Commit graph

1281 commits

Author SHA1 Message Date
Magnus Enger
9060c5275f Bug 16316 - Limit patron search to surname
This patch makes it possible to limit a patron search to
search just for surnames.

To test:
- Apply the patch
- Add two patrons, called e.g. "John Doe" and "Doe John"
- Go to Patrons in the Intranet
- Make sure you have selected "Search fields" = Standard
- Search for "john" and verify both patrons show up
- Search for "doe" and verify both patrons show up
- Set "Search fields" = Surname and search for "john".
  "Doe John" should show up, but not "John Doe".
- Set "Search fields" = Surname and search for "doe".
  "John Doe" should show up, but not "Doe John".

Update: Revised the last point in the test plan.

Sponsored-by: Alingsås Public Library, Sweden
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 15:53:24 +00:00
a196dfc4f0 Bug 16298: Standardize on "Patron categories" when referring to patron category administration
This patch modifies references to the patron categories administration
page in two places: Replacing "Patron types and categories" in the
administration sidebar menu and replacing "Patron category
administration" in the heading of categories.tt. Both should now read
"Patron categories."

To test, apply the patch and confirm that the text has been updated
correctly.

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Text has been updated correctly

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 15:29:11 +00:00
5e1bcc4aa7 Bug 16242 - Move staff client JavaScript out of language directory
This patch moves the JavaScript files in prog/en/js to prog/js.
JavaScript files do not need to be in the directory which is processed
by the translator.

To test, apply the patch and visit various pages in the staff client to
confirm that JavaScript files are still loading correctly.

Revised: I intended for this to be built on top of Bug 15883 as well as
Bug 16242. Now it is.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883 and 16241
All seems to work, js files pulled from new dir.
No errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 14:32:42 +00:00
Julian Maurice
1c9b9e3e0e Bug 16238: QA fix: remove tab characters
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 14:18:24 +00:00
Julian Maurice
27770b7c8f Bug 16238: Use .prop() instead of .attr() for 'checked'
According to https://jquery.com/upgrade-guide/1.9/#attr-versus-prop-
.attr() is no longer correct to access the checked state of a checkbox.

This patch do the following replacements:
  .attr('checked')               =>  .prop('checked')
  .attr('checked, '')            =>  .prop('checked', false)
  .attr('checked, 'checked')     =>  .prop('checked', true)
  .attr('checked', boolValue)    =>  .prop('checked', boolValue)
  .removeAttr('checked')         =>  .prop('checked', false)
  .attr('checked') == 'checked'  =>  .is(':checked')

Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 14:18:24 +00:00
6381d1853d Bug 16241 - Move staff client CSS out of language directory
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.

In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.

To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:

- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.

Revised: I intended for this to be built on top of Bug 15883. Now it is.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

On top of 15883
Works as described, all pages on test plan
No Errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 13:54:37 +00:00
94af2b3212 Bug 15918 - Obsolete file datatables-strings.inc can be removed
The include file datatables-strings.inc is no longer necessary. Its
contents are now in datatables.inc. This patch corrects two references
in comments to datatables-strings.inc (replacing it with datatables.inc)
and removes the obsolete file.

To test, apply the patch and load any page with a DataTables-enabled
table configured to show pagination buttons, e.g. Saved Reports.
Pagination labels like "Next," "Previous," and "Showing X of X..."
should be correct.

Search the codebase to confirm that no references remain for
datatables-strings.inc.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 13:33:06 +00:00
9c5b819100 Bug 15009: QA follow-up
This patch adds a test to check the unicity of auth cats, simplify
the GetBudgetAuthCats subroutine and make it return an arrayref of scalar
instead of an arrayref of hashref with only 1 key.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 13:00:21 +00:00
Bouzid Fergani
97e36c0264 Bug 11371 - Add a new report : Orders by fund with more options
Add option show or no inactive budget and more options
 Use subroutine GetBudgetHierarchy for return all budgets
 Delete subroutine GetBudgetPeriodDescription and theire tests
 Use Price TT plugin
 Correct name of column and capitalization the first letter
 Add  checkbox for show inactive budgets, default the drop down list containt a active budget
 Not use [i] for inactive budgets, i add (inactive) at the end of inactive budget
 Add vendor note in the list of show attribute

