Commit graph

2421 commits

Author SHA1 Message Date
9bdd33de21 Bug 14671: Allow correct translation of CAS authentication
In authentication pages with CAS, the use of acronym or abbr tags does not allow a correct translation of the text.
See http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5983#c7

It does not help a lot end users to know that CAS is Central Authentication Service, I think. Now one can custom the login page with NoLoginInstructions syspref to describe how to use the authentication.

This patch removes the use of acronym and abbr is authentication pages.

Test plan (example with fr-FR locale) :
- Without patch
- Update translation files : cd misc/translator ; perl translate update fr-FR
- You see in fr-FR-opac-bootstrap.po : msgid "If you have a "
- Is is translated in : msgstr "Si vous avez un compte "
- Apply patch
- Update translation files : cd misc/translator ; perl translate update fr-FR
- You see in fr-FR-opac-bootstrap.po : msgid "If you have a CAS account, %s please "
- You can now translate it : msgstr "Si vous avez un compte CAS, %s veuillez "
- Same test for intranet authentication page
- Install the translation : cd misc/translator ; perl translate install fr-FR
- Look at the result

Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as advertised. Tranlated OK, tested in spanish es-ES

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-10-02 15:07:58 -03:00
Winona Salesky
67fa231a74 Bug 14054: 246 XSLT Improvements
Adds other title type based on ind2 value. ind2 overridden by $i value.

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-09-28 11:52:08 -03:00
1b8f3194e9 Bug 14509: Reject invalid passwords
Bug 10177 rejects password with leading or trailing whitespaces, but
only on the member-password page.
It's not consistent to only do this check on 1 place.
This patch adds the check for the 2 other places: memberentry and at the
OPAC.

Test plan:
1/ Edit a patron and set a password with leading and/or trailing
whitespaces. You should not be allowed to do it (no server side check).
2/ Same at the OPAC ("Change you password" tab). Here there is a server
side check.

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-09-28 11:51:08 -03:00
2d69e143d8 Bug 14904: Resolve warning from tt_valid.t
Test tt_valid.t warns that opac-retrieve-file.tt has no id and class
attribute on the body tag.
This patch adds them to clear the warning.

Test plan:
Apply patch and run xt/tt_valid.t.

Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-09-28 11:49:13 -03:00
83ea49a009 Bug 14321: Integrate Upload.pm into Koha
This patch makes the following changes to achieve that:
[1] Use Upload.pm in stage-marc-import.pl, upload-cover-image.pl,
    offline_circ/process_koc.pl and enqueue_koc.pl.
[2] A new file-upload.js replaces file-upload.inc in the associated template.
    We now use ajax to get progress figures instead of launching perl script
    upload-file-progress.
    The js changes now also allow for aborting a file upload.
[3] Adds a tools/upload script and template. It allows to upload multiple
    files at once.
[4] Makes upload-file return error messages in JSON. For a multiple upload,
    we could have some files with errors and others without errors.
    The upload is now marked as Failed only if there was no upload at all.
[5] The upload plugin is converted to use tools/upload with plugin param.
    Deleting an upload is now presented via the search results form.

NOTE: In editing the process_koc.tt I noticed that the form enqueuefile was
hidden and no longer used (with associated code in process_koc.pl). When a
file has been uploaded, I display the form again (with the Apply directly
button). The code still works.

NOTE: We fix an error in upload-file from one of the patches of bug 6874.
The userid of the Koha admin user is passed to haspermission, but we
should pick the userid from the session.

NOTE: Bug 14686 will add a specific permission for tools/upload.pl, and
will add the tools/upload script to the Tools menu.
For now, you need edit_catalogue to start upload.pl and you will
additionally need a permission like upload_local_cover_images
to successfully upload a new file.

