Commit graph

2899 commits

Author SHA1 Message Date
Jon Knight
65e541085c Bug 13990: ILS-DI LookupPatron requires ID Type
Patch provides a constrained set of borrower attributes to try in turn if the
ID type is not specified.  Also added "email" to the POD documented list of
id types seeing as its quite a useful one for integration developers.

Test plan:

1) without the patch applied, turn on ils-di interface in your admin sysprefs
   and then try accessing the URL:

   https://your-server/cgi-bin/koha/ilsdi.pl?service=LookupPatron&id=Mabel

   replacing "your-server" your Koha dev test domain name (localhost:8080 if
   you're using a kohadevbox VM) and "Mabel" with the first name of a patron
   (Mabel is in the test database already if you're using that).

   You should get back an error message in the XML.

2) Apply the patch and repeat. This time you should get an <id> element in
   the XML with Mabel's patron ID in it.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-30 14:18:21 -03:00
231817c40f Bug 18083: Simplify the condition - if there are more than 1 library
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-19 15:50:32 -03:00
Te Rauhina Jackson
3dfb27605c Bug 18083: Don't show 'library' selection on popular titles page for single-branch libraries
This patch hides the search filter labelled "From" that offers you to
select a library branch which is located on the 'popular titles' page on the OPAC. It is hidden when the library only has one branchas it would be unneccessary to have an option for other branches when there is only one.

Test Plan:
1) Make sure you have a single-branch library
2) Make sure OPACTopIssue is allowed in the OPAC preferences
3) In the OPAC, got to 'Most Popular' page
4) Check that there is no "From" filter in the refine search
5) Create a new branch so that you have more than one branch
6) Check that there is a "From" filter in the refine search on the Most Popular page.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended white space on second change.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-19 15:50:32 -03:00
4933de21ea Bug 19677: Properly escape enumchrom/serialseq data
Some serial issues use angle brackets for denoting certain data.
Currently this is not displayed in Koha. This patch escapes the data so
that angle brackets will display.

To test:
1 - Add an enumchron field to an item containg angle brackets:
"This is a <test>"
2 - View the record in the staff and opac, not the field displays as:
"This is a"
3 - Apply patch
4 - Note full text now displays

Signed-off-by: Charlotte Cordwell <charlotte.cordwell123@gmail.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-19 15:46:43 -03:00
Aleisha Amohia
dd77236371 Bug 18915: Renaming svc/patron_notes to svc/checkout_notes
For consistency.

Signed-off-by: Marjorie Barry-Vila <marjorie.barry-vila@collecto.ca>

https://bugs.koha-community.org/show_bug.cgi?id=19801

Signed-off-by: Marjorie Vila <marjorie.barry-vila@collecto.ca>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-15 12:14:00 -03:00
cd7df9a7a3 Bug 19911: Escape password value during self-registration confirmation
The password must be correctly escape, it can contains html character
and break the display.

Test plan:
Apply first patch and confirm that the display is broken
Apply second patch (this one) and confirm that the display is fixed

Signed-off-by: Arturo <alongoria@sll.texas.gov>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-15 12:14:00 -03:00
67bf5baf15 Bug 19568: Escape url params with url filter - opac-opensearch.tt
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 17:23:14 -03:00
Mark Tompsett
1cff43a3d5 Bug 19570: Add autocomplete=off to opac-main as well
To confirm all the files were modified for opac, typed
this:
$ git grep -i password | grep opac | grep -v "[.]po:" | grep
"opac[^/]*[.]tt:" | cut -f1 -d: | sort -u

The follow output was handled as follows:
    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
These were already done in the first patch.

    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
This already had the autocomplete modification.

    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
This was a false-find. There was no modification necessary.

    koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
This is the modal login in. This patch amends it.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 17:23:07 -03:00
61452ce1f2 Bug 19570: Add autocomplete='off' for login forms at the opac
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 16:02:33 -03:00
ecc6b8b615 Bug 19319: (QA follow-up) Biblionumber leftovers in opac-detail.tt
Correcting a few biblionumber template var leftovers in opac-detail
template. They were combined with url filter instead of html.

