Commit Graph

37877 Commits

Author SHA1 Message Date
Kevin Carnes ef98fbfb62 Bug 27770: ES: Deprecated aggregation order key [_term] used, replaced by [_key]
Starting in Elasticsearch 6.0 _key should be used instead of _term to order
buckets by their term

To test:
1) Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/Search.t
2) If you observe an error about types, apply patch for bug 25669
3) Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/Search.t
4) Observe if you get a deprecation warning about order key
5) Apply patch
6) Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/Search.t
7) Observe no deprecation warning about order key
8) Sign off

Sponsored-by: Lund University Library
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 2cd93d8ea6)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-05-18 23:06:27 +00:00
Chris Cormack b32611ab55 Update release notes for 19.11.29 release
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-27 09:38:36 +12:00
Chris Cormack 4d15773ada Increment version for 19.11.29 release
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-27 09:18:46 +12:00
Chris Cormack 74f1c05e6a Fix translations for Koha 19.11.29
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-27 09:16:40 +12:00
Koha translators 26b0a99597 Translation updates for Koha 19.11.29
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-27 08:35:54 +12:00
Mason James 3ff9ff5311 Bug 19169: Add a test to detect unneeded 'atomicupdate' files
to test...

1/ set git repo
    $ git reset --hard v21.11.03

2/ run test
    $ prove ./t
    OK

3/ apply patch

4/ run test again, observe FAIL

    $ prove ./t/00-check-atomic-updates.pl
    ./t/00-check-atomic-updates.pl .. 1/?
    #   Failed test 'check for unhandled atomic updates: bug_29596.pl'
    #   at ./t/00-check-atomic-updates.pl line 34.
    #                   'bug_29596.pl'
    #           matches '(?^u:.*pl$)'
    # Looks like you failed 1 test of 3.
    ./t/00-check-atomic-updates.pl .. Dubious, test returned 1 (wstat 256, 0x100)
    Failed 1/3 subtests

JD Amended patch: fix copyright year
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-26 09:55:14 +12:00
Jonathan Druart 5960f44be1 Bug 26328: Add test
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-20 19:43:15 +12:00
David Cook 19fe56dcb9 Bug 26328: Cast barcode from varchar to integer for incremental barcode
Without this patch, the incremental barcode generation will
treat 978e0143019375 as having an exponent and interpret it as a very
large number.

With this patch, the incremental barcode generation will first cast
barcode varchar strings to integers before finding a max() value.
In this case 978e0143019375 becomes 978 instead of
1.7976931348623157e308

Test plan:

0. Using koha-testing-docker

Before applying patch:

1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=autobarcode
2. Set to "generated in the form 1, 2, 3"
3. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=1#additema&searchid=scs_1607059974968
4. Add item with barcode 978e0143019375
5. Click "p - Barcode"
6. Note the barcode is "Inf"

After applying patch:
1. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=1#additema&searchid=scs_1607059974968
2. Click "p - Barcode"
3. Note the barcode is "39999000019194"

Signed-off-by: Marjorie <marjorie.barry-vila@collecto.ca>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-20 19:42:16 +12:00
Fridolin Somers 0e0a9b4a5a Bug 28943: (QA follow-up) Fix opac.pref
Fix YAML syntax of opac.pref, we must use dash for new lines.

Also removes duplicate text before syspref.
No need to say "code" since it is now a list of categories.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-19 09:44:06 +12:00
Marcel de Rooy 24d02038f8 Bug 28943: Lower the risk of accidental patron deletion
If you do not use a temporary self registration patron category,
you should actually make the preference
PatronSelfRegistrationExpireTemporaryAccountsDelay empty.

As the comment in sysprefs.sql already said, we should not let
a zero value in the pref delete patrons too.

The module is changed now, the test adjusted and
the description of both related sysprefs modified.

