Commit graph

54817 commits

Author SHA1 Message Date
9dc87a4e6f
Bug 37263: Fix deletion of 'All' patron category in Default article request fees
Follow same test plan as before, but attempt to delete a 'All' entry in 'Default article request fees'.
Notice it blows up before this patch. It works as expected after the patch.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:56 +02:00
40876b7ae1
Bug 37263: Fix URL param retrieval
This was introduced by bug 34478.
To test:
Follow the test plan as before, but test for several different patron categories

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:56 +02:00
84a31260ad
Bug 37263: Fix handling of 'All' values on 'default article request fees'
To test:
1. Enable ArticleRequests sys pref
2. Visit <staff_url>/cgi-bin/koha/admin/smart-rules.pl
3. Under 'Default article request fees' on 'Patron category' select 'All' and input a numeric Free
4. Click 'Add'. Notice it blows up.
5. Apply patch. Repeat.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:55 +02:00
897f4f319b
Bug 37389: (QA follow-up) Tidy
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:55 +02:00
3b613fb73f
Bug 37389: ExtendedAttributes mixin
This is what we're doing here:

- Creating a new mixin called ExtendedAttributes.pm
- Moving the extended_attributes 'join' logic out of REST/Plugin/Query and instead applying it to the aforementioned Mixin. Moving this to this level allows for this consistent behavior to happen on all search queries including, but not limited to, search queries happening on the REST API.
- Applying this Mixin to Patrons and ILL::Requests (we don't apply it to AdditionalFields.pm here yet because no AdditionalFields supporting classes have the extended_attributes accessor yet, I'll tackle this when rebasing 35287)

- The aforementioned mixin does the following:
-- Generates dynamic accessors for extended_attributes e.g. if there is a borrower attribute with code 'height', the 'extended_attributes_height' accessor is generated dynamically if a search with 'prefetch'=>'extended_attributes' AND the extended_attribute.code = 'height' is performed.
-- Rewrites the 'join' entries in the query to have the aliases as above.
-- Rewrites the WHERE conditions to match the above ruleset.

Example:

A DBIX search query as follows:

[
        {
            '-and' => [
                [
                    {
                        'extended_attributes.attribute' => { 'like' => 'abc%' },
                        'extended_attributes.code'      => 'CODE_1'
                    }
                ],
                [
                    {
                        'extended_attributes.code'      => 'CODE_2',
                        'extended_attributes.attribute' => { 'like' => '123%' }
                    }
                ]
            ]
        }
    ]

Results in the following SQL:

    SELECT
      `me`.`borrowernumber`
    FROM
      `borrowers` `me`
      LEFT JOIN `borrower_attributes` `extended_attributes_CODE_1` ON (
        `extended_attributes_CODE_1`.`borrowernumber` = `me`.`borrowernumber`
        AND `extended_attributes_CODE_1`.`code` = ?
      )
      LEFT JOIN `borrower_attributes` `extended_attributes_CODE_2` ON (
        `extended_attributes_CODE_2`.`borrowernumber` = `me`.`borrowernumber`
        AND `extended_attributes_CODE_2`.`code` = ?
      )
    WHERE
      (
        (
          (
            `extended_attributes_CODE_1`.`attribute` LIKE ?
            AND `extended_attributes_CODE_1`.`code` = ?
          )
          AND (
            `extended_attributes_CODE_2`.`attribute` LIKE ?
            AND `extended_attributes_CODE_2`.`code` = ?
          )
        )
      )

What fixes the performance issue that originated this work is the 'AND `extended_attributes_CODE_1`.`code` = ?' that was missing on the LEFT JOIN.

All of the above is explained using Borrowers and Borrower attributes, but it all also applies to ILL::Requests and ILL::Request::Attributes.

Co-authored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:54 +02:00
bbf52b754f
Bug 37389: Add tests
prove t/Koha/REST/Plugin/Query.t
prove t/db_dependent/Koha/Objects/Mixin/ExtendedAttributes.t

Co-authored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-02 18:59:53 +02:00
Jan Kissig
1293980793
Bug 37535: Adding a debit via API will show the belated patron as the librarian that caused the debit
This patch fixes the addPatronDebit route so that the librarian that caused the debit is taken from either the requests payload user_id or if not set from the api user.

