Commit graph

13256 commits

Author SHA1 Message Date
d86ff0f5db Bug 20778: (bug 19777 follow-up) Fix subscription deletion
Caused by
  commit 666a1b2760
  Bug 19777: Move template JavaScript to the footer: Serials, part 3

TT vars should not be used in .js files

Test plan:
Delete a subscription, confirm you see the confirmation popup and that
the it deletes the subscription correctly after it has been confirmed.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 09:48:12 -04:00
3e91d99a15 Bug 20053: Drop type attribute "text/javascript" in OPAC templates
This patch is a reimplementation of the original from Indranil Das Gupta
and the QA follow-up from Julian Maurice. Original test plan:

Conformance rules for HTML5 is generating warnings for <script> element
with type="text/javascript" attribute when the OPAC page is checked
with W3C Validator. This patch removes the cause of these warnings.

Test plan
=========

1/ Paste the URL to your OPAC page (if it is hosted) to W3C Validator
   and watch about 10+ warnings being generated by the validator.

2/ Apply patch and re-submit the page to the Validator. The warnings
   would be gone.

Signed-off-by: Jon Knight <J.P.Knight@lboro.ac.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 09:48:12 -04:00
Katrin Fischer
870913b3c3 Bug 2426: Remove deprecated management permission
After review of the code it turns out that the management permission
that has been marked as deprecated a long time ago, does not have
any function.

The patch removes all remaining code related to it.

To test:
- Make sure you have a patron with the management permission
- Apply patch
- Run database update
- Check everything still works as expected

Bonus:
borrowers.flags is recalculated for patrons with management
permission.

To check:
- Create some 'permission twins' with and without management
  permission
- Note the value in borrowers.flags
- Apply patch, don't run database update
- Save permissions from GUI for one of the twins
- Note the newly calculated value
- Run database update
- Now both twins should have the same borrowers.flags value

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 12:17:25 +00:00
Kyle M Hall
d4cf19ac04 Bug 20120: (QA follow-up) Pass on_editing parameter for Price plugin
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 11:45:25 +00:00
Kyle M Hall
515cab0c46 Bug 20120: Prevent writeoffs of more than the amount owed for a fee
In short, it is possible to 'over-writeoff' a fee such that the value of the fee is now a credit.

Test Plan:
1) Attempt to writeoff a single fee, set the amount input to more than
   the amount of the fee.
2) Note the writeoff makes the fee go negative.
3) Apply this patch
4) Attempt to repeat step 1, you should be unable to write-off an
   amount more than the amount outstanding for the fee!

Signed-off-by: George Williams <george@nekls.org>

Signed-off-by: George Williams <george@nekls.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 11:45:23 +00:00
f8ea20344b Bug 20875: (bug 16735 follow-up) Fix library list for OpacAddMastheadLibraryPulldown
This patch fixes a regression introduced by
  commit 2059f7d801
  Bug 16735: Migrate library search groups into the new hierarchical groups

It re-added code that was removed by bug 15758 (use of var BranchesLoop).

Test plan:
- Create library search groups
- Turn OpacAddMastheadLibraryPulldown on
- At the OPAC confirm that the search box with libraries and library
groups is displayed and works correctly.
- Remove the library search group
- The dropdown list should not have the optgroup tags

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-08 10:48:13 +00:00
63673d70cd Bug 17561: (follow-up) Pass itemnumber on returns and correct itemnumber param in circulation
To test:
1 - Place two holds on a bib for a single patron
2 - Check in both items, confirm the screen message and slip are correct
3 - Checkout both items to another patron, confirm the screen message
and slip are correct

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-04 13:40:37 -04:00
Benjamin Rokseth
2c1f7d2281 Bug 17561: ReserveSlip needs itemnumber for item level holds on same biblio
This patch fixes a regression after bug 14695.
This patch adds itemnumber and barcode as optional params in ReserveSlip used
by hold-transfer-slip.pl to generate HOLD_SLIP. This is for ReserveSlip to be
able to generate correct slips when items in multi-item holds are checked in.

