Bug 8919 - ExtendedPatronAttributes not populated from LDAP
Current code is overly complex and assumes that
C4::Members::AttributeTypes::GetAttributeTypes
returns array of attribute codes which is not true.
Instead it return array of hashes so none of extended attributes
will be replicated from LDAP.
This code correctly extracts extended attributes from borrower data
provides simpler code which fills same structure.
It also skips empty values (" ") which are result of mapping without
any default value. This is needed to make unique extended patron values
work. If not handled it would insert empty value for first user and
fail for all others on uniqueness constraint.
Test scenario:
1. define Patron attribute types in administration
2. define mapping from LDAP fields to attributes in koha-conf.xml
3. login as new user with LDAP fields and verify that extended
attributes are replicated from LDAP
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Passed-QA-by: Paul Poulain <paul.poulain@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Mark Tompsett [Tue, 18 Sep 2012 12:53:32 +0000 (20:53 +0800)]
Bug 8784 - Missing files in debian.packages list
Added missing items based on ./koha_perl_deps.pl -m -u
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Passed-QA-by: Paul Poulain <paul.poulain@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Magnus Enger [Wed, 31 Oct 2012 08:06:31 +0000 (09:06 +0100)]
Bug 8805 - Add a biblio-zebra-indexdefs.xsl for NORMARC
This is required in order for Koha to support DOM indexing of the
NORMARC dialect, cf Bug "Bug 7818 - support DOM mode for Zebra
indexing of bibliographic records".
The two files in this patch were generated from the NORMARC
record.abs by doing the steps suggested at the bottom here:
http://wiki.koha-community.org/wiki/Switching_to_dom_indexing
No manual editing was involved.
To test:
- Do a fresh install, choosing NORMARC as the MARC dialect
- Run rebuild_zebra.pl and check it does not complain about missing
files or other things
- Check that search works as expected. Using MARC21 records for
the testing should be OK.
2012-10-31: New patch after an update to Bug 8665 Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Paul Poulain <paul.poulain@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
[This patch was split out from tcohen's excellent patches for bug 8519
--jcamins]
It removes the obsolete zebraqueue_daemon.pl and koha-zebraqueue-ctl.sh
obsolete scripts too.
Several files are modified to address te removal/addition of these files.
I didn't run the install procedure as I was working on my laptop with a dev
setup, just set the symlinks. Now fixed things as proposed by wajasu
on comment #4. Any other suggestion please let me know.
Tested to work on an up-to-date Ubuntu 12.04.
Asked by wajasu, remove remaining obsolete zebraqueue stuff.
Sponsored-by: Universidad Nacional de Córdoba Signed-off-by: wajasu <matted-34813@mypacks.net> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Marcel de Rooy [Thu, 4 Oct 2012 11:34:51 +0000 (13:34 +0200)]
Bug 8872: Changes for intranet showmarc
Simplifies template (eliminating intranet-bottom include).
Makes encoding for card view more consistent with approach in Templates module.
Rearranges a few lines in script for consistency and performance.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Marcel de Rooy [Thu, 4 Oct 2012 11:40:51 +0000 (13:40 +0200)]
Bug 8872: Changes for opac-showmarc
Simplifies template (eliminating opac-bottom include).
Makes encoding for card and html view more consistent with approach in Templates module.
Rearranges a few lines in script for consistency and performance.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Marcel de Rooy [Thu, 4 Oct 2012 10:05:10 +0000 (12:05 +0200)]
Bug 8872 Add UTF-8 encoding to opac xslt files
Does also fix head and body tags in MARC21slim2OPACMARCdetail.xsl.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Marcel de Rooy [Thu, 4 Oct 2012 10:00:28 +0000 (12:00 +0200)]
Bug 8872: Add UTF-8 encoding to intranet xslt files
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Paul Poulain [Fri, 2 Nov 2012 09:02:30 +0000 (10:02 +0100)]
Bug 8842 fix Plack scoping for holidays
the internal sub add_holiday uses some variables that are defined in the main script, usual fix
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Paul Poulain [Fri, 2 Nov 2012 10:19:23 +0000 (11:19 +0100)]
Bug 8949: Trying to view help on a page without any help results in a nasty error
The problem was probably a side effect of bug 7038
I've checked that things are OK in translated languages.
