Commit graph

20116 commits

Author SHA1 Message Date
6f0d4153df Bug 11307: Fix potential XSS attack in public catalog RSS feed
To test:
1/ Craft a url like
/cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2
2/ look at the source, notice
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
3/ apply the patch, and reload url
4/ source now contains
 <opensearch:itemsPerPage>50&quot;'&lt;h1&gt;test&lt;/h1&gt;</opensearch:itemsPerPage>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-26 18:16:27 +00:00
Galen Charlton
17b78abc7f Bug 11040: DBRev 3.15.00.001
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-24 18:47:39 +00:00
Peggy Thrasher
2131c78618 Bug 11040: Add CircAutoPrintQuickSlip option to print regular slip
This patch adds a third option to the CircAutoPrintQuickSlip system
preference.  The three options are now:

* print quick slip
* print regular slip
* clear the screen

Test plan:
1.  Set the System Preference for CircAutoPrintQuickSlip to "clear the
    screen".
    Enter a borrower barcode for checkout
    Press Enter
    The screen should be cleared.

2.  Set the System Preference for CircCircAutoPrintQuickSlip to "open a
    quick slip window"
    Enter a borrower barcode for checkout
    Press Enter
    A Quick slip is printed.

3.  Apply the patch
    Update the database using UpdateDatabase.pl

4.  Set the System Preference for CircAutoPrintQuickSlip to "clear the
    screen".
    Enter a borrower barcode for checkout
    Press Enter
    The screen should be cleared.

5.  Set the System Preference for CircCircAutoPrintQuickSlip to "open a
    quick slip window"
    Enter a borrower barcode for checkout
    Press Enter
    A Quick slip is printed.

6.  Set the System Preference for CircCircAutoPrintQuickSlip to "open a
    slip window"
    Enter a borrower barcode for checkout
    Press Enter
    A Slip is printed.

7.  Reload the database using sysprefs.sql
    Set the System Preference for CircAutoPrintQuickSlip to "clear the
    screen".
    Enter a borrower barcode for checkout
    Press Enter
    The screen should be cleared.

8.  Set the System Preference for CircCircAutoPrintQuickSlip to "open a
    quick slip window"
    Enter a borrower barcode for checkout
    Press Enter
    A Quick slip is printed.

9.  Set the System Preference for CircCircAutoPrintQuickSlip to "open a
    slip window"
    Enter a borrower barcode for checkout
    Press Enter
    A Slip is printed.

10.  Verify that the Checkout Help includes information about printing Slips.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-24 18:37:42 +00:00
Galen Charlton
b25de3e7cf Bug 6435: (follow-up) make -daemon really imply -a and -b
This patch follows up on the previous patch by moving the
check for whether authority and/or biblio indexing have been
specified so that -daemon has a chance to set those modes.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-24 18:20:56 +00:00
Doug Kingston
00240d6970 Bug 6435: (follow-up) rebuild_zebra -daemon option now smarter
Based on feedback, make daemon mode imply -z -a -b and abort
on startup if flags incompatible with an incremental update daemon
are used.  Update documentation to match.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-24 18:15:23 +00:00
Doug Kingston
1b0992e8d5 Bug 6435: Add daemon mode to rebuild_zebra.pl
This change adds code to check the zebraqueue table with a cheap SQL query
and a daemon loop that checks for new entries and processes them incrementally
before sleeping for a controllable number of seconds.  The default is 5 seconds
which provides a near realtime search index update.  This is desirable particularly
for libraries that are doing active catalogue updating.  The query is adjusted
based on whether -a, -b, or -a -b are specified.

Help text updated.  Tested against a live 3.12 system.

Note that this fix will benefit from the fix to lack of locking (bug 11078)

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-24 18:12:21 +00:00
Sophie Meynieux
7021d36d0e Bug 11125: Correct display for patron messaging preferences on OPAC
To test :
 1) Remove 'sms' from message_transport_types table
 2) Go on OPAC "My messaging" tab => table columns are out of alignment with table heading
 3) Apply patch => table is correctly displaid

Signed-off-by: Koha team AMU <koha.aixmarseille@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-23 20:54:07 +00:00
Zeno Tajoli
69c42067ce Bug 11222: fix crash that can occur in search for items to add to label batch
This patch fixes a regression on label-item-search.pl introduced by
the patch for bug 9239 where searching for items to add to a label
batch fails with an error if QueryParser is not enabled and you use
the "Added on or before date" search option.

