Commit graph

52401 commits

Author SHA1 Message Date
Aleisha Amohia
60e2c5d5f6 Bug 35768: Show 'Used in' records link for results in cataloguing authority plugin search
To test:

1. Edit a biblio record
2. Go to the 100 tab and click the plugin launcher icon for an author
   tag i.e. next to 100$a
3. Search for an authority and observe the results
4. Notice that the number of times this authority has been "Used" in a
   record is now a link, and clicking it does a search showing those
   records.

Sponsored-by: Education Services Australia SCIS
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 553126e5a3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 16:15:37 +02:00
cdfdfc6b53 Bug 35857: Update authority search pop-up windows with consistent footer markup
This patch updates the cataloging authority finder template in order to
style submission and close buttons in a fixed footer at the bottom of
the pop-up window, with markup consistent with other pop-up windows.

Some inline CSS has been removed in favor of styling the "Clear" button
like a default button. Unrelated, "No results found" message has been
wrapped in a "dialog message" div for consistency's sake.

To test, apply the patch and go to Cataloging -> New record.

- In the "Add MARC record" form, locate a tag which is linked to an
  authority type, e.g. 100$a.
- Click the icon to the right of the field to trigger the authority
  search window.
- There should be a fixed footer in the pop-up window with buttons for
  "Submit," "Clear form," and "Close window." Test that each behave
  correctly.
  - The search results view should have the same footer.
  - Clicking "Choose" from the search results should close the window
    and populate the MARC tag with the correct authority data.

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f49f76d60a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 16:14:15 +02:00
9334fe9392 Bug 36494: Flatpickr error on checkout page if the patron is blocked from checking out
This patch add some error-handling to the recent change to
circulation.tt where we handle dates and on-site checkouts. This
prevents an error in the console when the patron is blocked and the
"specify due date" field is hidden.

To test, apply the patch and make sure OnSiteCheckouts is enabled.

- Go to Circulation and check out to a patron.
- Under the restrictions tab, add a manual restriction.
- When the page reloads and the checkout form is no longer visible,
  confirm that there is no error in the browser console.

Confirm that the Bug 18885 test plan still works.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cc15deb001)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 16:10:20 +02:00
Thibaud Guillot
9dbc2737e1 Bug 18885: Specify due date behavior according to on-site checkbox
When a on-site checkout is performed a date is automatically added but
if you unchecked the date remains. Even with OnSiteCheckoutAutoCheck
syspref

Test plan:
1) Do an on-site checkout by clicking on checkbox and see date added
2) Unchecked and see that the date remains on input
3) Do another test with OnSiteCheckoutAutoCheck enabled
4) Apply this patch and repeat actions

Normally now its works correctly

Signed-off-by: tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ec8897377e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 16:08:55 +02:00
e04518f050 Bug 36033: DBRev 23.11.05.001
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6a6db6aa7c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 15:46:17 +02:00
6ba45bc290 Bug 36033: Add more indexes to table pseudonymized_transactions
Table pseudonymized_transactions contains :
  KEY `pseudonymized_transactions_ibfk_1` (`categorycode`),
  KEY `pseudonymized_transactions_borrowers_ibfk_2` (`branchcode`),
  KEY `pseudonymized_transactions_borrowers_ibfk_3` (`transaction_branchcode`)

To improve SQL queries performance, it needs more indexes, specially on itemnumber.

Looking at table statistics :
  KEY `timeidx` (`datetime`),
  KEY `branch_idx` (`branch`),
  KEY `type_idx` (`type`),
  KEY `itemnumber_idx` (`itemnumber`),

So index is need on pseudonymized_transactions columns :
itemnumber => For join with table items
transaction_type => For filter on type issue, return ...
datetime => For filter on date, this will help cleanup script

Test plan :
1) Run updatedatabase.pl
2) Check indexes are created in table pseudonymized_transactions
3) Run SQL query :
   describe select * from pseudonymized_transactions join items using(itemnumber)
   where transaction_type='issue' and datetime < date_sub(curdate(), INTERVAL 30 DAY)
=> You see the 3 new indexes used in 'possible_keys'.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0573d01eaa)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 15:44:58 +02:00
c65b3a3813 Bug 36321: Problem when dateexpiry in BorrowerUnwantedField
hen dateexpiry is in BorrowerUnwantedField it is hidden in patron edition form.
The problem is when editing an existing patron the value is re-computed with category settings, as if it where empty.

