diff --git a/app/assets/javascripts/protocols/import_export/import.js.erb b/app/assets/javascripts/protocols/import_export/import.js.erb
index 1ff9df895..ae08873c0 100644
--- a/app/assets/javascripts/protocols/import_export/import.js.erb
+++ b/app/assets/javascripts/protocols/import_export/import.js.erb
@@ -60,7 +60,7 @@ function importProtocolFromFile(
// Populate values in the template
if (values !== null) {
_.each(values, function(val, key) {
- template.find("[data-val='" + key + "']").text(val);
+ template.find("[data-val='" + key + "']").append(val);
});
}
@@ -134,7 +134,7 @@ function importProtocolFromFile(
var stepGuid = node.attr("guid");
var stepPosition = String(Number.parseInt(node.attr("position")) + 1);
var stepName = node.children("name").text();
- var stepDescription = node.children("description").text();
+ var stepDescription = $(node.children("description")).html();
// Generate step element
var stepEl = newPreviewElement(
@@ -431,7 +431,7 @@ function importProtocolFromFile(
stepJson.id = stepId;
stepJson.position = $(this).attr("position");
stepJson.name = $(this).children("name").text();
- stepJson.description = $(this).children("description").text();
+ stepJson.description = $(this).children("description").html();
// Iterate through assets
var stepAssetsJson = [];
diff --git a/app/utilities/protocols_importer.rb b/app/utilities/protocols_importer.rb
index 0c3e64359..50a9466d5 100644
--- a/app/utilities/protocols_importer.rb
+++ b/app/utilities/protocols_importer.rb
@@ -53,7 +53,8 @@ module ProtocolsImporter
protocol_json['steps'].values.each do |step_json|
step = Step.create!(
name: step_json["name"],
- description: step_json["description"],
+ description: # Sanitize description HTML
+ ActionController::Base.helpers.sanitize(step_json['description']),
position: step_pos,
completed: false,
user: user,
diff --git a/app/views/protocols/import_export/_preview_templates.html.erb b/app/views/protocols/import_export/_preview_templates.html.erb
index 29aead7fc..a7183f488 100644
--- a/app/views/protocols/import_export/_preview_templates.html.erb
+++ b/app/views/protocols/import_export/_preview_templates.html.erb
@@ -14,7 +14,7 @@