Commit graph

2660 commits

Author SHA1 Message Date
4ecb11eaa1 Bug 16686: Fix "Item in transit from since" in Holds tab
POC, tests needed.

Alternative patch works for me.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-02 13:56:02 +00:00
Jacek Ablewicz
fb449aaede Bug 17117: Patron personal details not displayed unless branch update request is enabled
In patron acount ("your personal details" tab, which serves as a form
for submitting update requests as well) it's not possible to display
some account details like expiration date etc., without enabling
the field for branch / library update requests too.

To reproduce:

1) set OPACPatronDetails to "Allow"
2) clear PatronSelfModificationBorrowerUnwantedField preference
- all possible fields in the update requests form are visible
in patron account, including some extra details (card number,
expiration date, category) in the "Library" section on top
3) put 'branchcode' in PatronSelfModificationBorrowerUnwantedField preference
4) the whole 'Library' section disappears

To test:

1) apply patch
2) put 'branchcode' in PatronSelfModificationBorrowerUnwantedField,
'Library' section should remain visible (sans branch selection option)
3) put 'branchcode|cardnumber|datexpiry|categorycode' in the same
preference, 'Library' section should now disappear

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-18 15:59:42 +00:00
6cd1891ffe Bug 16996: (follow-up) Do not explode if mandatory fields are missing
When registering a new patron, if something went wrong, the form is
resent to the template but without the categorycode (not a dropdown list
anymore, but just displayed as a readonly value # TODO LATER).

Signed-off-by: Marc <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-18 15:43:01 +00:00
Mark Tompsett
c0ac389c1e Bug 16615: Follow up - missed a spot
Also, it is recommended to apply bug 17103 before this.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Oliver Bock <oliver.bock@aei.mpg.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-18 15:38:26 +00:00
Oliver Bock
40b9645bf6 Bug 16615: Open Library API fails for full-site-SSL
When running Koha in a full-site-SSL configuration accessing
external resouces like Open Library cover images via HTTP
doesn't work (mixed SSL/non-SSL content). It thus breaks a
core feature of Koha. Referencing such resources always via
HTTPS resolves the problem and also enhances privacy as a
side-effect.

Previous tickets took care of Amazon resources. This ticket
is supposed to address the remaining external resource providers,
starting with Open Library.

TEST PLAN
---------
1) Over https access your OPAC with the Enhanced Content system
   preferences 'OpenLibraryCovers' set to 'Add', and
   'OpenLibrarySearch' set to 'Show'.
2) Search for something (e.g. Mo Willems)
   -- Your browser console log will show messages about
      mixed content.
3) Apply the patch
4) Making sure to reload the java script, attempt steps 1 & 2
   again.
   -- no mixed content messages should be given
5) run koha qa test tools

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-18 15:38:26 +00:00
Indranil Das Gupta (L2C2 Technologies)
6fcd32a75c Bug 17103 - Google API Loader jsapi called over http
This patch replaces the hardcoded protocol ("http") from the URI with
https since that is what Google defacto uses to serve JS resources
Prevents MIXED CONTENT failure, allowing GoogleIndicTransliteration
to function correctly when used in SSLized OPACs.

Test plan
---------

1/ Make sure your OPAC is being served both over HTTP and HTTPS
2/ Set GoogleIndicTransliteration syspref to "Show"
3/ Access the OPAC over http, Google transliteration element will
   show up in masthead searchbox.
4/ Access the OPAC over https. The element will not show. Console
   will show MIXED CONTENT error and failure of google loader.
5/ Apply patch. Repeat steps #3 and #4 again. Now in both cases
   GoogleIndicTransliteration will work.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-17 17:59:43 +00:00
Marc
d76737ba7d Bug 17078 - Format fines on opac-account.pl
To verify:
- Log in to OPAC as a user who has fines or credits
- Go to page "your fines"
- Verify that values for "Fine amount", "Amount outstanding"
  and "Total due" are not formatted as defined in syspref CurrencyFormat
  (e.g. for FR)

To test:
- Apply patch
- Repeat steps above
- Verify that values are formatted as appropriate with different
  settings for syspref CurrencyFormat