This comes from all fields in BorrowerUnwantedField beeing removed from %newdata in memberentry.pl.
Whe must skip dateexpiry.

Test plan :
1) Be sure dateexpiry is not in BorrowerUnwantedField
2) Define a patron category with enrollment period 12 month
3) Create a new patron in this category
4) Its expiration date is in now + 12 month
5) Edit the patron category to set enrollment period 6 month
6) Add dateexpiry in BorrowerUnwantedField
7) Edit the patron and save
=> Without patch the expiration date is changed to now + 6 month
=> With patch the exporation date is unchanged

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Perl-tidied.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 571521ba13)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 15:43:28 +02:00
e3a04f73a2 Bug 36708: Fix column index for processing No automatic renewal after
To test:
1- Find or create a circulation rule with a 'Holds allowed (total)' limit of 3 (or another number) and no value in 'No automatic renewal after (hard limit)'
2- Select to edit the rule, and note that 'No automatic renewal after (hard limit)' box in the editing line is now populated with a date
3- Note also that 'Holds allowed (total)' is empty in your editing line
4- If you save your edits without clearing the new 'No automatic renewal after (hard limit)' date, it will save as part of the rule. Also, 'Holds allowed (total)' will save as Unlimited unless you re-add your numerical value.
5- APPLY PATCH
6- Try again, the values should save corrected and not erroneously fill the No automatic renewal after (hard limit) column.

Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-22 14:58:36 +02:00
64ebafd69b Bug 36612: (QA follow-up) Add 'source' to public_read_list
This patch adds the required 'source' field to the public_read_list for
tickets.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a464e20091)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:55:51 +02:00
d6cf0250a9 Bug 36612: Add public_read_list to Koha::Ticket
Without the public_read_list to define which fields should be accessible
from the public endpoints we will always return a 500 from the API on
otherwise successfull additions of tickets via the OPAC.

Test plan
1) Enable OPACCatalogConcerns
2) Login to the OPAC and "Report a concern"
3) Note the error message in the UI "There was an error when submitting
   your concern, please contact a librarian."
4) Confirm that the concern is actually created regardless
5) Apply the patch here and restart plack
6) Submit another 'Report a concern' and now note the success message
   "Your concern was successfully submitted."

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 834fc10650)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:55:51 +02:00
a4ca7a68d3 Bug 36612: Unit test for public ticket add
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit af0422ccab)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:55:51 +02:00
Emily Lamancusa
aa7bea04c4 Bug 36832: (bug 36791 follow-up) Allow authid=0
To test:
1. Go to the Authorities module and do a Z39.50 search that will return
   results (e.g. a general subject heading)
2. Import an authority record from the results
--> Confirm that the record is imported into the editor
3. Authorities > New, replace it via Z39.50, confirm it's imported
4. Authorities > New, fill the required fields, confirm it saves
5. Edit an existing authority, replace it via Z39.50, confirm it saves
6. Edit an existing authority, replace authid=nn in the URL with a
   number that doesn't exist like 1000000, confirm you get a 404 page

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1aba01adb4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:48:24 +02:00
Emily Lamancusa
f666716b3b Bug 36791: (QA follow-up) Simplify conditional
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 37bda5d130)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:48:24 +02:00
Janusz Kaczmarek
b9ba92c153 Bug 36791: Koha explodes when trying to edit an authority rec. with an invalid authid
When trying to open the authority editor with authid=<invalid_authid>
(e.g. a deleted authid) Koha explodes with a message:
Can't call method "authtypecode" on an undefined value at
/kohadevbox/koha/authorities/authorities.pl line 556

This this because authtypecode method is called on the result of
->find without verifying that it was succesful.

