As of 18.11 the IntranetReportsHomeHTML syspref no longer renders HTML
on report-home.pl. I think this is being filtered wrong in the template.
Test Plan:
1) Edit IntranetReportsHomeHTML, set to "<p>Test</p>"
2) View a report, note that you see the html p tags are displayed
litterly
3) Apply this patch
4) Reload the page
5) Note the p tags are rendered as html
Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2 tiny fixes:
- Remove space before : as this is not correct in English
- Remove an errorenous commented line that probably snuck back
in from a merge
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
- Removed merge marker
- Changed include path in favor of using the Asset tt plugin (bug 20538)
- Changed access_dir to a two-level entry for clarity
Test plans stay the same, just make sure that the two-level configuration entry
work properly and everything pass QA.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This squash contains all of these commits:
- Adds a page to access log files on the server from the intranet
- Update ID to allow for permalinking
- Rename config to "'accessdir' and fix qa
- Allows for multiple directories to be accessible
- Update the link under reports
- (Follow-up) Fixing merge error and cosmetic changes
- (Follow-up) Fix tab chars and move javascript to the footer
- (QA Follow-up) Fix datatable
- Make filename unicode-proof, renamed accessdir to access_dir and fix update
Test plans:
- Apply patch, update database
- Add to koha-conf:
<access_dir>/tmp/koha-public/one</access_dir>
<access_dir>/tmp/koha-public/two</access_dir>
<access_dir>/tmp/koha-public</access_dir>
- Create these directories ( mkdir /tmp/koha-public , etc...)
- Create these files:
echo "hello world!" > /tmp/koha-public/❤
echo "test" > /tmp/koha-public/one/samename.txt
echo "this is not the same" > /tmp/koha-public/two/samename.txt
- Login as Superadmin, go to tools > reports files
- Click on ❤, make sure it's downloadable and readable
- Click on both samename.txt, look inside and make sure the file is different
- Login as NON-superadmin. Go under tools, see no Report/Log under the third column
- Go to add tools/access_file permission to user
- See new entry under tools third column.
- validate link is ok.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch makes cosmetic changes to the reports home page in the staff
client following the pattern set on the Administration home page with
the system preferences search box. A reports keyword search form is
added, and reports actions have font-awesome icons.
To test, apply the patch and view the reports home page. Confirm that
all affected links work correctly and that the search form works
correctly.
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch updates various unrelated templates to use the Bootstrap
grid.
- about.tt - The about page
- auth.tt - The login page
These pages should look correct.
- reports/reports-home.tt - The reports home page
- admin/admin-home.tt - The administration home page
These pages should look correct, with a single centered column
with wide margins on either side. At lower browser widths the margins
should disappear.
- serials/subscription-add.tt - Serials -> Add subscription. The entry
form should look correct during each step of the add/edit process.
- suggestion/suggestion.tt - Acquisitions -> Suggestions -> New
suggestion. The page with the new suggestion form should look correct.
Signed-off-by: Roch D'Amour <roch.damour@inlibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
File koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt contains a link to /cgi-bin/koha/reports/stats.screen.pl with label 'Till reconciliation' that is commented out since years.
Remove this link and the related files:
cgi-bin/koha/reports/stats.screen.pl
koha-tmpl/intranet-tmpl/prog/en/modules/reports/stats_screen.tt
To test:
- Apply patch
- Verify that Koha > Reports still display the same
- Verify that two files stats.screen.pl and stats_screen.tt are gone and thet they are not used
anywhere in the Koha codebase
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Also fix forbidden patterns in koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch creates a new report that outputs cash register stats for a specific period.
Changes:
koha-tmpl/intranet-tmpl/prog/en/includes/reports-menu.inc - Added cash register report link
koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash-register_stats.tt - new file
koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt - Added cash register report link
reports/cash-register_stats.pl - new file
Testing:
I Apply the patch
0) Go to reports home page (Home › Reports);
1) Validate link << Cash Register >> under Statistics wizards;
2) Click link;
3) Validate page with three fieldsets;
4) Chose a date interval, a transaction type, a library and an output;
5) Validade the result.
Signed-off-by: Nicole <nicole@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Add option show or no inactive budget and more options
Use subroutine GetBudgetHierarchy for return all budgets
Delete subroutine GetBudgetPeriodDescription and theire tests
Use Price TT plugin
Correct name of column and capitalization the first letter
Add checkbox for show inactive budgets, default the drop down list containt a active budget
Not use [i] for inactive budgets, i add (inactive) at the end of inactive budget
Add vendor note in the list of show attribute
Test case:
Go to Home > Reports > Orders by fund
Select one or all budgets
You can show the inactive budget, default the drop down list containt a active budget
Choose output to screen ou csv file
Works as expected. QA tools OK with Bug 16104 applied.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
- changed 'Fund (budget):' back to 'Fund:', as the budget
no longer shows in the pull down.
- Fixed number of tests in Budgets.t
- Removed &GetBudgetPeriodDescription
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
To test:
1 - Apply patch
2 - run updatedatabase.pl
3 - Add some html to the two new prefs IntranetReportsHomeHTML and
IntranetCirculationHomeHTML
4 - View the reports and circulation homepages and confirm your changes
show
Sponsored by Northeast Kansas Library System, NEKLS (http://nekls.org/)
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Reports home should show the same report name (i.e. "Patrons with the most checkouts")
the report itself uses. It is chosen as it is more idiomatic.
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Adds support for custom plugins. At the moment the Plugins
feature supports two types of plugins, reports and tools.
Plugins are installed by uploading KPZ ( Koha Plugin Zip )
packages. A KPZ file is just a zip file containing the
perl files, template files, and any other files neccessary
to make the plugin work.
Test plan:
1) Apply patch
2) Run updatedatabase.pl
3) Create the directory /var/lib/koha/plugins
4) Add the lines
<pluginsdir>/var/lib/koha/plugins</pluginsdir>
<enable_plugins>1</enable_plugins>"
to your koha-conf.xml file
5) Add the line
Alias /plugin/ "/var/lib/koha/plugins/"
to your koha-httpd.conf file
6) Restart your webserver
7) Access the plugins system from the "More" pulldown
8) Upload the example plugin file provided here
9) Try it out!
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
This is the last one - adding the classes and ids to the report module and
some template files for smaller moduls/functions.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Adds schema and reports library to reports-home.tt
To Test: Verify that schema and report library links are visible on reports-home.pl
Signed-off-by: Liz Rea <lrea@nekls.org>
Works as advertised, links are correct.
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