Note: This patch does not force text alignment to the right.
      Text alignement can be done using syspref OPACUserCSS
      (td.sum, td.credit, td.debit)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 14:10:21 +00:00
phette23
aa2f56fa1a Bug 16806: no error message for 'too_soon' renewal
To test:
-  for a particular item type & patron category, configure a non-zero
"no renewal before" date so items can't be immediately renewed
- sign in as a patron in aforementioned patron category
- check out an item of aforementioned item type
- go to your renewals page in OPAC /cgi-bin/koha/opac-user.pl
- an error messages appears in the div.alert.dialog up top

Sponsored-by: California College of the Arts
Signed-off-by: Brendon Ford <brendon.ford@manhattan.edu>

Signed-off-by: Irma Birchall <irma@calyx.net.au>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:52:27 +00:00
492d79a7df Bug 7441 - Followup search results showing wrong branch [UNIMARC]
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
  Playing with OPACResultsLibrary syspref, biblio with items having different
  home/holding library are displayed properly.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:14:20 +00:00
4db2e745e2 Bug 7441 - search results showing wrong branch?
When you search in the OPAC it shows you the HOME branch on the location
in XSLT, but if you click through to the detail page it shows you the
CURRENT BRANCH in the holdings table which is very confusing to patrons.
I don't know what's the right solution - home or holding branch, but they
should be the same in both places for the patron's sake. If you do the same
search in the staff client you see the right branch info on the search results
and on the detail page.

Test Plan:
1) Apply this patch
2) Run updatedatabase.pl
3) Search the catalog, you search should include results with items
   that have different home and holding libraries.
4) The results should look the same as before the patch
5) Change the system preference OPACResultsLibrary to "current location"
6) Refresh your page of search results
7) The results show now show the holding library instead of the home library

Signed-off-by: Barbara Walters <bwalters@ncrl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-08-10 13:14:19 +00:00
phette23
17a5ef5119 Bug 17068: empty <li> in opac-reserve.tt
empty HTML list item on 'holds' page, to test:
- sign in as user
- attempt to place hold
- view source in between 'holds note' textarea & <!-- ITEM HOLDS --> comment
- note empty <li>
- apply patch
- repeat process above up until patch
- no more empty <li>

Signed-off-by: Jason Robb <jrobb@sekls.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-08-05 07:26:21 +00:00
1766b10d52 Bug 16847: Add empty option to Salutation/title
At the OPAC there is no way to empty this value.
I think it should be allowed to empty it.

Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:23:42 +00:00
131002e623 Bug 16847: Remove C4::Members::GetTitles
This subroutine just reads the content of a pref, split it, add an
empty string and returns.
It is not really useful and the code in the script (memberentry.pl) uses
the only occurrence of CGI::popup_menu
Let's remove it and build the dropdown list in the template.

Test plan:
1/ Empty BorrowersTitles, edit a patron and confirm that the "Salutation"
does not appear
2/ Fill BorrowersTitles with "Mr|Mrs|Miss|Ms", edit a patron and confirm
that the "Salutation" dropdown list is correctly filled.
The default option should be selected if you are editing a patron with a
title defined.
This should also be tested at the OPAC.

Followed test pan, works as expected in Staff and OPAC
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:23:42 +00:00
65918b146c Bug 16958: Fix XSS in opac-imageviewer.pl
Test plan:
Trigger
/opac-imageviewer.pl?biblionumber=14&imagenumber=7"><sCrIpT>alert(42)<%2fsCrIpT>

=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:12:02 +00:00
Aleisha
59d8f3f861 Bug 16876: Remove Full Heading column from OPAC Auth search results
To test:

1) Go to Authority Search and do a search
2) Notice that there is a Full Heading column that has 'View full
   heading' links. These take up a lot of space and don't mean a lot to
   the user
3) Apply patch and refresh
4) Notice that the the Full Heading column is gone and there is now a
   Details column next to the authorities. Confirm the link takes you to
   the expected authority detail page.

Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-15 18:10:34 +00:00
b89a601e57 Bug 15853 - Add author and link columns to opac course reserves table
To test:
1 - Add some course reserves
2 - View the table in staff and opac, there is no column for author or
link
3 - Apply patch
4 - You shoudl see these columns
5 - Link should contain item uri if present, fallback to title 856$u,
  then be blank if niether

Sponsored by:
    Southeastern Wisconsin Information Technology Exchange, Inc (SWITCH)
    (http://caspian.switchinc.org/)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Might be good to add this table to the column visibility tool if you
plan to add more columns.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-15 18:04:09 +00:00
Marc Véron
dc1ff4efff Bug 16621: Translatability: Issues in opac-user.tt (sentence splitting)
This patch fixes issues due to sentence splitting in
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt

Note: This is a string patch. It does not add or change functionallity.

