members/cancel-charge.pl will take either a POST or a GET, and as long as the
accountline_id it is passed can be cancelled, will cancel it. That means any
link you click anywhere while logged in to Koha might cancel a charge. It also
takes a borrowernumber which isn't used for the cancelling, only to determine
what account to show after a charge is cancelled, letting a malicious link
show an account other than the one whose charge was just cancelled.
Test plan:
1. Without the patch, Circulation - Checkout - search for the 'koha' patron
you log in as
2. Accounting - Create manual invoice - Make it a Manual fee of 100.00 and
Save
3. Pretending it's a well-disguised link in a spear-phishing email, load
http://localhost:8081/cgi-bin/koha/members/cancel-charge.pl?borrowernumber=5&accountlines_id=1
4. You are now looking at charges for the patron Acosta, Edna rather than for
the patron koha, but if you look at the patron koha, its 100.00 charge
has been cancelled.
5. Apply patch and reset_all (or if you don't, you'll have to manually adjust
the link to reflect the charge being accountlines_id 3 rather than 1)
6. Circulation - Checkout - search for the 'koha' patron you log in as
7. Accounting - Create manual invoice - Make it a Manual fee of 100.00 and
Save
8. Click the link http://localhost:8081/cgi-bin/koha/members/cancel-charge.pl?borrowernumber=5&accountlines_id=1
9. You got a 403 because you didn't pass the op cud-cancel, but if you did
pass that op, you would also get a 403 for having a cud- op in a GET (and
if you POST, you won't have a csrf_token)
10. Checkout - search for koha - Accounting - Cancel charge
11. Having done it the right way, you're now on koha's list of transactions,
where you can see you just cancelled it
Sponsored-by: Chetco Community Public Library Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Magnus Enger [Fri, 16 Aug 2024 12:59:20 +0000 (14:59 +0200)]
Bug 33339: (Follow up) Fix more cases of formula=empty
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()
Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Kyle M Hall [Thu, 27 Jul 2023 16:30:54 +0000 (12:30 -0400)]
Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas. Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
David Cook [Mon, 26 Aug 2024 01:22:12 +0000 (01:22 +0000)]
Bug 37724: Remove Koha version number from OPAC
This change removes the Koha version number from the OPAC generator
metadata.
Test plan:
0. Apply patch
1. Enable syspref SelfCheckInModule
2. Visit /cgi-bin/koha/opac-main.pl and confirm meta tag doesn't
include version number
3. Visit /cgi-bin/koha/sci/sci-main.pl and confirm meta tag doesn't
include version number
4. Visit /cgi-bin/koha/sco/sco-main.pl) and confirm meta tag doesn't
include version number
5. Click "Help" and confirm meta tag doesn't include version number
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Artur [Sat, 7 Sep 2024 16:12:05 +0000 (18:12 +0200)]
Bug 37861: Fix XSS vulnerability in barcode append function
When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection.
To test:
Enable the "SelfCheckInModule".
Open the barcode input form.
Enter a barcode with HTML or script tags.
Without the patch, observe that the script is executed.
Apply the patch.
Repeat step 2.
Verify that the input is escaped and no script execution occurs.
Check that the barcode is properly appended to the table.
Documentation:
No updates required.
Sponsored-by: KillerRabbitAos Signed-off-by: Bo Gustavsson <bosse@gustavsson.one> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Jonathan Druart [Wed, 18 Sep 2024 08:40:32 +0000 (10:40 +0200)]
Bug 37953: (bug 35138 follow-up) Fix DisplayLibraryFacets - facet order
Before bug 35138:
DisplayLibraryFacets had priority over the settings in the mappings page.
If you had DisplayLibraryFacets set to "holding library" (only) then only the holding library facet was displayed.
On 231200036 we were not adjusting the facet order/appearance, but the
label, which was wrong. The label must be adjusted for both facets and
the order depending on DisplayLibraryFacets.
Note that bug 37446 is adding a new db rev to adjust the label for
installations that have been updated already.
Test plan:
0. checkout c120975b783 (the commit right before 35138 has been pushed)
1. reset_all
2. holding library is set in DisplayLibraryFacets by default
3. checkout main (so without this patch)
4. updatedatabase
=> ES search result display both facets
5. Repeat 0,1,2 and checkout main + this patch, updatedatabase
=> ES search result display only the holding library facet
Feel free to try with another value in DisplayLibraryFacets
Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 80d4d3a58682a0dcc206822375d4d1afe9969a34) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Tue, 25 Jun 2024 14:56:04 +0000 (14:56 +0000)]
Bug 35125: Respect LinkerConsiderThesaurus in update_cache
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8b691a2b9c512f1ff2e17f471b2afec61f46cbfb) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Mon, 24 Jun 2024 19:53:42 +0000 (19:53 +0000)]
Bug 35125: Respect LinkerConsiderThesaurus in get_link
This patch adds a new key 'notconsidered' to the authority cache when
linking to avoid doubling when creating new authorities and wishing
to ignore thesaurus
To test:
0 - Set LinkerConsiderThesaurus to "don't"
1 - Set AutCreateAuthorities to generate
2 - Set AutLinkBiblios to Do
3 - Set CataloguingModuleRelink to Do
4 - Save a new record in Koha with the same randomized heading repeated
but from 3 different authority sources
ensure source is defined by indicators only and by field $2 once
ensure the heading is random so that no matches will be found
5 - Confirm each authority is linked to a new unique authority
6 - Apply patch, restart all
7 - Repeat 4 with a new subject heading
8 - Confirm all headings are linked to the same authority
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1894fc510138a7f291504c3988d1af0cbc855649) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Pedro Amorim [Wed, 11 Sep 2024 10:40:17 +0000 (10:40 +0000)]
Bug 37891: Submit SMS related data even if SMSSendDriver is empty.
The bug is caused by the SMS data not being submitted as its fieldset is disabled if SMSSendDriver is empty.
This causes the SMS instance of the notice to not be updated when the edit happens, becoming out of sync.
Once it becomes out of sync with the other notices of same code but different transport_type, the 'GROUP BY branchcode,module,code,name,branchname' in letter.pl will fail, as the name no longer matches, listing the same notice twice on the notices table.
This patch updates the logic on the template to have the SMS input elements be disabled/readonly instead of having disabled='disabled' on the SMS fieldset.
This keeps the same functionality i.e. staff member is unable to edit SMS notice if SMSSendDriver is disabled, but ensures that SMS related data is submitted to the controller when the notice edit save happens.
Test plan:
1) Visit notices and slips:
<staff_url>/cgi-bin/koha/tools/letter.pl
2) Search for a notice code e.g. 'ILL_REQUEST_UPDATE'.
3) Notice only one result is returned. Click 'Edit'.
4) Edit the 'Name'. Click 'Save'.
5) Repeat 2. Notice two results are now returned.
6) Apply patch. Repeat test plan. Notice only one result is returned at the end.
Signed-off-by: Jason Robb <jrobb@sekls.org> Amended-by: Jonathan Druart
Align
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Tue, 8 Oct 2024 18:10:46 +0000 (18:10 +0000)]
Bug 38126: Skip allocated holds when filling from transport cost matrix
This patch simply weeds out allocated holds before filling from the matrix
To test:
1 - Enable RealTimeHoldsQueue
2 - Enable UseTransportCostMatrix
3 - Enable LocalHoldsPriority Give/Home/Home
4 - Administration - Transport cost matrix - enable transfers to/from Centreville and other libraries, add a cost, and save
5 - Find a bib with a Centerville item
6 - Place a hold for a centerville patron
7 - Circulation - Holds queue - All libraries
8 - Note hold is entered twice
9 - On command line:
perl misc/cronjobs/holds/build_holds_queue.pl --force
10 - Run holds queue again, still there twice
11 - Apply patch
12 - On command line:
perl misc/cronjobs/holds/build_holds_queue.pl --force
Confirm allocated only once
13 - Delete hold, place again from bib record (to test real time allocation)
14 - Confirm allocated only once
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4ed5e6c248f7a74ad94f5a553f5371bb293e6f7b) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass [Tue, 15 Oct 2024 23:50:00 +0000 (23:50 +0000)]
Bug 38183: Get the active tab number from data-attribute
To test:
1. Have more than 1 staff member who can manage suggestions
2. Create some suggestions
3. Move some suggestions to different statuses (Pending/Accepted/Rejected) so you have multiple tabs on the "Suggestions management" page.
