Commit graph

21478 commits

Author SHA1 Message Date
David Nind
c9ab718a39
Bug 33395: Patron search results - show number of overdues and checkouts when patrons have overdues
This fixes the display of patron search results, so that it shows
the number of checkouts when a patron has overdue items. For
example: 1 / 2

Bug 30063 changed the display to show only the number of overdue
items in bold and red, without the total number of items checked
out.

Test plan:
1. Check out two items to a patron - make one overdue (click the
   checkout setting options and then specify a due date a month
   ago).
2. Check out another item to another patron.
3. Search for patrons so that the two patrons you checked out
   items to are listed in the results.
4. Note the display for the 'Checkouts' column:
   4.1 For patrons without any checkouts: 0 / 0
   4.2 For the patron from step 2 with one checkout: 0 / 1
   4.3 For the patron from step 1 with one overdue and one
       checkout: 1 (in bold and red)
5. Apply the patch.
6. Refresh the page of results (step 3).
7. Note that for the patron from step 1, the display now shows:
   1 / 2 (with the 1 in bold and red).
8. Sign off! 8-)

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 16:40:15 -04:00
f3ebd78dee
Bug 34300: Add holds column to order table
Adds the ability to easily place a hold on an ordered item from a basket

To test:
    1) Apply patch
    2) Go to acquisitions
    3) Go to an existing basket, or create a new one
    4) Add an order to the basket
    4) Notice there is a "Place hold" column in the Orders table
    5) Click the link for an item which allows you to place a hold easily on the biblio
    6) On the columns settings, toggle the "Place hold" column to hide it, and make sure it gets hidden

    Sponsored-by: Pymble Ladies’ College

Signed-off-by: Lisette Scheer <lisette.scheer@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 16:40:14 -04:00
c4080836de
Bug 9525: (QA follow-up) Clarify how float groups are selected in circulation rules
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 16:40:12 -04:00
fdf7732dc2
Bug 9525: (QA follow-up) Fix QA complaints
Add boolean to schema
Remove stray console.log
Fix subroutine name in POD

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 16:40:11 -04:00
Emmi Takkinen
7c22b12240
Bug 9525: Add option to define float groups and rules for float
Bug 22284 introduced ability to create hold groups.
We should have ability to create float groups in
same manner. This patch adds checkbox "Is local
float group" to group creation feature and new return
policy "Item floats by librarygroup".

To test:
1. Add new float group and some libraries to it.
2. From circulation and fine rules, set default
return policy as "Item floats by library group".
3. Check out an item for a patron.
4. Set library as one that belongs in the same
float group.
5. Check in the item.
=> Observe that notice for transfer doesn't pop up.
6. Check out again.
7. This time set library as one that doen's
belong in the same float group.
8. Check in.
=> Observe that notice for transfer pops up.

Experiment this feature by changing return policy
per library, item type etc.

Also prove t/db_dependent/Koha/Libraries.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: Lisette Scheer <lisettePalouse+Koha@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 16:40:10 -04:00
1f730fb866
Bug 34961: Add sort parameter to OPAC search results RSS feed link
This patch corrects two RSS links in the OPAC search results template so
that they include the correct parameters, including the descending sort
by acquisition date.

To test, apply the patch and go to the OPAC.

- Perform a catalog search which will return search results.
- Next to the page heading "Your search returned X results" is an RSS
  link. Check the link to confirm that it has all the expected
  parameters:

  opac-search.pl?idx=kw&q=nude&count=50&sort_by=acqdate_dsc&format=rss

- Perform a search which will return no results and check the RSS link
  on that page. It should be the same.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:57 -04:00
1a633d68da
Bug 34737: Add ability to match on combinations of item fields
This patch updates the sort bin selection logic to allow for multiple
item field comparisons in a single config rule line.

Test plan
1) Run the unit tests before and after applying this patch and confirm
   they pass in both cases (prove -v t/db_debendant/SIP/Transaction.t
2) Check out an item and return it via SIP2:
     $ telnet localhost 8023
     9300CNterm1|COterm1|CPCPL|
     09N20200422    12430020200422    124300APCPL|AOCPL|AB001|AC|
   (Where 001 in |AB001| is the barcode of the item in question)
4) Check there is no CL field in the last response
5) Apply the patch, fill in SIP2SortBinMapping with e.g.:
       CPL:itype:eq:BK:ccode:eq:TEEN:3
6) Repeat the first step
7) Check the response contains a CL field with a value of 3 (or what
   you put in the config). The field should look like |CL3|

Signed-off-by: Toni Ford <Toni.Ford@newcastle.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 11:07:51 -04:00
ca2fdda342
Bug 34891: Correct link on view restrictions button
This patch updates the button which appears on the circulation page
when a patron is restricted. Before this patch, clicking the button
would activate the restrictions tab but wouldn't scroll the page to make
the tab visible.