Test plan:
==========
1. Try to edit an auth rec. giving as a authid (in URL) a non-existing
   authid, e.g. in ktd, with standard ktd test data:
   http://your_ktd:8081/cgi-bin/koha/authorities/authorities.pl?authid=100000
   Koha should explode with the message:
   Can't call method "authtypecode" on an undefined value at
   /kohadevbox/koha/authorities/authorities.pl line 556
2. Apply the patch; restart_all.
3. Repeat p. 1.  You should get the 404 error page.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 18843cabdb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:48:24 +02:00
dce78a0ecd Bug 34972: (QA follow-up) Remove second transfer from Circulation.t
Removing the manual transfer and rightaway doing the Reserve
transfer. One test description was misleading too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7f22156b8f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:44:24 +02:00
4d473a1788 Bug 34972: (QA follow-up) Remove some ModReserveCancelAll imports
Not used? Dont import.
Which actually only leaves circ/waitingreserves.pl as the only
'real' caller.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 87c1759dd7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:44:24 +02:00
Emily Lamancusa
18884add71 Bug 34972: Remove GetOtherReserves
GetOtherReserves attempts to set the waiting/transit status for the next
hold on the list when applicable, but in practice it either leaves the
hold state unchanged, or sets the itemnumber without setting the found
status (erroneously converting bib-level holds to item-level holds).

The latter situation only occurs when the user has been prompted to
confirm, cancel, or revert the hold, and is able to ignore the prompt.
In those situations, the hold's state should not change.

GetOtherReserves does not need to change the hold state, and it does not
do so correctly. Besides that, it does not do much other than call
CheckReserves, and is only used in 3 places.

This patch removes GetOtherReserves, and refactors returns.pl and
C4::Reserves::ModReserveCancelAll to call CheckReserves directly instead.

To test:
1. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
2. Check in an item from that record to fill Patron A's hold
3. Set the hold's expiration date to yesterday by accessing the database
    in the command line:
    - In a ktd shell prompt, open the db client with koha-mysql kohadev
    - UPDATE reserves
        SET expirationdate = DATE_SUB(CURDATE(), INTERVAL 1 DAY)
        WHERE borrowernumber = <Patron A's borrowernumber>
4. Go to Circulation > Holds Awaiting Pickup, and find the hold in the
    "holds waiting past their expiration date" tab
5. Click the "Cancel hold" button in the Actions column next to the hold
   (do not check in the book)
6. Return to the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold and does not
    have a waiting status

7. Cancel Patron B's hold
8. Place 2 new holds on the record: one for Patron A at the logged-in
    library, and one for Patron B at a different library
9. Check in an item to fill Patron A's hold
10. Repeat steps 3-5 to expire and cancel Patron A's hold
11. Return to the Holds tab of the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold, and there is no
    "Revert transit status" button

12. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
13. Check in an item from that record to fill Patron A's hold
14. Check in the same item again. A modal will pop up, saying that the
    hold is already waiting
15. In the modal, choose a cancellation reason and click "Cancel hold"
--> A new modal will pop up to fill Patron B's hold
16. Click "Ignore" on the modal for Patron B's hold
17. Return to the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold and does not
    have a waiting status

18. Apply patch
19. Repeat steps 1-6
--> Note that Patron B's hold is still a bib-level/"next available" hold
20. Repeat steps 7-11
--> Note that Patron B's hold is still a bib-level/"next available" hold
21. Repeat steps 12-17
--> Note that Patron B's hold is still a bib-level/"next available" hold

Make sure correct behavior is unchanged:

22. Cancel Patron B's hold
23. Place 2 new holds on the record: one for Patron A at the logged-in
    library, and one for Patron B at a different library
24. Check in an item from that record to fill Patron A's hold
25. Check in the same item again. A modal will pop up, saying that the
    hold is already waiting
26. In the modal, choose a cancellation reason and click "Cancel hold"
--> A new modal will pop up to fill Patron B's hold
27. Click "Print slip, transfer, and confirm" on the modal for Patron B's hold
--> Confirm that the information on the slip is correct
--> Confirm that the hold is correctly put in transit

22. Set HoldsAutoFill and HoldsAutoFillPrintSlip to "Do"

23. Place a bib-level hold for the logged-in library
24. Check in an item from that bib
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly assigned and set to waiting
25. Place a bib-level hold for a different library
26. Check in an item from that bib
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly put in transit
27. Change the logged-in branch to match the hold pickup location
28. Check the item in
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly assigned and set to waiting

29. Repeat steps 22-26
--> Confirm a correct hold slip pops up for Patron B's hold
--> Confirm that Patron B's hold is correctly put in transit
30. Cancel Patron B's hold
31. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
33. Repeat steps 24-26
--> Confirm a correct hold slip pops up for Patron B's hold
--> Confirm Patron B's hold is correctly set to Waiting

34. Prove t/db_dependent/Circulation.t
35. Prove t/db_dependent/Koha/Holds.t
--> Tests pass

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit dc00e55a32)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:44:24 +02:00
Emily Lamancusa
c4661a1660 Bug 34972: Add tests for ModReservesCancelAll
To test:
1. Apply this patch only
2. prove t/db_dependent/Koha/Holds.t
--> Tests pass
3. Apply the other patch
4. prove t/db_dependent/Koha/Holds.test
--> Tests still pass

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d71f527202)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:44:24 +02:00
2ff0a65783 Bug 36508: Refresh patron object when updating category
To test:
1 - Find a ptron, I sued #45 in KTD, note their category
2 - Update them from one category to another using finesunder:
    perl misc/cronjobs/update_patrons_category.pl -f ST -t S --finesunder=5.00 --where "me.borrowernumber=45" -v -c
3 - Check their modification log (I told you to enabled BorrowersLog,
    right?)
4 - See many fields reported changed
5 - Apply patch
6 - Repeat, but change the to and from options
    perl misc/cronjobs/update_patrons_category.pl -f S -t ST --finesunder=5.00 --where "me.borrowernumber=45" -v -c
7 - Note only one column changed in the logs
8 - Ask for unit tests

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cae2efd69d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:37:01 +02:00
9659b8cddf Bug 36508: Unit tests
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8f359aa72c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:37:01 +02:00
0513ffa58e Bug 36563: Turn into array only if required
Test plan, apply first patch:
1- Visit item search:
   http://localhost:8081/cgi-bin/koha/catalogue/itemsearch.pl
2- Set "Home library" -> "is not" -> "Centerville". Notice you get items
   from Centerville.
3- Apply second patch, repeat step 2, notice you now don't get items
   from Centervile.
4- Test other use cases, like 'is' and 'is not' for multiple choices

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit eae74ed6d9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:35:48 +02:00
d8ca12b404 Bug 36563: Dirty fix
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 492d7be2cc)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:35:48 +02:00
Emmi Takkinen
d26306ed32 Bug 36313: Fix Undefined subroutine &C4::Circulation::CheckReserves error
On (at least) git installations of Koha checkouts and checkins fail on
error 500. Logs have following error:

Undefined subroutine &C4::Circulation::CheckReserves called...

Error happens also when one tries to open patrons checkouts from detail page.
Koha doesn't die but table just keeps loading. Solution is to add C4::Reserves
before CheckReserves when it's called from Circulation.pm.

