AdvancedSearchTypes syspref can be multivalued, opac-topissues.pl
have to support that.
AdvancedSearchTypes can have one or more of the following values:
'itemtypes', 'ccode', 'loc'. But this patch adds support only for
itemtypes and ccode. AdvancedSearchTypes can still contain 'loc' but it
will change nothing to the behaviour of opac-topissues.pl.
This patch also removes duplicate code in template (the "Refine your
search" form was written in two different places)
This introduces a small behaviour change: when there is no results,
instead of having the form in the center of the page, it remains in the
left sidebar and we have a "No results" message in the main area.
Depends on bug 14788
Tested on top of 14788. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Tested with syspref 'AdvancedSearchTypes' set to itemtypes an ccode (one at a time).
No problems found.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
In order to see the checkboxes of the Collection and Shelving location of the advanced search, the if changed so that only the Itemtypes will go through the previous if
This allows to group certain item types in a category, to be displayed (and searched) as such in OPAC's advanced search. For example, you can group Reserve 2h and Reserve 12h into a Reserve category. The 2 and 12h types won't appear anymore.
This also allows to simply prevent an item type from displaying as a search option.
TEST PLAN
------------------
0) Back up database, so you can reset and retest easily. ;)
1) Apply the patch
2) Run Koha QA tool.
3) prove -v t/db_dependent/Koha.t
-- all tests should pass.
4) run ./installer/data/mysql/updatedatabase.pl to add the
two columns to itemtypes
-- Does a meaningful message get printed?
Are the columns added?
"DESCRIBE itemtypes;" should list hideinopac and searchcategory.
5) You need to add a category to group your item types:
a) In Intranet/Koha Admin/Authorized values,
select DOCTYPECAT in the 'Show category:' dropdown
i) If you do not have a DOCTYPECAT category, create one.
b) Click button "New authorized value for DOCTYPECAT"
c) Enter
Authorized value: HARDWARE
Description : Hardware
Description (OPAC): Hardware
6) Group your items under that new category
a) In Intranet/Koha Admin/Item types, choose (at least)
two item types and for each:
- Click action/Edit on the right column
- Third row (below Description) is the Search category list box, select Hardware
- click Save changes at the bottom
7) Select at least one item to be hidden in the OPAC search
a) In Intranet/Koha Admin/Item types (again), choose a different item type:
- Click action/Edit
- Click the checkbox "Hide in OPAC" below the list of icons.
8) Go test your modifications
a) Go to OPAC/Adv search.
b) Validate that all items modified above (hidden or grouped) do not appear in Item type list
c) Validate that new item type Hardware does appear instead.
d) Select item Hardware, start Search.
) Validate returned items are the of the two types that were grouped into the Hardware category in step 4.
Sponsored-by: Vanier college
Signed-off-by: Nick <nick@quecheelibrary.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch introduces 2 sysprefs :
RestrictionBlockRenewing to allow/block renewal of items when patron is restricted.
OverduesBlockRenewing to allow, block only the late ones or block all checked out items
Default is "allow" in both case.
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
CGI->url does not return the correct url on install using packages.
Test plan:
1/ Try to reproduce the bug from the description of bug 15005.
You should be able to login to the intranet and the OPAC
2/ Send a basket and a list from the intranet and the OPAC.
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alexis Rodegerdts <arodegerdts@wallawallawa.gov>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Test plan (requires Baker and Taylor cover images to be set up and enabled):
1. Create a record with an ISBN that does not have a cover and a UPC
that does. 141985934X/085391174929 is one set that works well.
2. Verify that the record shows up as "No image available" in the
following OPAC locations: shelf browser, reviews, lists, search and
reading record. This will require adding reviews/checkouts/etc. for
the record in question.
3. Apply patch.
4. Check the locations again, and verify that the record now has a
valid cover image.
Signed-off-by: Alexis Rodegerdts <arodegerdts@wallawallawa.gov>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Koha is currently not engineered to handle multiple holds per record.
Until such time that is does, we should not allow them to be created.
Test Plan:
1) Apply this patch
2) Log in to the opac
3) Place a hold
4) Hit the back button on your browser
5) Place the hold again
6) Note the new message
Signed-off-by: David Kuhn <kuhn@monterey.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
At the OPAC, if the tag is not approved, the tag's link did not return
any result.
This patch removes the link.
Test plan:
1/ Set TagsModeration to 'Require'
2/ Create tags at the OPAC
3/ Approve a couple
4/ Confirm that unapproved tags does not have links.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
works as described, no errors
For the (approved) link to work I need to install YAML::XS
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
There is hidden text in "Checkouts" cells that prevent DataTables to
sort numerically.
This patch adds the 'title-numeric' sort plugin and use it in
opac-topissues.pl
Column 'Checkouts' in Home > Most popular items sorts as expected
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
In authentication pages with CAS, the use of acronym or abbr tags does not allow a correct translation of the text.
See http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5983#c7
It does not help a lot end users to know that CAS is Central Authentication Service, I think. Now one can custom the login page with NoLoginInstructions syspref to describe how to use the authentication.
This patch removes the use of acronym and abbr is authentication pages.
Test plan (example with fr-FR locale) :
- Without patch
- Update translation files : cd misc/translator ; perl translate update fr-FR
- You see in fr-FR-opac-bootstrap.po : msgid "If you have a "
- Is is translated in : msgstr "Si vous avez un compte "
- Apply patch
- Update translation files : cd misc/translator ; perl translate update fr-FR
- You see in fr-FR-opac-bootstrap.po : msgid "If you have a CAS account, %s please "
- You can now translate it : msgstr "Si vous avez un compte CAS, %s veuillez "
- Same test for intranet authentication page
- Install the translation : cd misc/translator ; perl translate install fr-FR
- Look at the result
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised. Tranlated OK, tested in spanish es-ES
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Bug 10177 rejects password with leading or trailing whitespaces, but
only on the member-password page.
It's not consistent to only do this check on 1 place.
This patch adds the check for the 2 other places: memberentry and at the
OPAC.
Test plan:
1/ Edit a patron and set a password with leading and/or trailing
whitespaces. You should not be allowed to do it (no server side check).
2/ Same at the OPAC ("Change you password" tab). Here there is a server
side check.
Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Test tt_valid.t warns that opac-retrieve-file.tt has no id and class
attribute on the body tag.