Test plan:

0) Set "UseQueryParser" to "do not try"
1) Start with an installation with bibliografic data and items
   information.
2) Check that in items there are values inside Accession Date

Without the patch:
a) Go in Home› Tools› Labels  and click on 'New batch'
b) Click on 'Add Item(s)'
c) Try to select items with option "Added on or before date"
d) You will receive an error

With the patch:
Try steps a),b), and c)
Now you don't receive an error and you can select items

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Added a description of the problem and copied the test plan from the bug
report, with the addition of the information that QueryParser must be
off to confirm and test.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-23 19:54:38 +00:00
5dcf1857da Bug 7491: improve description of the item-level_itypes syspref
Adding some text to the pref description referring to OPAC display.

Test plan:
Look at the new description in Cataloging preferences.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-23 19:45:26 +00:00
Fridolyn SOMERS
d1bec84142 Bug 11146: Show a go back link on no permission page
When a user does not have permissions for a page or module, the
authentication page is displayed with message

  "Error: You do not have permission to access this page.".

Most librarians uses the "previous page" button of their browser to
come back on the page they were before trying to get to the
non-permitted page.

This patch adds a button to help coming back to previous page.
It also changes the "Click to log out" link as a button.

Test plan :
- Define a user with staff permissions but no permission on tools module
- Login with this user
=> You get to intranet home page
- Edit URL to go to tools module : cgi-bin/koha/tools/tools-home.pl
=> You get a page with a red error message and 2 buttons "Previous page"
   and "Log out"
- Click on "Previous page"
=> Go get to intranet home page
- Edit URL to go to tools module : cgi-bin/koha/tools/tools-home.pl
- Click on "Log out" button
=> You are logged-out and get to authentication page : cgi-bin/koha/mainpage.pl?logout.x=1

Signed-off-by: Garming Sam <garming@catalyst.net.nz>

Works as intended.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-23 19:43:37 +00:00
Jonathan Druart
572c586793 Bug 11238: contruct links to the appropriate manual version dynamically
This patch uses the version number of the Koha database to
dynamically generate links from help to the appropriate version
of the manual.

Test plan (for 3.15 branch):
- Open a help page
- Verify the manual link is correct (point to 3.14 manual)
- change the version in mysql:
update systempreferences set value="3.1600000" where variable="version";
- Verify the manual link now points to the future 3.16 manual.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described. No koha-qa errors

Tested on top of Bug 10671
On master (BD version 3.13.xxx) help links point to 3.12 manual
Changing version to 3.14/15 points to 3.14 manual
Changing version to 3.16 points to the future :)

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2013-11-23 19:30:16 +00:00
Jonathan Druart
55b13c092a Bug 11061: remove unused routine Koha::Calendar::_mock_init
Bug 9209 removes the only occurrence to Koha::Calendar::_mock_init
The routine can be removed.

Test plan:
prove t/Calendar.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
I left that routine because I planned to do a follow-up for that so the
Calendar patch series was pushed soon. Nice catch Jonathan, works as expected.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, t and xt

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-23 19:27:08 +00:00
Colin Campbell
248283fc29 Bug 10996: Allow numeric subfields to be stripped on export
Regex assumed all numeric characters were part of the tag number
This is obviously false as $9 would be a likely candidate
to be removed on export.

The code can be any printing ascii character other than space
according to LoC's website.

Also changed regexp to no longer allow a zero length tag number
which is nonsensical.

The old regex would accept shorter than 3 digit tags but these were
not stripped so I've removed that option, considering it a bug
not a feature

NB assumption that the code makes that a tag is always numeric is
incorrect but works in practice. Handling non-numeric tags is
a 'To be done'

Made code dependent on the regex succeeding. Picking up results
from a previous regex on failure can lead to weird hard to
identify bugs

In the course of testing Paola Rossi <paola.rossi@cineca.it>
spotted that the delete operation was flawed, only removing
the first occurence of the specified tag/tag subfield. Reworked
the delete loop to operate on all occurences

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 17:53:02 +00:00
Fridolyn SOMERS
2a4fa0a803 Bug 11245: fix typo in modborrowers.tt javascript string
In modborrowers.tt, Bug 8986 made the javascript strings translatable:
  _("This attribute will be only applied to the patron\'s category")

In this case, the backslash is useless.

Test plan :
- Create a borrower attribute with a "Category" defined
- Go to Tools / Batch patrons modification
- Enter a cardnumber and submit
- Next to "Attribute", select the borrower attribute you created
=> You see a grey text at the right : This attribute will be only
   applied to the patron's category "XXX"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 17:38:23 +00:00
Fridolyn SOMERS
7ca790997e Bug 10809: use branches template plugin in serials search
In serials-search.pl, branch name was computed using branch code and
then passed to template.

