Koha/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt

273 lines
12 KiB
Text
Raw Normal View History

Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% USE raw %]
[% USE Asset %]
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
[% USE KohaDates %]
[% PROCESS 'i18n.inc' %]
[% SET footerjs = 1 %]
[% PROCESS 'i18n.inc' %]
2011-03-21 07:02:15 +00:00
[% INCLUDE 'doc-head-open.inc' %]
<title>[% FILTER collapse %]
[% tx("Receive shipment from vendor {vendor}", { vendor = name }) | html %] &rsaquo;
[% t("Acquisitions") | html %] &rsaquo;
[% t("Koha") | html %]
[% END %]</title>
2011-03-21 07:02:15 +00:00
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="acq_parcels" class="acq">
[% WRAPPER 'header.inc' %]
[% INCLUDE 'acquisitions-search.inc' %]
[% END %]
2011-03-21 07:02:15 +00:00
[% WRAPPER 'sub-header.inc' %]
[% WRAPPER breadcrumbs %]
[% WRAPPER breadcrumb_item %]
<a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a>
[% END %]
[% WRAPPER breadcrumb_item %]
<a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% name | html %]</a>
[% END %]
[% WRAPPER breadcrumb_item bc_active= 1 %]
<span>Receive shipment from vendor [% name | html %]</span>
[% END %]
[% END #/ WRAPPER breadcrumbs %]
[% END #/ WRAPPER sub-header.inc %]
2011-03-21 07:02:15 +00:00
<div class="main container-fluid">
<div class="row">
[% IF ( count ) %]
<div class="col-sm-10 col-sm-push-2">
[% ELSE %]
<div class="col-md-10 col-md-offset-1 col-lg-8 col-lg-offset-2">
[% END %]
<main>
[% INCLUDE 'messages.inc' %]
<h1>Receive shipment from vendor <a href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | uri %]">[% name | html %]</a></h1>
[% IF ( error_failed_to_create_invoice ) %]
<div id="error" class="dialog alert">
<p>An error has occurred. Invoice cannot be created.</p>
</div>
[% END %]
2011-03-21 07:02:15 +00:00
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
[% IF duplicate_invoices %]
<div id="parcels_duplicate_invoice" class="dialog alert">
<p>This invoice number has already been used. Would you like to receive on an existing invoice?</p>
<table>
<thead><tr><th>Invoice number</th><th>Shipment date</th><th></th></tr></thead>
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
<tbody>
[% FOREACH invoice IN duplicate_invoices %]
<tr>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<td>[% invoice.invoicenumber | html %]</td>
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
<td>[% invoice.shipmentdate | $KohaDates %]</td>
<td><a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% invoice.invoiceid | uri %]">Receive</a></td>
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
</tr>
[% END %]
</tbody>
</table>
<form method="post" action="parcels.pl">
[% INCLUDE 'csrf-token.inc' %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
<input type="hidden" name="op" value="cud-confirm" />
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<input type="hidden" name="invoice" value="[% invoicenumber | html %]" />
Bug 30718: (QA follow-up) KohaDates filter on inputs Found another one on a visible input. Replaced with html filter. koha-tmpl/intranet-tmpl/prog/en/modules/onboarding/onboardingstep2.tt: <input type="text" class="enrolmentperioddate" name="enrolmentperioddate" id="enrolmentperioddate" value="[% category.enrolmentperioddate | $KohaDates %]" /> But we also have a few hidden ones. First verified that cleanborrowers did not work anymore with expirydate. Fixed it with passing iso dateformat to resolve. intranet-tmpl/prog/en/modules/acqui/parcels.tt: <input type="hidden" name="shipmentdate" value="[% shipmentdate | $KohaDates %]" /> intranet-tmpl/prog/en/modules/serials/subscription-add.tt: <input type="hidden" id="acqui_date" name="firstacquidate" value="[% firstacquidate | $KohaDates %]"/> intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt: <input type="hidden" name="new_hard_due_date" value="[% new_hard_due_date | $KohaDates %]" /> intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt: <input type="hidden" name="not_borrowed_since" value="[% not_borrowed_since | $KohaDates %]" /> intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt: <input type="hidden" name="last_issue_date" value="[% last_issue_date | $KohaDates %]" /> intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt: <input type="hidden" name="borrower_dateexpiry" value="[% borrower_dateexpiry | $KohaDates %]" /> intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt: <input type="hidden" name="borrower_lastseen" value="[% borrower_lastseen | $KohaDates %]" /> Test plan: Try cleanborrowers with expiry date. cd koha-tmpl; git grep "<input.*\$KohaDates" | grep -v iso Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2022-08-19 09:04:49 +00:00
