Commit graph

6885 commits

Author SHA1 Message Date
Samanta Tello
d12b4e0b19 Bug 14490: Duplicate armenian translator
This patch fix trivial duplicate
in about page.

To test:
1) Go to about page > translations
2) Check duplicate entry for Armenian
first in 4th line, second before indonesian
3) Apply patch
4) Reload page and check again

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Trivial string patch. The restults are the expected.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Double checked :-P
2015-07-03 12:59:57 -03:00
Tomas Cohen Arazi
936d452ffa Bug 11882: (QA followup) fix capitalization errors
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-26 15:10:55 -03:00
simith
8e04ea7282 Bug 11882: Add a new button to the checkout confirmation dialog when checking out a reserved item
This patch adds a "Don't Check Out and Print Slip" button to the dialog that appears
        when trying to checkout a reserved item.

Test case :
* Put a hold on an item for User A.
* Try to check out it item with User B.
* The "Please confirm checkout" box should appear. The "Don't Check Out and Print Slip" button should appear in this box.
* Click on the "Don't Check Out and Print Slip" button.
* A print popup will appear

Signed-off-by: Nick <Nick@quechelibrary.org>

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-26 15:07:32 -03:00
Lyon3 Team
bf9bff898f Bug 12074: Filter duplicates when adding a batch from a staged file
When adding a batch of records to a basket, duplicates are skipped and
an alert is displayed with a link to them so as they could be treated
individually.

Test plan :

You need the 2 test attached files TestFile1.mrc and TestFile2.elc
(TestFile1 includes only the title "Amilec ou La graine d'hommes" that
is also included in TestFile2)

1) go to “Stage MARC records for import” page, upload TestFile1 and
stage it (select iso 5426 encoding).
2) Manage staged record and import the batch.
3) Make sure that the new record is indexed (depending to your indexing
system and test platform).
4) Go back to go to “Stage MARC records for import” page upload
TestFile2 and stage it (select iso 5426 encoding).
5) Go to acquisitions module and create a new basket.
6) From your basket, in the “Add order to basket block”  choose  'From a
staged file'.
7) Then click File2 (‘addorder button').
8) Go down the "Import all" block and save.
9) You are redirected to the basket page : a warning is displayed to
tell you that some duplicates have been found and skipped.
There's a link on the warning throughout you can go back to the list of
remaining records and treat them individually if necesary.
10) Click the link : you fall upon the title of TestFile1 (of course as
it's a duplicate).
11) Check that the imported records have been indexed.
11) Go down the "Import all" block and save.
12) A warning is displayed saying that no records have been imported
because they all match an existing record. The “Import all” block is not
any more visible.

Signed-off-by: JA <aloi54@live.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-24 11:32:30 -03:00
Liz
f900ea03bf Bug 14450: itemsearch no longer working
To test:
Click Advanced search in staff client
Click the link for "Go to Item Search" at the top of the page
Do a search, you should get results. Try some combinations and make sure it works like it should.

Signed-off-by: Jacek Ablewicz <abl@biblos.pk.edu.pl>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-24 10:54:10 -03:00
Indranil Das Gupta
3a179e7a2b Bug 14252: (followup) addresses the QA Manager comments
Addresses Katrin's comments in comment# 56

TEST PLAN
---------
 1) Back up your DB
 2) Ensure you have multiple languages, including
    some that have sub-languages (e.g. de-DE, de-CH)
    -- cd misc/translator
    -- perl translate install {language code}
 3) Ensure that you have all the languages enabled
    -- Staff client -> Home -> Global system preferences
       --> I18N/L10N
       Check all the languages in opaclanguages.
       Ensure that opaclanguagesdisplay is 'Allow'
 4) Open OPAC
    -- should only have languages in footer.
       Annoyingly below the fold.
 5) Drop your koha database, and create a blank one.
 6) Apply all patches
 7) Reinstall all the known languages, so the templates
    are appropriately updated.
 8) Go to staff client and do an install of koha, with
    all the dummy data.
 9) Ensure you have all the languages enabled (see (3))
10) Refresh your OPAC page
    -- language selector position should be in both
       the footer and at the top as expected.
    -- this confirms the sysprefs.sql change.
11) Restore your DB
12) run the updatedatabase.pl script
13) Ensure you have all the languages enabled (see (3))
14) Refresh the OPAC page
    -- should still only have languages in the footer.
    -- this confirms that upgrade won't change anything.
    -- this confirms the atomic update.
15) git diff origin/master
    -- the opac-bottom.inc difference should only
       have changes around a SET, IF, and END.
       This confirms the noprint was fixed.
16) In the staff client, change the OPAC system preference,
    OpacLangSelectorMode, to all three values.
    For each value, refresh the OPAC page, and confirm the
    position of the language selector.
    -- should work as expected.
17) run koha qa test tools