Test plan:
* open help on a page with help in english (mainpage.pl)
* open help on a page with help in another language (mainpage.pl)
=> you'll see the online help, as usual
* open help on a page without help in english (acqui/addorderiso2709.pl)
* open help on a page without help in another language (acqui/addorderiso2709.pl)
=> you'll get the "oops, no help available, sorry", no more the Perl error
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Paul Poulain [Fri, 2 Nov 2012 11:16:19 +0000 (12:16 +0100)]
Bug 8490: fix Plack error when creating label layout
This patch fixes "Error message "Can't bless non-reference value at
/home/pi/koha/C4/Creators/Layout.pm line 111." when trying to add a
label layout while using plack."
The $layout_id variable is set to 5001 on my setup. And 5001 is the Unix
port where I run Plack. WTH is this value stored in this variable ?
Because of
> my $layout_id = $cgi->param('layout_id') || $cgi->param('element_id') || $ARGV[1] || '';
in label-edit-layout.pl
Removing $ARGV[1] solves the problem
Also removing $ARG[0] because I also don't think it's useful
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Signed off after confirming with Chris Nighswonger that these scripts
were not intended to be run from the command line. Works as promised.
Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Paul Poulain [Fri, 2 Nov 2012 08:53:57 +0000 (09:53 +0100)]
Bug 8904: fix Plack scoping for overduerules.pl
There are 2 Plack scoping errors in tools/overduerules.pl:
the local sub blank_row require that @rule_params and input are global
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com>y Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Nicole C. Engard [Fri, 26 Oct 2012 15:44:24 +0000 (11:44 -0400)]
Bug 8945: Tools Help Files
This patch updates the help files for 3.10 in the Tools
section and adds a help file for the patron modification tool
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed off patch includes one small fix:
Profilemarcfields -> Profile MARC fields Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Bug 7455: Authority subfields are cloned in the wrong field (follow-up 3)
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Bug 7455: Authority subfields are cloned in the wrong field (follow-up 2)
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Fridolyn SOMERS [Tue, 28 Aug 2012 12:55:01 +0000 (14:55 +0200)]
Bug 7455: Authority subfields are cloned in the wrong field (follow-up)
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Bug 7455: Authority subfields are cloned in the wrong field
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Owen Leonard [Tue, 16 Oct 2012 18:12:13 +0000 (14:12 -0400)]
Bug 8931 - submit buttons have blue background
This patch specifies a transparent background for fieldsets
and divs with the class "action," which are typically containers
for the submit/cancel actions.
For testers, a good example page to view is the "set library" page.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Robin Sheat [Wed, 24 Oct 2012 04:49:20 +0000 (17:49 +1300)]
Bug 8636 - add Moose dependency to the dependencies
Koha::SearchEngine requires moose, but it wasn't declared as a
dependency.
Also update the debian/control dependencies to match the current state
of the requirements.
Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com> Passed-QA-by: Mason James <mtj@kohaaloha.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
The test was moved since the original patch was written, making the
revised test fail. This patch corrects the mocked template patch so that
the test will pass.
To test:
1) Before applying patch, run
`prove t/db_dependent/SuggestionEngine_ExplodedTerms.t`
2) Note that it fails.
3) Apply patch.
4) Run `prove t/db_dependent/SuggestionEngine_ExplodedTerms.t`
5) Note that it passes.
6) Celebrate.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Bug 8846: Exploded Terms test sneakily uses database
Even though there is no need for anything stored in the database for the
test, C4::Templates requires the database and a koha-conf.xml. The
solution is to mock all database- and koha-conf-using routines.
