Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Move to aqinvoice_adjustment
Move to Koha::Acquisition::Invoice::Adjustments
Test if variable exists before count
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patchset adds the ability to add adjustments to an invoice, one can
provide a reason, an adjustment amount, select a budget, and choose
whether to encumber the funds before the invoice is closed or not
To test:
1 - Create a new invoice with or without a shipping cost
2 - Note there are no existing adjustments
3 - Add an adjustment
4 - Submit the form withno changes, nothing happens
5 - Update the adjustment you created, ensure changes are saved but no
extra adjustment created
6 - Add another invoice prodiving only reason or amount (you can have 0
value adjustments)
7 - Verify the adjustment total at bottom is correct
8 - Recieve some orders
9 - Verify totals are correct
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
mechanism, it will be tedious
This patch:
- adds a Template::Toolkit plugin that generates <script> and
<link> tags for JS and CSS files, and inserts automatically the Koha
version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable
Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
checking your browser's dev tools (there should be no 404 for JS and
CSS files, and the Koha version should appear in filenames) and the
server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch modifies some staff client acquisitions templates so that
JavaScript is included in the footer instead of the header.
To test, apply the patch and test the JavaScript-driven features of the
modified templates: All button controls, DataTables functionality, tabs,
etc.
- Acquisitions -> Invoices
- Datepickers
- Search for invoices
- Datatable
- Acquisitions -> Late orders
- Datepickers, datatables, selection controls (when searching by
vendor)
- Acquisitions -> Vendor -> Basket -> Add to basket -> From an existing
record -> Search
- Datatables, View MARC modal
- Acquisitions -> Vendor -> Basket -> Add to basket -> From a new
(empty) record
- Form validation, inactive fund control, add users to notify on
receiving.
- Acquisitions -> Vendor -> Basket -> Add to basket -> From a
subscription -> Search
- Datatables, show only renewed, show/hide search form
- Acquisitions -> Vendor -> Basket -> Add to basket -> From a suggestion
- Datatables, "Show" controls
- Acquisitions
- "Ordered" link in table of funds
- Datatables
- Acquisitions -> Vendor -> Receive shipment -> Invoice -> Receive
- Datepickers, item add form plugins (test with AcqCreateItem set to
'receiving an order.'
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
==TEST PLAN==
1) Open Acquisitions and click on the ordered link under the fund
2) There will be no link on the title
3) Go back and click on thespent link
4) There will be no link on the title
5) Apply patch
6) Go to Acquisitions and click on ordered
7) There will now be a link that takes the user to the book catelog
page
8) Go back and click on sent
9) There will be a link that takes the user to the book catelog
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Works like a charm!
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.
In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.
To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:
- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.
Revised: I intended for this to be built on top of Bug 15883. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883
Works as described, all pages on test plan
No Errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The "highlight" class on table rows is unnecessary since we have a CSS
rule which defines colors for alternating row colors. This patch removes
use of the "highlight" class from templates and removes the definition
from staff-global.css
To test, view the affected pages and confirm that the change has not
broken anything.
Acquisitions -> Vendor -> View basket
Acquisitions -> Late orders
Acquisitions -> Ordered
Acquisitions -> Vendor -> Receive shipment
Acquisitions -> Spent
Acquisitions -> Vendor details -> Contracts table
Administration -> MARC frameworks (comment removed only)
Administration -> Class sources
Authorities -> Authority search results
Catalog -> Bibliographic detail page -> Items -> View item's checkout
history
Catalog -> subject.tt (is this template used?)
Cataloging -> Cataloging search results
Patrons -> Patron account
Reports -> Patrons who haven't checked out
Reports -> Statistics wizards -> Patrons
Reports -> Top lists -> Most-circulated items
Reports -> Inactive -> Items with no checkouts
Reports -> Reports dictionary
Reports -> Statistics wizards -> Circulation
Reports -> Statistics wizards -> Holds
Holds -> Place a hold -> Existing holds table
Serials -> New subscription -> Search for a vendor -> Search results
Serials -> Check expiration
Serials -> Subscription -> Serial collection
Serials -> Subscription -> Serial collection -> Edit serials
Suggestions
Tags -> View tags -> View titles with a tag
Tools -> Manage staged MARC records -> Batch (I think the affected
section of this template is obsolete)
Tools -> Log viewer -> Log result
Lists -> View lists (May be broken by Bug 15916)
Note that if you search the templates for instances of a <tr> with a
"highlight" class you'll find two instances in slip templates which
refer to a class defined in printreceiptinvoice.css.
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Looks good. Haven't seen any regression.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
This patch removes instances of dt_add_type_uk_date() from acquisitions
templates and updates sorting configurations according to current
guidelines.
In cases where a formatted date was passed from a Perl script, the
script has been modified to pass an unformatted date.