4. Go to the first tab, check some suggestions, and click "Select manager" under "Update manager".
5. Pick a new manager, notice nothing changes on that tab.
6. Now look at the last tab in your list of tabs, see the suggestion manager has been set incorrectly to the last tab.
7. APPLY PATCH
8. Try 4-5 again. The manager should be selected correctly.
9. Try setting the manaager from every tab, making sure it works right.
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2d28aa403a46e7e37fb48135398448f07ff079ac) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Thu, 5 Sep 2024 03:38:27 +0000 (20:38 -0700)]
Bug 37801: Search results with limits create URLs that cause XML errors in RSS and Atom output
The template for RSS and Atom feeds of search results (curiously named
opac-opensearch.tt) is careful to escape ampersands in the query_cgi param
while adding it to URLs, but doesn't escape the limit_cgi param at all. It
should.
Two drive-by fixes for Atom: because the <title> when your search has a limit
includes , which isn't an XML character entity, you couldn't get as far
as the error from the <link> URL, and as long as I was going to have blame for
the line, I couldn't bear to leave the stray undefined SEARCH_RESULT. in the
(hard-coded and bogus) <link rel="last">.
Test plan:
1. In the OPAC, Advanced search - check the boxes to limit by item type Books
and Mixed Materials and search for the keyword Perl
2. At the top of the search results, click the orange RSS icon
3. That gives you an ugly "not well-formed" error, so in the URL for the page
change the final "format=rss" to "format=atom"
4. That gives you an ugly "undefined entity" error, so apply the patch
5. Reload the page with the Atom feed, it should change from an error page
to a garbled display of the feed. Click Back to go back to the RSS feed
and reload it if it's still cached on the error page. That should give
a pretty-printed display of the RSS feed without parsing errors
Sponsored-by: Chetco Community Public Library Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8298e708b9dda5b4bec561eebc94414fd964a141) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Emmi Takkinen [Tue, 22 Aug 2023 10:45:27 +0000 (13:45 +0300)]
Bug 34585: Add data-code attribute to chargeperiod_charge_at selector
When one tries to edit circulation rule "When to charge"
columns value is always set as "End of interval". This patch adds
data-code attribute to chargeperiod_charge_at selector
to define existing rules value.
To reproduce:
1. Navigate to Circulation and fine rules page.
2. Find or create a rule with a "When to charge" value set as
"Start of interval".
3. Edit rule.
=> Note that "When to charge" value is now "End of interval",
while as the other values should be copied as they were.
4. Apply this patch.
5. Edit rule again.
=> "When to charge" should now be copied correctly.
Sponsored-by: Koha-Suomi Oy Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2ca65e0a06bff5b0b1c395874fca431e915c11c1) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard [Thu, 18 Jul 2024 14:58:29 +0000 (14:58 +0000)]
Bug 37270: (follow-up) Fix mixed quotes in preview modal JS
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1d6f3c4cbe92230c582e50f34c2be30b77fe5409) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard [Tue, 9 Jul 2024 13:13:34 +0000 (13:13 +0000)]
Bug 37270: Fix deletion of saved reports
This patch fixes deletion of saved reports in two instances which
were broken by the CSRF changes: From the dropdown menu in the table of
saved reports, and in the modal window which appears if you click the
"Preview" dropdown menu in the table of saved reports.
The patch also makes a minor change to form-submit.js so that the event
handler will attach to dynamically-generated elements (as is the case
with the preview modal).
To test, apply the patch and go to Reports -> Use saved.
- Add one or more reports if necessary.
- In the table of reports, click the secondary dropdown link in the
"Run" button.
- Click "Delete." You should be asked to confirm, and confirming should
correctly delete the report.
- Now test the "Preview SQL" link in the menu.
- A modal window should appear showing you the SQL of the report.
- In the footer of the modal, test the "Delete" button.
Sponsored-by: Athens County Public Libraries Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 44d0703b4a9a9ab116b4d473c2805e3fb283c2a2) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Wed, 2 Oct 2024 02:01:39 +0000 (19:01 -0700)]
Bug 38056: Search term after deleting an authority shouldn't be URI encoded
Now that deleting an authority record uses a form, rather than building up a
URL in JavaScript, using the filter | uri on the value (confusingly named
value) which passes along the search terms to reload after deleting results
in a bad search. It should instead use the filter | html.
Test plan:
1. Without the patch, top menu - Authorities
2. The default search, Main heading ($a only), Authority type Default,
Operator contains, Order by Heading A-Z will work fine. You need to a
search which will return more than one of the same thing (not hard in
ktd) - for MARC21 search for a professional
3. You should get five results. For one of them, Actions - Delete - Confirm
that you meant to click it
4. You now have a%20professional in the search box, and search results for
whatever ElasticSearch thinks a% means. It's certainly not professional -
you can change that term to any random string and get the same results
5. Apply patch, top menu - Authorities
6. Repeat steps 2 and 3, but this time after deleting another result,
you will get a professional without the %20 in the search box, and
your results will be the remaining Addison-Wesley professional computing
series authorities
Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6eb4d5804b006f16f6876dcfd9b4b6b036bba10d) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass [Thu, 17 Oct 2024 23:45:06 +0000 (23:45 +0000)]
Bug 38199: [24.05.x] Add back missing print class
To test:
1. Find an item to checkout that doesn't belong to the branch you are logged in at.
2. Check the item out.
3. Go to Circulation > Check in
4. Using the check in input in the main area ("Check in"), check the item in
5. A modal should appear, "Please return this item to {branch}"
6. Click "Print slip"
7. Deal with the browsers print dialouge. ( print, cancel, or save should work for testing)
8. After the modal closes focus is not brought back to the barcode field.
9. Check the item in again, this should trigger the "Wrong transfer detected, please return item to: {branch}" modal.
10. Click "Print transfer slip", here the modal closes and properly gives focus to the #barcode input.
11. APPLY PATCH, clear browser cache.
12. Try all the steps again, each time focus should be restored to the #barcode input
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
0. Apply the 1st patch (the revert)
1. Go to `misc/translator/po`
2. es-ES-messages-js.po
3. Mark "Edit" string as fuzzy (around line 48). It should look like:
```
msgid "Edit"
msgstr "Editar"
```
4. Edit ./intranet-main.tt and add the following lines at the bottom,
inside the `$(document).ready` block:
5. Install the templates
k$ koha-translate --install es-ES --dev kohadev && restart_all
6. Enable *es-ES* by searching for `language` in the sysprefs and switch
to it for the staff interface.
7. Go to the Koha home page, open the browser console
=> FAIL: Notice that the second log in the console is displaying the
fuzzy string (i.e. is being translated when it shouldn't)
8. Apply this patch
9. Re-install the translated templates:
k$ koha-translate --update es-ES --dev kohadev && restart_all
10. Repeat 7
=> SUCCESS: With this patch applied both logs show the English version of the
string.
11. Remove the fuzzy flag on `es-ES-messages-js.po`
12. Repeat 9 and 10
=> SUCCESS: The results are similar to step 7, but in this case they are
expected as the string is not marked fuzzy.
13. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5102f708a53861d6c4e4663e0a7d28f55cedeaf3) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b285fd57c8c9e9c53d0945aae6fe54f3ac9f82ed) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Mon, 21 Oct 2024 09:51:45 +0000 (11:51 +0200)]
Bug 38211: frameworkcode must be set before read
It's a stupid global variable, we MUST have this init line BEFORE we
read it!
