We are preparing the ground with this patch. As the "Columns settings"
page will now add the ability to modify settings for the whole table, it
makes sense to rename the file and the variables.
Note that the controller script (admin/columns_settings.pl) and the yml
(admin/columns_settings.yml) files have not been moved to not break
shortcuts and abits people could have. But if QA decides, it could be
easy to do.
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Alex Arnaud <alex.arnaud@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The patch adds the suggestion management reason to the display when
viewing a suggestion.
To test:
1) Edit a suggestion and assign a reason for accepting it.
2) View the suggestion (/cgi-bin/koha/suggestion/suggestion.pl?suggestionid=XX&op=show, replacing XX with your suggestion ID)
3) Under suggestion management, the reason you've just assigned does not
display.
4) Apply the patch
5) Check the display again - the Reason should now be visible directly
under the status.
Signed-off-by: Abbey Holt <aholt@dubuque.lib.ia.us>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Incorrect markup surrounding Bootstrap dropdown buttons causes display
problems with the buttons are in a DataTable. Dropdown wrapper <div>s
must have a "btn-group" class.
To reproduce the problem, look at the MARC bibliographic frameworks
page. The "Actions" menu when triggered will not line up with the
button.
In almost all cases, dropdown buttons inside tables should also have the
"dropup" class on their wrapper so that the menu appears above the
button. This prevents the menu from disappearing off the bottom of the
window when the button is positioned low in the viewport.
To test, apply the patch and test the button menus in tables on the
following pages:
- Acquisitions -> Invoices
- Acquisitions -> Add to order -> From external source -> Results
- Acquisitions -> Suggestions
- Administration -> Budgets
- Administration -> Funds
- Administration -> Authority types
- Administration -> Authority types -> MARC structure
- Administration -> MARC bibliographic frameworks
- Administration -> MARC bibliographic frameworks -> MARC structure
- Administration -> OAI sets configuration
- Administration -> Z39.50/SRU servers
- Authorities -> Authority search results
- Authorities -> New from Z39.50/SRU -> Search results
- Cataloging -> Edit items
- Cataloging -> New from Z39.50/SRU -> Search results
- Circulation -> Article requests
- Reports -> Saved reports
- Tools -> Patron lists
- Tools -> Rotating collections
- Serials -> Serials search results
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
I believe I suggested a typo - trying to fix it here.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Sometimes librarians are creating purchase suggestions that came from patrons
which didn't use the opac (but sent an email, or told the librarian verbally...)
This patch allows the librarian to change the creator of the purchase suggestion
when entering it.
This way, the patron will be able to receive notifications during the purchase
suggestion workflow.
Test plan:
- Apply the patch
- Check that you can change the default creator of the purchase suggestion when
creating a new suggestion by clicking on 'Set to patron'
(Home > Acquisitions > Suggestions management > New purchase suggestion)
- Check that you can also change the creator of the purchase suggestion when
editing an existing suggestion
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The <i> was not closed resulting in the "Archived" displaying in
the wrong font. Might be a browser specific issue, but adding the
closing </i> fixed it and follows the existing pattern.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
There are performance issues when searching suggestions if there are
thousands of suggestions.
To prevent that we are going to add the ability to archive purchase
suggestions, in order to remove them from the search list (by default).
Test plan:
0. Apply all the patches, execute the updatedatabase.pl script, restart
all
1. Create some suggestions
2. Search for them
3. Use the "Archive" action button for one of them
4. Restart the search
=> The archived suggestion does no longer appear in the list
5. Use the filter "Included archived" in the "Suggestion information"
filter box
=> The archived suggestion is now displayed
6. Use other filters
=> The "archived" filter is kept from one search to another
7. Use one of the action at the bottom of the suggestion list (change
the status for instance)
=> The "archived" filter is still kept
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
On commit 4494e8ba6c
Bug 23594: Batch modification for itemtypes on suggestions page
The anchors of the tabs on suggestion.pl has been replaced with
tab_$count instead of the status code.
There was a need at the time, but I cannot remember it.
I restored the previous behavior, and did not find any regressions.
Test plan:
1 - Add several suggestions to Koha
2 - Set them in different status, leaving at least one pending
3 - Go to home page, note it shows count of pending
4 - Click the link on home page
5 - It takes you to correct tab
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Fixes links to the patron accounts from the edit and list view of
suggestions.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
On creating the TT var managedby_patron does not exist yet
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
To separate the two feature we want to create a distinct template
notice.
A new NOTIFY_MANAGER notice is added.
A follow-up patch will be added for other languages, when this one will
be approved by QA.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
- Ensure that the sequence of columns will be the same for new
and updated installations (add AFTER ...)
