This patch changes all instances of type="number" in inputs to adhere
with the ACC2 guidelines
In addition, all "min" and "step" attributes have been removed from
these inputs (Thanks Owen).
Test plan:
Go through the boraccount.tt file and insure that no instances of
type="number" were missed.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch updates the logic to create a cancellation accountline and
apply it to the charge line so we correction record the transaction in
terms of double entry accounting standards.
Test plan:
1. Go to a patron's accounting section
2. Create a manual invoice
3. In Transactions tab, you should see a 'Cancel charge' button. Click
on it. It should now be marked as cancelled
4. A cancellation line should be associated with the original charge.
5. Create another manual invoice
6. Pay it (partially or fully)
7. Notice that the 'Cancel charge' button is not available
8. Void the payment
9. 'Cancel charge' button is available again. Click on it and verify
that it still works
10. prove t/db_dependent/Koha/Account/Lines.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
https://bugs.koha-community.org/show_bug.cgi?id=24063
Bug 24603: Fix number of unit tests
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
https://bugs.koha-community.org/show_bug.cgi?id=24063
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
There is already a button to void a payment. It should be possible to
cancel a charge too.
This patch adds a button in patron's accounting section (Transactions
tab) that allow to cancel charges.
Charges that have been fully or partially paid cannot be cancelled.
It also fixes Koha::Account::Line::is_credit by looking at
credit_type_code instead of amount (amount can be 0 for voided payments)
It also fixes the tests for Koha::Account::Line::void when database does
not contain the borrowernumber 51 (the default in
t::lib::Mocks::mock_userenv)
Test plan:
1. Go to a patron's accounting section
2. Create a manual invoice
3. In Transactions tab, you should see a 'Cancel charge' button. Click
on it. It should now be marked as cancelled
4. Create another manual invoice
5. Pay it (partially or fully)
6. Notice that the 'Cancel charge' button is not available
7. Void the payment
8. 'Cancel charge' button is available again. Click on it and verify
that it still works
9. prove t/db_dependent/Koha/Account/Lines.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch updates the html_helper for the cash register selection block
to remove the 'empty option' such that it can be correclty set for each
select case and updates all existing cases where we used the process
block previously to include the relevant blank option '-- Select an
option --', '-- None --', 'Library default' and finally the new '-- All
--' options introduced with this bug.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch adds handling to allow for the use of the session cash
register by default if it has been set, otherwise it defaults to '--
None --' and requires the end user to select the register to proceed
with the refund or payout action.
Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Realized I'd left a stray tag, fixed.
To test:
1 - go to borrower account, apply manual fee
2 - go to Transactions tab and see that fee has "% Apply discount" button
3 - apply patch, restart, reload page
4 - button just says "Apply discount"
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch fixes the total row where the column count was out by one.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
In some areas it's required to sequentially number payment slips /
receipts.
This patch adds a database column accountlines.credit_number and a
system preference AutoCreditNumber to control how this number will be
generated. The following options are available:
- Do not automatically generate credit numbers.
This is the current behaviour and the default syspref value.
- Automatically generate credit numbers in the form <year>-0001 (annual)
- Automatically generate credit numbers in the form
<branchcode>yyyymm0001 (branchyyyymmincr)
where <branchcode> is the branch where the user (staff member) is
logged in
- Automatically generate credit numbers in the form 1, 2, 3
(incremental)
It also adds a column (hidden by default) in the table under
Transactions tab to display this number.
Test plan:
0. Apply patch, run updatedatabase and update_dbix_class_files
1. Go to Admin » Column settings, and uncheck the 'hidden' box for
column credit_number in table account-fines. It will be easier for
testing
2. Create a manual credit for a borrower. Verify in Transactions tab
that this credit has no number generated
3. Change syspref 'AutoCreditNumber' to 'incremental'
4. Create more manual credits, and verify that the numbers generated are
1, 2, 3, ...
5. Change syspref 'AutoCreditNumber' to 'annual'
6. Create more manual credits, and verify that the numbers generated are
'2020-0001', '2020-0002', ...