 Test case:
    Go to Home > Reports > Orders by fund
    Select one or all budgets
    You can show the inactive budget, default the drop down list containt a active budget
    Choose output to screen ou csv file

Works as expected. QA tools OK with Bug 16104 applied.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
- changed 'Fund (budget):' back to 'Fund:', as the budget
  no longer shows in the pull down.
- Fixed number of tests in Budgets.t
- Removed &GetBudgetPeriodDescription

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 12:20:25 +00:00
b75d982be0 Bug 14497 [QA Followup] - Refactor code to have a single source for message
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 12:16:43 +00:00
76bd4b6f29 Bug 10171 [Follow-up] Add a header in Advanced Search (staff interface)
This patch re-indents the new include file because it's not often you
get to help a new file come into the world, it should be indented
nicely.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 11:37:24 +00:00
Aleisha
b64df89601 Bug 10171: Add a search box include on advanced search and item search pages
This patch creates a new file: adv-search.inc. This search include has
no catalog search (as it makes no sense to have the catalog search tab
on the advanced search page).
The item search page uses home-search.inc (with catalog search) as the
catalog search is different to the item search.

To test:
1) Go to Search (advanced search)
2) Confirm search header is there with no catalog search tab and works
   as expected
3) Go to item search
4) Confirm search header is there with catalog search tab and works as
   expected

Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Tested together with follow up patch, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 11:37:24 +00:00
Aleisha
87ae49399d Bug 16182: Make phone number clickable to call
EDIT: fixing typo, changing sms number from tel: to sms:

To test:

1) Go to a patron detail page
2) Confirm that all available phone numbers can be clicked and allow you to call this number from your device
	a) in the top left circ-menu.inc
	b) primary/secondary/other/organisation/mobile phone numbers
	c) alternate address phone number
	d) alternate contact phone number
	e) enable the EnhancedMessagingPreferences system preference. check the SMS number under Patron messaging preferences (back on the detail page) is clickable
3) Check to see if there are any phone numbers I have missed.

Sponsored-by: Catalyst IT

Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 11:01:24 +00:00
Aleisha
d06de76eab Bug 16281: Remove the use of 'onclick' from Reports module
EDIT: Removing unnecessary functions

To test:

1) Go to Reports -> Dictionary
	a) Attempt to delete a definition. Confirm the Ok and cancel
           buttons in confirm dialog work as expected
2) Go to Reports -> Build new
	a) On each step of building a report, confirm the back button
           works as expected
	b) Confirm add column and delete column on step 3 works as
           expected
3) Confirm deleting a report from the toolbar triggers confirm dialog
   and it works as expected
4) Create a report with an SQL error and run it. Confirm that the
   'Return to previous page' link works as expected

Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 10:58:28 +00:00
Katrin Fischer
4f91c48259 Bug 15533: QA follow-up - Formatting and improving translatability
- Makes new message in the holds tables in the patron account
  translatable
- Unbolds the note in the holds table for the record

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-04-29 10:26:05 +00:00
9eb80092e3 Bug 14686: Add Upload to Tools menu
This patch makes sure that the added granular permissions work as
advertised.

Note: The field owner was not included in the Koha::Upload->get response.
The code to verify if a user is allowed to delete an upload, is concentrated
in the template now. When get returns a Koha::Object, this check could be
relocated.

Test plan:
[1] Verify that the current user has permission for tools, or has
    at least upload_general_files.
[2] Do you see Upload in the Tools menu? Follow the link.
[3] Upload a permanent file (with a category).
[4] Do you see the Delete button in the results form?
[5] Make sure that another user has no permission to upload.
[6] Login as that user and check the Tools menu.
    Try the URL [yourserver]/cgi-bin/koha/tools/upload.pl
    You should have no access to the upload form.
[7] Enable upload_general_files for this user. Go to upload and search for
    the upload from step 3. You should not see a Delete button.
[8] Enable upload_manage for this user. Search for the upload again.
    Delete the upload.
[9] Go to upload via the Cataloguing editor (856$u plugin) or add
    parameter "plugin=1" to the URL. You should not see the Tools menu.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
2016-04-27 16:14:17 +00:00
49a3b581b7 Bug 14686: Add two granular permission for upload under tools
[1] Upload_general_files
    This will allow you to access the tools/upload form via the Tools menu.
    And it will also allow you to add permanent uploads.