Test plan:

1) activate a circulation rule with multi-item holds
2) Place two holds on same biblio for patron
3) for debugging, either use browser console to observe POST request and responses
   or use info from reserves, e.g. reserve_id in the HOLD_SLIP
4) checkin two items from same biblio on pickup branch
5) note that both holds are effectuated, but reserve_id is the same on both slips
6) also note that there is no itemnumber or barcode in the requests from returns.pl
7) Apply this patch
8) repeat 2-4
9) note that reserve_id is now different on the two slips

and/or:
Run tests:
  t/db_dependent/Reserves/ReserveSlip.t

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Maksim Sen <maksim.sen@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-04 13:40:36 -04:00
Katrin Fischer
819e6216e6 Bug 3849: Improve descriptions of granular acquisition permissions
The permissions for acquisitions were not very clearly described.
This patch changes the descriptions in the include file (GUI) and
in the default SQL.

To test:
- Go to any patron account in staff
- Go to more > permissions
- Verify that the meaning of each acquisition permission is clear
  from the description

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-04 13:59:44 +00:00
9bd9d28874 Bug 20831: Fix KohaTable calls after bug 9573
Test plan:
0) Do not apply the patch
1) Confirm not working datatable on patrons hold history page
2) Apply the patch
3) The table should be working now

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-04 13:58:04 +00:00
f9d62f1585 Bug 20840: (bug 2696 follow-up) Fix biblio info fetch
There is no accountlines.biblionumber field, if the account line is
linked to an item, accountline-details.pl will explode with:
Template process failed: undef error - The method biblionumber is not
covered by tests!

Test plan:
Create a fine for a given item
Pay the fine
View the detail of the account line

=> Without this patch you get a software error
=> With this patch applied you will see the biblio's title

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-06-04 12:55:20 +00:00
Kyle M Hall
0895eadd67 Bug 20798: Client side validation for for fund selection prevents adding only some records to a basket
Bug 19453 "fixed" the fund validation that never actually worked. This validation should be removed altogether instead. It is overly simplistic and simply checks to see if each record in the batch has a fund selected regardless of whether that record will be imported or not.

In addition, the code completely ignores items generated by MarcItemFieldsToOrder such that even if items on that page have a fund selected, the javascript forces the librarian to make a selection from the left-hand fund pulldown even though it will not be used.

Considering this bad validation is basically 'new' as it never worked before, the most sensible course of action would be to 'undo' the change and remove the validation.

Test Plan:
1) Add records to a basket from an import batch
2) Select only some of those items in the batch
3) Note Koha will not let you import them unless you set funds for *all*
   records in the batch
4) Apply this patch
5) Note Koha no longer forces a budget to be selected in the pulldown

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

https://bugs.koha-community.org/show_bug.cgi?id=20789
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 14:20:08 +00:00
c48f3cd73c Bug 20761: Fix some js includes in rancor
To test:
1 - Load the advanced cataloging editor
2 - Inspect the network tab in your browser (F12)
3 - Note failure to load 'cataloging_.js'
4 - Note some other scripts don't have versioning
5 - Apply patch
6 - Reload page
7 - Note cataloging.js loads with version number
8 - Note more js files have versioning

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 14:16:56 +00:00
60b0d9439b Bug 20781: Set a minimum enrollemnt period 'in months' of 1
To test:
 1 - Browse to Admin->Patron Categories
 2 - Click '+ New category'
 3 - Enter data as required, however, enter 0 in 'Enrolment period' ->
'in months'
 4 - Save
 5 - View the list of categories, the new category has 'Enrolment period'
= 'until'
 6 - Create a patron in this category, note their dateexipry is
'0000-00-00'
 7 - Search for them
 8 - internal server error
 9 - Delete that patron
10 - Apply patch
11 - Edit the category, note you cannot save with 0 months
12 - Set 1 month and save
13 - Create a patron in this cateogry
14 - Note they have a valid dateexpiry
15 - Search for them
16 - All works
17 - Create a new category and verify you cannot add with 0 months

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 13:56:00 +00:00
Katrin Fischer
db5628e771 Bug 3886: Fix mismatch of required permissions for printing slips
- Print summary (summary-print.pl)
- Print quick slip (printslip.pl)
- Print slip (printslip.pl)
- Print overdues (print_overdues.pl)

Perl scripts all require circulate_remaining_permissions, while
in the template we were checking for edit_borrowers.

Now the print pull down will only be visible if the patron has
circulate or circulate_remaining_permissions.

To test:
- Verify that printing the listed slips works for staff users
  with either circulate or circulate_remaining_permissions
  and without edit_borrowers.