Test plan:
Run t/db_dependent/Members.t
Check in Administration the two adjusted OPAC pref descriptions.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
2022-04-19 09:43:12 +12:00
Wainui Witika-Park 38d69065b8 Update release notes for 19.11.28 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-16 15:48:06 +00:00
Wainui Witika-Park 115ceeb228 Increment version for 19.11.28 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-16 15:38:30 +00:00
Wainui Witika-Park 2b319db741 Fix translations for Koha 19.11.28
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-16 15:35:38 +00:00
Koha translators 180ea0a19f Translation updates for Koha 19.11.28
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-23 21:01:39 -03:00
Jonathan Druart 2558a52ac5 Bug 30296: [20.11.x] Set path for bibs_selected
Or it does not get cleared. Not that we may want to skip it for master
as bug 29932 is going to replace it with sessionStorage

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
No longer needed too on 21.11 and 21.05.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-15 21:36:09 +00:00
Wainui Witika-Park 88c0d8c23d Merge branch '19.11.x-security' into 19.11.x 2022-03-14 01:03:15 +00:00
Wainui Witika-Park ec3cbd666c Update release notes for 19.11.27 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-09 09:20:55 +00:00
Wainui Witika-Park 0e2a9ba335 Increment version for 19.11.27 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-09 09:11:47 +00:00
Jonathan Druart 8aeac893ce Bug 29956: Prevent login form to be serialized into cookie
To recrate:
Logout
Go to /cgi-bin/koha/opac-search.pl
Click "Log in to your account"
Fill in the login form
Submit
Check the 'form_serialized' cookie's value

=> Without this patch it contain login/password
=> With this patch applied the cookie is not created

Confirm that the "Return to the last advanced search" feature still
works as expected.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-09 01:46:45 +00:00
Marcel de Rooy ab2774aaab Bug 29931: [21.05.x] Check cookie status before continuing
Test plan:
Logout from staff.
Try to run plugins-enable (you should have some active plugin).
Like: https://yourserver:staffport/cgi-bin/koha/plugins/plugins-enable.pl?class=Koha::Plugin::Test&method=enable
Replace class and method as appropriate.
Verify that with this patch, you will be redirected to 401 page.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 29931: (follow-up) Similar thing in opac-patron-image.pl

Although less harmful indeed. No borrowernumber, no image.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested: logged in, logged out, prefs toggled. All fine.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 29931: (follow-up) Fix svc/checkouts and return_claims too

Adding the same auth_status check here too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-09 01:42:38 +00:00
Mason James 91eae0b243 Bug 29881: libdbd-sqlite2-perl is unavailable on deb12 (koha-common wont install)
to test...

- attempt to install koha-common pkg on deb12

  confirm error...
   The following packages have unmet dependencies:
   koha-common : Depends: libdbd-sqlite2-perl but it is not installable

- apply patch, rebuild new package

- install new koha-common pkg on deb12 successfully

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 382e63cc2d)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 9a76176710)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit d43f0b3500)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-03-07 04:04:54 +00:00
Wainui Witika-Park 54f287f018 Update release notes for 19.11.26 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-24 22:38:09 +00:00
Wainui Witika-Park dd60198f5a Increment version for 19.11.26 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-24 22:22:40 +00:00
Wainui Witika-Park 99ee1e7667 Fix translations for Koha 19.11.26
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-24 22:20:26 +00:00
Koha translators 67dc74b606 Translation updates for Koha 19.11.26
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-24 18:51:17 -03:00
Jonathan Druart ff80b5bc65 Bug 30045: (bug 29543 follow-up) Fix SCO print slip
Certainly since bug 29543 and bug 29914.

