Commit graph

54745 commits

Author SHA1 Message Date
1213ad7af7
Bug 37540: Ensure datetime is a string before enqueueing pseudonymization
To test:
1 - Enable Pseudonymization in system preferences
    NOTE: See bug 28911 for bcrypt setup
2 - Issue an item to a patron
3 - View the patrons checkouts
4 - Check the box under 'Renew'
5 - Renew selected items
6 - Internal server error
7 - Apply patch
8 - Restart all
9 - Repeat 4&5
10 - Success!

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 18:22:27 +02:00
Julian Maurice
0b7c79fca4
Bug 37210: Properly escape SQL query parameters by using bind values
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Rebased-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:46 +02:00
Hammat Wele
56abb85b1a
Bug 37210: Escape single quote in search string in overdue.pl
To Test:
1. Go to /cgi-bin/koha/circ/overdue.pl
2. In the «Name or card number» field, type «Tommy'and(select(0)from(select(sleep(10)))v)and'»
3. Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
4. Inspect the page, in «Patron category:» field, put «Tommy'and(select(0)from(select(sleep(10)))v)and'» in one of his option's value
5. select the option from the filter and Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
we can inject SQL to the followin field : borname, itemtype, borcat, holdingbranch, homebranch and branch
6. Apply the patch
7. Repeat step 1,2,3
   ==> it doesn't take 10 seconds, the injected sql is not executed
8. Repeat step 5
==> it doesn't take 10 seconds, the injected sql is not executed
9. Repeat step 5 with the followin field : itemtype, holdingbranch, homebranch and branch
   ==> it doesn't take 10 seconds, the injected sql is not executed

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:45 +02:00
f7aabc532a
Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:44 +02:00
35e9ac9b0a
Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:44 +02:00
e77db213a5
Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:43 +02:00
c77c44be6d
Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:43 +02:00
Hammat Wele
a10697ff76
Bug 37018: (follow-up) adding some allowed operators
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:42 +02:00
47757a3078
Bug 37018: Use validation in search_rs helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:41 +02:00
36afa645ba
Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:41 +02:00
5b75ae509d
Bug 37018: Add Koha::Exceptions::REST
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:40 +02:00
470db1620f
Bug 37018: Unit tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:40 +02:00
5a6b8c4166
Bug 37018: Regression tests
This patch adds regression tests. With the current codebase, the
malicious query returns a 200. It should be caught and a 400 needs to be
returned.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/query.t
=> FAIL: It returns a 200
3. Once the rest of the patches are ready, repeat 2
=> SUCCESS: It returns a 400

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:39 +02:00
19e318c545
Bug 37247: Fix display of "closed"
The subscription was not shown as closed after we closed it.
This is because "closed" is not passed to the template.
It seems more reliable to rely on the subscription object (that is passed to both
serials/serials-collection.tt and serials/subscription-detail.tt, the
others are not showing the Reopen/Close buttons)

Also fetch the subscription object after and reopen/close it to display
accurate values.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:38 +02:00
e3a0ad463b
Bug 37247: Fix subscriptions operation allowed without authentication
Move close and reopen after get_template_and_user().
Also move Koha::Subscriptions->find(), not a good idea to run DB queries
before authentication.

Test plan :
1) Apply patch
2) Authenticate to staff interface
3) Go to an existing open subscription
4) Open a new browser tab and use it to log-out
5) Go to first tab and click on 'Close'
6) You get login page
7) Authenticate
8) Check subscription is not closed
9) Check you can close and reopen subscription

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:38 +02:00
a4fef6b201
Bug 37146: Add tests
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:37 +02:00
4741900611
Bug 37146: Prevent path traversal by validating input
This patch validates the plugin_name passed to plugin_launcher.pl
against the base path containing the "value_builder" directory.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29
3. Check that the tag editor for leader still works
4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
5. Check that the pluginf or "Date acquired" still works

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:37 +02:00
6503787f13
Bug 36863: (QA follow-up): tidy up code
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:36 +02:00
e79d407340
Bug 36863: Deal with non-listed methods in CSRF plack middleware
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:36 +02:00
c4be7134c4
Bug 37074: Do no pass biblionumber
It is not used in the controller

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:35 +02:00
9a8fac823b
Bug 37074: Comment approval and un-approval should be CSRF-protected
This patch converts the "Approve" and "Unapprove" controls in the staff
client's comment moderation page so that the operations are POST instead
of GET.

