Some templates use Edifact and edifact. As EDIFACT
is an abbreviation, we should spell it like one.
To test:
- Check templates for occurrences of EDIFACT
- acquisitions navigation menu
- basket page
- basketgroup page
- EDIFACT messages page
- Verify changes are correct
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Changes are correct
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
The root of this issue is old code in circulation.pl that is no longer
needed and leaves the affected scripts open to future regressions.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Heather Braum <hbraum@nekls.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
If you edit notice triggers and then use the "Checko out" tab from the
top bar, you may change your logged in library by accident!
Test Plan:
1) Disable the system preference CircAutocompl
2) Go to the notice triggers
3) Select the triggers for a library other than the one you logged in as
4) Use the "Check out" tab at the top to check out to a patron
5) Note your logged in branch has changed ( you'll need to refresh the
page if the check out search took you directly to one patron ).
6) Apply this patch
7) Repeat steps 2-4
8) Note the branch no longer changes
Tested with both patches applied. Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Heather Braum <hbraum@nekls.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch makes multiple changes to the plugins home page template to
bring it up to date with current interface patterns.
Test the following changes:
- Breacrumb links have been corrected to include "Tools" in the path.
Verify that this link is correct.
- A toolbar has been added for an "Upload plugin" button. Uploading is
an action, not a view, so it should be displayed in a toolbar. Verify
that the button works correctly.
- Messages are now formatted as messages rather than as headings. To
test, trigger a message by, for instance, uninstalling all plugins or
passing an invalid "method" parameter with the URL.
- Incorrect capitalization corrected.
- Plugin actions are moved to a single "Actions" dropdown menu. This
includes 'Run report,' 'Run tool,' 'Configure,' and 'Uninstall.' Test
that all these menu options work correctly.
- The standard "Tools" sidebar menu has been added.
- An "onclick" attribute has been removed in favor of defining the event
in JavaScript. Test by choosing the 'Uninstall' menu item for a
plugin. Test both confirm and cancel actions.
Also changed:
- Corrected capitalization on the tools home page.
- Adding missing plugins link to the tools sidebar menu.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch removes the obsolete "border" attribute from <img> tags.
Browsers haven't applied an border to images by default for years.
There should be no visible changes as a result of this patch. It only
affects HTML validation. If you want to test the affected pages, apply
the patch and confirm that images look correct on these pages:
- In the patron sidebar menu, if patron images are enabled.
- On the authority MARC subfield structure administration page, only
some obsolete markup is affected (See Bug 16367).
- I don't know how to trigger display of the "filefind.png" image on
authority and bibliographic detail pages. Possibly unused markup?
- On the advanced search page, itemtype/collection/shelving location
images should look correct.
- When viewing existing holds for a title, the arrow images used for
changing the position of a hold in the list should look correct.
- When viewing a list of MARC modification actions, the arrow images
used for changing the order of actions should look correct.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch makes it possible to limit a patron search to
search just for surnames.
To test:
- Apply the patch
- Add two patrons, called e.g. "John Doe" and "Doe John"
- Go to Patrons in the Intranet
- Make sure you have selected "Search fields" = Standard
- Search for "john" and verify both patrons show up
- Search for "doe" and verify both patrons show up
- Set "Search fields" = Surname and search for "john".
"Doe John" should show up, but not "John Doe".
- Set "Search fields" = Surname and search for "doe".
"John Doe" should show up, but not "Doe John".
Update: Revised the last point in the test plan.
Sponsored-by: Alingsås Public Library, Sweden
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch modifies references to the patron categories administration
page in two places: Replacing "Patron types and categories" in the
administration sidebar menu and replacing "Patron category
administration" in the heading of categories.tt. Both should now read
"Patron categories."
To test, apply the patch and confirm that the text has been updated
correctly.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Text has been updated correctly
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch moves the JavaScript files in prog/en/js to prog/js.
JavaScript files do not need to be in the directory which is processed
by the translator.
To test, apply the patch and visit various pages in the staff client to
confirm that JavaScript files are still loading correctly.
Revised: I intended for this to be built on top of Bug 15883 as well as
Bug 16242. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883 and 16241
All seems to work, js files pulled from new dir.
No errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
According to https://jquery.com/upgrade-guide/1.9/#attr-versus-prop-
.attr() is no longer correct to access the checked state of a checkbox.
This patch do the following replacements:
.attr('checked') => .prop('checked')
.attr('checked, '') => .prop('checked', false)
.attr('checked, 'checked') => .prop('checked', true)
.attr('checked', boolValue) => .prop('checked', boolValue)
.removeAttr('checked') => .prop('checked', false)
.attr('checked') == 'checked' => .is(':checked')
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The staff client CSS is not language-specific, so it can be moved out of
the en/ directory and thus not be duplicated for every translation.
In order to be able to have a generic path to the YUI CSS files, the YUI
directory is moved by this patch to the staff client's lib/ directory.
To test, apply the patch and visit various pages in the staff client.
Look in particular at pages which include more than the standard CSS.
For example:
- The staff client login page.
- The staff client home page.
- Patron -> Set permissions.
- The advanced cataloging editor.
- Acquisitions -> Vendor -> Basket groups.
- Tools -> News -> Edit news.
- Administration -> System preferences.
Revised: I intended for this to be built on top of Bug 15883. Now it is.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
On top of 15883
Works as described, all pages on test plan
No Errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The include file datatables-strings.inc is no longer necessary. Its
contents are now in datatables.inc. This patch corrects two references
in comments to datatables-strings.inc (replacing it with datatables.inc)
and removes the obsolete file.
To test, apply the patch and load any page with a DataTables-enabled
table configured to show pagination buttons, e.g. Saved Reports.
Pagination labels like "Next," "Previous," and "Showing X of X..."
should be correct.
Search the codebase to confirm that no references remain for
datatables-strings.inc.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch adds a test to check the unicity of auth cats, simplify
the GetBudgetAuthCats subroutine and make it return an arrayref of scalar
instead of an arrayref of hashref with only 1 key.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Add option show or no inactive budget and more options
Use subroutine GetBudgetHierarchy for return all budgets
Delete subroutine GetBudgetPeriodDescription and theire tests
Use Price TT plugin
Correct name of column and capitalization the first letter
Add checkbox for show inactive budgets, default the drop down list containt a active budget
Not use [i] for inactive budgets, i add (inactive) at the end of inactive budget
Add vendor note in the list of show attribute
Test case:
Go to Home > Reports > Orders by fund
Select one or all budgets
You can show the inactive budget, default the drop down list containt a active budget
Choose output to screen ou csv file
Works as expected. QA tools OK with Bug 16104 applied.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
- changed 'Fund (budget):' back to 'Fund:', as the budget
no longer shows in the pull down.
- Fixed number of tests in Budgets.t
- Removed &GetBudgetPeriodDescription
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch re-indents the new include file because it's not often you
get to help a new file come into the world, it should be indented
nicely.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch creates a new file: adv-search.inc. This search include has
no catalog search (as it makes no sense to have the catalog search tab
on the advanced search page).
The item search page uses home-search.inc (with catalog search) as the
catalog search is different to the item search.
To test:
1) Go to Search (advanced search)
2) Confirm search header is there with no catalog search tab and works
as expected
3) Go to item search
4) Confirm search header is there with catalog search tab and works as
expected
Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Tested together with follow up patch, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
EDIT: fixing typo, changing sms number from tel: to sms:
To test:
1) Go to a patron detail page
2) Confirm that all available phone numbers can be clicked and allow you to call this number from your device
a) in the top left circ-menu.inc
b) primary/secondary/other/organisation/mobile phone numbers
c) alternate address phone number
d) alternate contact phone number
e) enable the EnhancedMessagingPreferences system preference. check the SMS number under Patron messaging preferences (back on the detail page) is clickable
3) Check to see if there are any phone numbers I have missed.
Sponsored-by: Catalyst IT
Signed-off-by: Marc Veron <veron@veron.ch>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
EDIT: Removing unnecessary functions
To test:
1) Go to Reports -> Dictionary
a) Attempt to delete a definition. Confirm the Ok and cancel
buttons in confirm dialog work as expected
2) Go to Reports -> Build new
a) On each step of building a report, confirm the back button
works as expected
b) Confirm add column and delete column on step 3 works as
expected
3) Confirm deleting a report from the toolbar triggers confirm dialog
and it works as expected
4) Create a report with an SQL error and run it. Confirm that the
'Return to previous page' link works as expected
Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
- Makes new message in the holds tables in the patron account
translatable
- Unbolds the note in the holds table for the record
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch makes sure that the added granular permissions work as
advertised.