To test:
- Examine code and verify that the text changes remove sentence splitting
  and that the changes make sense.
- Log in to OPAC and verify that messages look correct
  - with blocked /debarred user (with and without comment and date)
  - with user who has to much fines (needs syspref OpacRenewalAllowed
    and syspref OPACFineNoRenewals)
  - with user who has his card marked as lost
  - with user with an account that is about to expire
  - with user with expired account
  - with user with uncertain address information (with and without
    syspref OPACPatronDetails set to Allow)

Note: Amended to make patch apply 2016-07-10 mv
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-15 15:09:00 +00:00
199c00c7ba Bug 2735: CSS changes
Signed-off-by: Nicole C Engard <nengard@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-15 14:05:59 +00:00
de2df0dfe8 Bug 2735: Fix authority search pagination at the OPAC
The authority search pagination displays only 15 pages, even when there
are more.
To fix that, this patch mimic the authorities-home.pl intranet script to
manage the pagination.

Test plan:
Without this patch, do some authority search and click on different
pages.
Apply this patch, redo the same search and make sure the same records
are displayed (i.e. confirm that the pagination still works as before).

Signed-off-by: Nicole C Engard <nengard@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-15 14:05:59 +00:00
Mark Tompsett
dee29d9f0b Bug 16805: Log in with database admin user breaks OPAC
TEST PLAN
---------
1) Apply Jonathan's test patch
2) prove t/db_dependent/Letters.t
   -- dies before finishing tests
3) Apply second test patch
4) prove t/db_dependent/Letters.t
   -- dies before finishing tests
   -- 'addalert' is changed to 'getalert'
5) Log into OPAC with database admin user.
   -- see error given in comment #0
6) Apply this patch
7) prove t/db_dependent/Letters.t
   -- says 'getalert'
   -- all tests pass.
8) Log into OPAC with database admin user.
   -- logs in, but gives warning with a nice logout button.
9) run koha qa test tools.

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
No kaha qa errors
In debian display diferent error:
Can't use an undefined value as an ARRAY reference at /usr/lib/perl5/DBI.pm line 2054.
Works as advertised

NOTE: Revised test plan, as Jonathan added useful test case.
      Works as I've tested above.
      Hector tested older test plan which was steps
      5,6,8 and 9.

      Revised test plan again while tweaking to address comment #9.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 14:45:04 +00:00
b9e47f135e Bug 16677 - Use abbr for authorities linked headings
In authorities search results, UNIMARC flavour, linked headings are displayed
with a link type : BT, NT, UF, RT.

This patch adds a abbr tag around those acronyms to know there meaning :
BT = Broader Term
NT = Narrower Term
UF = Used For
RT = Related Term

Acronyms are used because there can be a lot of linked headings, using abbr
will display the complete text on mouse over.

Test plan :

- Use UNIMARC database
- Create an authority with :
250 $a Heading250a
450 $a Heading450a
550 $5 a $a Heading550a
550 $5 g $a Heading550g
550 $5 h $a Heading550h
- Save an index zebraqueue
- Go to intranet authorities search
- Search for "Heading250a"
- You see :
Heading250a
Heading250a
UF: Heading450a
RT: Heading550a ; BT: Heading550g ; NT: Heading550h
- Move your mouse over the acronyms, you see a tip with the complete text
- Same with opac authorities search

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
  Works as described. Translatable.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 14:28:07 +00:00
b6a774028a Bug 15128 (QA Followup) Display all purchase suggestions whether or not suggestion was added Correct enforcement of 0 limit
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 14:09:48 +00:00
1bfe7c7512 Bug 15128 [QA Followup 2] - Only count pending suggestions for the limit
Signed-off-by: Barbara Walters <bwalters@ncrl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 14:09:48 +00:00
7445b8f897 Bug 15128 - Add ability to limit patrons open purchase suggestions
To test:
1 - Define a number of MaxOpenSuggestions
2 - Add some suggestions for a patron
3 - Note they cannot add any more suggestions if limit is reached
4 - Delete a suggestion and note you can add another
5 - Add them to limit again
6 - Accept a suggestion in the staff client and note user can add more
7 - Repeat above with rejecting or deleting
8 - Sign off.

