Commit graph

49978 commits

Author SHA1 Message Date
b6f3da27c1 Bug 33881: Clear self-check JWT during auth kick out
This patch clears the JWT cookie during auth kick out (ie
when a web user navigates from the self-check out/in to
the rest of Koha).

Test plan:
0. Apply patch and koha-plack --reload kohadev
1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
2. Log in as the "koha" user
3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1
5. Note that you are prompted to "Log in to your account" via the normal Koha prompt
6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
7. Note that you are prompted to "Log in to your account" within the "Self checkout system",
and note that your self-checkout session for the "koha" user has *not* persisted like
it did before the patch was applied

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 1fa961b97b8f52d1c9920c72d9338d150deb829b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
84724639ed Bug 30524: (QA follow-up) Fix tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 158edb411b32253fae4f068ce416d6ad4d1a67d3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
17a496f1bc Bug 30524: (QA follow-up) Unit tests for GenerateCSRF()
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 60d11ae7251a227fab3977ecd61cb01d0f062f79)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
6aa54daa3e Bug 30524: (QA follow-up) Only generate CSRF token if it will be used
This patch avoids generating CSRF tokens unless the csrf-token.inc file
is included in the template.

Passed token doesn't need HTML escaped. The docs for WWW::CSRF state:
  The returned CSRF token is in a text-only form suitable for inserting into a HTML form without further escaping (assuming you did not send in strange things to the Time option).

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit ddf1eb6cef14da365675890920ff72f010c59527)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
Michał Górny
dbe7d8f601 Bug 34023: Prevent HTML injection in "back to results" link from search page
It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.

I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e86e81a2480ec5486660bac241c694210eaefa11)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
08bceb9d01 Bug 22990: (follow-up) Fix suggestion.pl
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 64500a92130f6e879b6a49b5ee7c9f45b7554170)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
3b2221a3cf Bug 22990: Fix template toolkit syntax issues in shelves_results.tt
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fd69581fcf743c6720cc8b5fba687f75fc613321)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
ec5ddabf59 Bug 22990: Fix for shelves table
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c0f232250e1186dd217e77db7e121a0b98a789cb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
Amit Gupta
49bd9bae3e Bug 22990: Add CSRF protection to boraccount, pay and suggestion
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Test plan would have been nioe.
Tested by changing MAX_AGE with suggestions.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 833d1dc8b082cc742b88e358edef77960b5ffc2f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
e0d8356d9d Bug 34368: Add CSRF token to Content Management pages
This change adds a CSRF token to the Content Management pages
at additional-contents.pl.

Test plan:
0. Apply patch
1. koha-plack --restart kohadev
2. Try to add "News", "HTML customizations", and "Pages".
3. Try to delete these new content entries
4. Note that you were successful in your endeavours

JD amended patch: remove empty line removal (no need to create
unecessary conflicts)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e97fae72141446b0a2fb06c454c601966e5f3494)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
3d648da398 Bug 30524: Unit tests
Test plan:
Run t/Output.t
Run t/db_dependent/Auth.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2918f6ceda533719ac0da53d8245ea4826f43681)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
c931804171 Bug 30524: Core CSRF checking code
Split out from bug 22990 as requested.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit aba9e61cfbab1e915f1be4a527b5708b9ec59c35)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-28 09:12:39 -10:00
6f20c9139b Bug 34029: (RMaint) fix DBRev name 2023-07-27 21:12:10 -10:00
Katrin Fischer
625d0f812a Bug 34181: Fix jQuery selector to make delete checkboxes reappear
Bug 32257 changed the page structure slightly to fix a display
issue with the labels. This resulted in a broken selector in the
function for displaying the checkboxes for deleting/emptying a
certain patron field.

To test:
* Go to Tools > Batch patron modifications
* Enter some cardnumbers or borrowernumbers
* On the batch patron edit form, verify that the checkboxes
  behind each input field are missing
* Apply patch
* Verify the checkboxes reappeared
  * Verify that for mandatory fields the checkbox is locked
* Make some batch edits and verify the checkboxes work as
  intended

Signed-off-by: Lisette Scheer <lisette.scheer@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d81b009ab0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-25 10:23:05 -10:00
f400830a56 Bug 34337: (bug 33581 follow-up) Sample patrons not inserted
The "select all" link for the optional sample data is not selecting
holidays and patrons.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 39496af98f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-25 10:20:52 -10:00
874ebe5792 Bug 34178: (QA follow-up) Tidy
Tidy the relevant lines to pass the new QA rules

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-25 10:20:52 -10:00
b1c4e5efd0 Bug 34178: Adjust tests
We need to clear the cache when changing rules/statuses

