Commit graph

23 commits

Author SHA1 Message Date
11622b8a9e Bug 21526: (follow-up) Use the 'url' filter when needed
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2018-11-12 16:35:44 -03:00
cd81bdc6a0 Bug 21526: Use the 'url' filter when needed
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2018-11-12 16:35:43 -03:00
Jonathan Druart
dcd1f5d48c Bug 13618: Add html filters to all the variables
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-08-17 15:55:05 +00:00
Julian Maurice
ed7543287b Bug 20538: Remove the need of writing [% KOHA_VERSION %] everywhere
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
  mechanism, it will be tedious

This patch:
- adds a Template::Toolkit plugin that generates <script> and
  <link> tags for JS and CSS files, and inserts automatically the Koha
  version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable

Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
   checking your browser's dev tools (there should be no 404 for JS and
   CSS files, and the Koha version should appear in filenames) and the
   server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-04-13 11:49:44 -03:00
0ab22e1c7c Bug 18789: Send Koha::Patron object to the templates
In order to simplify and make uniform the code, the controller scripts send
a Koha::Patron object to the templates instead of all attributes of a patron.

That will make the code much more easier to maintain and will be less
error-prone.

The variable "patron" sent to the templates is supposed to represent the
patron the librarian is editing the detail.

In the members module and some scripts of the circulation module, the
patron's detail are sent one by one to the template. That leads to
frustration from developpers (making sure everything is passed from all
scripts) and to regression (we got tone of bugs in the last year because
of this way to do).
With this patch set it will be easy access patron's detail, passing only
1 variable from the controllers.

Test plan:
Play with the patron and circulation module and make sur the detail of
the patron you are editing/seeing info are correctly displayed.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-16 13:03:58 -03:00
0ad922011c Bug 12904: Force browser to load new javascript files after upgrade
This patch has been automatically generated using:
  perl kv.pl **/*.tt **/*.inc

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
2018-02-08 14:53:24 -03:00
a7bdc6eb3e Bug 17014 - Remove more event attributes from patron templates
There are many patron-related templates which still use event attributes
to define events. This patch updates these templates so that events are
defined in JavaScript.

To test apply the patch and check out to a patron.

- From the Print menu in the toolbar, choose "Print summary." The patron
  summary page should open and the print dialog should be automatically
  triggered.

- From the Print menu in the toolbar, choose "Print slip." The patron
  slip page should open and the print dialog should be automatically
  triggered.

- From the Print menu in the toolbar, choose "Print quick slip." The
  patron quick slip page should open and the print dialog should be
  automatically triggered.

- Click the patron's "Fines" tab in the left-hand sidebar and then
  choose the "Account" tab.
  -- Click the "Print" button for an account payment (the link should
     point to printfeercpt.pl). A print receipt page should open and
     the print dialog should be automatically triggered.
  -- Follow the same procedure for a transaction which is not an account
     payment (the link should point to printinvoice.pl).

- Click the "Create manual invoice" tab.
  -- Select one of the "type" choices. Doing so should automatically
     populate the "Description" field with the corresponding code.
  -- If necessary, define one or more values for the MANUAL_INV
     authorized value and confirm that those invoice types work as well.

- From the patron's "Pay fines" tab, click the "Pay amount" button. In
  the "collect from patron" field, enter any combination of letters,
  numbers, and symbols. When you tab away from that field your text
  should be reformatted to currency format.

- From the patrons home page, change the filter in the left-hand sidebar
  and submit it. The correct results should be returned.

Signed-off-by: EricGosselin <eric.gosselin.5@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-03-31 14:33:51 +00:00
Marc Véron
0b6bc2b598 Bug 16218: printfeercpt.tt (and others) does not include jQuery
This patch adds [% INCLUDE 'doc-head-close.inc' %] to the following files
(to make them include jQuery):

koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-receipt.tt
koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt

To test:

1) Temporarily include the follwing lines in syspref IntranetSlipPrinterJS:

function printThenClose() {
  if (typeof jQuery != 'undefined') {
    // jQuery is loaded => print the version
    alert(jQuery.fn.jquery);
  }
  else {
    alert('jQuery not available');
  }
}

2) Go to a users page and print slips:
From the Print button in the tool bar:
- Print summary
- Print slip
- Print quick slip
From the "Fines" tab: Account
- 'Print' link in the table with paid transactions

Without patch, a JavaScript message 'jQuery not avaliable' appears.
With patch, the message displays the current jQuery version (1.7.2)

3) Remove IntranetSlipPrinterJS
- Verify that the slips above print as expected.

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as expected

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 14:14:54 +00:00
6381d1853d Bug 16241 - Move staff client CSS out of language directory
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.

In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.

To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:

- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.

