Modify JS script to all templates for z3950_search.tt and reduce the
redundant code
This patch propose:
-z3950_auth_search.tt has various onclick events used in links.
Also fix: acqui/z3950_search.tt and cataloguing/z3950_search.tt
-Trigger onclick events via JQuery .on()
-Make a separate .js and .inc file
-Reduce the number of line and redundant code
-Also add Font Awesome Icons to "Select/Clear all" and "Clear search
form" links
To test:
1-Apply bug 16600 on top
2-Apply patch
3-Go to Authorities > click New from Z39.50
4-Fill some fields and click in "Clear search form" link
5-Search under "Dalton" or another author that launch too many headings
6-Clic in some heading and notice the dialog open, test: "Preview MARC",
ISBD (when showed), "Import" and close the dialog "X". Use the
"Import" from table too.
7-Use the "next/previous page" button, change "Go to page" to number in and
out of the range presented, also test whit a letter, etc.
Go to Cataloging > New from Z39.50/SRU
Repeat steps 3 to 6. But this time with bib records.
Go to Adquisition > Open or Create a basket and choose to "Add to basket"
button. A modal appear, chose the option "Order from external source"
Repeat steps 3 to 6. But this thime with bib records.
NOTE: The icon trash for "Clear search form" has been selected according
with module "Advanced search" there is an icon trash with link "Clear
fields" that has the same fuctionality.
For some reason the image loading-small.gif does not charge all times
when the code is get out of the template. (Fixed with this new patch)
DataTable it is specific for each template
Sponsored-by: Universidad de El Salvador
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch replaces Greybox modals on the acquisitions receipt summary
page with Bootstrap modals.
To test, apply the patch and go to Acquisitions -> Invoices -> View an
invoice -> Go to receipt page.
- In the list of pending orders, test the "MARC" and "Card" links for
various titles. Each should trigger a Bootstrap modal with the correct
content.
- Repeat the same tests in the list of already received orders.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch makes changes to Font Awesome icons in order to make icon
choice consistent for common actions.
<i class="fa fa-trash"></i> where something is deleted, removed, or
emptied.
<i class="fa fa-remove"></i> where an operation is cancelled (also where
selections are cancelled, as in checkboxes).
<i class="fa fa-times-circle"></i> for "close," as in baskets and
windows.
To test, apply the patch and view the following pages to confirm that
the correct icon is used:
- Acquisitions -> Vendor -> Vendor delete button.
- Acquisitions -> Vendor -> Edit -> Delete contact button.
- Acquisitions -> Invoices -> Delete menu item.
- Cataloging -> Edit record -> Authority search pop-up (triggered from
the tag editor for a tag linked to an authority) -> Clear field button
- Authorities -> Authority detail -> Delete button.
- Tools -> Quotes editor -> Quotes delete button.
- Reports -> View saved report -> Delete button.
- Reports -> Saved reports -> Delete menu item.
- Serials -> Subscription details -> Subscription close button.
- Administration -> Budgets -> Delete menu item.
- Administration -> Item search fields -> Delete button.
- Administration -> Z39.50/SRU servers -> Delete menu item.
- Catalog -> Advanced search -> Clear fields link.
- Cataloging -> Advanced editor -> Macros -> Delete macro button.
- Circulation -> Checkout -> Check out an item which is on hold for
another patron. "Cancel checkout and place hold" button now uses the
icon used elsewhere for holds.
- Course reserves -> Course -> Delete course button.
- Patrons -> Patron lists -> Add patrons -> Remove selected button.
- Acquisitions -> Suggestions -> Suggestion details -> Delete button.