Test plan:
[1] Upload a marc file in stage-marc-import. (This is temp storage.)
[2] Check new entry in table uploaded_files. Look for the file in your
    temporary directory (/tmp ?), subfolder koha_upload.
    Bonus: Remove permissions on this subfolder. Retry, check error and
    restore permissions again.
[3] Upload another (larger) file and abort the upload. Check table and
    directory again. You should have a partial file, but no record.
[4] Verify that Stage for import still works as expected.
[5] Test Upload local cover image. (Enable OPACLocalCoverImages.) You can
    test an individual image or a zip file including images and a file
    called datalink.txt (with lines biblionumber,filename).
[6] Test uploading a offline circulation file:
    Enable AllowOfflineCirculation, and create a koc file (plain text):
    Line1: Version=1.0\tA=1\tB=2
    Line2: 2015-08-06 08:00:00 345\treturn\t[barcode]
    Note: Replace tabs and barcode. The number of tabs is essential!
    Checkout the item with your barcode.
    Go to Offline circulation file upload. Upload and click Apply directly.
    Checkout again. Upload again, click Add to offline circulation queue.
[7] Upload three files via tools/upload.pl with a category and marked as
    public. Check the results in the table.
    Verify that you can download the file in OPAC without being logged in.
[8] Pick one new file and one of the files of step 7. Upload them in the
    same category. One upload should succeed. Check for reported error.
[9] Connect upload.pl to field 856$u.
    Goto Cataloguing editor.
    In an empty 856$u, click the tag editor. Upload a file and click Choose.
    Save the record. Open the record in the OPAC and click the link.
    Copy this link to your clipboard for next step.
[A] Go back to editor. Click the tag editor on the same 856 field.
    Choose for Delete.
    Open the link in your clipboard again. Error message?
[B] Check the process of upload, search, download and delete of an upload
    with some diacritical characters in the filename. (Bonus points for
    adding special chars in the category code.)
    Note: You can add categories via authorized values, UPLOAD key.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Bug 14321: [QA Follow-up] Perltidy upload.pl

Run perltidy -pro=xt/perltidyrc on tools/upload.pl.
No other changes.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-09-25 12:02:52 -03:00
73e9dcb70f Bug 14760: Disabled courses display in the course reserves list for items
If an item is on reserve for two courses but one of those courses is
disabled, both courses are still listed on opac-detail.pl!

Test Plan:
1) Enable course reserves
2) Create two courses
3) Place one item on reserve for both courses
4) Disable one of the two courses
5) View the record details for that record/item
6) You should see both courses listed in the course reserves column
7) Apply this patch
8) Reload the page
9) You should now only see the active course in the course reseves column

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-09-07 12:08:40 -03:00
Winona Salesky
8749411abd Bug 13383: 100/110/111 changes to XSLT
Test plan:
1) Apply this patch
2) Ensure you are using the default XSLT setting for the staff and opac search results and record details
3) Find or create a record with MARC tags 100,110,111
4) Perform an opac search that would show the record in the search results.
5) Click title to review record.
6) Note the fields updates 100,110,111 to show subfields a,b,c,d,q and t.Multiple fields are separated by span class=separator |. Includes 100$j and handles multiple relator terms/codes.
7) Repeat steps 4 - 6 for the staff interface

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-08-28 09:39:26 -03:00
Winona Salesky
16f382e7ec Bug 13387: Uniform titles (130 / 240 / 730) Display in XSLT
Test Plan:
1) Apply this patch
2) Ensure you are using the default XSLT setting for the staff and opac record details
3) Find or create a record with MARC tags 130/240/730
4) Perform an opac search that would show the record in the search results.
5) Click title to review record.
6) Fields show subfields a,d,f,g,h,k,l,m,n,o,p,r,s,t with multiple fields separated by span class=separator |
7) Repeat steps 4 - 6 for the staff interface

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-21 10:44:03 -03:00
Liz Rea
c6d24b15ce Bug 14652: change gender specification from "N/A" to "None specified"
To test:

Edit a patron in the intranet, note that the gender options are "Female," "Male," and "None specified"

Setting "None specified" should result in the gender not being shown on the patron detail page (unchanged functionality)

In the opac, log in and click the "your personal details" tab, and note that the gender options are "Female," "Male," and "None specified"

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-21 10:03:06 -03:00
Winona Salesky
a1359d8b83 Bug 13734: RDA: Display 33xs
Test Plan:
    1) Apply this patch
    2) Ensure you are using the default XSLT setting for the staff and opac search results and record details
    3) Find or create a record with MARC tags 336,337,338
    4) Perform an opac search that would show the record in the search results.
    5) Click title to review record.
    6) Adds fields 336, 337 and 338 to staff and opac details. Adds comma between multiple subfields and | with class='separator' between multiple datafields (e.g. two 336 fields)
    7) Repeat steps 4 - 6 for the staff interface

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works, no errors

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-21 09:58:35 -03:00
Winona Salesky
3cbed1e65e Bug 14181: MARC21 773 -- Display when ind1 = 0 or blank
Display 773 in opac and staff details when ind1 !=1

Test plan
=========

1/ Add a new record which uses the 773 field to an instance running
   master code. (the selected MARC framework should have the 773's
   relevant sub-fields enabled and visible on staff client, opac and
   the editor).
2/ Set ind1 as '0' (zero). The note should be displayed both on OPAC
   as well as the staff client.
3/ Reset ind1 with a non-zero value or leave it blank. The display
   note should no longer be visible from either client or opac.
4/ Apply the patch.
5/ Repeat step #1 and #2. The note is displayed on staff and opac.
6/ Repeat step #3. The display note should be visible on both staff
   and opac.
7/ run koha-qa.pl -c 1 -v 2

Note : For #1 above, the following LoC record was used:
       http://www.loc.gov/marc/bibliographic/examples.html#monographic

       The patch applied cleanly and performed as expected.

