The new servicing instructions UI on the "add order" form was showing
unconditionally, even when the EDIFACT system preference is disabled
or the vendor has no EDI account configured. Elsewhere in acquisitions
(e.g. acqui/basket.tt) EDI-only UI is gated on
Koha.Preference('EDIFACT') && ediaccount, so apply the same check here.
Test plan:
1. With EDIFACT disabled, or EDIFACT enabled but the vendor has no
entry in vendor_edi_accounts, open Acquisitions > a basket > Add
order (neworderempty.pl)
=> No "Servicing instructions" field is shown
2. Enable EDIFACT and add a vendor_edi_accounts row for the vendor
=> The "Servicing instructions" field appears and behaves as before
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Test Plan:
1. Pre-checks:
a. Observe plack-intranet-error.log.
b. Make sure you have one fund with a subfund which also have a
subfund.
2. After each followings, verify there are new logs in
plack_intranet-error.log, check that the fund dropdown contains no ">"
a. In staff interface go to Acquisitions module.
b. Navigate to Advanced Search
c. In a basket create an order by clicking on "Add to basket" ->
"From existing orders (copy)"
3. Apply patch
4. run prove t/db_dependant/Budgets.t
5. Redo 2. and notice there is no log anymore and subfunds are marked
with >, subsubfunds with >>
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
The RM's review found two stored XSS vectors in the servicing
instruction free-text (LVT) handling:
1. neworderempty.tt embedded the servicing instruction JSON (and the
EDIFACT_SI authorised values list) directly into an inline <script>
block via JSON.parse('[% ... | $raw %]'). TT's html filter does not
escape single quotes, so a free-text value like
test' + alert(1) + ' broke out of the JS string literal and
executed on the next page load of the edit form.
2. basket.pl built the "Servicing instruction" column display by
concatenating raw LVC/LVT values with '<br>' and rendering the
result with | $raw in basket.tt, so HTML/script content in a
free-text value executed directly on the basket page.
Fix the first by moving the JSON into existing/new hidden input
value="" attributes (escaped with the html filter, which is safe for
double-quoted HTML attributes) and reading them back via jQuery's
.val() before JSON.parse(), instead of interpolating untrusted data
into a JS string literal.
Fix the second by passing the display parts to the template as a list
and escaping each with the html filter at render time, instead of
building a pre-escaped raw HTML string in Perl.
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This patch adds the user interface for managing and displaying
EDIFACT servicing instructions in the acquisitions module.
Changes to acqui/neworderempty.pl:
- Parses servicing_instruction JSON for editing existing orders
- Fetches EDIFACT_SI authorized values for dropdown
- Passes data to template in both array and JSON formats
Changes to acqui/addorder.pl:
- Accepts servicing_instruction_groups_json from form submission
- Validates and stores JSON in database
Changes to acqui/basket.pl:
- Fetches EDIFACT_SI authorized values
- Formats servicing instructions for display in get_order_infos()
- Creates human-readable display strings with:
* LVC codes replaced with descriptions
* Groups separated by <br> tags
* Format: "Description" or "Description: free text"
Changes to neworderempty.tt:
- Dynamic UI for adding/removing servicing instruction groups
- Each group can contain:
* One LVC (coded) instruction only, OR
* One LVT (free-text) instruction only, OR
* One LVC + one LVT combination
- Validation prevents:
* More than 2 instructions per group
* Duplicate LVC or LVT in same group
- LVC instructions use dropdown populated from EDIFACT_SI authorized values
- LVT instructions use free-text input
- Groups serialized to JSON hidden field for form submission
- Smart button labels show what can be added to each group
Changes to basket.tt:
- Displays servicing instructions in basket table
- Pre-formatted in Perl (no JavaScript parsing needed)
- Shows LVC descriptions instead of codes
- Multiple groups displayed on separate lines
Changes to columns_settings.yml:
- Adds servicing_instruction column to basket table configuration
Display format examples:
- LVC only: "Barcode labelling"
- LVT only: "Handle with care"
- Combined: "Binding: Apply to spine"
- Multiple groups (on separate lines):
Barcode labelling
Binding: Special instructions
Test plan:
1. Create/edit order
2. Add servicing instruction groups
3. Try to add more than 2 instructions to a group (should prevent)
4. Try to add duplicate LVC or LVT to group (should prevent)
5. Save order
6. View basket and verify instructions display correctly
7. Edit order and verify instructions load into form
Sponsored-by: Martin Renvoize <martin.renvoize@gmail.com>
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Test plan:
1. Create an order with multiple items and receive the order in full
2. From the vendor record, click Receive shipments
3. You should be in parcels.pl and the table should show your shipments
4. There will be no column displaying the total
5. Apply patch and restart_all
6. Refresh the page, the column should now be visible showing the total
Signed-off-by: Coleen Lilly <clilly@aacpl.net>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
The invoice page previously fetched all edifact_errors for the EDI
message, causing errors from unrelated invoice lines to appear on every
invoice generated from the same EDI file. For example, one unmatched
ordernumber in a file with 20 invoices would flag all 20 as having
errors.