To test:
1 - prove -v t/db_dependent/Holds/DisallowHoldIfItemsAvailable.t

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-25 10:20:52 -10:00
52ca495955 Bug 34178: Cache ItemsAnyAvailableAndNotRestricted in memory and don't precalculate
There are several places in the code where we precalculate ItemsAnyAvailableAndNotRestricted to avoid
looping on this routine when calling IsAvailableForItemLevelRequest on a list of items form a biblio

The value of ItemsAnyAvailableAndNotRestricted is only used when there is a circulation rule for
'onshelfholds' with a value of '2' (If all unavailable)

Rather than calculate a value that may never be used, let's cache this value per request when we do
calculate it - and reuse the cached value

To test:
 1 - Apply patch
 2 - Set circulation rule 'On shelf holds allowed' as 'If all unavailable'
    make sure the rule applies to all of the items/patrons you test with
 3 - Find a record with two items that are available
 4 - Try to place a hold for a patron - not allowed
 5 - Check out one item to another patron
 6 - Attempt hold - still not allowed
 7 - Check out second item to another patron
 8 - Attempt hold - allowed!
 9 - Apply patch
10 - Cancel and replace hold - it is allowed!
11 - Check in one item, and cancel hold
12 - Place hold - not allowed!
13 - Check in second item
14 - Place hold - not allowed!
15 - prove -v t/db_dependent/Holds/DisallowHoldIfItemsAvailable.t

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2023-07-25 10:20:51 -10:00
84cfa20a73
RMAINT: Remove x-koha-query usage in biblios.t
RMAINT Comment: We remove x-koha-query in the header support
inadvertantly when backporting bug 33974. As such we backport the test
fix only for bug 33971.

This patch removes handling of x-koha-query from the tests.

To test:
1. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/biblios.t
=> SUCCESS: Tests pass
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests still pass! Change from x-koha-header to q= gives same
results.
4. Sign off :-D

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0f1b048b5d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 15:59:17 +01:00
4cdb3a57db
Bug 33671: (follow-up) Disable FK check for column change
See also BZ report. As suggested by Tomas.

NOTE: The dbrev is extended too for removing records with a failing guarantor_id
foreign key (theoretically not present obviously).

Test plan:
1) cp installer/data/mysql/db_revs/220600048.pl installer/data/mysql/atomicupdate/
2) Run updatedatabase.pl
3) Remove copied file

Bonus:
Manually remove FK constraint before running updatedatabase.
Insert a record with bad guarantor_id into relationships manually.
Run the update again.
You should not see the message that the constraint is removed.
Is the bad record count reported and record removed?

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Simplified. No longer removes the FK. Just disables during ALTER.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0397251ece)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:30:18 +01:00
835bc43d31
Bug 34303: Only perlcritic files from git repo
Test plan:
Run t/00-testcritic.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2bc251cfdd)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:29:35 +01:00
3fc7bc0c9e
Bug 31339: Add staff wrapper template include for tool plugins
This change adds a template include which can be used as a
WRAPPER for tool plugins, which makes it easy to pages in tool
templates without having to copy and maintain a lot of template
boilerplate.

Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Upload koha-plugin-test-wrapper
2. Enable the plugin
3. Click "Actions" and click "Run tool"
4. Note how the plugin page looks like a perfect Koha Tools page
5. Note that the plugin only contains 6 lines of template code
to achieve this effect

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit bc13d57e02)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:28:34 +01:00
2cb9fa1b52
Bug 29471: Add display of MARC 520 to staff interface detail page
At the moment 520 only displays in the OPAC. With this patch it
also displays in the staff interface detail page.

To test:
* Find a record with 520 or add some 520 entries to a record
  Note: different ind. 1 values will result in different labels
* View the record in the staff interface and the OPAC
* Verify only the OPAC shows the 520 entries
* Apply patch
* Verify now the staff interface displays them as well

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Updated patch for displaying $u as link.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Restored signoff line from Phil. Change only for $u.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 256518bf75)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:28:19 +01:00
5ffa76abe7
Bug 29732: Check alert in cataloguing authorities should be a static message
This patch modifies the authority record editor so that form
validation errors are collected in a static "dialog" at the top of the
page instead of showing in a transient JavaScript alert.

The text of the message is roughly the same as it was in the alert, and
links have been added so that the user can click to jump directly to the
field referenced.

If the user scrolls down away from the static error message, a button
appears in the floating toolbar to jump back to the message.