Test plan:
See the other bugs linked with this one, confirm the test plan for all
of them still pass.
Test plan for this specific bug report:
1. Cataloging - New record -> Audio Cassettes, CDs
2. Fill in the required fields and save
3. Switch to 'Normal', Edit - Edit record
4. Note that 001 and 003 are not visible, and the Settings menu has a checkmark by Audio Cassettes, CDs
5. Click the browser Back button, then Edit - Edit record
6. Note that 001 and 003 are not visible, and the Settings menu has a checkmark by Audio Cassettes, CDs
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e44927842b545dab62dccca79a3dcd75f4205591) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 51055d892bbe767b669be8719a85aa2bff28d11d) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Kyle M Hall [Fri, 4 Oct 2024 14:10:13 +0000 (10:10 -0400)]
Bug 38094: Allow librarians with fast add permissions to edit existing fast add records
The ability to create fast add records was fixed on bug 38076, but they still cannot be edited after they are saved.
Test Plan:
1) Create a librarian with only fast add cataloging permissions
2) Create a fast add record, save it
3) Attempt to edit that record, you cannot!
4) Apply this patch
5) Restart all the things!
6) Attempt to edit that record, you can!
7) Attempt to edit a non-FA record, you cannot!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 664cbb5bc5d5173a517a6d2206d62665a8b22792) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4623dce6f761138d456e564c2bd579c8c329cb07) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Kyle M Hall [Fri, 4 Oct 2024 14:56:44 +0000 (10:56 -0400)]
Bug 38076: (QA follow-up): Make permission edit_catalogue imply fast_cataloging
Any librarian with the edit_catalogue sub-permission should also be able
to edit fast catalog records. If that was not true, a cataloger could
not convert fast adds into full records.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 20c38762b8cf6ec16ddaaede54846468c63ef4e8) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Kyle M Hall [Thu, 3 Oct 2024 14:09:18 +0000 (14:09 +0000)]
Bug 38076: Fix inability of fast catalogers to add/edit FA framework records
If a librarian does not have the editcatalogue permission, but does have the fast_cataloging permission, they should be able to add and edit fast cataloging records. Instead they are presented with a login screen and the message that they do not have sufficient permissions.
Test Plan:
1) Create a librarian with only fast add cataloging permissions
2) Attempt to create a fast cat item from the circ menu
3) Note the login screen and error
4) Apply this patch
5) Restart all the things!
6) Try again, you can now create FA records!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5b124f7a1eededdeb4c4f3d914453f042e6b060b) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Tue, 22 Oct 2024 20:06:01 +0000 (20:06 +0000)]
Bug 38148: (QA follow-up) Code comments
Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 38e33074b6f8431f363e17fdd792cbaae721c41f) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Pedro Amorim [Tue, 22 Oct 2024 10:48:14 +0000 (10:48 +0000)]
Bug 38148: Revert back to get_effective_rule
And update the first conditional logic.
This patch aims to maintain the logic behind the first patch, but restore get_effective_rule.
get_effective_rule_value is using cache and I believe that is the reason why Items.t fail when using that.
Test plan:
1) Search for 'music' on OPAC
2) Notice records have the 'place hold' link
3) Visit circulation rules on Staff:
<staff_url>/cgi-bin/koha/admin/smart-rules.pl
4) On 'Default checkout, hold and return policy' , under 'Hold policy' pick 'From any library'. Hit 'Save'.
5) Repeat 1). Notice the 'place hold' link is gone.
6) Apply patch. restart plack. Repeat 1). Notice the 'place hold' is shown again
Run:
$ prove t/db_dependent/Koha/Items.t
Signed-off-by: andrewa <andrew.auld@ptfs-europe.com> Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c7c24aa8d3e856a21e50075f743a5abc39fa5797) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Aleisha Amohia [Fri, 11 Oct 2024 01:53:11 +0000 (01:53 +0000)]
Bug 38148: Check value of holdallowed circ rule properly
It was noted on Bug 29087 that the value of circulation rules needs to be checked differently, so this follow-up addresses that.
To test:
1. Apply patch and restart services
2. Search for a record on the OPAC. Confirm you can see a link to place a hold.
3. Search for this record on the staff interface and place a hold. Go to Circulation -> Holds to pull and confirm your hold shows in the list.
4. Confirm tests still pass t/db_dependent/Koha/Holds.t
Sponsored-by: Whanganui District Council Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: andrewa <andrew.auld@ptfs-europe.com> Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e2be4e00a5bf0920786339f5f47997508be93c4d) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Tue, 22 Oct 2024 19:54:42 +0000 (19:54 +0000)]
Bug 38148: Unit tests
Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 76352200cac7736bb905b809cea5640b83576b53) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard [Mon, 24 Jun 2024 14:46:36 +0000 (14:46 +0000)]
Bug 37150: Can't delete single title from a list using the "Remove from list" link
In the OPAC display of titles on a list, the "Remove from list" control
needs to trigger a POST operation instead of GET. This patch
appends a form for handling single entry deletions, populating
the hidden input upon confirmation.
To test, apply the patch and create a list if necessary, adding multiple
titles to it.
- View the contents of your list.
- Each title on your list should have a "Remove from this list" link.
- Click one of these. You should see a modal confirmation, "Are you
sure you want to remove this item from the list?"
- Confirming should delete the title form the list.
- Check multiple checkboxes in the list of titles and click "Remove
from list" at the top of the list.
- You should see a modal confirmation, "Are you sure you want to
remove these items from the list?"
- Confirming should result in all checked titles being removed
from the list.
- Check one or more checkboxes and then click a single "Remove from
list" link. After confirming, you should find that only the one
title was removed from the list.
Sponsored-by: Athens County Public Libraries Signed-off-by: Eric Garcia <cubingguy714@gmail.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ace488e50f67dfa0986c3dba3e9b85c911539ac1) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Thu, 27 Jun 2024 03:19:21 +0000 (20:19 -0700)]
Bug 37197: Reports option to send to batch patron modification needs to use POST
When you have an SQL report that selects cardnumber from borrowers, you
get a menuitem to send the results to Batch patron modification. Currently
that fails with a message about no card numbers or borrowernumbers given,
because it tries to do a GET with the op show, when modborrowers.pl is
expecting a POST with the op cud-show.
Test plan:
1. Without the patch, Reports - Create from SQL - name it and paste
select cardnumber from borrowers
in the SQL textarea and save, then Run report.
2. Above the results is a "Batch operations with 20 visible records" menu,
choose Batch patron modification
3. Note that instead of modifying the records, you're stuck with a message
saying "No patron card numbers or borrowernumbers given." even though
there's a whole string of them in the URL.
4. Apply patch, refresh the page with the results (oddly, no apparent need
to even restart_all), and choose the menuitem again, but this time with
a successful result.
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a85086d8278b3c0b5ad578c3af7b0e70637a47be) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 32530: When duplicating child card, guarantor is not saved
When duplicating a child card with a guarantor, the guarantor information
appears during the card creation process, but disappears as soon as saving
the card. To recreate:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
New test plan:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
Apply patch and repeat, the guarantor should stay after 3.
Note, I may not have understood the code but it looks like nothing is
searching for the content of the displayed information. Therefore I add
hidden fields that are copies of those provided in guarantor_template
class
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b64a3ce9ba376f7b0a5a2e5714f1147afd012ade) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Fri, 12 Jul 2024 14:00:49 +0000 (14:00 +0000)]
Bug 37339: Set messaging preferences from default on self registration
The change on bug 30318 prevented setting the default messaging preferences when none were passed.
Self registration relied on this for setting borrower preferences from the defaults.