Now only errors where invoicenumber matches the current invoice (or
where invoicenumber is NULL, indicating a message-level error) are
displayed.
Signed-off-by: Ray Delahunty <lib-systems@arts.ac.uk>
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
In order to tidy all the script tags of the .tt files we isolate the
interpolation of Template::Toolkit variables in a separate script tag.
This patch focuses on the acquisition module.
The 2 main changes are in the following files:
* basket.tt
It's mostly about table settings and the visibility of columns depending
on syspref:
- "supplier report" / EDIFACT
- "modify" / if basket is not closed
- "cancel" / CancelOrdersInClosedBaskets
* neworderempty.tt
trivial changes, no error or warning in the console should appear.
Confirm than createing a new order works as expected.
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
The outer SELECT hardcoded unitprice_tax_included while the inner
subquery selects the field returned by FieldsForCalculatingFundValues.
With CalculateFundValuesIncludingTax disabled the derived table only
exposes unitprice_tax_excluded, so spent.pl dies with:
Unknown column 'unitprice_tax_included' in 'field list'
To test:
1. Set CalculateFundValuesIncludingTax to 'Exclude'
2. View spent.pl for a fund with received orders
3. Observe error 500
4. Apply patch, restart_all
5. Reload, page renders correctly
6. Set CalculateFundValuesIncludingTax back to 'Include'
7. Reload, page still renders correctly
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
To test:
1 - Have some received orders and some invoice adjustments
2 - View spent.pl for a fund
3 - Apply patch, restart_all
4 - Reload
5 - Confirm the display has not changed
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
The warnings look like:
[2026/05/08 15:02:42] [32918] [WARN] Variable "@messages" is not available at /usr/share/koha/intranet/cgi-bin/acqui/basket.pl line 698.
[2026/05/08 15:02:42] [32918] [WARN] Variable "$op" is not available at /usr/share/koha/intranet/cgi-bin/acqui/basket.pl line 704.
Note in the fix, we are switching to the "our" keyword. When we declare
things with "our", and we run this under plack, those variables and
values persist across multiple requests! Due to this behavior we always
need to reinitialize anything that uses "our" unless we specifically
want that behavior ( like caching ).
Test plan:
1) Send an EDI order, note the warnings in the logs
2) Apply this patch
3) Restart all the things!
4) Send another EDI order, note the warnings are gone!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
By limiting the data sent to libmagic to 100 characters, we make
the test faster and we avoid situations where a large or malicious
file causes too many resources to be used.
100 characters is more than enough for the file types we're allowing.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This patch uses File::LibMagic to determine the real file type using
libmagic and magic numbers of invoice files, and allows a select group
of file types to be viewed inline for user convenience.
Note that a default Content-Security-Policy is still included to offer
an extra layer of protection against XSS.
Test plan:
0a. Apply the patch
0b. koha-plack --restart kohadev
1. Enable the syspref AcqEnableFiles (ie set to Do)
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Click "Finish receiving"
7. Click "Manage invoice files"
8. Upload a range of files including SVG, PDF, PNG, TXT
9. Click on the "Download" button
10. Note that the file downloads for all types
11. Click on the link in the "Name" column
12. Note that only the PDF and PNG display inline in the browser.
The other file types should be downloaded same as if you clicked the
"Download" button.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Serve invoice files with a CSP header that prevents XSS
instead of with an attachment header that turns them into
downloads.
Testing plan:
- Set AcqEnableFiles preference to Do
- Acquisitions > Vendor > Receive Shipment > Create invoice
- Finish Receiving > Manage invoice files
- Upload an SVG with a <script> tag in it
- Click the SVG filename to open it
- Inspect browser's console: it should say something about a
script being blocked due to the CSP directive
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
ConnectDuplicate does not appear to be used anywhere.