Revised: I intended for this to be built on top of Bug 15883. Now it is.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

On top of 15883
Works as described, all pages on test plan
No Errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 13:54:37 +00:00
a8942c2884 Revert bug 13618 - "Prevent XSS in the Staff Client and the OPAC" due to performance issues
Revert "DBRev to make notes of the XSS patches and the new important dependency."

This reverts commit e140603a59.

Revert "Bug 13618: Specific for branches.opac_info"

This reverts commit 06e4a50f00.

Revert "Bug 13618: (follow-up) Specific for other prefs"

This reverts commit d6475a111f.

Revert "Bug 13618: Fix for debarredcomment and patron messages"

This reverts commit dd98c9df92.

Revert "Bug 13618: Do not display html tags in patron's notices"

This reverts commit a065b243fe.

Revert "Bug 13618: Do not display &nbsp; and html tags in item fields content"

This reverts commit baeeaffbf8.

Revert "Bug 13618: Fix for system preference description"

This reverts commit a967a09261.

Revert "Bug 13618: Remove html filters for newly pushed code"

This reverts commit 0e98662b10.

Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"

This reverts commit fc2fb605e5.

Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"

This reverts commit bc308fdd9c.

Revert "Bug 13618: Fix for edit biblios and items"

This reverts commit 811c4e8402.

Revert "Bug 13618: followup to remove tabs"

This reverts commit ca8e8c397c.

Revert "Bug 13618: Fix last occurrences recently introduced to master"

This reverts commit bb417b256b.

Revert "Bug 13618: Fix for news"

This reverts commit ae5b98020a.

Revert "Bug 13618: Fix escape on sending baskets or shelves by email"

This reverts commit a7731ffe25.

Revert "Bug 13618: Specific for XSLTBloc"

This reverts commit 11fa38dc29.

Revert "Bug 13618: Specific for Salutation on editing a patron"

This reverts commit 36c07ad6d3.

Revert "Bug 13618: Specific for other prefs"

This reverts commit e6ea281a3b.

Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"

This reverts commit 7824874557.

Revert "Bug 13618: Specific for ColumnsSettings"

This reverts commit 1834da3da3.

Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"

This reverts commit 21ae62b253.

Revert "Bug 13618: Fix error 'Not a GLOB reference'"

This reverts commit 602bdbab4c.

Revert "Bug 13618: Specific for the ISBD view"

This reverts commit d254362435.

Revert "Bug 13618: Specific for pagination_bar"

This reverts commit 8837a8ae68.

Revert "Bug 13618: Specific places where we don't need to escape variables - intra"

This reverts commit 00eff140b3.

Revert "Bug 13618: Remove html filters at the intranet"

This reverts commit 7db851ff03.

Revert "Bug 13618: Specific places where we don't need to escape variables"

This reverts commit 49a3738b8d.

Revert "Bug 13618: Remove html filters at the OPAC"

This reverts commit cedaa0e23e.

Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"

This reverts commit 01b38d3b13.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-11 19:39:53 +00:00
d6475a111f Bug 13618: (follow-up) Specific for other prefs
follow-up for SlipCSS and printslip

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:17 +00:00
Katrin Fischer
3efbad2ce9 Bug 12933: (QA followup) Add missing notice templates and other small fixes
- Fixes page title of slip print window: Members > Patrons
- Fixes error message if no notice template is found
- Fixes a stray template variable that resulted in the
  borrower number showing in the 'Print' pull down
- Fixes xt/sample_notices.t by adding the sample notice to
  it-IT and es-ES

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-04 12:41:29 -03:00
e6127b1bc0 Bug 12933: Add ability to print overdue slip from staff intranet
Some librarians would like to be able to print an overdues slip from the
staff intranet. This slip would be defined as the print transport
version of the ODUE slip.

Test Plan:
1) Apply this patch
2) Locate a patron with overdues
3) Define a print version of the OVERDUES_SLIP slip
4) Try Print > Print overdues

Signed-off-by: Amy Purvis <APurvis@galencollege.edu>
Signed-off-by: Laurie McKee <lmckee@littleelm.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-04 12:41:29 -03:00
Katrin Fischer
5dcb7435b7 Bug 12062: Follow up - adds missing )
With this patch, patches pass QA script and unit tests.
Tested printing different slips successfully.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-07 10:32:24 -03:00
Bernardo Gonzalez Kriegel
c53520d58d Bug 12062: Follow up to fix more untraslatable cases
This patch modifies staff printslip.tt to take into account
caller. Also fixes similar problem on opac printslip.tt

To test:
staff
1. Print hold transfer slip
2. Print transfer slip
3. Print member slip
opac
4. Print self checkout slip

5. Update translation files, check new strings are present

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-07 10:32:08 -03:00
Bernardo Gonzalez Kriegel
ebac54dfea Bug 12062: Untranslatable "Reserve not found"
This patch rewrites transfer slip code to make some
strings translatable.
Also simplifies some code and parameters.