Note: The field owner was not included in the Koha::Upload->get response.
The code to verify if a user is allowed to delete an upload, is concentrated
in the template now. When get returns a Koha::Object, this check could be
relocated.
Test plan:
[1] Verify that the current user has permission for tools, or has
at least upload_general_files.
[2] Do you see Upload in the Tools menu? Follow the link.
[3] Upload a permanent file (with a category).
[4] Do you see the Delete button in the results form?
[5] Make sure that another user has no permission to upload.
[6] Login as that user and check the Tools menu.
Try the URL [yourserver]/cgi-bin/koha/tools/upload.pl
You should have no access to the upload form.
[7] Enable upload_general_files for this user. Go to upload and search for
the upload from step 3. You should not see a Delete button.
[8] Enable upload_manage for this user. Search for the upload again.
Delete the upload.
[9] Go to upload via the Cataloguing editor (856$u plugin) or add
parameter "plugin=1" to the URL. You should not see the Tools menu.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
[1] Upload_general_files
This will allow you to access the tools/upload form via the Tools menu.
And it will also allow you to add permanent uploads.
[2] Upload_manage
It will allow you to delete uploads from other users.
Note that anyone may delete his own uploads.
It is not meant to include upload_general_files.
In order to not disturb existing users that now have edit_catalogue and are
using the plugin (read: added at least one record to uploaded_files), we
will add the first permission for them. New users will need to be authorized
in the usual way thereafter.
Note: If you only have one of the other permissions checked in allows_add_by,
e.g. stage_marc_import, you can add temporary uploads, but not permanent
uploads.
Test plan:
We are only testing the dbrev here, not if the perm works as advertised.
[1] Run the dbrev and check that you see the perms with a description on
the Patron/Set permissions page.
[2] If you had records in uploaded_files and a user with edit_catalogue
*only*, verify that this user now also has upload_general_files.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
The default patron search types has changed from 'contain' to
start_with. Users consider it as a bug.
This patch revert the previous changes to default on 'contain'.
Test plan:
Search for patrons in different places (guarantor, checkout, patron
module, acquisition module, etc.) and confirm that the default is always
'contain'
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
This patch updates the staff client version of jQuery to 2.2.3. In order
to maintain compatibility with existing scripts, the jQuery migrate
plugin has also been added.
Included is the development version of the jQuery migrate plugin.
Developers could modify doc-head-close.inc to use this version if they
wanted to take advantage of its upgrade warning log.
To test, apply the patch and test JavaScript interactions everywhere in
the staff client.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
There are some issues with the template changes introduced by the EDI
feature in Bug 7736. This patch makes the following changes:
- Use Font Awesome icon on the Acquisitions basket page instead of a
Glyphicon.
- Use Font Awesome icon on the Acquisitions basket group page instead of
a Glyphicon.
- For consistency's sake, use the phrase "Library EANs" instead of "EDI
EANs" in menus and the Library EANs page.
- On the EDI accounts page:
- Correct the markup of the title tag.
- Improve the breadcrumbs to eliminate redundancy.
- Use Font Awesome icon instead of Glyphicon for the "New account"
button.
- Change or remove "maxlength" attribute of form fields to match table
structure.
- Move the contents of some title attributes into a visible hint.
- Use 'checked="checked"' instead of 'checked'. Koha templates use
XTHML-style attributes.
- Correct template variable in account deletion confirmation dialog.
Before this patch the vendor name was not correctly displayed.
- Show a message if there are no accounts defined rather than an empty
table.
- Remove use of "highlight" class from table rows (Bug 15927).
- Correct parameter name in link to vendor details page (should be
booksellerid instead of supplierid).
- Correct the markup of the deletion confirmation dialog (Bug 15785).
- Use Bootstrap-style buttons for "edit" and "delete," with Font
Awesome icons.
- On the Library EANs page:
- Correct the markup of the title tag.
- Make capitalization of "EAN" consistent.
- Use Font Awesome icon instead of Glyphicon for the "New EAN" button.
- Show a message if there are no EANs defined rather than an empty
table.