- Fix permissions (see bug 22868)
- Fix column configuration (see 16784)
- Remove '- ' displying before the date
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The notify option is only available from the edit view
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
No tests are provided for the changes made to SearchSuggestion. It is
going to be remove very soon as it is super ugly...
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Just a bit of cleaning
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Prior to this patch there was an hidden behavior that set the manager to
the logged in user when a suggestion was edited. This patch proposes to
let the librarian pick another manager.
Other small adjustements will be added to polish this new behavior:
* Create 2 new DB columns: suggestions.lastmodificationby and
suggestion.lastmodificationdate
* Choose a manager when editing a suggestion
* Batch modify suggestions and set a manager for them
* Let notify the new manager using the TO_PROCESS letter
* Display the manageddate, lastmodificationby and lastmodificationdate
info where appropriate
This first patch adds a new "Select manager" link when editing a
suggestion.
Test plan for the whole patchset:
0/
a. Execute the update DB entry, generate the new DBIC file and restart all
b. Create at least 2 patrons with the suggestions_manage permission
1/ Submit a new suggestion (OPAC or staff, not important)
2/ Accept it
3/ Edit it
=> "Last modification by" is empty
=> You see that you are the manager of this suggestion
4/ Click "Select manager" and search for a new manager
=> The patron search will only display patrons with the
suggestions_manage permission
5/ Save
6/ Edit again
=> The manager is set to you, but there is a note saying that previously
it was the patron you picked
=> The "Last modification by" is set to you
7/ Click "Keep existing manager"
=> The manager is now set to the previous manager
8/ Select another manager (which has a valid email address defined)
9/ Click the "notify" checkbox
10/ Save
11/ Confirm that a TO_PROCESS notice has been generated into the
message_queue table
12/ Create at least one other suggestion
13/ List the suggestions
=> There is a 4th action column to assign a manager to several
suggestions in one go.
14/ Use this new button and confirm that it works as expected
15/ Go to your purchase suggestion list (OPAC and staff)
=> You see the "managed date" displayed in a new column
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
In French, everything has one of the binary genders (male or female),
and it affects the past tense verb agreements.
This patch adds contextualization for the "Created" verb
The following files have been modified:
booksellers.tt - refers to a basket
basket.tt - refers to a basket
transferorder.tt - refers to a basket
memberentrygen.tt - refers to a patron restriction
suggestion.tt - refers to a suggestion
To test, apply the patch and visit all those pages in English to make
sure there is no change.
1) Go to Acquisitions
2) Search for vendors
3) On the vendors result pages, check the 'Created by' column heading
of the baskets
4) Click on one of the baskets, check the basket info at the top,
it should say 'Created by:'
5) Click Transfer on one of the orders
6) Search for and choose a vendor
7) In the list of that vendor's basket, it should say 'Created by'
8) Go to a patron's account
9) Add a manual restriction in the Restrictions tab at the bottom
10) In the restriction info, it should say 'Created'
11) Click on the Purchase suggestions tab on the left
12) Add a new suggestion
13) In the Suggestion management section, it should say 'Created by:'
14) Submit the suggestion
15) From the list of suggestions, click on the title
16) In Suggestion management, it should say 'Created by:'
Next, install a new language (fr-CA used as example)
1) translate create fr-CA
2) open fr-CA-messages.po and add a translation for 'basket created by',
'patron restriction created on' and 'suggestion created by' (it doesn't
have to be real, just write something different for each)
3) translate install fr-CA
4) in the system preferences, enable the french language in
'language'
5) change interface language to french
Redo the tests above to make sure the word you put in the translation
for the basket is in the places where 'Created by' refers to a basket, that
the translation for the patron restriction is where it should be and that
the translation you put in for the purchase suggestion is in the places where
'Created by' refers to a purchase suggestion
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
If there is a link between a suggestion and a bibliographic record (ie.
if suggestion.biblionumber is set), it makes sense to have an hyperlink
on the suggestion detail page.
Test plan:
- Create 2 suggestions
- Create an order from one of them
- Go to the detail page of the suggestion
=> The one with the order has a to the bibliographic record
=> The other one is not linked with a bibliographic record, and so the
title is displayed, without hyperlink
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Also fixes the following QA failure:
forbidden pattern: Attribute type should not be used for script tags (bug 20053) (line 840)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This new enhancement adds the ability to update the item types for
selected suggestions on the suggestions management page
(suggestion/suggestion.pl)
To achieve this goal we needed to refresh a bit the template, in order
to get rid of weird code. To not recreate the previous coding awkwardness
some code has been rewritten (mainly the removal of suggestiontype)
Test plan:
- Create some suggestions
- On the suggestions management page, select some of them and a new item
types.
