko-search-ui/weko_search_ui/rest.py | 20 +- .../templates/weko_search_ui/indexlist.html | 2 +- 6 files changed, 708 insertions(+), 11 deletions(-) diff --git a/modules/weko-admin/tests/test_utils.py b/modules/weko-admin/tests/test_utils.py index 4b8e9650cd..f42d1d0870 100755 --- a/modules/weko-admin/tests/test_utils.py +++ b/modules/weko-admin/tests/test_utils.py @@ -60,7 +60,8 @@ get_title_facets, is_exits_facet, overwrite_the_memory_config_with_db, - get_detail_search_list + get_detail_search_list, + sanitize_html_string ) from tests.helpers import json_data @@ -2616,3 +2617,22 @@ def test_get_detail_search_list(i18n_app, users): with patch("flask_login.utils._get_user", return_value=users[3]['obj']): result = get_detail_search_list() assert result + +# def sanitize_html_string(html_string, allow_tags=[], allow_attributes={}, strip=True): +# .tox/c1/bin/pytest --cov=weko_admin tests/test_utils.py::test_sanitize_html_string -vv -s --cov-branch --cov-report=term --basetemp=/code/modules/weko-admin/.tox/c1/tmp +def test_sanitize_html_string(): + test_str = "
ab
" + result = sanitize_html_string(test_str) + assert result == "aalert(1)b" + + result = sanitize_html_string(test_str, allow_tags=["div"]) + assert result == "
aalert(1)b
" + + result = sanitize_html_string(test_str, allow_tags=["div"], allow_attributes={"div": ["onclick"]}) + assert result == "
aalert(1)b
" + + result = sanitize_html_string(test_str, allow_tags=["div"], allow_attributes={"div": ["onclick"]}, strip=True) + assert result == "
aalert(1)b
" + + result = sanitize_html_string(12345) + assert result == 12345 \ No newline at end of file diff --git a/modules/weko-admin/weko_admin/utils.py b/modules/weko-admin/weko_admin/utils.py index 6a37f415e2..f324e6a05e 100755 --- a/modules/weko-admin/weko_admin/utils.py +++ b/modules/weko-admin/weko_admin/utils.py @@ -30,6 +30,7 @@ from io import BytesIO, StringIO from typing import Dict, Optional, Tuple, Union +import bleach import requests from flask import current_app, request from flask_babelex import gettext as __ @@ -2835,3 +2836,30 @@ def _elasticsearch_remake_item_index(index_name): current_app.logger.info(' END elasticsearch import from records_metadata') return returnlist + +def sanitize_html_string( + value, + allow_tags=[], + allow_attributes={}, + strip=True + ): + """bleachを使用してHTMLをサニタイズする + + Args: + value (str): HTML文字列 + allow_tags (list): 許可するHTMLタグのリスト + allow_attributes (dict): 許可するHTML属性の辞書 + strip (bool): サニタイズ後にタグを削除するかどうか + + Returns: + str: サニタイズされたHTML文字列 + """ + + if isinstance(value, str): + value = bleach.clean( + value, + tags=allow_tags, + attributes=allow_attributes, + strip=strip + ).strip() + return value \ No newline at end of file diff --git a/modules/weko-search-ui/tests/conftest.py b/modules/weko-search-ui/tests/conftest.py index 641165785a..940ffd8adb 100644 --- a/modules/weko-search-ui/tests/conftest.py +++ b/modules/weko-search-ui/tests/conftest.py @@ -295,7 +295,7 @@ def base_app(instance_path, search_class, request): WEKO_INDEX_TREE_STATE_PREFIX="index_tree_expand_state", REDIS_PORT="6379", DEPOSIT_DEFAULT_JSONSCHEMA=DEPOSIT_DEFAULT_JSONSCHEMA, - SERVER_NAME="TEST_SERVER", + SERVER_NAME="test_server", LOGIN_DISABLED=False, INDEXER_DEFAULT_DOCTYPE="item-v1.0.0", WEKO_SCHEMA_JPCOAR_V1_SCHEMA_NAME = 'jpcoar_v1_mapping', @@ -791,6 +791,15 @@ def db(app): if not database_exists(str(db_.engine.url)): create_database(str(db_.engine.url)) db_.create_all() + _now = datetime.now() + _p_start = _now.date().replace(day=1) + _p_end = (_p_start + timedelta(days=31)).replace(day=1) + _p_name = "user_activity_logs_{}_{:02d}".format(_now.year, _now.month) + db_.session.execute( + "CREATE TABLE IF NOT EXISTS {name} PARTITION OF user_activity_logs " + "FOR VALUES FROM ('{start}') TO ('{end}');".format( + name=_p_name, start=_p_start, end=_p_end)) + db_.session.commit() yield db_ db_.session.remove() db_.drop_all() @@ -878,6 +887,123 @@ def client_request_args(app, file_instance_mock): ) yield r +@pytest.yield_fixture() +def