NOTE: Tested as a single batch together.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
8da9d099c6 Bug 14252: (Followup) Fixed issues pointed to in comment #40
Based on Mark's inputs in comment #40 -

[1] selected 'mast' (short of 'masthead') and updated :
   (a) bug_14252-OpacLangSelectorMode_syspref.sql
   (b) sysprefs.sql
   (c) opac.pref
[2] Reduced the calls to Koha.Preference() from :
   (a) masthead.inc
   (b) opac-bottom.inc

After applying this patch, update the database once for it to pick
up the new option values -'both|mast|foot'.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Indranil Das Gupta
a2478a708b Bug 14252: (followup) Adds OpacLangSelectorMode syspref
Based on discussion, this followup does the following:

1/ brings back the switcher on opac-bottom.inc
2/ adds a syspref OpacLangSelectorMode to toggle between the three
   modes:
     (a) show switcher both on masthead and footer (default)
     (b) footer only
     (b) masthead only

Test plan
=========

1/ apply earlier patches attached to this bug in their correct order
2/ apply this followup patch
3/ run updatedatabase.pl to add in the atomic update
4/ goto admin/preferences.pl?tab=opac
5/ look up OpacLangSelectorMode, it should be set with default value
   "both masthead and footer"
6/ check OPAC to see if both locations show the selectors
7/ change OpacLangSelectorMode to 'only header' and 'only footer' at
   each iteration, and check if the selection has correctly toggled
   the selectors. It should

Note: make sure you do not have the patch 11057 applied on the branch
      from before, otherwise merge conflict might happen.

http://bugs.koha-community.org/show_bug.cgi?id=14252

Followed test plan. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:24:46 -03:00
Jonathan Druart
cad134cd17 Bug 13962: Add link to the vendor detail page
This patch 1/ uses the class of the th to filter the columns and 2/ adds
a link on the vendor name to the vendor detail page.

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:20:34 -03:00
Katrin Fischer
55103ad860 Bug 13962: Add vendor to acq details tab in staff
Implementing some feedback from our user meeting:
The acquisition details tab on the detail page
in staff should also show the vendor of the
order.

To test:
- Make sure AcquisitionDetails is active.
- Create an order or look up an order in the
  acqusition module.
- Go to the ordered record and check the
  'Acquisition details' tab
- Verify the vendor shows up there as first
  column now
- Check that sorting and display of the other
  columns are still working correctly

Note: Also fixes a </th> that should be a </td>
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:20:34 -03:00
Liz Rea
887bb6d510 Bug 14423: tab characters in auth_subfields_structure
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:39 -03:00
603a111d3a Bug 14423: Multiple XSS bugs in suggestion.pl
To test
1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to=
2/ Notice alert box(es)
3/ Apply patch
4/ Reload and notice alert is gone

Repeat for
collection_title
copyrightdate
isbn
manageddate_from
manageddate_to
publishercode
suggesteddate_from
suggesteddate_to

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:33 -03:00
d87b8a5cf3 Bug 14423: Multiple XSS vulnerabilities in serials-search
To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:26 -03:00
a5489d9936 Bug 14423: XSS bugs in catalogue search
To test