To test:
1. Apply this patch.
2. Try to check out and check in item.
=> Confirm both operations are succesfull.
3. Attempt to open patrons checkouts from patron detail and checkout page.
=> Table should load

Also prove t/db_dependent/Circulation.t.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: BabaJaga <babajagawgoglach@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 80beaf875b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:30:10 +02:00
Brendan Lawlor
34e17b5aba Bug 33832: Allow updating username without changing password on member-password.pl
This patch updates the change password page on the staff interface to
allow for changing the patron's username without changing the password.
If the new password is an empty string we can skip setting the patron's
password and sending the new password to the template.

Test plan:
1. From a patron record tool bar click 'Change password'
2. Notice that if you try to change the user's name without also
   changing the password the page just reloads and nothing happens
3. Apply patch and restart_all
4. From the patron record click 'Change password' again
5. Set the user's new username and  password eg. '1234Abc' and click
   'Save'
6. Confirm that you can log in to the OPAC with the user
7. Return to the patron record and click 'Change password' again
8. This time change just the 'New username field' and click 'Save'
6. Notice that the username is updated
7. Confirm you can log into the OPAC with the new username and the
   original password '1234Abcd'
8. Make sure that the change password form still validates passwords
   for length and matching errors etc

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e26fc0a3d5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-22 14:13:13 +02:00
89f7bfae73 Update release notes for 23.11.05 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-03 15:15:06 +02:00
0aaee9fab5 Increment version for 23.11.05 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-05-03 15:02:03 +02:00
Julian Maurice
57b1c90e19 Bug 36149: Add userenv middleware to app.psgi
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5cca1bdcd67a1a8fc8b0bb2aa6c666cccdb49fbb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
0534259c2c Bug 36149: (follow-up) POD and tidy
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 31943a5781aaaa9803ca87247eb7a663fb999fc5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
3dd1cdd74f Bug 36149: Unset userenv from middleware
The userenv (logged in user's info) are stored in
$C4::Context->context->{activeuser}, which persists in plack worker's
memory.
It's really bad in theory as we are not cleaning it before or after the
HTTP request, but only when set_userenv is called (what we are doing
commonly in C4::Auth::get_template_and_user).
If C4::Context->userenv is called before set_userenv we should get undef,
not the userenv from the previous request!
In practice this should not be a problem, but well... who really knows?

This patch suggests to have a middleware to deal with removing the
userenv at the beginning of each request (maybe it should be after, right? - FIXME).

To test:
1 - Edit /etc/koha/sites/kohadev/koha-conf.xml to set <plack_workers>1</plack_workers>
2 - Edit about.pl  and add a line after: CGI->new:
    warn Data::Dumper::Dumper( C4::Cointext->userenv() );
3 - tail -f /var/log/koha/kohadev/*.log
4 - View about.pl in staff interface, should get a "somethign's wrong" warning
5 - Reload, you get current user info
6 - Open an incognito tab, sign in as a different user and click some stuff
7 - Reload about.pl in other window
8 - You get the opac user info
9 - Apply patch
10 - Edit /etc/koha/sites/kohadev/plack.psgi and add the middleware after "RealIP":
     enable "+Koha::Middleware::UserEnv";
11 - Restart all
12 - Reload about.pl - you get a "Something's wrong" warning
13 - Click things in opac on incognito window
14 - Reload about.pl  - only "Something's wrong" - you no longer see any user info

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 576e7e09fdca703f76c0d10ae55eebf12ee1fdf4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
55931114b6 Bug 19613: Use the 'note' profile
WNC amended patch: tidied

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 3cb586b72165bcbd029948f46407359be9d5e9a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
383984a016 Bug 19613: Scrub borrowers fields: borrowernotes opacnote
To prevent XSS

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 83db8696ca7a83aba224a0ab645f03447a96887b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
e413db6083 Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences
Also tidy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 42d388c80fcdd98c2594ad7b111b8e40c991388a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
fb1c48da9a Bug 36328: Add a separate 'note' profile
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 7a626d8d870039330889d6e48c3ae5ba848d85e9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
11ea420b54 Bug 36328: Add test
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit b315c0f2630ccd738fc811e13d1e95b11d3c8df1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
de4053a0f3 Bug 36328: Add p span div to Scrubber
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit ca64e4f6f30b172d86184c61134f5f29713863d2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
1df8ee1994 Bug 36532: Protect opac-dismiss-message.pl from malicious usages
Really bad design, NEVER retrieve the logged in user from the CGI
param!