Test plan:
[1] Look for [^.;?]biblionumber in opac-detail.tt and verify that these
    occurrences are fine.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 16:02:25 -03:00
950fc8e101 Bug 19319: Reflected XSS Vulnerability in opac-MARCdetail.pl
Try going to this URL on your site: /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>

Test Plan:
1) Go to /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>
2) Note <TEST> is embedded all over the html
3) Apply this patch
4) Refresh the page, note the injection is gone!
5) run koha qa test tools

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 16:02:25 -03:00
99797acd83 Bug 19913: Fix embedded HTML5 videos at the OPAC
Caused by
commit 752aef4593
Bug 18754: Translatability: Get rid of exposed tt directives in opac-detail.tt

A space is missing between 'source' and 'src'

Test plan:
Set  HTML5MediaEnabled  to OPAC
Put a video link to 856$u
See the OPAC detail page, tab video, click the video
=> Should play with this patch applied

Note that this does not affect intranet

Signed-off-by: George Williams <george@nekls.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-09 09:52:42 -03:00
94cd27677d Bug 19918: Close span tag in opac-registration-confirmation.tt
Introduced by:
commit 06f4950aa2
Bug 13599 - Add patron cardnumber to self registration confirmation

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-01-05 11:09:36 -03:00
Liz Rea
6f7bc75985 Bug 19338: Fix sorting by dates in opac-account.tt
To test:
Find an account with lots of fines/payments
load up the borrower's account in the OPAC
note that the sort on the dates sorts by day, and not by date.
apply this patch
reload the page, note that the sort on the dates is now correct.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-26 12:52:34 -03:00
David Bourgault
103fe109b2 Bug 19702: Correct cookie path in Basket.js
This corrects the cookie path in bootstrap/js/basket.js. It used to take
the default value (current page path), but will now be "/"

Test plan:
0) Visit the OPAC, add a book to your basket
1) Navigate to the OPAC's homepage (www.domain.com, without the
    /cgi-bin/koha)
    -> The basket will display as empty
    2) Apply patch
    3) Clear your cookies and your cache
    4) Redo step 1)
        -> Basket will display correctly

Patch applies without issue and functions as descibed.
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-22 13:15:37 -03:00
ebc1583f09 Bug 19573: Link to make a new list in masthead in OPAC only appears / works if no other list already exists
This patch corrects the OPAC masthead include file so that the "New
list" link will appear whether or not the logged-in user has existing
private lists.

To test, apply the patch and log into the OPAC as both a user with
private lists and a user without private lists. The header's "Lists"
dropdown menu should include a "New list" link in both cases.

Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:12 -03:00
8b98a82572 Bug 11976: Fix sorting issues
The last column must be sortable, and dates must use title-string
I removed the class on the th (did not seem useful as we have an id
already)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:12 -03:00
Mark Tompsett
c1ea09f851 Bug 11976: Add Publication date to subscription table (opac) + column settings
This patch adds the column settings feature to the subscription list at
the OPAC.
It also adds a new column (Publication date) to this table

Using Home->Administration->Column Settings->OPAC->subscriptionst
the fields visibility can be toggled.

TEST PLAN
---------
1) Have a subscription where you have received at least once.
2) Look for it in OPAC and note the date is the received date, not the publication date
3) Apply patch
4) Log in to staff client
5) Home->Administration->Column Settings->OPAC->subscriptionst
6) Set visibility as desired.
7) Refresh OPAC page
   -- everything should be as expected.
8) run koha qa test tools.

Signed-off-by: David Bourgault <david.bourgault@inlibro.com>

Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 13:21:11 -03:00
e2d88cfb28 Bug 19808: Do not display 'Added' alone
It seems that reviews.datereviewed ends with NULL in DB.
It is caused by another issue that will be fixed on another bug report.

