Commit graph

849 commits

Author SHA1 Message Date
c2eb7633ca Bug 9573: Lost items report - add KohaTable to itemlost
Before this patch set, we used KohaTable to display a table with the
column visibility plugin, and an usual dataTable initialisation for the
filters.
For the lost items report table we will need both.
To do so we need to reorganize the code a bit

We cannot pass a selector but the id of the node which represents the
table. Indeed it is how works currently the filters (we may want to
improve that later)

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-17 18:32:14 -03:00
b3434ebb3d Bug 19947: Update popup window templates to use Bootstrap grid: Acquisitions transfer order
This patch updates the acquisitions transfer order template to use the
Bootstrap grid instead of the YUI grid.

Also fixed: Corrected footer include for popup window.

To test, apply the patch and go to Acquisitions -> Vendor -> Open order
-> Transfer.

In the popup window search for a vendor, select, and choose a basket.

Signed-off-by: Charlotte Cordwell <charlotte.cordwell123@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-16 14:05:19 -03:00
5bb01c8616 Bug 18789: (QA follow-up) Fix showing the name of basket creator on booksellers page
Test plan:
1) Go to Acquisition and search for a vendor, you are presented with vendors and their baskets
2) Look to Created by column
--> without patch only firstname is shown
--> with patch you should see full name

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-16 13:03:58 -03:00
0ab22e1c7c Bug 18789: Send Koha::Patron object to the templates
In order to simplify and make uniform the code, the controller scripts send
a Koha::Patron object to the templates instead of all attributes of a patron.

That will make the code much more easier to maintain and will be less
error-prone.

The variable "patron" sent to the templates is supposed to represent the
patron the librarian is editing the detail.

In the members module and some scripts of the circulation module, the
patron's detail are sent one by one to the template. That leads to
frustration from developpers (making sure everything is passed from all
scripts) and to regression (we got tone of bugs in the last year because
of this way to do).
With this patch set it will be easy access patron's detail, passing only
1 variable from the controllers.

Test plan:
Play with the patron and circulation module and make sur the detail of
the patron you are editing/seeing info are correctly displayed.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-16 13:03:58 -03:00
fd70cdcc31 Bug 12904: Add KOHA_VERSION to few more .css
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-16 13:01:19 -03:00
fad518ed7d Bug 20038: Switch single-column templates to Bootstrap grid: Acquisitions
This patch updates several acquisitions module templates to use the
Bootstrap grid.

- acqui/z3950_search.tt - Acquisitions -> Vendor -> View basket -> Add
  to basket -> From an external source. The Z39.50 search form should
  look correct.
  - Search for a title. The search results page should look correct.

- acqui/addorder.tt - Acquisitions -> Vendor -> View basket -> Add to
  basket. Add an order to the basket which costs more than is available
  in the fund you select. The error/confirmation screen should look
  correct.

- acqui\modordernotes.tt - Acquisitions -> Vendor -> View basket -> Add
  internal or vendor note. The note add form should look correct.

- acqui/cancelorder.tt - Acquisitions -> Vendor -> View basket -> Cancel
  order (from an open basket which has existing orders). The
  confirmation screen should look correct.

- acqui\basketheader.tt - Acquisitions -> Vendor -> New basket. The new
  basket edit form should look correct.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-15 13:30:23 -03:00
609f2f1fc7 Bug 19755: Move template JavaScript to the footer: Acquisitions, part 3
This patch modifies even more staff client acquisitions templates so
that JavaScript is included in the footer instead of the header.

To test, apply the patch and test the JavaScript-driven features of the
modified templates: All button controls, DataTables functionality, tabs,
etc.

- Acquisitions -> Vendor -> Vendor details
  - Contracts datatable
  - Edit vendor
    - Add contacts, form validation
- Acquisitions -> Vendor -> Invoices -> Invoice -> "Go to receipt"
  - Datatables, MARC and Card previews
    - Transfer
      - Confirmation of transfer, window closes
- Acquisitions -> Vendor -> Receive shipments
  - Datatables, date pickers
- Acquisitions -> Available funds table -> Spent report
  - Datatables
- Acquisitions -> Vendor -> Uncertain prices
  - Datatables, form validation
- Acquisitions -> Vendor -> Basket -> Add to basket from external source
  - Select and clear all on search form
  - Search results
    - Datatables, MARC and Card previews, in-table pop-up controls
      (click any table cell)

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-15 13:30:23 -03:00
571c088cee Bug 10032: (follow-up) Move title attribute to button container
This patch modifies the "Close basket" button markup so that the title
attribute on a disabled button is added to the button wrapper <div>
instead of the <a> tag. This allows the title attribute tooltip to
appear when the cursor is hovered over the button.