       The koha-qa.pl gave OK as results.

Signed-off-by: Indranil Das Gupta  <indradg@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-20 13:49:44 -03:00
Martin Stenberg
d5a5e9576e Bug 14675: Don't update details if no changes made
if no changes has been made for personal details, bring user back to details
page and inform them that no changes has been made.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-20 13:42:04 -03:00
cb1ac9f36a Bug 13485: Use the Koha template plugin to access syspref values
And remove the useless use of the KohaDates plugin

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-11 15:15:36 -03:00
Simith D'Oliveira
43fadbadea Bug 13485: Add a page to display links to restricted sites
To test:

I) Apply the patch
II) Run updatedatabase.pl

scenario I)

1) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
2) Add your machine ip (ex. 127.0.0)
3) Validate cgi-bin/koha/opac-proxypage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents.

scenario II)

1) Logout opac page
2) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
3) Add other ip that your machine ip.
4) Validate: cgi-bin/koha/opac-proxypage.pl shows a login page.
5) Validate: cgi-bin/koha/opac-proxypage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents after login.

Followed both scenarios, works as expected.
Signed-off-by: Marc Veron <veron@veron.ch>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Bug 13485 [QA Followup]

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Bug 13485 - Atomic Update + Rename Proxy page to Restricted page

Test plan:

I) Apply the patch
II) Run updatedatabase.pl

scenario I)

1) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
2) Add your machine ip (ex. 127.0.0)
3) Validate cgi-bin/koha/opac-restrictedpage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents.

scenario II)

1) Logout opac page
2) Add some content in RestrictedPageContent and RestrictedPageTitle sysprefs.
3) Add a diffrent ip.
4) Validate: cgi-bin/koha/opac-restrictedpage.pl shows a login page.
5) Validate: cgi-bin/koha/opac-restrictedpage.pl shows a page with RestrictedPageContent and RestrictedPageTitle contents after login.

	new file:   installer/data/mysql/atomicupdate/Bug13485_RestrictedSitesPage.sql
	modified:   installer/data/mysql/sysprefs.sql
	modified:   koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
	renamed:    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-proxypage.tt -> koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-restrictedpage.tt
	renamed:    opac/opac-proxypage.pl -> opac/opac-restrictedpage.pl

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-08-11 15:15:16 -03:00
Mark Tompsett
c0a52bb198 Bug 13948: Prevent explosion when Template::Plugin::Stash not installed
TEST PLAN
---------
1) Install first two patches
2) do not install, or uninstall Template::Plugin::Stash
3) Upgrade to make sure system preference is added.
4) Set the system preference to turn it on for Staff and OPAC
5) Refresh staff -- kaboom
6) Load OPAC -- kaboom
7) Apply this patch
8) Reload staff and OPAC
   -- nice HTML comment about what is wrong.
9) run koha qa test tools.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Neat, runs well. Tested with/without sysprefs and Template::Plugin::Stash
No koha-qa errors

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
2015-07-28 10:30:21 -03:00
aa356f47ea Bug 13948: Add ability to dump template toolkit variables to html comment
It would be incredibly helpful if we could easily enable Koha to dump
all Template Toolkit variables to a comment for debugging purposes.

Test Plan:
1) Apply this patch
2) Run updatedatabase
3) Enable the new system preferences DumpTemplateVarsIntranet and
   DumpTemplateVarsOpac
4) Load a page in the staff intranet, view the html source
5) Note the template toolkit variables are embedded in an html comment
6) Load a page in the opac, view the html source
7) Note the template toolkit variable are embedded in an html comment

NOTE: I had to cpan2deb Template::Plugin::Stash to test.
      This is not optimal. Additionally:
      http://www.template-toolkit.org/docs/modules/Template/Plugin/index.html
      does not contain Stash. I suspect this was how it was
      introduced initially by TT.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-07-28 10:29:43 -03:00
cf5df6590d Bug 5685: [OPAC follow-up] Validation of email address field
This patch makes a few changes to the way errors are handled in the
OPAC:

- The validation plugin has been moved from the global include file to
  the template itself. Since we aren't doing form validation on any
  other page yet it doesn't make sense to include it globally at this
  time.