No test plan to provide here.
git grep connectDuplicate should return nothing
Since there is no cud-, it would at least have been broken for a year
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Correct genuine spelling errors identified by the codespell 2.4.x
full scan after the KTD container OS upgrade. Changes are in
comments, POD, strings, and template text across 55 files.
"SAN Ouest Provence" (the French library co-operative and Koha
sponsor) is preserved as a proper noun. Perl copyright lines
receive an inline # codespell:ignore annotation; about.tt files
(contributor attribution pages) are added to the Koha::Devel::Files
codespell exception list so that future uses of "Provence" as a
typo for "Province" are still caught in all other files.
Notable user-visible fixes:
- "submiting" -> "submitting" in authority and bibliographic merge screens
- "deleteable" -> "deletable" in patron exception messages
- "Acquistions" -> "Acquisitions" in reports dictionary
Test plan:
1. Apply patches
2. In the staff interface, go to Cataloguing > Merge records and
confirm the submit button reads "Submitting" (not "Submiting")
3. In the staff interface, go to Authorities > Merge and confirm
the same correction
4. Attempt to delete a patron with outstanding issues and confirm
the error message reads "deletable" (not "deleteable")
5. prove xt/author/codespell.t
=> All tests pass
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Amended-by: Jonathan Druart
Tidy C4/Search.pm
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes it so that invoice-files.pl returns 404 if
AcqEnableFiles is disabled
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
3. Note that you see a 404 page
4. Change "AcqEnableFiles" syspref to "Do"
5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
6. Note that you now see a "Files for invoice" page
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch implements a JSON representation of EDIFACT interchanges for enhanced
programmatic access and debugging capabilities.
Backend Changes:
- Add to_json() method to Koha::Edifact module
- Structured JSON output with header, messages array, and trailer
- Segment parsing with raw data, elements arrays, and line_id tracking
- Line item grouping using LIN segment identifiers
Frontend Changes:
- Add JSON download button to edimsg.pl page
- Support for ?format=json parameter and Accept: application/json header
- Proper HTTP content-type handling for JSON responses
- Error handling for missing messages in JSON format
JSON Structure:
{
"header": "UNB+UNOC:3+...",
"messages": [
{
"header": "UNH+1+QUOTES:D:93A:UN:EAN008'",
"segments": [
{
"tag": "LIN",
"raw": "LIN+1+1+9780552150040:EN'",
"elements": ["1", "1", "9780552150040:EN"],
"line_id": "1"
}
],
"trailer": "UNT+25+1'"
}
],
"trailer": "UNZ+1+1'"
}
Test plan:
1. Apply this patch
2. Ensure you have EDIFACT messages in your system
3. Go to Acquisitions > EDIFACT messages
4. Click "View message" for any message
5. Click the new "JSON" button
6. Verify JSON downloads with proper structure
7. Verify direct URL access with ?format=json parameter works
8. Test with Accept: application/json header
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
Create, edit and receive a command from a suggestion (the lonely call
of modReceiveOrder is at the receipt in acqui/finishreceive.pl)
Run `prove prove t/db_dependent/Acquisition.t`
Run `prove prove t/db_dependent/Suggestions.t`
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
See bug 41324 comment 6
1. Variable serialization
2. Use of permissions and sysprefs
We also removed 'UniqueItemFields' from the controller.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1 - Create suggestion
2 - Display a suggestion
3 - Amend a suggestion
To do with and without patch
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Amended-by: Jonathan Druart
tidy
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Generated using
`perl misc/devel/tidy.pl --perl`
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Attempt to call undefined import method with arguments (get_active) via package Koha::Acquisition::Currencies (Perhaps you forgot to load the package?) at acqui/addorder.pl line 133.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When po_is_basketname is enabled for a vendor, duplicate purchase order
numbers should prevent both automatic ordering (auto_orders) and manual
UI-triggered ordering to avoid conflicts with existing baskets.