To test:
1) Produce a transfer slip, no changes must be noted.

2) Update PO file, new strings
msgid "%s %s%s%sNo hold found%s %s %s "
msgid "%s%s%sNo hold found%s "
msgid "Koha &rsaquo; Circulation &rsaquo; Transfers"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-07 10:31:49 -03:00
789c562e18 Bug 11014 - Slip Print Problem in Chrome
Currently, slips cannot be printed in circulation, members, or the
self check out when using Chrome.

This patch adds a timer of 1ms which allows Chrome's custom code to
prevent "window.close" occuring before the user has dealt with the
print window.

This patch also allows admins to use the 'IntranetSlipPrinterJS'
system preference to override the slip printing code by centralizing
all the slip printing code in slip-print.inc, and including this JS
anywhere it's needed in the staff client.

I haven't used this include in the OPAC SCO but perhaps it would make
sense to do so as well (even if it isn't referred to in the syspref's
name).

_TEST PLAN_
1) Using Chrome on Windows (not sure if this is an issue on other OSes),
try to print a slip in the following locations:

Fines Tab -> Print button
koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt:

Details tab -> Print button -> Print slip || Print quick slip
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-receipt.tt:

Details tab -> Print button -> Print summary
koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt:

Fines tab -> Accounts tab -> Print (Manual invoice of $5 sundry)
koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt:

Checkout tab -> Print button
koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt:

Finish button
koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt

2) Note that each time you try to print, a new print page is created
but closed before you have a chance to print.

3) Apply the patch

4) Repeat Step 1

5) Note that the print page now doesn't close until after you've
chosen to print or cancel.

Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-05-30 16:05:23 -03:00
887900ba59 Bug 10731: fix use of IntranetSlipPrinterJS by hold slips
Hold slips aren't printing automatically with JS Print Setup because it
appears the system preference IntranetSlipPrint is never being passed to
the template.

Test Plan:
1) Set up JSPrintSetup
   http://wiki.koha-community.org/wiki/Setting_up_slip_printer_to_print_silently
2) Place a hold
3) Check the item in to capture the hold
4) Click "Print and confirm"
5) Note the slip does not print automatically
6) Apply this patch
7) Repeat steps 2 through 4
8) Observe that the slip now prints automatically

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-09-18 16:10:54 +00:00
Galen Charlton
6405f26524 Bug 10592: fix display of favicon
Move the favicon files for OPAC and staff so that they are not
blocked by the Apache configuration change introduced by the
patch for bug 9812.

Note that this patch makes the favicon customizable by theme,
not both theme and language.

To test, after applying the patch.

[1] Open pages in the OPAC and staff client.  Verify that the favicon
    is displayed in the usual place in your web browser.  Specific pages
    to test include

    - circulation receipts and slips
    - help
    - lists view
    - web-based self-checkout

[2] Verify that the Apache logs do not contain entries like this:

client denied by server configuration: {...}/prog/en/includes/favicon.ico

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Verified that the favicon displays correctly. Also
tried changing favicons for staff and OPAC using the
system preferences for those. This still works, where
the system preferences are correctly supported in the
templates.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-07-22 14:00:23 +00:00
47609920b7 Bug 9265 - Switch to HTML5 doctype in OPAC and staff client
This patch replaces the XHTML DOCTYPE with an HTML5 one. The HTML5
validator seems to be significantly different than the XHTML one,
so I'm seeing lots of new errors. This patch includes corrections
for one: Deprecation of the "language" attribute of <script>
tags.

To test, view pages in the OPAC and staff client. They should
appear as normal. Numerous validation follow-ups will be required,
but I suggest these be handled incrementally.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
test on some intranet pages and I found no regression. (chromium and
firefox).
The w3c page about the doctype: http://www.w3.org/TR/html5-diff/#doctype

Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
2013-01-31 11:47:04 -05:00
Marc Veron
45f6b755fa Bug 7563 - Silent print slips using Firefox PlugIn jsPrintSetup and new staff client preference
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-07-06 18:23:39 +02:00
Katrin Fischer
9ab692693e Bug 7760 - Add ids and classes to every staff page to help with customizaton (circulation)
New id: circ_<filename>
New class: circ

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
2012-03-22 18:12:27 +01:00
Srdjan Jankovic
a9ded4fa00 bug_7001: Issue and Reserve slips are notices.
Branches can have their own version of notices - added branchcode to
letter table.
Support html notices - added is_html to letter table.
Support for borrower attributes in templates.
GetPreparedletter() is the interface for compiling letters (notices).
Sysprefs for notice and slips stylesheets
Added TRANSFERSLIP to the letters

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
2012-03-09 10:11:20 +01:00