To test:
1) Stop MySQL
2) Unset KOHA_CONF
3) Run test
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Lyon3 Team [Mon, 29 Oct 2012 10:59:44 +0000 (11:59 +0100)]
Bug 8978: Patron's dateexpiry erroneously updated when in UnwantedField
If dateexpiry field was absent because it has been included in
UnWantedField syspref list, the script assumed that the date has
been forgotten and updated it when clicking on 'save' button.
Signed-off-by: Owen Leonard <oleonard@myacpl.org> Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
MJ Ray [Tue, 30 Oct 2012 10:14:49 +0000 (10:14 +0000)]
Bug 8982 make koha-create accept --database option
Signed-off-by: Robin Sheat <robin@catalyst.net.nz> Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Owen Leonard [Tue, 30 Oct 2012 15:07:04 +0000 (11:07 -0400)]
Bug 8707 - tags always say approved
Template scope error caused an incorrect state on the
approval/rejection buttons when viewing rejected tags.
To test, go to Tags and view the list of rejected tags.
In the "Actions" column, the "rejected" button should be
greyed out, and the "approve" button active.
Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com> Passed-QA-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Owen Leonard [Mon, 29 Oct 2012 19:24:37 +0000 (15:24 -0400)]
Bug 8980 - Untranslatable strings in modborrowers.pl
This patch removes the declaration of interface labels
from the script and puts it in the template where the
labels can be translated. The labels have been modified
to match those used on the patron entry form.
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
The DOM transformer was missing a line from a previous development,
resulting in the MARC21 authorities DOM indexing stylesheet being
regenerated with a missing line. This patch readds the missing line
to the transformer, and provides the corrected authority-zebra-indexdefs.
Signed-off-by: Elliott Davis <elliott@bywatersolutions.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Bug 8665: DOM indexing fails to index some bib records
Use a user-specified field for z:id.
This patch also fixes an excess space before the index in the MARC21
biblio index definitions, which someone fixed in the generated file
but not in the source file it should have been fixed in.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Elliott Davis <elliott@bywatersolutions.com>
Magnus Enger [Thu, 18 Oct 2012 09:56:47 +0000 (11:56 +0200)]
Bug 8941 - Make title display properly for NORMARC OPAC detail view
Authors and materialtype were displayed to the right of the title.
This patch simly adds class="title" to the h1 that holds the title.
To test:
- Set marcflavour = NORMARC
- Check a detail view in the OPAC and see that the display is wrong
- Apply the patch
- Check that the detail view now looks good
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Bug 8823: CatalogModuleRelink Creates Multiple Links between Bib and Auth record
On 3.8.x, it was possible for multiple automatically generated
authorities to be linked to a single heading. This patch deletes
previous links from headings prior to linking them to
automatically-generated headings. This patch also corrects a
potential problem wherein multiple authorities might be generated if
a record is edited repeatedly in quick succession. The latter problem
exists on Master and 3.6.x as well, and the code that corrects the
multiple linkages is equally applicable if seemingly unnecessary.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Kyle M Hall [Thu, 4 Oct 2012 14:34:49 +0000 (10:34 -0400)]
Bug 8253 - fix fine doubling, when upgrading from 3.6 to 3.8 - Add de-duplication script
This script will remove these duplicate fines. To use, repeatably run this
script until there are no more duplicates in the database.
(fix_accountlines_rmdupfines_bug8253.pl)
Duplicate fines would happen if you upgraded to a 3.8 version that does not have the
bug8253 patch, and the misc/cronjobs/fines.pl is run. In 3.8 an upgrade to a more
granular date/time was not addressed for pre-existing fine entries and this script
removes the resulting duplicates. It also intelligently preserves the amount outstanding
for payments already applied. If your version already had the bug8253 patch at the time
of the upgrade, duplicate fines should not have been generatd.
