Commit graph

36 commits

Author SHA1 Message Date
Julian Maurice
96cc447045 Bug 25898: Prohibit indirect object notation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-10-15 12:56:30 +02:00
c2d45ac0f4 Bug 5087: Add server-side check
If a user to access a CSV profile that is not available at the OPAC we
should redirect to 404.

It will also handle undefined csv_profiles

For instance:
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadshelf.pl?shelfnumber=1&format=3
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadcart.pl?bib_list=1/2/&format=3

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-07-23 11:17:27 +02:00
db15f4af8d Bug 5087: (QA follow-up) Fix leakage in opac-downloadshelf.pl
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-07-23 10:52:10 +02:00
Mark Tompsett
e1b5fa657d Bug 14385: Squash of a lot of patches rebased
- Added missing GetHiddenItems parameter change case
     Without this prove t had a failure.

- Always use mocks, not set_preference

- Tweaks so t/db_dependent/00-strict.t passes
     There was a typo botcat vs borcat and borrowernumber was never
     defined. Grabbing from userenv, like other code does.

- Tweak t/db_dependent/Items.t to fully test changes
     This will test all the if structures fully in GetHiddenItemnumbers.
         prove t/db_dependent/Items.t

- Tweak borrower category code
     $borrower->{categorycode} on a Koha::Patron is not the
     same as $borrower->categorycode. Fixed error.

- Search was returning URLS for wrong interface
     There was one search context place wrong. Changed it to $is_opac
     as the logic for setting $is_opac was modified correctly.

- Corrected issues with category code.
     When a user isn't logged in, $borrower is undef and causes error
     when determining category code. Added conditional check.

- Properly trigger all changes in C4/Search.pm

- Fix QA Test tool failures
     C4/Search.pm had some tabs.

- Add some commenting to make sense of logic

- Refactor EmbedItemsInMarcBiblio parameters to hashref

- Trigger GetMarcBiblio's EmbedItemsInMarcBiblio call.
     prove t/db_dependent/Items.t

- Add missing test to trigger Koha/BiblioUtils/Iterator change

- Add borrower category overrides
     These files generally add borcat parameter to GetMarcBiblio.
     Others might include correction of filtering of items
     (opac-basket), or a comment as to why no changes were done
     (opac-search).

     In the case of opac-search, correcting the first FIXME will
     likely correct the OpacHiddenItems issues on tags. As such,
     that is beyond this bugs scope.

     Some code had loop optimizations and fixes made, like a
     'next unless $record' when the biblio shouldn't even be in
     the list.

- Modify opac-ISBDdetail and opac-MARCdetail
     Both files had similar logic. They were rearranged and
     optimized, so that both files would have practically identical
     initial blocks of code.

     Optimizations were possible, because GetMarcBiblio
     returns a filtered record, so that there is no double call
     (once in the opac-### file and once in GetMarcBiblio) to
     GetHiddenItemnumbers.

- Fix hiding in opac-tags
     opac/opac-tags.pl was not properly hiding.

     There is currently one known bug associated with tags left.
     If you have two biblios tagged by different people with the
     same tag, the opac-search will show the one you tagged that
     is supposed to be hidden, because tag searches work differently
     than regular searches. This is beyond the scope of this bug.
     See the FIXME's in opac/opac-search.pl

- Trigger the C4::ILSDI::Services changes
     prove t/db_dependent/ILSDI_Services.t

- Added missing 'my'

- Test C4/Labels/Label.pm changes

- Improve C4::Record::marcrecord2csv test cases

- Corrected opac-details searchResult call

- Fix breaking issues constraint in ITerator test

- Fix ILSDI_Services test when clubs with branch exist

- Rebased again!
- Rebased t/db_dependent/Items.t conflict.

The test plan is in comment #112 last I checked.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-11-02 10:33:12 +00:00
Mark Tompsett
d5986c9b97 Bug 19040: Refactor GetMarcBiblio parameters
Change parameters to a hashref.

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Looks good to me.
Two calls in migration_tools/22_to_30 still in old style.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-25 10:23:42 -03:00
7457f278af Bug 8612: [Follow-up] Make usage and type different columns in table
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-06-05 12:02:08 -03:00
ef0b0f13fc Bug 17094: Make Koha::Virtualshelf methods return Koha::Objects-based objects
Instead of DBIx::Class objects.