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 13:52:34 +00:00
08c731f6da Bug 20774: Trivial HTML error in itemslost.tt
This patch makes a minor correction to the markup of the lost items
report template.

To test, apply the patch and run the lost items report with parameters
which will return results. The report results should look correct, and
the page should validate with no relevant errors.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 13:34:02 +00:00
Katrin Fischer
76aa349ebe Bug 20752: Fix capitalization on the files tab for patron files
- Activate EnableBorrowerFiles
- Go to any patron account in staff
- Go to the files tab
- Check that strings on the page ar all properly capitalized
  - button
  - legend on section

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 13:27:30 +00:00
Katrin Fischer
62595687c1 Bug 20791: Correct capitalization on 'Notices & slips' page
- Standardizes spelling to 'Notices & slips'

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 13:27:01 +00:00
6773a5e300 Bug 20827: Display Fund's owner name when selected
When a fund is created or edited and does not have a owner yet, the
name of the patron will not be displayed when selected.

The HTML element the JS code expects is not present in the DOM.

Test plan:
- Create a fund, set a owner
- remove the owner, edit, etc.
- Save
- Edit again
Make sure it works as expected.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 12:41:16 +00:00
3b5599f00e Bug 20652: Fix result sorting after search on limit only
1 chomp was missing, spaces were replaced with %20
This patch adds extra chomps, but it does not hurt

Test plan:
Advanced Search
Choose an Item type (do not enter any other search limits)
Search
Click on Sort (it doesn't appear to matter what you sort on)

Signed-off-by: Pierre-Luc Lapointe <pierreluc.lapointe@inLibro.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 12:14:19 +00:00
82a4f23ee3 Bug 20822: (bug 18789 follow-up) Fix HOLD_SLIP
Caused by
  commit ab47e46ea0
  Bug 18789: Pass a Koha::Patron object from returns.pl

circ/returns.pl does not send a $patron Koha::Patron object to the
template in case print_slip is set

Test plan:
Confirm a hold and print the slip

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-05-29 11:58:54 +00:00
aa3a2943f6 Bug 20701: Add csrf protection to mancredit.pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-23 13:01:59 -03:00
d6f99f0df1 Bug 20701: Add csrf protection to maninvoice.pl
TO test:
1 - Be signed in to Koha
2 - Add a manual invoice to an account, works fine
3 - Now do it via url: http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=5&type=test&amount=5&add=Save
4 - Apply patches
5 - Test that everything continues to work as expected (but more securely)
6 - Try adding a new invoice via URL
7 - Should get 'internal server error' and wrong csrf token in logs

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-23 12:19:33 -03:00
fe8a617efd Bug 20803: Cannot search to hold or use print options from API keys interface
This patch adds a required JS asset to the patron API key interface.
Without it, JS-based functions in the toolbar do not work.

To test you must have RESTOAuth2ClientCredentials enabled.

 - From a patron detail page, choose More -> Manage API keys.
 - Test the toolbar buttons on this page, especially "Search to hold"
   and the various print options.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-23 11:44:10 -03:00
cff62796ea Revert "Bug 20073: Move Elasticsearch configs to yaml files and improve the default settings."
This reverts commit f489d2034b.

This commit breaks the install process when using debian packages.
Reverting as we are very close to the 18.05.00 release

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-21 11:02:16 -03:00
b2f5371b01 Bug 20792: (bug 18789 follow-up) Fix patron edit page if TranslateNotices is set
translated_language is not a Koha::Patron's method but a simple variable
sent to the template.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-21 10:58:19 -03:00
Kyle M Hall
1cb0147aff Bug 18856: (QA follow-up) Rename method to avoid confusion
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Hmm. I would have liked the opac parameter even better ;)

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-17 11:40:03 -03:00
Lee Jamison
c1c7f5ede6 Bug 7143: Update about page for documentation team
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-16 13:13:09 -03:00
Mark Tompsett
92ac27b7b2 Bug 20706: Fix bad HTML link to help file
Before there is no href.
After there is.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-16 11:31:14 -03:00
Katrin Fischer
6c1092396a Bug 20706: Adds en language code to the links to the manual
As we don't have a fix yet to link to the right translated manual,
this adds /en to the links from the help files to the manual to
make them work again.