- Go to Authorities and create a new authority record using a framework
  which has multiple mandatory fields defined
  (e.g. an unmodified default framework)
- Without entering anything in mandatory fields, click the "Save"
  button.
- You should see a message box appear at the top of the page.
  - It should list each missing mandatory subfield and tag, each with a
    "Go to field" link next to it.
  - Clicking the "Go to field" link should switch you to the correct tab
    and scroll the mandatory field into view.
- When you have scrolled down far enough for the error messages to be
  offscreen, an "Errors" button should appear in the floating toolbar.
  Clicking it should scroll the box back into view.
- If you fix some but not all of the missing mandatory fields the
  message should update with only the current issues.
- Confirm that the record saves when all issues are resolved.

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5d572ec461)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:28:05 +01:00
32db2823b8
Bug 33270: (QA follow-up) Do not change param hashref
Might just be a theoretical thing now, but safer to clone.

Test plan:
Run t/db_dependent/Koha/Biblio/Metadata.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit cfbe8daf21)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:27:44 +01:00
1d11b4360a
Bug 33270: (QA follow-up) Tidy
Resolve:
WARN   tidiness
  The file is less tidy than before (bad/messy lines before: 21, now: 24)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b3aba2b065)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:27:44 +01:00
247ebf90b2
Bug 33270: (follow-up) Handle records that fail attempt to ignore bad characters
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit ea1a282b5e)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:27:44 +01:00
2e23ed06b7
Bug 33270: Attempt to recover from invalid metadata exception
This patch uses the new record_strip_nonxml routine to attempt to display
the record when it contains invalid characters

Rather than silently strippg these, we warn in the logs, then add an 'about'
container to the response. It is displayed nicely in the web view or sent as "INVALID_METADATA" in
the xml response

The 'error' codes for OAI seem to be at the request level, and the offered codes don't have a match
for a bad record. Adding the about when we can recover seems the most generous response

To test:
Test plan, assumes using KTD default data - otherwise you need to find and import a record with encoding issues:
 1 - Enable OAI-PMH system preference
 2 - Browse to:
    http://localhost:8080/cgi-bin/koha/oai.pl?verb=ListRecords&resumptionToken=marcxml/350////0/0/352
 3 - 500 error:
    Invalid data, cannot decode metadata object (biblio_metadata.id=368, biblionumber=369, format=marcxml, schema=MARC21, decoding_error=':8: parser error : PCDATA invalid Char value 31...
 4 - Apply patch, restart all
 5 - Reload the page
 6 - It loads!
 7 - Click 'Metadata' for record 369 - it succeeds!
 8 - Check the logs - confirm you see a warning of the record problem
 9 - Confirm 369 has an about section
10 - Check the individul 'GetRecord' response as well
    http://localhost:8080/cgi-bin/koha/oai.pl?verb=GetRecord&metadataPrefix=oai_dc&identifier=KOHA-OAI-TEST:369

Signed-off-by: Sam Lau <samalau@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c71468537b)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:27:43 +01:00
9544bd25a2
Bug 33270: Add record_strip_nonxml routine to Koha::Biblio::Metadata
This adds a routine that can strip non xml characters form a record.
It is intended for cases where we do not wish to throw an exception,
but rather need to process a record to allow other work to continue

To test:
prove -v t/db_dependent/Koha/Biblio/Metadata.t

Signed-off-by: Sam Lau <samalau@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 4997d59c83)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:27:43 +01:00
Jan Kissig
05f5c83140
Bug 34251: When using the fast add framework in addbiblio.pl there is thrown a JS error in selectTab( "#tab0XX_panel" );
This is because no nav tabs are build in addbiblio.tt as BIG_LOOP has a
length(size) of 1

To test:

1) go to More>Cataloging
2) click +New record
3) Click Settings> Fast add framework
4) take a look on console
5) try selecting a different framework now, will have no effect
6) apply patch and redo steps 1 to 5
7) there should be no error in console and a change in settings works a
   expected

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e3ff3a6204)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 09:19:07 +01:00
e7c83d93cf
Bug 34288: Unit tests
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fbc21148e7)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 08:32:47 +01:00
7a77ea6985
Bug 34288: (follow-up) Tidy block
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8e545cff75)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 08:32:47 +01:00
afacad6a2d
Bug 34288: Allow access to the cataloguing module with tools permission
Bug 31162 moved the cataloguing tools to a new cataloguing module home
page. This prevents people without cataloguing permissions, but with
some tools permissions to access things like the labels creator tool.

I tracked all permissions on the cataloging-home.tt template, including
the Stock Rotation ones which I initially missed because I was focusing
on tools.

This patch makes the cataloging-home.pl page require either
'cataloguing' or any relevant 'tools' permission to allow access. the
page.

