Check input parameters to avoid SQL injection
Rewrite a for loop for readability
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests pass, perlcritic is unchanged.
Test plan
- Verify ExtendedPatronAttributes hides/shows new patron attribute
search criteria
- Verify patron attribute show up correctly
- pull down list for attributes linked to authorized values
- input field for other attributes
- Verify search works correctly
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This patch allows to choose row and column amongst extended patron
attributes and to filter on them in reports/borrower_stats.pl
Signed-off-by: Marc Veron <veron@veron.ch>
Great, I was looking for such a feature.
Patch works as expected.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
- the dateformat value is send to all templates (from
C4::Auth::get_template_and_user)
- remove all assignment of dateformat in all .pl files
- the DHTMLcalendar_dateformat variable is unused
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Fixed conflicts:
- opac/sco/sco-main.pl
- reports/acquisitions_stats.pl
- tools/cleanborrowers.pl
All tests pass, perlcritic problems appeared in some files
before and after these patches were applied.
Checked sorting in following pages:
- acqui/addorderiso2709.tt - list of staged imports in acq
- acqui/histsearch.tt - sorting of dates in acq search result list
- acqui/invoices.tt - billing date in list of invoices in acq
- acqui/lateorders.tt - list of late orders in acq
- acqui/ordered.tt - ordered titles and estimated costs for a fund
- acqui/parcels.tt - receive shipment page
- acqui/spent.tt - received titles and actual costs for a fund
...
- serials-search.tt - subscription search result list
...
- opac/sco/sco-main.tt - due dates in list of checked out items
- reports/acquisitions-stats.tt - date searches, display of dates
- tools/cleanborrowers.tt
- tools.holidays.tt - different views of dates library is closed,
adding dates
Checked dates display according to system preference everywhere and
searching, entering dates etc. still worked as expected.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
- Possibility to select for line and column: items.homebranch and
items.ccode
- Possibility to filter on these fields
- Possibility to count unique biblios (count(distinct biblionumber)),
ordered amount and spent amount (based on aqorders.datereceived)
Filtering on item homebranch and ccode works only on items that were
created at ordering or receiving (ie items are linked to an order)
Some refactoring is done, mainly replacing switch-like if statements by
given/when
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
If a subscription is no longer enough published (or we are not waiting
for a new periodical) we are allowed to close it.
If a subscription is closed, we are not able to receive or generate a
new serial.
On the serial module, we can now
- close a subscriptionn
- reopen a closed subscription
On serial search 2 tabs is displayed (opened and closed subscriptions).
This patch adds:
- a new field subscription.closed in DB
- a new status for serials (8 = stopped)
Test plan:
- search subscriptions
- close a subscription and check that you cannot receive or generate a
new serial
- launch another search and check that the closed serial is into the "closed"
tab.
- You are allowed to reopen a subscription on the subscription detail
page and on the subscription result page. A javascript alert ask you
if are certain to do this operation.
- Check the serial status "stopped" everywhere the status is
displayed (catalogue/detail.pl, serials/claims.pl,
serials/serial-issues-full.pl, serials/serials-collection.pl,
serials/serials-edit.pl, serials/serials-recieve.pl,
serials/subscription-detail.pl and opac-full-serial-issues.pl)
- The report statistics does not include the closed subscriptions if you
don't check the "Include expired subscriptions" checkbox.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Bug 8782: Followup: add some minor modifications
- Show 'closed' information in biblio detail page
- Add a column in serials report table
- Search subscriptions on title words instead of string
- Prevent serials editing when subscription is closed
- Don't change status of "disabled" serials
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Bug 8782 - Close a subscription - Followup - Fix updatedatabase.pl
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Reports dictionary won't let you set a comparison for MEDIUMTEXT columns. To
test, choose a MEDIUMTEXT column like borrowers.surname in Step 3 of adding
a new dictionary definition. Before the patch, in Step 4 you would not see
any kind of form field for entering a comparison. After patching Step 4 will
offer you a field labeled "Search string matches."
Signed-off-by: Melia Meggs <melia@test.bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
All tests and perlcritic pass.
Test plan:
1) Reports > Reports dictionary > New definition
2) Step 1: Some name
3) Step 2: Patrons
4) Step 3: First name (mediumtext)
5) Step 4: Verify 'Search string matches' is offered.