Signed-off-by: Jon Knight <J.P.Knight@lboro.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 11:07:37 -03:00
Victor Grousset
12882d824e Bug 19808: Handle deleted reviewers gracefully - opac-detail
And other display issues when the patron was NULL.
Which allows to keep the review even if it has no patron.
Because it might be useful.

For example when disconnected, the borrowernumber is null. So the
comments from deleted patrons were displayed as if the disconnected
user wrote them. So it had the edit button...

And fix borrowernumber not being passed to the template when
OpacStarRatings was false.

Test plan
1. Log in as a patron
2. Leave a comment/review on a record
3. Librarian: approve this comment
4. Delete the borrower
5. See the record (opac:/cgi-bin/koha/opac-detail.pl?biblionumber=RELEVANT_BIB_NUMBER)
6. Then you should see an error
7. Apply this patch
8. Refresh the page
9. Then you should see the record page with the comment

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jon Knight <J.P.Knight@lboro.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-21 11:07:37 -03:00
Isabel Grubi
fcb8b106fa Bug 18313: Remove delicious link on social networks
To test:
1/ enable social networkds systems preference
2/ look at any record on the OPAC, notice it has a link to delicious
3/ apply patch
4/ refersh page on OPAC, noitce delicious link has gone

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-20 13:34:10 -03:00
25e050e2ef Bug 19444: Display error message for auto_account_expired
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-18 12:16:26 -03:00
Simon Pouchol
67741fb69e Bug 19692: fix unclosed div in opac-shelves.tt
Test plan:
1. set syspref OpacKohaUrl to "Show"
2. Log into the OPAC
3. /cgi-bin/koha/opac-shelves.pl
4. Notice that "Powered by Koha" is not in the footer in this page.
  When on the other tabs it's in the footer (out of .main)
5. Apply this patch
6. Notice that "Powered by Koha" now in the footer in the "your lists" page

Signed-off-by: Dominic Pichette <dominic@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-07 09:37:10 -03:00
1beb65ed4f Bug 19640: fix OPAC IdRef webservice display
The OPAC webservice IdRef display was broken.
The call returns results but citations where empty.
Maybe the webservice has changed.

This patch corrects the fetch of datas in result.
Also fixes a small HTML missing tag tr.
Also adds a comment with link to official doc :
http://documentation.abes.fr/aideidrefdeveloppeur/index.html#MicroWebBiblio

Test plan :
1) Enable system preference IdRef
2) Choose an existing PPN like 032581270
3) Look result on : https://www.idref.fr/services/biblio/032581270.json
4) Call in OPAC website : /cgi-bin/koha/opac-idref.pl?unimarc3=032581270
5) Without patch you see only one role containing empty rows
6) With patch you see all roles with correct rows

Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended: removed unused @unimarc3 (not to be confused with $unimarc3).

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-07 09:37:09 -03:00
d149f1963e Bug 7317: Fix translatable-templates.t failure
Failed with
 /tmp/Lqv0BH2xC9:7979:13: invalid multibyte sequence
 msgmerge: found 1 fatal error

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-11-09 14:22:56 -03:00
dd52583363 Bug 7317: opac.css update
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-11-09 11:42:14 -03:00
06f9e5fe3a Bug 7317: Handle backend absense more gracefuly
5/ This patch makes Koha::Illrequest->load_backend raise an exception
if the passed backend is invalid. This way we will catch more errors introduced.

The patch also disables the 'New Ill request' when no backends are available. Gets
rid of a related warnings.

Both OPAC and Intranet now display a warning message when no backends
are available.

Tests are added for the load_backend changes.

4/ This patch fixes the path for the checkboxes jquery plugin, and removes the include
for tablesorter, as this implementation uses Datatables. This is obviously code for older
Koha, ported to master.

TODO: There's something wrong on the styling. My idea is to get rid
of the custom column visualization tool, and have it display as regular
DataTables. We can then introduce the use of colvis on a separate bug
report.

