Clicking on "Delete record" while there are existent subscriptions no
longer delete the record and the subscription. Instead an alert box
inform the user that he must delete all subscription before deleting the
record.
To test:
1) Add a subscription to a biblio, or check a biblio which has one
attached already.
2) Remove all items if there are any.
3) Apply patch.
4) Confirm that the 'Delete record' item is disabled in the list.
5) Attempt to 'Delete record', you should recieve
an error message stating to delete all subscriptions before
deleting record.
6) Sign off.
Sponsored by: Lunds Universitetsbibliotek
Signed-off-by: Samu Heiskanen <samu.heiskanen@hypernova.fi>
Signed-off-by: Frank Hansen <frank.hansen@ub.lu.se>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch moves translatable strings out of catalog-strings.inc into
catalog.js, wrapped in the double-underscore function for
translation.
To test that each affected string correctly appears in the interface:
- View the details for a bibliographic record which has items attached.
- From the Edit menu, choose "Delete record." You should get an alert,
"X item(s) are attached to this record. You must delete all items
before deleting this record."
- From the Edit menu, choose "Delete all items." You should get an
alert, "Are you sure you want to delete the X attached items?"
- When logged in as a user with acquisitions and cataloging privileges,
view the details for a bibliographic record which is used in an order
in Acquisitions. Delete any items attached.
- Choose "Delete record" from the Edit menu. You should get an alert,
"Warning: This record is used in X order(s). Deleting it could cause
serious issues on acquisition module. Are you sure you want to delete
this record?"
- In Acquisitions, view a basket containing orders. Cancel the
order for a title in the basket. Open the detail page for the title in
the cancelled order. Try to delete it. You should get an confirmation,
"X deleted order(s) are using this record. Are you sure you want to
delete this record?"
- Perform the same test as a user with cataloging but not acquisitions
privileges. The alert should say "X deleted order(s) are using this
record. You need order managing permissions to delete this record."
- When logged in as a user with cataloging but not acquisitions
privileges, view the details for a bibliographic record which is used
in an order in Acquisitions. Delete any items attached.
- Choose "Delete record" from the Edit menu. You should get an alert, "X
order(s) are using this record. You need order managing permissions to
delete this record."
- View the details for a bibliographic record which has a hold.
- Choose "Delete all items" from the Edit menu. You should get an alert,
"X hold(s) on this record. You must delete all holds before deleting
all items."
- View the details for a bibliographic record which has no items.
- Choose "Delete record" from the Edit menu. You should get an alert,
"Are you sure you want to delete this record?"
- Choose "Edit items in a batch" from the Edit menu. You should get an
alert, "This record has no items."
I could not find any instance of the PopupZ3950Confirmed function in
catalog.js being triggered so I don't think the associated string can be
tested.
TESTING TRANSLATABILITY
- Update a translation, e.g. fr-FR:
> cd misc/translator
> perl translate update fr-FR
- Open the corresponding .po file for JavaScript strings, e.g.
misc/translator/po/fr-FR-messages-js.po
- Locate strings pulled from
koha-tmpl/intranet-tmpl/prog/js/catalog.js for
translation, e.g.:
msgid "This record has no items."
msgstr ""
- Edit the "msgstr" string however you want (it's just for
testing).
- Install the updated translation:
> perl translate install fr-FR
- Switch to your newly translated language in the staff client
and repeat the test plan above. The translated strings should
appear.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch puts definition of the missing "searchid" variable into an
include file to be used by various bibliographic detail pages. The
variable is required by several JavaScript functions.
To test, apply the patch and locate or create a record with no items.
Open the labeled MARC view and choose Edit -> Delete record. Confirm the
deletion. The deletion should complete correctly.
Perform the same test with the detail view, ISBD view, MARC view, and
items view.
Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We do not longer need the order variables to be passed from the
controllers, we can call the methods on the biblio object instead.
There is something wrong with our ->search method and TT behaviours, it
is hard to retrieve object list in a scalar context.
If [% objects.method.count %] is called, objects.method will get the
first object of the list and count will explode (Koha::Object->count
does not exist)
We need to force the call in a scalar context to retrieve an iterator
and prevent to fetch all the objects (we could have called all then
size, but it's not efficient)
If adopted I will move the plugin on a separate bug report to ease
backport
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch adds HTML comments to Template::Toolkit include files which
contain <script> tags so that it is clear where the embedded scripts can
be found in the code.
To test, apply the patch and view source on the following pages to
verify the presence of the comments:
Acquisitions home page:
- acquisitions-toolbar.inc
- validtor-strings.inc
- js_includes.inc
- format-price.inc
Acquisitions -> Add order from new record,
Acquisitions -> Receive order:
- additem.js.inc
Cataloging -> Add/Edit item:
- columns_settings.inc
- strings.inc
- select2.inc
- calendar.inc
- str/cataloging_additem.inc
Authorities home page:
- authorities_js.inc
Bibliographic detail page:
- catalog-strings.inc
Cataloging -> Advanced editor:
- cateditor-ui.inc
- cateditor-widgets-marc21.inc
Administration -> Item types:
- greybox.inc
ILL requests:
- ill-list-table-strings.inc
Web installer
- installer-intranet-bottom.inc
Web installer -> Onboarding
- installer-strings.inc
Lists -> List contents -> Merge records
- merge-record-strings.inc
Patrons -> Patron -> Change password
- password_check.inc
- str/members-menu.inc
Patrons -> Patron -> Print summary
- slip-print.inc
Circulation -> Check out
- timepicker.inc
Administration -> System preferences:
- str/tinymce_i18n.inc
- wysiwyg-systempreferences.inc
Cataloging -> Z39.50 Search:
- z3950_search.inc
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch removes the "type" attribute from <script> tags in several
staff client include files. Also removed: Obsolete "//<![CDATA[ //]]>"
markers.
This patch also makes minor indentation changes, so diff using the "-w"
flag.
To test, apply the patch and confirm that examples of affected pages
work properly without any JavaScript errors in the browser console:
- Acquisitions -> Vendor (uses acuisitions-toolbar.inc)
- Acquisitions -> Vendor -> Add to basket -> From a new (empty) record
(uses additem.js.inc)
- Catalog -> Search results -> Bibliographic detail view. (uses
browser-strings.inc, catalog-strings.inc, datatables.inc, and
format_price.inc )
- Tools -> Label creator -> Manage -> Label batches -> Export batch
(uses greybox.inc)
Validating the HTML source of any of these pages should return no errors
related to the "type" attribute.
Signed-off-by: Nadine Pierre <nadine.pierre@inLibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
The naming mismatch can cause javascript errors.
Test Plan:
1) Confirm the string vars used in catalog.js match the ones in
catalog-strings.inc
Signed-off-by: Pierre-Luc Lapointe <pierreluc.lapointe@inLibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch modifies multiple catalog-related pages in order to move
embedded JavaScript to the footer.
The JavaScript previously embedded in cat-toolbar.inc is moved to a
separate file (catalog.js).
To test, apply the patch and test JavaScript-driven interactions on all
modified pages, including JS which isn't page-specific (menus, help,
etc). The functionality of the catalog toolbar should be tested on each
page.
- Bibliographic detail pages (standard, MARC, labeled MARC, ISBD).
- Advanced search page
- Local cover image viewer
- Item search page
- Item detail page
- Search history page
- Checkout history page
https://bugs.koha-community.org/show_bug.cgi?id=17839
Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