<input type="hidden" name="shipmentdate" value="[% shipmentdate | $KohaDates dateformat => 'iso' %]" />
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<input type="hidden" name="shipmentcost" value="[% shipmentcost | html %]" />
<input type="hidden" name="shipmentcost_budgetid" value="[% shipmentcost_budgetid | html %]" />
<input type="submit" class="btn btn-primary" value="Create new invoice anyway" />
Bug 10366: Alert librarian if an invoice number is duplicated Some vendors ship materials from the same invoice in multiple packages. In those cases, it would be good to notify the librarian when they enter a duplicate invoice number, so that they can continue receiving on the previously-created invoice, rather than creating an invoice with a duplicate number. To test: 1) Apply patch and run database update. 2) Make sure that you have created at least one invoice on acqui/parcels.pl and take note of the invoice number. 3) Try to create an invoice with the same invoice number. 4) Note that without changing your configuration this works exactly the same as before. 5) Turn on the AcqWarnOnDuplicateInvoice system preference. 6) Try to create a new invoice with the same number as the one you noted earlier. 7) Make sure you get a warning about a duplicate invoice. 8) Choose to receive on the existing invoice. 9) Confirm that you are receiving on said existing invoice. 10) Start the receiving process over, and this time choose "Create new invoice anyway." 11) Confirm that you are now receiving on a new invoice. Signed-off-by: Srdjan <srdjan@catalyst.net.nz> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> Passes all tests and QA script. I have followed the test plan, but also checked some more things: - Checking the duplicate check works when you have the entered invoice number in your database multiple times already. - Checking that no duplicate message is shown if you enter the invoice number and it's already been used for an invoice from another vendor. Looks all good. I think the only thing we could argue about here is if this could be activated by default for new installations. Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-05-29 03:03:59 +00:00
</form>
</div>
[% END %]
2011-03-21 07:02:15 +00:00
[% IF ( count ) %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<p> [% count | html %] shipments</p>
<div id="resultlist" class="page-section">
2011-03-21 07:02:15 +00:00
<!-- Search Results Table -->
<table class="small" id="parcelst">
<thead>
2011-03-21 07:02:15 +00:00
<tr>
<th>Line</th>
<th>Date received</th>
<th>Invoice number</th>
<th>Item count</th>
<th>[% tp("Bibliographic record", "Record count") | html %]</th>
2011-03-21 07:02:15 +00:00
<th>Items expected</th>
</tr>
</thead>
<tbody>
<!-- Actual Search Results -->
[% FOREACH searchresult IN searchresults %]
<tr>
<td>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% searchresult.number | html %]
</td>
<td data-order="[% searchresult.datereceived | html %]">
[% searchresult.datereceived | $KohaDates %]
</td>
<td>
[% IF ( searchresult.code ) %]
<a href="/cgi-bin/koha/acqui/parcel.pl?invoiceid=[% searchresult.invoiceid | uri %]">[% searchresult.code | html %]</a>
[% ELSE %]
<abbr title="not available">n/a</abbr>
[% END %]
</td>
<td>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% searchresult.reccount | html %]
</td>
<td>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% searchresult.bibcount | html %]
</td>
<td>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% searchresult.itemcount | html %]
</td>
</tr>
2011-03-21 07:02:15 +00:00
[% END %]
</tbody>
2011-03-21 07:02:15 +00:00
</table>
<div id="resultnumber">
<!-- Row of numbers corresponding to search result pages -->
[% IF ( displayprev ) %]
<a href="parcels.pl?booksellerid=[% booksellerid | uri %]&amp;startfrom=[% prevstartfrom | uri %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom | uri %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto | uri %][% END %][% IF ( code ) %]&amp;filter=[% code | uri %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby | uri %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage | uri %][% END %]&amp;type=intra">&lt;&lt; Previous</a>
2011-03-21 07:02:15 +00:00
[% END %]
[% FOREACH number IN numbers %]
[% IF ( number.highlight ) %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<span class="current">[% number.number | html %]</span>
2011-03-21 07:02:15 +00:00
[% ELSE %]