For both, surname (mediumtext) and first name (text) the program should offer you
"Search string matches" on step 4.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
The fix for Bug 7993 removed some lines from guided_reports.pl
which passed a new report's name and id to the template after
saving. For some reason this was removed, making it impossible
to run or edit a new report immediately after saving.
This patch adds back that part of the script which passes those
variables to the template. Before this patch, after adding a new
SQL report you would not see a "run this report" link. The
"run this report" and "edit" buttons in the toolbar would not
work. After applying the patch these should work.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Tested creating reports and was able to run them after saving.
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
This should make saved reports more manageable.
Group/Subgroup hierarchy is stored in authorised_values,
categories REPORT_GROUP and REPORT_SUBGROUP, connected by
REPORT_SUBGROUP.lib_opac -> REPORT_GROUP.authorised_value
Database changes:
* authorised_values: expanded category to 16 chars
* created default set of REPORT_GROUP authorised values to match
hardcoded report areas
* reports_dictionary: replaced area int with report_area text, converted
values
* saved_sql: added report_area, report_group and report_subgroup;
report_area is not currently used, saved for the record
C4/Reports/Guided.pm:
* Replaced Area numeric values with the mnemonic codes
* get_report_areas(): returns hardcoded areas list
* created get_report_areas(): returns full hierarchy (groups with belonging
subgroups)
* save_report(): changed iterface, accepts fields hashref as input
* update_sql(): changed iterface, accepts id and fields hashref as input
* get_saved_reports():]
- join to authorised_values to pick group and subgroup name
- accept group and subgroup filter params
* get_saved_report():
- changed iterface, return record hashref
- join to authorised_values to pick group and subgroup name
* build_authorised_value_list(): new sub, moved code from
reports/guided_reports.pl
* Updated interfaces in:
cronjobs/runreport.pl, svc/report, opac/svc/report: get_saved_report()
reports/dictionary.pl: get_report_areas()
reports/guided_reports.pl
reports/guided_reports_start.tt:
* Reports list:
- added group/subgroup filter
- display area/group/subgroup for the reports
* Create report wizard:
- carry area to the end
- select group and subgroup when saving the report; group defaults to area,
useful when report groups match areas
* Update report and Create from SQL: added group/subgroup
* Amended reports/guided_reports.pl accordingly
Conflicts:
C4/Reports/Guided.pm
admin/authorised_values.pl
installer/data/mysql/kohastructure.sql
installer/data/mysql/updatedatabase.pl
koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tmpl
koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tmpl
misc/cronjobs/runreport.pl
reports/dictionary.pl
reports/guided_reports.pl
Signed-off-by: Delaye Stephane <stephane.delaye@biblibre.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
This reverts commit 215abc8024.
The 3 patches for bug 8089 have been reverted, because they break
jenkins & Koha.
A follow-up has been provided, but it does not solve the problem on my
test server, it just changes the error message.
After a discussion with jared, Dobrica should work on another patch, so
the best option is to revert.
1. Replace all instances of memoize_memcached with appropriate calls
into Koha::Cache:
* reports/guided_reports.pl
* C4::Biblio::GetMarcStructure
* C4::Languages::getFrameworkLanguages
* C4::Languages::getAllLanguages
* C4::SQLHelper::GetPrimaryKeys
* C4::SQLHelper::_get_columns
2. Replace all references to memcached with the appropriate calls into
Koha::Cache in C4::Context.
Test plan :
* have DEBUG env set to 1
* reach addbiblio page to test the patch in Biblio.pm, or setup more than 1
language
* you should see in the logs that you're reading and writing from cache
* run the test suite twice both with and without the following environment
variables set:
export MEMCACHED_SERVERS=127.0.0.1:11211
export MEMCACHED_NAMESPACE=KOHA
export CACHING_SYSTEM=memcached
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
I'm unsure about some of the caching times 10000 is a long long time,
but other than that, works fine.
Rebase of a patch originally submitted by gcollum@gmail.com
Original commit message:
Improvement on the previous patch through the use of GetBranchesLoop.
Added code so that the logged in location will be the location that
is selected by default.