To test, apply the patch and check out to a patron who has one or more
restrictions.

- There should be a message on the page, "Restricted since..."
- Click the "View restrictions" button.
- The page should jump down so that the tabs are visible and the
  restrictions tab should be active.
- Test on the patron details page too.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:07 -04:00
b0b33b382c
Bug 32676: Fix EDI message status case
Edifact status appear to vary between all lower case and being
capitalized. This breaks the switch in the edi_status block of the
basket.tt template. We should make this switch case-insensitive.

Test Plan:
1) View the basket for a sent EDI order, note the Sent status does not
   display.
2) Apply this patch
3) Reloate the page, note the status is now visible!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:06 -04:00
Katrin Fischer
d949ac5e5c
Bug 34820: (QA follow-up) Fix span tag
One span tag was missing a <.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:05 -04:00
659ccabd93
Bug 34820: (QA follow-up) Replace em tags with quotes
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:05 -04:00
80b85e1bb3
Bug 34820: (QA follow-up) add filter, update CSV output
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:04 -04:00
1810fac11e
Bug 34820: Clarify inventory tool message for items with non-matching notforloan value
In the inventory tool, if one or more not for loan values are selected, and an item is scanned that has no NFL status or an unselected NFL status, the error message reads "Unknown not-for-loan status". This can be interpreted as the item having an NFL status value that is not defined in the system, but that is not accurate. This should be reworded to remove ambiguity.

Test plan:
1) Create two items, one of which has the NFL status of "Ordered", the
   other having no NFL status
2) Enter those two barcodes in the inventory tool barcodes list
3) Check only "Ordered" in items.notforloan
4) Note the problem messages
5) Apply this patch
6) Re-run the inventory tool
7) Note the new clarified messages!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:04 -04:00
a3849909a9
Bug 34945: Remove the use of event attributes from OPAC clubs tab
This patch removes the use of event attributes (onclick) from the
template for the clubs tab shown in the OPAC to a logged-in user.
These events are defined now along with the other in-page JS.

The patch also makes some general improvements to the template for
consistency:

- Adding Bootstrap color classes to the "Enroll" and "Cancel enrollment"
  buttons.
- Enhancing the responsive configuration to the DataTable.

To test you should have a few patron clubs defined (Tools -> Patron
clubs).

- Apply the patch and log in to the OPAC.
- On the user summary page, click the "Clubs" tab.
- The "Enroll" and "Cancel enrollment" buttons should look correct and
  work as expected:
  - Click the "Enroll" button.
    - On the enrollment confirmation view, test both the "Finish
      enrollment" button and the "Cancel" link.
  - Test "Cancel enrollment" button.
- Test the responsive behavior of the page to confirm that it adjusts
  well to narrow browser widths.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:44:03 -04:00
dc140bdb2e
Bug 34833: (follow-up): remove redundant spaces
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:53 -04:00
Katrin Fischer
2b1b7c9ce8
Bug 34833: Make "order number" in acq modal translatable
The 'order number' was not translatable when editing the
estimated delivery date or notes from basket summary or
when editing the estimated delivery date from late orders.

To get there:
0. Make sure you have budgets and vendors set up

1. Create a basket (skip this if you already have an open basket)
   1.1. Go to acquisitions
   1.2. Search for a vendor
   1.3. Click New > basket
   1.4. Enter a name for the basket
   1.5. To make the tests easier, choose to create items when : cataloging the record
   1.6. Click save

2. Add an order
   2.1. Click add to basket > From a new (empty) record
   2.2. Fill out the form, minimally
        - Enter a title
        - Enter a quantity
        - Choose a fund
        - Enter a vendor price
   2.3. Click Save

3. Next to the order line, click Edit under Estimated delivery date
4. Verify that the 'order number <ordernumber>' shows on top of the modal
5. Edit internal/vendor note, verify it shows there as well
6. Close basket
7. Go to late orders
8. Edit estimated delivery date, text should show there as well
9. Apply patch
10. Run translation update script
11. Verify the string now appears in po files
12. Translate it
13. Install translation
14. Verify it shows nicely translated in all 3 mentioned spots

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:53 -04:00
799f7968dd
Bug 34619: Show debug mode column in list of SMTP servers
This patch adds a column to the table of SMTP servers which shows
whether debug mode is on or off. This information was previously only
conveyed through the color of the text in the table row.