This patch removes the call to handle_form_action and replaces it with a call to:
SetMessagingPreferencesFromDefault
To test:
1 - Ensure self registration is enabled
2 - Set default messaging preferences for the self registration category
3 - Self register a patron from the OPAC, confirm defaults not set
4 - Apply patch, restart all
5 - Self register a patron
6 - Confirm defaults have been set
7 - Enable PatronSelfRegistrationVerifyByEmail
8 - Self register a patron on OPAC with an email
9 - Find the email and grab the verification link (unless you have emails enabled)
SELECT * FROM message_queue;
10 - Visit the link and confirm registration
11 - Confirm messaging defaults are set
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2accac5fd9a210c9aa0107c47522c7393b257c8c) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Add circulation rules for a specific library
2) Attempt to remove one of those library specific rules -> get redirected to 'All'
3) Notice the rule for that specific branch is still there
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com> Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 72fd2c580d3bb9e2dce62cff602d93bab401eb4b) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Thu, 19 Sep 2024 04:01:56 +0000 (21:01 -0700)]
Bug 37961: Inventory problem resolution fails by POSTing without an op or csrf_token
After you upload a file or textarea of barcodes to inventory, the next step is
a list of the things that were missing, with checkboxes to check when you find
them, and buttons to Mark seen, which send a POST to
/cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't
have an $op) and without a csrf_token, so the POST fails with a 403.
Test plan:
1. Without the patch, Cataloging - Inventory - in Item location filters
set Library to Centerville, Shelving location to Audio visual, Collection
code to Reference, and in Optional filters for inventory list or comparing
barcodes set Last inventory date to today.
2. Click Submit, and you'll have a table of 23 items. Check the checkbox for
the first item, click Mark seen and continue
3. What was supposed to happen was that you would be taken to the next
page, but instead you are still in the same page, and if you had the
browser console open, you would have seen that you sent a POST to
ajax-inventory.pl, and got a 403 error in response
4. Apply patch, restart_all
5. Repeat step 1 and 2, this time getting to the second page. Check the
checkboxes for the last two items, and click Mark seen and quit
6. Repeat step 1 and click Submit. You should now have only 20 items, since
the three you checked now have a Last inventory date of today.
Yeah, when you did Mark seen and continue they ought to have been removed from
the list, I agree. I had to go back to 23.11.x and make sure that was really
how it was supposed to function, but that is the existing behavior. Even
though they get marked as seen, nothing changes about your list until you quit
and go back to it. Maybe because then something that wasn't on the current
page would have moved there. Another bug.
Sponsored-by: Chetco Community Public Library Signed-off-by: Sonia Bouis <sonia.bouis@univ-lyon3.fr> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 801fa43c7cecd8e310f77a51e03ebeec3677015e) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 37536: Update conditional to check for 'cud-saveitem'
In additem.pl and additem.tt all instances of 'saveitem' have been updated to 'cud-saveitem'
The javascript needs to be updated in the same way.
Test plan:
- Make sure acqcreateitem is set to "when placing an order"
- Create a basket with some orders
- Close the basket
- Go to your vendor and receive an order
- On the receive page, try to edit your item
=> Without the patch, the pop up page will open and then close, not allowing the item to be edited.
=> With this patch applied you will see the item edit form. Save and
confirm that the parent window is updated with the new value (actually
it's refreshed)
QA notes:
1. git grep 'saveitem'
2. Notice all instances in additem.pl and additem.tt have been updated to 'cud-saveitem'
3. Notice cataloging_additem.js checks if op != 'saveitem'
4. Check the files and verify the change makes sense
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e6b2b342d2ee06bdac05d829a96dc942a2534ebc) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you click on a cell in the Item circulation alerts table, the page sends
a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
csrf_token, which gets back a 403 error because that's sketchy behavior. It
needs to include the token.
Test plan:
1. Administration - Item circulation alerts
2. Open the browser devtools to the console
3. Click on any green table cell
4. It should have turned red, but instead your console turned red with a 403
5. Apply patch, reload
6. Click on any green table cell, it will turn red
Sponsored-by: Chetco Community Public Library
https://bugs.koha-community.org/show_bug.cgi?id=37959 Signed-off-by: Jan Kissig <jkissig@th-wildau.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Thu, 19 Sep 2024 07:13:21 +0000 (09:13 +0200)]
Bug 37947: (bug 37429 follow-up) Fix addbiblio and frameworkcode="Default"
On bug 37429 we reordered the global var to assign them before anything
else. The logic is correct except for $frameworkcode, we want to do some
processings (like defaulting to "" if eq "Default") BEFORE we retrieve
the MARC structure ($tagslib, $usedTagsLib).
This patch also moved this code after get_template_and_user (and so
authentication), like it should be everywhere.
Test plan:
1. Go to Cataloging
2. Click on New from Z39.50/SRU
3. Make a search in the library of congress server for anything (Caroline searched for author: shakespeare)
4. Click on one of the results and choose Import
Without this patch the basic editor appears, but not the record
With this patch applied the bug is fixed and you can edit the record
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit dffc8cdd2ca85ac919fa8ca3fef3361d1116317c) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Tue, 31 Oct 2023 08:00:11 +0000 (09:00 +0100)]
Bug 35191: Make entries per page configurable for items table on staff detail page
The new API driven items view defaults to 20 per page. This is a bit low, it would be great if it could be configurable to a higher value per the table configuration.
Test plan:
1. Apply this patch
2. restart_all (memcached restart is required)
3. Go to Administration > Table settings
4. Catalogue > holdings_table | otherholdings_table
=> Notice the new "Default display length"
5. Select something else than 20
6. Go to the detail page of a record with lot of records
=> Notice that the default value defined in the settings is used.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8e211a1fefa13e54ea01f38fdfe972f1cd603fc7) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Fri, 14 Jun 2024 18:02:02 +0000 (18:02 +0000)]
Bug 37055: Check count of holds, not if defined
To test:
- enable WaitingNotifyAtCheckout
- have or create a waiting hold for a patron
- check out an item to a different patron who does not have a waiting hold
- Koha says "This patron has waiting holds that are available for checkout"
- Apply patch
- Reload patron (click 'Checkout' tab)
- Check out an item - no warning
- Find the patron with waiting hold
- Check out an item - warning
- Checkout the waiting item - no warning
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b5f122696cc40aee33830cdf7ab1da20fa4e7b66) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 37375: Fix holdings table not loading if MARC framework is missing certain 952 subfields
When you've catalogued a record with MARC framework that is for some reason missing
certain 952 subfields (8, a, b, c, or y), holdings table is no longer loading but
stuck in the "Processing..." loader.
To test, open Koha in two browser tabs:
IN TAB 1 (framework configuration):
1. Create a new MARC framework "TEST", based on the default MARC framework
IN TAB 2 (record view):
2. Create a new record using MARC framework "TEST"
3. Add an item to the newly created record
4. Observe item visible on the record's holdings list
IN TAB 1 (framework configuration):
5. Delete all 952 subfields in framework "TEST" except: 8, a, b, c, y
IN TAB 2 (record view):
6. Refresh page
7. Observe item visible on the record's holdings list
8. Open your browser's console for upcoming error messages
IN TAB 1 (framework configuration):
9. Delete subfield <FIELD> in framework "TEST"
IN TAB 2 (record view):
10. Refresh page
11. Observe error "Uncaught TypeError: <NAME> is undefined" (Firefox)
(or Cannot read properties of undefined (reading 'str') (Chromium))
12. Apply patch
IN TAB 2:
13. Refresh page
14. Observe item visible on the record's holdings list
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c93ed758f95af0d5e06d3125ae3c6f19f937a6a) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6bcc82815d727ee0d6faa94aa42a86909e5d9a57) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Emily Lamancusa [Tue, 6 Aug 2024 20:12:51 +0000 (16:12 -0400)]
Bug 37587: Fix priority of multiple item-level holds
The rank parameter is passed per biblio record, not per item. When
placing multiple item-level holds on one bib record, only $rank[0] is
defined.