- Change or remove "maxlength" attribute of form fields to match table
structure.
- Remove use of "highlight" class from table rows (Bug 15927).
- Correct the markup of the deletion confirmation dialog (Bug 15785).
- Use Bootstrap-style buttons for "edit" and "delete," with Font
Awesome icons.
To test, apply the patch and review the affected templates. Confirm that
pages look correct and work correctly.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
All seems to work and looks well,
add/edit/delete EDI accounts and Library EANs works Ok
No errors
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher <bredan@bywatersolutions.com>
From C4::Koha::GetAuthorisedValues
# TODO: the "selected" feature should be replaced by a utility function
# somewhere else, it doesn't belong in here. For starters it makes
# caching much more complicated. Or just let the UI logic handle it, it's
# what it's for.
Indeed, it's not a job for a subroutine, the template should take care of that.
Note that a perf gain could be won with this patch \o/
Test plan:
- Edit an itemtype and check the value of the "Search category" dropdown list
- Edit a patron attribute type and check the value of the "Class" dropdown list
- Detail for a catalogue record, the Status column should be correctly
populated if items are damaged and/or lost
- Item details for a catalogue record, the lost, damaged and withdrawn
value should be correctly displayed
- Edit a patron, the "street type" should be correctly selected
- Create a patron attribute type linked to an authorised value list.
- Edit a patron, set a value for this attribute, edit it again. The
correct value should be selected.
- Search for subscriptions. The 'Location' dropdown list should behave
correctly (select the entry you have choosen before, etc.)
- Edit a subscription, the location dropdown list should select the
correct value.
- Edit and view a suggestion with a 'reason for suggestion' set (you
should have at least 1 OPAC_SUG AV defined)
Followed test plan, works as expected
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Add support for processing incoming Edifact Quotes, Invoices
and order responses and generating and transmission of
Edifact Orders.
Basic workflow is that an incoming quote generates an aquisition
basket in Koha, with each line corresponding to an order record
The user can then generate an edifact order from this (or another)
basket, which is transferred to the vendor's site
The supplier generates an invoice on despatch and this will
result in corresponding invoices being generated in Koha
The orderlines on the invoice are receipted automatically.
We also support order response messages. This may include
simple order acknowledgements, supplier reports/amendments
on availability. Cancellation messages cause the koha order
to be cancelled, other messages are recorded against the order
Which messages are to be supported/processed is specifiable on a
vendor by vendor basis via the admin screens
You can also specify auto order i.e. to generate orders from quotes
without user intervention - This reflects existing
workflows where most work is done on the suppliers website
then generating a dummy quote
Received messages are stored in the edifact_messages table
and the original can be viewed via the online
Database changes are in installer/data/mysql/atomicchanges/edifact.sql
Note new perl dependencies:
Net::SFTP:Foreign
Text::Unidecode
Signed-off-by: Paul Johnson <p.johnson@staffs.ac.uk>
Signed-off-by: Sally Healey <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Reports -> Use saved (or build a new one if you have none saved)
2) Click on the Actions drop down and confirm that when you click Delete from here, a confirm message shows up. Click Cancel.
3) Click Show in the drop down menu
4) Click Delete in the Reports toolbar. Confirm you now get a confirm message. Clicking Cancel will cancel the delete, and clicking OK deletes the report and takes you to the saved reports page.
Spponsored-by: Catalyst IT
Signed-off-by: Magnus Enger <magnus@libriotech.no>
After applying the patch I get a JavaScript popup confirmation when
I click on the delete button, in the Show, Edit and Run views. Nice!
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
datatables.inc loads dataTables.buttons.min.js and buttons.colVis.min.js
since bug 15285: Update common files because the dom param now contains
'B'. The DT init fails with it does not know what 'B' means.
Test plan:
Test tables using buttons (columns visibility), they should work as
before this patch.
Tested with patron search and administration/currencies, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Tools -> Rotating Collections
2) Click on any rotating collection ('Add or remove items' from drop down menu)
3) Click 'Delete' from toolbar. Validate you are now asked to confirm your deletion. Check that cancel works, then check that confirm works.
Sponsored-by: Catalyst IT
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
I've added the word 'rotating' before collection, to make
it clear for translators what is meant here.