7. Change syspref to 'AutoCreditNumber' to 'branchyyyymmincr'
8. Create more manual credits, and verify that the numbers generated are
'BRANCHA2020020001', 'BRANCHA2020020002', ... (assuming you are
connected to library BRANCHA, and it's February 2020)
9. Set library to another one, say BRANCHB
10. Create more manual credits, and verify that the numbers generated are
'BRANCHB2020020001', 'BRANCHB2020020002', ...
11. Edit the letter ACCOUNT_CREDIT, and add [% account.credit_number %]
somewhere. Go back to Transactions tab and click on 'Print' for one
line that has a credit number. Make sure the number is there.
12. prove t/db_dependent/Koha/Account.t
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We have different classes we can use to set specific behaviours on
table columns: title-string, string-sort, anti-the and NoSort.
We should not need to pass them to the DataTable constructor, we could
teach it that we always want to apply them.
It will avoid bug like bug 26233
The goal is to define them in a centralised place
(columns_settings.inc) then only use the class on the th
Test plan:
Different behaviour and tables must be tested to confirm it works
correctly. Focus must be put on table when aoColumnsDefs is passed from
the template and confirm that this will add more info to aoColumnsDefs
and not remove the existing ones.
Note that this only work when KohaTable is used.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We are preparing the ground with this patch. As the "Columns settings"
page will now add the ability to modify settings for the whole table, it
makes sense to rename the file and the variables.
Note that the controller script (admin/columns_settings.pl) and the yml
(admin/columns_settings.yml) files have not been moved to not break
shortcuts and abits people could have. But if QA decides, it could be
easy to do.
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
... instead of issue and return.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
TO TEST:
1. Have a patron with some fines on an item. Try accruing fines.
2. Go to the accounting tab and look at both the Tranaction tab and Make a payment Tab
3. No Issue Date
4. Apply patch
5. Check those tabs again and see the issue date displays.
6. Go to column configuration and try to hide the issuedate, make sure it hides properly. Try this for both tables. Also make sure other columns hide properly.
7. Sign off!
Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
It does the same thing as the 'Pay' button under 'Make a payment' tab.
It is nothing more than a shortcut.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds an ID to the payout confirmation modal on the
borrower account details page.
Test plan:
1/ Apply patch
2/ Attempt to issue a payout to a patron
3/ Inspect the page and note the presence of an ID for the confirm
button
4/ Signoff
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds an ID to the refund confirmation modals for both
borrower account and point of sale register details pages.
Test plan:
1/ Apply patch
2/ Attempt to issue a refund to a patron
3/ Inspect the page and note the presence of an ID for the confirm
button,
4/ Attempt to issue a refund via point of sale register details page
5/ Inspect the page and note the presence of an ID for the confirm
button.
6/ Signoff
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Rebasing was a nightmare, so I'm squashing the sign off follow-ups to
ease the pain with any future rebases
Includes:
Bug 23051: (follow-up) Refactor renewal code
As per Nick's first point in comment #20, the code that tests for
renewability and renews items has been refactored into it's own
function.
Bug 23051: (follow-up) Provide feedback
For renewals that fail when a fine is being paid off, this patch causes
any errors to be passed back to the template for display.
Addresses the second point in Nick's comment #20
Bug 23051: (follow-up) Fix unit tests
As raised by Nick in comment #35
Bug 23051: (follow-up) Fix/improve feedback
This follow up patch addresses the following parts of Nick's feedback in
comment #35:
- it would be nice to get feedback on what was successfully renewed as well
- In general I think I would prefer to see 'ok' and 'not_ok' returned as
a single 'renewal_results' array
- There is no listing of errors if I use the 'pay' button on an
individual fine
Bug 23051: (follow-up) Refactor methods
This follow up patch addresses the following parts of Nick's feedback in
comment #35:
- I don't really like that the functions are internal functions and then
exported
- I think the pref description should highlight that if 'RenewalPeriodBase'
is set to due date, there may be doubled charges
Bug 23051: (follow-up) Add SIP summary
This follow up patch addresses the following parts of Nick's feedback in
comment #35:
- Ideally SIP would get feedback in a screen message
Bug 23051: (follow-up) Renewing in OPAC
This follow up patch addresses the following parts of Nick's feedback in
comment #35:
- I am also not sure about the code path if a patron paid fines on the
opac (via paypal etc.) but renewals are not allowed on the opac.