<a href="parcels.pl?booksellerid=[% booksellerid | uri %]&amp;startfrom=[% number.startfrom | uri %][% IF ( number.datefrom ) %]&amp;datefrom=[% number.datefrom | uri %][% END %][% IF ( number.dateto ) %]&amp;dateto=[% number.dateto | uri %][% END %][% IF ( number.code ) %]&amp;filter=[% number.code | uri %][% END %][% IF ( number.orderby ) %]&amp;orderby=[% number.orderby | uri %][% END %][% IF ( number.resultsperpage ) %]&amp;resultsperpage=[% number.resultsperpage | uri %][% END %]&amp;type=intra">[% number.number | html %]</a>
2011-03-21 07:02:15 +00:00
[% END %]
[% END %]
[% IF ( displaynext ) %]
<a href="parcels.pl?booksellerid=[% booksellerid | uri %]&amp;startfrom=[% nextstartfrom | uri %][% IF ( datefrom ) %]&amp;datefrom=[% datefrom | uri %][% END %][% IF ( dateto ) %]&amp;dateto=[% dateto | uri %][% END %][% IF ( code ) %]&amp;filter=[% code | uri %][% END %][% IF ( orderby ) %]&amp;orderby=[% orderby | uri %][% END %][% IF ( resultsperpage ) %]&amp;resultsperpage=[% resultsperpage | uri %][% END %]&amp;type=intra">Next &gt;&gt;</a>
2011-03-21 07:02:15 +00:00
[% END %]
</div>
</div>
[% END %]
<div id="parcels_new_parcel">
<form method="post" action="parcels.pl" class="validated">
[% INCLUDE 'csrf-token.inc' %]
2011-03-21 07:02:15 +00:00
<fieldset class="rows">
<legend>Receive a new shipment</legend>
<ol> <li>
<label for="invoice" class="required">Vendor invoice:</label>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<input type="hidden" name="booksellerid" value="[% booksellerid | html %]" />
<input type="hidden" name="op" value="cud-new" />
<input type="text" size="20" id="invoice" name="invoice" class="focus required" required="required" />
2011-03-21 07:02:15 +00:00
</li>
[% IF ( gst ) %]
<li>
<label for="gst">GST:</label>
<input type="text" size="20" id="gst" name="gst" />
</li>
[% END %]
<!-- // Removing freight input until shipping can be proplerly handled .
<li>
<label for="freight">Shipping:</label>
<input type="text" size="20" id="freight" name="freight" />
</li> -->
<li>
<label for="shipmentdate">Shipment date: </label>
<input type="text" id="shipmentdate" name="shipmentdate" maxlength="10" size="10" value="[% shipmentdate_today | html %]" class="flatpickr" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>
</li>
<li>
<label for="shipmentcost">Shipping cost: </label>
Bug 34169: Add decimal class to all relevant input fields in the acquisitions module This is a first step towards more consistency and possibly supporting multiple input formats as well in the future. It marks all input fields for monetary values, such as prices, replacement prices etc. with a class that is linked to a check for number format with the jQuery Validator plugin. To test: For any input field to test, try adding various false entries, like "abc" or "1,00". It should only accept inputs with decimal dot, like: "1.00" 0) Apply patch, restart_all 1) Suggestion * Add a new suggestion in the staff interface * Test: price input field at the bottom of the form. * Accept the suggestion 2) Order form * Create a new basket * Create an order line from an existing record * Test: list price, replacement price, and actual price. * Check the checkbox for uncertain price before you save 3) Uncertain prices * Go to the uncertain prices page for this vendor * Test: price field Note: this form does its own validation, but the change should not change behaviour for now * Resolve the uncertain price * Close order 4) Receive shipment * Test: Shipping cost 5) Receive the order * Test: replacement price, actual price * Check checkbox for price in foreign currency * Test: price in foreign currency * Receive order line 6) Invoice summary * Finish receiving * Test: shipping cost * Test: invoice adjustments: amount in the form for the first entry, amount in the table after adding it 7) Merging invoices * Receive another shipment and create and invoice * Go to invoices and search all * Check the 2 entries for merging * Test: shipping cost 8) Adding orders from a staged/new file * Export some records using the cart or list * Create a new basket * Order from new file * Import your file, ignore item records * Test: price and replacement price + Bonus: also test with items, test plan and file from bug 22802 are really helpful here Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-07-17 16:01:25 +00:00
<input class="decimal" type="text" id="shipmentcost" name="shipmentcost" size="10" />
</li>
<li>
<label for="shipmentcost_budgetid">Shipping fund: </label>
<select id="shipmentcost_budgetid" name="shipmentcost_budgetid">
<option value="">No fund</option>
[% FOREACH budget IN budgets %]
[% IF ( budget.b_active ) %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<option value="[% budget.b_id | html %]">[% budget.b_txt | html %]</option>
[% ELSE %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<option value="[% budget.b_id | html %]" class="b_inactive">[% budget.b_txt | html %] (inactive)</option>