This patch adds them to clear the warning.
Test plan:
Apply patch and run xt/tt_valid.t.
Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
This patch makes the following changes to achieve that:
[1] Use Upload.pm in stage-marc-import.pl, upload-cover-image.pl,
offline_circ/process_koc.pl and enqueue_koc.pl.
[2] A new file-upload.js replaces file-upload.inc in the associated template.
We now use ajax to get progress figures instead of launching perl script
upload-file-progress.
The js changes now also allow for aborting a file upload.
[3] Adds a tools/upload script and template. It allows to upload multiple
files at once.
[4] Makes upload-file return error messages in JSON. For a multiple upload,
we could have some files with errors and others without errors.
The upload is now marked as Failed only if there was no upload at all.
[5] The upload plugin is converted to use tools/upload with plugin param.
Deleting an upload is now presented via the search results form.
NOTE: In editing the process_koc.tt I noticed that the form enqueuefile was
hidden and no longer used (with associated code in process_koc.pl). When a
file has been uploaded, I display the form again (with the Apply directly
button). The code still works.
NOTE: We fix an error in upload-file from one of the patches of bug 6874.
The userid of the Koha admin user is passed to haspermission, but we
should pick the userid from the session.
NOTE: Bug 14686 will add a specific permission for tools/upload.pl, and
will add the tools/upload script to the Tools menu.
For now, you need edit_catalogue to start upload.pl and you will
additionally need a permission like upload_local_cover_images
to successfully upload a new file.
Test plan:
[1] Upload a marc file in stage-marc-import. (This is temp storage.)
[2] Check new entry in table uploaded_files. Look for the file in your
temporary directory (/tmp ?), subfolder koha_upload.
Bonus: Remove permissions on this subfolder. Retry, check error and
restore permissions again.
[3] Upload another (larger) file and abort the upload. Check table and
directory again. You should have a partial file, but no record.
[4] Verify that Stage for import still works as expected.
[5] Test Upload local cover image. (Enable OPACLocalCoverImages.) You can
test an individual image or a zip file including images and a file
called datalink.txt (with lines biblionumber,filename).
[6] Test uploading a offline circulation file:
Enable AllowOfflineCirculation, and create a koc file (plain text):
Line1: Version=1.0\tA=1\tB=2
Line2: 2015-08-06 08:00:00 345\treturn\t[barcode]
Note: Replace tabs and barcode. The number of tabs is essential!
Checkout the item with your barcode.
Go to Offline circulation file upload. Upload and click Apply directly.
Checkout again. Upload again, click Add to offline circulation queue.
[7] Upload three files via tools/upload.pl with a category and marked as
public. Check the results in the table.
Verify that you can download the file in OPAC without being logged in.
[8] Pick one new file and one of the files of step 7. Upload them in the
same category. One upload should succeed. Check for reported error.
[9] Connect upload.pl to field 856$u.
Goto Cataloguing editor.
In an empty 856$u, click the tag editor. Upload a file and click Choose.
Save the record. Open the record in the OPAC and click the link.
Copy this link to your clipboard for next step.
[A] Go back to editor. Click the tag editor on the same 856 field.
Choose for Delete.
Open the link in your clipboard again. Error message?
[B] Check the process of upload, search, download and delete of an upload
with some diacritical characters in the filename. (Bonus points for
adding special chars in the category code.)
Note: You can add categories via authorized values, UPLOAD key.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Bug 14321: [QA Follow-up] Perltidy upload.pl
Run perltidy -pro=xt/perltidyrc on tools/upload.pl.
No other changes.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
If an item is on reserve for two courses but one of those courses is
disabled, both courses are still listed on opac-detail.pl!
Test Plan:
1) Enable course reserves
2) Create two courses
3) Place one item on reserve for both courses
4) Disable one of the two courses
5) View the record details for that record/item
6) You should see both courses listed in the course reserves column
7) Apply this patch
8) Reload the page
9) You should now only see the active course in the course reseves column
Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
To test:
Edit a patron in the intranet, note that the gender options are "Female," "Male," and "None specified"
Setting "None specified" should result in the gender not being shown on the patron detail page (unchanged functionality)
In the opac, log in and click the "your personal details" tab, and note that the gender options are "Female," "Male," and "None specified"
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
if no changes has been made for personal details, bring user back to details
page and inform them that no changes has been made.
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
And remove the useless use of the KohaDates plugin
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
To test:
I) Apply the patch
II) Run updatedatabase.pl
scenario I)
1) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
2) Add your machine ip (ex. 127.0.0)
3) Validate cgi-bin/koha/opac-proxypage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents.
scenario II)
1) Logout opac page
2) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
3) Add other ip that your machine ip.
4) Validate: cgi-bin/koha/opac-proxypage.pl shows a login page.
5) Validate: cgi-bin/koha/opac-proxypage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents after login.
Followed both scenarios, works as expected.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Bug 13485 [QA Followup]
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Bug 13485 - Atomic Update + Rename Proxy page to Restricted page
Test plan:
I) Apply the patch
II) Run updatedatabase.pl
scenario I)
1) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
2) Add your machine ip (ex. 127.0.0)
3) Validate cgi-bin/koha/opac-restrictedpage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents.
scenario II)
1) Logout opac page
2) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
3) Add a diffrent ip.
4) Validate: cgi-bin/koha/opac-restrictedpage.pl shows a login page.
5) Validate: cgi-bin/koha/opac-restrictedpage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents after login.
new file: installer/data/mysql/atomicupdate/Bug13485_RestrictedSitesPage.sql
modified: installer/data/mysql/sysprefs.sql
modified: koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
renamed: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-proxypage.tt -> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-restrictedpage.tt
renamed: opac/opac-proxypage.pl -> opac/opac-restrictedpage.pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
This patch makes a few changes to the way errors are handled in the
OPAC:
- The validation plugin has been moved from the global include file to
the template itself. Since we aren't doing form validation on any
other page yet it doesn't make sense to include it globally at this
time.
- The error message which appears if you have JavaScript disabled and
have submitted invalid emails was styled in a non-standard way.
- I have added in-page links to the error message which appears if you
have JavaScript disabled so that you can click to jump to the field
which contains the error.
- I have modified the error message language slightly to make it (I
hope) read better.
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch adds server-side & client-side validation for email
form fields in the members/memberentry -view and in the
opac/memberentry-view (bootstrap).