To test, apply the patch and restart services.

- If necessary, enable OPACComments and submit a few comments on a few
  titles in the OPAC
- Go to Tools -> Comments
- Test the process of approving, unapproving, and deleting comments

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-01 17:26:34 +02:00
Jennifer Sutton
558b900895
Bug 35236: Make "Batch description" label match corresponding <input> field
To test:
  1. Create a new patron.
  2. Go to Tools -> Patron card creator.
  3. Create a new patron card batch.
  4. On the "Edit patron card batch" page, click the "Batch
     description:" label.
  5. Observe that the corresponding <input> field is selected.

Mentored-by: Catalyst Academy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 16:58:17 +01:00
Sam Lau
47a3c28473
Bug 36998: Correctly update the 'Amount paid' displayed on the issue refund modal
To test:
1) Enable the 'EnablePointOfSale' sys pref (also requires the 'UseCashRegisters' pref)
2) In the POS module, configure a cash register and also configure some items for purchase with different costs
3) Make multiple sales
4) View the transactions table by clicking the 'Cash summary for ...' tab and then clicking on your cash register's name.
5) Click on the 'Issue refund' button for one of the sales, this should have the correct 'Amount paid'
6) Close the modal and click issue refund on your other item.
7) Note the 'Amount paid' is incorrect and lists the value from the previous item
8) Apply patch
9) Now when clicking issue refund, it displays the correct 'Amount paid'

Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 16:57:59 +01:00
a4b9dcaf61
Bug 37476: Fix reserved word error on Serials.pm on MySQL 8
This patch fixes the fact `RANK` become a reserved word in MySQL 8.0.2
[1]

To test:
1. Launch KTD with MySQL 8:
   $ ktd down
   $ DB_IMAGE=mysql:8 ktd up -d
2. Open the logs
   $ ktd --shell
  k$ tail -f /var/log/koha/kohadev/*.log
3. Create a serial, receive an issue and try to create a routing list
4. Click on `+ Add recipients` and look for Henry
5. Click `Add` and then `Close`
=> FAIL: Henry not added
=> FAIL: The logs show an error about wrong SQL syntax
6. Run:
  k$ prove t/db_dependent/Serials.t
=> FAIL: Tests explode with the same kind of error!
6. Apply this patch
7. Restart plack
8. Repeat 3 through 6
=> SUCCESS: Henry added!
=> SUCCESS: No explosion about the SQL syntax in the logs
=> SUCCESS: Tests pass!
9. Sign off :-D

[1] https://dev.mysql.com/doc/refman/8.0/en/keywords.html

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:45 +01:00
3d76ccdf94
Bug 37476: Unit tests
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:45 +01:00
Thibaud Guillot
e0856d0db6
Bug 36196: Handling NULL data on ajax call
Test plan:

1) Update some data in your cities table, sample for one send:
"UPDATE cities SET city_state=NULL WHERE cityid=<id>"
2) Go on "/cgi-bin/koha/admin/cities.pl" and wait a entire life :)
3) Apply this patch
4) Rebuild your po files if needed
5) Reload the same page and now you get normally the datatable

Sponsored by: BibLibre
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:50:27 +01:00
4eb9816354
Bug 37303: Replace po2json with a JS version
When using __() (ie. Gettext.js) we are seeing the translations that are marked as fuzzy.
This is definitely not the expected behaviour.

It happens because (our version of) po2json are old and no longer maintained,
and just embed them.

It seems that the bin we have has been upgraded to a JS version
(different authors).