Note: POD coverage for the exceptions file is wrongly tested. It is a false positive.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-11-09 11:42:14 -03:00
Magnus Enger
66727e6c68 Bug 7317: QA followup
This fixes some of the issues reported by the QA script, but not all.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-11-09 11:42:14 -03:00
Alex Sassmannshausen
8e86b5e093 Bug 7317: Interlibrary loans framework for Koha.
This Commit is at the heart of adding an interlibrary loans framework
for Koha.  The framework does not prescribe a particular workflow.
Instead it provides a general framework that can be extended &
implemented by individual backends whose responsibility it is to
implement a specific workflow.

The module is largely self-sufficient: it adds new tables to the Koha
database and touches only a few files in the Koha source tree.

Primarily, we add our files to the Makefile and the koha-conf.xml,
define ill paths for the REST API, and introduce links from the main
intranet, opac pages & user permissions.

Outside of this we simply add new files & functionality.

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-11-09 11:42:12 -03:00
Katrin Fischer
b95f5c28aa Bug 13796: (follow-up) Move renewal remaining statement back
This moved the renewals remaining statement back out of the
condition so it's visible always - with and without a rental
fine on the item type.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 16:05:52 -03:00
Marc Véron
3df0c9ac70 Bug 13796: OPAC: Display rental charge for renewing
This patch displays the rental fee that will be applied for
renewing (near "Renew" link on patron's summary page)

To test:
- Apply patch
- Enable system preference 'OpacRenewalAllowed'
- Verify that you have item types with and without rental fee
  for testing
- Issue items with an without rental fee to a patron
- In OPAC, display patron's summary page
- Verify in table 'Checked out', items with rental charge display an information as
  appropriate (near the link 'Renew')

Patch rewritten because of merge issues with previous patches. 2017-04-21 mv

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 16:05:51 -03:00
Aleisha Amohia
d25719d223 Bug 19216: Fix broken table in OPAC for when club doesn't allow public enrolment
To test:
1) Apply bug 19214 and bug 19215 to fix other issues with patron clubs
2) Create a club template that DOES NOT allow public enrollment
3) Create a club, enrol a user
4) Log in as that user to the OPAC
5) Go to 'your summary' and click the Clubs tab
6) Notice the broken table with empty column
7) Edit the club template to allow public enrollment
8) Notice the table is fixed - so this bug is just when the club does
not allow public enrollment
9) Apply the patch
10) Edit the club template to NOT ALLOW public enrollment
11) Confirm the table in the OPAC is now fixed and does not leave an
empty column

Sponsored-by: Catalyst IT
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 14:10:27 -03:00
ad790bed2d Bug 2093: [Compiled CSS] Add OPAC dashboard for logged-in users
This patch contains the CSS file compiled from LESS.

Signed-off-by: Hugo Agud <hagud@orex.es>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

RM note: opac.css regenerated before push:
lessc --clean-css="--s0 --advanced --compatibility=ie7" bootstrap/less/opac.less > bootstrap/css/opac.css

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 14:10:23 -03:00
Aleisha Amohia
506d669424 Bug 2093: (follow-up) Add OPAC dashboard for logged-in users
This patch:
- hides the dashboard if there is no dashboard information to display
- changes '5.00 due' to '5.00 due in fines and charges' for translation
- uses Koha::Holds in place of deprecated C4::Reserves methods

To test, confirm all the right information for holds still shows, and
confirm the dashboard is hidden if there are no checkouts, holds, fines
or overdues.

Signed-off-by: Hugo Agud <hagud@orex.es>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 14:09:05 -03:00
ffee02e41d Bug 2093: (follow-up) Add OPAC dashboard for logged-in users
This patch adds some additional markup for applying styles to and the
corresponding CSS.

Also modified: Links to opac-user.pl should now open the correct tab.

To test, apply the patch and compile the modified LESS file. Clear your
browser cache if necessary. Follow the original test plan and confirm
that the revised links work correctly.

Signed-off-by: Hugo Agud <hagud@orex.es>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 14:09:04 -03:00
Aleisha Amohia
657c417a87 Bug 2093: Add OPAC Summary for logged-in users
This patch adds a summary to the OPAC once the user has logged in that
shows the users number of checkouts, overdues, holds pending, holds
waiting and total fines. We also have a syspref OPACUserSummary to turn
this feature on and off. Default is ON.