Check with both patches applied, that the links work.
You will have to change 17.11 to 18.05.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-16 11:31:14 -03:00
Katrin Fischer
554642ae75 Bug 20706: Fixes the links to the manual to reflect chanced chapter file names
The numbering in front of the chapter file names has been removed,
so the links need to be adapted accordingly.

Note:
Testing this in master currently won't work for 2 reasons:
- We are still using 17.11 as version variable, will be 18.05 later.
- We are missing the lanugage code before /html and this leads
  to an outdated version of the 18.05 manual.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-16 11:31:14 -03:00
71eba3a74a Bug 20428: Display warning if the entry is empty
And not only if the entry is missing. We should do the same for other
entries.
Also, use Koha::UploadedFile->temporary_directory to know the fallback
value.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-14 11:14:40 -03:00
fdb5d0ca1a Bug 20428: Make upload_tmp a more general tmp directory
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-14 10:36:39 -03:00
da2886132e Bug 20428: Make about.pl inform about missing upload_tmp_path entry
This patch makes about.pl warn about a missing upload_tmp_path entry in
koha-conf.xml. It also mentions the effectively used tmp dir.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-14 10:36:38 -03:00
54944bd102 Bug 7910: Give feedack when the subscriptions have been renewed
This patch adds a message to the user to let them know the subscription
have been renewed successfully.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-11 11:04:44 -03:00
Mark Tompsett
3b47ed3f90 Bug 20719: USE Branches in TT files
TEST PLAN
---------
In the staff client on a kohadevbox:
1) Enable the HouseboundModule system preference.
2) Enable the EnableBorrowerFiles system preference.
3) Go to a patron detail page.
   -- note the Home library is shown.
4) Go to Fines tab (left pane)
   -- Home library is still shown.
5) Click each of the four horizontal tabs
   (Account, Pay fines, Create manual invoice,
    Create manual credit)
   -- Home library not visible for both create tabs
      and the account tab
6) Click the 'Create manual invoice' tab, and create
   some kind of entry.
7) On the 'Account' tab, the table has a 'Details' button.
   Click that.
   -- Home library not visible.
8) Click the 'Details' tab in the left pane.
9) Click 'More' button and choose 'Delete'
   -- Home library not visible when asked for delete
      confirmation.
10) Cancel that, and if you know how to actually
    set up the Norwegian system preferences you can
    figure out how to test the nl-search change.

After seeing all these not visible, apply this patch.
Repeat all the steps, but this time the Home library
should be visible.

Works OK.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-11 10:52:45 -03:00
Amit Gupta
5a7976e34f Bug 20719: Add missing USE Branches to files.tt
Test

On a kohadevbox:
0. Enable the EnableBorrowerFiles system preference
1. Go to any patron, and click on the 'Files' tab in the
   left pane.
   -- the Home library is not displayed.
2. Apply the patch, restart_all, and reload the page.
   -- the Home library is now displayed.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-11 10:52:45 -03:00
d2ea81e652 Bug 18789: Fix borrowernumber on members/files.tt
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-10 14:42:42 -03:00
fe7e0d1e52 Bug 20734: Add warning to the about page if RESTOAuth2ClientCredentials and not Net::OAuth2::AuthorizationServer
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:56:03 -03:00
5cf8bbfb7a Bug 20624: Make staff client respect RESTOAuth2ClientCredentials
This patch makes the staff client UI respect the
RESTOAuth2ClientCredentials syspref.

To test:
- Make sure RESTOAuth2ClientCredentials is "Don't enable"
- Go to a patron's detail page
=> SUCCESS: The 'More' dropdown doesn't show the API keys management
link.
- Enable RESTOAuth2ClientCredentials
- Reload
=> SUCCESS: The 'More' dropdown shows the API keys management link
- Click on the API keys management link
=> SUCCESS: You can edit the api keys
- Disable the syspref
- Reload
=> SUCCESS: You are presented an error 400 page.
- Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:56:02 -03:00
027aa4f349 Bug 20624: Add RESTOAuth2ClientCredentials syspref
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:56:01 -03:00
d2454d6868 Bug 20568: Fix bad resolution conflict with bug 18403
borrowers module permission has now several subpermissions

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:56:00 -03:00
82edceb2ed Bug 20568: (QA follow-up) Remove api-key management from OPAC
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:56:00 -03:00
45841d9ec7 Bug 20568: CSRF protection
Edit: fix warning introduced by this patch

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:59 -03:00
b67e88f429 Bug 20568: Move value => client_id + secret
This patch addresses the request from Julian that api keys are expected
to be client id/secret pairs.