Test plan:
(replace LANG with your language code)
0. Do not apply this patch
Edit misc/translator/po/LANG-messages-js.po
Mark a string as fuzzy
Edit ./intranet-main.tt and add the following lines inside $(document).ready
  console.log(_("Your string"));
  console.log(__("Your string"));
Replace "Your string" with the string you are actually testing.

Update the templates: `koha-translate --update LANG --dev kohadev && restart_all`

Go to the Koha home page, open the console.

=> Notice that the second log in the console is displaying the fuzzy string.

1. Apply this patch
Install the new version of po2json using `yarn install`
Repeat the previous steps.

=> With this patch applied both logs show the English version of the
string.

Remove fuzzy, update the templates and try again.

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:53 +01:00
bbd1fa0bfa
Bug 37351: Rework checkbox JS to work with paginating dataTable
To Test:

1. Log in to staff client
2. Place items on items for borrowers
    2-1 Place enough holds as noted above
    2-2 Trap holds for borrowers
3. Open Circulation->Holds Awaiting Pickup (circ/waitingreserves.pl)
4. Click a checkbox for one or mroe holds
    Note->The 'Cancel selected (0)' button changes to 'Cancel
	selected (1)', etc.
5. Cancel selected Holds using the (Cancel selected (#) button)
6. Confirm Cancellation
7. Wait for background processes to complete, then verify holds are cancelled.
8. Return to Open Circulation->Holds Awaiting Pickup (circ/waitingreserves.pl)
9. Ensure button shows "Cancel selected (0)"
10. Click "Next >" to navigate to page 2 of holds
11. Click a checkbox for one or more holds
     Note->The 'Cancel selected (0)' button DOES NOT increase as boxes
	are selected.
12. Cancel selected Holds using the (Cancel selected (#) button)
13. Confirm Cancellation
14. Wait for background processes to complete, then verify holds are cancelled.
     Note-> Holds were not cancelled

15. APPLY PATCH
16. Try step 9-14 again. This time the 'Cancel selected (0)' button should update even when you paginate.
17. Make sure you try all the tables, Holds waiting, Holds waiting over X, Holds with cancellation requests.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:34 +01:00
a0f89e7e98
Bug 37378: Tidy
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:18 +01:00
ebdf121a7d
Bug 37378: libraries_where_can_see_things should always return an array
The subroutine libraries_where_can_see_things stores the list of libraries that things
can be viewed from in an internal variable, so we can return this directly if we have already calculated.

When returning if not cached, we dereference the list and return an array. If cached, we are returning
an arrayref. This patch simply ensures we dereference the array even if already cached.

Before this patch, we were fetching the patrons, then redacting all info as their branches didn't match against
an arrayref, rather than checking against each branch we are allowed to view.

To test:
1. Setup a library group and check the "Limit patron data access by group ." option.
2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL )
3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries"
4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL )
5. Log in as that patron and attempt a patron search that would include users from either library in step 2.
6. See the error:

Something went wrong when loading the table.
500: Internal Server Error.
Expected boolean - got null.
Expected boolean - got null.
Expected string - got null.
Expected string - got null.
Expected string - got null.
Expected integer - got null.
Expected integer - got null.
Expected integer - got null.
Expected boolean - got null.
Expected boolean - got null.
Expected string - got null.

7. Apply patch, restart all
8. Search again, you can see the expected patrons

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:18 +01:00
fb768ebbb8
Bug 37378: Unit test
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 14:49:18 +01:00
Laura_Escamilla
e7a017e663
Bug 37285: (QA follow-up) Perl Tidy
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:33 +01:00
Baptiste Wojtkowski
64027daadc
Bug 37285: Printing lists only prints the ten first results
GIVEN koha in a version later than 22.11, a list with more than ten entries
WHEN the user tries to print the list
THEN only the ten first results are printed

EXPECTED THEN all results are printed

It looks like it is an undesired effect of BZ36858. Page remains set
even while printing, therefore, however the number of rows is not set,
default value (10) is used.

