It adds methods, DBIC rs and Exceptions class for biblio metadata.
Note that schema is marcflavour in 18.11
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This patch cleans opac-showmarc.pl so it doesn't allow retrieving
records from import batches without requiring any permissions in the
OPAC.
it does so by just removing the code portion that does that.
It also cleans the record fetch operation and how the record processor
is initialized to it actually works :-D
To test:
1. Perform a successful Z39.50 search in cataloguing (this fetches 20
records usually)
2. Query your DB for a valid import_record_id:
$ koha-mysql kohadev
> SELECT * FROM import_records LIMIT 1;
3. Notice some of the MARCXML details (title, author, etc), and the
import_record_id
4. Point your browser to the opac-showmarc.pl URL like this:
http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20
=> FAIL: You get the record! (Bonus: no field/subfield takes place)
5. Hide some obvious subfield on the framework for a known (to you)
biblionumber
6. Point your browser to:
http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here>
=> FAIL: No filtering takes place
7. Apply this patch
8. Repeat 4
=> SUCCESS: You get an error because you did a bad request (no id param)
9. Repeat 6
=> SUCCESS: Subfield filtering actually works!
10. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit d3ba9dc0fe)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test and understand what's going on, you can try that bit of code:
my @a = qw( a b c a);
my @b = qw( b c d );
my @c;
@c = grep { 'a' eq $_ } @a ? 'ok' : ();
say @c;
@c = ( grep { 'a' eq $_ } @a ) ? 'ok' : ();
say @c;
@c = grep { 'a' eq $_ } @a ? ('ok') : (undef);
say @c;
The problem here:
Have patrons in 3 branches CPL, MPL, SPL
Have a non superlibrarian with edit_borrowers permission but
without view_borrower_infos_from_any_libraries, from CPL
Create a library group with CPL, MPL
Use that non superlibrarian to search for patrons
You can search for patrons fro CPL and MPL
BUT, edit the value for CPL, use SPL (edit the DOM)
Search and... oops
Apply this patch, try again
Also use a superlibrarian patron (and/or with view_borrower_infos_from_any_libraries)
and confirm that they can see all patrons
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Tested with edit_borrowers permission but NOT view_borrower_infos_from_any_libraries
Editing the DOM I can search (not edit) from any branch
With patch no entries found :)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Amended test plan slightly (+ without)
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit c33f598c5c)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.
It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.
The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.
QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.
Note: This patch should have a regular and a dev install signoff.
Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
Try one of the URLs in step 3.
Verify that your staff client still operates as usual. Test a few
URLs inside some modules.
[3] For dev installs:
Try some URLs like below.
Expect 404 errors only, not 500s. If you do not see a 404, go back!
/misc/stage_file.pl
/t/db_dependent/default_search_class.pl
/installer/data/mysql/updatedatabase.pl
/Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 3401e94d94)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test:
Have a record with the 000 position 5 set to "deleted" (record status)
Use koha-shell to run the job with the -i flag: perl misc/cronjobs/delete_records_via_leader.pl -c -i -v
* items and the record should be deleted
Mark another record with the 000 position 5 set to deleted (record status)
Use koha-shell to run the job without the -i flag: perl misc/cronjobs/delete_records_via_leader.pl -c -v
* if the record had items, it will not be deleted
* if the record did not have items, it will be deleted.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit b713241845)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Currently when fixing priorities of existing holds, priorities aren't
fixed when checking out a middle priority hold because the hold has been
fulfilled and deleted. This patch adds a check for, if the hold can't be
found, an old hold with the required reserve_id.
To test:
1. Place at least four holds on a biblio for different borrowers
2. Check out an item to the 3rd priority borrower
3. Check the existing holds table for the biblio. The priorities might be
out of order, or try clicking the dropdowns and there might be an empty
dropdown option, or open the browser developer tools and notice the option
values in the select are missing value=3.
4. Apply patch and restart memcached
5. Check out an item to the 2nd priority borrower
6. Check the existing holds table for the biblio. Confirm the priorities
have been fixed and are now consecutive with no gaps.
Sponsored-by: Chartered Accountants Australia and New Zealand
Signed-off-by: Emmi Takkinen <emmi.takkinen@outlook.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit b17c16f910)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d29f435e26)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This patch enable the translation of the
labels 'Mandatory' or 'Optional' present at install time
for groups of installer files.
To test:
1) Try install using de-DE language,
at step3 verify 'Mandatory' and 'Optional'
labels for marc21 or other data checklist
Do not close this window!