- Lists -> List contents -> Remove selected button.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Acqui -> find a vendor
2) On Vendor details page (supplier.pl) confirm that Contracts table now
has one column called Actions
3) Confirm that Edit and Delete show as buttons
4) Confirm that buttons don't wrap on a narrower browser
5) Click Contracts tab
6) Confirm Actions column, Edit and Delete buttons, and button's don't
wrap
Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
- Rephrase removing 'Shopping'
- Fix link to vendor
To test:
- Create a subscription for vendor X
- Create a baskest for vendor X
- Choose: order from subscription
- Check breadcrumbs:
- Link to vendor works
- 'Shopping' is gone, Basket remains
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Some templates use Edifact and edifact. As EDIFACT
is an abbreviation, we should spell it like one.
To test:
- Check templates for occurrences of EDIFACT
- acquisitions navigation menu
- basket page
- basketgroup page
- EDIFACT messages page
- Verify changes are correct
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Changes are correct
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
If you are trying to add a user as a manager of a basket in
acquisitions, a JavaScript error will be triggered if that user has a
single quote in their name (e.g. "O'Neil"). This patch corrects the
issue by removing the "onclick" attribute and using the JS change made
in Bug 16386.
Also changed by this patch: Increased the size of the patron search
popup and made a correction to some invalid HTML.
To test you should have a patron whose name contains a single quote who
is also a user with permission to manage acquisitions.
- Apply the patch and go to Acquisitions.
- Locate an open basket and view the details for that basket.
- In the "Managed by" section, click the "Add user" button to trigger
the patron search popup.
- Search for the patron described above and click the "Add" button.
- In the parent window, the patron you chose should have been added to
the "Managed by" section.
Tested on top of Bug 16383, behaves as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
When you edit the basket from the basket summary page,
saving the change brings you back to the basket summary
page, but cancelling brings you to the baskets page of
the vendor.
To test:
- Add a basket in acq
- Test cancel link returns to baskets page of vendor
- Add a basket and save
- Edit this basket
- Test cancel link now returns to basket summary page
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
In order to bring the acquisitions basket template into compliance with
coding guideline JS9, this patch changes with way some JavaScript events
are handled by moving JS handling out of the HTML markup.
Also changed: Replaced the use of [% script_name %] (which is
undefined), with the actual script path.
To test, apply the patch and locate an open basket in Acquisitions which
has more than one order in it.
- Test the "Managed by: Add user" button and verify that it triggers a
popup where you can search for patrons.
- Select two or more patrons to be managers for the basket.
- Close the search windows and confirm that your choices appear on the
basket page.
- Click "Delete user" next to one of the patrons. The patron should be
removed.
- Click "Save changes" and verify that your choices are correctly
saved.
- Click "Delete user" next to one of the remaining patrons. The patron
should be removed.
- Click "Save changes" and verify that the patron stays deleted.
- In the list of orders, click the "Transfer" link and confirm that the
correct pop-up window is triggered.
- Test the "Delete this basket" button in the toolbar. A modal window
should be triggered.
- In a basket with orders:
- The "Delete basket and orders" button should do what it says,
leaving associated bibliographic records intact.
- The "Delete basket, orders, and records" button should do what it
says, deleting any bibliographic records associated with orders.
- In a basket with no orders:
- The "Delete basket" button should work correctly.
- Test the "Create edifact order" button.
- Click "Send EDI order" on the resulting page.
- In the resulting dialog, "Are you sure you want to generate an
edifact order," verify that both the "Yes" and "No" options work
correctly.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
To test:
1) Go to Acqui -> do a vendor search and view an open basket
2) Confirm last column heading says cancel instead of delete
3) Confirm link to cancel order says cancel instead of delete
4) If can't delete record, confirm reasons say cancel order instead of delete
5) Click the vendor name, then Baskets tab, then Receive Shipment
6) Fill vendor invoice field and click next
7) If there are any pending orders, confirm that all instances of 'delete order' now say cancel
Sponsored-by: Catalyst IT
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch moves the JavaScript files in prog/en/js to prog/js.
JavaScript files do not need to be in the directory which is processed
by the translator.
To test, apply the patch and visit various pages in the staff client to
confirm that JavaScript files are still loading correctly.
Revised: I intended for this to be built on top of Bug 15883 as well as
Bug 16242. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883 and 16241
All seems to work, js files pulled from new dir.
No errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
According to https://jquery.com/upgrade-guide/1.9/#attr-versus-prop-
.attr() is no longer correct to access the checked state of a checkbox.
This patch do the following replacements:
.attr('checked') => .prop('checked')
.attr('checked, '') => .prop('checked', false)
.attr('checked, 'checked') => .prop('checked', true)
.attr('checked', boolValue) => .prop('checked', boolValue)
.removeAttr('checked') => .prop('checked', false)
.attr('checked') == 'checked' => .is(':checked')
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.
In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.
To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:
- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.
Revised: I intended for this to be built on top of Bug 15883. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883
Works as described, all pages on test plan
No Errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
* Add `AFTER` to DB update
* Change "Is standing order basket:" to "Orders are standing:"
* Disable item creation when adding from a staged file
* Correctly show is_standing for existing baskets
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This seems to cause fewer problems with the existing acquisitions code.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This allows creation of special baskets that include standing orders.
These orders do not have a known quantity (and may not have a known
price in advance). Upon receipt, the received items are split into a new
completed order.
Test plan:
1) Run updatedatabase.pl.
2) Run prove t/db_dependent/Acquisition/StandingOrders.t . (and the
other Acquisition tests).
3) Create a new basket, mark it as a standing order basket.
4) Add an order to this basket, and notice that the quantity field is
missing (and thus not required).
5) Receive items for this order, and notice that the original order is
unchanged. The new child order line should have the correct price
and quantity information.
(Note: the QA tools output what seems to be a spurious spelling error
for Test::More's "isnt" in StandingOrders.t.)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Sorting by the "summary" column does not produce the preferred results.
Title beginning with 'a', 'an', or 'the' are sorted using those
articles.
Test plan:
1) Place an order for 2 items with the titles "Alpha" and "The Alpha",
along with some other records with titles starting with something
between 'a' and 't', and 't' and 'z'
2) Sort the "pending orders" table, note the incorrect sorting
3) Receive all the items
4) Sort the "already received" table, note the incorrect sorting
5) Apply the patch
6) Repeat steps 1-4, note the corrected sorting
7) Check acqui/basket.pl for correct sorting
8) Check acqui/invoice.pl for correct sorting
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
To test:
1) Go to Acqui -> do a vendor search -> view a basket
2) Confirm that the Add Order to basket section at the bottom is gone.
Confirm the add to basket button in the toolbar still works as
expected
3) Confirm that when you make your browser shorter, the toolbar follows
the page down as you scroll
Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
EDIT: Added 'validated' class to form and removed 'Required' span (became unnecessary)
To test:
1) Go to Acqui -> Do a vendor search
2) Receive a shipment
3) Attempt to click 'Next' without specifying invoice number. Notice error.
4) Go back to vendor search then apply patch. Click Receive shipment
5) Notice you cannot click 'Next' until you put something in invoice number.
Sponsored-by: Catalyst IT
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch fixes problems with show/hide actions on a few pages
caused by some problematic jQuery syntax.
To test, apply the patch and go to Acquisitions.
Testing basket.tt:
- Locate a vendor which has an open basket with multiple orders.
- View the details of that basket.
- Click the 'Show all details' checkbox above the table of orders.
- Checking the box should trigger the display of additional columns in
the table.
- Unchecking the box should hide them again.
Testing invoice.tt:
- Go to Acquisitions -> Invoices and perform an invoice search.
- Click to view an invoice which includes one or more received records.
- Click the 'Show all details' checkbox above the table of titles and
confirm that it fuctions as described above.
Testing newordersubscription.tt:
- Go to Acquisitions and locate a vendor which is linked to a
subscription
- Create or add to a basket for that vendor.
- Add an order using the 'From a subscription' option.
- Perform a search for subscriptions.
- In the table of subscriptions search results, checking or
unchecking the "Show only renewed" checkbox should work correctly.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
If a basketgroup has basket attached, it should not be deletable.