Fixed a couple of minor xhtml errors.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Changes to markup and script to enable unique ids on form
fields. These changes allow for working label+input pairs
on one or more text and select inputs and multiple working
datepickers.
To test, create a report with more than one date parameter,
at least one text parameter, and one or more authorised
value parameters. The datepickers should each work properly,
and labels should by clickable.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Hands back JSON, and supports caching
Squashed commit of the following:
commit 5c93506079738b9a13139417d3a0734289a4b007
Author: Chris Hall <chrish@catalyst.net.nz>
Date: Mon Nov 21 15:41:14 2011 +1300
Fixed bugs when creating reports, added more user friendly input and
feedback
commit c62430bb358ee4af6ee5331b4d3a2ed67f723032
Author: Chris Hall <chrish@catalyst.net.nz>
Date: Mon Nov 21 12:00:27 2011 +1300
Added caching to intranet report webservices, added cache expiry and public
options to reports
commit 2d89f0777d95b26bf08635782070b6367d0698f3
Author: Chris Cormack <chris@bigballofwax.co.nz>
Date: Wed Nov 9 20:29:26 2011 +1300
Working on caching for services
commit e0511f180cebd81747858ad776433fe3a1cf6854
Author: Chris Cormack <chris@bigballofwax.co.nz>
Date: Wed Nov 9 08:28:26 2011 +1300
Starting work on webservices
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Patch includes database update adding 2 new fields to the saved_sql table.
1) Checked that adding/deleting/editing of sql reports still works and new
fields are correctly saved to the database.
2) The saved reports page now lists the new fields correctly.
3) Checking URLs with JSON output
- if report is not public http://localhost/cgi-bin/koha/svc/report?id=2 fails,
but http://localhost:8080/cgi-bin/koha/svc/report?id=2 works
- if report is public, both links work
4) Checking results are cached
Created a report listing my borrowers, setting caching to 60 seconds and
added new borrowers before doing following tests.
- URL doesn't show new borrower immediately - correct
- Turning off the usecache system preference updates data - correct
- Restarting memcached updates data '/etc/init.d/memcached restart' - correct
- Waiting until cache time runs out updates data - correct
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Retested the feature and renewing my sign-off.
There are some things that should be noted:
- currently there is a hardcoded limit of 10 results for the reports webservice
- reports with runtime parameters are currently not supported
In Bug 7772 Ian correctly noted that reports have exit(1) all over the place.
This is left over from old code, and this patch changes them to exit(0).
I decided to use plain exit as opposed to explicit exit(0) since it produces
cleaner code, but I'm welcoming suggestion on this.
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Creating new include, reports-toolbar.inc for presenting "action"
options to the user, in contrast with "view" options in the left-
hand navigation menu.
In the toolbar: New (guided report, SQL report), Edit, Run.
The presence of the toolbar allows the user to access functions
more flexibly: Getting directly to 'edit' or 'run' from the 'view'
page for instance.
Modifications to guided_reports.pl pass report id and name to
the template for clarity and for the purpose of enabling the
edit/run buttons.
To test: Apply the patch and go through the process of creating
a new saved SQL report. Note that the toolbar is present and
the buttons are functional at appropriate times.
New and Edit options should only be displayed if the user has
permission to create reports. Test with a user who does not
have create permission to confirm.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Adds a date picker for SQL reports with the 'date' authorised_value. Updates help
documentation for this new feature, as well.
To test:
1. Create a new report with two date parameters, using the syntax:
<<Label for this selection of date|date>>
2. Run the report
3. Select dates
4. The SQL generated should format the dates properly in ISO, and keep track of which
date is which
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This patch fixes several errors in reserves_stats.pl and reserves_stats.tt.
Testing -
To test this patch, data must be in either the reserves table or old_reserves or both. The following SQL will give you the raw data that is used by the report.