To test:
1. System preference and circulation rule setup
i. Set the system preference DisplayMultiItemHolds to Enable
ii. Edit the default circulation rule to allow 5 holds per record
2. Find or create a bib with 4 or more items
3. Place several bib-level holds
4. Place 4 or more item-level holds at once on that same record
i. Search for a patron to place the holds for (not one of the
patrons you used in step 3)
ii. Select "Hold a specific item"
iii. Check the checkboxes for 4 or more items
iv. Click Place hold
--> Note that one of the new item-level holds is at the end of the list
as it should be, but the rest are out of order
5. Cancel the item-level holds from step 4
6. Apply patch and restart_all
7. Repeat step 4
--> All the new item-level holds are now at the end of the list
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e1517fc8c8d7c70a5d20004dc7c8c260c1183828) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Tue, 17 Sep 2024 12:14:23 +0000 (12:14 +0000)]
Bug 37483: Use cud-list for extend due dates tool
This patch switch the check in the script to 'cud-list' - we use the same form
submission if listing for preview or directly updating dates, so this may or may
not be a cud- action - assuming it is restores script functionality.
See bug 37941 for updating forms to not share actions
To test:
1 - Checkout some items to patrons of at least two libraries
2 - Tools -> Batch extend due dates
3 - Select nothing except 'preview' and submit
4 - Blank screen
5 - Apply patch, repeat
6 - It works!
7 - Filter by library and confirm it still works
8 - Sign off!
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2e396f08da6ebcaa23af0e9db29c68543cabfe5) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Wed, 28 Aug 2024 10:18:06 +0000 (12:18 +0200)]
Bug 37720: Prevent XSS in label creator
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Wed, 28 Aug 2024 10:18:06 +0000 (12:18 +0200)]
Bug 37720: Prevent XSS in label creator
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Thu, 15 Aug 2024 22:41:18 +0000 (15:41 -0700)]
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading
We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.
Test plan:
1. Without the patch, search for any record in the catalog and click Edit
record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
should display in italics, and the "(Record number nnn)" after it should
not be italicized.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Phil Ringnalda [Fri, 16 Aug 2024 04:22:12 +0000 (21:22 -0700)]
Bug 37656: XSS in Advanced editor from Z39.50 search results
The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.
Test plan:
1. Not a dependency, but you'll avoid getting even more alerts while batch
importing by starting with the patch from bug 37654
2. Without this patch applied, download attachment 170421
3. Administration - set the preference EnableAdvancedCatalogingEditor to
Enable
4. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - Stage for import
5. Once the background job finishes, View batch (getting alerts if you
didn't apply the patch from bug 37654) - Import this batch into the
catalog
6. When the import finishes, Search the catalog for script, on the imported
record Edit record (if you wind up in the basic editor, Settings - Switch
to Advanced editor)
7. In the left sidebar below the search inputs, click Advanced », check
the checkbox for Local catalog and uncheck any others, then search for
the Title script
8. You'll get five alerts, and the word "edition" displayed in huge text
9. Close the search popup, apply patch, shift+reload the advanced editor
page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
the title and the other <script> inclusions.
Sponsored-by: Chetco Community Public Library Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Fri, 16 Aug 2024 02:57:42 +0000 (19:57 -0700)]
Bug 37654: XSS in Batch record import for Citation column
Viewing a staged MARC record batch loads a DataTable from
/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the
DataTable just trust the author/title/isbn/issn to be free of HTML. They
shouldn't.
Test plan:
1. Without this patch applied, download attachment 170418, then Cataloging
- Stage records for import - Select the downloaded file - Upload file -
Stage for import
2. When the background job completes, View batch - you'll get three alert()s
from the title, author, and ISSN, and the author and ISSN displayed huge
3. Apply patch, restart_all
4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero
alerts and no <h2> display
Sponsored-by: Chetco Community Public Library Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
David Cook [Tue, 20 Aug 2024 00:54:38 +0000 (00:54 +0000)]
Bug 37681: Fix XSS in staff interface item URLs on detail page
This patch uses Javascript objects and safe sinks to prevent XSS
in the item URLs on the staff interface detail page.
It also makes sure those URLs don't get double-escaped. Yippee!
Test plan:
0. Apply the patch
1. Add/edit an item with the following URL:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
2. Add/edit a different item with the following URLs:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au |
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
3. Go to the staff interface detail page
4. Notice that the URLs are not double-encoded!
5. Try out a malicious payload (talk to QA/security about this)
6. Confirm that the malicious payload fails to execute the XSS
7. Celebrate!
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 13342: Not logged user can place a review/comment
We are able to comment a notice even when no user is connected
To test
1. Log in to OPAC.
2. Find a Biblio and open the comments tab.
3. Open another tab/window, and log out from the account.
4. Return to the first tab.
5. Click "Post your comments on this title."
--> We are able to post a comment
6. Apply the patch
7. Repeat step 1, 2, 3, 4, 5
--> You should be redirected to the login page.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Bug 13342: Tidy
Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Tue, 14 May 2024 07:34:31 +0000 (09:34 +0200)]
Bug 36598: Add comments asking to keep both CSRF checks in sync
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Tue, 14 May 2024 07:15:50 +0000 (09:15 +0200)]
Bug 36598: Prevent use of unsafe HTTP method with non-cud op parameter
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Mon, 13 May 2024 13:06:04 +0000 (15:06 +0200)]
Bug 36598: Improve documentation and error message in CSRF plugin
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Fri, 3 May 2024 07:17:37 +0000 (09:17 +0200)]
Bug 36598: Fix CSRF header name (underscore -> hyphen)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Mon, 15 Apr 2024 07:08:48 +0000 (09:08 +0200)]
Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Fri, 12 Apr 2024 13:08:17 +0000 (15:08 +0200)]
Bug 36598: Enable CSRF protection for Mojolicious apps
Test plan:
1. Run bin/opac daemon -l http://*:3001/
2. Go to http://localhost:3001/cgi-bin/koha/opac-user.pl
3. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
4. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
5. Reload the page, try to log in normally without modifying the DOM, it
should succeed
6. Run bin/intranet daemon -l http://*:3002/
7. Go to http://localhost:3002/cgi-bin/koha/mainpage.pl
8. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
9. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
10. Reload the page, try to log in normally without modifying the DOM,
it should succeed
11. Run prove t/db_dependent/mojo/csrf.t
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Fri, 30 Aug 2024 12:47:07 +0000 (12:47 +0000)]
Bug 37775: Remove delayed commits from update_totalissues.pl and add progress option
This patch removes setting AutoCommit to 0 and commiting only every X records.
Instead we commit as we go and report progress using a parameter.
Bug 36474 reduced the numebr of changes that are being committed, so this should be a reasonable change. The
use of commits without transactions was causing problems if the library was active while the script ran.
To test:
1 - perl misc/cronjobs/update_totalissues.pl -c
2 - Script runs, but with unknown parameter
3 - perl misc/cronjobs/update_totalissues.pl -p 10
4 - Script runs and reports every 10 records
5 - per; misc/cronjobs/update_totalissues.pl
6 - Script runs and reports every 100 records by default
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit dba9dd405339691a8671c243518f16cb20f4777f) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Mon, 1 Apr 2024 15:00:34 +0000 (15:00 +0000)]
Bug 36474: Don't update records when total issues has not changed
This patch adds a new check in UpdateTotalIssues to check that we are changing the number
of total issues before calling ModBiblio
To test:
0 - Enable CataloguingLog
1 - Checkout an item
2 - Run : misc/cronjobs/update_totalissues.pl --use-stats --commit=1000 -v
3 - In report, note all biblios were updated
4 - Check action_logs - note a new entry for every biblio
5 - Apply patch
6 - Repeat
7 - Note no biblios reported updated
8 - Note no new cataloguing log entries
9 - Checkout the item again
10 - Run again
11 - Note biblionumber has updated count in verbose output
12 - Note report only rpeort 1 biblio modified, the rest only processed
13 - Only one line added to action_logs
14 - Run it again
15 - Confirm no updates
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d7b36d7f692420a5b67dee88ce78529ce7509413) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens [Wed, 28 Aug 2024 13:28:35 +0000 (13:28 +0000)]
Bug 36474: Unit tests
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1c875b01572d81c8f1fedd73e4399d0535f44f97) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
CJ Lynce [Tue, 10 Sep 2024 18:12:04 +0000 (18:12 +0000)]
Bug 37873: [24.05.x] Unable to delete user from routing list or preview/print routing list slip
This patch restores the ability to delete a recipient from a serials routing list.