This patch just removes the Delete button from the interface if it
cannot be deleted.
When editing a basketgroup, the "Delete basket group" button is no
longer displayed.
Test plan:
1/ Create a basketgroup
2/ Attach 1+ baskets to this basketgroup
3/ Confirm you are not able to delete it
4/ Remove the baskets from this basketgroup
5/ Confirm you are able to delete it
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
This patch fixes a regression introduced by bug 15084: The currency
dropdown lists are not correctly built.
The selected currencies are wrong.
Test plan:
Create a vendor, the selected currencies should be the default one
Edit the vendor, the selected currencies should be the ones defined for
this vendor
Create an order, the selected currency should be the 'List prices' of
the vendor
Edit an order, the selected currency should be the one defined for this
order
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
There are some issues with the template changes introduced by the EDI
feature in Bug 7736. This patch makes the following changes:
- Use Font Awesome icon on the Acquisitions basket page instead of a
Glyphicon.
- Use Font Awesome icon on the Acquisitions basket group page instead of
a Glyphicon.
- For consistency's sake, use the phrase "Library EANs" instead of "EDI
EANs" in menus and the Library EANs page.
- On the EDI accounts page:
- Correct the markup of the title tag.
- Improve the breadcrumbs to eliminate redundancy.
- Use Font Awesome icon instead of Glyphicon for the "New account"
button.
- Change or remove "maxlength" attribute of form fields to match table
structure.
- Move the contents of some title attributes into a visible hint.
- Use 'checked="checked"' instead of 'checked'. Koha templates use
XTHML-style attributes.
- Correct template variable in account deletion confirmation dialog.
Before this patch the vendor name was not correctly displayed.
- Show a message if there are no accounts defined rather than an empty
table.
- Remove use of "highlight" class from table rows (Bug 15927).
- Correct parameter name in link to vendor details page (should be
booksellerid instead of supplierid).
- Correct the markup of the deletion confirmation dialog (Bug 15785).
- Use Bootstrap-style buttons for "edit" and "delete," with Font
Awesome icons.
- On the Library EANs page:
- Correct the markup of the title tag.
- Make capitalization of "EAN" consistent.
- Use Font Awesome icon instead of Glyphicon for the "New EAN" button.
- Show a message if there are no EANs defined rather than an empty
table.
- Change or remove "maxlength" attribute of form fields to match table
structure.
- Remove use of "highlight" class from table rows (Bug 15927).
- Correct the markup of the deletion confirmation dialog (Bug 15785).
- Use Bootstrap-style buttons for "edit" and "delete," with Font
Awesome icons.
To test, apply the patch and review the affected templates. Confirm that
pages look correct and work correctly.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All seems to work and looks well,
add/edit/delete EDI accounts and Library EANs works Ok
No errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
Add support for processing incoming Edifact Quotes, Invoices
and order responses and generating and transmission of
Edifact Orders.
Basic workflow is that an incoming quote generates an aquisition
basket in Koha, with each line corresponding to an order record
The user can then generate an edifact order from this (or another)
basket, which is transferred to the vendor's site
The supplier generates an invoice on despatch and this will
result in corresponding invoices being generated in Koha
The orderlines on the invoice are receipted automatically.
We also support order response messages. This may include
simple order acknowledgements, supplier reports/amendments
on availability. Cancellation messages cause the koha order
to be cancelled, other messages are recorded against the order
Which messages are to be supported/processed is specifiable on a
vendor by vendor basis via the admin screens
You can also specify auto order i.e. to generate orders from quotes
without user intervention - This reflects existing
workflows where most work is done on the suppliers website
then generating a dummy quote
Received messages are stored in the edifact_messages table
and the original can be viewed via the online
Database changes are in installer/data/mysql/atomicchanges/edifact.sql
Note new perl dependencies:
Net::SFTP:Foreign
Text::Unidecode
Signed-off-by: Paul Johnson <p.johnson@staffs.ac.uk>
Signed-off-by: Sally Healey <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
Apply patch and go to pretty much every page on the Intranet - look out
for labels on forms etc where there should be colons but aren't. If you
see any that I've missed but I'm 99% sure I got all of them! Make sure
to click through some forms where creating a new thing involves
continuing the submission on multiple pages.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Rebased on current master and checked all changed pages.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
To test:
1) Go to Acquisitions and find a vendor
2) Add to a basket from a suggestion
3) Confirm that 'Order' next to the suggestions looks like a button and works as expected
Sponsored-by: Catalyst IT
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
If patron infos contain invalid JSON chars (\t for instance), the
results won't appear.
