Commit graph

26974 commits

Author SHA1 Message Date
4db2e745e2 Bug 7441 - search results showing wrong branch?
When you search in the OPAC it shows you the HOME branch on the location
in XSLT, but if you click through to the detail page it shows you the
CURRENT BRANCH in the holdings table which is very confusing to patrons.
I don't know what's the right solution - home or holding branch, but they
should be the same in both places for the patron's sake. If you do the same
search in the staff client you see the right branch info on the search results
and on the detail page.

Test Plan:
1) Apply this patch
2) Run updatedatabase.pl
3) Search the catalog, you search should include results with items
   that have different home and holding libraries.
4) The results should look the same as before the patch
5) Change the system preference OPACResultsLibrary to "current location"
6) Refresh your page of search results
7) The results show now show the holding library instead of the home library

Signed-off-by: Barbara Walters <bwalters@ncrl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:14:19 +00:00
26f20d64cb Bug 17069: Koha::Patron::Category->store must default checkprevcheckout to 'inherit'
Creating a new patron category raises an error "An error occurred when updating
this patron category. Perhaps it already exists."
DBIx::Class does not default to the value defined at the DB devel if the
key checkprevcheckout has been passed to the constructor.
We may need to provide a global fix for this kind of issue: if a column
is defined as "not null" but has a default value, the constructor
(Koha::Object->new) should not pass it to the DBIx::Class constructor
(even if assuming that null means default is a terrible mysqlism).

Test plan:
Create a new patron category.

Works as expected.
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:12:34 +00:00
5b4259be9c Bug 6499: [QA Follow-up] Trivial adjustments
Removes commented line from bib1.att.
Adjust OCLC-number to Other-control-number in comment of ccl properties.
No need to explicitly add 035$a and $z if you index 035 completely in
record.abs as well as biblio-koha-indexdefs.xml.
Rerun koha-indexdefs-to-zebra.xsl on index defs.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-09 10:13:11 +00:00
Barton Chittenden
84f51549c9 Bug 6499: Add Zebra index "Other-control-number" covering MARC21 035$a, 035$z and 035 (entire tag)
1) Apply patch
2) Make sure that you have a bib that has MARC21 035$a (and possibly also 035$z) populated.

pre 3) Replace all modified zebra files and restart zebra server

3) Rebuild zebra: misc/migration_tools/rebuild_zebra.pl -x -b -z
4) Add the following to the intranetuserjs syspref:

$(document).ready(function(){
    // Add Other Control Number to advanced search
    if (window.location.href.indexOf("catalogue/search.pl") > -1) {
        $(".advsearch").append('<option value="Other-control-number">Other Control Number</option>');
    }
});

5) Do an advanced search, select "Other Control Number" from the search menu, then add the Other Control Number in 035$a for the bib specified in step 1.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works, no koha-qa errors

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-09 10:13:10 +00:00
Mirko Tietgen
7f50e9f686 Bug 17062 - debian/control.in update: change maintainer
Changing the package maintainer and removing a whitespace in debian/control.in.
Regenerated debian/control from that, which also adds libhtml-parser-perl because of bug 16971.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 14:32:00 +00:00
Mirko Tietgen
8102098fa6 Bug 17019 - debian/changelog update
This has not been updated for a while. I plan to add the stable
releases.

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 14:30:55 +00:00
Mirko Tietgen
3c9eace41a Bug 17043 - Readonly deps
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 14:26:34 +00:00
Mirko Tietgen
fd2f15c486 Bug 17043 - master control file
latest control file update

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 14:26:33 +00:00
Mirko Tietgen
347c3b68d7 Bug 17043 - debian/list-deps fixes, master edition
This makes debian/list-deps ready for Debian Jessie
and adds small fixes I already use for package releases.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 14:26:32 +00:00
e4bb70a447 Bug 17030: Make REST api available on packages with plack enabled
This patch is the starting point for making the REST api available
on Plack.

What it does:
- It creates the /api/v1/app.pl mount point in plack.psgi
- It enables the ProxyPass and ProxyPassReverse directives so it
  is reached through Plack.
- It sets rewrite rules so we can use the 'pretty' urls (i.e.
  /api/v1/patrons instead of /api/v1/app.pl/api/v1/patrons).