- The error message which appears if you have JavaScript disabled and
  have submitted invalid emails was styled in a non-standard way.

- I have added in-page links to the error message which appears if you
  have JavaScript disabled so that you can click to jump to the field
  which contains the error.

- I have modified the error message language slightly to make it (I
  hope) read better.

Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-07-24 13:47:57 -03:00
342a7a1205 Bug 5685: [Compiled CSS] Validation of email address field
This patch contains the recompiled opac.css file based on changes made
to opac.less in the previous patch.

Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>

FIXED the compress. - mtompset

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-07-24 13:47:49 -03:00
Juhani Seppälä
ab1fd8a556 Bug 5685: Validation of email address field
This patch adds server-side & client-side validation for email
form fields in the members/memberentry -view and in the
opac/memberentry-view (bootstrap).

I recently added simple validation for phone number and email address fields
for our in-house koha and saw this old bug: I'm open to any ideas on how
to do this better. Validation for phone numbers would be easy to add on
top of this but I left it out since this bug is only about the email
fields.

To test:
1) Select a member and go to any of the edit forms with email fields
(Primary info, "Library use", "Alternate address", "Alternative
contact").
2) Disable javascript in the browser in order to test server-side
validation and try to input invalid emails in each of the email form
fields.
3) Confirm that an invalid address is catched from any of the email
fields, an alert shown for each invalid address and that the member's
information was not updated with invalid data.
4) Enable javascript in the browser.
5) Confirm that the jquery validation plugin caches invalid addresses
from any of the email fields and that you cannot send the form before
correcting the problem.
6) Perform the same tests for the opac-memberentry-view.

Note: as the jQuery validation plugin doesn't exist in the bootstrap
folder, I just copied it over from the staff-client folder -how to deal
with this?

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

I have undone the changes to opac.css so that they can be submitted as a
separate patch. I have some other follow-ups to make as well.

Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-07-24 13:47:32 -03:00
Jonathan Druart
f8abcf3e8e Bug 12137: Use Koha.Preference to access pref value
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
2015-07-20 10:44:06 -03:00
Jonathan Druart
0183cc0223 Bug 14404: Rename class no-show to noshow for consistency with nosort
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-07-20 10:34:00 -03:00
e9061028c1 Bug 14404: Checkouts default sort order for Self Checkout (SCO) confusing for patrons
Libraries are reporting that patrons are very confused during
self-checkout. The problem is they are expecting the list of checkouts
to be in the order they checked out the items ( first checkout on the
bottom, last item checked out on top ). However, the checkouts
table is sorted by title ( ascending ) then due date ( descending ).
This is not intuitive.

Test Plan:
1) Enable Koha's self checkout
2) Use the SCO to check out a random assortment of items,
   make sure you don't check them out in alphabetical order
3) Note the order of the items in the list is not based on the order
   you checked them out in
4) Apply this patch
5) Refresh the page
6) Note the items are now in the order you checked them out
   with the last on top and the first on bottom

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-07-20 10:33:51 -03:00
ff280e01f4 Bug 14524: Don't escape query_cgi with uri
According to the doc, we should not escape query_cgi with the uri
filter:
http://www.template-toolkit.org/docs/manual/Filters.html#section_uri

Since query_cgi can contains something like: "idx=kw&q=42", we should
not escape the & char

Test plan:
0/ Don't apply the patch
1/ Go on launch a search at the OPAC
2/ Click on the RSS icon
3/ You should arrive on
opac-search.pl?idx%3Dkw%26q%3D42&count=50&sort_by=acqdate_dsc&format=rss2
The & has been escaped.
4/ Apply the patch
5/ Now you should get result and see an url correctly formatted.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-07-20 10:20:20 -03:00
Winona Salesky
058b50de5b Bug 14326: XSLT Syntax error in MARC21slimOPACResults.xsl
Test Plan:
1) Apply this patch
2) Ensure you are using the default XSLT setting for the staff and opac  record details
3) Perform an opac search check "Availability" for expected display values.
5) Note this patch corrects invalid syntax in xslt, there should be no visable changes to the results page.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-07-07 15:37:56 -03:00
Mark Tompsett
aa88125f62 Bug 14345: broken isbn logic prevents display of idreambooks image
TEST PLAN
---------
1) Ensure you have a book that would pull up an idreambooks image
   (e.g. The road to character / David Brooks.)
   -- I imported from the Library of Congress via z39.50
2) Ensure your system preferences for idreambook stuff is set.
3) Ensure you have multiple 020$a's for your book, and
   the first one must just be an ISBN number!
   -- I removed the '(hardcover: acidfree paper)' from the first.
   -- I took the second 020 field and changed 020$z to 020$a
4) Search for that book in OPAC and go to details.
   -- There should be a readometer image, but it will be broken.
   -- Notice the ISBN line has "#############; ..."
      This could also be attained by just putting two semi-colon
      separated ISBN's on the first 020$a.
5) Apply this patch
6) Refresh page
   -- readometer image appears. YAY!
7) run koha qa test tools