We've introduced the syspref RenewAccruingItemInOpac (default is off)
which, when enabled, will cause items attached to fines that are paid
off in the OPAC (via payment plugins), to be automatically renewed.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds the ability to apply discounts to existing patron
charges from the boraccount page.
Test plan
1/ Carry out some accounting actions that end up with debts on the
patron record. (Add a manual invoice for example)
2/ Note a new 'Apply discount' action button on the unpaid debt
3/ Paid debts do not display the action button
4/ Click the button
5/ Enter an amount into the resulting modal and click confirm
6/ Confirm that the outstanding debt has been reduced by the amount you
specified.
7/ Confirm that a new 'Discount' line appears on the patrons account
8/ Confirm that in the 'details' view of the debt that the discount line
was used against the debt to create the reduction.
9/ Signoff
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds a minor correction to the refund form on the borrower
accounts page. It removes the hidden 'registerid' form field and
corrects the select field to submit registerid as intended.
This corrects the behaviour such that the staff user can select which
cash register the payout action should be attributed to.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds a minor correction to the payout form on the borrower
acocunts page. It removes the hidden 'registerid' form field and
corrects the select field to submit registerid as intended.
This corrects the behaviour such that the staff user can select which
cash register the payout action should be attributed to.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This enhancement adds a refined workflow to allow librarians
to refund payments to patrons and record these refunds on the
patrons account.
The use case is that a patron has paid for something before
then performing an action that may require some level of refund
to be actioned. Perhaps they are returning a lost and paid for
book.
Test plan:
1) Undertake a series of transactions that result in a debit
accountline being partially or fully paid off.
2) Note that a new 'Issue refund' button appears next to a
debit (but only if your user has the refund permission or
is a superlibrarian)
3) Click the 'Issue refund' button and a modal should appear
pre-populated with the amount - amountoutstanding.
4) You should be able to edit the amount you wish to refund,
record the refund or cancel.
5) Signoff
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This enhancement adds a refined workflow to allow librarians to pay out
money to patrons and record these payouts on the patrons account.
The use case is that a patron has somehow accrued credit, through a
refund perhaps, and the library wants to be able to physically hand over
some money to balance the patrons account.
Test plan:
1) Undertake a series of transactions that result in some outstanding
credit on a patrons account.
2) Note that a new 'Issue payout' button appears next to a credit with
an outstanding balance (but only if your user has the payout
permission or is a superlibrarian)
3) Click the 'Issue payout' button and a modal should appear
pre-populated with the amountoutstanding.
4) You should be able to edit the amount you wish to payout, make
payment or cancel.
5) Signoff
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Some libraries would like to show the amount of change given on print reciepts triggered by FinePaymentAutoPopup
so the patron can verify he or she has recieved the correct amount of change.
1) Apply this patch
2) Edit ACCOUNT_CREDIT slip and add "[% IF change_given %]<h1>CHANGE: [% change_given %]</h1>[% END %]" at the top
3) Enable FinePaymentAutoPopup
4) Make a payment
5) Note the change given is shown on the popup receipt
6) Note the change given is *not* shown on subsequent prints of the same receipt using the "print" button for the payment
Signed-off-by: Kyle Hall <kyle@bywatersolutions.com>
Signed-off-by: Hasina Akhte <hasinaa@pascolibraries.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch upgrades DataTables and makes some style changes to the
default DataTables toolbar style. DataTables assets are now combined and
minified using their download customizer, bundling together these
elements:
- JSZip 2.5.0
- pdfmake 0.1.36
- DataTables 1.10.18
- Buttons 1.5.6
- Column visibility 1.5.6
- HTML5 export 1.5.6
- Print view 1.5.6
- FixedHeader 3.1.4
DataTables assets have been moved from lib/jquery/plugins to
lib/datatables. The global header and footer include files are updated
correspondingly.
This patch removes the custom "four_button" pagination configuration and
updates pages which used it to use the built-in "full" type instead.
This is done for the sake of consistency and upgradability. This change
touches a lot of files.
Table-specific CSS has been moved from staff-global.scss to a new
include, _tables.scss. A second common include, _mixins.scss has some
variable definitions used in both files.
Many images have been made obsolete by this change and have been
removed.