To test, follow the original patch's test plan and confirm that when the
"Close basket" button is disabled, hovering the mouse over the button
triggers the title attribute tooltip.

Signed-off-by: Charlotte Cordwell <charlotte.cordwell123@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2018-02-08 17:01:14 -03:00
Jon Knight
f3453684df Bug 10032: Improve GUI when uncertain price prevents closing the basket
Added disabled "Close this basket" button when uncertain
prices are present.
Note that whilst this has a "title" attribute, there is no tooltip
shown because JQueryUI disabled buttons don't get DOM events.

https://bugs.koha-community.org/show_bug.cgi?id=10032

Signed-off-by: Charlotte Cordwell <charlotte.cordwell123@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2018-02-08 17:01:13 -03:00
0ad922011c Bug 12904: Force browser to load new javascript files after upgrade
This patch has been automatically generated using:
  perl kv.pl **/*.tt **/*.inc

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
2018-02-08 14:53:24 -03:00
Victor Grousset
3e23c85bce Bug 19928: Acquisitions' CSV exports now honors syspref "delimiter"
Bonus fixes:
- Basketgroup: there was an unnecessary space.
  " RRP tax excluded" replaced by "RRP tax excluded"
- Late orders:
  - leading spaces before every line
  - surrounding spaces for [% orders.size %]

Other changes:
- quoted "Total orders in late" to no worry about additional spaces
- Late orders: additional spaces which shouldn't be a problem because
  all the fields are enclosed by quotes.

Test plan:
1. Set syspref "delimiter" to "#'s"
2. Change the language e.g. FR-fr

3. Create a vendor with minimal info
4. Create a basket with two items
5. Go to the basket. URL should be
   /cgi-bin/koha/acqui/basket.pl?basketno=XXXXX
6. Close this basket
7. "Export as CSV"
8. You should see that the file contains commas "," This is the bug.
   Leave the file open for future comparison to ensure that there are
   no regressions.

9. Create a basket group with two baskets
   (tick the close this basket group check box)
10. Go to the "Closed" tab to see your basket group
11. "Export as CSV"
12. You should see that the file contains commas "," This is the bug.
    Leave the file open for future comparison to ensure that there are
    no regressions.

13. Go to /cgi-bin/koha/acqui/lateorders.pl
14. Tick two orders. Of the same vendor, otherwise Koha won't let you tick
    orders of different vendors.
15. "Export as CSV"
16. You should see that the file contains commas "," This is the bug.
    Leave the file open for future comparison to ensure that there are
    no regressions.

17. Apply this patch
18. Translation stuff
    1. cd misc/translator
    2. perl translate update YOUR_LANG
    3. manually edit the po file, remove the fuzzy tags.
       And translate the string. You can just copy the original and
       replace some parts by gibberish.
    4. perl translate install YOUR_LANG

19. Re-export the same CSVs and compare with the original version to check that
    - delimiter syspref is honored
    - the headers are translatable
    - there is no whitespace regression (additional newlines or spaces)

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2018-02-08 14:52:01 -03:00
Amit Gupta
26864e9f6f Bug 19611: Fix XSS Flaws in supplier.pl
Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 16:02:00 -03:00
1a13244076 Bug 19753: Move template JavaScript to the footer: Acquisitions
This patch modifies some staff client acquisitions templates so that
JavaScript is included in the footer instead of the header.

This patch adds a JavaScript file, acquisitions-menu.js, which controls
the highlighting of the current page in the sidebar. Highlighting will
be temporarily broken for pages which have not been modified to include
this file

To test, apply the patch and test the JavaScript-driven features of the
modified templates: All button controls, DataTables functionality, tabs,
etc.