[2] Upload_manage
    It will allow you to delete uploads from other users.
    Note that anyone may delete his own uploads.
    It is not meant to include upload_general_files.

In order to not disturb existing users that now have edit_catalogue and are
using the plugin (read: added at least one record to uploaded_files), we
will add the first permission for them. New users will need to be authorized
in the usual way thereafter.

Note: If you only have one of the other permissions checked in allows_add_by,
e.g. stage_marc_import, you can add temporary uploads, but not permanent
uploads.

Test plan:
We are only testing the dbrev here, not if the perm works as advertised.
[1] Run the dbrev and check that you see the perms with a description on
    the Patron/Set permissions page.
[2] If you had records in uploaded_files and a user with edit_catalogue
    *only*, verify that this user now also has upload_general_files.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
2016-04-27 16:14:17 +00:00
a8491dc156 Bug 15930: Make patron searches defaulting on 'contain'
The default patron search types has changed from 'contain' to
start_with. Users consider it as a bug.
This patch revert the previous changes to default on 'contain'.

Test plan:
Search for patrons in different places (guarantor, checkout, patron
module, acquisition module, etc.) and confirm that the default is always
'contain'

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
2016-04-22 00:31:50 +00:00
88e8f60ebc Bug 15883 - Upgrade jQuery from v1.7.2 in the staff client
This patch updates the staff client version of jQuery to 2.2.3. In order
to maintain compatibility with existing scripts, the jQuery migrate
plugin has also been added.

Included is the development version of the jQuery migrate plugin.
Developers could modify doc-head-close.inc to use this version if they
wanted to take advantage of its upgrade warning log.

To test, apply the patch and test JavaScript interactions everywhere in
the staff client.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
2016-04-20 20:31:58 +00:00
3156950e0a Bug 16206: Corrections to templates related new EDI feature
There are some issues with the template changes introduced by the EDI
feature in Bug 7736. This patch makes the following changes:

- Use Font Awesome icon on the Acquisitions basket page instead of a
  Glyphicon.
- Use Font Awesome icon on the Acquisitions basket group page instead of
  a Glyphicon.
- For consistency's sake, use the phrase "Library EANs" instead of "EDI
  EANs" in menus and the Library EANs page.

- On the EDI accounts page:
  - Correct the markup of the title tag.
  - Improve the breadcrumbs to eliminate redundancy.
  - Use Font Awesome icon instead of Glyphicon for the "New account"
    button.
  - Change or remove "maxlength" attribute of form fields to match table
    structure.
  - Move the contents of some title attributes into a visible hint.
  - Use 'checked="checked"' instead of 'checked'. Koha templates use
    XTHML-style attributes.
  - Correct template variable in account deletion confirmation dialog.
    Before this patch the vendor name was not correctly displayed.
  - Show a message if there are no accounts defined rather than an empty
    table.
  - Remove use of "highlight" class from table rows (Bug 15927).
  - Correct parameter name in link to vendor details page (should be
    booksellerid instead of supplierid).
  - Correct the markup of the deletion confirmation dialog (Bug 15785).
  - Use Bootstrap-style buttons for "edit" and "delete," with Font
    Awesome icons.

- On the Library EANs page:
  - Correct the markup of the title tag.
  - Make capitalization of "EAN" consistent.
  - Use Font Awesome icon instead of Glyphicon for the "New EAN" button.
  - Show a message if there are no EANs defined rather than an empty
    table.
  - Change or remove "maxlength" attribute of form fields to match table
    structure.
  - Remove use of "highlight" class from table rows (Bug 15927).
  - Correct the markup of the deletion confirmation dialog (Bug 15785).
  - Use Bootstrap-style buttons for "edit" and "delete," with Font
    Awesome icons.

To test, apply the patch and review the affected templates. Confirm that
pages look correct and work correctly.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All seems to work and looks well,
add/edit/delete EDI accounts and Library EANs works Ok
No errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
2016-04-20 16:49:46 +00:00
b64e6be1c4 Bug 16157: Move the selected flag from GetAuthorisedValues to the templates
From C4::Koha::GetAuthorisedValues

    # TODO: the "selected" feature should be replaced by a utility function
    # somewhere else, it doesn't belong in here. For starters it makes
    # caching much more complicated. Or just let the UI logic handle it, it's
    # what it's for.