TEST PLAN

1 - create a list with more than 10 items
2 - print the list -> there is a pagination and that only 10 items
  are printed
Apply patch
3 - print the list again -> every items are being printed

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:33 +01:00
1c12a9fe9e
Bug 37366: Patron category "Password change in OPAC" setting only follows system preference
In Administration > Patron categories, when setting the Password change in OPAC field, Koha will not save "Allowed" or "Not allowed" options, and will only keep "Follow the system preference OPACPasswordChange..." value.

Test Plan:
1) Change the Password change in OPAC field
2) Note the change doesn't take affect
3) Apply this patch
4) Change the field again
5) This time is stays!

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:33 +01:00
Catalyst Bug Squasher
3eb461bc9b
Bug 33455: Fix the size of the patron change password heading
The H1 heading on the patron change password page in the staff
interface is too big and should be outside of the area with
form area with the white background.

Test plan:
1. In the staff interface, click on top right of menu and navigate
   to my account.
2. Click the 'Change password' button.
3. Note that title is now outside the legend and font size is
   comparable to other H1 headings (e.g. Duplicate).

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:33 +01:00
Eric Garcia
39ff970544
Bug 37435: Fixed renew patron from moremember.pl without circulate permissions
To recreate:
1. Have a staff account with limited permissions:
    -Staff access ( catalouge )
    -Add, modify and view patron information (borrowers)
    -NO circulate permissions
2. Log in as that staff user and find a patron with an expired account.
3. See the warning "Expiration: Patron's card has expired. Renew or Edit details".
4. Try clicking on Renew, you are logged out and see "Error: You do not have permission to access this page."

To test:
1. Apply patch
2. From the expired patron's details page see the warning and click Renew
3. Notice it renews the patron and returns to the patron details page
4. Details -> Edit -> Set the expiration date so that the patron is expired
5. Go back to your staff patron and check 'Check out and check in items' permission
6. In your expired patron's page -> Check out -> See warning -> Renew
7. Notice it renews the patron and returns to the check out page
8. Set the expired patron's expiration date so that it expires soon
9. Uncheck 'Check out and check in items' permission for your staff patron
10. Confirm the warning for your patron now is "Expiration: Patron's card expires on (DATE). Renew or Edit details"
11. Repeat steps 2-7 and notice it returns to the correct pages

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:33 +01:00
Brendan Lawlor
620dbcde87
Bug 37407: Fix automatic checkout for fast cataloging
This patch adds a check for the referrer to the circulation page.
If the referrer is from the same origin's additem.pl then get the
barcode from the url parameters, fill the form and submit.

Test plan:
1. Apply patch
2. Enter a barcode not in the system, eg 99999
3. Click '+ Add record using fast cataloging'
4. Fill required bib fields 000, 008 and 245a and click 'Save'
5. Add required item field y - Koha item type and click 'Add item'
6. Notice the barcode is filled and the form is submitted automatically
7. Confirm the item is checked out and the dutedate specified works
8. Add an html customization somewhere else in koha with a link like
   http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=38&barcode=99999&duedatespec=&stickyduedate=
9. Click on the link to simulate a csrf attack
10. Confirm the checkout page is loaded for that patron but no checkout is made

Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:32 +01:00
476776cc5b
Bug 34147: Load all categories for displaying patron results
Currently we are only loading unlimited categories into the patron search, so when we return
patrons from a category limited to another library we crash because we don't have the descriptions
loaded.

This patch removes the limit from 'categories_map' which is only used for displaying patrons. As patron
visibility is a feature of permissions and groups, I don't think we should enforce if based on category
limitations.

NOTE: the categories for searching are still limited in the left hand filters - but not in the dropdown if you click the options button in the top search form. This is beyond the scope of this bug.