I recently added simple validation for phone number and email address fields
for our in-house koha and saw this old bug: I'm open to any ideas on how
to do this better. Validation for phone numbers would be easy to add on
top of this but I left it out since this bug is only about the email
fields.
To test:
1) Select a member and go to any of the edit forms with email fields
(Primary info, "Library use", "Alternate address", "Alternative
contact").
2) Disable javascript in the browser in order to test server-side
validation and try to input invalid emails in each of the email form
fields.
3) Confirm that an invalid address is catched from any of the email
fields, an alert shown for each invalid address and that the member's
information was not updated with invalid data.
4) Enable javascript in the browser.
5) Confirm that the jquery validation plugin caches invalid addresses
from any of the email fields and that you cannot send the form before
correcting the problem.
6) Perform the same tests for the opac-memberentry-view.
Note: as the jQuery validation plugin doesn't exist in the bootstrap
folder, I just copied it over from the staff-client folder -how to deal
with this?
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
I have undone the changes to opac.css so that they can be submitted as a
separate patch. I have some other follow-ups to make as well.
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Libraries are reporting that patrons are very confused during
self-checkout. The problem is they are expecting the list of checkouts
to be in the order they checked out the items ( first checkout on the
bottom, last item checked out on top ). However, the checkouts
table is sorted by title ( ascending ) then due date ( descending ).
This is not intuitive.
Test Plan:
1) Enable Koha's self checkout
2) Use the SCO to check out a random assortment of items,
make sure you don't check them out in alphabetical order
3) Note the order of the items in the list is not based on the order
you checked them out in
4) Apply this patch
5) Refresh the page
6) Note the items are now in the order you checked them out
with the last on top and the first on bottom
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
According to the doc, we should not escape query_cgi with the uri
filter:
http://www.template-toolkit.org/docs/manual/Filters.html#section_uri
Since query_cgi can contains something like: "idx=kw&q=42", we should
not escape the & char
Test plan:
0/ Don't apply the patch
1/ Go on launch a search at the OPAC
2/ Click on the RSS icon
3/ You should arrive on
opac-search.pl?idx%3Dkw%26q%3D42&count=50&sort_by=acqdate_dsc&format=rss2
The & has been escaped.
4/ Apply the patch
5/ Now you should get result and see an url correctly formatted.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
TEST PLAN
---------
1) Ensure you have a book that would pull up an idreambooks image
(e.g. The road to character / David Brooks.)
-- I imported from the Library of Congress via z39.50
2) Ensure your system preferences for idreambook stuff is set.
3) Ensure you have multiple 020$a's for your book, and
the first one must just be an ISBN number!
-- I removed the '(hardcover: acidfree paper)' from the first.
-- I took the second 020 field and changed 020$z to 020$a
4) Search for that book in OPAC and go to details.
-- There should be a readometer image, but it will be broken.
-- Notice the ISBN line has "#############; ..."
This could also be attained by just putting two semi-colon
separated ISBN's on the first 020$a.
5) Apply this patch
6) Refresh page
-- readometer image appears. YAY!
7) run koha qa test tools
NOTE: Only changed test plan, so leaving sign-off on.
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
There is no need to display the cardnumber and expiration date values in
a disabled input.
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
This patch makes it possible to show the expiration date
of a patron account in the OPAC on the details tab in the
patron account.
Extras:
- Makes it possible to hide cardnumber with
PatronSelfRegistrationBorrowerUnwantedField
To test:
- Toggle OPACPatronDetails and test date expiry always shows
- Check PatronSelfRegistrationBorrowerUnwantedField for dateexpiry
and cardnumber
- Verify a patron address modification request still works
as expected
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()
This patch corrects opac/opac-ratings.pl
Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page
Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
To test:
1/ Hit a url like
/cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh
noes')</script> Where the id is a valid shelf id
2/ Notice the js is executed
3/ Apply patch
4/ Reload page
5/ Notice input is now escaped on display
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tested in Debian, couldn't reproduce the alert in Iceweasel, but in
Chromium. Patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Fix for /cgi-bin/koha/opac-search.pl
To test
1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script
src='http://cst.sba-research.org/x.js'/>&q=a
2/ Notice the js is executed
3/ Apply patch
4/ Reload page, notice it is no longer executed
5/ Test the rss links work still
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed bug and that the patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
opac-addbybiblionumber.pl is also vulnerable because it doesn't escape
list names.
To test
1/ Create a malicious list name
2/ Try to add a biblio to the lists
3/ Notice js is excuted
4/ Apply patch
5/ Test again
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
This pref does not work at all, the interface let the user choose to
list all suggestions, but whatever he chooses the suggestion list is the
same.
This patch cleans a bit the suggestedby management.
There are a lot of cases to test, because linked to 2 prefs:
AnonSuggestions and OPACViewOthersSuggestions.
1/ AnonSuggestions = 0 and OPACViewOthersSuggestions = 0
- A non logged in user is not able to make a suggestion.
- A logged in user is not able to see suggestions made by someone else.
2/ AnonSuggestions = 0 and OPACViewOthersSuggestions = 1
- A non logged in user is not able to make a suggestion.
- A logged in user is able to see suggestions made by someone else.
3/ AnonSuggestions = 1 and OPACViewOthersSuggestions = 0
- A non logged in user is able to make a suggestion.
The suggestedby field will be filled with the AnonymousPatron pref value.
He is not able to see suggestions, even the ones made by AnonymousPatron.
- A logged in user is not able to see suggestions made by someone else.
4/ AnonSuggestions = 1 and OPACViewOthersSuggestions = 1
- A non logged in user is able to make a suggestion.
He is able to see all suggestions.
- A logged in user is able to see suggestions made by someone else.
In all cases a logged in user should be able to search for suggestions
(except if he is not able to see them).
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All use cases tested, work as expected
No errors
Only comment is perhaps (in the future) a gracefull failure
when AnonymousPatron is not set, or has '0' value
Message is DBIx::Class::ResultSet::create(): Column 'suggestedby' cannot be null at ...
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Patch marks several strings in the Javascript on the OPAC detail
and result page for translation.