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
To test:
1) Go to Reports -> Use saved
2) Click 'Show' on the dropdown for any report
3) Confirm that 'Duplicate and 'Schedule' are now on the toolbar and work as expected
Sponsored-by: Catalyst IT
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Test plan:
Go on a page of the tools module
You should see a "Automatic item modifications by age" link
Click on it
The list should not be styled to highlight the fact that you are on this
page.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Most of the scripts called via greybox (which uses iframe) don't include
doc-head-close. But some do.
This patch adds a popup parameter for these templates, not to include
the legacy browser trick and avoid the replacement of the location.
Test plan:
1/ Export patroncard and label
2/ translate itemtypes
3/ click on a idref link at the OPAC
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Web pages that can be embedded in frames are vulnerable to cross-frame
scripting attacks. Cross-frame scripting is a type of phishing attack
that involves instructions to an unsuspecting user to follow a specific
link to update confidential information in an online application.
Because the link leads to a legitimate page from the online application
that is embedded in a frame hosted by the attackers' server, the
attackers can capture all the information that the user enters.
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Single quotes audio selector break ability to edit an alert
Test Plan:
1) Enable audio alerts
2) Add new a alert with a select containing single quotes such as: input[name*='test']
3) Note you cannot edit the alert
4) Apply this patch
5) Reload the page
6) You should now be able to edit the alert
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Bug 15734 applied on top. Works as advertised
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
When the SMSSendDriver system preference is set to "Email" a link to the
SMS cellular providers management page should appear in the left-hand
sidebar menu on Administration pages. This patch adds the link to
admin-menu.inc.
To test, apply the patch set your SMSSendDriver system preference to
"Email." View various Administration pages which show the left-hand
sidebar menu and confirm that "SMS cellular providers" is in the list.
Empty the SMSSendDriver preference and confirm that the link no longer
appears.
Signed-off-by: Nicole C Engard <nengard@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
This patch adds some JavaScript to the item search fields management
page so that the add form is not displayed by default. This simplifies
the interface and makes it more consistent with other similar
interfaces.
Also changed in this patch:
- Changing instances of "Items search fields" to "Item search fields."
- Correct form structure to use ordered list
- Add "required" classes and enable built-in JS form validation.
- Add explicitly labeled "Choose" options to <select>s.
- Add missing ids to form fields (labels don't work without them).
- Correct classes of message and alert dialogs.
- Add JS confirmation of deletions.
- Convert MARC tag and subfield dropdowns to regular inputs (Bug 15384).
To test, apply the patch and go to Administration.
- Confirm that the "Item search fields" link is correct.
- Follow the link and confirm that the list of existing fields is shown
by default, or a message saying there are no existing fields.
- Click the "New search field" button and confirm that it displays the
entry form.
- Confirm that submitting an empty form does not work.
- Confirm that clicking the "Cancel" link correctly hides the form.
- Confirm that submitting valid data works correctly.
- In the table of existing item search fields, confirm that the "Edit"
button works correctly.
- Confirm that submitting edits works correctly.
- In the table of existing item search fields, confirm that clicking
"Delete" highlights the row in question and a confirmation dialog
appears.
- Test both canceling and confirming deletion.
Signed-off-by: Hector Castro <hector.hecaxmmx@gmail.com>
Works as described. JSHint OK, koha-qa OK.
Revision per QA: Undid the change making tag and subfield inputs text
fields.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
Bug 14189 added some global JavaScript to a new include file which is
included in doc-head-close.inc. Since it's included globally, there is
no reason not to move it to staff-global.js. This patch does so.
To test, apply the patch and clear your browser cache if necessary.
- Navigate to any page in the staff client which has multiple header
search tabs.
- Type something in one of the tabs.
- Switch tabs. Verify that your text was copied to the newly-displayed
form field.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
The "Column visibility" text button was not translatable, now it is.
Test plan:
1/ Update the template for a given language and translate the "Column
visibility" string
2/ Go on admin/currency.pl
=> The string should be translated.
Signed-off-by: Aleisha <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
C4::Members::getidcity and C4::Members::GetCities simply retrieved
cities info from the cities table.
The job done in members/memberentry.pl looked really weird and complicated.
Either I have missed something, or this patch can simplify it.