NOTE: Only changed test plan, so leaving sign-off on.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-07-07 15:33:03 -03:00
Jonathan Druart
f194bca268 Bug 14002: Display readonly values as plain text
There is no need to display the cardnumber and expiration date values in
a disabled input.

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-25 14:48:10 -03:00
Katrin Fischer
69baa022a5 Bug 14002: Show patron expiry date in OPAC
This patch makes it possible to show the expiration date
of a patron account in the OPAC on the details tab in the
patron account.

Extras:
- Makes it possible to hide cardnumber with
  PatronSelfRegistrationBorrowerUnwantedField

To test:
- Toggle OPACPatronDetails and test date expiry always shows
- Check PatronSelfRegistrationBorrowerUnwantedField for dateexpiry
  and cardnumber
- Verify a patron address modification request still works
  as expected

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-25 14:48:10 -03:00
f1acb5615d Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)
Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects opac/opac-ratings.pl

Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-25 14:41:21 -03:00
Jonathan Druart
7e449548e8 Bug 14252: Add sort by rfc4646_subtag in footer
This patch sort by rfc4646_subtag the languages in the footer.
Same as in the header.

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:47 -03:00
Indranil Das Gupta
3a179e7a2b Bug 14252: (followup) addresses the QA Manager comments
Addresses Katrin's comments in comment# 56

TEST PLAN
---------
 1) Back up your DB
 2) Ensure you have multiple languages, including
    some that have sub-languages (e.g. de-DE, de-CH)
    -- cd misc/translator
    -- perl translate install {language code}
 3) Ensure that you have all the languages enabled
    -- Staff client -> Home -> Global system preferences
       --> I18N/L10N
       Check all the languages in opaclanguages.
       Ensure that opaclanguagesdisplay is 'Allow'
 4) Open OPAC
    -- should only have languages in footer.
       Annoyingly below the fold.
 5) Drop your koha database, and create a blank one.
 6) Apply all patches
 7) Reinstall all the known languages, so the templates
    are appropriately updated.
 8) Go to staff client and do an install of koha, with
    all the dummy data.
 9) Ensure you have all the languages enabled (see (3))
10) Refresh your OPAC page
    -- language selector position should be in both
       the footer and at the top as expected.
    -- this confirms the sysprefs.sql change.
11) Restore your DB
12) run the updatedatabase.pl script
13) Ensure you have all the languages enabled (see (3))
14) Refresh the OPAC page
    -- should still only have languages in the footer.
    -- this confirms that upgrade won't change anything.
    -- this confirms the atomic update.
15) git diff origin/master
    -- the opac-bottom.inc difference should only
       have changes around a SET, IF, and END.
       This confirms the noprint was fixed.
16) In the staff client, change the OPAC system preference,
    OpacLangSelectorMode, to all three values.
    For each value, refresh the OPAC page, and confirm the
    position of the language selector.
    -- should work as expected.
17) run koha qa test tools

NOTE: Tested as a single batch together.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Mark Tompsett
c446a4da4e Bug 14252: Follow up noprint and default values
TEST PLAN
---------
0) Back up your DB
1) open OPAC
   -- should only have languages in footer.
      Annoyingly below the fold.
2) Drop your koha database, and create a blank one.
3) Apply all patches
4) Go to staff client and do an install of koha, with
   all the dummy data.
5) Once installed, refresh your OPAC page
   -- language selector position should be in footer
      still as expected.
   -- this confirms the sysprefs.sql change.
6) Restore your DB
7) run the updatedatabase.pl script
8) Refresh the OPAC page
   -- should still only have languages in the footer.
   -- this confirms that upgrade won't change anything.
   -- this confirms the atomic update.
9) git diff origin/master
   -- the opac-bottom.inc difference should only
      have changes around a SET, IF, and END.
      This confirms the noprint was fixed.
10) In the staff client, change the OPAC system preference,
    OpacLangSelectorMode, to all three values.
    For each value, refresh the OPAC page, and confirm the
    position of the language selector.
    -- should work as expected.
11) run koha qa test tools