1) IDreamBooks*
- Activate the 3 IDreamBooks* system preferences
- Check the 'cloud' and additional content shows up correctly on
the detail and result pages
- Verify everything works as expected and the same as without the patch
2) OpacBrowseResults
- Activate OpacBrowseResults
- Do various searches
- Verify the nex, previous, browse result list features still
work the same as without the patch
Bonus: Check new strings appear in the .po files by updating one
language with the patch applied (perl translate update de-DE)
NOTE: Really should have read the test plan more closely.
I couldn't find the 'Go to detail:' section, until I clicked
'Browse results'.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
Using 'in the complete record' rather than 'in keyword'. I think this fits well as it seems that this means the search looks anywhere in the record.
To test:
1) In the OPAC, click on Authority Search
2) Notice that in the drop-down menu for the 'Where:' field, there is an 'in keyword' option.
3) Apply patch
4) Now says 'in the complete record'
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
To test:
1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.
To test:
1) Go to URL such as ... /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The synopsis of this TT plugin contains two example lines:
[% myhtml FILTER html2text(leftmargin => 0, rightmargin => 0) %]
[% myhtmltext | html2text %]
These lines have been copied (without too much thought :) to a few templates. Since we do no use the variables myhtml or myhtmltext in these templates, these lines are useless.
Test plan:
[1] Put some items in your cart. And send it.
[2] Send a shelf.
[3] Git grep on myhtml. Should not have results.
NOTE: Sent carts and lists in Intranet and OPAC successfully.
Though, this does bring into question why the letters
have HTML formatting if it is getting removed. That,
however, is beyond the scope of this bug.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
If a Koha server is configured to run over SSL, all iDreamBooks content
is blocked due to the fact that a secure page is requesting an insecure
endpoint. This is due to the fact that the urls for iDreamBooks use http
and not https. A simple fix would be to switch them to https since
browsers have to qualms about loading a secure data endpoint from an
insecure one.
Test Plan:
1) Enable iDreamBooks
2) Set up your OPAC to use https
3) Verify iDreamBooks content continues to work
Note: tested Chrome and IE, so that the IE change would be validated.
Discovered isbn semi-colon issue that is beyond scope of this bug.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Same as before for the OPAC.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Good result, no errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch corrects the display of current page on
a multipage recent comments.
To test:
1) Enable OpacShowRecentComments
2) Add multiple comments to multiple records
I used a script to add multiple lines like
"insert into reviews values ($i, 51, $i, 'Comment $i', 1, '2015-06-01 00:00:00')"
to table reviews
3) On OPAC, go to 'Recent comments', verify the bug
4) Apply the patch
5) Reload and check correct display
Can't found missing space near 'by' from description.
Display is correct for me.
Followed test plan, displays as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
- Fix filter labels:
Library : -> Library:
Subscription : -> Subscription:
- Make '(All)' entry in filter pull downs translatable
- Show branch name instead of branchcode in table and filter
To test:
- Verify changes as described above
- Verify filters still work as expected
Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
First, it is strongly recommended to set the OPACBaseURL. But
this patch allows the inclusion of the protocol and not just
a site.
Next, C4/Auth now puts OPACBaseURL into the template parameters
regardless of OPAC or Staff clients. t/db_dependent/Auth.t was
tweaked to add a check for confirming that get_template_and_user
adds OPACBaseURL to both OPAC and Staff templates.
In the staff client, once the OPACBaseURL is set, you get a nice
OPAC View link when viewing a biblio's detail. It should reflect
the protocol used now.
Hard coded 'http://' strings were removed from the
sample_notices.sql files. This is what required also updating
the letters table in the updatedatabase.pl script.
The explanation text in the sysprefs.sql needed updating too to
reflect the inclusion of the protocol. And this was the other
update done in the updatedatabase.pl script. The opac.pref file
was similarly changed as well.
catalogue/detail.pl had no need to pass a custom OpacUrl value,
since C4/Auth passes the required OPACBaseURL, so it and the
corresponding template were modified.
Both the MARC21 and NORMARC intranet details files had 'http://'
hard coded in them. This was removed.
Both the bootstrap and prog theme opac-detail template had a
protocol parameter that was used. The logic for the parameter
was not removed, because it is used extensively in one template.
Perhaps it should be used to simplify the other. However, the
calculated current_url parameter had references to the protocol
removed, because of the changes to OPACBaseURL.
opac/opac-shareshelf.pl had a hard coded 'http://' which was
removed.
t/db_dependent/Auth_with_cas.t had 'http://' added to the value
set for OPACBaseURL.
In virtualshelves/sendshelf.pl explicit code which sent the
OPACBaseURL preference was removed, since C4/Auth sends it all
the time now.
C4::Context::set_preference was tweaked to ensure that
OPACBaseURL would always start with http.
t/db_dependent/Context.t was tweaked to specifically test this.
The Shibboleth authentication needs OPACBaseURL set, and that
it be https protocol. The _get_uri routine was tweaked to always
pass back https:// as the protocol on the OPACBaseURL.
t/Auth_with_shibboleth.t was tweaked to specifically test the
changes.
TEST PLAN
---------
This is not an easy patch to test. Difficulties include:
- configuring Koha to run under https
(tweaking apache2 isn't so hard, just tricky)
- configuring Koha to run OPAC and Staff with Plak
(since code with comments about plak were sliced out)
- configuring Koha to use CAS
(may be requires for the CAS test)
1) Apply patch
2) Make sure OPACBaseURL is set without the protocol included.
UPDATEDATABASE
3) back up your DB
4) ./installer/data/mysql/updatedatabase.pl
-- It should run without errors.
5) Look up the OPACBaseURL system preference in the staff
client
-- It should have http:// prepended.
6) Run the mysqlclient from your koha git directory
USE koha_library;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
-- There should be no prepended http:// on the
<<OPACBaseURL>>.
7) restore your DB
8) Make sure OPACBaseURL is set with the protocol included,
preferably https.
-- Using https requires a bunch of apache2 tweaks.
AUTH
9) Call up staff client.
10) Call up OPAC.
-- C4/Auth.pm doesn't barf.
11) Call up Plack staff client
12) Call up Plack OPAC.
-- C4/Auth.pm doesn't barf.
13) prove -v t/db_dependent/Auth.t
CONTEXT
14) Home -> Koha administration -> Global System Preferences
-> OPAC
15) Modify and save OPACBaseURL to not have http:// or https://
on it.
-- It should be modified to include http://
16) Modify and save another system preference.