It does so by
- Adding 'client_id' and 'secret' columns
- Removing 'value'

Tests got adjusted and so controller scripts and templates.
Both libs and tests changes have been squashed. This ones remain in
order to keep Owen's attribution on the template changes and avoid
rebase conflicts.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:59 -03:00
37efe6ff76 Bug 20568: (follow-up) Interface and markup changes
This patch makes some interface changes to bring things better in line
with existing interface patterns. This patch also re-indents the
modified templates with 4 spaces instead of 2 and makes <input>s
self-closing.

Also changed: Corrected system preference check in opac-apikeys.pl.

To test, apply the patch and:

In the staff client:

 - Open a patron record and choose More -> Manage API keys.
   - There should be a standard message dialog containing a link to
     "Generate a new key."
     - Clicking the link should show the form for adding a new key.
     - Test that clicking the "Cancel" link hides the form.
     - Test that creating the new key works correctly.
   - You should now see a table showing existing keys and a "Generate a
     new key" button above it.
     - Test that the "Delete" button asks for confirmation, and that
       confirming and denying both work correctly.
     - Test that "Revoke" and "Activate" actions still work correctly.

In the OPAC:

 - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Allow."
 - Log in to the OPAC and click the "your API keys" link in the sidebar.
   - Clicking the "Generate new key" button should display the form for
     adding a new key.
     - Clicking the "cancel" link should hide the form.
     - Submitting the form should add a new key.
   - You should now see a table showing existing keys.
     - Test that the "Delete" link asks for confirmation, and that
       confirming and denying both work correctly.
     - Test that "Revoke" and "Activate" actions still work correctly.
 - Set the AllowPatronsManageAPIKeysInOPAC system preference to "Don't
   allow."
   - Log in to the OPAC and confirm that the "your API keys" link in the
     sidebar is no longer visible.
     - Confirm that navigating directly to /cgi-bin/koha/opac-apikeys.pl
       results in a 404 error.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:58 -03:00
9007b25d09 Bug 20568: API key management for OPAC users
This patch makes the OPAC interface for API keys management work
with the new lib. Verify all actions work for a logged user.

Users without login should be redirected to an error page.

The AllowPatronsManageAPIKeysInOPAC syspref is added to control if the
OPAC feature is enabled or not.

To test:
- Verify the syspref works
- Verify users can manage their API keys

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:58 -03:00
05101f0afa Bug 20568: Add mandatory description field for api keys
This patch changes the table structure adding fields usually found on
this kind of api management pages.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:58 -03:00
Julian Maurice
3aa102d0c3 Bug 20568: API keys management in interface
This introduces the concept of API keys for use in the new REST API.
A key is a string of 32 alphanumerical characters (32 is purely
arbitrary, it can be changed easily).
A user can have multiple keys (unlimited at the moment)
Keys can be generated automatically, and then we have the possibility to
delete or revoke each one individually.

Test plan:
1/ Go to staff interface
2/ Go to a borrower page
3/ In toolbar, click on More -> Manage API keys
4/ Click on "Generate new key" multiple times, check that they are
   correctly displayed under the button, and they are active by default
5/ Revoke some keys, check that they are not active anymore
6/ Delete some keys, check that they disappear from table
7/ Go to opac interface, log in
8/ In your user account pages, you now have a new tab to the left "your
   API keys". Click on it.
9/ Repeat steps 4-6

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-09 12:55:58 -03:00
affd3f0ece Bug 20686: OPAC shows 'Login to OverDrive account' with 'OverDriveCirculation' syspref disabled
ps: you will need an active and working overdrive account to test this patch

1/ prepare a koha with overdrive sysprefs set and working
    (OverDriveLibraryID,OverDriveClientKey,OverDriveClientSecret)

2/ set OverDriveCirculation syspref to 'disable'

3/ do an opac search, note the 'Login to OverDrive account' message is incorrectly displayed
    see pic 1

4/ apply patch

5/ do an opac search, note the 'Login to OverDrive account' message is no longer displayed (good)
    see pic 2

Can confirm that bug is replicable and patch applies and functions as described.
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-05-07 11:55:32 -03:00