Signed-off-by: wajasu <matted-34813@mypacks.net> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Mason James [Tue, 2 Oct 2012 22:09:41 +0000 (11:09 +1300)]
Bug 8253 - Fine doubling
Provides a fix that during database upgrade, fines are correclty
formatted. Once the misc/cronjobs/fines.pl is run in the
upgraded database, it will not result in duplicate fines being
generated.
The logic for the XSLT fallback was backwards, which meant that
non-English installations of the CCSR theme were unable to use XSLT
stylesheets. This patch corrects the logic.
To test:
1) Switch to the ccsr OPAC theme.
2) Switch to a language other than English for the OPAC.
3) Turn on the default XSLT stylesheets for the OPAC.
4) Do a search or view a record that would result in something being
displayed with XSLT. This will work after the patch, but not before.
Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Works as advertised!
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Bug 8914: Blank search that returns invalid authorities fails under Plack
When doing a search with no terms for the default authority type under
Plack, you will get a segfault if it returns any records that do not
have any authority type. As far as I can tell, this cannot be reproduced
under CGI/Apache.
To test:
Confirm that you don't get an error if you click the Submit button in
the authorities sections in the staff client and OPAC without entering
a term or changing the authority type.
You may or may not be able to reproduce the problem prior to applying
the patch, but that is the only situation in which I managed to trigger
it.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Lyon3 Team [Mon, 8 Oct 2012 17:06:04 +0000 (19:06 +0200)]
Question marks in series title facet links
When series title include a question or exclamation mark, theese must be removed
to prevent search failure.
http://bugs.koha-community.org/show_bug.cgi?id=8888 Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Before the patch: Series facet links with ! or ? return no results.
After the patch the same links return valid results.
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
The GetAuthority shim does not check that authority retrieval was
successful, and therefore can call ->record on an undefined value.
This can be reproduced by trying to load an invalid authority record
using bulkmarcimport. There may be other ways to trigger it, but I'm
not sure what they are.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
another way to trigger this error is just forging your URL with a wrong
authid !
Mark Tompsett [Fri, 12 Oct 2012 06:29:59 +0000 (14:29 +0800)]
Bug 8910 - silent warnings triggered in about.pl
In order to detect the apache version, there are multiple
commands used. These may not all exist, which triggers error log
entries. By simply adding " 2> /dev/null", the errors are no
longer generated.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Mark Tompsett [Thu, 27 Sep 2012 06:12:00 +0000 (14:12 +0800)]
Bug 8834 - Call to C4::Context::preference fails to pass $self in Circulation.pm
Changed:
my $circcontrol = C4::Context::preference('CircControl');
To:
my $circcontrol = C4::Context->preference('CircControl');
This will pass $self and 'CircControl' which will then prevent
a "Use of uninitialized value" error log entry.
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Magnus Enger [Sun, 30 Sep 2012 07:57:37 +0000 (09:57 +0200)]
Bug 8568 - Fix some errors in docs for scripts provided by the Debian packages
1. Create a page for koha-run-backups
2. Fix the synopsis for koha-foreach
3. Add koha-create and koha-run-backups to koha-common
To test
- Convert the changed xml files to man pages with
$ xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl koha-x.xml
- View generated pages with e.g.
$ man -l koha-x.8"
(Replace x with the names of the changed files)
- Check that the changes make sense
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Works as described. I was able to produce the 3 man files, load them with man
command, and see the added information properly formated.
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Colin Campbell [Fri, 28 Sep 2012 10:48:18 +0000 (11:48 +0100)]
Bug 8841 Duedate should be set to end of expiry day
When reducing duedate to patron's expiry date
it should be set to end of that day not 00:00
take account of the fact that the borrower
expiry date will have no hours/minutes
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Jonathan Druart [Wed, 19 Sep 2012 07:59:59 +0000 (09:59 +0200)]
But 8787: don't load the page if OpacMaintenance is ON
If the syspref OpacMaintenance is ON, it is useless to loaded the
requested page.