The solution is to escape these info.
Test plan:
Edit patron infos in DB (update borrowers set surname="foobar\t" where
borrowernumber=42)
Search for foobar (you should have more than 1 result)
Without this patch, DT retrieves a bad formatted JSON and the results
won't appear.
With this patch, the table result appears
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Acquisitions and do an empty vendor search
2) Should now read "Vendor search: X results found"
3) Enter a search term and search for vendor
4) Should now read "Vendor search: Y results found for 'search term'"
Sponsored-by: Catalyst IT
NOTE: two nested if/else/end's could make it result/results,
as suggested in comment #3. However, this meets my understanding
of the problem as defined in comment #0.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Acquisitions
2) Go to the basket groups for a vendor
3) Confirm that an open basket group has the option to 'Close and export as PDF'
4) Confirm that a closed basket group has the option to 'Export as PDF'
5) Confirm these buttons still work as expected
Sponsored-by: Catalyst IT
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
If you click on a link that opens a new tab/window to another site, that tab
has access to the original window through JavaScript. The browsing context is
related, even if the domains are totally different.
The tab retains access to the original window's object via window.opener, even
if you navigate to another page or domain, in the new or original window.
Access to the Window object means the new window can use Window.location to
open a different URL in the original window, perfect for phishing attacks.
Depending on the site's Same-Origin Policy settings, the new window may have
access to other parts of the original window's DOM as well.
Any 'A HREF' that contains a target of of '_blank' or '_new' or a fixed name
is vulnerable. Previous security best practice often suggested creating a random
fixed name for an unpredictable namespace - that won't help with this problem!
Targets of '_self' and '_parent' are safe.
We do not use _new (at first glance) but several _blank. Some are used
to refer internal url, we do not need to update or remove them. Others
are used to satisfy OPACURLOpenInNewWindow, in these case, we should add
the rel="noreferrer" attribute to the a tags.
In other cases, we can simply remove them and let the users discover
that a mouse has more than one button (we are in 2016, they can do it!)
Signed-off-by: Chris <chrisc@catalyst.net.nz>
Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This patch fixes the display of the currency symbol on invoice.tt
See comment #5
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This trivial follow-up adds an "actions" class to the table cell
containing the new buttons. In conjunction with the style update in Bug
16048, this will prevent the buttons from wrapping at narrow browser
window widths.
To test, apply the patch for Bug 16048 and search for a vendor in
Acquisitions which has at least one open basket.
Confirm that the "View" and "Add to basket" buttons look correct and do
not wrap when you make your browser window narrower.
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
To test:
1) Go to Acqui -> do a vendor search
2) Confirm actions 'View' and 'Add to basket' are now buttons and behave as
expected
Sponsored-by: Catalyst IT
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
When closing a basket in Acquisitions the confirmation dialog should be
styled using Font Awesome icons. This patch adds them.
The cancel button has been moved into its own form so that we can get
rid of several problematic JavaScript issues: The use of the
"javascript:" pseudo-protocol, the use of an "onclick" attribute, and
the use of a JS redirect where a GET action will do.
To test, apply the patch and locate an open basket in Acquisitions which
can be closed.
- Click the 'Close this basket' button and confirm that the icons in the
dialog look correct.
- Test the cancel operation to make sure you are redirected back to the
page showing the basket details.