Test plan:

 a) enable system preference RESTBasicAuth
 b) use a REST client to send a POST request with the following JSON body to http://localhost:8081/api/v1/patrons/5/account/debits

{
  "amount": 1.23,
  "description": "some description",
  "internal_note": "internal_note",
  "type": "MANUAL"
}

 Authentication username and password is "koha"
 c) verify that "user_id" is the same as patron_id in response.
 d) send a different request including user_id to the same endpoint
{
  "amount": 1.23,
  "description": "some description",
  "internal_note": "internal_note",
  "type": "MANUAL",
  "user_id": 19
}

 e) verify that "user_id" is the same as patron_id in response.
 f) apply patch and repeat step b) and d)
 e) verify that user_id in b) is now 51 (which is the borrowernumber of koha user)
 f) verify that user_id in d) is now 19 as defined in request
 g) recheck on http://localhost:8081/cgi-bin/koha/members/accountline-details.pl?accountlines_id=<account_line_id> (from response) that column Librarian now says the user from user_id

 h) sign off :)

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:36 +02:00
c1fa65d72d
Bug 37535: Regression tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:36 +02:00
Vicki McKay
3a3d367922
Bug 33453: Change the button class of the record cashup modal to btn-primary
To test:

1. Go to System Preferences > find and enable "Use cash registers"
2. Go to Administration > "Cash registers" and create a new cash register
3. Go to Tools > "Transaction history for" > "Record cashup"
4. Click "Record cashup"
5. Modal with change: "Confirm" should be yellow and primary.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:35 +02:00
d56226d737
Bug 37373: Combine duplicate class attributes
This patch corrects two instances in patron-search.inc where there were
two class attributes on one input. Combining the two class names under
one class attribute seems to fix the focus problem.

The patch also updates the global JS giving focus to elements with a
"focus" class so that it only targets elements which are visible. This
prevents the browser from trying to put focus on a field in a hidden
modal.

Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:34 +02:00
Eric Garcia
94890a1e55
Bug 37411: Fixed exporting to CSV file
To test:
1. Acquistions -> Budgets -> Funds -> Planning, select any option
2. In the toolbar see Export, and click Submit and see a 500 error
3. Apply patch, restart_all
4. Repeat steps 1-2
5. Notice the 500 error is gone and the CSV is exported properly

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:34 +02:00
Eric Garcia
7367b114c9
Bug 37411: Fixed 500 error when exporting budget planning
To test:
1. Acquistions -> Budgets -> Funds -> Planning, select any option
2. In the toolbar see Export, and click Submit and see a 500 error
3. Apply patch, restart_all
4. Repeat steps 1-2
5. Notice the 500 error is gone and the CSV is exported properly

Notes:
Is there a reason we call exit(1) after exporting the csv?

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:33 +02:00
43e7dd17d1
Bug 37188: Allow batch modification of borrowers from reports with cardnumber or borrowernumber
Some libraries do not use cardnumbers for their patrons, but would still like to be able to batch
modify patrons from reports.

Borrowernumber is going to be authoritative - every borrower will have one - so if this column is
included in the results we should offer batch modification. If we have cardnumber, we can use that.
If we have both, we should use borrowernumber

To test:
 1 - Write a report like:
    SELECT cardnumber FROM borrowers ORDER BY rand() LIMIT 35
 2 - Run report
 3 - Click "Batch operations.." -> "Batch patron modification"
 4 - Confirm it works
 5 - Edit report:
    SELECT borrowernumber FROM borrowers ORDER BY rand() LIMIT 35
 6 - Run report
 7 - No option for batch modifying patrons
 8 - Apply patch
 9 - Run report
10 - The option for batch modificatoin now shows
11 - Confirm both batch operation types work from report
12 - Edit report:
   SELECT cardnumber,borrowernumber FROM borrowers ORDER BY rand() LIMIT 35
13 - Run report
14 - Confirm both batch operations work

Signed-off-by: Laura ONeil <laura@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:33 +02:00
Sam Lau
2263d9f3b0
Bug 37489: Separate forms for uploading and deleting a patron image
This patch creats a new form for image deletion that is submitted via the 'Delete' button on the modal.