client_request_args2(app, file_instance_mock): + app.register_blueprint( + create_blueprint(app, app.config["WEKO_SEARCH_REST_ENDPOINTS"]) + ) + + file_path = os.path.join( + os.path.dirname(os.path.abspath(__file__)), + "data", + "sample_file", + "sample_file.txt", + ) + + # files = {'upload_file': open(file_path,'rb')} + # values = {'DB': 'photcat', 'OUT': 'txt', 'SHORT': 'short'} + + # r = requests.post(url, files=files, data=values) + + with app.test_client() as client: + with patch("flask.templating._render", return_value=""): + r = client.get( + "/", + query_string={ + "index_id": "33", + "page": 1, + "count": 20, + "term": 14, + "lang": "en", + "parent_id": 33, + "index_info": {}, + "community": "comm1", + "item_link": "1", + "is_search": 1, + "search_type": WEKO_SEARCH_TYPE_DICT["INDEX"], + "is_change_identifier": True, + "remote_addr": "0.0.0.0", + "referrer": "test", + "host": "127.0.0.1", + "q": "q" + }, + ) + yield r + +@pytest.yield_fixture() +def client_request_args3(app, file_instance_mock): + app.register_blueprint( + create_blueprint(app, app.config["WEKO_SEARCH_REST_ENDPOINTS"]) + ) + + file_path = os.path.join( + os.path.dirname(os.path.abspath(__file__)), + "data", + "sample_file", + "sample_file.txt", + ) + + with app.test_client() as client: + with patch("flask.templating._render", return_value=""): + r = client.get( + "/", + query_string={ + "index_id": "33", + "page": 1, + "count": 20, + "term": 14, + "lang": "en", + "parent_id": 33, + "index_info": {}, + "community": "comm1", + "item_link": "1", + "is_search": 0, + "search_type": WEKO_SEARCH_TYPE_DICT["INDEX"], + "is_change_identifier": True, + "remote_addr": "0.0.0.0", + "referrer": "test", + "host": "127.0.0.1", + }, + ) + yield r + +@pytest.yield_fixture() +def client_request_args4(app, file_instance_mock): + app.register_blueprint( + create_blueprint(app, app.config["WEKO_SEARCH_REST_ENDPOINTS"]) + ) + + file_path = os.path.join( + os.path.dirname(os.path.abspath(__file__)), + "data", + "sample_file", + "sample_file.txt", + ) + + with app.test_client() as client: + with patch("flask.templating._render", return_value=""): + r = client.get( + "/", + query_string={ + "index_id": "33", + "page": 2, + "count": 20, + "term": 14, + "lang": "en", + "parent_id": 33, + "index_info": {}, + "community": "comm1", + "item_link": "1", + "is_search": 1, + "search_type": WEKO_SEARCH_TYPE_DICT["INDEX"], + "is_change_identifier": True, + "remote_addr": "0.0.0.0", + "referrer": "test", + "host": "127.0.0.1", + }, + ) + yield r + @pytest.yield_fixture() def client_request_args_FULL_TEXT(app, file_instance_mock): app.register_blueprint( diff --git a/modules/weko-search-ui/tests/test_rest.py b/modules/weko-search-ui/tests/test_rest.py index 60d366e3e2..2d89c32965 100644 --- a/modules/weko-search-ui/tests/test_rest.py +++ b/modules/weko-search-ui/tests/test_rest.py @@ -133,6 +133,14 @@ def dummy_response(data): with patch("weko_admin.utils.get_facet_search_query", return_value=facet): with patch("weko_search_ui.rest.Indexes.get_self_list",side_effect=mock_path(**path1)): with patch("invenio_search.api.RecordsSearch.execute", return_value=dummy_response("data/search/execute_result01_02_03.json")): + + error_result = json_data("data/search/execute_result01_02_03.json") + error_result["hits"]["hits"][0]["_source"]["title"] = [] + with patch("invenio_search.api.RecordsSearch.execute", return_value=dummy_response(error_result)): + res = client_rest.get(url("/index/",{"self":"?page=1&size=20"})) + result = json.loads(res.get_data(as_text=True)) + assert res.status_code == 200 + with patch("weko_search_ui.rest.get_heading_info", side_effect=Exception): res = client_rest.get(url("/index/",{"self":"?page=1&size=20"})) result = json.loads(res.get_data(as_text=True)) @@ -198,6 +206,12 @@ def test_IndexSearchResource_get2(app,i18n_app, users, client_request_args): return_data_2.path = "q" return_data_2.name = "test" + return_data_3 = MagicMock() + return_data_3.path = "q/child" + return_data_3.name = "child" + return_data_3.name_en = "child" + return_data_3.comment = "child comment" + with patch("invenio_pidstore.current_pidstore.fetchers", return_value=1): def search_class(): @@ -255,6 +269,383 @@ def to_dict(): return (data_1, data_2) + def search_factory2(x, y): + data_1, _ = search_factory(x, y) + original_execute = data_1.execute + + def execute(): + result = original_execute() + result_dict = result.to_dict() + result_dict["aggregations"]["path"]["buckets"] = [ + result_dict["aggregations"]["path"]["buckets"][0], + { + "key": "child", + "doc_count": 1, + "no_available": {"doc_count": 0}, + "date_range": {"available": {"buckets": [{}]}}, + }, + ] + result.to_dict = lambda: result_dict + return result + + data_1.execute = execute + data_2 = MagicMock() + data_2.is_perm_paths = ["q/child"] + data_2.get.return_value = data_2.is_perm_paths + return (data_1, data_2) + + def search_factory3(x, y): + data_1, data_2 = search_factory2(x, y) + data_2.is_perm_paths = ["q/other"] + data_2.get.return_value = data_2.is_perm_paths + return (data_1, data_2) + + def search_factory4(x, y): + data_1, data_2 = search_factory2(x, y) + original_execute = data_1.execute + + def execute(): + result = original_execute() + result_dict = result.to_dict() + result_dict["aggregations"]["path"]["buckets"][0]["key"] = "q" + result.to_dict = lambda: result_dict + return result + + data_1.execute = execute + data_2.is_perm_paths = ["other"] + data_2.get.return_value = data_2.is_perm_paths + return (data_1, data_2) + + def make_response(pid_fetcher, search_result, links, item_links_factory): + return (pid_fetcher, search_result, links, item_links_factory) + + + ctx = { + "pid_fetcher": "", + "max_result_window": 10000, + "search_class": search_class, + "search_factory": search_factory, + "links_factory": "test", + "make_response": make_response + } + + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_1]): + assert isinstance(test.get(), tuple) + assert isinstance(test.get()[1], dict) + assert test.get()[1]["hits"]["total"] == total_hit_count + assert test.get()[2]["self"] == top_page + assert test.get()[2]["next"] == next_page + + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_2]): + assert isinstance(test.get(), tuple) + assert isinstance(test.get()[1], dict) + assert test.get()[1]["hits"]["total"] == total_hit_count + assert test.get()[2]["self"] == top_page + assert test.get()[2]["next"] == next_page + + ctx["search_factory"] = search_factory2 + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with app.test_request_context( + "/index/", query_string={"q": "q", "is_search": 1} + ): + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch( + "weko_index_tree.api.Indexes.get_self_list", + return_value=[return_data_2, return_data_3], + ): + response = test.get() + rd = response[1] + index_data = rd["aggregations"]["path"]["buckets"][0][0] + assert index_data["date_range"]["pub_cnt"] == 0 + assert index_data["date_range"]["un_pub_cnt"] == 1 + + ctx["search_factory"] = search_factory3 + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with app.test_request_context( + "/index/", query_string={"q": "q", "is_search": 1} + ): + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch( + "weko_index_tree.api.Indexes.get_self_list", + return_value=[return_data_2, return_data_3], + ): + response = test.get() + rd = response[1] + child_indexes = rd["aggregations"]["path"]["buckets"][0] + assert all(index["key"] != "q/child" for index in child_indexes) + + ctx["search_factory"] = search_factory4 + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with app.test_request_context( + "/index/", query_string={"q": "q", "is_search": 1} + ): + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch( + "weko_index_tree.api.Indexes.get_self_list", + return_value=[return_data_2], + ): + response = test.get() + rd = response[1] + index_data = rd["aggregations"]["path"]["buckets"][0][0] + assert index_data["key"] == "q" + assert index_data["date_range"]["pub_cnt"] == 