- Test the confirm operation and verify that the basket is closed.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Please note that the confirmation message display depends on
BasketConfirmations.
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
In Acquisitions, when you delete (cancel) an order, a dialog asks you to
confirm. This dialog should be styled with Font Awesome icons.
Other minor edit: Changing page grid style for centered main content
area.
To test, apply the patch and locate a basket in Acquisitions with an
order.
- View the details for the basket.
- Click the 'Delete' link next to the order you want to delete.
- Confirm that the dialog is correctly styled.
- Test the cancel operation and verify that you are correctly redirected
back to where you were.
- Test the confirmation operation and verify that your order is deleted.
- Also test the deletion process from Acquisitions -> Vendor -> Invoices
-> Invoice -> Go to receipt page -> Delete order.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Most part of the code here is unnecessary complex. We should selected
the currency if it is selected, that's all :)
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
The "highlight" class on table rows is unnecessary since we have a CSS
rule which defines colors for alternating row colors. This patch removes
use of the "highlight" class from templates and removes the definition
from staff-global.css
To test, view the affected pages and confirm that the change has not
broken anything.
Acquisitions -> Vendor -> View basket
Acquisitions -> Late orders
Acquisitions -> Ordered
Acquisitions -> Vendor -> Receive shipment
Acquisitions -> Spent
Acquisitions -> Vendor details -> Contracts table
Administration -> MARC frameworks (comment removed only)
Administration -> Class sources
Authorities -> Authority search results
Catalog -> Bibliographic detail page -> Items -> View item's checkout
history
Catalog -> subject.tt (is this template used?)
Cataloging -> Cataloging search results
Patrons -> Patron account
Reports -> Patrons who haven't checked out
Reports -> Statistics wizards -> Patrons
Reports -> Top lists -> Most-circulated items
Reports -> Inactive -> Items with no checkouts
Reports -> Reports dictionary
Reports -> Statistics wizards -> Circulation
Reports -> Statistics wizards -> Holds
Holds -> Place a hold -> Existing holds table
Serials -> New subscription -> Search for a vendor -> Search results
Serials -> Check expiration
Serials -> Subscription -> Serial collection
Serials -> Subscription -> Serial collection -> Edit serials
Suggestions
Tags -> View tags -> View titles with a tag
Tools -> Manage staged MARC records -> Batch (I think the affected
section of this template is obsolete)
Tools -> Log viewer -> Log result
Lists -> View lists (May be broken by Bug 15916)
Note that if you search the templates for instances of a <tr> with a
"highlight" class you'll find two instances in slip templates which
refer to a class defined in printreceiptinvoice.css.
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Looks good. Haven't seen any regression.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
A warning is raised when order amount exceed budget or fund this dialog needs to be styled with Font Awesome icons.
To test:
-Add orders to a basket
-Exceed a fund or budget
-Notice about the dialog alert
-Apply patch
-Exceed again and see the new icons
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
The tables using the treetable plugin don't display correctly (with JS
error).
The lazy way to fix it is to redefine the dom of the table and remove
the button area (B).
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
On editing biblios or items, the marc_lib, marc_value and javascript
values are often populated with html code which needs to be displayed
raw.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
To test:
1) Reproduce warn following steps above
2) Apply patch
3) Create a new basket and click Save. Do not add any items
4) Notice warn is gone
5) Click 'Delete this basket' and confirm that the validation message reads: "Are you sure you want to delete this basket?" Click cancel.
6) Add an order to the basket, then click 'Delete this basket'. Confirm the validation message gives more information and more delete options.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To Test -
1. If you don't have a budget and a fund, make at least one of each.
2. Go to funds from budgets.
3. Either make a new fund or edit an existing one and then click Edit owner, which will bring up a pop-up tab.
4. Search for a patron.
5. Using the tab key try to navigate onto the Select link.
6. Notice it skips select.
7. Apply the patch and then repeat steps 3-5, notice the select link can now be accessed through using the keyboard.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