See comment 1 for more info

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
(cherry picked from commit a40e1fd62c7320ad5f7b8514ba2bd129aad2d10f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:36:20 +02:00
0a53dabd14 Bug 36382: (QA follow-up) Don't escape quotes in escapeHtml 2024-04-24 07:36:20 +02:00
a9a2b68619 Bug 36382: XSS in showLastPatron dropdown
1) Set borrower surname to:
    <script>alert("here comes trouble");</script>
2) Save, nothing happens
3) Enable showLastPatron
4) Reload patron
5) Note the alert popup
6) Apply this patch
7) Reload patron
8) No alert!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2024-04-24 07:36:20 +02:00
Michael Hafen
eac751072e Bug 36139: Bug 35518 Follow-up to fix AutoSwitchPatron - clear variables
Bug 35518 moved some code blocks to after the call to
get_user_and_template() so that userenv would be populated before it
was needed.  This caused a couple variables to be set before the
AutoSwitchPatron block could prevent them from being set.  Which broke
AutoSwitchPatron functionality.  This clears two variable so that
AuthSwitchPatron works again.

The AutoSwitchPatron clears the $borrowernumber variable to switch
patrons. With the AuthSwitchPatron block moved, the $patron variable
still gets set, and the patron doesn't get switched.  The clears the
$patron variable too.

Also clear the barcode list.
The AutoSwitchPatron block got moved, and now the @$barcodes variable
gets filled and not cleared.  Leading to a 'Barcode not found' error
when the patron is auto switched.

Test plan:
1. Ensure AutoSwitchPatron is turned on.
2. Select the card number of two patron accounts.
3. Find the first patron in circulation.
4. Enter the second patron's card number in the item barcode field to
   switch patrons.
5. Observe the error about item barcode not existing, and the patron did
   not switch.
6. Apply patch and restart services.
7. Enter the second patron's card number in the item barcode field
   again.
8. Observe that the patron was switched with no error about an invalid
   barcode.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4d351d2c6d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-24 07:31:47 +02:00
f53018dce0 Bug 36053: Correct input name for item replacement fields
To test:
1 - Follow test plan and use sample record from bug 35912 ( or similar)
2 - Confirm that when the order is saved the replacement price is $0.00
3 - Apply patch, restart_all
4 - Delete previous orders, and stage and add to basket again
5 - Confirm that upon adding orders to basket the replacement price is saved correctly

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 94da493d0e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-18 09:22:03 +02:00
Brendan Lawlor
1b041972c0 Bug 35980: Check for CAN_user_borrowers_edit_borrowers in patron-toolbar.inc
This patch removes the 'New patron' and 'Quick add new patron' buttons from the patron tool bar that's included on members-home.pl

To test:
1. Log in with a user with only 'catalogue', 'list_borrowers' and 'manage_patron_lists' permissions
2. From the main page click on Patrons
3. Notice there are 'New patron' and 'Quick add new patron' buttons in the members-home.pl page that lead to permissions errors
4. Apply patch, restart all, reload the page
5. Notice the buttons to add new patrons are gone, but the button to manage patron lists is still there

Signed-off-by: Esther <esther@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0b4bb48f2c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-18 08:40:09 +02:00
Brendan Lawlor
c2014f2949 Bug 35980: Check for CAN_user_borrowers_edit_borrowers in more-member.tt
This patch removes edit buttons and add buttons from the more member page if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice there are edit and add (pecil and plus icon) buttons in the patron details page
4. You may have to enable some system prefereences like HouseboundModule to fully test
5. Test that things like Additional attributes and identifiers are still displayed
3. Apply patch, restart all, reload the page
4. Notice the edit and add buttons in the patron details page are gone