2) Apply this patch
3) Update de-DE translation files, reinstall lang files
cd misc/translator
./translate update de-DE
./translate install de-DE
4) Reload page at step3, now 'Mandatory' label
is translated to 'Pflichtfeld'
5) Verify strings in translation file
Search for
^msgid \"Mandatory\"
^msgid \"Optional\"
in po/de-DE-staff-prog.po.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 1adc4986e9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 42bc9671ca)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
When selecting a new hard due date, we should keep the time part of the
original checkouts.
Test plan:
1 - Checkout an item specifying a date due
2 - Checkout an item without specifying a date due
3 - Use Tools->Batch extend due date
4 - Select a hard due date
5 - On the confirmation screen you should see that the time part has
been kept
6 - Confirm
7 - Make sure the correct values hava been inserted in DB
8 - Try now using the other option, give a number of days
9 - Repeat 4-7
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 5550da8a50)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5d49c80644)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test:
- go to admin/categories.pl
- click Help, confirm it takes you to manual main page
- apply patch
- restart all
- click Help, confirm it takes you to patron categories in manual
Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 5fbde57bbc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bacd18d29b)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Hold cannot be suspended if found=W:
Koha::Hold->suspend_hold
90 if ( $self->is_found ) { # We can't suspend found holds
So when TestBuilder generate a hold with found=W the test fail.
A question however:
Why did not we have the correct exception displayed somewhere? That
would be much more helpful to find the problem!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit c405b03dd3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1993e98edf)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This patch corrects a couple of invalid Template Toolkit comments in the
Circulation and Fines rules template.
To test, apply the patch and log into the staff client as an
administrator.
On the Circulation and Fines Rules page "View source" and look for
instances of the text "[#% Default branch %#]" There should be none.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] There is a theoretical difference between [% # and [%#. The latter
marks the whole directive as a comment and not just until EOL.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 1fbd446864)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b791fabc93)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Patch change Apache access control from 2.2 to 2.4 directives.
Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit c0422998f8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 97df645697)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test:
1- go to cgi-bin/koha/admin/branch_transfer_limits.pl
2- see wording "Check the boxes for the libraries you accept to checkin items from"
3- apply patch
4- see wording "Check the boxes for the libraries you allow your items to be transferred to"
To verify new wording accuractely describes behavior:
1- Set UseBranchTransferLimits set to Enforce using itemtype
2- Confirm circ rules allow holds
3- Confirm hold policy by item type allows holds
4- Confirm all branches are valid pickup locations in branch setup
5- In Branch Transfer Limits, set dropdown to Branch A, select itemtype Book, disable all transfers so Branch A does not accept books from any other branch
6- Find a patron from Branch A
7- Find a book from Branch B
8- On the intranet, successfully place hold on item for patron for pickup at branch A
9- Cancel hold
10- Log into opac as patron
11- Successfully place hold on item for pickup at Branch A
12- Cancel hold
13- In Branch Transfer Limits, set dropdown to Branch A, select itemtype Book, ENABLE all transfers so Branch A DOES accept books from any other branch
14- In Branch Transfer Limits, set dropdown to Branch B, select itemtype Book, disable all transfers so Branch B does not accept books from any other branch
15- On the intranet, try to place a hold on item for patron, confirm Branch B is your only pickup option
16- On the OPAC, log in as patron, try to place a hold on item, confirm Branch B is your only pickup option
Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 84026f2589)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 67a4e40f5c)
We allow for the user to add multiple users to this field, and the
search function expects and array. We have been treating it as a scalar
TO test:
1 - Have an open basket in acquisitions
2 - Add to basket - from an existing order (copy)
3 - Enter a name in the 'Basket created by' field and select a user
4 - Hit search
5 - ISE (Can't use string ("1") as an ARRAY ref while "strict refs" in use at /usr/share/koha/lib/C4/Acquisition.pm line 2482.)
6 - Apply patch
7 - Repeat 1-4
8 - Success!
9 - Test with mutiple 'created by' entries as well
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 789866e585)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 63374a8db6)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
The test t/db_dependent/Koha/XSLT/Security.t failed on Jenkins for U18
when this bug's patches were backported, due to it returning a different
IO error message for XSLT.
This patch adds a condition to the regex which matches both messages:
'Failed to load external entity' and 'Failed to load HTTP resource'
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Same change as the first patch, but for the staff detail page.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 6298eafa64)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0870bb6da6)
To test:
1 - Add an 830 to a record with a volume subfield separated by a semicolon
830$aThe series ;$vvol 8.