It also fixes the slip preview when using the "Save and preview slip", and removes
the koha staff intranet head from the slip when using 'Print list' from the
Serial collection information screen.
To test:
1) Login to the staff client.
2) Open the Serials module.
3) + New subscription to add a new serial.
4) Create a new subscription.
a) Search for a record (I searched for 'dog') and chose that record.
b) Under 'When receiving this serial', select 'Create an item record'
c) Under the 'Item type' dropdown, select anything.
d) Click Next -> (and confirm the popup).
e) Select any 'First issue date'.
f) Select any 'Frequency'.
g) Enter a number larger than 5 in the 'Subscription length'.
h) Select any 'Subscription start date'.
i) Select your favorite numbering pattern.
j) Verify your prediction pattern using "Test prediction pattern".
k) Click "Save subscription".
5) On the 'Subscription details' screen, click "Receive".
6) Under the first volume, click "Add item" then "Save".
7) Repeat step 6 to receive one more issue.
8) On the 'Serial collection information' page click "+ Create routing list"
9) Click "+ Add recipients".
10) Search for and add several recipients.
11) Click "Close" to exit the 'Add recipients' page.
12) Click "Delete" next to any recipient.
*Note that the recipient is not deleted.
13) Click "Save" on the 'Modify routing list for ...' page.
14) Click "Save and preview routing slip" button.
*Note you are redirected to the Subscription details page, but no routing
slip preview appears.
15) Click "Serial collection" from the left-side menu.
16) Click "Print list" on either of the issues you previously received.
*Note the routing slip includes the staff intranet header, menu, etc.
17) Apply patch.
18) Return to the 'Serial collection information' screen for your subscription.
19) Click "Edit routing list".
20) Repeat steps 12-16 and verify the issues are fixed.
-"Delete" button works to remove a recipient from a list.
-"Save and preview routing list" button pops-up a preview before redirecting.
-"Print list" pops-up a vanilla routing list to print.
Sponsored-by: Westlake Porter Public Library Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Julian Maurice [Fri, 6 Sep 2024 09:02:30 +0000 (11:02 +0200)]
Bug 37763: (QA follow-up): Tidy
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0e359a5981f672aa49f5c44ef5e28e4281547347) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
CJ Lynce [Wed, 28 Aug 2024 18:45:24 +0000 (18:45 +0000)]
Bug 37763: Do not show SQL report editor after 'Update and run'
This patch corrects an error where the SQL editor screen would appear
after the report results when using 'Update and run SQL' when editing
reports.
This also corrects a related issue where the saved_sql.id of the report
would be repeatedly appended to SQL code when using 'Update and run
SQL'.
To test:
1) Login to staff client
2) Navigate to Reports -> Create from SQL
3) Create a short report (SELECT * FROM items), name it and SAVE it.
4) On the resulting "Edit SQL report' page, click 'Update and run SQL'
5) See the report runs, but at the 'Edit SQL report' screen shows at the
bottom.
6) Apply Patch
7) Return to Reports -> Saved Reports and Edit the report you created.
8) On "Edit SQL report' page, click 'Update and run SQL'
9) Verify that the report runs, but the 'Edit SQL report' section is
gone.
Sponsored-by: Westlake Porter Public Library Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bd79cbd858cb91a2e696a37922438d74e9c4a4e2) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard [Tue, 9 Jul 2024 18:40:33 +0000 (18:40 +0000)]
Bug 36276: Fix editing of identity provider and domains
This patch fixes identity_providers.pl to remove the "cud-" prefix for
two operations which are not POSTed: editing identity providers and
editing domains.
To test, apply the patch and restart services.
- Go to Administration -> Identity providers.
- If necessary, create an identity provider and then click "Manage
domains" -> New identity provider domain to create a new domain.
- From the list of domains, click "Edit"
- The edit form should appear with all the correct details prefilled.
- Check that the page title, breadcrumbs, and page header all show the
correct domain.
- Make a change to the domain and confirm that the changes are saved.
- From the list of identity providers, click "Edit"
- This form should also load correctly.
- Submitted changes should be saved correctly.
Sponsored-by: Athens County Public Libraries Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 32578e4f724d56ebb8905f6523b665026eea8e7a) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass [Mon, 26 Aug 2024 20:11:48 +0000 (20:11 +0000)]
Bug 37551: (24.05.x) Only delete price when there is already an itemprice
To test:
1. Have a mrc file with some different prices. In my case I am using the mrc file attached here with different price values in the 975$p and 975$a
2. Set the MarcFieldsToOrder to "price: 975$p" and MarcItemFieldsToOrder to "price: 975$a"
3. In Acquisitions create a new basket > add to basket > from a new file
4. The value from MarcFieldsToOrder (975$p) is always set as the price when it should be the value from MarcItemFieldsToOrder (975$a)
5. APPLY PATCH, restart_all
6. Try steps 1 - 3 again, this time item price should be correctly handled.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Pedro Amorim [Thu, 1 Aug 2024 11:59:58 +0000 (11:59 +0000)]
Bug 37413: Ensure itemnumber is sent
Fix condition to ensure the itemnumber is sent
Signed-off-by: Sam Lau <samalau@gmail.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 99c5e3bae40122bd8e8721aa186292388db9a7d6) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Brendan Lawlor [Wed, 21 Aug 2024 15:52:24 +0000 (15:52 +0000)]
Bug 37542: Fix patron search when dateofbirth is a DefaultPatronSearchField
This patch updates the call to dayjs to use strict parsing for patron search. See https://day.js.org/docs/en/parse/string-format
To test:
1. Create a patron with dateofbirth 1994-07-27
2. Add dateofbirth to DefaultPatronSearchFields
3. In patron or checkout search, type a cardnumber like '2908800092528'
4. Note the patron with that birth date is found in autocomplete
5. Apply patch and restart_all
6. Repeat step 3 and notice the patron is no longer found
7. In patron or checkout search, try searches using a formatted date
8. Confirm searches for '07/27/1994' and '1994-07-27' find the patron
Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 764162cd6dc7c74a7028128d3d94ebc0eb5e90b0) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Thu, 11 Jul 2024 14:37:19 +0000 (16:37 +0200)]
Bug 31921: Include the modal code from acquisitions-toolbar.inc
Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8619598d3b9b9b1db68d9f39d2cd84df8fbb0ea8) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Sam Lau [Tue, 9 Jul 2024 15:20:57 +0000 (15:20 +0000)]
Bug 31921: Add confirmation modal when deleting a vendor
This patch adds a new modal for confirming vendor deletion. It fixes
the previous functionality, showing a confirmation modal for each
vendor and appropriately handling the response.
To test:
1) Visit Acquisitions home. Under where it says 'Manage orders', click
the search bar to bring up the list of vendors.
2) Add a few vendors by clicking 'New' and 'Vendor'. After this, go back
to the vendor search so that all the vendors are showing.
3) For each vendor, click on 'Delete vendor' and ensure the modal shows
properly.
4) Attempt to delete one of the vendors. Go back to the vendor search
and ensure they are deleted correctly.
5) Click on a vendor's name to go their supplier page. Make sure modal
works properly and attempt to delete a vendor from here.
Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 81af57344d5efa19eae68acbf110df09b02dcfa2) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
CJ Lynce [Sun, 4 Aug 2024 20:33:51 +0000 (20:33 +0000)]
Bug 37563: Refund, payout, and discount modals in borrower transactions and Point of Sale have broken/bad formatting of values
This patch corrects formatting of amounts in both the POS and member
accounting module Payment, Discount, and Payout modals.