0 + assert index_data["date_range"]["un_pub_cnt"] == 0 + +# .tox/c1/bin/pytest --cov=weko_search_ui tests/test_rest.py::test_IndexSearchResource_get_is_search_1_with_q -vv -s --cov-branch --cov-report=term --basetemp=/code/modules/weko-search-ui/.tox/c1/tmp +def test_IndexSearchResource_get_is_search_1_with_q(app,i18n_app, users, client_request_args2): + total_hit_count = 30 + + return_data_1 = MagicMock() + return_data_1.path = "q" + return_data_1.name = "test" + return_data_1.comment = "aaaaa" + + return_data_2 = MagicMock() + return_data_2.path = "q" + return_data_2.name = "test" + return_data_2.comment = "google" + + return_data_3 = MagicMock() + return_data_3.path = "q2" + return_data_3.name = "test" + + with patch("invenio_pidstore.current_pidstore.fetchers", return_value=1): + + def search_class(): + search_class_data = MagicMock() + + return search_class_data + + def search_factory(x, y): + def execute(): + def to_dict(): + dict_1 = { + "hits": { + "total": total_hit_count, + "hits": [{ + "_source": { + "title": [1], + "_comment": "test", + "control_number": 1, + "custom_sort": "custom_sort", + "_item_metadata": {"item_type_id": 1} + } + }] + }, + "aggregations": { + "path": { + "buckets": [{ + "key": "q", + "doc_count": 1, + "no_available": { + "doc_count": 1 + }, + "date_range": { + "available": { + "buckets": [{}] + } + } + }] + } + } + } + + return dict_1 + + data_3 = MagicMock() + data_3.hits = MagicMock() + data_3.hits.total = 30 + data_3.to_dict = to_dict + + return data_3 + + data_1 = MagicMock() + data_1.execute = execute + + data_2 = MagicMock() + data_2.is_perm_paths = ["q"] + data_2.get.return_value = data_2.is_perm_paths + + + return (data_1, data_2) + + def make_response(pid_fetcher, search_result, links, item_links_factory): + return (pid_fetcher, search_result, links, item_links_factory) + + ctx = { + "pid_fetcher": "", + "max_result_window": 10000, + "search_class": search_class, + "search_factory": search_factory, + "links_factory": "test", + "make_response": make_response + } + + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + dummy_index = MagicMock() + dummy_index.image_name = "test_image" + + with patch("weko_index_tree.api.Indexes.get_index", return_value=dummy_index): + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_1]): + response = test.get() + rd = response[1] + assert rd["aggregations"]["path"]["buckets"][0][0]["comment"] == "aaaaa" + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_2]): + response = test.get() + rd = response[1] + assert rd["aggregations"]["path"]["buckets"][0][0]["comment"] == "google" + + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_1]): + response = test.get() + rd = response[1] + assert rd["aggregations"]["path"]["buckets"][0][0]["img"] == "test_image" + +# class IndexSearchResource(ContentNegotiatedMethodView): +# def __init__ +# def get(self, **kwargs): +# .tox/c1/bin/pytest --cov=weko_search_ui tests/test_rest.py::test_IndexSearchResource_get_is_search_not1 -vv -s --cov-branch --cov-report=term --basetemp=/code/modules/weko-search-ui/.tox/c1/tmp +def test_IndexSearchResource_get_is_search_not1(app,i18n_app, users, client_request_args3): + total_hit_count = 30 + top_page = "http://test_server/index/?page=1&size=20" + next_page = "http://test_server/index/?page=2&size=20" + + return_data_1 = MagicMock() + return_data_1.path = "" + return_data_1.name = "test" + + return_data_2 = MagicMock() + return_data_2.path = "q" + return_data_2.name = "test" + + return_data_3 = MagicMock() + return_data_3.path = "q" + return_data_3.name = "test" + return_data_3.comment = "aaaaa" + + return_data_4 = MagicMock() + return_data_4.path = "q" + return_data_4.name = "test" + return_data_4.comment = "google" + + return_data_5 = MagicMock() + return_data_5.path = "q/child" + return_data_5.name = "child" + return_data_5.name_en = "child" + return_data_5.comment = "child comment" + + with patch("invenio_pidstore.current_pidstore.fetchers", return_value=1): + + def