Several instances of the no longer valid align attribute have been
removed from <td> tags in favor of an existing "data" class which is
suitable for display of currency values.
To test, view the following pages in Acquisitions. Columns containing
dates should sort correctly regardless of dateformat system preference
setting. Columns containing bibliographic titles should ignore articles
when sorting.
- Add to an order from a staged file: The table of staged files should
sort correctly. After clicking "add orders" for one of the staged
files, the table of titles in that staged file should also be sorted
correctly.
- Add to an order from a subscription. The table of subscription search
results should sort correctly.
- Orders search results should sort correctly.
- Late orders should sort correctly.
- Search for a vendor. Click on the vendor name to view the vendor
detail page. The table of contracts on this page should sort
correctly.
- From the Acquisitions home page click a number in the "spent" column
of the table of available funds. The table of orders should sort
correctly.
- From the Acquisitions home page click a number in the "ordered" column
of the table of available funds. The table of orders should sort
correctly.
- From a vendor detail page, click the "Receive shipments" button. On
the receive shipments page the table of shipments should be sorted
correctly.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
On ordered.pl and spent.pl, the itemtype codes are displayed, instead of
descriptions.
Links for the ordernumber should be changed. In ordered.pl, we are
redirected to the receive page. In spent.pl, the links are deleted.
Signed-off-by: Broust <jean-manuel.broust@gmail.com>
Revisited patch: The link to orderreceive was broken, so I undo the
changes.
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works alright, itemtype descriptions are shown.
The removed link was potentially 'dangerous' as you shouldn't
get to the receive page for an order, without providing an invoicenumber
first.
Passes all tests and QA script.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch adds an upgraded copy of the DataTables plugin to the jQuery
plugin directory outside the theme directories. Copies of the old
DataTables plugin scripts have been left in the old location while
templates are incrementally updated.
To test, visit each affected page in Acquisitions and confirm that table
sorting still words correctly:
- Acquisitions home
- Acquisitions -> Late orders
- Acquisitions -> Order search
- Acquisitions -> Ordered (from table of available funds)
- Acquisitions -> Spent (from table of available funds)
- Acquisitions -> Vendor search
- Acquisitions -> Vendor detail
- Acquisitions -> Vendor -> Basket
- Acquisitions -> Vendor -> Basket -> Add order from existing record
-> Add order from suggestion
-> Add order from subscription
-> Add order from external source
-> Add order from staged file
- Acquisitions -> Vendor -> Basket groups
- Acquisitions -> Vendor -> Uncertain prices
- Acquisitions -> Vendor -> Invoices
- Acquisitions -> Vendor -> Invoices -> Invoice
- Acquisitions -> Vendor -> Receive shipments
- Acquisitions -> Vendor -> Receive shipments -> Receipt summary (click
invoice number)
Also test one or more pages which have not been modified to confirm that
old DataTables assets are still in place and working (ex: Circulation,
Quotes editor, Saved reports, etc.)
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>
Edit: Rebased on current master
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests und QA script pass. I found some smaller bugs, that
also appeared on master without the patch applied. For some datatables
I struggled with a result set of over 5.000 lines - there is room for
improvement where a lot of data can be shown.
testing notes:
- Acquisitions home
- Amounts don't sort correctly before and after the patch, see bug 10792.
- Acquisitions -> Late orders
- OK.
- Acquisitions -> Order search
- OK.
- Acquisitions -> Ordered (from table of available funds)
- OK.
- Acquisitions -> Spent (from table of available funds)
- OK.
- Acquisitions -> Vendor detail
- OK.
- Acquisitions -> Vendor -> Basket
- OK.
- Acquisitions -> Vendor -> Basket -> Add order from existing record
- Datatables seems not to be in use here?
-> Add order from suggestion
- OK.
-> Add order from subscription
- OK.
-> Add order from external source
- OK.
-> Add order from staged file
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This patch adds the JS required to enable correct sorting
of dates in DD/MM/YYYY format to pages which require it.
To test, set your dateformat accordingly and confirm on the
affected pages that dates are sorted correctly.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Resolved conflict in serials/serials-search.tt.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This is the first patch for bug 7760 and touches all pages in acquisitions.
This adds a unique id "acq_<filename>" and a class "acq" to the body tag of
each page in acquisitions.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
hide link to neworderempty if user does not have order_manage permission
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
New revision updates for current master and cleans up new
instances introduced by recent commits.
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
2 problems found, fixing those in follo up patches:
- late orders don't allow more than 1 order to be selected
- basketgroups: 'Edit vendor' does the same as 'Manage orders'
This patch introduces a Filter (KohaDates) for use in templates
[% USE KohaDates %]
[% somevariable | $KohaDates %]
This will format the date in the format specified by the systempreference
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