To test:
- switch on the syspref OpacMaintenace
- check in your apache access log, zebra log, etc. the requested page is
not loaded (i.e. on the opac-search.pl page)
Signed-off-by: Marc Veron <veron@veron.ch>
Checked by watching other_vhosts_access.log
Works as expected
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Mark Tompsett [Mon, 1 Oct 2012 08:29:22 +0000 (16:29 +0800)]
Bug 8849 - Error log generated when not a demo system
Changed two lines similar to:
unless (C4::Context->config('demo') == 1) {
into lines similar to:
unless (C4::Context->config('demo')) {
By removing the == 1, undefined = false without an error. The
value of demo is supposedly set by a koha-conf.xml variable,
but there is very little documentation on this "demo mode"
beyond the set it to 1 in koha conf for demo mode. Also, demo
doesn't exist in the default koha-conf.xml file generated.
So anyone who knows to create it, will likely create it the
proper way and with the proper value.
Signed-off-by: wajasu <matted-34813@mypacks.net> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
1. parametars from CGI are not encoded in utf-8, so when they are
compared with utf-8 strings from database every field with
utf-8 characters will be reported in e-mail as changed
2. when sending e-mail, wide characters are passed to Mail::Sendmail
which results in software error if edited field has utf-8 characters
(because of first point, this happend if ANY fields has utf-8 chars)
3. when declaring encoding for outgoing e-mail utf-8 is more correct
than just utf8
Test scenario:
1. open opac-userupdate and edit user which has utf-8 characters in
at least one field (firstname and surname are common examples)
2. edit one of other fields and add utf-8 character to it
3. verify that e-mail with changes arrived with just edited field
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Bug 8890: Koha::Borrower::Files shouldn't use db in BEGIN
This patch removes the usage of the database in Koha::Borrower::Files'
BEGIN block. It also removes the export-related declarations, since
they were unused, and unnecessary in a module called in an object-oriented
fashion.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
C4::Members::Statistics uses the database in its BEGIN {} block,
which breaks the package build process. This patch causes it to be
skipped in the 00-load test.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
This counter-patch moves all database handling code into subroutines
in C4::HoldsQueue. This fixes the test, and is required for persistent
environments like Plack.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Bug 3652: close XSS vulnerabilities in opac-export
The opac-export.pl script had a number of XSS vulnerabilities relating
to its error handling.
To test:
1) Go to /cgi-bin/koha/opac-export.pl?op=export&bib=2&format=<h2>evil</h2>
(substituting a valid biblionumber for the '2')
2) Notice that "evil" is rendered as an h2 heading.
3) Apply patch.
4) Notice that you now see the h2 tags, and they are not rendered by
the browser.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Bug 3652: close XSS vulnerabilities on biblionumber and authid
Previously we did not sanitize biblionumber and authids passed in by
the user.
To test:
1) Go to /cgi-bin/koha/opac-detail.pl?biblionumber=2hi (substituting a
valid biblionumber for the 2).
2) Notice the presence of "2hi" on this page, and also on the ISBD and
MARC views.
3) Go to /cgi-bin/koha/opac-authoritiesdetail.pl?authid=2bye
(substituting a valid authid for the 2).
4) Notice the presence of "2bye" on this page.
3) Apply patch.
4) Notice that "2hi" and "2bye" strings are gone.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Owen Leonard [Wed, 17 Oct 2012 16:35:28 +0000 (12:35 -0400)]
Bug 8935 - transport cost matrix could be prettier
Correcting the template so that it follows established
interface patterns and coding guidelines:
- Form contents in a fieldset
- Submit button in a fieldset with class "action" and
with a "Cancel" link.
- Errors displayed in a <div class="dialog alert">
(no custom error classes necessary).
- Valid markup.
- No JavaScript errors (to that end, the patch removes a
call to a non-existent function, show_transport_cost_matrix)
http://bugs.koha-community.org/show_bug.cgi?id=8936 Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
still works as expected and is much more visually appealing.
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
projects / koha.git / log