search_class(): + search_class_data = MagicMock() + + return search_class_data + + def search_factory(x, y): + def execute(): + def to_dict(): + dict_1 = { + "hits": { + "total": total_hit_count, + "hits": [{ + "_source": { + "title": [1], + "_comment": "test", + "control_number": 1, + "custom_sort": "custom_sort", + "_item_metadata": {"item_type_id": 1} + } + }] + }, + "aggregations": { + "path": { + "buckets": [{ + "key": "", + "doc_count": 1, + "no_available": { + "doc_count": 1 + }, + "date_range": { + "available": { + "buckets": [{}] + } + } + }] + } + } + } + + return dict_1 + + data_3 = MagicMock() + data_3.hits = MagicMock() + data_3.hits.total = 30 + data_3.to_dict = to_dict + + return data_3 + + data_1 = MagicMock() + data_1.execute = execute + + data_2 = { + "is_perm_paths": ["q"], + } + + return (data_1, data_2) + + def search_factory2(x, y): + data_1, _ = search_factory(x, y) + original_execute = data_1.execute + + def execute(): + result = original_execute() + result_dict = result.to_dict() + result_dict["aggregations"]["path"]["buckets"].append({ + "key": "child", + "doc_count": 0, + "no_available": {"doc_count": 0}, + "date_range": {"available": {"buckets": [{}]}}, + }) + result.to_dict = lambda: result_dict + return result + + data_1.execute = execute + data_2 = { + "is_perm_paths": ["q/child"], + } + return (data_1, data_2) + def make_response(pid_fetcher, search_result, links, item_links_factory): return (pid_fetcher, search_result, links, item_links_factory) @@ -290,6 +681,134 @@ def make_response(pid_fetcher, search_result, links, item_links_factory): assert test.get()[2]["self"] == top_page assert test.get()[2]["next"] == next_page + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_3]): + response = test.get() + rd = response[1] + assert rd["aggregations"]["path"]["buckets"][0][0]["comment"] == "aaaaa" + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_4]): + response = test.get() + rd = response[1] + assert rd["aggregations"]["path"]["buckets"][0][0]["comment"] == "google" + + ctx["search_factory"] = search_factory2 + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch( + "weko_search_ui.rest.Indexes.get_self_list", + return_value=[return_data_5], + ): + response = test.get() + rd = response[1] + index_data = rd["aggregations"]["path"]["buckets"][0][0] + assert index_data["key"] == "q/child" + assert index_data["date_range"]["pub_cnt"] == 0 + assert index_data["date_range"]["un_pub_cnt"] == 0 + +# .tox/c1/bin/pytest --cov=weko_search_ui tests/test_rest.py::test_IndexSearchResource_page_2 -vv -s --cov-branch --cov-report=term --basetemp=/code/modules/weko-search-ui/.tox/c1/tmp +def test_IndexSearchResource_page_2(app,i18n_app, users, client_request_args4): + total_hit_count = 30 + top_page = "http://test_server/index/?page=2&size=20" + prev_page = "http://test_server/index/?page=1&size=20" + + return_data_1 = MagicMock() + return_data_1.path = "" + return_data_1.name = "test" + + return_data_2 = MagicMock() + return_data_2.path = "q" + return_data_2.name = "test" + + with patch("invenio_pidstore.current_pidstore.fetchers", return_value=1): + + def search_class(): + search_class_data = MagicMock() + + return search_class_data + + def search_factory(x, y): + def execute(): + def to_dict(): + dict_1 = { + "hits": { + "total": total_hit_count, + "hits": [{ + "_source": { + "title": [1], + "_comment": "test", + "control_number": 1, + "custom_sort": "custom_sort", + "_item_metadata": {"item_type_id": 1} + } + }] + }, + "aggregations": { + "path": { + "buckets": [{ + "key": "", + "doc_count": 1, + "no_available": { + "doc_count": 1 + }, + "date_range": { + "available": { + "buckets": [{}] + } + } + }] + } + } + } + + return dict_1 + + data_3 = MagicMock() + data_3.hits = MagicMock() + data_3.hits.total = 30 + data_3.to_dict = to_dict + + return data_3 + + data_1 = MagicMock() + data_1.execute = execute + + data_2 = MagicMock() + + return (data_1, data_2) + + def make_response(pid_fetcher, search_result, links, item_links_factory): + return (pid_fetcher, search_result, links, item_links_factory) + + + ctx = { + "pid_fetcher": "", + "max_result_window": 10000, + "search_class": search_class, + "search_factory": search_factory, + "links_factory": "test", + "make_response": make_response + } + + test = IndexSearchResource( + ctx=ctx, + search_serializers=None, + record_serializers=None, + default_media_type=None + ) + + with patch("weko_index_tree.api.Indexes.get_index", return_value=MagicMock()): + with patch("weko_index_tree.api.Indexes.get_self_list", return_value=[return_data_1]): + assert isinstance(test.get(), tuple) + assert isinstance(test.get()[1], dict) + assert test.get()[1]["hits"]["total"] == total_hit_count + assert test.get()[2]["self"] == top_page + assert test.get()[2]["prev"] == prev_page + # def get_heading_info(data, lang, item_type): def test_get_heading_info(i18n_app): subitem_heading_banner_headline = "test1" diff --git a/modules/weko-search-ui/weko_search_ui/rest.py b/modules/weko-search-ui/weko_search_ui/rest.py index 2e797275cc..a7943e39de 100644 --- a/modules/weko-search-ui/weko_search_ui/rest.py +++ b/modules/weko-search-ui/weko_search_ui/rest.py @@ -59,7 +59,7 @@ from webargs.flaskparser import use_kwargs from weko_accounts.utils import limiter from weko_admin.models import SearchManagement as sm -from weko_admin.utils import get_facet_search_query +from weko_admin.utils import get_facet_search_query, sanitize_html_string from werkzeug.http import generate_etag from werkzeug.exceptions import NotFound from weko_index_tree.api import Indexes @@ -344,9 +344,10 @@ def get(self, **kwargs): agp[k]["name"] = p.name if p.name and lang == "ja" else p.name_en agp[k]["date_range"] = dict() comment = p.comment - agp[k]["comment"] = (comment,) + sanitized_comment = sanitize_html_string(comment) + agp[k]["comment"] = (sanitized_comment,) result = agp.pop(k) - result["comment"] = comment + result["comment"] = sanitized_comment current_idx = result for _path in is_perm_paths: if ( @@ -366,13 +367,15 @@ def get(self, **kwargs): index_id = p.cid index_info = Indexes.get_index(index_id=index_id) rss_status = index_info.rss_status + comment = p.comment + sanitized_comment = sanitize_html_string(comment) nd = { "doc_count": 0, "key": p.path, "name": p.name if p.name and lang == "ja" else p.name_en, "date_range": {"pub_cnt": 0, "un_pub_cnt": 0}, "rss_status": rss_status, - "comment": p.comment, + "comment": sanitized_comment, "image_name": index_info.image_name, "image_width": current_app.config['CHILD_INDEX_THUMBNAIL_WIDTH'], "image_height": current_app.config['CHILD_INDEX_THUMBNAIL_HEIGHT'], @@ -392,14 +395,15 @@ def get(self, **kwargs): for p in paths: m = 0 current_idx = {} + comment = p.comment + sanitized_comment = sanitize_html_string(comment) for k in range(len(agp)): if p.path == agp[k].get("key"): agp[k]["name"] = p.name if p.name and lang == "ja" else p.name_en agp[k]["date_range"] = dict() - comment = p.comment - agp[k]["comment"] = (comment,) + agp[k]["comment"] = (sanitized_comment,) result = agp.pop(k) - result["comment"] = comment + result["comment"] = sanitized_comment current_idx = result m = 1 break @@ -413,7 +417,7 @@ def get(self, **kwargs): "name": p.name if p.name and lang == "ja" else p.name_en, "date_range": {"pub_cnt": 0, "un_pub_cnt": 0}, "rss_status": rss_status, - "comment": p.comment, + "comment": sanitized_comment, "image_name": index_info.image_name, "image_width": current_app.config['CHILD_INDEX_THUMBNAIL_WIDTH'], "image_height": current_app.config['CHILD_INDEX_THUMBNAIL_HEIGHT'], diff --git a/modules/weko-search-ui/weko_search_ui/static/templates/weko_search_ui/indexlist.html b/modules/weko-search-ui/weko_search_ui/static/templates/weko_search_ui/indexlist.html index b4f1c32b2b..3f5e266e9c 100644 --- a/modules/weko-search-ui/weko_search_ui/static/templates/weko_search_ui/indexlist.html +++ b/modules/weko-search-ui/weko_search_ui/static/templates/weko_search_ui/indexlist.html @@ -141,7 +141,7 @@

Index List

-

{{index_path.comment}}

+