To test:
1) Apply patch and update database
2) Set up some checkouts, overdues, holds pending AND waiting and fines
for a user
3) Log into OPAC as that user, see summary. Confirm links all work as
expected
4) Confirm that if there are no checkouts / overdues etc that the link
disappears from the summary
5) Turn OPACUserSummary OFF and confirm the summary does not show on the
mainpage.

Sponsored-by: Catalyst IT

Signed-off-by: Hugo Agud <hagud@orex.es>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 14:09:04 -03:00
Mark Tompsett
c4113dce70 Bug 18956: Fix empty to in message queue
Follow the test plan in comment #20.
Also tweaked string, because it was really 'or' before too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended text in added comment.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 13:57:10 -03:00
Mark Tompsett
e08a0afa26 Bug 18956: Prevent leaking during password recovery
TEST PLAN
---------

It is assumed you have set the OpacResetPassword to 'allowed',
and likely in combination with OpacPasswordChange to 'Allowed'.

You will have two patrons: one with and another without
any email address entered. You will want to test this test plan
with both patrons.

$ git checkout -b bug_18956 origin/master

Prepend the following as understood between step sections:
opac -> forgot password and then enter...

correct login/cardnumber, it will email
delete from borrower_password_recovery;

correct email, it will email
delete from borrower_password_recovery;

correct login/cardnumber && correct email, it will email
delete from borrower_password_recovery;

wrong login/cardnumber && correct email, error page as expected
delete from borrower_password_recovery;

correct login/cardnumber && wrong email, error page as expected
delete from borrower_password_recovery;

wrong login/cardnumber && wrong email, error page as expected
delete from borrower_password_recovery;

submit empty -- INTERNAL SERVER ERROR?!
delete from borrower_password_recovery;

-- None of the above step sections displayed email.

correct login/cardnumber, it will email

correct login/cardnumber again, but it leaks email address!
delete from borrower_password_recovery;

correct email, it will email

correct email again, but it leaks login/cardnumber!
delete from borrower_password_recovery;

$ git bz apply 18956
-- choose interactive, and choose this counter patch.

repeat the same test set again
-- no leaks will occur, error message pages returned should
   be reasonable, code should read reasonably.

run koha qa test tools.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 10:59:05 -03:00
570eb40266 Bug 19333: Fix XSS in opac-shelves
category is send back to the template, it must be escaped

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-27 10:59:01 -03:00
e711c8e418 Bug 19038: Remove the OPACShowBarcode syspref
This patch removes the OPACShowBarcode syspref in favour of the new
columns settings option introduced by bug 16759.

On the upgrade step, it picks the value for OPACShowBarcode and uses it
to populate the columns_settings table.

To test:
- Verify the upgrade process maintains the current behaviour

Regards

Sponsored-by: Dover

Followed test plan and works as expected. Functionality of patch from bug 16759
appears intact too.
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 16:12:46 -03:00
Marc Véron
8bb8decf01 Bug 17381: Add system preference SCOMainUserBlock
This patch adds a system preference SCOMainUserBlock to display custom HTML
on the self checkout page.

To test:
- Set up self checkout (see section Self Checkout in Circulaton sysprefs )
- Apply patch
- Update db
- Add some HTML system preference SCOMainUserBlock
- Go to sco page
- Verify that HTML displays on page (logged in and not logged in)

New version based on Koha.Preference TT plugin as of comment #7
Depends on Bug 12691

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:42 -03:00
662a98345a Bug 19028: Add 'shelving location' to holdings table in detail page
This patch adds the option to show shelving locations on a separate
column. This is controlled by a new syspref, 'OpacLocationOnDetail',
which replaces 'OpacLocationBranchToDisplayShelving', adding a
conveniente 'column' option.

The new 'Shelving location' column is conveniently added to the columns
configuration entry added by bug 16759 for this purpose.

The current behaviour is preserved.