SELECT priority, found, reservedate, notificationdate, reminderdate,
waitingdate, cancellationdate, borrowers.categorycode, items.itype,
reserves.branchcode, holdingbranch, items.homebranch, items.ccode,
items.location, items.itemcallnumber, borrowers.sort1, borrowers.sort2
FROM reserves
LEFT JOIN borrowers on (borrowers.borrowernumber = reserves.borrowernumber)
LEFT JOIN items on (items.itemnumber = reserves.itemnumber)
UNION SELECT priority, found, reservedate, notificationdate, reminderdate,
waitingdate, cancellationdate, borrowers.categorycode, items.itype,
old_reserves.branchcode, holdingbranch, items.homebranch, items.ccode,
items.location, items.itemcallnumber, borrowers.sort1, borrowers.sort2
FROM old_reserves
LEFT JOIN borrowers on (borrowers.borrowernumber = old_reserves.borrowernumber)
LEFT JOIN items on (items.itemnumber = old_reserves.itemnumber)
To test the notificationdate and reminderdate, I added data to the old_reserves table, since I have never run notices on my test machine.
Ex:
UPDATE old_reserves
SET notificationdate = "2012-01-29",
reminderdate = "2012-01-29"
WHERE timestamp = "2012-01-29 20:09:34";
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Confirm original bug -- Reports work as expected now!
prove t xt t/db_dependent no different from master.
use encoding(UTF-8) rather than utf-8 for stricter
encoding
Marking output as ':utf8' only flags the data as utf8
using :encoding(UTF-8) also checks it as valid utf-8
see binmode in perlfunc for more details
In accordance with the robustness principle input
filehandles have not been changed as code may make
the undocumented assumption that invalid utf-8 is present
in the imput
Fixes errors reported by t/00-testcritic.t
Where feasable some filehandles have been made lexical rather than
reusing global filehandle vars
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
* the filter on dates don't work
* when displaying by day or month, it was 100% alphabetic, april was before
january for example. Adding the month number before the month name to get
proper sorting
* removed many commented warn & lines
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Plus several other fixes for this report no one uses:
- Clarifying titles and breadcrumbs
- Correcting terminology: branch -> library
- Sorting library select field by library name
- Displaying library name instead of code on output
- Sorting results by itemtype description
- Adding tablesorter to results
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Removes deprecated calls to HTML::Template or HTML::Template::Pro from:
C4/Output.pm
catalogue/export.pl
reports/issues_by_borrower_category.plugin
reports/itemtypes.plugin
Only remaining calls are in misc/cronjobs/rss/rss.pl, misc/cronjobs/smsoverdues.pl,
and t/test_template.pl. These scripts still legitimately depend on H:T:P
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Reports dictionary won't let you set a comparison for MEDIUMTEXT columns. To
test, choose a MEDIUMTEXT column like borrowers.surname in Step 3 of adding
a new dictionary definition. Before the patch, in Step 4 you would not see
any kind of form field for entering a comparison. After patching Step 4 will
offer you a field labeled "Search string matches."
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Fixes described problem with mediumtext columns.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Optimization of the SQL request using NOT EXISTS instead of NOT IN
BibLibre MT5946
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Do not misleadingly document or pass an unused second parameter
makes all calls use the single parameter call as the C4
routines already did
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Fixes bug where paging through output of an SQL report that includes
one or more parameters fails by asking you for the parameter values
and again and sending you back to the first page of results.
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Patch fixes a TT error that caused Build New to be empty.
To test:
Click More -> Reports, you should see the welcome page and be able to step through creating the report.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
1. Moved the form to the left under the menu
2. Added a calendar next to date (and a date format tip)
3. Styled the form like other filter forms for consistency's sake
4. Formatted on-screen message to match standard style
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: fdurand <frederic.durand@univ-lyon2.fr>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
- 'Not checked out since:' date was not added to query
- borrowers with only checkouts and no returns since this date were considered inactive
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
this fix filters of borrowers top issues that doesn't work really well... perhaps because reports scripts need too much improvment.
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
This patch fix ordering in acquisition stats to order by month number.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
More podchecker cleanups to eliminate warnings / errors
Signed-off-by: Andrew Elwell <Andrew.Elwell@gmail.com>
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
* Enforce the requirement that the user must have the
create_reports permission in order to delete a saved report;
closes hole where unprivileged user could delete reports
by constructing a URL maliciously
* Added another tweak of the template - don't offer option
to create a new report if the user doesn't have permission.
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
missing s
create_reports
and execute_reports
rather than
create_report
and execute_report
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