The expected behavior is:
1. Create a new patron => No city selected
2. Edit an existing patron => The borrowers.city value is selected
3. Add a guarantee => The borrowers.city of the guarantor is selected
4. Edit a guarantee => The borrowers.city of the guarantee is selected
Test plan:
Confirm that the expected behaviors are the ones before and after this patch.
Signed-off-by: Natasha <tasham_8@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
This patch moves the Button area all tables which does not redefine the
dom/sDom DT parameter.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
I have only changed this in the includes for the tabs at the top.
Dependent on Bug 12051 as that patch adds extra tabs to the top which would need to be changed later
To test:
1) Apply Bug 12051 first, then this patch
2) Ensure that Check Out/Check In/Renew tabs still work as they should
3) Check patch for errors or pages I've missed
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
UPDATE: Added to checkin-search.inc to show up on returns.pl
To test:
1) Apply patch
2) Confirm that there is now a Renew tab on the pages where there is also a Check-in tab only
3) Attempt to renew a book using this, confirm it works as expected
4) Check if I have missed any pages
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Revert "DBRev to make notes of the XSS patches and the new important dependency."
This reverts commit e140603a59.
Revert "Bug 13618: Specific for branches.opac_info"
This reverts commit 06e4a50f00.
Revert "Bug 13618: (follow-up) Specific for other prefs"
This reverts commit d6475a111f.
Revert "Bug 13618: Fix for debarredcomment and patron messages"
This reverts commit dd98c9df92.
Revert "Bug 13618: Do not display html tags in patron's notices"
This reverts commit a065b243fe.
Revert "Bug 13618: Do not display and html tags in item fields content"
This reverts commit baeeaffbf8.
Revert "Bug 13618: Fix for system preference description"
This reverts commit a967a09261.
Revert "Bug 13618: Remove html filters for newly pushed code"
This reverts commit 0e98662b10.
Revert "Bug 13618: (follow-up) add missing lines for opac-shelves"
This reverts commit fc2fb605e5.
Revert "Bug 13618: (follow-up) Specific for ColumnsSettings"
This reverts commit bc308fdd9c.
Revert "Bug 13618: Fix for edit biblios and items"
This reverts commit 811c4e8402.
Revert "Bug 13618: followup to remove tabs"
This reverts commit ca8e8c397c.
Revert "Bug 13618: Fix last occurrences recently introduced to master"
This reverts commit bb417b256b.
Revert "Bug 13618: Fix for news"
This reverts commit ae5b98020a.
Revert "Bug 13618: Fix escape on sending baskets or shelves by email"
This reverts commit a7731ffe25.
Revert "Bug 13618: Specific for XSLTBloc"
This reverts commit 11fa38dc29.
Revert "Bug 13618: Specific for Salutation on editing a patron"
This reverts commit 36c07ad6d3.
Revert "Bug 13618: Specific for other prefs"
This reverts commit e6ea281a3b.
Revert "Bug 13618 - memberentrygen.tt errors Not a GLOB reference"
This reverts commit 7824874557.
Revert "Bug 13618: Specific for ColumnsSettings"
This reverts commit 1834da3da3.
Revert "Bug 13618: Specific for IntranetUser* and OPACUser* prefs"
This reverts commit 21ae62b253.
Revert "Bug 13618: Fix error 'Not a GLOB reference'"
This reverts commit 602bdbab4c.
Revert "Bug 13618: Specific for the ISBD view"
This reverts commit d254362435.
Revert "Bug 13618: Specific for pagination_bar"
This reverts commit 8837a8ae68.
Revert "Bug 13618: Specific places where we don't need to escape variables - intra"
This reverts commit 00eff140b3.
Revert "Bug 13618: Remove html filters at the intranet"
This reverts commit 7db851ff03.
Revert "Bug 13618: Specific places where we don't need to escape variables"
This reverts commit 49a3738b8d.
Revert "Bug 13618: Remove html filters at the OPAC"
This reverts commit cedaa0e23e.
Revert "Bug 13618: Use Template::Stash::AutoEscaping to use the html filter"
This reverts commit 01b38d3b13.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
Bug 8064 (Merge several biblio records) change some code used in both
biblios and authorities merge tool without updating the authorities
merge tool.
This patch fixes that.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan Gallagher brendan@bywatersolutions.com