Sponsored by:
    North Central Regional Library (http://ncrl.org/)

Signed-off-by: Barbara Walters <bwalters@ncrl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 14:09:48 +00:00
Marc Véron
5f147cc6bb Bug 16562 - Translatability: Issue in opac-user.tt (separated word 'item')
Alternate patch with wording as proposed in comment #12

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 13:06:42 +00:00
Bouzid Fergani
a12d3d1bfa Bug 15636 - DataTables Warning: Requested unknown parameter from opac-detail.tt
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch adds the same tests in the aoColumns DT definition than the
ones in the creation of the table. That's sound good.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 13:02:15 +00:00
Morgane Alonso
a1285ba9c0 Bug 12509 - Fix Untranslatable Restriction added by overdues process
Changes the value of the "comment" column in "borrower_debarments" table
from "Restriction added by overdues process yyyy-mm-dd hh:mm:ss" to
"OVERDUE_PROCESS yyyy-mm-dd hh:mm:ss" in the overdue_notices.pl. Then in
the templates "moremember.tt", "circulation.tt", "memberentrygen.tt",
"opac-reserve.tt" and "opac-user.tt" the value of "comment" is
check, if it's an automatical comment due to overdue process it'll
write "Restriction added by overdues process yyyy-mm-dd hh:mm:ss",
then if there is a customizable comment it will be written without
modification. Like this, the comment "Restriction added by overdues
process" is written in the po files and can be translated later.

To test:
1) create a patron with automatical restriction due to overdue process;
2) apply patch;
3) run misc/cronjobs/overdue_notices.pl;
4) verify if the comment "Restriction added by overdues process" is well
   written and translatable on the following page :
    - opac patron home page (opac-user.tt);
    - opac item reservation page (opac-reserve.tt);
    - pro patron page (moremember.tt);
    - reservation item for a patron (circulation.tt, memberentrygen.tt);
5) try to translate the comment in po files;
6) sign off.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-08 12:41:47 +00:00
62508428cd Bug 16651: Notes field blank for 952$z in opac-course-details.pl
This patch changes course reserves to check for item notes form the
course reserve and fallback to itemlevel notes if they are empty

To test:
1 - Enabvle course reserves
2 - Add some items
3 - Make sure the items have notes at the item level and not at course
reserves
4 - Notes don't display in staff or opac
5 - Apply patch
6 - Notes display in staff and opac
7 - Add notes at course reserves level
8 - These override the item level notes

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-24 13:57:33 +00:00
NguyenDuyTinh
e1d6974bff Bug 16705 - Add missing status to serials history in OPAC
The bug is related to 10851. Due to add of status in 10851, status added were
missing in opac-detail.tt and opac-full-serial-issues.tt. The patch just added
these missing status.

To test:
1) Create New subscription in Serials, in Intranet
2) Do a search of the new subscription by Title
3) Take Serial receive as Actions to edit the status to Missing (<something>)
4) Go to Opac and Search the subscription created, by its title and See missing status
5) Apply patch, status must be showed.
6) Sign off

Followed test plan, works as expected.
Amended to format commit title and message.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-24 11:58:32 +00:00
779fa7c6da Bug 16591: Fix CSRF in opac-memberentry
If an attacker can get an authenticated Koha user to visit their page
with the code below, they can update the victim's details to arbitrary
values.

Test plan:

Trigger
/cgi-bin/koha/opac-memberentry.pl?action=update&borrower_B_city=HACKED&borrower_firstname=KOHA&borrower_surname=test

=> Without this patch, the update will be done (or modification
request)
=> With this patch applied you will get a crash "Wrong CSRF token" (no
need to stylish)

Do some regression tests with this patch applied (Update patron infos)

QA note: I am not sure it's useful to create a digest of the DB pass,
but just in case...