To test:
1. Make sure you are logged in as Centerville
2. Do a patron search for 'Ac' -- there are two patrons: Henry (Staff) and Edna (Patron)
2. Go to Administration > Patron Categories
3. Edit the Patron (PT) category, set the Library limitations to Fairfield only
4. Do the patron search for 'Ac' again - it hangs up with a Processing box
5. Apply patch
6. Reload the page (clear cache) and confirm the results now load

Signed-off-by: Jason Robb <jrobb@sekls.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:32 +01:00
Phil Ringnalda
a85086d827
Bug 37197: Reports option to send to batch patron modification needs to use POST
When you have an SQL report that selects cardnumber from borrowers, you
get a menuitem to send the results to Batch patron modification. Currently
that fails with a message about no card numbers or borrowernumbers given,
because it tries to do a GET with the op show, when modborrowers.pl is
expecting a POST with the op cud-show.

Test plan:
1. Without the patch, Reports - Create from SQL - name it and paste

select cardnumber from borrowers

   in the SQL textarea and save, then Run report.
2. Above the results is a "Batch operations with 20 visible records" menu,
   choose Batch patron modification
3. Note that instead of modifying the records, you're stuck with a message
   saying "No patron card numbers or borrowernumbers given." even though
   there's a whole string of them in the URL.
4. Apply patch, refresh the page with the results (oddly, no apparent need
   to even restart_all), and choose the menuitem again, but this time with
   a successful result.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-26 13:56:32 +01:00
43985e90db
Bug 36936: (QA follow-up) Make the test work on MySQL 8.x
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-07-25 14:46:41 -03:00
a62d39ea11
Bug 36362: (QA follow-up) Tidy code
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:19:04 +01:00
David Gustafsson
2c1e955621
Bug 36362: Only call Koha::Libraries->search() if necessary in Item::pickup_locations
To test:

1) Make sure the following tests pass:
 - t/db_dependent/Koha/Item.t
 - t/db_dependent/Koha/Biblios.t
 - db_dependent/Koha/Biblio.t

Sponsored-by: Gothenburg University Library
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:18:53 +01:00
Emmi Takkinen
1a154f1f0e
Bug 36129: Make check on "Hide all columns" persist on item patch modification/deletion
On item patch modification/deletion tool, if one checks
"Hide all columns" checkbox and then reloads the page,
checkbox is no longer selected. Columns are hidden as
they should. This patch adds line to batchMod.js which
sets "checked" attribute and class "selected" to checkbox.

To test:
1. Find items to modify/delete and modify/delete them with
corresponding tool.
2. Check checkbox "Hide all columns".
3. Refresh the page.
=> Note that columns are still hidden, but checkbox is now
unselected.
4. Apply this patch.
5. Check checkbox again and refresh page.
=> Checkbox should be still checked.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:16:50 +01:00
628f84bdec
Bug 35539: DBRev 24.06.00.021
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:13:12 +01:00
1dde4f4f58
Bug 35539: (QA follow-up) Fix atomic update to look for first non-null values
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:24 +01:00
fb4fb88ace
Bug 35539: Schema update
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:22 +01:00
fcc4de2018
Bug 35539: Atomicupdate
Removal of 'bulk' column
Removal of 'finetype' column
Removal of 'issuelimit' column

Test plan, k-t-d:
1) Add data to the relevant columns, run the following mysql:
update categories set bulk = 1;
update categories set finetype = 1;
update categories set issuelimit = 1;
2) Run updatedatabase, notice it shows a warning and does not update the database
3) Clean up the data, run the folllowing mysql:
update categories set bulk = null;
update categories set finetype = null;
update categories set issuelimit = null;
4) Run updatedatabase again, notice it updates the database as intended

Run:
t/db_dependent/Circulation/GetHardDueDate.t

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:18 +01:00
4a4469fd6a
Bug 35539: Remove 'issuelimit' column/field from categories table
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:16 +01:00
581903289d
Bug 35539: Remove 'finetype' column/field from categories table
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:14 +01:00
6d4b201823
Bug 35539: Remove 'bulk' column/field from categories table
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-07-25 11:11:08 +01:00