It also corrects an issue where amounts of a previous modal show up
when clicking on the same modal for a different accountline
the member Accounting page.
Finally, it corrects an issue with the member Accounting Discount
modal in that an amount without both decimal places will not
display.
Steps to test:
1) Login to staff client
2) Enable the 'EnablePointOfSale' system preference
3) Enable the 'UseCashRegisters' system preference
4) Open POS module and configure a cash register
5) In the POS module -> 'Configure items for purchase', create some
items with different costs (divisible by .10, e.g 25 or 1.10, etc.))
6) Use the POS module to make a few transactions
7) Open POS -> 'Cash Summary for [BRANCH]', and open your configured
register
8) Click 'Issue Refund' and check the formatting of the paid and
returned to patron numbers
*** Issue A) See that numbers are not formatted with two decimal places
9) Pull up the 'Accounting' tab for a borrower
10) Create at least 3 invoices for different amounts (divisible by .10,
e.g 25 or 1.10, etc.)
11) Pay TWO of your invoices then open the 'Transactions' tab
12) Create a manual credit for an amount (divisible by .10, e.g 25 or
1.10, etc.)
13) Click the 'Apply discount' button on one of your invoices
*** Issue B) No 'Amount charged' appears
14) Click 'Issue refund' for one of the paid invoices.
*** Issue C) The 'Return to Patron' line does not have 2 decimal places
15) Click 'Issue refund' for another paid invoice
*** Issue D) The 'Amount Paid' shows the amount from the first modal
16) Click 'Apply discount' for one of the unpaid invoices
*** Issue E) The 'Amount charged' line is blank
*** Issue F) The discount line is also blank, should at least have a
0.00 value
17) Click 'Issue Payout' for your manual credit.
*** Issue G) The 'Return to Patron' line does not have 2 decimal places
18) Apply patch
19) Repeat steps 7 & 8 and check the formatting is correct for issue A
20) Repeat steps 13-17 and check behavior and formatting is correct
for issues B-G
21) Celebrate that you are done with all the steps and looking at
numbers, and that all is right in the Koha payment world (maybe)
Sponsored by: Westlake Porter Public Library Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 538c943faa52f1571814642ab5a05a48b689b083) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Laura_Escamilla [Wed, 7 Aug 2024 13:44:36 +0000 (13:44 +0000)]
Bug 37586: Added aria-label for Login icon
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 57dc65bed597507c9b0433edaed5f535d46b7f0c) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Laura_Escamilla [Wed, 7 Aug 2024 13:22:58 +0000 (13:22 +0000)]
Bug 37586: Updated aria-labels for masthead links
Update to my last comment: The Lists aria-label had an accessibility issue as the label did not match the visible text.
New test plan:
Check the OPAC Interface:
* Open the OPAC in a normal-sized browser window.
* You’ll see the text next to the 'Cart', 'Lists', and 'Login' icons clearly.
* Gradually reduce the window size until the text next to these icons disappears.
* Inspect the icon elements. You’ll find that there is no alternative text (like aria-label) provided for 'Cart' and 'Login'. The aria-label for 'Lists' does not match the visible text. It currently says "Show dropdown with detailed list information". This lack of alternative text is an accessibility issue and labels should match visible text.
Apply the Patch:
* Apply the patch
* Restart_all
Verify the Fix:
* Inspect the icons again.
* For the 'Cart' icon, you should see an aria-label attribute with the text "View your shopping cart".
* For the 'Login' icon, you should see an aria-label attribute with the text "Log in to your account".
* For the 'Lists' icon, you should see an updated aria-label attribute with the new text of "Lists".
* These changes will improve accessibility for users relying on screen readers.
Sign Off:
* Sign off and Have an amazing day!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8318d27a7d08d6c8667adb0eba7662ab6ac545f4) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Fri, 9 Aug 2024 22:43:50 +0000 (15:43 -0700)]
Bug 37612: Batch patron modification should accept both cud-show and show ops
Just like with batch item modification, batch patron modification can accept
either a POST of a lot of data, which might be more than Apache's default
URL length limit, or a GET of a little data. Or at least it could, if both
the op 'cud-show' and the op 'show' were accepted. Show isn't doing any
creation or updating or deleting, it just has to be cud-show because it needs
to be able to accept large POSTs. So when it is only getting a little data, it
should be willing to take a GET with op=show just like batch item
modification does.
Test plan:
1. Without the patch, Tools - Patron lists - New patron list - give it a
name and Save
2. Type enough characters in the Patron search input to find a patron (I
like ace for poor often-used Henry Acevedo) and click on a patron in
the list of results
3. Click Add patrons
4. Click Patron lists, and in the Actions menu for your list, choose
Batch edit patrons. Note that the page that loads doesn't show any patrons
or UI to edit them, only a message about "No patron card numbers or
borrowernumbers given."
5. Apply patch, restart_all
6. Repeat step 4, but this time get a page with your patron listed, and a
form to change things about the patron record.
Sponsored-by: Chetco Community Public Library Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit fc5eed80a30c8562078289e5664d8685211f3597) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Paul Derscheid [Wed, 14 Aug 2024 09:24:49 +0000 (09:24 +0000)]
Bug 37643: Check for NaN instead of truthiness if calendar.inc accepts_time
To test:
1) Go to circulation.pl (checking out to a patron)
2) Click the settings in the barcode input
3) Set any due date with the time set to 00:00
4) Note that the picker resets the time to 23:59
5) Apply the patch
6) Repeat 1-3
7) Note that the time (00:00) stays put
8) Sign off
Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e96a334aa830aa7f9aacd705d04ba544fd389e8b) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Matt Blenkinsop [Thu, 15 Aug 2024 09:37:10 +0000 (09:37 +0000)]
Bug 37647: Remove Text::CSV_XS import
There is an unnecessary import that has been left over from when KBART file processing logic was being handled directly in the API controller. This patch removes that import as it is no longer needed
Test plan:
1) Look at the patch diff and confirm that the import for Text::CSV_XS has been removed
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3c94b26c662c76792c36b1b8dd5a95411bf05d03) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Pedro Amorim [Thu, 16 May 2024 11:46:08 +0000 (11:46 +0000)]
Bug 36882: Reapply flatpickr to cloned entry
1) Add a patron attribute type:
http://localhost:8081/cgi-bin/koha/admin/patron-attr-types.pl?op=add_attribute_type
2) Make sure its repeatable + is_date
3) Visit overdues:
http://localhost:8081/cgi-bin/koha/circ/overdue.pl
4) Click the 'add' button under the date custom attribute
5) Click on the newly created input, notice the flatpickr pop up doesnt
show
6) Apply patch. Repeat.
Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c3ef3b69d4660843261669f01a53c4d908ab270) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard [Tue, 21 May 2024 15:09:59 +0000 (15:09 +0000)]
Bug 36907: Add maxlength to OAI set mapping form fields
This patch adds a maxlength attribute to the field, subfield, and value
fields in the OAI set mapping form. This helps prevent an error when the
form data is too long for the database columns.
Unrelated: The patch also adds quotes around two unquoted name
attributes.
To test, apply the patch and go to Administration -> OAI sets.
- If necessary, create a new set.
- Click Actions -> Define mappings.
- Test that each form field is limited correctly:
Field: 3
Subfield: 1
Value: 80
- Test that the form can be submitted successfully with the maximum
number of characters in each field.
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c3f47091def8b03c9d5d4fbf5329d01d743398f5) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit da5aa7fabad0635535a7b1847ad9e8736414d38c) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 32696: Recalls can inadvertently extend the due date
If an item is due sooner than the recall due date interval then placing
a recall on it can inadvertently extend the book's due date, possibly
causing the recalling patron to receive the item later than they would
otherwise.
Test plan:
=========
1. Turn on recalls with UseRecalls.
2. In circulation rules, set the recall due date interval to 7 days
or any other arbitrary period.