-- It should save normally
17) prove -v t/db_dependent/Context.t
CATALOGUE/DETAIL (tt & pl)
18) Confirm the OPACBaseURL is set
19) Navigate to any biblio details in the staff client
-- There should be a "OPAC view" link which has the
correct http:// or https:// in it.
SQL (sample notices and sysprefs)
20) Run the mysqlclient from your koha git directory
USE koha_library;
DELETE FROM letter;
source installer/data/mysql/de-DE/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/en/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/nb-NO/1-Obligatorisk/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/es-ES/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/fr-FR/1-Obligatoire/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/it-IT/necessari/notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/pl-PL/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/ru-RU/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
DELETE FROM letter;
source installer/data/mysql/uk-UA/mandatory/sample_notices.sql;
SELECT content FROM letter WHERE content LIKE "%<<OPACBaseURL>>%";
-- Each of the selects should should lines that have
<<OPACBaseURL>> starting them, but no hard-coded http://
DELETE FROM systempreferences;
source installer/data/mysql/sysprefs.sql;
SELECT * FROM systempreferences WHERE variable='OPACBaseURL';
-- The explanation should reflect the new explanation.
QUIT
21) restore your DB
22) Make sure OPACBaseURL is set with the protocol included,
preferably https.
-- Using https requires a bunch of apache2 tweaks.
SLIM2INTRANETDETAIL
23) Set 'XSLTDetailsDisplay' system preference to default.
24) Set 'marcflavour' system preference to MARC21.
25) View any biblio's details.
-- the URL beside 'OPAC View' should have the appropriate
http:// or https://
26) Set 'marcflavour' system preference to NORMARC.
27) View any biblio's details.
-- the URL beside 'OPAC View' should have the appropriate
http:// or https://
OPAC-DETAIL
28) Set 'opacthemes' to bootstrap.
29) Set 'SocialNetworks' to enabled.
30) In OPAC, view any biblio's details.
-- the Share links should have the appropriate protocol on
the OPACBaseURL.
31) Set 'opacthemes' to prog.
32) In OPAC, view any biblio's details.
-- the Share links should have the appropriate protocol on
the OPACBaseURL.
AUTH_WITH_CAS
33) prove -v t/db_dependent/Auth_with_cas.t
OPAC-SHARESHELF
34) Set 'OpacAllowSharingPrivateLists' to allow.
35) In OPAC, 'Save to Lists' a search result.
36) Save it to a new private list.
37) Click the Lists button, and select the new list.
38) Click the Share button.
AUTH_WITH_SHIBBOLETH
39) prove -v t/Auth_with_shibboleth.t
-- needs to be tests on Debian, because I can't get
the Test::DBIx::Class installed in Ubuntu. :(
Rebased again on kohadevbox...
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The original concern of bug 14266 was to provide a compatibility for
<IE9.
But actually we don't need to trim the email address template side.
It will even better to trim it in the perl script, so that the email
will be trimed even if JS is disabled.
Test plan:
1/ Share a list and does not provide any email address
2/ Submit
=> The form is not submited, no alert/message is displayed (same as
before this patch).
3/ Share a list and provide an email address with spaces before and
after
4/ Submit
=> You should receive the email
Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Test output compliant with expected test plan outcome.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch replaces trim() with $.trim() which is supported
in versions of IE older than IE9.
Revised test plan
=================
Before applying patch:
0) Use IE 8 or Document Mode 8 in a newer IE using F12 Developer Tools
1) Set OpacAllowSharingPrivateLists to "Allow" in Global System Preferences
2) Create a private list in the OPAC
3) Add a record to the private list
4) Click "Share" or "Share list" on one of the list screens
5) Type in an email address and click "Send"
6) Note the error in the console log
7) The page should submit
Apply the patch:
7) Hold shift + refresh the browser to update any Javascript cache
8) Try to "Share" the list again
9) Note that the form submit after clicking "Send" and
that there are no errors in the console log
http://bugs.koha-community.org/show_bug.cgi?id=14266
Signed-off-by: Indranil Das Gupta <indradg@gmail.com>
Remarks: Works as per revised test plan
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Tested wit OPAC, full list is printed.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The phrase
Please type this following characters into the preceding box
should be
Please type the following characters into the preceding box
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
At the OPAC and the intranet, the urls don't be displayed anymore.
The variables used in the templates are not the good ones (MARCurlS vs
MARCURLS).
Test plan:
1/ On the intranet side, add some urls to some records
2/ Add these records to the basket
3/ Add records without urls defined
4/ Go on the basket view, click "more details"
5/ You should see the urls displayed
6/ Repeat steps 4-5 at the OPAC
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
NOTE: 856$u displays now in intranet and OPAC. :)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch makes the following changes:
1) If there is no logged in patron, the RSS link states it is for
system-wide news.
2) If a patron is logged in, the RSS link states it is for system-wide
news *and* news for the patron's home library.
3) The patron's home branch code is embedded in the RSS feed url so
he or she no longer needs to be logged in for us to know what branch's
news to pull.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch fixes an invalid URL when clicking
on RSS feed.
To test:
1) Using Nicole words :)
If you visit : http://mykoha/cgi-bin/koha/opac-main.pl
then the RSS feed works.
If you're on http://mykoha and you click the rss icon you
get : http://mykoha/opac-news-rss.pl which is a 404 page.
2) Apply the patch
3) Repeat 1, error is now fixed
Signed-off-by: Pierre <tredok.pierre@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The RSS button used to read ' RSS for the librarys general newsfeed.'
This included one grammatical error and I think included more words
than most average people would read. This patch simplifies it to say
'RSS for Library News.'
To test:
* Apply all patches
* Review RSS feed button's text on main page under news
http://bugs.koha-community.org/show_bug.cgi?id=7843
Signed-off-by: Pierre <tredok.pierre@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
1/ use strict and warnings are useless, Modern::Perl is used
2/ Prefer to use the interface and theme TT var instead of the hard
coded path
Signed-off-by: Pierre <tredok.pierre@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Test plan:
* Install the patch
* Make shure there is news in the Opac
* Go to the Opac (opac-main.pl)
* Make shure you see an RSS icon below the news and a short text.
* Click the RSS icon and verify that you get an RSS feed that validates.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
I took the liberty of fixing the copyright statement when signing it off
Signed-off-by: Pierre <tredok.pierre@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
If error occurs when generating the pdf, it would be better to get an
encapsulated error instead of the "software error" message in the pdf
file.