The staff interface main page and the top bar dropdown are updated using
the same logic to display the cataloguing module link.

For that purpose, I wrapped the permissions on a sub in `C4::Auth`.

To test:
1. Have a patron with only 'catalogue' and some of this permissions:

* inventory
* items_batchdel
* items_batchmod
* items_batchmod
* label_creator
* manage_staged_marc
* marc_modification_templates
* records_batchdel
* records_batchmod
* stage_marc_import
* upload_cover_images
* stockrotation => manage_rotas

2. Log in
=> FAIL: No link to the cataloguing module, neither in the dropdown
3. Apply this patch
4. Repeat 2
=> SUCCESS: You have the link!
5. Play with the different combinations and notice things are sound and
   correct
6. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0db60995a8)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-19 08:32:47 +01:00
Katrin Fischer
853ced5fa1
Bug 29762: (follow-up) Change field names from phone to primary phone
This change is made in order to make sure that the labels on the
normal patron form and the batch patron edit tool match up.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3f80a0fcf7)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:51:04 +01:00
Philip Orr
cd56fda58d
Bug 29762: Change field names from "Mobile" to "Other phone"
This Patch changes the field name for "Mobile" to "Other phone"
in Patron batch modification.

To test:
1. Apply the patch
2. Go to Tools -> Batch Patron Modification and add some patrons
3. Hit "continue"
4. Verify that in the list of patrons you selected, the field
"Mobile" has been replaced by the field "Other phone"
5. Verify that down below in the fields to be batch modified,
the field "Mobile" has also been replaced by the field "Other
phone"
6. Add some data into the field "Other phone" (e.g. 12345 or
some other number) and hit save
7. Confirm that the field was correctly modified and is still
named "Other phone"

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 782bb4acf9)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:50:42 +01:00
Katrin Fischer
19e79589c2
Bug 34232: (QA follow-up) Remove superfluous "Use:" from each list entry
We do have a heading "Use existing item groups" above the
entries. The added "Use:" in front of each entry is not requires and
makes entries longer and harder to scan.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2c0ea36a00)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:49:46 +01:00
ebe3637a25
Bug 34232: Make dropdown on additem page rescept display order
To test:
1. EnableItemGroups
2. Find a record and add some new item groups with different display orders
3. Now edit an item on the record and scroll down to the dropdown underneath "+ Add to item group"
4. Notice that the values in the dropdown do not respect the display order.
5. Apply patch and restart_all
6. The display order should now be respected

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8065e3515a)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:49:46 +01:00
eba9d13660
Bug 33808: Add aria-labels in reports-toolbar.inc
This patch adds an aria-label and an aria-haspopup to Download buttons
identified as non-descriptive in accessibility testing

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8fac9067b2)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:47:58 +01:00
12ee1fde0d
Bug 33808: Add aria-labels in basket.tt
This patch adds an aria-label and an aria-haspopup to Download buttons
identified as non-descriptive in accessibility testing

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e0813a3b3d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:47:58 +01:00
b1ddaa0b15
Bug 33808: Add aria-labels in opac-basket.tt
This patch adds an aria-label and an aria-haspopup to Download buttons
identified as non-descriptive in accessibility testing

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit aa0f113f97)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:47:58 +01:00
c7ab9be9b0
Bug 33808: Add aria-labels in opac-shelves.tt
This patch adds an aria-label and an aria-haspopup to Download buttons
identified as non-descriptive in accessibility testing

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 429f0d6dce)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:47:58 +01:00
Michael Hafen
6d1748ed4c
Bug 34209: Follow up on Bug 28726 - move whole 'select all ...' header into condition
Move the whole search header div into the checkbox column condition, so
that other patron search popups don't have an empty div.

To test:
* Activate the ERM module
* Create a new agreement
* Search for a user using the pop-up search
* Verify there is an empty div showing as grey box above the table
* Go to tools > label creator > new batch
* Search for patrons
* Verify the box isn't empty and shows the select all ... options
* Apply patch
* Repeat steps, verify the empty div is gone and the options remain

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c2e5a32425)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:44:42 +01:00
Phil Ringnalda
a25c9e637b
Bug 34182: Don't set biblio.serial based on biblio.seriestitle in AddBiblio
A misunderstanding of the intention of some dead code that probably wanted
to set biblio.series (which doesn't exist) left us setting biblio.serial
if biblio.seriestitle was set. The only thing series and serial have in
common is the first four letters. We shouldn't set serial on something
with a series (unless someone also sets serial on it, of course).