1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice alert boxes
3/ Apply patch
4/ Reload url, no alerts
5/ Check search still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:18 -03:00
91a8584aa8 Bug 14423: XSS issues in marc_subfields_structure
1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice all the alert boxes
3/ Apply patch
4/ Reload page, no more alerts
5/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:11 -03:00
c08063d037 Bug 14423: XSS bug in auth_subfields_structure
1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice a ton of alert boxes pop up
3/ Apply patch
4/ Reload url, no longer get any alerts
5/ Test fuctionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:12:03 -03:00
3601c6fb1b Bug 14423: XSS bug in lateorders
1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom
2/ Not you get an alert box
3/ Apply patch notice it is fixed
4/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:11:57 -03:00
98901d27be Bug 14423: XSS in authorities-home
To test:
1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice you get 3 alert boxes
3/ Apply patch
4/ Hit the url again, no js

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-23 10:11:49 -03:00
Katrin Fischer
e5cea455d0 Bug 14356: Improvements to the 'Transfers to receive' page
Patch makes several small changes to the template for the
'Transfers to receive page'

1) Show the branch name instead of the branchcode in the
   table of incoming transfers.

If there is a hold connected with the transfer:
2) Show the patron's name as 'surname, firstname'
   intead of 'surname  firstname'
3) Restore broken feature: Show a mailto: link with a
   generated subject of 'Hold: <title>'.

The mailto: feature actually existed in the templates, but
was broken to a misnamed database column. I made some small
changes to make the subject translatable (see bug 8330).

To test:
- Create a transfer by placing a hold with pickup at another library
- Craete a transfer manually
- Go to the circulation > transfers to receive
- Check the changes explained above, compare before and after
- Check the mailto: link works as expected

Bonus: Check the Hold: bit in the subject is really translatable now.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-22 17:30:53 -03:00
Jonathan Druart
b61782f1e7 Bug 14253: (follow-up) Same fix for the basket page
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-22 17:07:46 -03:00
Katrin Fischer
e835e03ccf Bug 14253: Acq - notify borrowers popup needs to allow scrolling
The 'notify on receiving' patron search on the new order form
in acquisitions didn't allow you to scroll, so there was no
way to select users from the bottom of a longer result list.

To test:
- Create a new order in acquisitions
- On the order form, use the 'Add user' button to open
  the popup
- Perform a patron research with a lot of results
- Verify that with the patch you can scroll, but
  that you couldn't without it

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
without patch: no scroll bar in Firefox 38
with patch: scrolling works fine

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-22 17:07:45 -03:00
Katrin Fischer
46a2585b01 Bug 11804: Remove unused circ-menu.tt
The formerly used circ-menu.tt is no longer referenced in the
templates and can be removed.

To test:
- Verify all tabs in the patron account still work as
  they should.
- git grep circ-menu.tt

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
No problems on patron pages, no more circ-menu.tt
No errors

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-22 16:57:11 -03:00
Nicolas Legrand
1ea3465d30 Bug 14290: Add a table foot to circulation matrix
Reprint circulation matrix header in a footer helps editing entries in
big matrix. Otherwise, the header disapears and it's hard to tell
which columns we're editing.

Test plan : try do add, modify or delete some entries in the
circulation matrix, everything should work as expected.

Patch works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:53:30 -03:00
Katrin Fischer
67881bd907 Bug 8330: Overdue email link contains untranslatable 'Overdue:'
The translation scripts don't pick up text from href attributes,
which is what we want, with a small exception for this script.

Patch uses a TT trick to make the Overdue: in the subject
of the mailto: link translatable.

Regression test:
- Make sure you have an overdue item
- Go to Circulation > Overdues
- Verify the [email] link works and a subject
  with 'Overdue: <title>' is generated
- Apply patch and repeat steps

Bonus: Verify the branch name now shows instead of
       the branchcode in the table

To test translatability:
- cd misc/translator
- perl translate update de-DE
- Open file po/de-DE-staff-prog.po
- Search for Overdue:
- Translate string, remove 'fuzzy' marker
- perl translate install de-DE
- Test again, subject should now be translated

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:50:48 -03:00
Katrin Fischer
6d9d66e32a Bug 14094: DDC - Add separators for repeated $a subfields (MARC21)
Mulitple 082 fields are already separated by |, but multiple
$a in one 082 field were only separated by space, making those
not easy to read.

Patch takes care that the | separator is used in all cases.

