Commit graph

36422 commits

Author SHA1 Message Date
adcd95bca6
Bug 20948: Add missing html filter
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-10 10:39:56 +00:00
cef3745aae
Bug 17831: DBRev 19.12.00.001
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:57:16 +00:00
Katrin Fischer
34e931d5a2
Bug 17831: Database update - Tidy up frameworks in existing installations
The mapped table and column doesn't exist, so we should also remove
it from existing installations.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:49:14 +00:00
285e1eb8ca
Bug 17831: Remove non-existig bibliosubject.subject mapping from frameworks
This patch removes the assignment of non-existent koha field
'bibliosubject.subject' to MARC subject fields in the installer data
for koha

To test:
You'll want a new fresh db

1 - Apply patch
2 - Run websintaller
3 - Ensure that thigns go smoothly
4 - Add/delete/edit some records and ensure that things are working with
the installed frameworks

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:48:59 +00:00
9d68838af6
Bug 24128: Add alias for biblionumber search
To test:
1 - In staff or OPAC using ES, search for "biblionumber:3" or any existing biblionumber
2 - No results
3 - Apply patch, restart all the things
4 - Search again
5 - You go to the biblionumber

Signed-off-by:  Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:48:14 +00:00
ca501374af
Bug 20948: Only display item-level hold info if first hold
On the item list of the catalogue detail page we display next item-level
hold info even if it is not the next hold. That leads to confusion as it
will not necessarily be the accurate info.

This patch makes the following changes:
- Display the item-level hold only if it is the next hold (priority ==
1)
- Display "There is an item level hold on this item (priority=X)"
if there is at least 1 item-level hold placed on this item

Test plan:
- Place several next available holds on a single item record
- Place an item level hold on the item
- Go the the biblio detail page
=> Without this patch, the item will show the item level hold
=> With the patch you see "There is an item level hold on this item"
- Check the item in, confirm the hold
=> No changes, the item will show the waiting hold info
- Cancel all the holds except the item-level one
=> No changes, the item will how the item-level one

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:34:53 +00:00
93b2905bdf
Bug 20948: Simplify existing code
No changes expected here.

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:34:44 +00:00
6938b0eac5
Bug 23246: (follow-up) Hardcoding tab position is not enough
There are many conditions that determine the tab number for 'media'.
Translated into variables that hold the tabs count on each condition, it
is clear that '3' was not good enough:
            [%- holdings      = (SeparateHoldings)   ? 2 : 1
                notes         = (MARCNOTES || notes) ? 1 : 0
                acq           = (Koha.Preference('AcquisitionDetails')) ? 1 : 0
                frbr          = (FRBRizeEditions  && XISBNS) ? 1 : 0
                local_covers  = (LocalCoverImages && (localimages || CAN_user_tools_upload_local_cover_images)) ? 1 : 0
                media_tab     = holdings + notes + acq + frbr + local_covers
            -%]

This patch gets rid of the hardcoded value, adds an id to the 'media'
tab (i.e. 'media_tab') and uses JS to get the right index.

To test:
- Play with the different options governing those variables
=> FAIL: 3 is not always the 'media' tab
- Apply this patch
- Repeat your tests
=> SUCCESS: It always picks the 'media' tab
- Sign off :-D

Sponsored-by: American Numismatics Society
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:33:34 +00:00
142a0235ad
Bug 23246: Only jump into the 'images' tab HTML5MediaEnabled is set
This patch makes jumping into the third tab happen only if
HTML5MediaEnabled is set to 'both' or 'staff'.

To test:
- Have HTML5MediaEnabled set to 'opac' or 'not at all'
- Open the detail page of a record with no holdings
=> FAIL: The 'images' tab is selected
- Apply this patch
- Reload
=> SUCCESS: The 'holdings' tab is selected as it should be.
- Sign off :-D

Sponsored-by: America Numismatic Society
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:32:58 +00:00
9fa2818899
Bug 24126: Article requests tab appears twice on patron's checkout screen
This patch removes duplicated markup on the checkout page which results
in the "Article requests" tab appearing twice.