To test, apply the patch and go to Administration -> SMTP servers.

- If necessary, add one or more SMTP servers so that there are more than
  one: At least one with debug mode on, at least one with debug mode
  off.
- In the table listing SMTP servers you should see a column for "Debug
  mode," where the rows indicate "On" or "Off."
- Each row which is highlighted in red should show "On" for debug mode.

Signed-off-by: Émily-Rose Francoeur <emily-rose.francoeur@inLibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:52 -04:00
Caroline Cyr La Rose
f91db88fce
Bug 34511: Typo in manage_staged_records permission description
This patch corrects a typo in the description of the manage_staged_records permission. All other permission descriptions are in the present tense, but this one is in the past tense.

To test:
0. Apply the patch
1. Go to any patron record
2. Click More > Set permissions
3. Click Show details next to the Use all tools permission
4. Read the description for the manage_staged_records permission, make sure the spelling and grammar are correct

Signed-off-by: hebah <hebah@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:51 -04:00
5c47fd33f3
Bug 33812: Checkboxes need labels in opac-messaging.tt
Aria-labels have been added to checkboxes in the OPAC messaging preferences table to assist with screen reading. The relevant preference has been mentioned in each label to identify what the checkbox is for.

Signed-off-by: Sam Lau <samalau@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:51 -04:00
92ef068232
Bug 34865: Use OPACURLOpenInNewWindow for library URLs
If a library has a URL defined it is shown in the OPAC under the
libraries page. This patch updates the template so that the link
respects the OPACURLOpenInNewWindow system preference.

To test, apply the patch and go to Administration -> Libraries and edit
a library if necessary so that it has a URL defined.

In the OPAC, go to the Libraries page. Test that the library link
respects whichever setting you have for OPACURLOpenInNewWindow

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:50 -04:00
Caroline Cyr La Rose
8a45084b7f
Bug 34679: Change description for RELTERMS authorized value category
This patch changes the description of the RELTERMS authorized value
category to "List of relator codes and terms".

To test:
1. Apply patch
2. Go to Administration > Authorized values
3. Search for category RELTERMS
   --> The description should read "List of relator codes and terms"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:32:50 -04:00
10ef1fe672
Bug 34944: Remove the use of event attributes from OPAC full serial issue page
This patch removes the use of event attributes (onclick) from the OPAC's
full serial issues template. These events are defined now along with the
other in-page JS.

To test you must have a serial record with issues from multiple years.

- Locate the serial record and view the detail page.
- Click "More details" at the bottom of the "Subscriptions" tab.
- Click the "Full history" tab.
- Test the "Show year" controls to confirm that clicking each year
  correctly filters the table of issues to show only issues from that
  year.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:15:40 -04:00
ff00e77f46
Bug 34939: Set hour:minute to 23:59 when inputing dates unless explicitly set
1. Find some places in the staff interface where data-flatpickr-enable-time is set to true. Examples: renew.tt or circulation.tt
2. Directly input a date in whatever date format you have specified in DateFormat but omit the hour/minute. Example: 12/12/2023
3. See that the hour/minute default to 00:00 if your TimeFormat is 24hr and 12:00 AM if your time format is 12hr
4. Apply patch, clear browser cache.
5. Try step again, setting a date like '12/12/2023'. The hour:minute should be added as 23:59.
6. With TimeFormat set to 24hr try entering a date with the hour:minute like '12/12/2023 11:22'. The hour:minute should be set to 11:22.
7. With TimeFormat set to 12hr try entering a date with the hour:minute like '12/12/2023 11:22 AM'. The hour:minute should be set to 11:22 AM.
8. Play with this in as many TimeFormat and DateFormat combonatinons as you can.

Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-04 09:15:38 -04:00
3b190d625b
Bug 34801: Fix incorrect use of __() in .tt and .inc files (bug 34038 follow-up)
__() should be used in .js files, not .tt files

To test, apply the patch and update a translation, e.g. fr-FR:

  > cd misc/translator
  > perl translate update fr-FR

- Open the corresponding .po file for JavaScript strings, in this case
  misc/translator/po/fr-FR-staff-prog.po
- Confirm that the strings are now in the .po file for translation. You
  should find the lines in the commit

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:48 -04:00
Jacob O'Mara
20524530c8
Bug 34917: Fix default sort column of table in suggestion.tt
Test plan:
1. Navigate to Acquisitions and load the suggestions management page
2. Ensure that there are some suggestions in the table
3. Observe that the default sort is on the "Suggester Category" column
4. Apply Patch
5. Observe that the default sort is now on the "Suggested on" column
   instead

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:48 -04:00
86628b3523
Bug 34389: Fix inconsistencies in debit types titles, breadcrumbs, and header
This patch fixes a couple of inconsistencies in the debit types
administration page, making sure the page title, breadcrumb
navigation, and page headers are consistent with each other.

To test, apply the patch and go to Administration -> Debit types. Test
each variation of the page:

- Main page
- New debit type
- Modify debit type

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:47 -04:00
0b2cc01ca5
Bug 34391: Fix inconsistencies in cash registers titles, breadcrumbs, and headers
Fix inconsistencies in cash register page titles, breadcrumbs, and
header

This patch fixes a couple of inconsistencies in the cash register
administration page, making sure the page title, breadcrumb
navigation, and page headers are consistent with each other.

To test, apply the patch and go to Administration -> Cash register. Test
each variation of the page:

- Main page
- New cash register
- Modify cash register

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:47 -04:00
David Nind
7ec0a8ae60
Bug 34942: Fix typo - 'brower' to 'browser'
This fixes a typo in a message used in the advanced cataloguing
editor when macros are converted from being stored in the browser to
being stored in the database (bug 17268 - Advanced cataloging editor
- rancor - macros are lost when browser storage cleared).

Test plan:
1. Search for 'brower' in the codebase - there should be one occurance:
   grep -rn --exclude=*.po brower *
2. Apply the patch.
3. Run the search in step 1 again, there should now be no occurances.
4. Review the diff for the patch a nd make sure that the change makes
   sense.
5. Sign off! 8-)

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:46 -04:00
David Gustafsson
ee8ef4b174
Bug 29145: Add tests and modify sysprefs
Add tests, remove ODueDebarmentRemovalAllowUnrestricted syspref and instead
modify AutoRemoveOverduesRestrictions to have a third option

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:38 -04:00
Stefan Berndtsson
f2d2a7839e
Bug 29145: use overdues restrict delays when removing overdues restriction upon return
How to test:
1) Run tests in t/db_dependent/Circulation/MarkIssueReturned.t

Sponsored by: Gothenburg University Library

Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 09:24:37 -04:00
56348379ec
Bug 34934: Remove the use of event attributes from OPAC lists page
This patch removes the use of event attributes (onclick, onchange) from
the OPAC lists template. These events are defined now along with the
other in-page JS.

The patch also removes a "delete list" button which was only shown
when viewing an empty list and which was redundant.

To test, apply the patch and log into the OPAC.

- Go to Lists -> New list.
- Change the category to "Private" and the "Allow changes" dropdown to
  "Staff only."
  - You should see a message, 'The "Staff only" permission has no actual
    effect while this list is strictly private'
- Change the category to "Public." The message should disappear.

- View the contents of a list.
  - Click the "Send list" button at the top of the table of titles.
  - It should trigger the "Sending your list" popup window.

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 08:51:13 -04:00
f03cf6cc10
Bug 34936: Remove the use of event attributes from OPAC detail page
This patch removes the use of event attributes (onclick) from the OPAC's
bibliographic detail page template. These events are defined now along
with the other in-page JS.

The patch also adjusts the global "Dopop" function so that the popup
window is a litte bigger. The comments form did not fit well.

In checking for use of the "Dopop" function I found that it was being
redefined in opac-topissues.tt for no reason so I removed it.

To test you must have the OPACComments system preference enabled.