- Acquisitions home page
  - Datatable, Inactive budget controls
- Vendor search results
  - Acquisitions -> Vendor search
    - Datatables, "Show all" links
- Basket
  - Acquisitions -> Vendor -> Basket
    - Datatables, button controls, add managing user
- Add to basket from a staged file
  - Acquisitions -> Vendor -> Basket -> Add to basket from a staged file
    - Datatables, tabs, selection controls
- Edit basket
  - Acquisitions -> Vendor -> Edit basket
    - Form validation
- EDIFACT messages
  - Acquisitions -> EDIFACT messages
    - Datatables, message preview
- Orders search
  - Acquisitions -> Order search
    - Full orders search form
      - Patron autocomplete in "Basket created by" field
      - Datepickers
    - Orders search results
      - Datatables, column visibility
- Invoices
  - Acquisitions -> Vendor -> Invoices -> Invoice
    - Form validation, datepickers, datatables
  - Invoice files (enable AcqEnableFiles preference)
    - Manage invoice files
      - File list datatable

Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-22 13:15:40 -03:00
b4d3b25bc2 Bug 19429: Rename .delete to .delete_invoice
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:13 -03:00
Aleisha Amohia
0ec74621ca Bug 19401: Add confirm message when deleting invoice
To test:
1) Go to Acquisitions
2) Go to Invoices (left nav menu)
3) Click Search (no need to filter results)
4) Click dropdown menu for an invoice, click Details
5) Click Delete
6) Notice invoice is deleted instantly
7) Apply patch and repeat steps 4 and 5
8) Confirm the confirm message shows and works as expected

Sponsored-by: Catalyst IT

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:13 -03:00
Aleisha Amohia
367f6ef536 Bug 19429: Add confirm message when deleting invoice from invoice search page
To test:
To test:
1) Go to Acquisitions
2) Go to Invoices (left nav menu)
3) Click Search (no need to filter results)
4) Click dropdown menu for an invoice, click Delete
5) Notice invoice is deleted instantly
6) Apply patch and repeat steps 3 and 4
7) Confirm the confirm message shows and works as expected

Sponsored-by: Catalyst IT

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:13 -03:00
bc900d81c5 Bug 17182: Allow Keyword to MARC mapping for acquisitions searches
This patchset adds the 'subtitle' field to the results display on
acquistions search for adding an order form an existing item.

Any field mapped to 'subtitle' in 'Keyword to MARC mapping' will be
fetched and displayed in the results

To test:
1 - Perform an acquisitions search for existing record
2 - Note record subtitles are not displayed
3 - Map 245$b and 245$n to 'subtitle' in 'Keyword to MARC mapping'
4 - Note they are still not displayed ion acq results
5 - Apply patch
6 - subtitle fields should now display

Sponsored by: Round Rock Public Library
<https://www.roundrocktexas.gov/departments/library/>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-11 14:30:43 -03:00
2aba85d811 Bug 19083: Fix 'show all details' link on closed basket detail
'Show all details' add columns on the basket summary page.
This link is broken if the basket is closed.

Indeed there is a JS error raised by $('#toolbar').fixFloat();
The toolbar is not displayed if the basket is closed.

This is caused by bug 12333, which added the floating toolbar.

Test plan:
Create 2 baskets with orders
Close 1 basket
Click on the 'show all details' links and confirm it works as expected
Also confirm that the toolbar works correctly

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jon Knight <J.P.Knight@lboro.ac.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-13 13:57:56 -03:00
David Gustafsson
b830349f45 Bug 19453: Incorrect jQuery selector for fund drop down validation
Steps to reproduce:
1. Create a new basket
2. Choose "Add to masket"
3. Choose "From a staged file"
4. Select a file
5. Save without selecting a fund

Expected results: A validation error should be shown, and form submit
halted.

Actual results: No validation error is shown and form submits.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-13 13:57:56 -03:00
04aea91de0 Bug 15685: (QA follow-up) Address QA issues
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-11 13:08:47 -03:00
Jesse Weaver
b29493265b Bug 15685: Allow creation of items (AcqCreateItem) to be customizable per-basket
This adds a new basket attribute (create_items) that can optionally be
set to override AcqCreateItem.

The following have been modified to reflect this (with the value of
create_items that causes them to behave differently in parentheses):
  * Cancelling receipt of an order (receiving)
  * Creating an order by hand or from MARC (ordering)
  * Receiving an order (receiving)
  * Showing orders with uncertain price (ordering)
  * Showing orders (receiving)
  * Showing acquisition details in the OPAC (ordering)

Test plan:
  1) Create baskets with "Create items when:" set to ordering,
     receiving, cataloging and unset.
  2) Test each of the above for each of these baskets, verifying that
     the basket-specific attribute overrides AcqCreateItem if set and
     falls back to the syspref otherwise.