To test, apply the patch and regenerate the staff client CSS. View
various pages in the staff client with tables:
- Not formatted by DataTables:
- Reports -> Most circulated items
- Catalog -> Search results
- Formatted by DataTables without column configuration
- Acquisitions -> Vendor search
- Lists
- Formatted by DataTables with column configuration
- Administration -> Libraries
- Administration -> Item types
- Reports -> Saved SQL reports
- Non-standard DataTables configurations:
- Circulation -> Checkouts
- Administration -> System preferences
- Reports -> Lost items
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Some libraries would like an auto-popup after making a payment so librarians don't have
to navigate to the accounts page, locate the new payment, then click the print button.
Test Plan:
1) Apply this patch
2) Run updatedatabase.pl
3) Make a payment, note no difference in behavior
4) Enable the new syspref FinePaymentAutoPopup
5) Make a payment, note the popup for the payment receipt
Signed-off-by: Lisette Scheer <lisettes@latahlibrary.org>
Rescued-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch changes a parameter in the function which filters the
DataTable of transactions. The addition of more columns to the table
changed the index of the column which is being filtered.
To test, apply the patch and locate a patron who has multiple fines or
charges, some of them paid. Go to Accounting -> Transactions. Test the
"Filter paid transactions" link. Table rows which show "0.00" in the
"Oustanding" column should be hidden.
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch makes changes to the way hold fees are recorded and displayed
in the OPAC and staff client:
- No English strings should be stored in the accountline description.
- The accounttype code should be used to display what kind of charge it
is.
To test, apply the patch and go to the staff client:
- Configure a patron category to have a hold fee.
- Place one or more holds for a patron in that category.
- On the patron's record, view Accounting -> Make a payment
- There should be a separate column for "Account type" showing "Hold
fee" for the hold charges.
- There should be no "Res" or "Reserve Charge" text in the
description column--just the title.
- Switch to the "Transactions" tab. The display should be similar.
- In the OPAC, log in as a patron who has hold fees on their account.
- View the "your fines" page to confirm that the information is
displayed correctly there as well.
- Place a hold for a patron who incurs hold charges.
- Log in to the self-checkout module as that patron and check out an
item which will fulfill that hold.
- The correct fine information should be saved to accountlines: A "Res"
type with a description consisting only of the title.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
DataTables are used on enough pages in the staff client that it
doesn't make sense to put inclusion of the CSS into each template
where it is needed. This patch moves includes of datatables.css from
individual templates into the global header file.
To test, apply the patch and view various pages which have DataTables.
View various styles of DataTables, e.g.
- Full pagination, like item search results
- Four-button, like Saved SQL reports
Everything should look the same as it was.
Signed-off-by: Jose-Mario Monteiro-Santos <jose-mario.monteiro-santos@inLibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch modifies several patron templates to use the
Bootstrap grid instead of YUI.
This patch also removes obsolete "text/javascript" attributes from
<script> tags in the modified templates.
To test, apply the patch and view the following pages, confirming that
they look correct at various browser widths:
- Patrons -> View patron
- Fines
- Account
- Create manual credit
- Delete
- Try to delete a patron with checkouts
- Discharges
- Housebound
- Files
- Holds history
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch moves accounts-related descriptions into a single file to
ease finding them, and also encloses descriptions inside <span> tags to
make it easier to translate.
To test:
- Apply this patch
- Verify the templates work as expected
=> SUCCESS: No behaviour change
- Sign off :-D
Bonus: there were two cases in which the INCLUDE line used 'accountline'
as parameter, making it fail to pick the right account type!
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
The actions_col template param requires a DB search, only to display the
'Actions' column header vs. an empty string. But there will always be
buttons in there, that were added *after*.
It made sense when only the 'Reverse' button was displayed, but now both
'Print' and 'Details' are displayed anyway.
This patch removes it for good :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Test Plan:
1) Apply this patch
2) Note all references to reversing payments have been removed
3) Note ability to void payments remains unchanged
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch has been generated with the script provided on bug 21576.
It only affects variable used in the href attribute of a link *when*
href it the first attribute of the node (grep "a href")
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Wrong column was selected for filtering the table.
This was caused by changing the hmtl-structure of the table
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