Indeed, it's not a job for a subroutine, the template should take care of that.
Note that a perf gain could be won with this patch \o/

Test plan:
- Edit an itemtype and check the value of the "Search category" dropdown list
- Edit a patron attribute type and check the value of the "Class" dropdown list
- Detail for a catalogue record, the Status column should be correctly
  populated if items are damaged and/or lost
- Item details for a catalogue record, the lost, damaged and withdrawn
  value should be correctly displayed
- Edit a patron, the "street type" should be correctly selected
- Create a patron attribute type linked to an authorised value list.
- Edit a patron, set a value for this attribute, edit it again. The
  correct value should be selected.
- Search for subscriptions. The 'Location' dropdown list should behave
  correctly (select the entry you have choosen before, etc.)
- Edit a subscription, the location dropdown list should select the
  correct value.
- Edit and view a suggestion with a 'reason for suggestion' set (you
  should have at least 1 OPAC_SUG AV defined)

Followed test plan, works as expected
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-04-07 00:16:09 +00:00
Colin Campbell
e2e9916348 Bug 7736: Support Ordering via Edifact EDI messages
Add support for processing incoming Edifact Quotes, Invoices
and order responses and generating and transmission of
Edifact Orders.
Basic workflow is that an incoming quote generates an aquisition
basket in Koha, with each line corresponding to an order record

The user can then generate an edifact order from this (or another)
basket, which is transferred to the vendor's site

The supplier generates an invoice on despatch and this will
result in corresponding invoices being generated in Koha
The orderlines on the invoice are receipted automatically.

We also support order response messages. This may include
simple order acknowledgements, supplier reports/amendments
on availability. Cancellation messages cause the koha order
to be cancelled, other messages are recorded against the order

Which messages are to be supported/processed is specifiable on a
vendor by vendor basis via the admin screens

You can also specify auto order i.e. to generate orders from quotes
without user intervention - This reflects existing
workflows where most work is done on the suppliers website
then generating a dummy quote

Received messages are stored in the edifact_messages table
and the original can be viewed via the online

Database changes are in installer/data/mysql/atomicchanges/edifact.sql
Note new perl dependencies:
    Net::SFTP:Foreign
    Text::Unidecode

Signed-off-by: Paul Johnson <p.johnson@staffs.ac.uk>

Signed-off-by: Sally Healey <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-04-01 20:03:17 +00:00
Aleisha
181a85fe15 Bug 13132: Add confirm dialog for deleting reports from the reports toolbar
To test:

1) Go to Reports -> Use saved (or build a new one if you have none saved)
2) Click on the Actions drop down and confirm that when you click Delete from here, a confirm message shows up. Click Cancel.
3) Click Show in the drop down menu
4) Click Delete in the Reports toolbar. Confirm you now get a confirm message. Clicking Cancel will cancel the delete, and clicking OK deletes the report and takes you to the saved reports page.

Spponsored-by: Catalyst IT
Signed-off-by: Magnus Enger <magnus@libriotech.no>
After applying the patch I get a JavaScript popup confirmation when
I click on the delete button, in the Show, Edit and Run views. Nice!

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-31 18:50:54 +00:00
aed235cbf5 Bug 15921: Do not include datatables js/css files twice
datatables.inc loads dataTables.buttons.min.js and buttons.colVis.min.js
since bug 15285: Update common files because the dom param now contains
'B'. The DT init fails with it does not know what 'B' means.

Test plan:
Test tables using buttons (columns visibility), they should work as
before this patch.

Tested with patron search and administration/currencies, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-24 15:50:02 +00:00
Aleisha
a48d166bbf Bug 15866: Add confirm message for deleting rotating collection from toolbar
To test:
1) Go to Tools -> Rotating Collections
2) Click on any rotating collection ('Add or remove items' from drop down menu)
3) Click 'Delete' from toolbar. Validate you are now asked to confirm your deletion. Check that cancel works, then check that confirm works.

Sponsored-by: Catalyst IT

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
I've added the word 'rotating' before collection, to make
it clear for translators what is meant here.