- Submit the form and confirm that the itemtype of the suggestions has
been updated
- Also you should confirm that the "delete" and "change status" still
work as before
Sponsored-by: BULAC - http://www.bulac.fr/
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This follow-up adds a missing template filter quiet qa tool warning.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch adds DataTables column configuration and export options to
the suggestions management tables in the staff interface.
The columns settings made via the administrative interface will affect
tables under each tab in the interface whether it be organized by
status, library, etc. However because of the way the KohaTable function
is currently written, changes made via the "Columns" button will only
affect the visible table.
To test, apply the patch and go to Acquisitions -> Suggestions.
- Under each tab, the table of suggestions should have a DataTables
toolbar with export and columns buttons. These controls should work
correctly:
- Showing and hiding columns should work as expected
- Exports should work, excluding the first and last columns
- Test the tables when using the various "Organize by" settings.
- Test changing the settings in Administration -> Columns settings.
- Verify that the changes you make to that configuration are
reflected in the suggestions tables.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
We should move that to its own bug report if needed, not sure we will
all agree on that new column.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Additionally I have added a library input field in case the librarian wants to set a library branch whilst renewing a subscription. With the use case being they may have ommitted to set the branchcode whilst creating the subscription.
Test plan:
1. Create a subscription (if one does not already exist)
2. Set the RenewSerialAddsSuggestion syspref to 'Add'
3. Renew the item making sure to write in a value into the note field
3. Visit the suggestions page and notice that the note is not displayed
for the newly created suggestion
4. Apply patch
5. Repeat step 3. Notice that there is now a new branchcode dropdown
box. Select one of your libraries and write in the value into the note
field
6. Visit suggestions and notice there is now a 'Suggestion note' column
in the table containing the note.
Also note that the suggestion has the correct branchcode associated with
it
Sponsored-By: Catalyst IT
Signed-off-by: Maksim Sen <maksim@inlibro.com>
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The design of this script is pretty bad and any modifications is a
challenge.
Here we are trying to display to display the funds available for the
logged in user. I did not understand previous code, as we are doing a
limit using CanUserUseBudget, I do not think it makes sense to retrieve
funds for a given library.
Also, I am wondering if the dropdown list in the filters has ever been
populated: budgetid_loop in the template *never* appeared in the history
of suggestion.pl (??)
Test plan:
Search for suggestions
Add/edit suggestions
=> The funds in the dropdown list should be the ones the logged in user
can use.
Signed-off-by: hc <hc@interleaf.ie>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
When editing a purchase suggestion, the "No status"
option in the status pulldown is incorrectly capatalized.
This patch fixes the capitazliation.
To test:
1) Create a purchase suggestion in the acquisitions module.
2) Edit the suggestion. Notice the capitalization in the
status dropdown is incorrect.
3) Apply the patch.
4) Repeat step 2.
5) Note the capitalization has been fixed.
6) Sign off.
Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch makes minor CSS and markup changes in order to deliniate
suggestion notes from the other data in the suggestions list view.
To test you should have at least one suggestion with a note. Apply the
patch and go to Acquisitions -> Suggestions.
In the table of suggestions, check that the notes display clearly.
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This completes suggestion status options in the templates in 2 places
so all values can be translated and show correctly.
To test:
- Create 2 suggestions
- Accept them
- Create a basket and order those 2 from suggestions
- Close the basket
- Receive shipment and receive one of the 2 suggestions
- Go back to suggestions:
- Look at the status column in the suggestions table for both
- Verify that it shows AVAILABLE
- View both suggestions
- Verify that the Status: is empty
- Apply patch
- Repeat test from above, it should all show nicely now
Signed-off-by: Claudie Trégouët <claudie.tregouet@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch upgrades DataTables and makes some style changes to the
default DataTables toolbar style. DataTables assets are now combined and
minified using their download customizer, bundling together these
elements:
- JSZip 2.5.0
- pdfmake 0.1.36
- DataTables 1.10.18
- Buttons 1.5.6
- Column visibility 1.5.6
- HTML5 export 1.5.6
- Print view 1.5.6
- FixedHeader 3.1.4
DataTables assets have been moved from lib/jquery/plugins to
lib/datatables. The global header and footer include files are updated
correspondingly.
This patch removes the custom "four_button" pagination configuration and
updates pages which used it to use the built-in "full" type instead.
This is done for the sake of consistency and upgradability. This change
touches a lot of files.
Table-specific CSS has been moved from staff-global.scss to a new
include, _tables.scss. A second common include, _mixins.scss has some
variable definitions used in both files.