To test, apply the patch and enable ArticleRequests.

Check out to a patron. In the set of tabs that includes checkouts,
holds, restrictions, etc., the "Article requests" tab should appear only
once.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:32:09 +00:00
5d94cbefdc
Bug 23987: "return to cataloguing" if the record is deleted from bachMod-del
If a bibliographic record is deleted after having deleted all their items in a batch,
we should not display a "return to the record" button but "return to cataloguing" instead

Test plan:
1 - Have/make a bib with items
2 - On details page select Edit->Delete items in a batch
3 - Select all items and check "Delete record if no items remain"
4 - Delete the things
5 - On confirmation screen you have a count of items/bibs deleted
=> Without the patch there is a 'Return to record' button that leads to nowhere
=> With this patch there is a "Return to cataloging module" button
6 - Repeat using the "Delete selected items" link on top of the items table
=> Without the patch there is a 'Return to where you were' button that leads to nowhere
=> With this patch there is a "Return to cataloging module" button

Note that there is a link AND a button, coming from
  commit 928c0af2b6
  Bug 15824 - 'Done' button is unclear on batch item modification and deletion
I do not think it makes sense to have both.

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:31:13 +00:00
3225d049be
Bug 23987: Use src=CATALOGUING for edition/deletion in batch from items table
There are 2 ways to land in batchMod from the detail page of a bib
record: from the Edit menu, and the action buttons on top of the items
table.

We want the same behavior for both and so use src=CATALOGUING
It will make batchMod to behave identically for the "return" button

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:31:05 +00:00
Lisette Scheer
fa41a4a94d
Bug 24033: Fix column labelling on basket summary page (ecost)
When viewing a basket, some of the column names are unclear
and are different than the terms used for the same field
on the order form. This patch edits the column titles to
match the order form.

To test:
1) In acquisitions, create a budget.
2) In acquisitions, create a fund.
3) In acquisitions, create a vendor.
4) In acquisitions, create a basket and add a test item to the basket.
5) Observe the column titles ecost tax inc. and ecost tax exc.
   Check the column visibility settings if you don't see
   the columns.
6) Apply the patch.
7) Observe the column titles have been updated.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:30:22 +00:00
Lisette Scheer
fa1fa51562
Bug 24056: Capitalization: Cash Register ID on cash register management page
When editing a cash register, Cash register ID doesn't follow
our capitalization guidelines. This patch fixes that.

To Test:
1) Turn on cash register usage in the system preferences.
2) Add a cash register.
3) Edit the cash register.
4) Note the incorrect capitalization.
5) Apply the patch.
6) Edit the cash register.
7) Note the correct capitalization.

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:29:49 +00:00
243e4cd031
Bug 24057: Hea is not an acronym
This patch changes "HEA" (incorrectly capitalized) to "Hea" on the
staff client administration home page.

To test, apply the patch and set the "UsageStats" system preference to
"No, let me think about it."

 - Go to Administration in the staff client.
 - There should be a message at the top asking if you want to share
   anonymous usage statisitcs with the community. The word "Hea" in this
   message should be capitalized correctly.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:29:10 +00:00
Lisette Scheer
543e11fdfa
Bug 24053: Typo in FinePaymentAutoPopup description
There is a typo in the FinePaymentAutoPopup system preference description.
This patch fixes that.

To test:
1) Go to the systems preferences in administration.
2) Search for FinePaymentAutoPopup
3) Observe .. at the end of the preference description.
4) Apply the patch
5) Repeat steaps 1-2
6) Ovserve correct punctuation at the end of the preference description.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:28:40 +00:00
25ddfb15c5
Bug 24136: Update sponsors for 19.11 cycle
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:25:13 +00:00
ad3e5bae0c
Bug 24168: (bug 23116 follow-up) AllowHoldPolicyOverride allows a librarian to almost place a hold on an item already on hold
This patch actually fixes the issue described on bug 23116.