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-23 18:02:03 +00:00
Aleisha
a9d7292a10 Bug 15421: Show 'Duplicate' and 'Schedule' on Reports toolbar
To test:
1) Go to Reports -> Use saved
2) Click 'Show' on the dropdown for any report
3) Confirm that 'Duplicate and 'Schedule' are now on the toolbar and work as expected

Sponsored-by: Catalyst IT

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-22 01:46:36 +00:00
6045a808f3 Bug 16030: Add 'Automatic item modifications by age' to the tool sidebar
Test plan:
Go on a page of the tools module
You should see a "Automatic item modifications by age" link
Click on it
The list should not be styled to highlight the fact that you are on this
page.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-21 22:38:55 +00:00
fc640d2a86 Bug 15111: Do not include the antiClickjack legacy browser trick for greybox
Most of the scripts called via greybox (which uses iframe) don't include
doc-head-close. But some do.
This patch adds a popup parameter for these templates, not to include
the legacy browser trick and avoid the replacement of the location.

Test plan:
1/ Export patroncard and label
2/ translate itemtypes
3/ click on a idref link at the OPAC

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-03-14 16:30:09 +00:00
dc03bca76c Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks
Web pages that can be embedded in frames are vulnerable to cross-frame
scripting attacks. Cross-frame scripting is a type of phishing attack
that involves instructions to an unsuspecting user to follow a specific
link to update confidential information in an online application.
Because the link leads to a legitimate page from the online application
that is embedded in a frame hosted by the attackers' server, the
attackers can capture all the information that the user enters.

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-03-14 16:30:08 +00:00
f300914147 Bug 15735: Audio Alerts editor broken by use of of single quotes in editor
Single quotes audio selector break ability to edit an alert

Test Plan:
1) Enable audio alerts
2) Add new a alert with a select containing single quotes such as: input[name*='test']
3) Note you cannot edit the alert
4) Apply this patch
5) Reload the page
6) You should now be able to edit the alert

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Bug 15734 applied on top. Works as advertised

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-07 19:56:49 +00:00
4eb0a1ad19 Bug 15864 - SMS cellular providers link missing from administration sidebar menu
When the SMSSendDriver system preference is set to "Email" a link to the
SMS cellular providers management page should appear in the left-hand
sidebar menu on Administration pages. This patch adds the link to
admin-menu.inc.

To test, apply the patch set your SMSSendDriver system preference to
"Email." View various Administration pages which show the left-hand
sidebar menu and confirm that "SMS cellular providers" is in the list.

Empty the SMSSendDriver preference and confirm that the link no longer
appears.

Signed-off-by: Nicole C Engard <nengard@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-03 22:22:00 +00:00
fd74b271db Bug 15887: Revise layout and behavior of item search fields management
This patch adds some JavaScript to the item search fields management
page so that the add form is not displayed by default. This simplifies
the interface and makes it more consistent with other similar
interfaces.

Also changed in this patch:
- Changing instances of "Items search fields" to "Item search fields."
- Correct form structure to use ordered list
- Add "required" classes and enable built-in JS form validation.
- Add explicitly labeled "Choose" options to <select>s.
- Add missing ids to form fields (labels don't work without them).
- Correct classes of message and alert dialogs.
- Add JS confirmation of deletions.
- Convert MARC tag and subfield dropdowns to regular inputs (Bug 15384).

To test, apply the patch and go to Administration.

- Confirm that the "Item search fields" link is correct.
- Follow the link and confirm that the list of existing fields is shown
  by default, or a message saying there are no existing fields.
- Click the "New search field" button and confirm that it displays the
  entry form.
  - Confirm that submitting an empty form does not work.
  - Confirm that clicking the "Cancel" link correctly hides the form.
  - Confirm that submitting valid data works correctly.
- In the table of existing item search fields, confirm that the "Edit"
  button works correctly.
  - Confirm that submitting edits works correctly.
- In the table of existing item search fields, confirm that clicking
  "Delete" highlights the row in question and a confirmation dialog
  appears.
  - Test both canceling and confirming deletion.

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as described. JSHint OK, koha-qa OK.

Revision per QA: Undid the change making tag and subfield inputs text
fields.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-03-02 22:36:17 +00:00
3d2646938c Bug 15910 - Move header search keep text JavaScript into staff-global.js
Bug 14189 added some global JavaScript to a new include file which is
included in doc-head-close.inc. Since it's included globally, there is
no reason not to move it to staff-global.js. This patch does so.

To test, apply the patch and clear your browser cache if necessary.