To test:
- Grab the following files, and put them in /etc/koha (overwrite the existing ones)
  debian/templates/apache-shared-intranet-plack.conf
  debian/templates/apache-shared-opac-plack.conf
- Tweak your /etc/koha/sites/kohadev/plack.psgi file so the API-related stuff
  is present on your file.
- Make sure Plack is enabled for the instance:
  $ sudo koha-plack --enable kohadev
  $ sudo koha-plack --restart kohadev
  $ sudo service apache2 restart
- Follow the previous patch test plan, but use this URLs (no pretty URL):

  http://localhost:8080/api/v1/app.pl/api/v1/patrons/50
  http://localhost:8081/api/v1/app.pl/api/v1/patrons/50
=> SUCCESS: You get a JSON response from the API [1]
- Not use this URLs:
  http://localhost:8080/api/v1/patrons/50
  http://localhost:8081/api/v1/patrons/50
=> SUCCESS: You get a JSON response from the API [1]
- Sign off :-D

[1] this patch made a bug visible (the session is lost when accessing the API through
Plack) but it shouldn't prevent its inclusion because the API right now is not even available
as default for developers to test or fix it.

Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 13:17:35 +00:00
6e38b8b60f Bug 17030: Enable REST api on packages
This patch enables access to the REST API endpoint on packages setup.
It does so, by patching the shared apache-shared-intranet.conf and
apache-shared-opac.conf.

You can build your own master packages with this patch applied, or just:

- Grab
  debian/templates/apache-shared-intranet.conf
  debian/templates/apache-shared-opac.conf
and overwrite their counterparts in /etc/koha on a packages setup. For example
in kohadevbox.
- Have Koha loaded with all default data
- Create a superlibrarian user for you
- Login to the intranet and the OPAC
- Point your browser to:
  http://localhost:8080/api/v1/patrons/51
=> SUCCESS: You get JSON data, for the patron you requested
  http://localhost:8081/api/v1/patrons/51
=> SUCCESS: You get JSON data, for the patron you requested
- Sign off :-D

Note: I use the HTTPRequester addon for Firefox, re-using the CGISESSID value from the
browser session cookie, in the headers.

Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 13:17:34 +00:00
Mirko Tietgen
30474a3215 Bug 17065 - Rename C4/Auth_cas_servers.yaml.orig
C4/Auth_cas_servers.yaml.orig gets cleaned away after every package build because
of the .orig extension. This patch moves it.

It is only a sample file, there is no functionality to test. Just verify that the
file is there with the new name after you applied the patch.

Signed-off-by: Claire Gravely <c.gravely@arts.ac.uk>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 13:16:36 +00:00
Mirko Tietgen
3964fac311 Bug 17064 - Delete backup marc21_framework_DEFAULT.sql~ file
This .sql~ backup file should not have been committed.

Signed-off-by: Claire Gravely <c.gravely@arts.ac.uk>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 13:15:29 +00:00
Mirko Tietgen
bbaaabd1da Bug 17013 - build-git-snapshot: add basetgz parameter and update master version number
This adds a basetgz parameter to specify a pbuilder image.
I use this to build against different distributions.

This also updates the version number for master builds to 16.06.

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-08 13:13:24 +00:00
phette23
17a5ef5119 Bug 17068: empty <li> in opac-reserve.tt
empty HTML list item on 'holds' page, to test:
- sign in as user
- attempt to place hold
- view source in between 'holds note' textarea & <!-- ITEM HOLDS --> comment
- note empty <li>
- apply patch
- repeat process above up until patch
- no more empty <li>

Signed-off-by: Jason Robb <jrobb@sekls.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 07:26:21 +00:00
Zeno Tajoli
d0f2bad12e Bug 16585: Update Italian installer sample files for 16.05
With this patch all sample/defintions .sql files are updated and translated into Italian
(if you select italian during web installation).

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 06:11:11 +00:00
Mark Tompsett
6b3a04da6a Bug 16622: some tests triggered by prove t fail for unset KOHA_CONF
TEST PLAN
---------
1) unset KOHA_CONF
2) prove t
   -- 00-load.t dies miserably
3) prove t/Creators.t
   -- fails
4) apply patch
5) prove t
   -- noisy, but all tests successful
6) prove -v t/Creators.t
   -- 2 skipped tests
7) run koha qa test tools

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 06:09:58 +00:00
Lari Taskula
92b36fb717 Bug 17041: Fix missing properties in patron.json
Swagger definition for patron was missing two properties.

Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 06:08:12 +00:00
Lari Taskula
2ea99517ae Bug 17042: Fix missing column in hold.json
Swagger definition for hold was missing a property.

Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 06:06:22 +00:00
72d92be918 Bug 17044: Fix wrong destination for 'api' directory
The original Makefile.PL tweak missed to trim the directory name thus
repeating the 'api' directory like in 'api/api'.

To test:
- Make a standard install (for example in /usr/share/koha
=> FAIL: check /usr/share/koha/api/api exists
- Make a single install (for example in /home/tcohen/koha-single)
=> FAIL: check /home/tcohen/koha-single/api/api exists
- Apply the patch
- Make a standard install (for example in /usr/share/koha
=> SUCCESS: check /usr/share/koha/api exists and doesn't contain a nested 'api' dir
- Make a single install (for example in /home/tcohen/koha-single)
=> SUCCESS: check /home/tcohen/koha-single/api exists and doesn't contain a nested 'api' dir
- Sign off :-D

Note: this affects the packages too, as the standard install is used as a basis.
Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 04:32:36 +00:00
Nicole C Engard
ebaa3543d6 Bug 16727: Clarify upload category note
This patch clarifies the note on the upload tool
that states that no categories are defined.

To test:

* Log in to Koha
* Confirm that you have no values set for the UPLOAD
  authorized value category
* Visit Tools > Upload
* Check the warning note for typos
* Add a authorized value category for UPLOAD
* Visit Tools > Upload
* Confirm that note is replaced

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 21:29:51 +00:00
Hector Castro
e8d4c634b4 Bug 16861: (followup)Translatability: remove fa-hand-o-down icon
Remove fa-hand-o-down icon accoring with QA comment 5

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 21:24:57 +00:00
Hector Castro
5f3baecf42 Bug 16861: Translatability: Fix separated "below" in circulation.tt
This patch propose to fix this two entries in PO files:

"See highlighted items" and "below"

Also add some Font Awesome Icons

To test:
-Apply patch 16810 on top and this patch
-Go to a patron who has overdues
-See the link "See highlighted items below" with a hand down icon
-Look the new plus icon to "Add a new message" to the patron.
-Add a few messages and notice about the trash icon in "Delete" links

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 21:24:56 +00:00
Mark Tompsett
ef07389220 Bug 16864: Silence warnings in t/db_dependent/ILSDI_Services.t
prove t/db_dependent/ILSDI_Services.t
generates noisy output as a result of the ambiguous context
of two $cgi->param() calls.

By storing into scalar variables, and then using the scalar
variables, the code maintains readability and fixes the problem.

TEST PLAN
---------
1) prove t/db_dependent/ILSDI_Services.t
   -- noisy.
2) apply patch
3) prove t/db_dependent/ILSDI_Services.t
   -- not noisy
4) run koha qa test tools

Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 20:06:07 +00:00
Mark Tompsett
1be7fb5e12 Bug 16868: Silence error t/db_dependent/Linker_FirstMatch.t
When the auth_header table has records which exclude 1xx and
2xx tags, the $bibfield doesn't match anything. This in turn
sets it to undef, which triggers an error on the next line
killing the test.

This was completely refactored to provide the data necessary
for the tests to pass, and to be more comprehensive (both MARC
and UNIMARC are tested). The tests are then run.

C4::Headings::authorities is mocked, so that this test is not
dependent on a search engine.

TEST PLAN
---------
1) back up DB
2) DELETE FROM auth_header;
3) SOURCE auth_header.sql;
   -- the provided file
4) prove t/db_dependent/Linker_FirstMatch.t
   -- should barf before running all the tests
5) apply all patches
6) prove t/db_dependent/Linker_FirstMatch.t
   -- should work happy
7) run koha qa test tools
8) restore your backup

Followed test plan, behaves as expected.
Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 20:04:24 +00:00
Marc Véron
13004a8c64 Bug 16871: Translatability: Avoid [%%-problem and fix related sentence splitting in catalogue/detail.tt
In koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt,
fix line splitted TT directives and sentence splitting leading
to translatability problems. (See first comment).