To test:
- Catalog a record with multiple 082 fields
- Add one or multiple $a subfields to each
- Verify every single classification is separated from
  the others with a | in staff and in OPAC detail pages

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:48:18 -03:00
Katrin Fischer
da8ec2d37a Bug 13874: 'Rotating collections' are a circulation tool
Moves the entry for 'Rotating collections' from the Catalog
column to the 'Patrons and circulation' column.

To test:
- Verify the entry has been moved on the tools home page

NOTE: I agree that collections makes more sense under the new
      column.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:47:37 -03:00
Robin Sheat
865321f372 Bug 14394: fix documentation of OpacHiddenItems
The current documentation of OpacHiddenItems told people to go and read
a file on the server, which most people don't have access to. This
replaces it with a link to the wiki.

http://bugs.koha-community.org/show_bug.cgi?id=14394

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

It doesn't apply for some reason. Fixed
Added target attribute to open in new window/tab,
hope you don't mind.

Updated documentation
No errors

Belongs to Aleisha or Robin?
Update assignee please :)

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:24:36 -03:00
Jonathan Druart
68f0fe7b6f Bug 10172: Hide some uneeded stuffs on printing a record
When printing a record from the OPAC or the staff interface, some
uneeded blocks are displayed.

OPAC:
1/ Browse results
2/ The view tags (Normal, MARC, ISBD)

Intranet:
1/ Marc view link
2/ The Please upload one image link

Test plan:
On a record detail page (staff and OPAC), print the page and confirm
these blocks no longer appear.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:10:06 -03:00
Katrin Fischer
45c1b8f7b2 Bug 10119: Add note about CalculateFinesOnReturn to description of finesmode
This adds a note to the descrpition of the finesmode system
preference mentioning that CalculateFinesOnReturn is another
option for charging fines:

Note: Fines can also be charged by the CalculateFinesOnReturn system preference.

To test:
- Search for the finesmode system preference
- Verify the new text shows and is correct

NOTE: New text appears as expected. You can also just scroll for
      it on the Circulation preferences tab.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:08:46 -03:00
Nicole C. Engard
469275fef5 Bug 14424: Tools Help Files for 3.20
This patch updates and adds help files to 3.20+

To test:

* Visit batch record modification and note that there is a help file
 and confirm the text is right
* Visit export data, import borrowers, stage marc for import, and log viewer
  * Confirm updated text is right

Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:06:21 -03:00
Nicole C. Engard
d3983e563f Bug 14424: Admin Help Files for 3.20
This patch updates some of the help files for Admin areas in 3.20+

To test:

* Visit
  * Frameworks, add field, add subfield
  * Column settings
  * Patron attributes
  * Circ rules
* Confirm help loads up and is right

Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:06:20 -03:00
Katrin Fischer
6c94fe52f9 Bug 11458: Improve confusing description of syspref 'gist'
The description of "gist" was:

"Default tax rates are ... (enter in numeric form, 0.12 for 12%.
First is the default. If you want more than 1 value, please
separate with |) "

The doubled use of "default" is confusing here.

With the patch it reads:

Tax rates are ... Enter in numeric form, 0.12 for 12%.
The first item in the list will be selected by default.
For more than one value, separate with | (pipe)

To test:
- Verify that the gist system preference description is
  correct.

The use of "default" is confusing here.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:05:44 -03:00
Jonathan Druart
542b06f065 Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)
Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 11:00:09 -03:00
Chris Cormack
703a928b9d Bug 14416: Stored XSS vulnerability
The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

To test:
1/ Create a shelf in the opac that contains some malicious js
 eg Bad stuff <script>alert('oh noes');</script> as the name
2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client
  Note the js is executed
3/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is not escaped
4/ Apply patch
5/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is now escaped
6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-22 10:59:59 -03:00
Katrin Fischer
2eaeb70879 Bug 14215: Change the 'delimiter' syspref description for its wider use
Patch changes 'report files' to 'CSV files' as there are more
options now for downloading and creating CSV files where this
preference is taken into account.

To test:
- Verify the changed system preference description for
  'delimiter' is correct.

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:36:40 -03:00
c76b6a148b Bug 13904: Make unimarc_field_4XX displays usefull 200 subfield data
When searching for multivolumes titles, UNIMARC 4xx field plugin
displays the title of the biblios (200$a), without giving info about
volumes (200 $h $i). It neither doesn't display $e (subtitle) info which
could greatly help to disambiguate search result.