We should do the same authentication check than sco-main.pl, and also
make sure to generate the checkout history only for the logged in patron
(the OPAC one, not staff member)

Test plan:
Use the different combinations of the SCO config (AutoSelfCheckAllowed,
SelfCheckoutByLogin and WebBasedSelfCheck) and confirm that this patch
fixes the SCO print slip feature.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 72fa33490b)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 26cbc70d19)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 9416f10fa5)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 18:02:32 +00:00
Owen Leonard 35ab9a4a32 Bug 26102: [19.11] Prevent XSS when To.json is used: unimarc_field_4XX.tt
To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Owen Leonard 2aca4200ec Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt
To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Owen Leonard 3c3237ca87 Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt
To test, perform a search in the catalogue and verify that search term
highlighting works correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Owen Leonard 8401cd292c Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt
Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Owen Leonard b4dbedbcd4 Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt
Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Owen Leonard 383e7b8b9e Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt
Test that preference search term highlighting works correctly.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-22 00:31:47 +00:00
Wainui Witika-Park 726d3e1808 Revert "Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt"
This reverts commit f2063ecd9f.
2022-02-21 04:58:10 +00:00
Wainui Witika-Park 39c42f6a2c Revert "Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt"
This reverts commit 711848f856.
2022-02-21 04:58:03 +00:00
Wainui Witika-Park dbc4f4df25 Revert "Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt"
This reverts commit 9179e5b707.
2022-02-21 04:57:56 +00:00
Wainui Witika-Park 92af04b913 Revert "Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt"
This reverts commit 55c003f4af.
2022-02-21 04:57:49 +00:00
Wainui Witika-Park dc60546452 Revert "Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt"
This reverts commit 2b332eb5bf.
2022-02-21 04:57:40 +00:00
Wainui Witika-Park cbb3dab4d7 Revert "Bug 26102: Prevent XSS when To.json is used: subscription-add.tt"
This reverts commit 1048a5935b.
2022-02-21 04:57:32 +00:00
Wainui Witika-Park 93ff5a2b3e Revert "Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt"
This reverts commit 155aa985a8.
2022-02-21 04:57:23 +00:00
Wainui Witika-Park a5e1d77927 Revert "Bug 28926: Update cpanfile for Mojolicious::Plugin::OpenAPI v2.16"
This reverts commit 6696cef07d.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-21 03:51:37 +00:00
Mason James 6696cef07d Bug 28926: Update cpanfile for Mojolicious::Plugin::OpenAPI v2.16
to test...
 - apply patch
 - build package
 - confirm in about.pl that minimum versions are updated

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit bfd033c68a)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 81ce0e2db5)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 2b19368e1c)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-02-15 03:46:38 +00:00
Wainui Witika-Park 59e20a86f0 Update release notes for 19.11.25 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-31 03:38:43 +00:00
Wainui Witika-Park 80b7e424f8 Increment version for 19.11.25 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-31 03:14:36 +00:00
Wainui Witika-Park 1392bfd765 Fix translations for Koha 19.11.25
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-31 03:12:22 +00:00
Wainui Witika-Park a7b7113217 Merge remote-tracking branch 'translate/19.11.25-translate-20220131' into 19.11.25
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-31 02:55:03 +00:00
Koha translators ed45309173 Translation updates for Koha 19.11.25
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-31 03:29:26 -03:00
Jonathan Druart 2ec64eaa23 Bug 29903: Prevent messages to be deleted from unauthorised users
The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a2b9a76431)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 5f9b8321ae6b2f5adc9e0c21dcd9f780b59c47d5)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-30 23:53:45 +00:00
Jonathan Druart 7b00bf7ddb Bug 29542: Prevent access to private list to non authorized users
The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6ca49b550e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 2c41540b3bca62f8194b8392a283325411780ace)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-30 23:30:36 +00:00
Jonathan Druart a865baaee7 Bug 29914: Remove 'Use of uninitialized value ' warnings
(cherry picked from commit 68c11c5179)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 7d4fb54aead7133cdfd7400d3d5c8c06ad3d7034)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-26 04:19:57 +00:00
Nick Clemens 7816103503 Bug 29914: (QA follow-up) Add comment to explain last case
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

JD amended patch: remove ref to line number

(cherry picked from commit a866722ae6)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 0886a2f1e607272feb2fa101f7616343a02223be)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2022-01-26 04:19:50 +00:00