Test plan:
See bug 23116 and comment 5. Important to note that the later comparison with
itemAlreadyOnHold assumes that the variable is a string.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-09 14:23:37 +00:00
ece3e5a6a2
Bug 24145: (bug 22543 follow-up) Fix Auth.t
Auth.t is failing because of: 1. recent changes from bug 22543 and 2. wrong mocked CGI->param in tests
Without this patch we hit the exit statement that breaks the tests with the following error:

t/db_dependent/Auth.t .. 1/22 Un-mocked method 'url()' called at /kohadevbox/koha/C4/Auth.pm line 1223.
Un-mocked method 'redirect()' called at /kohadevbox/koha/C4/Auth.pm line 1227.
A context appears to have been destroyed without first calling release().
Based on $@ it does not look like an exception was thrown (this is not always
a reliable test)

This is a problem because the global error variables ($!, $@, and $?) will
not be restored. In addition some release callbacks will not work properly from
inside a DESTROY method.

Here are the context creation details, just in case a tool forgot to call
release():
  File: t/db_dependent/Auth.t
  Line: 74
  Tool: Test::More::subtest

Cleaning up the CONTEXT stack...
    # Looks like you planned 22 tests but ran 1.
t/db_dependent/Auth.t .. Dubious, test returned 255 (wstat 65280, 0xff00)
Failed 21/22 subtests

Test Summary Report
-------------------
t/db_dependent/Auth.t (Wstat: 65280 Tests: 1 Failed: 0)
  Non-zero exit status: 255
  Parse errors: Bad plan.  You planned 22 tests but ran 1.
Files=1, Tests=1,  2 wallclock secs ( 0.02 usr  0.00 sys +  1.54 cusr  0.24 csys =  1.80 CPU)
Result: FAIL

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-02 17:13:27 +00:00
1a78447367
Bug 24144: (bug 23836 follow-up) Fix regressions.t tests
Bug 23836 changes the behavior for tracklinks.pl but did not adjust the
tests.

We must then expect 404 if the pref is turned off.
Also mock_preference cannot work (we are hitting the web server and so
need to set the value in DB and flush the L1 caches)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-02 17:13:27 +00:00
1548f0300f
Koha 19.12 - Dobbie is a free elf...
“Dobby has got a sock. Master threw it, and
    Dobby caught it, and Dobby — Dobby is free."

Koha, the worlds first completely open library system. 🧦

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-12-02 17:13:15 +00:00
0553463d04
Update release notes for 19.11.00 release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 18:25:06 +00:00
019eff289b
Maintanence team template corrections
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 18:25:01 +00:00
bdf9e11abb
Add release team for 20.05 cycle
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 17:00:31 +00:00
24504b320e
Increment version for 19.11.00 release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 16:34:49 +00:00
5a2ef6fe57
Align DB updates
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 16:34:49 +00:00
2135352417
Translation Fixes
Correct some fatal errors in the translation files

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:31 +00:00
Koha translators
d5a386db8e
Translation updates for Koha 19.11.00
(cherry picked from commit bc938166712f17d731a1f190628c27593a082419)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:31 +00:00
e493cca4a0
Bug 24130: (RM follow-up) Fix old invalid data
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:23 +00:00
92d3e72da0
Update contributors statistics for release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:33:56 +00:00
8a766c2208
Bug 23042: Correct shib param escaping
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
4e02adb5df
Bug 23042: Only include GET params in return URL for Shibboleth
The shibboleth return target included POST parameters in the URL string,
this meant that a failed local login POST would include the username and
password used in the attemtped login in plaintext in the redirect URL
that is appended to the shibboleth login URL.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
d93f17bfaa
Bug 23042: Add tests to catch POST params in return URL
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
3493cffd54
Bug 23836: exit after output_error
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
863a961dcb
Bug 23836: Don't forward form tracklinks if not tracking
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
bbf7fad55f
Bug 23329: (RM follow-up) Restore DB after test
Test plan:
1) Dump your DB before the tests is run
2) Run the test
3) Dumper your DB again and compare to the first dump
Success if there are no differences (other than the timestamp of the
dump)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
20854939b4
Bug 23329: Fix tests
- www.google.com vs https://www.google.com
- Remove transaction otherwise data are not available from webserver
- Use new C4::Output::output_error to avoid 302 (redirect)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
7fa1cde78e
Bug 23329: Move error page to its own subroutine
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
fde00fefec
Bug 23329: (RM follow-up) Add regression tests
Test plan:

Run the new tests and they should all pass once we've caught all cases

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
eb89795328
Bug 23329: (QA follow-up) Resolve warning on wrong biblionumber
Passing a wrong biblionumber generates a warning:
    GetMarcUrls called on undefined record at opac/tracklinks.pl line 58.