[% END %]
[% END %]
</select>
<label for="showallfunds" style="float:none;width:auto;">&nbsp;Show inactive:</label>
<input type="checkbox" id="showallfunds" />
</li>
2011-03-21 07:02:15 +00:00
</ol>
</fieldset>
[% IF available_additional_fields %]
[% INCLUDE 'additional-fields-entry.inc' available=available_additional_fields values=additional_field_values %]
[% END %]
<fieldset class="action"><input type="submit" class="btn btn-default" value="Next" /> <a class="cancel" href="/cgi-bin/koha/acqui/supplier.pl?booksellerid=[% booksellerid | html %]">Cancel</a></fieldset>
2011-03-21 07:02:15 +00:00
</form>
</div>
</main>
</div> <!-- /.col-sm-10.col-sm-push-2 -->
[% IF ( count ) %]
<div class="col-sm-2 col-sm-pull-10">
<aside>
<form method="get" action="parcels.pl">
2011-03-21 07:02:15 +00:00
<fieldset class="brief">
<h4>Filter</h4>
<ol>
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
<li> <input type="hidden" name="booksellerid" value="[% booksellerid | html %]" /></li>
<li><label for="filter">Invoice number:</label><input type="text" size="20" name="filter" value="[% filter | html %]" id="filter" /></li>
<li>
<label for="datefrom">From:</label>
<input type="text" size="9" id="datefrom" name="datefrom" value="[% datefrom | html %]" class="flatpickr" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>
</li>
<li>
<label for="dateto">To:</label>
<input type="text" size="9" id="dateto" name="dateto" value="[% dateto | html %]" class="flatpickr" />
<div class="hint">[% INCLUDE 'date-format.inc' %]</div>
</li>
2011-03-21 07:02:15 +00:00
<li><label for="orderby">Sort by :</label><select name="orderby" id="orderby">
<option value="invoicenumber">Invoice number</option>
<option value="shipmentdate">Shipment date</option>
<option value="shipmentdate desc">Shipment date reverse</option>
<option value="invoicenumber desc">Invoice number reverse</option>
2011-03-21 07:02:15 +00:00
</select><br />
<label for="resultsperpage">Results per page :</label><select name="resultsperpage" id="resultsperpage">
<option value="20">20</option>
<option value="30">30</option>
<option value="50">50</option>
<option value="100">100</option>
</select></li>
</ol>
<fieldset class="action"><input type="submit" class="btn btn-default" value="Filter" /> <a href="/cgi-bin/koha/acqui/parcels.pl?booksellerid=[% booksellerid | uri %]">Clear</a></fieldset>
</fieldset>
</form>
</aside>
</div> <!-- /.col-sm-2.col-sm-pull-10 -->
[% END %]
</div> <!-- /.row -->
[% MACRO jsinclude BLOCK %]
Bug 13618: Add html filters to all the variables Here we go, next step then. As we did not fix the performance issue when autofiltering the variables (see bug 20975), the only solution we have is to add the filters explicitely. This patch has been autogenerated (using add_html_filters.pl, see next pathces) and add the html filter to all the variables displayed in the template. Exceptions are made (using the new 'raw' TT filter) to the variable we already listed in the previous versions of this patch. To test: - Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated data which contain <script> tags - Remove them from borrower_debarments.comments (there are allowed here) update borrower_debarments set comment="html tags possible here"; - From the interface hit page and try to catch alert box. If you find one it means you find a possible XSS. To know where it comes from: * note the exact URL where you found it * note the alert box content * Dump your DB and search for the string in the dump to identify its location (for instance table.field) Next: * Ideally we would like to use the raw filter when it is not necessary to HTML escape the variables (in big loop for instance) * Provide a QA script to catch missing filters (we want html, uri, url or raw, certainly others that I am forgetting now) * Replace the html filters with uri when needed (!) Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2015-01-23 12:18:54 +00:00
[% Asset.js("js/acquisitions-menu.js") | $raw %]
[% INCLUDE 'calendar.inc' %]
[% INCLUDE 'datatables.inc' %]
<script>
$(document).ready(function() {
var parcelst = $("#parcelst").dataTable($.extend(true, {}, dataTablesDefaults, {
"paginate": false
}));
//keep a copy of all budgets before removing the inactives
var budgetId = $("#shipmentcost_budgetid");
var disabledBudgetsCopy = budgetId.html();
$('.b_inactive').remove();
$('#showallfunds').click(function() {
if ($(this).is(":checked")) {
budgetId.html(disabledBudgetsCopy); //Puts back all the funds
}
else {
$('.b_inactive').remove();
}
});
});
</script>
[% END %]
2011-03-21 07:02:15 +00:00
[% INCLUDE 'intranet-bottom.inc' %]