Test plan:
1/ Add content to a list and share it with another patron
2/ Try to view the list with the other patron
3/ download and send a shelf and check if the biblio list is correct
4/ prove t/db_dependent/Virtualshelves.t should return green

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
2016-10-11 13:14:46 +00:00
39487d634e Bug 11592: (QA followup) Add missing framework code to ViewPolicy filter calls
This patch adds the frameworkcode option param, using each record's frameworkcode
as expected by the filter. Otherwise the ViewPolicy filter falls back to the
default framework.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-08 11:54:22 +00:00
ea27569334 Bug 11592: (QA followup) Simplify code
Koha::RecordProcessor and the defined filters are supposed to bring us
joy and happiness. Let's keep the code compact, simple and clean.

This patch removes record cloning all over the place.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-08 11:54:22 +00:00
Mark Tompsett
cadf5aea81 Bug 11592: MARCView and ISBD followup
There are still some leaks, but it is not as a result
of the filter, but rather a result of poorly written
template files.

Bug fixing template files is beyond the scope of this
set of patches.

TEST PLAN
---------
 1) Backup your DB
 2) run the following SQL on your DB.
    > UPDATE marc_subfield_structure set hidden=-8;
    -- this should set EVERYTHING to hidden across the board.
 3) In staff client, set OPACXSLTDetailsDisplay to blank
 4) In OPAC, view any detail.
    -- Normal view may mostly leak values still.
    -- MARC view may leak values.
    -- ISBD view may leak values.
 5) In staff client, set OPACXSLTDetailsDisplay to default
 6) In OPAC, view any detail.
    -- same issues as step 4
    -- 'View Plain' may leak too.
 7) 'Save record' -> 'Dublin Core'
 8) Apply this patch
 9) run koha qa test tools
    -- should be fine
10) prove -v t/db_dependent/Filter_MARC_ViewPolicy.t
    -- should pass
    -- this proves Koha/Filter/MARC/ViewPolicy.pm tweaks too
11) In OPAC, view any detail.
    -- Normal view:
       -- Material type comes from the LEADER field.
       -- Lists this is on will still display
       -- 'Tags from this library' will still display
       -- Item information in table will still display
          (THIS IS BEYOND SCOPE)
    -- MARC view:
       -- Record number is leaked
          (THIS IS BEYOND SCOPE)
       -- 'View plain' leaks LEADER field.
    -- ISBD view may leak field headings, but not values.
       (THIS IS BEYOND SCOPE)
12) In staff client, set OPACXSLTDetailsDisplay to blank
13) In OPAC, view any detail.
    -- same kind of output as step 10
14) 'Save record' -> BIBTEXT
    -- Should be next to nothing leaked.
15) 'Save record' -> Dublin Core
    -- Should be the same or less leaked between the two versions.
    -- (XML FILTERING IS BEYOND SCOPE)
16) In the staff client, go view the same record.
    -- it should be mostly hidden in ISBD View.
17) run the following SQL on your DB.
    > UPDATE marc_subfield_structure set hidden=1;
    -- this should set EVERYTHING to hidden in OPAC, but not
       the STAFF across the board.
18) Refresh the staff ISBD page
    -- values should reappear.
19) View the ISBD details in the OPAC
    -- values should still be hidden.
20) Check out the OPAC Cart and List
    -- while the intermediate pages may still leak
       the download links should leak very minimally.
    -- (CARTS AND LISTS ARE BEYOND SCOPE, THOUGH
        THE INTRANET ISBD AND SOME CART/LIST STUFF
        WERE FIXED BECAUSE OF THE GetISBDView REFACTOR)

Expectations:
Before Patch - all the OPAC Detail pages will display things
After Patch - all the OPAC Detail pages will display much less,
              and hopefully nothing (though there are known limits).
              the ISBD detail page in the Staff client will be
              filtered as well based on STAFF settings.
              The saving/exporting should generate nearly empty
              files.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-09-08 11:54:22 +00:00
f3d7f27107 Bug 15451: Koha::CsvProfiles - Remove the residue
This patch erase all traces of C4::Csv since it's not used anymore.
All occurrences have been replaced by previous patches to use
Koha::CsvProfiles.

Note that GetMarcFieldsForCsv was not used prior this patch set.

Test plan:
  git grep 'C4::Csv'
should not return any result.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
No more traces of the file.
This produces a koha-qa fail, due to the missing file.
No other errors

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:18:36 +00:00
814a1d4231 Bug 15451: Koha::CsvProfiles - Remove GetCsvProfilesLoop
This subroutine returned the csv profiles for a given type.
This could be done easily with the new Koha::CsvProfiles->search method.