NOTE: A check of AcqCreateItem in opac-detail.tt was removed because it
was redundant; the code path in question cannot be triggered unless
create_items/AcqCreateItems is set to the correct value anyway.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Barbara Fondren <bfondren@roundrocktexas.gov>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-11 13:06:06 -03:00
36821be142 Bug 13208: Display complete breadcrumbs on successful deletion
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-09 14:14:54 -03:00
faf1bd1e6e Bug 13208: (QA follow-up) Remove blank breadcrumbs on successful deletion
After order is deleted we don't have a vendor or basket so we get blank
breadcrumbs, this removes them

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-09 14:00:58 -03:00
Aleisha Amohia
3bdee4a05f Bug 13208: [FOLLOW-UP] Creating and implementing new Koha::Acquisition::Basket[s] modules
Test plan remains the same.

Sponsored-by: Catalyst IT

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-09 14:00:58 -03:00
Aleisha Amohia
639d7f308f Bug 13208: Improving breadcrumbs for when cancelling an order
To test:
1) Go to Acquisitions -> Find a vendor -> View a basket with orders in
it (or make a new basket and add an order)
2) Click Cancel order
3) Notice incomplete breadcrumbs, and 'Acquisition' typo
4) Apply patch and refresh page
5) Breadcrumbs should be fixed. Confirm links to vendor and basket work
as expected

Sponsored-by: Catalyst IT

Signed-off-by: severine.queune <severine.queune@bulac.fr>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-09 14:00:50 -03:00
Katrin Fischer
13e65432ce Bug 19086: (follow-up) Fix Stored XSS in supplier.pl
In preparation:
Make sure you enter <script>alert("sth")</script>
in all fields of a new vendor that are not validated
and save.

1) Access vendor summary page.
2) Verify scripts are executed
3) Apply patch
4) Verify scripts are on longer executed

This works in combination with the other patches for XSS
on this bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-29 12:20:45 -03:00
Amit Gupta
6d22674da5 Bug 19086: Fix Stored XSS in supplier.pl
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-29 12:20:45 -03:00
Aleisha Amohia
06b602b097 Bug 19180: [FOLLOW-UP] Renaming all instances of 'name' variable to 'booksellername'
... when referring to the name of the vendor.

To test:
1) Confirm vendor shows on webpage title (tab name)
2) Confirm vendor shows in breadcrumbs
3) Confirm vendor shows in heading when viewing basket ('Basket x (1) for
vendor')

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-19 11:47:33 -03:00
Marc Véron
2ee82801c7 Bug 18652: Get rid of tt directive in translation for uncertainprice.tt
Translation tool shows toe following for ncertainprice.tt
0; url=[% scriptname %]?booksellerid=[% booksellerid %]

This patch fixes it.

To test:
- Apply patch
- Verify that code change makes sense
- Verify that Home > Acquisitions > [vendor] > Uncertain prices for [vendor]
  works as before

- Additional test (for a langunage 'aa-AA')
  perl translate create aa-AA
  verify that line 41 no longer appears in aa-AA-staff-prog.po

Amended to switch from BLOCK to a template variable, see comment #5

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-30 16:43:35 -03:00
Amit Gupta
8534ca2780 Bug 19114 - Stored XSS in parcels.pl
Test
1. Hit the page /cgi-bin/koha/acqui/parcels.pl?booksellerid=xx
   xx is booksellerid
2. Add a text in the field Vendor invoice that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Fixed XSS for parcels.pl/parcel.pl/orderreceive.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-29 12:00:37 -03:00
Amit Gupta
d31c635fe2 Bug 19112 - Stored XSS in basketheader.pl page
To Test

1. Hit the page /cgi-bin/koha/acqui/basketheader.pl?booksellerid=1&op=add_form
2. Add a text in the field Basket name, Internal note, Vendor note that contains java script
3. Save the page
4. Notice js is execute
5. Apply patch, reload, js is escaped.

Fixed XSS on pages basket.pl/basketheader.pl/bookseller.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-29 12:00:37 -03:00
Amit Gupta
fd44f2fed7 Bug 16069 - XSS issue in basket.pl page
1. Hit /cgi-bin/koha/acqui/basket.pl?basketno=xx<script>alert('amit')</script>
   xx - is a basketno
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/acqui/basket.pl?basketno==xx<script>alert('amit')</script>
   xx - is a basketno.
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-29 12:00:37 -03:00
Amit Gupta
0cf9eb0cfb Bug 19052 - XSS Flaws in - Invoice search page
1. Hit /cgi-bin/koha/acqui/invoices.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> Invoiceno,
   ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on Invoiceno,
   ISBN/EAN/ISSN, Title, Author, Publihser, Publication year search box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-29 12:00:37 -03:00
Amit Gupta
3199cff639 Bug 19052 - XSS Flaws in vendor search page
1. Hit /cgi-bin/koha/acqui/booksellers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> vendor search box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on vendor search box.
6. Notice it is no longer executed.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-29 12:00:37 -03:00
Amit Gupta
ea886885d0 Bug 19118 - Due to wrong variable name passed vendor name is not coming in browser title bar
Test

