Commit graph

23 commits

Author SHA1 Message Date
a682c620ee Bug 27846: (follow-up) Add id back to breadcrumbs container
I think the "breadcrumbs" ID is worth saving for past and future CSS
customization reasons.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-04-01 18:51:38 +02:00
1ae1e6dfe3 Bug 27846: clubs, course_reserves, errors and ill folders
Modified breadcrumbs to be accessible, in particular for a
screen-reader.

Made the block of breadcrumbs be a <nav aria label="Breadcrumb"
class="breadcrumb"> with an ordered list inside. The last breadcrumbs
also has aria-current="page" to specify that it is the current page.

To test:
1) Apply patch
2) Build scss file
3) Ensure each of the files in the clubs, course_reserves, errors and
   ill folders has breadcrumbs that are in a <nav aria
   label="Breadcrumb" class="breadcrumb"> block
4) Ensure that there is an ordered list in the block of breadcrumbs
5) Ensure that the last breadcrumb has aria-current="page"
6) Ensure that the breadcrumbs on each page of the staff client
   belonging to these files look the same as before, but the '>' symbol
   is replaced with '/' and the last breadcrumb has bold text
7) Ensure that when the last breadcrumb is clicked it takes you to the
   page you are currently on

Sponsored-by: Catalyst IT
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-04-01 18:51:37 +02:00
5c68609110 Bug 27561: Remove type attribute from script tags: Various templates
This patch replaces remaining instances of <script type="javascript"> in
templates with "<script>."

To test, apply the patch and check the changes to the template. Verify
that the changes look correct.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-02-01 16:36:38 +01:00
9c2f9a021a Bug 26592: Prevent XSS vulnerabilities when circ/ysearch.pl is used
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-02 15:39:38 +01:00
a02bd4f71c Bug 25744: Replace <i> with <em> in staff interface
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-09-18 11:08:35 +02:00
2517147c30 Bug 21838: Wrong alignment of instructors in course reserves
This patch adds CSS to course reserve pages so that multiple instructors
on a course are displayed well.

To test, apply the patch and:

 - Add or edit a course.
   - Test adding and removing instructors, saving, and adding and removing
     again.
 - View a course with multiple instructors and confirm that they are
   displayed well.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Awesome, Owen :-D

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-11-16 12:53:02 +00:00
Mark Tompsett
2ca766f392 Bug 21349: Instructors with special characters in cardnumber cannot be removed from course reserves
The cardnumber can contain strange non-javascript-friendly
characters. This patch converts all the internal references
to borrowernumber, but displays the cardnumber when showing
list of matching users.

TEST PLAN
---------
1) Make sure Course Reserves is being used. Check system preferences.
2) Make sure there is a Course entered.
3) Make sure there is a patron with an cardnumber which breaks
   the existing javascript (eg. Ka-boom:Ka-boom!KABOOM@#$!)
4) Go into the course list.
5) Click the course name link
6) In the "Instructor Search" box enter the patron name.
7) Select the patron which has the ugly cardnumber.
8) Click Save
   -- The course listing should have the new teacher listed.
9) Click the course name link again.
10) Click 'Remove' beside the instructor's name.
    -- nothing happens, and inspecting the error console gives
       you the ugly error described in comment #0
11) apply this patch
12) restart_all
13) sudo service apache2 restart
14) refresh the page.
15) click 'Remove' beside the instructor's name.
    -- name is removed.
16) Click Save
    -- the course listing no longer lists the new teacher.
17) Actually confirm that adding and removing others normally
    works as expected.
18) run koha qa test tools.

Signed-off-by: Charles Farmer <charles.farmer@inLibro.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-10-29 00:35:41 +00:00
5825026448 Bug 21526: uri escape TT variables when used in 'a href'
This patch has been generated with the script provided on bug 21576.
It only affects variable used in the href attribute of a link *when*
href it the first attribute of the node (grep "a href")

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-10-26 17:09:57 +00:00
Jonathan Druart
dcd1f5d48c Bug 13618: Add html filters to all the variables
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.

This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.

To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags

- Remove them from borrower_debarments.comments (there are allowed here)
update  borrower_debarments set comment="html tags possible here";

- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)

Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-08-17 15:55:05 +00:00
3eb50270b1 Bug 19981: Switch single-column templates to Bootstrap grid: Course reserves
This patch updates three single-column course reserves templates to use
the Bootstrap grid:

- course-reserves.tt - The main Course Reserves page
- course-details.tt - The detail view of an individual course
- course.tt - Editing a course
- add_items-step1.tt - Adding items to a course, step 1 (scan barcode)
- add_items-step2.tt - Adding items to a course, step 2
- invalid-course.tt - The error page shown if you try to view
  course_reserves/course-details.pl directly without passing a course id
  in the URL
  - Also changed in this template: Error message has been wrapped in the
    standard "dialog alert" <div>.