To test:
1) Turon on the 'patronimages' sys pref
2) Visit a patron page, you should see an image module on the left.
3) Click on the image to edit it. Upload a new image.
4) Edit the image again, press delete and confirm the popup.
5) Note that it will not let you delete because of the required file.
6) Apply patch
7) Attempt to delete again, this time it is successful.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:32 +02:00
8872aa91e3
Bug 37288: Allow manual providers to be edited
There is a bug preventing manually created providers from being edited. This patch fixes that issue and allows providers to be edited if they have been created manually

Test plan:
1) Create a data provider in the ERM manually using the Create manually option
2) Click to edit that provider
3) The form will not load
4) Apply patch and run yarn build
5) Hard refresh the browser
6) The form should now load correctly

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:32 +02:00
b646d8ab65
Bug 37288: Improve display of data provider edit form
This patch makes some improvements to the edit form for data providers. It delays page display until the counter registry has responded and also improves the display of the "create manually" and "Create from registry" buttons

Test plan:
1) Create a Data provider in the ERM module
2) Click to edit that new provider
3) The page will load and there will be a slight delay before the Data provider name input is populated
4) The "Create manually" button will also be visible
5) Apply patch and yarn build
6) Hard refresh the browser and repeat steps 1 and 2
7) This time when the page loads the provider name should be prepopulated and no manual creation button will be visible

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:31 +02:00
db405f33f0
Bug 37419: DBIC schema update
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:30 +02:00
14a824ed50
Bug 37419: DBRev 24.06.00.022
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:30 +02:00
8754458775
Bug 37419: Update FK constraint on record sources to avoid data loss
Without this patch, deleting a record source will delete the associated
biblio_metadata rows, which is a severe data loss.

This patch makes the constraint restrict this action.

To test:
1. Add a record source
2. Set the record source to some records
   $ koha-mysql kohadev
   > UPDATE biblio_metadata SET record_source_id='your source id' WHERE
biblionumber=1;
3. Delete the record source
=> FAIL: Record metadata deleted
4. Apply this patch
5, Run:
   $ ktd --shell
  k$ updatedatabase
=> SUCCESS: DB update goes well
6. Repeat 1~3 with another record
=> SUCCESS: Source cannot be deleted if there are linked records

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:29 +02:00
Phil Ringnalda
f4d248f076
Bug 37093: Searching for reports on Mana should use GET
Searching for reports on Mana currently fails by sending a POST to
svc/mana/search without a CSRF token. There's no reason to POST, it's
just sending a search string.

 1. Enable Mana: Reports - lower right is a blue Knowledgebase box with
    a link to Change your Mana KB settings
 2. Switch Use Mana KB to Yes, click Save, below that give it a name and
    email, Send to Mana KB
 3. Reports - Use saved - New report - New SQL from Mana
 4. Enter any keyword to search, get a 403 forbidden error
 5. Apply patch, restart_all, Shift+Reload the page to clear cache
 6. Enter any keyword likely to return results, like select, get results

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:29 +02:00
2f6226ad69
Bug 37523: CSRF error when modifying an existing patron record
This patch modifies the patron entry template to avoid a CSRF error when
clicking the "Edit existing record" button after a duplicate patron is
found. The operation should be GET and thus can be a link.

To test, apply the patch and go to Patrons.

- If you aren't using the default testing data you should first locate
  an existing patron record so you can refer to the details.
- Start the process of creating a new patron record.
- Use the existing patron's data to fill out the form.
  - With the default data you can use:
    - Surname: Bennett
    - First name: Pamela
    - Date of birth: 09/16/1946
    - Any random new card number
- When you click "Save" you should get a duplicate patron warning:
  "Duplicate patron record?"
  - Click "It is a duplicate. Edit existing record."
  - You should be taken to the edit form for the existing patron.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Johanna Räisä <johanna.raisa@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:28 +02:00
Andreas Jonsson
e4e4953f61
Bug 37533: Fix query in orderreceive.tt
The new validation in the REST API will no longer allow
the operator "in".  Consequently, it has to be replaced
with the allowed "-in".

Test plan:

 * Open an invoice and click "Go to receipt page" and
   on any basket click "receive" and make sure the dialog
   box appears.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:28 +02:00
1213ad7af7
Bug 37540: Ensure datetime is a string before enqueueing pseudonymization
To test:
1 - Enable Pseudonymization in system preferences
    NOTE: See bug 28911 for bcrypt setup
2 - Issue an item to a patron
3 - View the patrons checkouts
4 - Check the box under 'Renew'
5 - Renew selected items
6 - Internal server error
7 - Apply patch
8 - Restart all
9 - Repeat 4&5
10 - Success!