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
abbd51fb00 Bug 14252: (fix) address the indentation for the lang loop
tidy the indentation for that lang selector loop code.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
8da9d099c6 Bug 14252: (Followup) Fixed issues pointed to in comment #40
Based on Mark's inputs in comment #40 -

[1] selected 'mast' (short of 'masthead') and updated :
   (a) bug_14252-OpacLangSelectorMode_syspref.sql
   (b) sysprefs.sql
   (c) opac.pref
[2] Reduced the calls to Koha.Preference() from :
   (a) masthead.inc
   (b) opac-bottom.inc

After applying this patch, update the database once for it to pick
up the new option values -'both|mast|foot'.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
a2478a708b Bug 14252: (followup) Adds OpacLangSelectorMode syspref
Based on discussion, this followup does the following:

1/ brings back the switcher on opac-bottom.inc
2/ adds a syspref OpacLangSelectorMode to toggle between the three
   modes:
     (a) show switcher both on masthead and footer (default)
     (b) footer only
     (b) masthead only

Test plan
=========

1/ apply earlier patches attached to this bug in their correct order
2/ apply this followup patch
3/ run updatedatabase.pl to add in the atomic update
4/ goto admin/preferences.pl?tab=opac
5/ look up OpacLangSelectorMode, it should be set with default value
   "both masthead and footer"
6/ check OPAC to see if both locations show the selectors
7/ change OpacLangSelectorMode to 'only header' and 'only footer' at
   each iteration, and check if the selection has correctly toggled
   the selectors. It should

Note: make sure you do not have the patch 11057 applied on the branch
      from before, otherwise merge conflict might happen.

http://bugs.koha-community.org/show_bug.cgi?id=14252

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Bernardo Gonzalez Kriegel
36e68aaaa9 Bug 14252: (followup) fix lang chooser for sublanguages
This quick fix disables sublanguages dropdown,
show all sublanguages on same level.

To test:
1) Apply both patches
2) Translate to have sublanguages (en-NZ, de-DE, de-CH)
3) Go to opac, confirm you can select any lang/sublang
4) Check on movil device

4th version.
Removed rfc4646 subtag on sublanguages, think it's cleaner.
Currently on master all translated languages/regions have
valid description ('en' at least)
Added language sort using rfc4646 subtag

Signed-off-by: Indranil Das Gupta <indradg@gmail.com>
Followup fixes the issue with lang group dropdowns. Works well
across standard desktop as well as mobile device with small screens
(checked on 4.3" / 4.7" / 5")

Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
2845fb2423 Bug 14252: Move OPAC lang switcher to masthead navbar
The OPAC language switcher takes up a lot of space at the bottom of the
browser. It also has issues of being not always visible.
This patch adds the switcher to the masthead navbar and removes from the
opac-bottom.inc navbar.

Test plan
=========

1/ Apply patch
2/ Set opaclanguagesdisplay syspref to 'show'.
3/ Add a few languages i.e. es-ES, fr-FR and de-DE
     $ cd misc/translator
     $ perl translate <langcode>
4/ Enable installed languages for OPAC use by checking on 'opaclanguages'
   under I18N/L10N sysprefs
5/ Go to the OPAC, you should have a "Languages" dropdown on the masthead
   navbar, the opac-bottom.inc navbar should no longer be there.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works, no koha-qa errors.
Followup fix language chooser for sublanguages