The displayed title is supposed to link to a biblio record view (MARC /
normal). It doesn't work.

TO TEST:

- On a UNIMARC Koha, add a new biblio record
- Call the 4XX plugin from 461/463 field
- Search for a biblio record which contains 200$e, and/or 200$h and/or
  200$i subfields.
- You get a result list, with two issues:
  1. $a, $h & $i aren't displayed
  2. Biblio title is not a link
- Apply the patch, and repeat previous steps.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
I got a link on fulltitle, but in 'ahie' order (not aehi)
Fixed some tabs.

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:35:57 -03:00
Jonathan Druart
d847b1d92a Bug 10866: Hide patron's history if intranetreadinghistory is set to not allow
If set to "not allow", the intranetreadinghistory pref prevent staff
members to access patron's checkout history.
But:
1/ The page is still accessible if you know the url
2/ The history can be consulted on the item history page

Test plan:
0/ Don't apply this patch
1/ Set the intranetreadinghistory to allow
2/ Go on a patron's checkout history page
3/ Open a new tab and go on a item's checkout history page
4/ Set the intranetreadinghistory to not allow
5/ Refresh both pages => no change
6/ Apply this patch
7/ Refresh both page.
On the first page, you should see a warning
On the other one, you should see that the patron column is not displayed
anymore.

Followed test plan, results were as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

http://bugs.koha-community.org/show_bug.cgi?id=10886
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Nice addition!
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:34:27 -03:00
Katrin Fischer
688452ad7e Bug 13427: jQuery Timepicker is not translated on returns page
The returns page was missing an include with the translated strings.

To test:
- Install an additional language, like de-DE
- Confirm the bug on the returns page
  - Make sure SpecifyReturnDate is activated
  - Open the datepicker, look at the time settings
- Apply the patch
- Reinstall the language, no update of the po files is needed
- Retest
- Verify, that now the time settings are translated

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Works as expected

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-19 11:30:15 -03:00
Jonathan Druart
d56a275c0d Bug 14070: Prevent to save a letter if an error occurred
On saving a letter, if the title or the content of a template is not
defined, a JS alert is raised. But the form is submitted anyway.
This patch prevent the form to be submitted.

Test plan:
- Create or edit a letter
- Fill the title for a template, not the content
- Save
- Confirm you get the alert and that the form is not submitted

http://bugs.koha-community.org/show_bug.cgi?id=14070

Signed-off-by: Indranil Das Gupta <indradg@gmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-06-17 09:55:40 -03:00
Jonathan Druart
83da81e0ce Bug 14029: Provide 'clear' link to empty reports search filters
Patch adds a 'clear' link next to the 'Apply filters' button to
empty out the form fields.

To test:
- go to the reports module
- make sure you have some saved reports
- search your saved reports using the author, keyword and date filters
- verify searching works as expected
- verify the new 'clear' link works as expected

Tested couner patch, followed test plan, works as expected. QA tools ok.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 13:08:53 -03:00
bba78196d3 Bug 13336 - Add time to date column for patron circulation history
Some librarians have expressed that it would be very helpful to have the
hours displayed in the date column for a patron's circulation history.
The time an action took place can be vital to tracking down which
librarians were working at the time a given circulation action took
place.

Test Plan:
1) View a patron's circulation history
2) Note the Date column has no hour/minute
3) Apply this patch
4) Reload the page
5) Note the hour and minutes now display

Signed-off-by: David Roberts <david.roberts@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 12:19:55 -03:00
99df63b4b0 Bug 7981: (QA followup) Rename TT vars
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 10:41:49 -03:00
Katrin Fischer
ca17301881 Bug 7981: Follow-up - Fix qa script complaints
- Fix updatedatabase, moving the update entry into the right spot
- Fix some tabs

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 10:41:44 -03:00
Jonathan Druart
074f8637e8 Bug 7981: Use The Branches TT plugin instead of GetBranchName
Note that homebranchname is never used in the template.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 10:41:37 -03:00
Benjamin Rokseth
57608fdecb Bug 7981: Remove HomeOrHoldingBranchReturn syspref
This patch removes HomeOrHoldingBranchReturn syspref and makes circ/returns.pl respect branch
circulation rules from C4::Circulation::GetBranchItemRule. Also transfer slip notice should reflect this.