This patch implements blocking functionality that:
1. Auto-orders blocking:
- Tracks baskets with PO number conflicts during quote processing
- Skips auto-ordering for baskets with duplicate PO numbers
- Logs clear warnings about blocked baskets
2. UI basket ordering blocking:
- Adds duplicate checking in create_edi_order function
- Returns detailed error information when conflicts detected
- Prevents EDI order creation for conflicting baskets
3. User-friendly error handling:
- Updates basket.pl to handle duplicate PO number errors
- Stays on basket page to display error messages
- Provides clear messaging about conflicts and resolution steps
4. Template messaging:
- Adds clear error message explaining duplicate PO conflicts
- Shows which existing basket uses the same PO number
- Guides users on next steps to resolve the issue
This ensures data integrity and prevents order processing conflicts
while providing clear feedback to users about duplicate PO number
issues.
Test plan:
1. Set up a vendor with EDI account and enable "po_is_basketname"
2. Create a basket with a specific name (e.g., "PO12345")
3. Process an EDIFACT quote that contains the same PO number:
- If auto_orders is enabled: verify the new basket is created but NOT automatically ordered
- Check the logs show "Auto-order blocked" message
4. For UI testing, create another basket manually with the same name
5. Try to generate EDI order via "Generate EDI order" button
6. Verify: Error message appears stating duplicate PO number conflict
7. Verify: Basket remains open (not closed)
8. Verify: Error message shows which existing basket uses the PO number
9. Test with po_is_basketname disabled: verify normal operation continues
10. Test with unique PO numbers: verify orders process normally
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Sponsored-by: Westminster City Council <https://www.westminster.gov.uk/>
Sponsored-by: Royal Borough of Kensington and Chelsea <https://www.rbkc.gov.uk/>
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When a basket is created from an EDI quote with the vendor EDI account configured
to use purchase order numbers, the basket name should be protected from changes
to maintain the integrity of the purchase order number reference.
This patch:
- Makes the basket name field read-only in the UI when the basket was created
from EDI with purchase order number setting
- Adds explanatory text when the field is protected
- Implements server-side protection to prevent basket name changes even if
the UI is bypassed
- Preserves the original purchase order number derived name
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Sponsored-by: Westminster City Council <https://www.westminster.gov.uk/>
Sponsored-by: Royal Borough of Kensington and Chelsea <https://www.rbkc.gov.uk/>
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch extends the EDIFACT message display functionality from the invoice page
to the basket page, providing comprehensive access to EDIFACT messages and error
reporting.
Features added:
- Toolbar buttons for viewing EDIFACT messages (quote/order)
- Smart button display: single button for one message type, dropdown for multiple
- EDIFACT parsing errors section with inline error display
- Errors grouped by message type with detailed information
- Conditional display: only shows when relevant data exists
Changes:
- acqui/basket.pl: Added EDIFACT message and error collection logic
- basket.tt: Added toolbar buttons and parsing errors section
- Uses existing modal system for raw message display
Sponsored-by: Open Fifth <https://openfith.co.uk>
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This enhancement adds an EDIFACT message section to the invoice display page.
If there's a linked EDI Message for this invice, we display the basic
details along with any parsing errors that may have been recorded and we
add a button to trigger the display of the raw message in a modal.
Changes include:
- Display EDIFACT message information on invoice page when available
- Show message type, transfer date, status, and filename
- Add "View EDIFACT message" button that opens modal with raw message
- Display EDIFACT processing errors directly on invoice page
- Create reusable modal components for EDIFACT message display
The implementation checks if the EDIFACT system is enabled and if the
invoice has an associated message_id before displaying the EDIFACT
section. Processing errors are highlighted in a warning box with
clear formatting.
Sponsored-by: Open Fifth <https://openfith.co.uk>
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test using a new empty record:
1. Ensure you have a vendor and a new basket available for ordering.
Click on “+Add to basket” and select “From a new (empty) record”
2. Choose an existing record to test with for example “CSS : the
definitive guide”
(http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=12&searchid=scs_1759160315801)
3. Copy over the main details from the existing record in order to fill
out the required details of the new order. I.e Title, and Koha item
type. Click add item and then select a fund. It’s not necessary to
fill anything else out.
4. Click save and notice that the duplicate record is not found.
5. Apply the patch and restart_all. Clear cache in your browser if
necessary.
6. Repeat steps 2 - 4. This time a duplicate warning will appear. Ensure
that all options of the duplicate warning work as expected.
7. Sign off and have a great day!
Signed-off-by: Kim Gnerre <kgnerre@hotchkiss.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When a basket is generated via an EDI QUOTE message, the QUOTE message
includes a library's EAN code (buyer_ean). This patch makes the 'Create
EDIFACT order' button automatically use the EAN from the original QUOTE
message instead of requiring manual EAN selection.
