Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
mechanism, it will be tedious
This patch:
- adds a Template::Toolkit plugin that generates <script> and
<link> tags for JS and CSS files, and inserts automatically the Koha
version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable
Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
checking your browser's dev tools (there should be no 404 for JS and
CSS files, and the Koha version should appear in filenames) and the
server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch modifies some staff client circulation templates so that
JavaScript is included in the footer instead of the header.
To test, apply the patch and test the JavaScript-driven features of the
modified templates: All button controls, DataTables functionality, tabs,
etc.
- Article requests (enable ArticleRequests system preference, have at
least one outstanding article request)
- Request article (Bibliographic detail page -> Request article).
- Item circulation statistics (Bibliographic detail page -> Items ->
View item's checkout history).
- On-site checkouts (enable OnSiteCheckouts system preference; Check out
some items as on-site checkouts; Go to Circulation ->
Pending on-site checkouts
- Overdues report (Circulation -> Overdues).
- Holds to pull (Circulation -> Holds to pull).
- Renew
- Holds ratios (Circulation -> Holds ratios).
- Check in
- Transfers to receive (Circulation -> Transfers to receive).
- Holds queue (Circulation -> Holds queue).
- Holds awaiting pickup (Circulation -> Holds awaiting pickup).
Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.
In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.
To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:
- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.
Revised: I intended for this to be built on top of Bug 15883. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883
Works as described, all pages on test plan
No Errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch revises the hold ratios report so that it uses template
plugins to display descriptions instead of codes for item holding
branch, item home branch, item type, and shelving location.
To test you should have multiple items on the hold ratio report (set the
ratio to a small number to increase the number of results). It should
include one or more items which have a shelving location set.
View the hold ratios report and confirm that library names, shelving
location descriptions, and item type descriptions are shown instead of
codes.
This revised patch steals from Bug 15560 to enable the correct display
of multiple home libraries, holding libraries, shelving locations, item
types, and call numbers. To properly test you should have records in
your report which have multiple values for each of those fields.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This patch removes C4::Dates from circ/reserveratios.pl
To test:
- Make sure you have many holds for biblios with not so much items (e.g. 5 holds, 1 item)
or follow hint below
- Go to Home > Circulation > Hold ratios
- Verify that everything works the same without an dwith patch
Hint: To get a big table you can set 'Hod ratio' in the filter to 0.1 (default value is 3).
This was will trigger biblios with less holds than items.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised. Tested with dateformat syspref, datepiker Ok
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
It seems odd that only the holding libraries are listed on the holds
ratios report, we should add the home libraries as well.
Test Plan:
1) Apply this patch
2) Run the hold ratios report
3) Note the new home libraries column
Signed-off-by: Heather Braum <hbraum@nekls.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
The holds ratio report ignores ordered items. This could cause a library
to inadvertently order more copies of a title than they actually need.
An option should be added to count ordered items ( i.e. any negative
notforloan value ).
Test Plan:
1) Apply this patch
2) Create a record with two items, one regular, one ordered.
3) Place 3 holds on the item
4) Run the reserve ratios report, by default you should see this record
5) Check the new 'include ordered' checkbox, rerun the report
6) Note that record is no longer displayed
Signed-off-by: Heather Braum <hbraum@nekls.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch makes columns Holds, Items and "Hold ratio" to sort
numerically instead of lexicographically. Also changes default sorting
column from "Holds" to "Hold ratio" because this is a hold ratios
-report, not hold count report.
Also cleans up an excess aoColumn -definition, because aoColumns ==
aoColumnDefs without target operator. No point in defining columns
twice.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This enhancement introduces a possibility to place orders
from hold ratios list:
- new option "Add order to basket" -> "From titles w/ highest hold ratios";
(user gets redirected from acqusition to "hold ratios" list in circulation)
- "N to order" in "Items needed" column now becomes a link - when clicked,
user gets redirected back to acquisition, directly to order form for
a choosen title (suggested quantity "N to order" is being preserved)
- in the "Items needed" column, there is an additional indication if
there are any pending (not yet received) orders for a given title
This solution is not exactly ideal.. most important drawback: to use
it librarian needs both acquisition & circulation priviledges; if not
having both - new options will not show / wouldn't be active. But it
requires relatively small amount of changes in the code.
To test:
- apply patch,
- test new functions (try to place some orders using an newly added
option, examine resulting order records etc.)