Many images have been made obsolete by this change and have been
removed.
To test, apply the patch and regenerate the staff client CSS. View
various pages in the staff client with tables:
- Not formatted by DataTables:
- Reports -> Most circulated items
- Catalog -> Search results
- Formatted by DataTables without column configuration
- Acquisitions -> Vendor search
- Lists
- Formatted by DataTables with column configuration
- Administration -> Libraries
- Administration -> Item types
- Reports -> Saved SQL reports
- Non-standard DataTables configurations:
- Circulation -> Checkouts
- Administration -> System preferences
- Reports -> Lost items
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch makes a number of changes in order to improve the way the
staff client's header menu adjusts at narrower browser widths:
- Updated version of Bootstrap 3.3.7 which includes the "collapse"
JavaScript plugin.
- Modified default Bootstrap CSS using Bootstrap's customization tool.
These changes facilitate the removal of some custom CSS (overriding
Bootstrap) from staff-global.scss.
- Added Bootstrap config file for loading customizations at
https://getbootstrap.com/docs/3.3/customize/
- Revised button classes for buttons in Bootstrap-styled toolbars.
The modified default CSS resets the base font size in Bootstrap to
better match our global CSS. A side-effect of this is that toolbar
buttons ended up looking smaller than they should. Changing the
button class solves this.
- Restructure the header menu in order to allow different rules to
govern the appearance of the navigational part of the menu
(Circulation, Search, etc) and the user menu (Set library, My
account, Log out).
- Modify the cart JS to so that the popup works well at narrow widths.
To test, apply the patch, regenerate the staff client CSS, and clear
your browser cache.
- Log in to the staff client and observe the layout of the header menu
as you adjust the browser to various widths.
- Confirm that sections of the menu "collapse" as the window gets
narrower.
- Confirm that dropdown menus behave correctly and that links work.
- Confirm that the Cart link works as expected when the cart empty
and when it has items.
- Install and enable multiple translations, including at least one
set of sub-languages (e.g. fr-FR and fr-CA).
- Test the appearance of the language menus in the footer at
various browser widths.
- View pages with button toolbars and confirm that they appear unchanged
(e.g. biblio detail page, patron detail page).
NOTE: While this patch is intended to make improvements to staff client
responsiveness, it does so within a limited scope. There are still many
pages which do not work well at narrower browser widths.
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
DataTables are used on enough pages in the staff client that it
doesn't make sense to put inclusion of the CSS into each template
where it is needed. This patch moves includes of datatables.css from
individual templates into the global header file.
To test, apply the patch and view various pages which have DataTables.
View various styles of DataTables, e.g.
- Full pagination, like item search results
- Four-button, like Saved SQL reports
Everything should look the same as it was.
Signed-off-by: Jose-Mario Monteiro-Santos <jose-mario.monteiro-santos@inLibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch modifies several assorted templates to use the
Bootstrap grid instead of YUI.
This patch also removes obsolete "text/javascript" attributes from
<script> tags and "text/css" attributes from <style> tags in the
modified templates.
To test, apply the patch and view the following pages, confirming that
they look correct at various browser widths:
- Administration -> Plugins
- Tools -> Comments
- Acquisitions -> Suggestions
- Lists
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch has been generated with the script provided on bug 21576.
It only affects variable used in the href attribute of a link *when*
href it the first attribute of the node (grep "a href")
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Generated with:
perl -p -i -e 's/\|\s?\$Price\s?\|\s?html\s%]/| \$Price %]/g' **/*.tt **/*.inc
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here we go, next step then.
As we did not fix the performance issue when autofiltering
the variables (see bug 20975), the only solution we have is to add the
filters explicitely.
This patch has been autogenerated (using add_html_filters.pl, see next
pathces) and add the html filter to all the variables displayed in the
template.
Exceptions are made (using the new 'raw' TT filter) to the variable we
already listed in the previous versions of this patch.
To test:
- Use t/db_dependent/Koha/Patrons.t to populate your DB with autogenerated
data which contain <script> tags
- Remove them from borrower_debarments.comments (there are allowed here)
update borrower_debarments set comment="html tags possible here";
- From the interface hit page and try to catch alert box.
If you find one it means you find a possible XSS.
To know where it comes from:
* note the exact URL where you found it
* note the alert box content
* Dump your DB and search for the string in the dump to identify its
location (for instance table.field)
Next:
* Ideally we would like to use the raw filter when it is not necessary
to HTML escape the variables (in big loop for instance)
* Provide a QA script to catch missing filters (we want html, uri, url
or raw, certainly others that I am forgetting now)
* Replace the html filters with uri when needed (!)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