- Navigate to any page in the staff client which has multiple header
  search tabs.
- Type something in one of the tabs.
- Switch tabs. Verify that your text was copied to the newly-displayed
  form field.

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-02 03:50:00 +00:00
e82f2b8f70 Bug 15674: Use double-quote instead of simple-quote
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-02 00:58:13 +00:00
48d14b7966 Bug 15674: Make "Column visibility" translatable
The "Column visibility" text button was not translatable, now it is.

Test plan:
1/ Update the template for a given language and translate the "Column
visibility" string
2/ Go on admin/currency.pl
=> The string should be translated.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-03-02 00:58:13 +00:00
07f85e7f88 Bug 15631: Koha::Cities - remove getidcity and GetCities
C4::Members::getidcity and C4::Members::GetCities simply retrieved
cities info from the cities table.
The job done in members/memberentry.pl looked really weird and complicated.
Either I have missed something, or this patch can simplify it.

The expected behavior is:
1. Create a new patron => No city selected
2. Edit an existing patron => The borrowers.city value is selected
3. Add a guarantee => The borrowers.city of the guarantor is selected
4. Edit a guarantee => The borrowers.city of the guarantee is selected

Test plan:
Confirm that the expected behaviors are the ones before and after this patch.

Signed-off-by: Natasha <tasham_8@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-24 03:53:52 +00:00
05be0f29cd Bug 12920 [QA Followup] - Show override option below checkouts table when allowed
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-24 03:10:20 +00:00
243b797dd1 Bug 15285: Update common files
This patch moves the Button area all tables which does not redefine the
dom/sDom DT parameter.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-24 00:02:49 +00:00
Aleisha
a382c8c1cb Bug 15706: (follow-up) Changing to circulate_remaining_permissions
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-23 22:38:46 +00:00
Aleisha
f4bcd98d9a Bug 15706: Changing to circulate_remaining_permissions
I have only changed this in the includes for the tabs at the top.
Dependent on Bug 12051 as that patch adds extra tabs to the top which would need to be changed later

To test:
1) Apply Bug 12051 first, then this patch
2) Ensure that Check Out/Check In/Renew tabs still work as they should
3) Check patch for errors or pages I've missed

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-23 22:38:46 +00:00
Aleisha
e93ffac3f1 Bug 12051: Adds a Renew tab to the staff client
UPDATE: Added to checkin-search.inc to show up on returns.pl

To test:

1) Apply patch
2) Confirm that there is now a Renew tab on the pages where there is also a Check-in tab only
3) Attempt to renew a book using this, confirm it works as expected
4) Check if I have missed any pages

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-23 21:35:19 +00:00
a8942c2884 Revert bug 13618 - "Prevent XSS in the Staff Client and the OPAC" due to performance issues
Revert "DBRev to make notes of the XSS patches and the new important dependency."

This reverts commit e140603a59.

Revert "Bug 13618: Specific for branches.opac_info"

This reverts commit 06e4a50f00.

Revert "Bug 13618: (follow-up) Specific for other prefs"

This reverts commit d6475a111f.

Revert "Bug 13618: Fix for debarredcomment and patron messages"

This reverts commit dd98c9df92.

Revert "Bug 13618: Do not display html tags in patron's notices"

This reverts commit a065b243fe.

Revert "Bug 13618: Do not display &nbsp; and html tags in item fields content"

This reverts commit baeeaffbf8.

Revert "Bug 13618: Fix for system preference description"

This reverts commit a967a09261.

Revert "Bug 13618: Remove html filters for newly pushed code"

This reverts commit 0e98662b10.

Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"

This reverts commit fc2fb605e5.

Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"

This reverts commit bc308fdd9c.

Revert "Bug 13618: Fix for edit biblios and items"

This reverts commit 811c4e8402.

Revert "Bug 13618: followup to remove tabs"

This reverts commit ca8e8c397c.

Revert "Bug 13618: Fix last occurrences recently introduced to master"

This reverts commit bb417b256b.

Revert "Bug 13618: Fix for news"

This reverts commit ae5b98020a.

Revert "Bug 13618: Fix escape on sending baskets or shelves by email"

This reverts commit a7731ffe25.

Revert "Bug 13618: Specific for XSLTBloc"

This reverts commit 11fa38dc29.