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:27 +02:00
Julian Maurice
0b7c79fca4
Bug 37210: Properly escape SQL query parameters by using bind values
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Rebased-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:46 +02:00
Hammat Wele
56abb85b1a
Bug 37210: Escape single quote in search string in overdue.pl
To Test:
1. Go to /cgi-bin/koha/circ/overdue.pl
2. In the «Name or card number» field, type «Tommy'and(select(0)from(select(sleep(10)))v)and'»
3. Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
4. Inspect the page, in «Patron category:» field, put «Tommy'and(select(0)from(select(sleep(10)))v)and'» in one of his option's value
5. select the option from the filter and Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
we can inject SQL to the followin field : borname, itemtype, borcat, holdingbranch, homebranch and branch
6. Apply the patch
7. Repeat step 1,2,3
   ==> it doesn't take 10 seconds, the injected sql is not executed
8. Repeat step 5
==> it doesn't take 10 seconds, the injected sql is not executed
9. Repeat step 5 with the followin field : itemtype, holdingbranch, homebranch and branch
   ==> it doesn't take 10 seconds, the injected sql is not executed

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:45 +02:00
f7aabc532a
Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:44 +02:00
35e9ac9b0a
Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:44 +02:00
e77db213a5
Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:43 +02:00
c77c44be6d
Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:43 +02:00
Hammat Wele
a10697ff76
Bug 37018: (follow-up) adding some allowed operators
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:42 +02:00
47757a3078
Bug 37018: Use validation in search_rs helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:41 +02:00
36afa645ba
Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:41 +02:00
5b75ae509d
Bug 37018: Add Koha::Exceptions::REST
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:40 +02:00
470db1620f
Bug 37018: Unit tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:40 +02:00
5a6b8c4166
Bug 37018: Regression tests
This patch adds regression tests. With the current codebase, the
malicious query returns a 200. It should be caught and a 400 needs to be
returned.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/query.t
=> FAIL: It returns a 200
3. Once the rest of the patches are ready, repeat 2
=> SUCCESS: It returns a 400

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:39 +02:00
19e318c545
Bug 37247: Fix display of "closed"
The subscription was not shown as closed after we closed it.
This is because "closed" is not passed to the template.
It seems more reliable to rely on the subscription object (that is passed to both
serials/serials-collection.tt and serials/subscription-detail.tt, the
others are not showing the Reopen/Close buttons)

Also fetch the subscription object after and reopen/close it to display
accurate values.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:38 +02:00
e3a0ad463b
Bug 37247: Fix subscriptions operation allowed without authentication
Move close and reopen after get_template_and_user().
Also move Koha::Subscriptions->find(), not a good idea to run DB queries
before authentication.

Test plan :
1) Apply patch
2) Authenticate to staff interface
3) Go to an existing open subscription
4) Open a new browser tab and use it to log-out
5) Go to first tab and click on 'Close'
6) You get login page
7) Authenticate
8) Check subscription is not closed
9) Check you can close and reopen subscription

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:38 +02:00
a4fef6b201
Bug 37146: Add tests
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:37 +02:00
4741900611
Bug 37146: Prevent path traversal by validating input
This patch validates the plugin_name passed to plugin_launcher.pl
against the base path containing the "value_builder" directory.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29
3. Check that the tag editor for leader still works
4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
5. Check that the pluginf or "Date acquired" still works

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:37 +02:00
6503787f13
Bug 36863: (QA follow-up): tidy up code
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:36 +02:00
e79d407340
Bug 36863: Deal with non-listed methods in CSRF plack middleware
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:36 +02:00
c4be7134c4
Bug 37074: Do no pass biblionumber
It is not used in the controller

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:35 +02:00
9a8fac823b
Bug 37074: Comment approval and un-approval should be CSRF-protected
This patch converts the "Approve" and "Unapprove" controls in the staff
client's comment moderation page so that the operations are POST instead
of GET.

To test, apply the patch and restart services.

- If necessary, enable OPACComments and submit a few comments on a few
  titles in the OPAC
- Go to Tools -> Comments
- Test the process of approving, unapproving, and deleting comments

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:34 +02:00
Jennifer Sutton
558b900895
Bug 35236: Make "Batch description" label match corresponding <input> field
To test:
  1. Create a new patron.
  2. Go to Tools -> Patron card creator.
  3. Create a new patron card batch.
  4. On the "Edit patron card batch" page, click the "Batch
     description:" label.
  5. Observe that the corresponding <input> field is selected.