Test plan:
 1. Administration - MARC bibliographic framework - Actions button next to
    Default framework - MARC structure
 2. In the Search for tag input type 942 and click search
 3. Actions button next to 942 - Edit subfields
 4. Tab s - check the checkbox for Editor, uncheck the checkbox for
    Collapsed - Save changes
 5. Cataloging - New record
 6. Click in the input for 000 and hold down Tab until you get past 008
    to fill in mandatory default values, then type any character in 040
    subfield c
 7. Tab 2 - In 245 subfield a type Series not serial
 8. Tab 4 - In 490 subfield a type any character
 9. Tab 9 - Set the value of subfield c to Books
10. Click save and leave the tab open to keep the biblionumber
11. Cataloging - New record - repeat step 6
12. Tab 2 - In 245 subfield a type Serial not series
13. Tab 9 - Set the value of subfield c to Books - Type 1 in subfield s
14. Click save, the biblionumber should be one higher than the first one
15. Reports - Create from SQL
16. Type something in Report name, paste in the SQL
SELECT biblio.serial, biblio.seriestitle, biblio.title FROM biblio WHERE
biblionumber IN ("","")
    and put your first biblionumber in the first "", your second in the
    second.
17. Save report - Run report
18. Series not serial should have a blank in the serial column and the
   character you typed in the seriestitle column; Serial not series
   should have a 1 in the serial column and a blank in the seriestitle
   column.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 65b7c67319)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:43:58 +01:00
cb07de6a98
Bug 34184: Add empty option for suggestion "document type"
Currently when editing a suggestion, the document type will preselect to the
first entry as we don't have an empty entry.
This can lead to data errors easily.

Test plan:
Create a new suggestion
=> Notice that "document type" is empty by default, pick one
Edit it again
=> Notice that the value is kept and empty can be picked, pick empty
Edit again
=> Empty is selected and saved in DB

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6485f244e0)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:43:43 +01:00
681c635024
Bug 34256: Fix regression from 34092
It appears search_fields variable got lost somewhere in my own rebases.
search_fields variable was not being considered as it should, in the function.
I think this patch fixes it.

This showed in the borrowernumer no longer being searchable:

* Use search filters in patron search
* Set 'Search field' to borrowernumber
* Search for 19 (Henry) or 41 (koha) in sample data
* No results :(
* Apply patch
* Search leads to the patron record again

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit bcabb5d247)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:42:51 +01:00
86c15fca16
Bug 34261: Add missing argument to show_account
This patch fixes a missing $crypt in the show_account function when deleting an edifact ordering account.

Test plan:
1) In system preferences search for EDIFACT and change EDIFACT to Enable
2) Navigate to Administration > EDI accounts
3) Create a dummy account
4) Try deleting the account using the delete button in the actions column on the far right
5) An error should be thrown - "Can't call method "decrypt_hex" on an undefined value"
6) Apply patch
7) Try deleting the account again
8) This time it should work and show the confirmation dialog box
9) Sign off

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0992769f6e)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:42:20 +01:00
a2a8cb86b0
Bug 33939: Preserve order budget dropdowns and default budget dropdowns seperately
The dropdowns have different hints after bug 22802. We need to preserve those when adding
or hiding inactive budgets

To test:
1 - Add some inactive budgets to Koha
2 - Use the settings and file from bug 22802 to stage a file and begin adding to basket
3 - When adding to basket test the 'Show inactive funds' on both the 'Select to import' tab and the 'Default accounting details' tab
4 - Ensure the dropdown hints/defaults don't change when hiding/showing budgets
5 - Confirm inactive budgets are correctly shown/hidden

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 80eb5ac35b)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:41:46 +01:00
45f5edc7c1
Bug 34225: KohaTable broken on batch item deletion and modification results
This patch adds the columns_settings include file to the batch item
modification and batch item deletion templates so that the tables can be
rendered as DataTables.

To test, apply the patch and go to Cataloging -> Batch item
modification.

- Submit a batch of barcodes or item numbers for modification.
- On the next page which shows all the items you submitted, the table
  should be rendered as a DataTable.
- Confirm that sorting, filtering, and export all work correctly.
- Confirm that there are not JS errors in the browser console.
- Perform the same tests on Cataloging -> Batch item deletion.

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8813c23a79)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:41:33 +01:00
8ecb70b338
Bug 33727: (QA follow-up) perl tidy whole file
Test plan:
Run prove again. Run qa tools.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c0f2a47d3c)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:40:38 +01:00
6052f0ec17
Bug 33727: Merge both Calendar tests
The old t tests become part of the first subtest.

Test plan:
Run the new t/db_dependent/Calendar.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2eb6c36c4d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-07-18 12:40:38 +01:00