Test plan:
To do at the OPAC and staff interface!
1/ Export a list using a CSV profile
2/ Export your CART using a CSV profile
Note that only MARC profiles should be available.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Tested on staff/opac & cart/list
Small problem on filename extension fixed in followup.
No errors

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2016-07-22 17:18:34 +00:00
2923cfdff4 Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off
If the user knows the URL for OPAC lists they can access them even with
the virtualshelves preference turned off. This patch copies the solution
added to opac-topissues.pl by Bug 10595 and applies it to OPAC lists
pages.

To test, apply the patch and set the virtualshelves system preference to
"don't allow."

- Navigate to /cgi-bin/koha/opac-shelves.pl. You should be redirected to
  an Error 404 page.
- Also check:
  - /cgi-bin/koha/opac-shareshelf.pl.
  - /cgi-bin/koha/opac-downloadshelf.pl
  - /cgi-bin/koha/opac-sendshelf.pl
  - /cgi-bin/koha/opac-addbybiblionumber.pl
- Turn virtualshelves back on. Access to lists and list sharing should
  be restored.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
2016-01-27 02:31:42 +00:00
9af429c33e Bug 14544: Get rid of C4::VirtualShelves and C4::VirtualShelves::Page
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:02 -03:00
ca0de1009c Bug 14544: Get rid of GetShelfContent
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:01 -03:00
a8f1a576e2 Bug 14544: Get rid of ShelfPossibleAction
Bug 14544: (follow-up) Get rid of ShelfPossibleAction

Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:01 -03:00
f510627842 Bug 14544: Make the OPAC side independent of Page.pm
Bug 14544: Fix redirect on editing a list

If you edit a list from the list view, after saving the form, you are
not redirected to the list view (but on the edit form).

Bug 14544: Cosmetic: &rsaquo; should be a class divider

Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:01 -03:00
863958f935 Bug 14544: Get rid of GetShelf
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2015-11-05 09:58:00 -03:00
Jonathan Druart
baea0a79d5 Bug 7976: Remove the borrow permission
The borrow permission was used but uselessly.
For instance, at the opac, the flagsrequired parameter was set to
'borrow' but the 'authnotrequired' was set also (which means no auth
required).
At the end, this permission was used at only 1 place: for the basket,
intranet side.
This can be replaced with the catalogue permission (which is used to
search).

Test plan:
1/ Confirm that you are able to show/download/sent the cart (intranet side)
with the catalogue permission.
2/ At the OPAC, you should be able to access the same pages as before
with any other permissions.

Concretely it is quite difficult to test this patch, you should have a
look at the code.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-06-05 13:43:34 -03:00
Jonathan Druart
a6c9bd0eb5 Bug 9978: Replace license header with the correct license (GPLv3+)
Signed-off-by: Chris Nighswonger <cnighswonger@foundations.edu>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>

http://bugs.koha-community.org/show_bug.cgi?id=9987

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-20 09:59:38 -03:00
93addad23a Bug 13695: Add ISBD export option for the OPAC cart and lists
This patch adds the option to download records from the cart, and
lists in the ISBD format from the OPAC.

To test (cart):
- Apply the patch
- Add several records to your OPAC cart.
- Go to your cart, and choose 'Download'
=> SUCCESS: There's an ISBD option
- Dowload and open the exported records
=> SUCCESS: The file contains the ISBD format for the records on the cart

To test (lists):
- Add several records to a list (i did it from the cart ;-))
- Open the list
- Choose 'Download list'
=> SUCCESS: There's an ISBD option
- Download and open the exported records
=> SUCCESS: The file contains the ISBD format for the records on the list.

- Sign off :-D

Sponsored-by: Orex Digital

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-03-31 10:34:35 -03:00
Jonathan Druart
e20270fec4 Bug 11944: use CGI( -utf8 ) everywhere
Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-01-13 13:07:21 -03:00
e185aaf19b Bug 12519 - Convert OPAC list download pop-up to modal dialog
This patch changes the OPAC list download process so that the download
link triggers a modal dialog instead of a pop-up window. This
streamlines the process a little bit and makes it work better on mobile
devices.

The download list page has been altered so that it works better as a
standalone page, as it might be seen if JavaScript is disabled. Simple
form validation has been added to help prevent submission of the form
without choosing a format.

To test the virtualshelves system preference must be enabled.

- View an existing list in the OPAC and click the "download list" link.
- A modal dialog should be displayed with the download form.
- Submitting the form without selecting a format should trigger either a
  browser-based form validation error (in HTML5-supporting browsers) or
  a JavaScript alert (if your browser doesn't support the "required"
  attribute.
- Choosing a download format and submitting the form should close
  the dialog and trigger the correct download.
- Clicking the "Cancel" link should close the dialog.