Reported by Alex Middleton at Dionach.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-24 11:55:15 +00:00
574bff5c6f Bug 16680: (bug 13918 follow-up) Display library names for holds in transit
Regression introduced by bug 13918: the library names are not displayed
anymore for holds in transit.
They are 2 warns in the logs:
No method wbrname! at
/home/koha/src/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
line 603.
No method wbrcd! at
/home/koha/src/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt
line 603.

Test plan:
Make sure you have holds in transit and go the opac-user.pl
In the "Holds" tab, you should see "Item in transit to LIBRARY NAME"

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-24 11:48:15 +00:00
Marc Véron
b6979db410 Bug 16563: Translatability: Issues in opac-account.tt (sentence splitting)
This patch removes splitting by <i>-tags from 2 sentences.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
No errors

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-10 17:46:49 +00:00
Marc Véron
6b432d2b21 Bug 16540 - Clean up opac-auth.tt for translatability
This patch fixes translatability issues in opac-auth.tt (ugly
translations caused by sentence splitting).

It was necessary to change indentation to make the the file more
readable and to make sure that changes have no side effects.

The changes do not touch the overall functionallity.

To test:
- Review code to verify that no functionality change is introduced
  and to verify that the text changes make sense.
- Apply patch, verify that OPAC login page behaves as before.

UPDATE: Amended for comment #10 / mv
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-10 17:44:27 +00:00
Marc Véron
593dee4ea0 Bug 16560: Translatability: Issues with "The entered " in opac-memberentry.tt
This patch fixes two splitted sentences to avoid translation issues:

The entered <a href="#borrower_cardnumber">card number</a> is the wrong length.
The entered <a href="#borrower_cardnumber">card number</a> is already in use.

To test:
Apply patch and verify that html in the 2 that are changed is correct and that
they are not splitted by a-tags.

Note: I could not figure out under which conditions this code displays in
      the OPAC self registration form.

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-10 17:37:56 +00:00
af59b66941 Bug 16465: Fix typo issues vs checkouts
Test plan:
Confirm the wording is correct

Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-10 16:45:31 +00:00
27254de06d Bug 16465: discharge - Add a title tag at the OPAC
Test plan:
Confirm that the opac-discharge.pl has now a title

Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-06-10 16:45:31 +00:00
Lari Taskula
7163fcfeea Bug 16200: Make 'Hold waiting too long' translatable and give it an unique accounttype
Holds that have expired have been untranslatable in Patron's Fines-tab. Also, they are
mixed with other type of fines with accounttype "F". This patch gives expired holds an
own accounttype "HE" (Hold Expired) and modifies the boraccount to recognize this new
accounttype in order to make it translatable.

To test:
1. Make a hold and let it expire
2. Go to Patron's Fines tab
3. Change Koha's language to some other than English
4. Observe that there is a "Hold waiting too long" fine described in English
5. Apply patch
6. Make another hold and let it expire
7. Update translations
8. Find "Hold waiting too long" from your .po file
9. Translate it and install translations
10. Go back to Fines tab and observe that the new expired hold is translated

Signed-off-by: Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-31 08:50:36 +00:00
Chris Cormack
c47c835672 Bug 16597: Fix XSS in opac-shareshelf
To test
1/ Go to /cgi-bin/koha/opac-shareshelf.pl?op="><script>alert('XSS')</script>&shelfnumber=5
2/ Notice you see a js alert
3/ Apply patch
4/ It is gone

Reported by
Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-30 11:14:03 +00:00
Chris Cormack
344033c324 Bug 16597: Fix XSS in opac-shelves.pl
To test
1/ Hit /cgi-bin/koha/opac-shelves.pl?shelfnumber=5&category=1&op=edit_form&referer="><script>alert('XSS')</SCRIPT>
2/ Notice JS is executed
3/ Apply patch
4/ Notice it's fixed

This bug reported by

Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-30 11:14:03 +00:00
bb4543f7db Bug 16599: Fix other potentials XSS for shelfname
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-30 11:12:15 +00:00
a44a930c07 Bug 16599: Fix XSS in opac-shareshelf.pl
Test plan:
- Create a list with the name "<script>alert(1)</script>"
- On the shelf list, click on share
=> Without this patch you will see the JS alert
=> With this patch applied you won't see it

Reported by Kaybee at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-30 11:12:15 +00:00
4e817ee04c Bug 16587 opac-sendshelf.pl is vulnerable to XSS
To test
1/ Hit a url like
http://localhost:8080/cgi-bin/koha/opac-sendshelf.pl?email=%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3Ezz%40zz&comment=tes&shelfid=4
2/ Notice you get a js alert
3/ Apply patch
4/ Notice the js is now escaped