2 - View the record in the opac
3 - Click the series link, no results
4 - View the link url - the semicolon is not encoded
5 - Apply patch
6 - link works
7 - URL is corrrectly encoded
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit e3cffae41f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e94543c454)
This seems not to be needed. Just at the safe side.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 96e6362ab7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 27be06c672)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test:
1 - Edit/create a file in the koha home dir '/var/lib/koha/{instance}/OAI.yaml' with content like below:
format:
marcxml:
metadataPrefix: marcxml
metadataNamespace: http://www.loc.gov/MARC21/slimhttp://www.loc.gov/standards/marcxml/schema/MARC21slim
schema: http://www.loc.gov/MARC21/slimhttp://www.loc.gov/standards/marcxml/schema/MARC21slim.xsd
include_items: 1
2 - Set the systempreferences below to indicated values:
OAI-PMH => Enable
OAI-PMH:ConfFile => /var/lib/koha/{instace}/OAI.yaml
3 - View a record with items and confirm the items show:
http://localhost:8080/cgi-bin/koha/oai.pl?verb=GetRecord&metadataPrefix=marcxml&identifier=KOHA-OAI-TEST:4
4 - Delete the items, then delete the record
5 - Reload the URL from step 3
6 - Internal Server Error:
Empty String at /kohadevbox/koha/Koha/OAI/Server/Record.pm line 58.
at /usr/share/perl/5.24/Carp.pm line 167
7 - Apply patch
8 - restart_all
9 - Repeat
10 - Reload URL from step 3
11 - Success
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 68488f4055)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d474a4edb1)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
misc/cronjobs/update_totalissues.pl when issuing statistics table, no-incremental, has a problem for biblio with multiple items.
The first SQL query gets the biblios linked to items with issues in statistics :
SELECT
biblio.biblionumber, COUNT(statistics.itemnumber)
FROM
biblio
LEFT JOIN
items
ON
(biblio.biblionumber=items.biblionumber)
LEFT JOIN
statistics
ON
(items.itemnumber=statistics.itemnumber)
WHERE
statistics.type = 'issue'
$limit
GROUP BY
biblio.biblionumber
The second SQL query is :
SELECT
biblio.biblionumber, 0
FROM
biblio
LEFT JOIN
items
ON
(biblio.biblionumber=items.biblionumber)
LEFT JOIN
statistics
ON
(items.itemnumber=statistics.itemnumber)
WHERE
statistics.itemnumber IS NULL
GROUP BY
biblio.biblionumber
The problem is that this second query will set to 0 where ANY item has no entry in statistics table.
So when running it sets 0 to the biblio that had a value from first
query.
I think the best fix is to use "WHERE statistics.type = 'issue'" inside que JOIN :
LEFT JOIN statistics ON (items.itemnumber=statistics.itemnumber AND statistics.type = 'issue')
Test plan :
1) Begin with an empty database
2) Create a biblio 1 with no items
3) Create a biblio 2 with 3 items
4) Create a biblio 3 with 2 items
5) Checkout and checkin all items of biblio 2
6) Checkout and checkin the firt item of biblio 3
7) run misc/cronjobs/update_totalissues.pl --use-stats -v
8) Check biblio 1 has biblioitems.totalissues = 0
9) Check biblio 2 has biblioitems.totalissues = 3
10) Without patch the biblio 3 has biblioitems.totalissues = 0
11) With patch the biblio 3 has biblioitems.totalissues = 1
12) Check misc/cronjobs/update_totalissues.pl --incremental is OK
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 91da9841d7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f6d61ce5e0)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
To test:
1 - Set OpacPublic syspref to 'Disable'
2 - Log in to OPAC
3 - Log out
4 - Try to log in again
5 - No error, but you get the login form again
6 - Apply patch
7 - Repeat
8 - This time you can log in again
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit a137b170c0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c188cf91a0)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
The system preference OPACMySummaryNote is used to display on the logged-in patron summary page at OPAC.
It does not display anymore.
Looks like it comes from code :
[% IF OPACMySummaryNote %][% Koha.Preference('OPACMySummaryNote') | $raw %][% END %]
OPACMySummaryNote used to be a provided variable.
Test plan:
1) Enable system preference OPACMySummaryNote
2) Enter some HTML into it
3) Go to OPAC and loggin
4) Check you see the HTML in opac-user.pl
5) Disable the preference
6) Check you dont see the HTML anymore
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d5c501bf63)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0f75bffeeb)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Donna Bachowski <donna@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit b56562f2d0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 50cc72db58)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
With events sometimes leading to unforeseen branch closures (think Coronavirus as
an example), it would be helpful to have a tool that would allow librarians to
update due dates in bulk based on branch and current due date of the material.
