This patch modifies several tools templates to use the
Bootstrap grid instead of YUI.
This patch also removes obsolete "text/javascript" attributes from
<script> tags in the modified templates.
To test, apply the patch and view the following pages, confirming that
they look correct at various browser widths:
- Tools -> Automatic item modifications by age
- View and edit rules
- Tools -> Batch item modification start page
- Tools -> Batch delete records
- Starting page
- Confirmation page
- Completion page
- Tools -> Batch record modification
- Starting page
- Confirmation page
- Completion page
- Tools -> Batch patron deletion/anonymization
- Starting page
- Confirmation page
- Completion page
- Tools -> CSV profiles
- View and edit CSV profiles
Signed-off-by: “Lucas Gass” <lucas@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Having to write [% KOHA_VERSION %] for each url is bad because:
- It's easily forgettable when adding new <script> or <link>
- It prevents grep'ing for the full filename
- It violates the DRY principle
- If at some point we want to change the "force js and css reload"
mechanism, it will be tedious
This patch:
- adds a Template::Toolkit plugin that generates <script> and
<link> tags for JS and CSS files, and inserts automatically the Koha
version in the filename
- use the new plugin to remove all occurences of [% KOHA_VERSION %]
- remove the code that was adding KOHA_VERSION as a template variable
Test plan:
1. Apply patch
2. Go to several different pages in Koha (opac and intranet) while
checking your browser's dev tools (there should be no 404 for JS and
CSS files, and the Koha version should appear in filenames) and the
server logs (there should be no "File not found")
3. `git grep KOHA_VERSION` should return nothing
4. prove t/db_dependent/Koha/Template/Plugin/Asset.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch modifies the staff client patron lists templates so that
JavaScript is included in the footer instead of the header.
To test, apply the patch and test the JavaScript-driven features of
each modified template: All button controls, DataTables functionality,
form validation, etc.
Revised: My original patch included changes to batchMod-edit.tt but
didn't take into account the MARC plugins which are loaded in the item
edit form. I have discarded those changes for now.
Tools -> Batch record modification
- Page highlighting in the sidebar
- Patron autocomplete in the "Check out" tab
- Submit records for deletion
- Page highlighting in the sidebar
- Checkbox selection links
- Warning when no records selected
- Patron autocomplete in the "Check out" tab
Tools -> Batch item modification
- Page highlighting in the sidebar
- Patron autocomplete in the "Check out" tab
Tools -> Batch item deletion
- Page highlighting in the sidebar
- Patron autocomplete in the "Check out" tab
- Submit items for deletion
- Patron autocomplete in the "Check out" tab
- Checkbox selection links
- Column-hiding checkboxes
- Datatables
Tools -> Batch record modification
- Page highlighting in the sidebar
- Patron autocomplete in the "Check out" tab
- Submit records for modification
- Page highlighting in the sidebar
- Patron autocomplete in the "Check out" tab
- Checkbox selection links
- Datatables
- MARC preview
- Warning when no records selected
- Progress bar after submitting items for modification
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To test:
1. Go to Home > Tools > Batch item deletion
2. Notice that there is an unnecessary option for "use default values
section" to "Populate fields with default values from default work"
3. Apply the patch.
4. Check that this section has disappeared.
Signed-off-by: Nick <Nick@quechelibrary.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
This patch makes the pre-population of the fields for the batch
item editor with the default values from the default framework
optional and off by default.
Test Plan:
1) Apply patch
2) Add default values for cost and replacement cost to the
default framework.
3) Browse to Tools / Batch item modification
4) Choose a file, or entire some barcodes in the text area
5) Ensure that the 'Populate fields with default values from default
framework' is *not* checked
6) Click 'Continue'
7) Observe that the fields for cost and replacement cost are blank
8) Click the 'back' button on your browser
9) Check the checkbox to enable the default value
10) Click 'Continue'
11) Observe that the fields for cost and replacement cost now contain
the default values you assigned them in the default MARC framework
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Switch works correctly, all tests and QA script pass.
Note: there is a bug with default values for all non text input
fields. Default values won't be applied for those fields as the
pull downs are not preselected correctly with the default values
defined in the framework.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Labels which precede a text input or select typically have a colon
before them:
Name: [____]
This patch cleans up templates where labels in this context lack a
colon. Exceptions to this rule include radio buttons, checkboxes, and
labels inside tables.
To test, view the affected pages and confirm that labels look
consistent.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Patch adds more consistency.
Work for translators could be made easier using CSS instead
of whitespace after colon.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
The batch modification pages (edit and delete) use the old tablesorter
plugin. They should use DataTables instead. This patch makes the
following changes:
- Remove tablesorter plugin from batchMod.tt where it was unused.
- Replace tablesorter assets with DataTables assets on batch edit and
batch delete pages.
- Replace tablesorter code with DataTables code in batchMod.js, which
provides table sorting functionality for both batch templates.
- Move position of batchMod.js script inclusion so that DataTables
assets are loaded first.
- Remove inline table sorting code from batch edit page since it is
provided by batchMod.js
To test, load barcodes on both the batch edit and batch delete pages.
Test JavaScript-based functionality on each results page:
- Check/Uncheck all
- Hide/show columns
- Table sorting on a variety of different kinds of data columns
Batch operations should complete normally.
There should be no JavaScript error on the batch operation "landing
page" (batchMod.tt).
Signed-off-by: Melia Meggs <melia@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests and QA script pass.
Checked both patches, no problems found.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