To test this patch I added this change:
b/Koha/Borrower/Discharge.pm
-115,6 +115,7 @@ sub generate_as_pdf {
say $html_fh $html_content;
close $html_fh;
my $pdf = PDF::FromHTML->new( encoding => 'utf-8' );
+ $html_path .= "poeut";
$pdf->load_file( $html_path );
$pdf->convert;
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch is the main patch. It adds new package and files for the new
pages (opac-discharge, members/discharge and members/discharges).
At the intranet, it is now possible to generate a discharge for a patron.
At the opac, a patron can request a discharge and a discharge if it has
been validated by a librarian.
Requirements:
The perl module PDF::FromHTML
New sysprefs:
- useDischarge: Allows librarians to discharge borrowers and borrowers
to request a discharge
New letter with a letter_code DISCHARGE.
Test plan:
- Switch on the syspref useDischarge.
- Verify a new tab appears in the patron page (intranet and opac).
- Verify the discharge cannot be generated if the patron has issues.
- Verify the patron can request a discharge from it's opac area.
- The request appears on the main page (intranet).
- Generate the discharge from the intranet.
- Try to download it (from the opac and the intranet).
Signed-off-by: Lucie <lucie.rousseaux@dracenie.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Test Plan:
1) Apply this patch
2) Create one or more public lists
3) View the list in the opac
4) Note the new RSS icon next to the list name
5) Open the link in FireFox or an RSS reader
6) You should see an RSS feed of your list with the title
and author of each item as a hyperlink to the record details
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
On the detail page (in the opac), if the biblio comes from the Sudoc,
you must have a link (on the right of the author link) which open a popup with
informations about this author (publications by role).
To test:
1/ Switch on the Idref system preference
2/ Simulate a SUDOC record:
Fill a 7..$3 field with a ppn (032581270 for example).
Fill the 009 field with an integer
3/ Go to the opac detail page of this notice.
You should see the IDREF link.
If you click on it, a popup displays a loading icon and after a few
seconds (depending of the productivity of the authority :)), a list of
roles. For each role, a table displays all his corresponding publications.
4/ On the right, you have 2 links: 1 for a koha search for this result
and 1 for a SUDOC link
Signed-off-by: valerie bertrand <valerie.bertrand@univ-lyon3.fr>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Rephrased error messages a little and changed the link to
look like it does on other pages, for example when looking
at an order created from a suggestion.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
http://bugs.koha-community.org/show_bug.cgi?id=10752
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Same as previous patches for the OPAC.
Test plan is the same.
Tested with all patches applied. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Followed test plan from patch 1/2, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The digest term seems to be ambiguous for some people.
This patch adds a tooltip to explain what it is (feel free to provide
a better wording).
Test plan:
Go at the OPAC and click on the "Your messaging tab", you should see an
icon close to "Digest only" to explain what is a digest.
Same at the intranet on editing/showing patron info
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Introduced by bug 13601, and same fix used in bug 10423 and bug 12847:
the date_due retrieved from the DB is modified.
There are some problems:
1/ There is confusion between the iso and sql formats in the codebase.
2/ Since bug 13601, dt_from_string does not manage the iso format (there
are occurrences of 'iso' but it assumes that both formats are
identical).
To solve the issue, 2 solutions:
1/ Same as bug 10423 and bug 12847: try to get rid of the change done on
date_due in C4::Members::GetPendingIssues, it should be kept as the sql
value.
2/ Too many errors found and another fallback should be added to
dt_from_string (if 'iso' is passed, try sql then iso).
Test plan:
Go on the checkout list at the OPAC and confirm that the due dates are
correctly formatted.
Signed-off-by: Nicolas Legrand <nicolas.legrand@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
All prog related patches were obsoleted from this bug.
Bug 11349 changed the code to have the proper template name
used (sco/printslip.tt instead of sco/printsplit.tmpl).
Bug 12062 moved the hard coded string logic into the template,
and passed the borrower number.
This only leaves the patch to remove the unused receipt.tt file.
TEST PLAN
---------
1) Confirm the file isn't used.
$ git grep "sco/receipt" | grep -v "\.po:"
-- this should list nothing, because there are still po
files referencing it, but they aren't needed either.
2) ls ./koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/receipt.tt
-- there should be a file
3) apply patch
4) repeat step 2
-- the file should be removed
Followed test plan, file does no longer exist.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
git grep receipt.tt says we are safe, trusting the QA people
Having placed holds on Serial Items with an enumchron, and browsing the
opac-user.pl's "Holds"-tab, the user cannot see which numbers of
magazines/serials he has on hold.
This patch appends the koha.items.enumchron after the title component in the
opac-user.pl's Holds-view.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
If you click a link from the Tag Cloud, the results page offers the
usual select menu to resort your results. However, doing so resubmits
the search as a standard keyword search.
Test plan:
1/ Click on a tag
2/ Confirm that the resort dropdown list does not appear.
Dropdown list disappears with tags as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The description of the BakerTaylorBookstoreURL syspref says
"Baker and Taylor "My Library Bookstore" links should be accessed at
https:// isbn (this should be filled in with something like
ocls.mylibrarybookstore.com/MLB/actions/searchHandler.do?nextPage=bookDetails&parentNum=10923&key=).
Leave it blank to disable these links."
Leaving this syspref blank does not disable the links. Instead, they are
populated without the bookstore URL: the cover image for ISBN 1575725738
will cause koha to make a request to http://1575725738, which will, of
course, time out.
Leaving BakerTaylorBookstoreURL blank should disable any URL that
depends on this syspref, as stated in the syspref description.
Test Plan:
1) Apply this patch
2) Enable Baker & Taylor cover images, but *not* BakerTaylorBookstoreURL
3) Perform an OPAC search where you have B&T cover images in the results
4) Note the image links now direct you to the record details
Signed-off-by: Sheila Kearns <sheila.kearns@state.vt.us>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Only affects Baker & Taylor related parts of the code.
Read the code carefully, but couldn't test in the OPAC.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This proposed followup adds a 'Coce' syspref so it is consistent with
the rest of the enhanced content providers sysprefs (also, there's no
point making the user delete its configuration if disabling his Coce
integration for testing purposes, for example).