Signed-off-by: Esther <esther@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 33c7c8730b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-18 08:10:29 +02:00
Brendan Lawlor
b2ab2e2745 Bug 35980: Check for CAN_user_borrowers_edit_borrowers in members-toolbar.inc
This patch removes the message button and more links from the members toolbar if the user does not have CAN_user_borrowers_edit_borrowers

To test:
1. Log in with a user with only 'catalogue' and 'list_borrowers' permissions
2. Search for a patron
3. Notice the 'Add message' and 'More' buttons in the toolbar only link to permissions errors
3. Apply patch, restart all, reload the page
4. Notice the buttons in the toolbar are gone

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 962290a27d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-18 08:04:54 +02:00
c13b941429 Bug 36447: Circ rules slow to load when many itemtypes and categories
It seems that we loop all categories and item types to build the circ
matrix. We should only loop over values that have actually been used
in circulation rules.

Test Plan:
1) Create 1000 itemtypes and category codes. You can use the following
   script:

   use t::lib::TestBuilder;
   my $builder = t::lib::TestBuilder->new();
   $builder->build( { source => 'Category' } ) for 0..1000;
   $builder->build( { source => 'Itemtype' } ) for 0..1000;

2) Note the lengthy load time for smart-rules.pl
3) Apply this patch
4) Restart all the things!
5) Reload the page
6) Note the much faster load time!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4e04ff28b6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:22:53 +02:00
067522e35e Bug 36159: (QA follow-up) Tidy code
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f44134a1ff)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:12:01 +02:00
c9379ddd00 Bug 36159: Add unit test
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 9c731a75a9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:12:01 +02:00
a9cea8a6c0 Bug 36159: (QA follow-up): Simplify code to supress warnings
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 22d51cdd07)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:12:01 +02:00
104761e917 Bug 36159: Patron imports record a change for non-text columns that are not in the import file
When importing patrons we assume a default of '' for borrower columns not supplied in the file.

When saving we compare the new object we built to the one form the database - for columns are that are not text type we get undef from the db and '' in the object we make. This means we see a difference and log into the BorrowersLog:

   "date_renewed" : {
      "after" : "",
      "before" : null
   },
   "dateofbirth" : {
      "after" : "",
      "before" : null
   },
   "debarred" : {
      "after" : "",
      "before" : null
   },
   "flags" : {
      "after" : "",
      "before" : null
   },
   "gonenoaddress" : {
      "after" : "",
      "before" : null
   },
   "lost" : {
      "after" : "",
      "before" : null
   },
   "password_expiration_date" : {
      "after" : "",
      "before" : null
   },
   "sms_provider_id" : {
      "after" : "",
      "before" : null
   }
}

This can mean a lot of useless logging in sites that do automated imports

Test Plan:
1) Enable 'BorrowersLog' system preference
2) Import the borrowers file attach do this bug report file, matchig on cardnuber, and overwriting
   Contents of the borrowers file are :
surname,firstname,branchcode,categorycode,cardnumber,dateenrolled,patron_attributes,lastseen
Acosta,Ednb,CPL,PT,23529001000463,02/01/2013,,
3) Check the logs, note the modification of columns that have no date
4) Import the file again with the same settings
5) Note the new action log
6) Apply this patch
7) Restart all the things!
8) Import the file again with the same settings
9) Note no new action log was created!

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 67680d5d6a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:12:01 +02:00
badf7521ba Bug 34886: Comment failing tests
These tests highlight the fact that the 'place hold' button visibility in the
search results page **does not** match the 'place hold' button visibility in
the detail page, given the same conditions.
Since that this is a known behavior, these tests should be commented out as they
are failing by design.

prove t/db_dependent/selenium/opac_holds.t

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f8665c8d55)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:10:07 +02:00
6f810dc932 Bug 34886: (QA follow-up) chmod, remove POD
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ae44fd1889)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-04-17 17:10:07 +02:00