Mentored-by: Catalyst Academy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 16:58:17 +01:00
Sam Lau
47a3c28473
Bug 36998: Correctly update the 'Amount paid' displayed on the issue refund modal
To test:
1) Enable the 'EnablePointOfSale' sys pref (also requires the 'UseCashRegisters' pref)
2) In the POS module, configure a cash register and also configure some items for purchase with different costs
3) Make multiple sales
4) View the transactions table by clicking the 'Cash summary for ...' tab and then clicking on your cash register's name.
5) Click on the 'Issue refund' button for one of the sales, this should have the correct 'Amount paid'
6) Close the modal and click issue refund on your other item.
7) Note the 'Amount paid' is incorrect and lists the value from the previous item
8) Apply patch
9) Now when clicking issue refund, it displays the correct 'Amount paid'

Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 16:57:59 +01:00
a4b9dcaf61
Bug 37476: Fix reserved word error on Serials.pm on MySQL 8
This patch fixes the fact `RANK` become a reserved word in MySQL 8.0.2
[1]

To test:
1. Launch KTD with MySQL 8:
   $ ktd down
   $ DB_IMAGE=mysql:8 ktd up -d
2. Open the logs
   $ ktd --shell
  k$ tail -f /var/log/koha/kohadev/*.log
3. Create a serial, receive an issue and try to create a routing list
4. Click on `+ Add recipients` and look for Henry
5. Click `Add` and then `Close`
=> FAIL: Henry not added
=> FAIL: The logs show an error about wrong SQL syntax
6. Run:
  k$ prove t/db_dependent/Serials.t
=> FAIL: Tests explode with the same kind of error!
6. Apply this patch
7. Restart plack
8. Repeat 3 through 6
=> SUCCESS: Henry added!
=> SUCCESS: No explosion about the SQL syntax in the logs
=> SUCCESS: Tests pass!
9. Sign off :-D

[1] https://dev.mysql.com/doc/refman/8.0/en/keywords.html

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:45 +01:00
3d76ccdf94
Bug 37476: Unit tests
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:45 +01:00
Thibaud Guillot
e0856d0db6
Bug 36196: Handling NULL data on ajax call
Test plan:

1) Update some data in your cities table, sample for one send:
"UPDATE cities SET city_state=NULL WHERE cityid=<id>"
2) Go on "/cgi-bin/koha/admin/cities.pl" and wait a entire life :)
3) Apply this patch
4) Rebuild your po files if needed
5) Reload the same page and now you get normally the datatable

Sponsored by: BibLibre
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:27 +01:00
4eb9816354
Bug 37303: Replace po2json with a JS version
When using __() (ie. Gettext.js) we are seeing the translations that are marked as fuzzy.
This is definitely not the expected behaviour.

It happens because (our version of) po2json are old and no longer maintained,
and just embed them.

It seems that the bin we have has been upgraded to a JS version
(different authors).

Test plan:
(replace LANG with your language code)
0. Do not apply this patch
Edit misc/translator/po/LANG-messages-js.po
Mark a string as fuzzy
Edit ./intranet-main.tt and add the following lines inside $(document).ready
  console.log(_("Your string"));
  console.log(__("Your string"));
Replace "Your string" with the string you are actually testing.

Update the templates: `koha-translate --update LANG --dev kohadev && restart_all`

Go to the Koha home page, open the console.

=> Notice that the second log in the console is displaying the fuzzy string.

1. Apply this patch
Install the new version of po2json using `yarn install`
Repeat the previous steps.

=> With this patch applied both logs show the English version of the
string.

Remove fuzzy, update the templates and try again.

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:53 +01:00
bbd1fa0bfa
Bug 37351: Rework checkbox JS to work with paginating dataTable
To Test:

1. Log in to staff client
2. Place items on items for borrowers
    2-1 Place enough holds as noted above
    2-2 Trap holds for borrowers
3. Open Circulation->Holds Awaiting Pickup (circ/waitingreserves.pl)
4. Click a checkbox for one or mroe holds
    Note->The 'Cancel selected (0)' button changes to 'Cancel
	selected (1)', etc.
5. Cancel selected Holds using the (Cancel selected (#) button)
6. Confirm Cancellation
7. Wait for background processes to complete, then verify holds are cancelled.
8. Return to Open Circulation->Holds Awaiting Pickup (circ/waitingreserves.pl)
9. Ensure button shows "Cancel selected (0)"
10. Click "Next >" to navigate to page 2 of holds
11. Click a checkbox for one or more holds
     Note->The 'Cancel selected (0)' button DOES NOT increase as boxes
	are selected.
12. Cancel selected Holds using the (Cancel selected (#) button)
13. Confirm Cancellation
14. Wait for background processes to complete, then verify holds are cancelled.
     Note-> Holds were not cancelled

15. APPLY PATCH
16. Try step 9-14 again. This time the 'Cancel selected (0)' button should update even when you paginate.
17. Make sure you try all the tables, Holds waiting, Holds waiting over X, Holds with cancellation requests.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:34 +01:00