To test:
- Apply patch
- Go to detail pages of biblios with waiting holds
- Verify that messages in column 'Status' are OK
- Examine code in patch to make sure that the simplification in logic
  makes sense and that no TT directive is splitted
- Bonus test:
  - Go to folder misc/translator. Run perl translate create xx-XX
  - Verify that monster mentioned in first comment no longer exists
    (in po/xx-XX-staff-prog.po)

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised

Amended for wording (comment #5) 2016-07-26 mv

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 20:01:31 +00:00
92626f55c8 Bug 16971: Missing dependency for HTML::Entities
This module is already used in opac-password-recovery.pl.
It is loaded in Acquisition, but not used (anymore?).
It is not yet listed in PerlDependencies.

Note: The module is packaged for Debian Wheezy and Jessie.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:44:03 +00:00
Jesse Weaver
d475dae773 Bug 16818: External auth redirect broken under Plack
Test plan:

0) Have either CAS or Shibboleth authentication enabled under Plack.
1) Hover over the authentication link on the staff client or OPAC, and
   notice that it has either '.../opac/...' or '.../intranet/...' instead
   of '.../cgi-bin/koha/...'. (This will be a complete dealbreaker for CAS
   authentication.)
2) Apply patch.
3) Check links again; they should now have the correct paths.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Did not test CAS or Shibboleth, but no regression found.

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:42:44 +00:00
6122b8fe6e Bug 16830: (followup) Remove weird character from warning in rebuild_zebra.pl
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:41:42 +00:00
87bcaa7df3 Bug 16830: Remove -x usage on koha-indexer
This patch just does that, and removes it from the comment on /etc/default/koha-common

To test:
- Apply the patch
- Run:
  $ vagrant ssh ; cd kohaclone
  $ sudo debian/scripts/koha-indexer --stop kohadev
  $ sudo debian/scripts/koha-indexer --start kohadev
=> SUCCESS: Verify no warning is shown on the indexer-output.log file
- Sign off

https://bugs.koha-community.org/show_bug.cgi?id=16830

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:41:41 +00:00
Chris Cormack
28eae42d2d Bug 16975 : @INC should not have '.' as its last entry
To Test
1/ Try using a plugin
2/ Apply patch
3/ Test plugin still works

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:39:11 +00:00
9bdea2e369 Bug 16878: Fix XSS in opac-memberentry
The vars are gotten from the url and sent to the template as it. They
must be escaped.

Test plan:
I have not managed to create the original issue, so there is no test
plan for the XSS fix, but you can confirm there is no regression.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:22:00 +00:00
91bc9451d0 Bug 16988 - Suspending a hold with AutoResumeSuspendedHolds disabled results in error
iUnless AutoResumeSuspendedHolds is enabled, attempting to suspend a
hold from reserve/request.pl results in the following error:

The given date (undefined) does not match the date format (us) at
/home/vagrant/kohaclone/Koha/DateUtils.pm line 152.

Test Plan:
1) Enable SuspendHoldsIntranet
2) Disable AutoResumeSuspendedHolds
3) Attempt to suspend or unsuspend a hold
4) Note the error
5) Apply this patch
6) Repeat step 3
7) The hold should suspend or resume correctly

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Megan Wianecki <mwianecki@mtpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:20:22 +00:00
c63d0b311b Bug 17022: Fix XSS in circ/branchtransfers.pl
Test plan:
Enter the following in the barcode input:
    <script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 19:19:23 +00:00
eb543a9084 Bug 17023: Fix XSS in acqui/z3950_search.pl
Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 18:46:08 +00:00
f6e0a619d9 Bug 17023: Fix XSS in cataloguing/z3950_search.pl
Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 18:46:08 +00:00
f563ba795e Bug 17024: Fix XSS in tools/viewlog.pl
Test plan:
    Hit /tools/viewlog.pl?do_it=1&modules=CATALOGUING&action=MODIFY&object=<script>alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 18:16:21 +00:00
9d00353a92 Bug 17026: Fix XSS in serials/checkexpiration.pl
Test plan:
Hit:
 /serials/checkexpiration.pl?title="><script>alert("XSS")</script>&date=12/02/2002
 /serials/checkexpiration.pl?issn="><script>alert("XSS")</script>&date=12/02/2002