Revert "Bug 13618: Specific for Salutation on editing a patron"

This reverts commit 36c07ad6d3.

Revert "Bug 13618: Specific for other prefs"

This reverts commit e6ea281a3b.

Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"

This reverts commit 7824874557.

Revert "Bug 13618: Specific for ColumnsSettings"

This reverts commit 1834da3da3.

Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"

This reverts commit 21ae62b253.

Revert "Bug 13618: Fix error 'Not a GLOB reference'"

This reverts commit 602bdbab4c.

Revert "Bug 13618: Specific for the ISBD view"

This reverts commit d254362435.

Revert "Bug 13618: Specific for pagination_bar"

This reverts commit 8837a8ae68.

Revert "Bug 13618: Specific places where we don't need to escape variables - intra"

This reverts commit 00eff140b3.

Revert "Bug 13618: Remove html filters at the intranet"

This reverts commit 7db851ff03.

Revert "Bug 13618: Specific places where we don't need to escape variables"

This reverts commit 49a3738b8d.

Revert "Bug 13618: Remove html filters at the OPAC"

This reverts commit cedaa0e23e.

Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"

This reverts commit 01b38d3b13.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-11 19:39:53 +00:00
Julian Maurice
5ef5fb5617 Bug 15358: Fix authorities merge
Bug 8064 (Merge several biblio records) change some code used in both
biblios and authorities merge tool without updating the authorities
merge tool.
This patch fixes that.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-02-03 23:03:33 +00:00
dd98c9df92 Bug 13618: Fix for debarredcomment and patron messages
At the OPAC and intranet.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:17 +00:00
0e98662b10 Bug 13618: Remove html filters for newly pushed code
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:16 +00:00
e6ea281a3b Bug 13618: Specific for other prefs
opacmainuserblock
opacnav
opacnavright
opaccredits
opacheader
opaccustomsearch
opacmysummaryhtml
opacmysummarynote
opacnavbottom
opacnoresultsfound
opacresultssidebar
opacsearchfortitlein
restrictedpagecontent
PatronSelfRegistrationAdditionalInstructions
intranetmainuserblock
intranetnav
intranetslipprinterjs
OpacSuppressionMessage
SCOUserCSS
SCOUserJS
SelfCheckHelpMessage
NoLoginInstructions

Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:14 +00:00
21ae62b253 Bug 13618: Specific for IntranetUser* and OPACUser* prefs
Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:13 +00:00
602bdbab4c Bug 13618: Fix error 'Not a GLOB reference'
The interpolation of a variable on including a file caused an unexpected
error:
Template process failed: undef error - Not a GLOB reference at
/usr/lib/i386-linux-gnu/perl5/5.20/Template/Provider.pm line 619.

The easier fix is to replace it with a SWITCH.

Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:13 +00:00
Jonathan Druart
7db851ff03 Bug 13618: Remove html filters at the intranet
Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala@gmail.com>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
2016-01-29 17:54:12 +00:00
Hector Castro
e3139601c6 Bug 13642 - Adding new features for Dublin Core metadata
When Koha export a bibliographic record to DC, makes it in XML format.
This XML not follows the DC-XML recommendations as should be: elements
in uppercase eg. dc:Date, dc:Creator, section 4.2, recommendation 4
explain that "The property names for the 15 DC elements should be all
lower-case." eg. dc:date, dc:creator" and section "4.3 Example - a
simple DC record", xsi:schemaLocation="http://example.org/myapp/
http://example.org/myapp/schema.xsd" schema does not exist.

NOTE: This new feature implement the XSLT transformation for OAI-DC,
SRW-DC and RDF-DC

Test plan
---------------
1) Download Dublin Core file from record detail page. Open up the file,
   and make sure that the document not follows the DC-XML
   recommendations as should be.
2) Apply patch.
3) Go to whichever bib record in OPAC or staff and click on Save >
   Dublin Core.  A modal will display, prove all options.
4) Change the system preference 'Opac ExportOptions' by enabling and
   disabling Dublin Core and try to download a record.
5) Try several bibliographic records in any format (book, magazine, DVD,
   etc.) to confirm that properly exported.
6) Test with all marc flavours.

Sponsored-by: Universidad de El Salvador

Signed-off-by: Frederic Demians <f.demians@tamil.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-01-27 06:23:07 +00:00