- Log in to the OPAC, locate a bibliographic record, and view the detail
  page.
- Under the "Comments" tab, click the "Post your comments on this title"
  link. It should trigger a popup window.
  - Submit your comment. When the detail page reloads, return to the
    "Comments" tab and click the "Edit" link on your comment. The same
    popup window should be triggered.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-10-03 08:51:13 -04:00
ea91896f15
Bug 34369: Fix 'Did you mean'
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 18:18:41 -03:00
3c6dd02acb
Bug 34369: Pass csrf token from syspref API client (for Vue app)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 18:18:40 -03:00
c6ef2aba6b
Bug 34369: Require CSRF token for updating system preferences
This patch adds the requirements that updating a system preference
requires a CSRF token. (Also, adding and deleting local system preferences.)

0. Apply patch
1. koha-plack --reload kohadev
2. Add local system preference
3. Update local system preference
4. Delete local system preference
5. Update normal system preference
6. Note no errors

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 18:18:40 -03:00
4e32b76198
Bug 34761: Prevent XSS for searches and saved search filters
</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 18:18:39 -03:00
06c2b4898b
Bug 28449: Add column with invoice number to basket summary page
At the moment it's quite a lot of clicks to get from the basket
summary to the invoice something was received in. This adds a nice
shortcut by creating a new column for the invoicenumber in the basket
summary table.

To test:
* Make sure you have a basket with some received and unreceived
  order lines
* Verify that the (received) shows for your received lines
* Verify no invoice number or link to it in sight
* Apply patch
* Verify that there is now a column for the Invoice containing
  the invoice number as a link to the invoice
* Test with a staff patron, that doesn't have edit_invoices permission
* Verify that now instead of a link you see the invoice number as text

Be happy, sign off ;)

Note: this doesn't change the CSV export. The way the CSV is built is
quite different to the summary table, so it would be better handled
in a separate bug/patch. The columns are already quite different!

Sponsored-by: The Research University in the Helmholtz Association (KIT)

Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Émily-Rose Francoeur <emily-rose.francoeur@inLibro.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:50 -03:00
8922fb1863
Bug 34618: Add sort 1 and 2 fields to basket in acquisitions
This patch adds the option to display sort1 and sort2 columns in the
view of the contents of a basket in acquisitions. The columns are
labeled "Statistic 1" and "Statistic 2" to match the labels in the
order creation/edit form.

The fields are hidden by default in the updated table configuration.

To test, apply the patch and restart services.

- Go to acquisitions and create a basket if necessary:
  - Search for a vendor and click New -> Basket from the vendor
    toolbar on the vendor search results screen.
  - Create a basket, then click "Add to basket" from the basket details
    page.
  - Add an order to the basket.
- With at least one order in the basket, check the table of orders in
  the basket.
- The columns should be unchanged.
- The table configuration button should show the two statistics fields
  as hidden. Test that they can be displayed.

- Go to Administration -> Table settings.
  - Under Acquisitions -> basket, try changing the settings for the
    Statistic 1 and Statistic 2 fields, and check that your changes are
    reflected in the basket view.

- Test with a vendor which has an EDI account:
  - Enable the EDIFACT system preference.
  - Go to Administration -> EDI accounts and create an account for your
    vendor.
  - Confirm that the table of orders in your basket still displays
    correctly now that the "Supplier report" column is present.

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:49 -03:00
384f9282e1
Bug 33428: (follow-up): Default to searching 'standard' fields
Before this patch set, a search for patrons from article requests or
reserves would search the attributes by default. They were not considered
'standard' searches, however.

This patch simply defaults to searching the 'standard' fields unless a value is passed

To test:
1 - Apply other patches
2 - Have patrons with searchable attributes
3 - From a title, click the holds or artickle requests tab
4 - Search for the attribute values and confirm patrons are not returned
5 - Apply this patch
6 - Search again, patrons are now returned

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:48 -03:00
bfdee70f24
Bug 33428: (QA follow-up) Fix escaping in a split call
We'd missed an escape case in one of the calls to .split for the pipe
delimited split operations.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:48 -03:00
47a2029161
Bug 33428: Adjust Unit Tests
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:47 -03:00
b1b92cb9a4
Bug 33428: Parse search fields in buildPatronSearchQuery
This patch moves the parsing of standard search_field into the buildPatronQuery subroutine
and adds a check for 'standard' field before adding attributes to the search