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:37 -03:00
Mark Tompsett
cb28aa454a Bug 5025: discrepancy between opac doc-head-open.inc and staff doc-head-open.inc
http://library.debiankoha.ca/cgi-bin/koha/errors/400.pl
http://library.debiankoha.ca/cgi-bin/koha/errors/401.pl
http://library.debiankoha.ca/cgi-bin/koha/errors/402.pl
http://library.debiankoha.ca/cgi-bin/koha/errors/403.pl
http://library.debiankoha.ca/cgi-bin/koha/errors/404.pl
http://library.debiankoha.ca/cgi-bin/koha/errors/500.pl
http://library.debiankoha.ca/cgi-bin/koha/ilsdi.pl
Set OpacMaintenance to "Show" in the Staff client system preferences.
http://library.debiankoha.ca/cgi-bin/koha/maintenance.pl
Set OpacMaintenance to "Don't show" in the Staff client system preferences.
http://library.debiankoha.ca/cgi-bin/koha/opac-ISBDdetail.pl?biblionumber=5390
http://library.debiankoha.ca/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=5390
Log into OPAC Client
http://library.debiankoha.ca/cgi-bin/koha/opac-account.pl
http://library.debiankoha.ca/cgi-bin/koha/opac-search.pl
-- This is actually the advanced search.
FIXME: Don't know how to trigger opac-alert-subscribe.tt
FIXME: Don't know how to trigger opac-auth-MARCdetail.tt
FIXME: Don't know how to trigger opac-auth-detail.tt
FIXME: Don't know how to trigger opac-auth.tt
Click 'Authority search' in OPAC
Click 'Submit'
Search for something in the catalog
Click 'Select all'
Change 'With selected titles:' drop down to 'cart'
View the cart.
Click 'Send'
Click 'Cancel'
Click 'Download'
Click 'Cancel'
Close cart window
Search for something in the catalog
Select 'Select all'
Change 'With selected titles:' drop down to '[ New List ]'
Save the list
Click 'Lists'
Click the list you saved
Click 'Download list'
Click 'Cancel'
Click 'Send list'
Click 'Cancel'
Copy the URL from download list and remove the '&context=modal'
Click 'Cancel'
http://library.debiankoha.ca/cgi-bin/koha/opac-blocked.pl
http://library.debiankoha.ca/cgi-bin/koha/opac-browser.pl
FIXME: Don't know how to trigger opac-course-details.tt
http://library.debiankoha.ca/cgi-bin/koha/opac-course-reserves.pl
http://library.debiankoha.ca/cgi-bin/koha/opac-detail.pl?biblionumber=5336
FIXME: Don't know how to trigger opac-full-serial-issues.tt
http://library.debiankoha.ca/cgi-bin/koha/opac-imageviewer.pl
http://library.debiankoha.ca/cgi-bin/koha/opac-main.pl
Click on the user name in the top area.
Click the 'your personal details' tab.
Change the birth date.
Click 'Submit'
http://library.debiankoha.ca/cgi-bin/koha/opac-messaging.pl
http://library.debiankoha.ca/cgi-bin/koha/opac-overdrive-search.pl
Click on the user name in the top area.
Click the 'change your password' tab.
Set OPACPrivacy to "Allow" in the Staff client system preferences.
Refresh OPAC page
click on the user name in the top area.
Click the 'your privacy' tab.
Click the 'your reading history' tab.
Change the PatronSelfRegistration to "Allow" in the Staff client system preferences.
Change the PatronSelfRegistrationCategory to "PT" or some other valid patron category code.
Change the PatronSelfRegistrationAdditionalInstructions to something.
Refresh OPAC page
Log out
Click the 'Register Here' link.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Tested most pages, inspected all of them.
No errors

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-22 17:04:48 -03:00
Katrin Fischer
6d9d66e32a Bug 14094: DDC - Add separators for repeated $a subfields (MARC21)
Mulitple 082 fields are already separated by |, but multiple
$a in one 082 field were only separated by space, making those
not easy to read.

Patch takes care that the | separator is used in all cases.

To test:
- Catalog a record with multiple 082 fields
- Add one or multiple $a subfields to each
- Verify every single classification is separated from
  the others with a | in staff and in OPAC detail pages

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:48:18 -03:00
Jonathan Druart
68f0fe7b6f Bug 10172: Hide some uneeded stuffs on printing a record
When printing a record from the OPAC or the staff interface, some
uneeded blocks are displayed.

OPAC:
1/ Browse results
2/ The view tags (Normal, MARC, ISBD)

Intranet:
1/ Marc view link
2/ The Please upload one image link

Test plan:
On a record detail page (staff and OPAC), print the page and confirm
these blocks no longer appear.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:10:06 -03:00
Chris Cormack
cd4c959f72 Bug 14418: More XSS vulnerabilities in opac-shelves.pl
To test:
1/ Hit a url like
/cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh
noes')</script>  Where the id is a valid shelf id
2/ Notice the js is executed
3/ Apply patch
4/ Reload page
5/ Notice input is now escaped on display

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tested in Debian, couldn't reproduce the alert in Iceweasel, but in
Chromium. Patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:10 -03:00
Chris Cormack
b6ca2b0cd2 Bug 14418: XSS flaw in opac-shelves.pl
To test:
1/ Create a list and add at least one item to it
2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
  Where the shelf id is the number of the list you created, notice the js is executed
3/ Apply the patch
4/ Reload the page notice the js is now escaped

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:10 -03:00
Chris Cormack
45dd775401 Bug 14418: XSS Vulnerabilities in OPAC search
Fix for /cgi-bin/koha/opac-search.pl

To test

1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script
src='http://cst.sba-research.org/x.js'/>&q=a
2/ Notice the js is executed
3/ Apply patch
4/ Reload page, notice it is no longer executed
5/ Test the rss links work still

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed bug and that the patch fixes it.
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:10 -03:00
Jonathan Druart
abd2bc99e8 Bug 14416: (follow-up) opac addbybilionumber
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:09 -03:00
Chris Cormack
fb51a4bb0f Bug 14416: Stored XSS vulnerability
opac-addbybiblionumber.pl is also vulnerable because it doesn't escape
list names.