3. Check out an item to one patron & set the due date to be before the
recall due date interval will have elapsed (e.g. the next day)
4. As a second patron, place a recall on the item in question.
5. See that the item's due date is extended to the current date plus
the recalls due date interval.
6. Apply the patch, restart_all;
7. Repeat steps 3. and 4. See that the due date has not been extended.
BTW, the calculation of $due_interval has been changed, because with
the current code and empty 'Recall due date interval' $due_interval
is undefined, despite the intention of the author of the code.
(after calling get_effective_rule $recall_due_date_interval is defined, but
$recall_due_date_interval->rule_value is undefined; the patron gets
a message: '... return the item within days, by ...' - no days count).
Sponsored-by: Ignatianum University in Cracow Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e584b9adcb6fafb96ce77fcd84b68f6f697478f4) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Aleisha Amohia [Tue, 13 Aug 2024 03:07:17 +0000 (03:07 +0000)]
Bug 37623: Make t/db_dependent/Letters.t idempotent
The tests should be unaffected by system preference settings, such as EmailFieldPrimary.
To test:
1. Log into the staff interface
2. Go to Koha Administration -> Global system preferences, and search for EmailFieldPrimary
3. Change the EmailFieldPrimary preference to something other than 'primary email' and 'first valid email address', i.e. any of the following:
4. Run tests t/db_dependent/Letters.t and notice they fail
5. Apply the patch
6. Run the tests again t/db_dependent/Letters.t with different settings of EmailFieldPrimary. The tests should always pass.
Sponsored-by: Pymble Ladies' College Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0e61e56e5728fc0ed387e9a53f40a6e77e9bc793) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Matt Blenkinsop [Mon, 19 Aug 2024 13:16:00 +0000 (13:16 +0000)]
Bug 37620: Improve cypress test to reduce random failures
This patch makes some improvements to the Infinite Scroll cypress test to try and prevent random test failures
- Fixes X-Base-Count and X-Total-Count for intercepted requests
- Makes element selection more precise
- Adds an intercepted request returning the requrired result for the filtered search
- Awaits this request before selecting an element from the dropdown
- Awaits all 10 requests triggered by typing "License 50" rather than just the first one
- Ensures that the select dropdown is closed between operations by clicking into another field to remove focus from the select dropdown
Test plan:
1) yarn cypress run --spec t/cypress/integration/InfiniteScrollSelect_spec.ts
or
1) yarn cypress open and select the InfiniteScrollSelect test from the Cypress GUI
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 538868d5f5e6c9c98f73dbdefb93a6ae0a186b84) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Eric Garcia [Mon, 8 Jul 2024 17:11:06 +0000 (17:11 +0000)]
Bug 37186: Fixed deletion of rotating collections
To test:
1. Tools -> Rotating collections
2. Create a rotating collection
3. In new collection Actions -> Delete
4. Notice collection is not deleted
5. Apply patch
6. In new collection Actions -> Delete
7. Notice collection is deleted
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl> Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 37cb3f35a324678d7af79c7ad9fa179f62a1bb7d) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes the tests check for the added exception instead of the
generic DBIx::Class::Exception.
A FIXME was set in place proposing we should throw a Koha::Exception
instead, so removing the FIXME as that's what this patch actually did.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8da67cec7217c4519fb0a73d33c65e967ecef529) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Johanna Räisä [Fri, 9 Aug 2024 05:58:31 +0000 (08:58 +0300)]
Bug 37591: Fix moredetail.tt performance issue
This patch fixes the performance issue in moredetail.tt by removing the
unnecessary call of checkout_renewals table.
To test:
1. Create lot of checkouts and renewals for a record.
2. Open the moredetail page for the record.
3. Check the timing of the page load.
4. Apply the patch and check the timing of the page load again.
5. The page load should be faster after applying the patch.
Sponsored-by: Koha-Suomi Oy Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5c41c1c657eba6be37bd8ca4622fdc9eda658fcd) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Sam Lau [Fri, 26 Jul 2024 20:52:19 +0000 (20:52 +0000)]
Bug 37409: Fix 'Edit' button for items in course reserves list
To test:
1) Set the 'UseCourseReserves' sys pref to 'Use'
2) Go to the Course reserves page
3) Create a new course, fill in the required info and make sure the 'Enabled?' is checked
4) Add a reserve to this course
5) From the course details page, select edit on the reserve you just made.
6) Note it brings you back to the add reserves page, and you are required to enter the barcode/biblionumber again to edit
7) Apply patch, restart_all
8) Press the edit button again
9) Now you are directed towards the correct page for editing
10) Make some changes and press save
11) You should be redirected back to the details page and your changes have been made
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0dad564763e190dd59ed44606ca5af56e526d429) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 37510: Make Koha::Object->delete throw Koha::Exception
This patch makes Koha::Object->delete wrap DBIC exceptions on FK
constraints and throw a Koha::Exception::Object::FKConstraint exception
instead. This will allow us better handling it from the callers.
To test:
1. Apply the unit tests patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/Koha/Object.t
=> FAIL: A DBIC exception is thrown instead, tests fail
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 923dc5e078593f653b075813885bde34531c503e) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 30a5baa70623625d2856450293b00ce34a764cd8) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart [Thu, 15 Aug 2024 10:21:10 +0000 (12:21 +0200)]
Bug 37429: Set default value for global variables
The global variables needs to be assigned with a default value, or the
value from the previous request will be used.
Global variables are persistent from one request to another, in memory.
This patch:
* groups default value for global variables together
* removes $authorised_values_sth from this list (it is not a global var)
* set $changed_framework to 0 (which fix the issue)
Test plan:
1. Open an existing biblio (detail.pl)
2. Click "Edit record"
3. Change the framework (no need to change any details)
4. Change the framework back to the original one (no need to save anything)
5. Go back to the biblio overview page (detail.pl)
=> The form is populated
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8aced236e9360ea6186e0d4c79d77ecd272bdc09) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Phil Ringnalda [Fri, 16 Aug 2024 00:44:20 +0000 (17:44 -0700)]
Bug 37614: Printing patron cards from patron lists should be a GET
There's no creating, updating, or deleting about printing patron cards, and
the only time there's a lot of data (selecting individual patrons in a card
creator batch), it doesn't matter if the "Export selected" URL exceeds the
maxlength for Apache since the actual link to create the PDF also will.
Test plan:
1. Without the patch, Tools - Patron lists - New patron list - Name it and
Save
2. Type three characters in the Patron search form (mar works well) to get
at least three patrons. Click on each of three, then click Add patrons
3. You can only print cards from the list of lists, so back to Tools -
Patron lists
4. In the Actions menu choose Print patron cards, in the popup click Export
5. Watch the throbber spin around for a while (it will never stop), then
close the popup, apply the patch, restart_all
6. Tools - Patron lists - Actions menu - Print patron cards - Export
7. Click the PDF link, make sure it has all three of your patrons
8. Tools - Patron card creator - New - Card batch
9. Without putting anything in the textarea, click Add patrons, in the
search popup search for your three characters (mar) again, and click
the checkboxes to the left of three of the names, then Add selected
patrons, then Close, then Add patrons
10. Click the checkboxes for two of the three patrons, then Export selected
card(s), then Export in the popup
11. Hover the link to the PDF, verify that it doesn't have stray 'amp;'
after the & and before label_id= anymore
12. Click the PDF link, verify it has your two patrons
13. Back at the card batch, click Export card batch, then Export
14. Check the PDF to verify it has all three of your patrons
15. Tools - Patron lists - click your list's name to open it
16. Click the card number for a patron, then the Patron lists tab in Checkout
17. Actions menu - Print patron cards - Export, verify the PDF has all three
patrons
Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0f255728c5101fbc90a1e18f3d6fdda96ed0182a) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Kyle M Hall [Wed, 14 Aug 2024 14:41:35 +0000 (14:41 +0000)]
Bug 37308: (QA follow-up) Tidy code
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5a06bd0d73d51bbc87a7e4ff210434b8782b90ec) Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
projects / koha.git / log