This patch uses the new template plugin now for this:
    Koha::Template::Plugin::Branches.

Test plan :
- Go to serials search
- Perform a search that returns at least an open an a closed subscription having a branch defined
=> The branch name is displayed in "Library" column

Signed-off-by: Pierre Angot <tredok.pierre@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 15:20:05 +00:00
Jonathan Druart
b15f25d8c6 Bug 11207: fix issue where SMS number couldn't be cleared when editing patron
Test plan:
1/ edit a patron
2/ set a sms alert number
3/ save
4/ edit the patron
5/ set the sms alert number to a blank value
6/ save
7/ the sms number is now an empty string

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.

Test plan used:
- Activate the SMS functionality by giving a 'fake'
  SMSSendDriver of TEST
- Activate EnhancedMessagingPreferences
- Create a new patron, set Other phone to 'test'
- Notice that Other phone was copied to sms number
- Edit messaging preference section using the edit link
  below on the details tab and delete SMS number
- Verify it's not possible to unset the SMS number
- Apply patch
- Repeat deleting - this time it works

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 15:15:44 +00:00
Galen Charlton
c7ca5ad5af DBRev 3.15.00.000: on to what comes after Pi
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 15:09:36 +00:00
Galen Charlton
beacc2625a Merge branch '3.14.x' 2013-11-21 02:05:27 +00:00
Galen Charlton
3fe0e78451 Update history.txt for Koha 3.14.0 release
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 01:58:05 +00:00
Galen Charlton
07b5f01c07 release notes for Koha 3.14.0
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 01:40:18 +00:00
Galen Charlton
44eba3f046 DBRev 3.14.00.000: Koha 3.14.0
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-21 00:53:22 +00:00
Galen Charlton
e71593035d Merge branch '3.14.x' 2013-11-20 18:34:51 +00:00
Bernardo Gonzalez Kriegel
83a5756645 Translation updates for 3.14.0
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-20 18:33:32 +00:00
Galen Charlton
69ec188bce Merge branch 'new/bug11269' into 3.14.x 2013-11-19 16:28:57 +00:00
Galen Charlton
477b9716f1 Merge branch 'new/bug11269' 2013-11-19 16:27:29 +00:00
2f6f6d2b0c Bug 11269: fix incorrect use of MARC::Field->subfield()
MARC::Record 2.0.6+ enables the warnings pragma, and as a
consequence, started logging cases where a routine in
C4::Search was calling MARC::Field->subfield() with an undef
subfield label.  This patch removes the log noise.

To test:
- Run prove -v t/db_dependent/Search.t
- There will be warnings about
  "Use of uninitialized value $code_wanted in string" in MARC::Field.
- Apply the patch.
- Those warnings are gone.

Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tests now pass

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-19 16:22:46 +00:00
Galen Charlton
fd6786331f Merge branch 'new/bug8854' into 3.14.x 2013-11-19 16:12:50 +00:00
Galen Charlton
49916a669b Merge branch 'new/bug8854' 2013-11-19 16:12:42 +00:00
Galen Charlton
f1aa43b75f bug 8854: fix some invoice search filters
Fix the supplier, shipment date, and library filters
on the invoice search.  An invoice's library is
(in parallel with order search) defined as the library
of the staff member that approved the basket.  Before this
patch, the code was referring to an aqorders.branchcode
column that doesn't exist.

This patch also improves the author, title, ISBN/EAN/ISSN,
publisher, and publication year filters to no longer require
exact matches; substring matches now suffice.

Finally, this patch considers biblio.copyrightdate in addition
to biblioitems.publicationyear for publication date searches, as
the MARC21 frameworks use the former column but not the latter.

This patch also fixes the current test cases for invoices
so that they pass and adds regression tests.

Test plan:

[1] Create two invoices for different vendors.
[2] Do an invoice search and filter on shipment
    date.  Verify that the expected invoice(s)
    are returned.
[3] Do an invoice search and filter on branch
    (of the staff member that approved the basket).
    Verify that the expected invoice(s) are returned.
[4] Do an invoice search and filter on supplier.
    Verify that the expected invoice(s) are returned.
[5] Do invoice searches on author, title, ISBN/EAN/ISSN,
    publisher, and publication year and verify that the
    results are as expected.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

Patch passes all tests, test plan and QA script.