To test
1/ Create a malicious list name
2/ Try to add a biblio to the lists
3/ Notice js is excuted
4/ Apply patch
5/ Test again

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:09 -03:00
Jonathan Druart
be35039b55 Bug 4137: Fix the OPACViewOthersSuggestions behavior
This pref does not work at all, the interface let the user choose to
list all suggestions, but whatever he chooses the suggestion list is the
same.

This patch cleans a bit the suggestedby management.

There are a lot of cases to test, because linked to 2 prefs:
 AnonSuggestions and OPACViewOthersSuggestions.
1/ AnonSuggestions = 0 and OPACViewOthersSuggestions = 0
  - A non logged in user is not able to make a suggestion.
  - A logged in user is not able to see suggestions made by someone else.
2/ AnonSuggestions = 0 and OPACViewOthersSuggestions = 1
  - A non logged in user is not able to make a suggestion.
  - A logged in user is able to see suggestions made by someone else.
3/ AnonSuggestions = 1 and OPACViewOthersSuggestions = 0
  - A non logged in user is able to make a suggestion.
  The suggestedby field will be filled with the AnonymousPatron pref value.
  He is not able to see suggestions, even the ones made by AnonymousPatron.
  - A logged in user is not able to see suggestions made by someone else.
4/ AnonSuggestions = 1 and OPACViewOthersSuggestions = 1
  - A non logged in user is able to make a suggestion.
  He is able to see all suggestions.
  - A logged in user is able to see suggestions made by someone else.

In all cases a logged in user should be able to search for suggestions
(except if he is not able to see them).

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All use cases tested, work as expected
No errors

Only comment is perhaps (in the future) a gracefull failure
when AnonymousPatron is not set, or has '0' value

Message is DBIx::Class::ResultSet::create(): Column 'suggestedby' cannot be null at ...

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:34:27 -03:00
Katrin Fischer
7ab873aaea Bug 11467: Bug Untranslatable srings in opac-detail.tt (IDreamBooks*, OpacBrowseResults)
Patch marks several strings in the Javascript on the OPAC detail
and result page for translation.

1) IDreamBooks*
- Activate the 3 IDreamBooks* system preferences
- Check the 'cloud' and additional content shows up correctly on
  the detail and result pages
- Verify everything works as expected and the same as without the patch

2) OpacBrowseResults
- Activate OpacBrowseResults
- Do various searches
- Verify the nex, previous, browse result list features still
  work the same as without the patch

Bonus: Check new strings appear in the .po files by updating one
       language with the patch applied (perl translate update de-DE)

NOTE: Really should have read the test plan more closely.
      I couldn't find the 'Go to detail:' section, until I clicked
      'Browse results'.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:09:43 -03:00
Aleisha
892d374b64 Bug 11011: Rephrasing 'in keyword' in OPAC authority search
Using 'in the complete record' rather than 'in keyword'. I think this fits well as it seems that this means the search looks anywhere in the record.

To test:

1) In the OPAC, click on Authority Search
2) Notice that in the drop-down menu for the 'Where:' field, there is an 'in keyword' option.
3) Apply patch
4) Now says 'in the complete record'

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:08:50 -03:00
Aleisha
9bef8f8738 Bug 14360: Unescaped variable causes alert pop-up
To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:04:41 -03:00
Aleisha
9e920f7479 Bug 14360: Unescaped variable causes alert
Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:04:40 -03:00
4fd923e12e Bug 14329: Useless copy/pasta from Template::Plugin::HtmlToText
The synopsis of this TT plugin contains two example lines:
[% myhtml FILTER html2text(leftmargin => 0, rightmargin => 0) %]
[% myhtmltext | html2text %]

These lines have been copied (without too much thought :) to a few templates. Since we do no use the variables myhtml or myhtmltext in these templates, these lines are useless.

Test plan:
[1] Put some items in your cart. And send it.
[2] Send a shelf.
[3] Git grep on myhtml. Should not have results.

NOTE: Sent carts and lists in Intranet and OPAC successfully.
      Though, this does bring into question why the letters
      have HTML formatting if it is getting removed. That,
      however, is beyond the scope of this bug.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-08 09:47:06 -03:00