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-25 22:14:33 +00:00
05a014b766 Bug 16587 - opac-sendbasket.pl is open to XSS
To test
1/ Hit a url like
http://localhost:8080/cgi-bin/koha/opac-sendbasket.pl?email_add=%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3Ezz%40zz&comment=tes&bib_list=3

Where bib_list is a valid basket number
2/ Notice you get a javascript alert showing
3/ Apply patch
4/ Notice the text is now escaped

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-05-25 22:14:33 +00:00
c7ca98c8d9 Bug 16516: Define the showListsUpdate JS function at the OPAC
Bug 12233 removes the declaration of the showListsUpdate JS function for
the OPAC.
It results in a JS error (ReferenceError: showListsUpdate is not
defined) when a user tries to add selected titles to a list if no title
is selected.

Test plan:
Launch a catalogue search
Select a list in the "Select titles to" dropdown list
=> Without this patch you will get the JS error
=> With this patch you will get a JS alert "No item was selected"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-23 17:40:51 +00:00
Hector Castro
0073a0c3f8 Bug 16343: 7XX XSLT subfields displaying out of order
This patch respect previous css classes
.authordates and .relatorcode but also include .titleportion

.authordates {display: none;}
.titleportion {display: none;}
.relatorcode {display: none;}

To test:
- Stage the two record attached with titles:
  - Surface & coatings technology.
  - Women crime writers.
- Reindex zebra (necessary to Opac and Itranet results)
- Leave empty the OPACUserCSS and IntranetUserCSS sysprefs
- Go to the new records in OPAC and Intranet detail page
- See the wrong display of dates
- Apply patch and refresh the page
- Test in OPACUserCSS and IntranetUserCSS the css stated before
- Play deleting or adding the classes
- Test with multiple records with 700 (with and without dates, etc;
  710 and 711)

NOTE: dates in 710 and 711 can be hidden with .titleportion class;
dates in this kind of heading go with another data for example:
Catholic Church. Plenary Council of Baltimore (2nd : 1866)
Patch rebased some typos fixed in comments

Signed-off-by: Dani Elder <danielle@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-23 17:24:12 +00:00
3c80b7c19e Bug 16478: Fix checkout history tabs - intranet
Test plan:
Same as before for the intranet.
And please retest the OPAC => I have changed the filter's values to
match OPAC/intranet

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-23 17:22:04 +00:00
Marc Véron
64c28e5c72 Bug 16478: Translation breaks display of Checkout history in tab Checks / On-site-checkouts
To test:
- Make sure that syspref OnsiteCheckouts is enabled
- Log in to OPAC as a patron who has checkouts, online checkouts and checkout history enabled
- Go to 'your reading history' (in English)
- Display all three tabs
- Apply patch
- Reload page, display oll three tabs again, there should be no difference
- Examine source code changes to verify that the words 'checkout' and 'onsite' no longer
  will be exposed to translation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-23 17:22:04 +00:00
Marc Véron
b3dfe0c194 Bug 16471: Translatability: Fix issues in opac-password-recovery.tt
This patch fixes issues with the translatability of opac-password-recovery.tt

To test:
- Apply patch
- Verify that text changes make sense.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-16 17:45:13 +00:00
Jesse Weaver
bc707baf02 Bug 15816: Redirect back to correct page after login
This uses a hacky but simple method to get the correct script name under
proxied packaged Plack.

Test plan:
  1) Log out of both the OPAC and staff side.
  2) Try to access a page that requires login (opac-reserve.pl is a
good one for the OPAC), then log in.
  3) You will be redirected back to mainpage.pl or opac-user.pl.
  4) Repeat above for both staff side and OPAC.
  5) Apply patch.
  6) Repeat steps 1-4; you should be redirected back to the original
     page you were on.
  7) Repeat the above for both a traditional CGI and kohadevbox/package
     Plack installation.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-05-13 12:38:14 +00:00
3f0a1f0c7f Bug 16473: Fix typo "an problem" vs "a problem"
Test plan:
Confirm the wording is correct

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
2016-05-12 16:21:52 -06:00