Default should always be to return item to home branch.

Test plan:
- make sure syspref 'AutomaticItemReturn' is set to 'false'
- unset 'Default checkout, hold and return policy' or set 'Return policy' to 'Item returns home'
- checkout an item and do a checkin from different branch than items homebranch
- verify that you're prompted with a transfer message to item's home branch and that print slip matches

- set 'Return policy' to 'Item returns to issuing library'
- do a checkout and a checkin from branch different than item's home branch
- verify that you're not prompted with a transfer message and that holding library is your current branch

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Follow-up:
- Added 3 tests in t/db_dependent/Circulation_Branches.t to test AddReturn
  policies
- Removed HomeOrHoldingBranchReturn from sysprefs.sql
- Added notice on removing syspref in updatedatabase

QA edits:
- removed trailing whitespace in tests
- moved branchname lookup from returns.pl to template

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
2015-06-11 10:24:22 -03:00
Jonathan Druart
27ef1410a7 Bug 11941: Add link to patron lists from the patron home page
The patron lists are only accessible from the tools module, which is not
easily accessible when you are in the patron module.

Test plan:
Go on the patron home page.
In the toolbar, you should see a link to the patron lists.

NOTE: Tweaked button to a to get the click to work.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:15:46 -03:00
Jonathan Druart
c345694808 Bug 13970: Remove category_type related code
Working on bug 13497 and bug 9314, I run into some Koha vestiges.
The category_type parameter should not be passed to memberentry.
On creating a new patron, the categorycode should be passed, and on
editing, it's useless. We can work with the borrowernumber and retrieve
these values.

Details of the changes:
- members-toolbar.inc: Remove the category_type parameter passed to
memberentry.pl
- memberentrygen.tt: Just remove the useless category_type parameter on
  editing a patron. Also remove the unused one passed to
  guarantor_search.pl.
- tables/members_results.tt: the borrowernumber is enough to edit a
  patron.
- memberentry.pl: check_categorytype is never used in the template, all
  the process to calculate/retrieve it is unnecessary.
- members/nl-search.tt: The borrowernumber is enough to edit a patron.

Test plan:
Try to create and edit patrons and verify that
- the guarantor search still work
- the form (memberentry) behave as before

Edit a patron from the nl-search.pl script (Magnus?)

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

On top of 9314 (13497 already pushed)

No evident regressions found, add/edit patron works,
search/set guarantor works.

Cant test nl-patron.pl save for exec it.
prove -v t/NorwegianPatronDB.t runs

No koha-qa errors

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:11:01 -03:00
Jonathan Druart
9d793b2f7e Bug 9314: Remove useless code related to the type_only parameter
Since the pref AddPatronLists has been removed in bug 13497, the code
related to type_only and category_type in memberentry.pl is useless.

Test plan:
Confirm you don't the information message.
You can also confirm that the message was wrong and nothing was saved.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Dead code removed, no errors

Think that bug description can be updated to commit message

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:09:55 -03:00
721a77e669 Bug 14338: Unable to delete patron images
The call to RmPatronImage is still passing cardnumber as its parameter
instead of borrowernumber.

Test Plan:
1) Upload a patron image
2) Ensure the card number is not the same as the borrower number
3) Attempt to delete patron image
   -- Image will remain
4) Apply this patch
5) Attempt to delete patron image
   -- Image will be removed
6) run koha qa test tools

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-11 10:08:59 -03:00
Jonathan Druart
0002126a2a Bug 10355: paramater 'object' lost on the road
Test plan:
1) Go to any detail page in staff
2) Click on the modification log tab
3) Verify, that the object is prefilled with the records biblionumber
and you can also see it as parameter in the url
4) Click a second time on modification log to reset your search

Before this patch, the object parameter was empty.
It now contains the value of the biblionumber.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described, no koha-qa errors

http://bugs.koha-community.org/show_bug.cgi?id=10335

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-08 16:25:54 -03:00