1. Hit the page /cgi-bin/koha/acqui/supplier.pl?booksellerid=xx
   xx is a booksellerid
2. Apply the patch and reload the page.
3. You can see vendor name in browser title bar.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-25 12:12:25 -03:00
3c6168d374 Bug 18331: POST_CHOMP everywhere!
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-15 12:17:41 -03:00
Lee Jamison
2ee4e0ac38 Bug 18331: Followup - Fix CSV export (once and for all!)
Follow-up on Comment 21 to correct the empty_line.inc
include in basket.tt

https://bugs.koha-community.org/show_bug.cgi?id=18331

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-15 12:17:40 -03:00
8403799c72 Bug 18331: Fix CSV export (once and for all!)
I am going to try and explain the problem here in order to make it a
have-to-read for next changes.

There are several things to test when and most of the time we break
something when we try to fix something else.

You have to test different CSV export, not only one. There are not all
processed the same way. For instance acqui/csv/basket.tt does not
contain any strings to translate and the translate script will copy the
original file as it.
But reports/csv/orders_by_budget.tt will not! Indeed it contains "TOTAL"
which will be translated. The generated tt file for the translated
language will remove all the carriage returns! That's why we cannot rely
on TT for newlines (contrary to bug 16914 assumption).

There are two possible methods:
1/ Fix the translate script
=> Hum... nope
2/ Remove all carriage returns and make them explicit by including an
file that only contains 1 carriage return

This second method is implemented in this patch.

How it works: Use the PRE_CHOMP "[%-" and POST_CHOMP "-%]"
(http://www.template-toolkit.org/docs/manual/Config.html#section_PRE_CHOMP_POST_CHOMP)
to remove all the newlines that could be added by TT in the original
(en) files. Then include the new_line.inc to add a new line.
That way original and translated files will behave the same way.
The BLOCK in the csv_headers avoid to have the newlines added, in any
cases. For instance: by default we will have an empty line at the end of
the headers, but the translated headers will not have it.

Test plan:
At least 2 signoffs will be needed, please test carefully!
You will need to generate CSV with at least 2 entries!
Test with the non-translated interface (en) and with the language you
want. To test with a translated language you will *have to*:
- cd misc/translator
- perl translate update LANG
- manually edit the po file, remove the fuzzy tags, correctly translate
the string (do not forget the additional %s in the headers)
- perl translate install LANG
1/ Export basket and basketgroup as CSV
2/ Export late orders as CSV
3/ Export items (from the item search) as CSV
4/ Export the 2 reports "Orders by fund" and "Cash register" as CSV

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-15 12:17:40 -03:00
Colin Campbell
8a0ecda6c4 Bug 18830: Fix phrasing of screen message
Verb should be plural in this message

Signed-off-by: Israelex A Veleña for KohaCon17 <israelex19@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-07-06 14:29:05 -03:00
ab29b5efdc Bug 18762: Remove warnings from xt/author/valid-templates.t
Test plan:
Read the changes and make sure they make sense

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
2017-06-14 14:36:28 -03:00
6a2ef935ac Bug 18722: Fund name is not shown in received orders fund subtotals
Test plan:
1) Go to acquisition and receive some orders
2) Show the receive summary for invoice
--> without patch, the fund name in subtotal is not shown
--> with patch the name is shown as expected

Signed-off-by: Michael Cabus <michael@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-09 11:32:48 -03:00
273659cc03 Bug 8612: [QA Follow-up] Remove two newlines from template output
When using the Default profile from the basket form, the resulting csv
file has an additional newline after the headers and at the end.
This patch removes them.
Unit test adjusted accordingly.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 12:02:08 -03:00
Blou
3c83e11786 Bug 8612: Use CSV profile for exporting basket
This patch allows the user to use a CSV export profile to create the fields to export the basket as CSV in a basket page.