It also changes the CoceProviders syspref so it is a 'multiple' type
syspref. It puts some sensible descriptions to the options too.
Feel free to discuss this followup, it is just an idea!
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
- OK for the 'Coce' syspref: it's sensible to distinct configuration
from enabling/disbaling the service.
- OK also for the multichoices systempreference. If a new service
popup, it won't be difficult to amend the .pref file.
Add to Koha support for displaying Book cover requested to Coce, a
remote image URL cache:
https://github.com/fredericd/coce
With this enhancement, cover images are not fetched directly from
Amazon, Google, and so on. Their URL are requested via a web service to
Coce which manages a cache of URLs.
Three cover image providers are now available: Google Books (gb), Amazon
(aws), and Open Library (ol). Two system preferences enable this service:
- CoceHost - URL of Coce server
- CoceProviders - Ordered list of requested providers. For example
gb,aws,ol, will return the first available URL from those providers.
Several advantages to this architecture:
- If a book cover is not available from a provider, but is available
from another one, Koha will be able to display a book cover, which
isn't the case now
- Since URLs are cached, it isn't necessary for each book cover to
request, again and again, the provider, and several of them if
necessary.
- Amazon book covers are retrieved with Amazon Product Advertising
API, which means that more covers are retrieved (ISBN13).
Test plan:
- Apply this patch, and test with 'Bootstrap' themes
- You can verify that nothing has changed on OPAC result and detail
page, since new syspref haven't been filled
- Install Code: https://github.com/fredericd/coce
Or ask me directly for the URL of a Coce server
- In sysprefs, tab Enhanced content, modify:
CoceHost -- enter the URL of your Coce server
CoceProviders -- fill with: gb,aws,ol
- Do a search. On result page, and detail page, you will see cover
images originating from the 3 providers: fly over the image to see its
URL. Try to compare with a Koha with just GoogleJacket or Amazon cover
to confirm that you have more images. Verify that it's quick, and even
quicker for cached images URLs.
- Check that Browse Shelf functionnality works properly.
- The ID sent to Coce is EAN or ISBN. Try with various type of biblios. DVD
have often EAN, but no ISBN.
- You can try with those sysprefs:
CoceProviders: aws,gb
CoceHost: http://coce.tamil.fr:8080
and this EAN (or ISBN): 3333297517744
=> OPACAmazonCoverImages enabled doesn't display a cover because, it's a DVD
=> Coce find and display the DVD cover.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Amended patch: replaced 1 tab with spaces in C4/Shelfbrowser.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The email field for sharing a list with another patron is
a bit short.
To test:
- Make sure OpacAllowSharingPrivateLists is activated
- Create a list in OPAC
- Use the "Share list" link to share with another user
- Check the length of the email field and if you like it
better with this patch applied
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
On the OPAC authentification page, the acronym tag is used, but
deprecated.
It should be replaced with abbr:
http://www.w3.org/wiki/HTML/Elements/acronym
Test plan:
Enable the CAS authentification and verify the tags have correctly been
replaced.
Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Befor the patch, "grep -r "<acronym" koha-tmpl/*/*/en/*" shows 4 occurences of
<acronym>, 3 related to CAS. After the patch, the same grep shows 1 remaining
<acronym>, in acqui/parcels.tt. I sign off this patch and will provide a
followup for the last occurrence.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch adds the option to download records from the cart, and
lists in the ISBD format from the OPAC.
To test (cart):
- Apply the patch
- Add several records to your OPAC cart.
- Go to your cart, and choose 'Download'
=> SUCCESS: There's an ISBD option
- Dowload and open the exported records
=> SUCCESS: The file contains the ISBD format for the records on the cart
To test (lists):
- Add several records to a list (i did it from the cart ;-))
- Open the list
- Choose 'Download list'
=> SUCCESS: There's an ISBD option
- Download and open the exported records
=> SUCCESS: The file contains the ISBD format for the records on the list.
- Sign off :-D
Sponsored-by: Orex Digital
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
At the OPAC, if the user adds tags pressing 'Enter', the page is
reloaded and the tags are not added.
To prevent that, this patch suggests to block the "press enter" event on
the inputs.
Test plan:
0/ Confirm the bad behavior, without this patch.
1/ Apply this patch and confirm nothing happen on pressing enter when
the focus is on the add tag input (At the opac, on the result view).
Patch works as expected.
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
All but two of the table headers in the item holdings table in the opac have identifiers. The remaining two should be added so they can be modified easily with CSS.
Test Plan:
1) Apply this patch
2) View the holdings table for a record
3) Note the new id field for the item holds column
4) Note the new id field for the hold prioirty column ( if enabled )
Followed test plan. Patch behaves as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
C4::Reserves:
* Added OnShelfHoldsAllowed() to check issuingrules
* Added OPACItemHoldsAllowed() to check issuingrules
* IsAvailableForItemLevelRequest() changed interface, now takes
$item_record,$borrower_record; calls OnShelfHoldsAllowed()
opac/opac-reserve.pl and opac/opac-search.pl:
* rewrote hold allowed rule to use OPACItemHoldsAllowed()
* also use OnShelfHoldsAllowed() through
* IsAvailableForItemLevelRequest()
templates:
* Removed AllowOnShelfHolds and OPACItemHolds global flags, they now
only have meaning per item type
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
I have tested this patch left, right and upside down for the last
several months. All tests have passed.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch adds RSS icon to OPAC page 'Recent comments'
To test:
1)
Enable display of 'Recent comments' in OPAC (Syspref OpacShowRecentComments)
2)
In OPAC, go to Home > Recent comments
3)
Verify that there is a link in the head part of the HTML source code (<link rel="alternate" type="application/rss+xml"....), but no RSS icon on the pate itself (like in search results).
4)
Apply patch
Result: Icon with link to RSS feed is displayed next to title.
Bug 13826 - Follow-Up: Close </h3>
There was a slash missing.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by for the Follow Up: Marc Veron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch introduces a new class "noprint" in koha-tmpl/opac-tmpl/bootstrap/css/print.css
With this class, unwanted elements can be hidden when printing.
To test:
In OPAC, do a search with many results (> 1 Page)
Print page or do a print preview
See that footer elements are not displayed correctly (as of screenshot in comment #1) and that on top of page 2 the language selector overlays the list
Apply patch
Repeat steps above.