To test:
- Apply this patches
- Run the upgrade:
  $ sudo koha-shell kohadev
 k$ cd kohaclone
 k$ perl installer/data/mysql/updatedatabase.pl
=> SUCCESS: Upgrade doesn't fail
- Have an item with shelving location set to something not void
- Have the item set home and holding libraries for testing purposes.
- Set 'OpacLocationBranchToDisplay' to 'home and holding libraries' [*]
- Visit the OPAC detail page for the record containing the item
=> SUCCESS: Both home and holding libraries are displayed.
- Loop through all OpacLocationOnDetail options (except from 'column', we leave it for later).
=> SUCCESS: Works as expected.
- Go to Administration > Columns settings
- Make item_shelving_location available in the OPAC section
- Reload the OPAC detail page
=> SUCCESS: No change
- Set OpacLocationOnDetail to 'on a separate column'
- Reload the OPAC detail page
=> SUCCESS: Shelving location is displayed on a separate column
- Sign off :-D

Sponsored-by: Dover

[*] For testing purposes

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:41 -03:00
7827a941d4 Bug 16759: Use index of elements in specific table
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:41 -03:00
c089fa0373 Bug 16759: Handle the otherholdings tab gracefuly
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:40 -03:00
92f6f5b049 Bug 16759: Make OPAC holdings table configurable
This patch makes the holdings table in the OPAC biblio detail page
configurable using the Columns configuration tools.

This patch:
- Moves the holdingst table from plain DataTable to KohaTable
- Creates a sample yml colvis configuration for this table
  containing all the currently available columns

To test:
- Visit some record's detail page in the OPAC
- Apply this patch
- Reload
=> SUCCESS: The page shows the same information
- On the staff interface, go to:
  Home > Administration > Columns settings
=> SUCCESS: There's a new OPAC section containing the configuration for
   holdingst.
- Choose to hide some fields (both currently displayed and currently hidden).
- Reload the OPAC detail page
=> SUCCESS:
   - Required fields are hidden
   - It doesn't explode because of trying to hide stuff that is not there to start with
- Sign off :-D

Sponsored-by: DOVER

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Followed test plan, patch worked as described. Also passed QA test tool

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:40 -03:00
5ea5fc83d9 Bug 17277: Always display location and *branch item info - opac detail
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:40 -03:00
Aleisha Amohia
ab5c810dac Bug 18949: Adding thead tags to OPAC MARC details holdings table
So that it can be styled alongside other tables in the OPAC.

To test:
1) Log into staff side
2) Find OPACUserCSS syspref and add the following CSS:
th,
.table-bordered>thead>tr:first-child>th {
color: red;
}
3) Log into the OPAC
4) Go to your fines, your search history, your reading history etc -
notice all of these table's headings are styled with red text
5) Go to the detail page of an item, then the MARC view.
Notice this table's headings are now styled with red text
6) Apply patch and refresh page
7) Your holdings table should now have red headings.
(You can delete the CSS from OPACUserCSS if you'd like.)

Sponsored-by: Catalyst IT

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-25 12:14:39 -03:00
ea5aef7841 Bug 12768: (QA follow-up) Add 'Processing fee' to templates
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-20 17:14:35 -03:00
3f9da34683 Bug 18298: Add server-side checks and refactor stuffs
Now that we have a check client-side, nothing prevents us from a smart guy to
bypass it and force an invalid password.
This patch adds two new subroutines to Koha::AuthUtils to check the
validity of passwords and generate a password server-side. It is used
only once (self-registration) but could be useful later.

Moreover the 3 different cases of password rejection (too leak, too
short, contains leading or trailing whitespaces) were not tested
everywhere. Now they are!

This patch makes things consistent everywhere and clean up some code.

Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-16 09:44:32 -03:00
ec4e666bc5 Bug 18298: minPaswordLength should not be < 3
Indeed if RequireStrongPassword is set we need at least 3 characters to
match 1 upper, 1 lower and 1 digit.
We could make things more complicated to allow minPasswordLength < 3
but, really, 3 is already too low...

Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-10-16 09:44:32 -03:00