Test plan:
1) Apply the patch
2) Go to Tools › CSV export profiles and create a profile of type "SQL for basket export in acquisition"
  example:
  biblionumber=biblio.biblionumber|auteur=biblio.author|titre=biblio.title|date=biblioitems.copyrightdate|editeur=biblioitems.publishercode|isbn=biblioitems.isbn|quantite=aqorders.quantity|prix=aqorders.rrp|panier=aqorders.basketno
3) In acquisition module, create a new basket and add an order to the basket
4) On basket detail page, there should be the split button labelled "Export to CSV"
5) Try to use the button and export CSV with your CSV profile you defined in step 2
6) Validate the CSV file.
7) Repeat 4-6 with a closed basket.
    a) close the basket
    b) View the basket
    c) validate that there is an export button
    d) test it with an export
8) prove t/db_dependent/Acquisition/GetBasketAsCSV.t t/db_dependent/Koha/CsvProfiles.t

Initial work:

Sponsored by: CCSR

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: mehdi <mehdi.hamidi@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 12:02:08 -03:00
Katrin Fischer
cbb5096934 Bug 11122: Follow up - Fix some display issues and typos
This patch fixes the display of copyrightdate for MARC21 installations.
As MARC21 already requires you to add punctuation in cataloguing, there
is usually no need for punctutation in the templates.

Also fixes a template variable name typo and the basket summary page.

To test (all 3 patches):
- Add several order lines to an order, one should be uncertain
- Verify that the publisher and publication year are displayed
- Check the uncertain price page
- Verify that the publisher code and publication year are displayed
- Fix uncertain price and close your order
- Basket summary: Verify... (you know what)
- Cancel one of your orders
- Verify... for cancelled orders
- Receive shipment
- Verify... for unreceived orders
- Receive order
- Verify ... for received orders
- Finish receiving
- Verify ... on the invoice summary page

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 11:48:16 -03:00
Mark Tompsett
c470b3e384 Bug 11122: Address MARC21 vs. UNIMARC issue
In comment #6 and comment #17, Katrin pointed out the discrepancy
between UNIMARC (using publisheryear) vs. Other MARC installations
(using copyrightdate). This was dealt with in invoice.tt already.
This patch does similar logic for the other 3 template files.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 11:48:16 -03:00
Fridolyn SOMERS
c59e395b74 Bug 11122 - publisher code and publication year not fetched in acq orders
In acquisition, several templates try to display publisher code and publication year : invoice.tt, parcel.tt, transferorder.tt.
Thoses pages use C4::Acquisition methods GetPendingOrders or GetInvoiceDetails.
The bug is that in the SQL query of those methods, biblioitems.publishercode and biblioitems.publicationyear.
In uncertainprice.pl those datas are fetch using GetBiblioData.
It whould be better to fetch them in GetPendingOrders and GetInvoiceDetails.

This patch changes SQL queries to fetch wanted datas : aqorders.*,biblio.title,biblio.author,biblioitems.isbn,biblioitems.publishercode,biblioitems.publicationyear. GetInvoiceDetails also needs : biblio.seriestitle,biblioitems.volume.
This patch also unifies the way biblio datas are displayed :
  <a href="link to catalog using biblionumber">[title]</a> <em>by</em> [author] &ndash; [isbn]
  <em>Publisher:</em> [publishercode], [publicationyear]

Test plan :
- Choose a biblio record containing a data in :
    biblio.title,
    biblio.author,
    biblioitems.isbn,
    biblioitems.publishercode,
    biblioitems.publicationyear,
    biblio.seriestitle,
    biblioitems.volume.
- Create an order using this biblio.
- Look at this order in pages : parcel.pl, transferorder.pl, uncertainprice.pl
=> You see publisher code and publication year
- Look at this order in page : invoice.pl
=> You see publisher code, publication year, series title and volume

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 11:48:16 -03:00
9a3ad32e46 Bug 18525: (bug 14828 follow-up) FIX ordering from suggestion when item-level_itypes = biblio
When ordering from a suggestion with item-level_itypes = biblio the app
crashes with
Template process failed: undef error - The method selected is not
covered by tests! at /home/vagrant/kohaclone/C4/Templates.pm line 121.

C4::ItemTypes->all did not set a selected flag. The item type is only
display when ordering (and not modifying an order).
The flag is never set, the test can be removed.

Test plan: Confirm that the error is gone

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-05-12 08:50:40 -04:00
8bb7769cad Bug 4969: Do not display the new link if we are seeing all baskets of a given vendor
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-03-31 13:51:49 +00:00
3c81b82b4b Bug 4969: Do not jump to the top on click
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-03-31 13:51:49 +00:00
8d2d59190a Bug 4969: Cursor should be pointer for links
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2017-03-31 13:51:49 +00:00