It allows to select checkouts given the following parameters:
* libraries
* patron's categories
* range of the due date
You can set a hard due date, or define a number of days to extend the
due date.
Test plan:
Check some items out
Use the new tool to extend the due dates
Test the different filters to make sure they all work
Note: What about holidays?
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 0ff5dc25ff)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7b0d904f88)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.
Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update
4. Apply the patch
5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 35cdeadbdf)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 6ef4c45b84)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
There is a security hole in 2 scripts that are used by the UI to edit
holidays.
To test:
1) Go to Tools -> Calendar, for Centerville
Check no holiday for 30/4/2020
2) To add a new holiday without login execute
a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
with the magic words:
<title>Koha ›
Log in to Koha
</title>
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b3)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
A successful message says that the email has been sent and the order has
been claimed, but nothing happened.
Test plan:
0. Do not apply this patch
1. Create a new vendor, does not create a contact
2. Create some orders, close the basket
3. Go to the late orders page and claims some orders
=> You get a successful message, but the claim has not been done!
4. Apply this patch
5. Claim the orders
=> You get an error
6. Set a contact for the vendor
7. Claim the orders
=> Success
In the docker container, you may need to:
% apt install postfix
% postfix start
Edit /etc/hosts
127.0.0.1 localhost localhost.localdomain
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit c2c7c6e754)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5bccfa152a)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
On
commit a230878b6f
Bug 21296: suspend hold ignores system preference on intranet
See comment 10.
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This patch modifies the DataTable configuration for the table of holds
which displays under the "Holds" tab on the patron's checkout and
details pages. A variable is now defined in the JavaScript with the
value of the "SuspendHoldsIntranet" system preference. This variable is
passed to the DataTable configuration to determine whether the column is
visible or not.
One of the changes made in this patch moves a <script> block so that it
appears before some of the JS includes on the page. This helps keep the
string-defining JS together in one block.
To test, apply the patch and set the "SuspendHoldsIntranet" system
preference to "Allow."
- Open the checkout page for a patron with one or more holds.
- Under the "Holds" tab, the table of holds should have a "Suspend"
column with controls for suspending or resuming holds.
- Check that the same is true on the patron detail page.
- Set the "SuspendHoldsIntranet" system preference to "Don't allow."
- Test the checkout and detail pages again and confirm that the
"Suspend" column does not appear.
Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 541dfa7dde)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cc87e68e0d)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This reverts commit f95749a66b.
https://bugs.koha-community.org/show_bug.cgi?id=23980
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Fixed commit title, no errors
Revised test plan:
- Do not apply the patch
- View koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt
- TEST: Verify that it includes a "jsinclude" block near the bottom of the template
- Apply the patch
- Re-open the template
- TEST: Verify that the "jsinclude" block is now gone
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
We must use Koha::Subscription instead of raw SQL.
It will fix issue with default and integer values.
Test plan:
Edit a subscription and set number of issues = "f"
Save
=> Without this patch there is a SQL error in the log:
Incorrect integer value: 'f' for column 'numberlength'
=> With this patch the other changes are effective.
Note: We also could change the type attribute of the input to "number",
to have a client-side check
Also, the return value of ModSuggestion is never used, so we are safe
with that.
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
The <strict_sql_modes> flag must be present and set to 1 in the <config> section of koha-conf.xml
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
This is a squashed version for backporting to stable branches.
IMPORTANT: It does not move XSLT_Handler to XSLT/Base as in master.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d8bf40281b)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
As shown in the comments on the bug, it appears that Unicode::Normalize
is the most reliable way to strip accents from strings for this use
case.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 27de0d6179)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 708fd8b4b1)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit ad92c14058)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7ad9807353)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
From
commit 295ae33800
Bug 20272: Replace error numbers by codes in XSLT_Handler
"""
Make XSLT_Handler a little bit less noisy by defaulting print_warns to
false unless $ENV{DEBUG} is set. (See also bug 19018).
"""
I think we should warn the errors in the logs. They are not debug messages here, we should not rely on DEBUG.
If too noisy we should fix the original issues, not hide all the errors (which make the XSLT debugging super hard)
Test plan:
Break a XSLT, reload the page and confirm that there are useful errors in the Koha log file
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit ec79582374)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8bcafbe3cf)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Jonathan Druart
Hayley Mapley
Koha translators
Tomas Cohen Arazi
Marcel de Rooy
Liz Rea
Aleisha Amohia
Bernardo Gonzalez Kriegel
Andrew Fuerste-Henry
Owen Leonard
David Cook
Andrew Fuerste-Henry
Nick Clemens
Katrin Fischer
Fridolin Somers
Andrew Isherwood
Martin Renvoize