(Adding from Katrin notes early) I agree with
Possible improvements:
- Document the behaviour of the library search as there are
  lots of branches all over acquisitions with different meaning.
- Add the shipment date to the results list table
- Change label ISBN/EAN/ISSN to not include EAN for MARC21
  installations

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-19 16:12:31 +00:00
Galen Charlton
03690cce7d Merge branch 'new/bug11221' into 3.14.x 2013-11-19 15:48:39 +00:00
Galen Charlton
942226d333 Merge branch 'new/bug11221' 2013-11-19 15:45:22 +00:00
Galen Charlton
15812e80c8 Bug 11221: (follow-up) test for NULL rather than empty string
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-19 15:35:25 +00:00
11fbcb30de Bug 11221: (follow-up) add unit test to test handling empty strings as dates
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests pass.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-19 15:31:06 +00:00
Jonathan Druart
d63b4a766c Bug 11221: ensure that SQLHelper uses NULL rather than 0000-00-00 as default date value
The default values for date fields is undef, so if a date field contains
an empty string, we should insert NULL in the DB, not 0000-00-00.
The format_date_in_iso routine should be only called if a date is
defined, is not equal to an empty string and does not match the iso
regex.

This patch fixes a bug where editing or creating a patron record
without setting the birth date results in 0000-00-00 rather than null
being set as the dateofbirth value.

Partial test plan:
1. Create a new patron. Leave dateofbirth empty.
2. Save the record.
3. Open the record for editing.
4. Save the record without making changes.
5. Koha gives no error.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Now when no date is given NULL is saved to the database.

Tested:
- Adding a patron without date of birth
- Editing the patron, entering a date of birth
- Editing the patron, deleting date of birth
All worked as expected.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-19 15:29:08 +00:00
Galen Charlton
527debf692 Merge branch 'new/bug11163' into 3.14.x 2013-11-15 15:35:22 +00:00
Galen Charlton
73d4ac9bab Merge branch 'new/bug11163' 2013-11-15 15:35:14 +00:00
39a656c6ba Bug 11163: display correct itemtype usage count when deleting an itemtype
Wrong usage of UNION instead of UNION ALL prevented the count to match
the expected value.

Steps to reproduce:
- Create an itemtype.
- Create some biblios setting the created itemtype at biblio level.
- Create some items setting the created itemtype on them.
- Try to delete the itemtype in Home > Administration > Item types, the
count is 1 and doesn't match the expected result.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 15:34:33 +00:00
Galen Charlton
c71cfd2281 Merge branch 'new/bug11185' into 3.14.x 2013-11-15 15:32:05 +00:00
Galen Charlton
efa202209f Merge branch 'new/bug11185' 2013-11-15 15:31:58 +00:00
0d21dc6c3b Bug 11185: fix bug preventing check-url-quick.pl from working
Revert commit f88f11b4f8

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Before this patch, check-url-quick.pl fails with an error. After the
patch it runs correctly.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 15:30:20 +00:00
Galen Charlton
c4102a382d Merge branch 'new/bug10671' into 3.14.x 2013-11-15 00:30:11 +00:00
Galen Charlton
1c0a2f6b40 Merge branch 'new/bug10671' 2013-11-15 00:30:02 +00:00
Nicole C. Engard
28717402b2 Bug 10671: Update Circ Help Files
This patch updates the existing help files and
adds the missing offline circ help file.

To test:

* Visit all circ pages and check the manual links
* Visit the new offline circulation page and confirm text
and link are there (link will work after 10/25)

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:29:40 +00:00
Galen Charlton
2bc24502eb Bug 9261: (follow-up) improving implementation of page title and breadcrumbs
This patch improves how the page title and breadcrumbs for the patron
purchase suggestions page are generated by:

* removing references to a template variable that is not set by the
  script
* using the patron-title.inc template include consistently

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:25:14 +00:00
Jonathan Druart
d565fb02e9 Bug 9261: (follow-up) make title required when adding a new suggestion
I don't know if it was a bug but at the OPAC, title is a required field
and not on the staff interface.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:24:58 +00:00
Jonathan Druart
967a48e5af Bug 9261: (follow-up) QA improvements and GPL version change
This patch:

- changes the GPL version from 2 to 3.
- uses the datatables.inc file
- removes the single pixel before and after the DT (modifying the sDom
  value).

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:24:24 +00:00
87aabcd249 Bug 9261: (follow-up) remove reference to deprecated DHTMLcalendar
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:23:59 +00:00
68fb73d9b3 Bug 9261: (follow-up) remove references to deprecated YUI widget
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:23:30 +00:00
c1dbee2ea4 Bug 9261: (follow-up) fix various issues identified during QA
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:22:59 +00:00
8505942344 Bug 9261: (follow-up) fix various issues identified during QA
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-11-15 00:22:11 +00:00