To test:
1 - Add a new attribute type and make it searchable
2 - Add a value to a patron
3 - Search for this value using 'Standard' fields, confirm you get the patron
4 - Search for the value using 'Cardnumber' field, confirm you get the patron - BAD!
5 - Apply patch
6 - Repeat cardnumebr search, confirm patron not found - Yay!
7 - Search standard, confirm patron is found
8 - Add a new field to 'DefaultPatronSearchFields
9 - Confirm it appears in patron search dropdown
10 - Confirm a search of this field with the attribute value does not return the patron

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:46 -03:00
cdedd6f2db
Bug 29822: (QA follow-up) Use pipe for all field separators
- Tidy atomic update

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:44 -03:00
6a98a8ef83
Bug 29822: Database and Preference description updates
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:43 -03:00
ffcfc13c7e
Bug 29822: Update code to reference by pipe
Moving to modalselect also has the effect of moving from comma delimited
to pipe delimitation for the preference contents

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:42 -03:00
0b4a37a29d
Bug 29822: Use the modal
As requested by Katrin.. switch to the modal and expose all fields from
the borrowers database table

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:41 -03:00
4d2a3d58b4
Bug 29822: Update 'DefaultPatronSearchFields' to a select list
This patch updates the `DefaultPatronSearchFields` preference from
freetext expecting a comma delimited list of borrower fields to a
multi-select with a sensible list of fields available.

I opted to not use the Modal approach with all borrower fields listed as
I felt it made more sense to only expose a more limited subset of the
fields available to us.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-25 10:53:41 -03:00
872c4ba2dc
Bug 34114: Replace the use of jQueryUI sortable
This patch adds a replacement for jQueryUI sortable, a standalone
library called Sortable. The patch updates pages which previously used
jQueryUI for sorting.

The patch updates the style of most sortable elements to use the
"grip-vertical" Font Awesome icon.

To test, apply the patch and test the following pages, confirming that
sortable elements are sortable and that the newly sorted state is saved
correctly:

- Administration -> System prefernces -> I18N/L10N
  - With multiple languages installed, test that languages listed in the
    'language' and 'OPACLanguages' preferences can be sorted and that
    after saving your changes the interface relfects your changes: In
    the footer and header of the OPAC and in the footer of the staff
    interface.
- Administration -> MARC bibliographic framework -> MARC structure ->
  Edit subfields of a tag.
  - Test using a tag with multiple subfields, e.g. MARC21 245.
    - Test that you can click and drag to reorder the tabs in the
      subfield edit view.
    - Test that when you save your changes, including changes to the
      "New" tab position, that fields are ordered correctly both in the
       display on this page and in the basic MARC editor.
  - Perform the same tests on Authorities: Administration -> Authority
    types -> MARC structure -> Edit subfields of a tag.
- Authorities -> New (or edit) authority
  - Multiple subfields of a tag should be sortable.
  - Multiple copies of the same tag should be sortable relative to each
    other.
  - Confirm that your changes are saved correctly and that the detail
    view of your updated authority record is correct.
  - Perform the same tests on Cataloging -> New (or edit) record in the
    basic MARC editor.
- Enable the StockRotation system preference if necessary.
  - Go to Cataloging -> Stock rotation
    - If necessary, create a new rota and add multiple stages
      - In the "Manage stages" view you should be able to click and drag
        to reorder stages. The new position should be saved immediately
        via AJAX.

Signed-off-by: paul <paul.poulain@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-22 13:00:00 -03:00
7d80a1df25
Bug 34302: (bug 28653 follow-up) Do not refresh the table if an error happened
If checkin or renew failed, we should not refresh the table or it will
hide the error message.

Test plan:
Apply the DO NOT PUSH patch
Do a renew
=> No error in the table
Apply this patch
Do a renew
=> You see the error
Revert the DO NOT PUSH patch
Do a renew
=> The table is refreshed

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-22 12:35:50 -03:00
9f59ea2f61
Bug 34835: Highlight logged-in library in patron searches fix for new staff interface
Since Bug 30952 the feature from Bug 10902 does not work anymore.
The class "currentlibrary" is there but no background color in CSS.
Bug 30952 removed it :
-    background-color: #E6FCB7;

This patch restores this rule plus '!important' that is used by
class 'ac-currentlibrary'

Test plan:
1) Perform a patrons search
2) Check you see green background color for patrons with same branch as
   currently logged in.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2023-09-22 12:35:50 -03:00