Test with JavaScript disabled:

- Clicking the "download list" link should take you to a page which
  contains the same form which appeared in the modal dialog.
- Submitting the form without selecting a format should trigger either a
  browser-based form validation error (in HTML5-supporting browsers) or
  a JavaScript alert (if your browser doesn't support the "required"
  attribute..
- Choosing a download format and submitting the form should result in
  the corect download.
- Clicking the "Cancel" link should return you to the correct list.

Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes QA script and tests, works as described.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2014-07-22 09:54:36 +12:00
afd2418d73 Bug 11349: Change .tmpl -> .tt in scripts using templates
Since we switched to Template Toolkit we don't need to stick with the
sufix we used for HTML::Template::Pro.

This patch changes the occurences of '.tmpl' in favour of '.tt'.

To test:
- Apply the patch
- Install koha, and verify that every page can be accesed

Regards
To+

P.S. a followup will remove the glue code.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2014-07-17 11:05:49 -03:00
Jonathan Druart
5ad6350616 Bug 10853: All existing routing to get a CSV should return a MARC csv
Test plan:
Verify that existing CSV lists list MARC CSV profiles and not SQL CSV
profiles.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-10-11 02:16:33 +00:00
6636d695ff Bug 7788: [SIGNED-OFF] Remove two unused calls to GetShelf
Removed two unused calls. Initialized $output in downloadshelf. Corrected some confusing indentation in downloadhself too.

signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
2012-05-22 12:06:25 +02:00
b65f6d0a99 Fix for Bug 3140 - It is possible to email someone else's private list
Adding check for ShelfPossibleAction("view") to make sure the logged
in user has permission to view the selected list when downloading
or emailing a list.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Ian Walls <ian.walls@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2011-05-26 09:50:52 +12:00
Matthias Meusburger
a3ff0bb5cb bug 5579 : Fixes several exports to embed items
- The following export pages used to embed items when exporting,
    this was no longer the case, so they were fixed :
      Intranet :
        - basket/downloadcart.pl,
        - virtualshelves/downloadshelf.pl
        - catalogue/export.pl
      Opac :
        - opac/opac-downloadcart.pl
        - opac/opac-downloadshelf.pl
        - opac/opac-export.pl

  - Notes :
     - GetMarcBiblio used to embed items data, this was no longer the case,
       so an optional parameter was added to choose if items should be embedded or not.
       This way, previous work on this bug is not broken, and this is a pretty usefull
       feature, imho.
     - An optional parameter has been added to SetUTF8Flag, to be able to use NFD during
       normalization. This was required to make Unicode/UTF-8 export work again.

Signed-off-by: Claire Hernandez <claire.hernandez@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2011-04-19 22:35:15 +12:00
Colin Campbell
a9010530a3 Bug 5105 - Remove use of depreciated Switch module
Use of switch generates errors in perl 12 and above
Replaced uses of the Switch module by if- else constructs
Removed some mixed space+tab indentation around these where
it generated visual confusion

As of perl 10 you can use given/when constructs but this is not
supported in earlier perls.
2010-11-11 11:32:02 +13:00
Henri-Damien LAURENT
6e0c124c9c error 500 when record cannot be loaded
On a basket or a basket download, or csv export, if Koha cannot get a biblio, then it failed with error 500.
This patch fixes that behaviour skipping the faulty record in order to present the user with the biblios which are not causing trouble.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-07-07 12:38:26 -04:00
Lars Wirzenius
873a3cb9bc Fix FSF address in directory opac/
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-03-16 20:17:54 -04:00
Matthias Meusburger
3bbbc15ccf MT 2116: Addons to the CSV export
Fix encoding selection

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-02-17 07:54:11 -05:00
Matthias Meusburger
0268a58e16 MT2116: Addons to the CSV export
Adds the ability to customize CSV exports through the use of a YAML file.

The following customizations are available :
  - Preprocessing
  - Postprocessing
  - Field-by-field processing

The YAML field should be stored in the tools/csv-profiles/ directory and
named after the id of the CSV profile you want to customize.
An example file is provided in that directory.
(cherry picked from commit 76655b5b94)

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2010-02-17 07:51:33 -05:00
Matthias Meusburger
b40d4052b9 MT2116 : Addons to the CSV Export
Add encoding selection
Add authorised values handling
2010-01-28 15:11:55 +01:00
Henri-Damien LAURENT
a7ccfbc629 MT 1587 : CSV export for cart and shelves, with the ability to define different export profiles
Signed-off-by: Henri-Damien LAURENT <henridamien.laurent@biblibre.com>
2009-09-30 11:30:35 +02:00
Henri-Damien LAURENT
5ade529284 Adding download for Cart and Shelf at OPAC
Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
2009-09-30 11:22:23 +02:00