Test plan:
[1] Try it again with a wrong biblionumber and check the logs.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
b2ec43cd8c
Bug 23329: (follow-up) Allow item URI with a biblionumber parameter
If you pass a URI with a biblionumber without specifying the itemnumber,
tracklinks did not redirect an item URI.

Test plan:
[1] Add URI in an item.
[2] Pass this URI with the itemnumber to tracklinks. Should pass.
[3] Pass this URI with the biblionumber to tracklinks. Should pass now too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
608cf1b073
Bug 23329: (follow-up) Use any instead of grep
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
e11b1e6d3c
Bug 23329: Only redirect tracklinks.pl to urls contained in records
Bug 19487 limited redirection to urls contained in a record/item if we were tracking.
We should probably limit forwarding if not tracking as well.
Additionally, if we don't have a soucre, let's not forward

To test:
 0 - Set TrackClicks syspref to 'Don't track'
 1 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 2 - You get forwarded to google
 3 - Set TrackClicks to 'Track anonymously'
 4 - You get a 404
 5 - Apply patch
 6 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 7 - You get a 404
 8 - Set TrackClicks syspref to 'Don't track'
 9 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
     Choose a biblionumber that exists
10 - You get a 404
11 - Add http://www.google.com to the 856$u of the record used above
12 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
13 - You are redirected
14 - Confirm redirection and 404 as expected with other settings of TrackClicks

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Magnus Enger
d20c9ff588
Bug 22543: Prevent "back and refresh attack"
To reproduce and test:
- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl
- Reload the page, you see an error like "Confirm new submission
  of form"
- Reload the page again and confirm the submission of the form
- You are now logged in to the OPAC again!
- Log out again
- Apply this patch
- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click back, you are taken to /cgi-bin/koha/opac-user.pl
- No matter how many times you reload /cgi-bin/koha/opac-user.pl,
  you should not see anything other than the login form.
- Check that Self Check Out still works as it should, by making
  sure you have a user with self_check permissions, then setting
  WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and
  AutoSelfCheckPass appropriately. Then visit
  /cgi-bin/koha/sco/sco-main.pl and verify everything works as
  expected.

The messages and errors pages you see related to resubmitting the
form might differ from the ones described here, depending on what
browser you use. I tested in Chromium 76.0.x.

This fix was originally proposed by LMSCloud:
74a7fe0f0c

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
5a8f202cb2
Bug 23451: Fix other similar wrong filterings
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
9f10889c85
Bug 23451: Prevent XSS vulnerabilities in opac-imageviewer.pl
And certainly in other sripts as it is in opac-bottom.inc

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
df5bf098d3
Bug 23025: Update yarn.lock
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:17 +00:00
78bf5b3ec6
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock
This patch updates the version requirements for modules used by yarn.
Running "yarn upgrade" will upgrade the project's direct dependencies as
listed in package.json. However, the output of "yarn audit" will
identify more vulnerabilities with libraries further down the dependency
tree.

Adding a "resolutions" list in package.json seems to be the way to
include these upgrades in an installation.

After making these changes I ran "yarn install" and "yarn audit" again.
The audit reported no vulnerabilities.

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:17 +00:00
a5339bb41f
Bug 20954: (RM follow-up) Add Sponsor
Sponsored-by: South East Kansas Library System [http://www.sekls.org]
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:17 +00:00
17ee5f7086
Bug 20292: (RM follow-up) Add Sponsor
Sponsored-by: Duchesne County Library [http://uintahlibrary.org/]
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:17 +00:00