Each of these pages should look correct, with a single centered column
with wide margins on either side. At lower browser widths the margins
should disappear.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2018-02-18 16:48:48 -03:00
Claire Gravely
dccb3a3414 Bug 19678: Clicking Cancel when adding New Course to course reserves shows message Invalid Course!
Clicking on the cancel link when adding a new course to course reserves
displays the message 'Invalid Course!'. It would be better if it
redirected back to the main Course Reserves page.

This patch redirects the user back to the main course reserves page.

To Test:

1. Go to Course Reserves

2. Click '+ New Course'

3. Cancel the process

4. You are shown 'Invalid Course!'

5. Apply patch and repeat steps 1-3

6. You are redirected back to the main course reserves page

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-20 13:26:46 -03:00
cf79a2694e Bug 19628: Move course reserves templates JS to the footer
This patch modifies the staff client course reserves templates so that
JavaScript is included in the footer instead of the header.

To test, apply the patch and test the JavaScript-driven features of
each page: All button controls, DataTables, autocomplete, etc.

Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-12-11 11:34:21 -03:00
Aleisha Amohia
f55af2fc07 Bug 19229: Return to course when cancelling out of edit form
To test:
1) Ensure UseCourseReserves is enabled
2) Go to Course Reserves, create a course
3) Edit course
4) Click Cancel
5) Notice you are returned to the courses home page rather than returned
to the course
6) Apply patch
7) Go to edit course and click cancel again
8) Confirm you are returned to the course and that this feels like the
natural expectation.

Sponsored-by: Catalyst IT
Signed-off-by: Claire Gravely <claire.gravely@bsz-bw.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-09-07 13:56:08 -03:00
b38370ff83 Bug 13941: [2/2] Fix <body> tags missing id/class
Followed test plan from patch 1/2, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-04-24 09:47:38 -03:00
aa722ab694 Bug 11570 - Upgrade jQueryUI to latest version in the staff client
This patch upgrades the version of jQueryUI included in the Koha staff
client from v1.8.23 to v.1.10.4. The upgrade introduces a few minor API
changes which require the updates in this patch:

- In CSS, the term "active" is used instead of "selected"
- Autocomplete functions use slightly changed parameters

Changes to the default jQueryUI CSS allows us to remove some instances
of "!important" from jQueryUI-related CSS in the staff client's main CSS
file.

To test:

Testing changes to autocomplete:

- Enable the CircAutocompl system preference. Try searching in the
  header's "Check out" tab. Autocomplete should look correct and
  function correctly.

- In Circulation -> Overdues: The patron attribute authorized value
  filter (must have patron attributes enabled, and a patron attribute
  defined which uses authorized values.

- Course reserves -> Course -> Edit: Searching for an instructor

- In the unimarc_field_210c_bis.pl plugin:
  1. Link the publisher name field in your MARC structure to
     the unimarc_field_210c_bis.pl plugin.
  2. Open a MARC record for editing and click the "tag editor" link to
     launch the plugin.
  3. Type the first few letters of a publisher which exists in your
     database. You should get an autocomplete menu of publishers
     which match your search.
  4. Select one and click the "choose" button to fill the field in the
     MARC editor.

- Tools -> Patron lists: Add a list or choose an existing list and add
  patrons. Perform a search for a patron.

- Placing a hold: After choose a title and clicking "Place hold,"
  search for a patron.

- Tags management: The sidebar filter for "reviewer" should let you
  search by patron name.

Other jQueryUI widget changes:

- Check tabs appearance in header search, biblio detail, cataloging, and
  circulation patron fines pages.

To confirm other jQueryUI widgets still function correctly:

- Check accordion (collapsing sections) in Patrons -> Patrons requesting
  modifications and the MARC subfield structure edit screen.

- Check datepickers, especially in Circulation with the added timepicker.
  Test a linked datepicker, for example in Reports -> Stats wizards ->
  Circulation where the value in one date field affects what dates are
  available in the matching field.

- Check the calendar interface in Tools -> Calendar

To confirm that the new jQueryUI default CSS is more flexible (fixing
Bug 11042), add the following CSS to your IntranetUserCSS system
preference and confirm that the header search active tab border color
changes (hash mark escaped so that it will appear in commit msg):

\#header_search ul.ui-tabs-nav li.ui-tabs-active {
  background-color: #FFFFF1;
  border: 1px solid #800000;
  border-top: 0 !important;
  top: -2px;
}

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-04-07 15:37:27 +00:00
4e9b5110d9 Bug 11788 - Use validation plugin when creating new course
The page for adding a new course includes some custom form
validation JavaScript which can be removed in favor of HTML5 validation
attributes and Koha's built-in validation plugin. This patch does so.

To test, apply the patch and go to Course reserves -> New course. Try
submitting the form without entering a department, course number,
and/or course name. This should trigger validation warnings.

Submission of the form with valid data should work correctly. Editing an
existing course should also work correctly.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-02-20 16:56:56 +00:00
d567733f23 Bug 11534: fix bug that made it impossible to remove instructors from a course
In some cases clicking the "remove" link to remove a course instructor
when editing a course reserves course doesn't work. I suspect this is
caused by leading zeroes in the card number. This patch refactors the
relevant function to fix the problem and to remove inline JavaScript
from generated markup.