Verify that printed page looks much nicer now by hiding unwanted elements (including e.g. RSS icon, toolbar etc.)
This mechanism can be used on other pages as well.
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This follow-up for Bug 11430 makes some changes to the template to make
it more useful when JavaScript is turned off:
- Hide the toolbar containing select all/clear all links if JS is off
- Add buttons to submit the forms if the delete link in the toolbar is
unavailable (or if the user has scrolled all the way to the bottom of
a long list)
Also changed: Corrected indentation from 2-space to 4-space, added
comments to the markup to help document page structure; changed the
class of the delete link to match other similar interfaces.
Note: This patch contains whitespace changes. Please diff
accordingly.
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: sonia BOUIS <sonia.bouis@univ-lyon3.fr>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
While testing bug 10937, there were noisy warnings, which
distracted from testing the functionality of it.
Here is a snippet of the after the patch warnings:
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 384.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 161.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 161.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 177.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 177.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 202.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 202.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 240.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 240.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 256.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 256.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 356.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 356.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 369.
Argument "" isn't numeric in numeric gt (>) at /home/mtompset/kohaclone/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt line 369.
Tweaking the [% IF %] statements eliminated the warnings.
TEST PLAN
---------
1) Apply patch
2) Run koha qa test tools.
-- there will be noisy warnings in the before processing, but
there will be no such messages in the after processing.
3) git diff origin/master
-- there should be no visible typos.
Signed-off-by: Magnus Enger <magnus@enger.priv.no>
- Applied the patch from bug 10937
- Ran "koha-qa.pl -c 1" and observed the warnings described in the
commit message
- Applied the patch from this bug
- Ran "koha-qa.pl -c 1" again and saw no warnings
- Ran "koha-qa.pl -c 2" and saw no warnings
I have not tested the functionality of 10937 with this patch, just verified
that the changes look sensible.
This patch feels more like a followup for 10937, than a separate patch,
especially since 10937 is just "signed off" at this time. But as long as it
works...
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch introduces the use of the idnew-value from the opac_news table as a base for a unique anchor on each newsitem in Opac.
The anchor can be used for linking to specific newsitems and also for improving bug 7843 (RSS stream for news) with a unique link to each item in the RSS stream.
Test plan:
* Make shure you have a few news in the opac. Best is if it's enough to hide a few beneath the bottom of the window.
* Install the patch.
* Verify that you can access newitems with links like mykoha/cgi-bin/koha/opac-main.pl#newsitem4
* Experiment with removing newsitems and verify that that the newsitem-id stay unique to each newsitem.
Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Works as advertised. Nice enhancement!
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
It appears that an empty string is sneaking into the list of words
to highlight and that is causing the browser to freak out.
Test Plan:
1) Enable NoveList
2) Enable OpacHighlightedItems
3) Search a title with a series (i.e. The Hunger Games)
4) Click into the record
5) Click on the series to search it
6) Click on a title in the search results
7) If Firefox doesn't crash, it gives the unresponsive script message
8) Apply this patch
9) Repeat steps 3-6
10) Browser doesn't freak our
Signed-off-by: Jason Robb <jrobb@sekls.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
could not confirm the problem, but small change and
highlighting terms on result list and couldn't find any
regressions in highlighting.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Labeling a phone number field "mobile phone" eliminates the usefulness
of having the labels "primary" and "secondary." Generic labels let the
user populate the fields according to their importance rather than their
type.
To test I recommend editing a patron record so that the values in the
patron record contain a label matching the table column:
borrowers.phone : 555-555-1234 (primary - phone)
borrowers.phonepro : 555-555-5678 (secondary - phonepro)
borrowers.mobile : 555-555-9012 (other - mobile)
View this patron's information in the various affected templates and
verify that the labels correctly match the data:
- OPAC "your personal details" (opac-memberentry.pl)
- Submit changes to primary, secondary, and other phone via the OPAC.
In the staff client, view the confirmation for those changes.
- Patron details in the staff client (moremember.pl)
- Patron entry/edit in the staff client (memberentrygen.pl)
- Patron duplicate confirmation in the staff client
(you can navigate directly to
/members/moremember.pl?borrowernumber=XXXX&print=brief)
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
No matter what the selection of OPACShowHoldQueueDetails is, if it is
enabled it displays a line "Holds and priority:" even if you've opted to
hide one of those!
Test Plan:
1) Apply this patch
2) Test each setting of OPACShowHoldQueueDetails
3) Ensure each setting displays the correct fields ( or lack thereof )
Signed-off-by: Christopher Brannon <cbrannon@debian.localdomain>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug partially corrected by Bug 11357.
The size column in biblioitems is a bit problematic when used in TT, because instead of the size value from the biblio column it will give you the size of the variable or current loop.
It's currently used in the templates like opac-topissues.tt :
[% IF results_loo.size %][% results_loo.size %][% END %]
This patch corrects by using item() TT method.
See http://stackoverflow.com/questions/2311303/how-can-i-handle-hash-keys-containing-illegal-identifier-characters-in-template.
Test plan :
- Be sure there is a mapping between a MARC field and biblioitems.size
- Create a record A with biblioitems.size defined : like "10x12"
- Create a record B with no value in biblioitems.size
- Check each modified page :
=> Without this patch : you see a number (loop size) for both records
=> With this patch : you only see the correct value for A and nothing for B
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Some libraries wish to display the patron's cardnumber on the
confirmation screen for patron self registration, rather than make the
patron locate it his or her cardnumber by logging in and browsing to the
personal details page. We should also add ids to these fields for easy
css styling/hiding.
Test Plan:
1) Apply this patch
2) Ensure that autoMemberNum is enabled
3) Self-register a new patron
4) Note confirmation screen now displays the patron cardnumber
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
To test:
- Use an installation a reasonable amount of authorities, so that you can
have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'
URL:
.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
To test
1/ Make sure you have some items in your database, that have values in items.issue
If nessecary do something like
UPDATE items SET issues = 10 WHERE itemnumber=somenumber
2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E
3/ Notice you will get a prompt
4/ Apply patch
5/ Test again
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
A specially crafted url causes XSS in Koha
To test:
cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E
cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves
These should cause a popup without the patch. With the patch, no popup.
You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't
have permission to view them.
Signed-off-by: Chris <chris@bigballofwax.co.nz>
Fixes the two listed problems
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed patch fixes the problem.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