- check modified hold ratios list for possible problems (for user
with only circulation priviledges, additional information regarding
pending orders should be still visible, but not the link
to order form)
- ensure the two following existing options for adding orders to basket
("From an existing record", "From a new (empty) record") a still working
properly.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Minor edit in signoff: Changed "w/" to "with"
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
This works nicely in my tests, neat new addition.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10649 introduced a new include file for adding DataTables-related
JavaScript assets. This patch adds use of this include file to all
circ-related pages which use DataTables.
Apply the patch and test the following pages to confirm that table
sorting works correctly:
- Circulation
- The UseTablesortForCirc system preference must be enabled.
- Check out to a patron with existing checkouts. Choose a patron who
is a guarantor to another patron with checkouts in order to test the
relatives' checkouts table.
- The checkouts and relatives' checkouts tables have been modified to
exclude articles when sorting of titles.
- Hold ratios - The title column has been configured to exclude articles
from sorting
- Transfer to receive
- Holds queue
- The title column has been configured to exclude articles when
sorting
- The date column has been modified to use the title-string filter for
sorting. An unformatted date is now passed from C4::HoldsQueue.pm to
the template, where the KohaDates filter is used for formatting.
Sorting is based on the unformatted date.
- Holds awaiting pickup
- The "available since" column has been configured for sorting on an
unformatted date. waitingreserves.pl now passes the unformatted
date to the template, and formatting is done using the KohaDates
filter.
- The title column has been configured to exclude articles when
sorting.
Edit: Rebased on current master following commit of Bug 11605
Signed-off-by: A. Sassmannshausen <alex.sassmannshausen@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
The default entry is 20 and can be apply to all tables.
Bug 11555 apply the menu entries to all tables, redefining it is
uesless and can be removed.
Test plan:
Test pages impacted by this patch and verify there is no regression on
the tables.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
The DataTables plugin doesn't by default take multiple columns into
account when sorting. The hold ratios report presents a situation where
it makes sense to sort by default based on two columns: hold count and
title, since there are likely to be many titles with the same hold
count.
This patch adds sorting by default on holds (descending) and title
(ascending). It also modifies the configuration of the title sort to
exclude articles when sorting.
To test, view the hold ratios report. If necessary use the filter form
to reduce the minimum hold ratio and generate more results. Confirm that
the correct columns can be sorted.
Note that by default one can manually trigger sorting on two columns by
shift-clicking the second column header.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
JS is a requirement for the staff client, so the sort link on header is
useless.
Test plan:
Check that there is no regression (sort, data, etc.) on the hold ratios
table.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested on top of patch for bug 9459.
All tests and QA script pass.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Replace the tablesorter plugin with the DataTables plugin on the
hold ratios report page.
To test, open the hold ratios report (Circulation -> Hold ratios).
Confirm that table sorting works correctly.
Revision adds correct pagination options and natural sort for 'items
needed' column.
Patch now depends on Bug 9431
(http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9431) which
introduces the natural sort plugin.
Further revision corrects template path to datatables assets.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Comment: On top of Bug 9431. Sorting works. No errors.
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
All instances of the old DynArch calendar have been replaced with
jQueryUI versions and the old library files have been removed.
calendar.inc has been modified to include jQueryUI localization
strings and global configuration options. Just add a "datepicker"
class to an input field to trigger a datepicker prompt.
If you would like two fields in one from to limit each other (one
is date from, one is date to), add these classes to each:
"datepickerfrom" and "datepickerto." This will prevent an invalid
entry, e.g. a date in the latter which falls before the former.
jQueryUI is now upgraded to the latest verision, 1.8.21.
Edit: Now with proper translatability, date formatting, first day
of the week handling, and RTL support.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Ian Walls <koha.sekjal@gmail.com>
QA Comment: rebased on current master; minor merge conflicts with other patches pushed
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
An invalid template syntax for defining a variable's default
value is found in the circ report template and several
others:
[% DEFAULT LibraryNameTitle="Koha Online" %]
Based on the T:T docs this appears to be the correct way of defining
a default value:
[% LibraryNameTitle or "Koha Online" %]
Reference:
http://template-toolkit.org/docs/manual/Syntax.html#section_Implicit_Directives_GET_and_SET
Signed-off-by: Nicole Engard <nengard@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Fixes various pages where the biblionumber was missing in links to the detail page of a record.
Should also fix 6241.
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
I made the changes Owen suggested
- added the class="ratiolimit" back
- fixed additional link in waitingreserve.tt
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