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 18:13:31 +00:00
66f81fc210 Bug 17028: Fix XSS in reserve/request.pl
Test plan:
Hit
  /cgi-bin/koha/reserve/request.pl?biblionumber=1"><script type="text/javascript">alert("XSS")</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-04 18:12:05 +00:00
c6d3e5a50b Bug 16715: Use Sereal::Decoder and Sereal::Encoder instead of Sereal
Sereal is not packaged for jessie, so let's use Sereal::Encoder and
Sereal::Decoder instead.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-02 14:29:02 +00:00
bcf7268f4f Bug 16436 [QA Followup] - Use debug instead of info
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-02 10:19:32 +00:00
ce8c55fba0 Bug 16436 - Allow action logs to be logged to the koha log file
Test Plan:
1) Ensure that your Koha::Logger configuration is in good working order
2) Apply this patch
3) Modify the first line of your log4perl.conf file from:
    log4perl.logger.intranet = WARN, INTRANET
   to
    log4perl.logger.intranet = INFO, INTRANET
4) Change a system preference setting
5) Note the new line in your log file!

Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-02 10:19:31 +00:00
fcd139b222 Bug 16310 - Remove the use of "onclick" from audio alerts template
This patch removes one use of "onclick" in favor of defining events in
the JavaScript.

This patch also makes changes to the style of some buttons to make the
interface a little more consistent with current practices.

To test, apply the patch and go to Administration -> Audio alerts.

- In the list of existing audio alerts, click the "Edit" button for any
  alert. The correct data should be loaded in the edit form.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 14:35:27 +00:00
537adde2d2 Bug 15397 - Pay selected does not works as expected
When patron has more fees (account lines) and you wan't to pay just some
of them, you select wanted lines a click on "pay selected" button. But
the fine isn't paid, the "amountoutstandig" is not modified, but it is
added new line with "pay" code an with amountoutstanding below zero.
Paying one or all fine works as expected. Paying selected worked some
time ago, but I don't know when it stopped working, we realize it after
upgrade to 3.22.

Test Plan:
1) Apply this patch
2) Pay fines using "Pay selected"
3) Note the payment and the fees outstanding balances are reduced!

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 10:49:31 +00:00
e8b54cb3be Bug 16573 - DBRev 16.06.00.012
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 09:54:30 +00:00
44785935bd Bug 16573: Define virtualshelves.created_on as datetime for existing installs
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 09:39:15 +00:00
Bernardo Gonzalez Kriegel
162b9015d9 Bug 16573: change created_on type - atomic update
This patch change 'created_on' virtualshelves column to
datetime type

To test:
1) Apply the patch
2) Run updatedatabase.pl
3) Verify type of 'created_on' column

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 09:39:15 +00:00
Bernardo Gonzalez Kriegel
36b2b288a7 Bug 16573: fix structure and sample data for MySQL 5.7
Web install on Ubuntu 16.04/Mysql 5.7 fails.

This patch makes small changes to make installation
possible to kohastructure.sql and some sample files.

Sample values for quotes table can't have '0000-00-00 ...' values
nor NULL values, now() is perhaps an option.

Depends on Bug 16572

To test:
1) System with MySQL 5.7, for example Ubuntu 16.05
2) Apply 16572
3) Try web install, it fails
4) Apply this and next patch
5) Try again, now it succeed

This is only for English install, i18n files needs revision
I can do that if this is accepted.

Perphaps a change is needed to updatedatabase.pl

Ammended patch, 'created_on' field on virtualshelves
can't be timestamp default null, mysql 5.5 complains
that only one timestamp column can be defined as
default not null. Changed to 'datetime' type.

Can provide followup with updatedabase change,
but need an opinion if this type change makes sense.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 09:39:14 +00:00
Bernardo Gonzalez Kriegel
d00d46112d Bug 16573: fix linkid value on marc_subfield_structure
followup to previous patch.

This patch fixes linkid value. It was set to '', but
declared as tinyint.
Mysql < 5.7 replaced this with nearest right value, i.e 0
Mysql 5.7 gives error here.

Also some normalization, all lines with data begins with two tabs

To test:
On top of Bug 16572 and previous patch

1) Run webinstaller
2) Add mandatory values
3) There must be no problems on MySQL 5.7

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-01 09:39:14 +00:00
Julian Maurice
ed61bd9bba Bug 14793: New cataloguing plugin unimarc_field_225a_bis
It is similar to unimarc_field_210c_bis, but searches in
biblioitems.collectiontitle instead of biblioitems.publishercode

Signed-off-by: Laurence Rault <laurence.rault@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:27:36 +00:00