Other changes:

- Make the "Remove" text translatable
- Re-order the first name and last name when added by JavaScript to
match the template's "surname, firstname" order.

To test:

1. If necessary, create or modify a patron to have a card number
   with leading zeroes.
2. Go to Course reserves and add or edit a course.
3. If you are editing a course and there are existing instructors, click
   the "remove" link. Nothing will happen.
4. Perform a patron search and choose one of the results. The name
   should be added to the list of instructors in the format "surname,
   firstname."
5. Click the "remove" link next to the patron name which was just added.
   Nothing will happen.
6. Apply the patch and repeat step 4. The "remove" link should work.
7. Add an instructor and save the course reserve. Repeat steps 2 and 3.
   The "remove" link should now work.

To test the translation fix, after applying the patch run "translate
update [language code]" and confirm that the "Remove" string is listed
in the updated po file for course_reserves/course.tt.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-01-31 15:45:56 +00:00
Katrin Fischer
4043df4395 Bug 10409: Follow up - improving strings for easier translation
Fixing this line:
<legend>[% IF course_id %] Edit [% ELSE %] Create [% END %] course</legend>

As grammar works different in different languages, having single
strings like that in a predefined order makes having a nice translation
unnecessarily hard.

This will make it a little easier:
<legend>[% IF course_id %]Edit course[% ELSE %]Create course[% END %]</legend>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-07-17 14:09:59 +00:00
1ad188f9d6 Bug 10409 - Do not show course entry form if no departments are found
The course reserves entry form should not be shown if there are no
DEPARTMENT authorized values, since this prevents the form from being
submitted. This patch replaces the form with an error message when no
DEPARTMENT authorized values are found.

Also corrected:

- Corrected grid structure for more standard display
- Converted labels with no corresponding inputs to <span class="label">
- Closed unclosed tags
- Corrected incorrect capitalization

This patch contains whitespace changes, so please ignore whitespace when
examining changes.

To test, delete any DEPARTMENT authorized values, if present. Create a
new course in Course Reserves. You should see a warning that no
DEPARTMENT values were found.

If you are logged in with the correct permission, the warning should
contain a link to the correct authorized value page. If you do no, the
warning should refer the problem to an administrator.

After creating one or more DEPARTMENT values, the form should display
and submit correctly.

Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
After this patch has been applied, I get an error message and no form
if I don't have any DEPARTMENTs defined, which makes sense given that
the form can't be submitted without a DEPARTMENT.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
You now see a useful error message, when no departments have been
defined. Else you are taken to the correct form.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-07-17 14:09:59 +00:00
20180b4c39 Bug 10420 - Standardize spelling of "authorized"
This patch corrects instances of the non-[American]-standard spelling
"authorised" when used in text.

The following instances are corrected:

- In Administration -> Funds, the error message displayed if you do not
  have permission to edit a fund.
- In Administration -> Authorized values, the instructions linked to the
  "Libraries limitation" field.
- In Administration -> MARC bibliographic framework test, instructions
  related to linking to authorized values.
- In the course reserves add form, error messages referring to missing
  authorized values.
- In guided reports, error messages shown when an authorized value
  chosen as a report parameter doesn't exit.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2013-06-07 08:26:13 -07:00
1940d4871c Bug 8215 - Add Course Reserves - QA Followup
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
2013-05-21 15:50:58 -07:00
Jonathan Druart
0ba129131c Bug 8215: Followup FIX QA issues
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
2013-05-21 15:50:57 -07:00
be869ab279 Bug 8215 - Course Reserves
Adds a course reserves system for academic libraries.

The course reserves system allows libraries to create courses
and put items on reserves for those courses.

Each item with at least one reserve can have some of its attributes
modified while it is on reserve for at least one active course.
These attributes include item type, collection code, shelving location,
and holding library. If there are no active courses with this item
on reserve, it's attributes will revert to the original attributes
it had before going on reserve.

Test Plan:
  1) Create new authorised value categories DEPARTMENT and TERM
  2) Create a new course, add instructors to that course.
  3) Reserve items for that course, verify item attributes have changed.
  4) Disable course, verify item attributes have reverted.
  5) Enable course again, verify item attributes again.
  6) Delete course, verify item attributes again.
  7) Create two new courses, add the same item(s) to both courses.
  8) Disable one course, verify item attributes have not reverted.
  9) Disable both courses, verify item attributes have reverted.
 10) Enable one course, verify item attributes are again set to the
     new values.
 11) Edit reserve item attributes, verify.
 12) Disable all courses, edit reserve item attributes, verify
     the item itself still has its original attributes, verify
     the reserve item attributes have been updated.
 13) Verify the ability to remove instructors from a course.
 14) Verify new permissions, top level coursereserves, with
     subpermissions add_reserves and delete_reserves.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Corinne Bulac <corinne.hayet@bulac.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

http://bugs.koha-community.org/show_bug.cgi?id=8125
2013-05-21 15:50:55 -07:00