This patch also fixes a bug in process_quote where all baskets in
multi-message QUOTE transports incorrectly used the first message's
buyer_ean, even when subsequent messages had different EANs.
Changes made:
1. Fixed Koha/EDI.pm process_quote auto-order creation to use the correct
buyer_ean for each message/basket pair in multi-message transports
2. Enhanced acqui/basket.pl to extract and provide the quote_ean from
QUOTE messages, handling both single and multi-message scenarios
3. Updated basket.tt template to automatically select the EAN from the
original QUOTE message when available and matching
Test plan:
1. Create a vendor with EDI account and multiple EANs configured
2. Process a QUOTE message that creates a basket
3. Go to the basket page and click "Create EDIFACT order"
4. Verify it automatically uses the EAN from the QUOTE message
(shows tooltip "Using EAN from original QUOTE message")
5. Test with multi-message QUOTE files to ensure each basket uses
the correct EAN from its corresponding message
6. Verify fallback behavior when no QUOTE EAN matches available EANs
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Hannah Dunne-Howrie <hdunne-howrie@westminster.gov.uk>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Add EAN account information to EDIFACT order confirmation message
when the BasketConfirmations system preference is enabled.
To test:
1. Set EDIFACT system preference to Enable
2. Set BasketConfirmations system preference to Enable
3. Create at least 2 EANs, one with a description and one without a
description
i. Go to Acquisitions > Library EANs
ii. Click "New EAN" and fill in the fields
4. Create an EDI account
i. Go to Acquisitions > EDI accounts
ii. Click "New account"
iii. Click Submit (for testing purposes you don't need to fill in
the fields)
5. Find or create a basket for the same vendor that's on the EDI account
6. Add an order to the basket from any source
7. In the menu bar at the top of the basket screen, click "Create
EDIFACT order" and select an EAN
--> Note that the confirmation page doesn't tell you which EAN was
selected
8. Click "No, don't close"
9. Apply patch and restart_all
10. Repeat step 7
--> The confirmation page should now display both the basket and the
selected EAN
11. Click "Cancel"
--> Confirm that the basket is still open
12. Repeat step 7
13. Click "Yes, generate order and close basket"
--> Confirm the basket is closed
14. Click "EDIFACT messages" in the sidebar menu
--> Confirm that you see a message with type ORDERS for that basket
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If an order is added from a suggestion in the first place, the
suggestion automatically changes status to ORDERED, and a notice is
sent out to the patron. If a suggestion is linked to the order after
the fact, it should move to ORDERED and notify the patron as well.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This enhancement allows library staff to link an order (in an unclosed basket, or a standing order) to an accepted suggestion.
To test:
1) In the staff interface, go to Suggestions and create at least two suggestions.
2) Mark at least two suggestions as Accepted.
3) Go to Acquisitions, create a vendor if you don't have one already.
4) Have or create two baskets - one should be standing, and one not standing (normal).
5) In the normal basket (not standing), add an order from any source but NOT from a suggestion.
6) When you save the order, there should be a new link in the Modify column of the Orders table - "Search for suggestion to link". Click this.
7) Choose one of your suggestions to link to the order.
8) You should be redirected back to the basket. Confirm your order has been correctly linked to the suggestion. Confirm there is no link to "Search for suggestion to link" for this order now that a suggestion has already been linked.
9) Add another order to this basket from any source but NOT from a suggestion.
10) Close the basket. Confirm there is no link to "Search for suggestion to link" because the basket is closed, but you could reopen the basket to link the order if you wanted to.
11) Go to Baskets in the left navigation so you can find your standing basket.
12) Add an order to your standing basket from any source but NOT from a suggestion.
13) Go to the vendor and Receive shipments. Receive your standing order and finish receiving.
14) Go to the standing basket. There should be a new unreceived standing order for the record you just received, with a link to "Search for suggestion to link". Click this.
15) Choose a suggestion to link to the order.
16) You should be redirected back to the basket. Confirm your orders for this record have been correctly linked to the suggestion.
Sponsored-by: Pymble Ladies' College
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1) Navigate to a vendor record and select the baskets view from the left menu
2) Click "add to basket" in the table
3) A modal will display requiring the user to define a budget and fund
4) Apply patch and restart_all
5) Repeat steps 1 and 2
6) You will get the modal to add to the basket
Signed-off-by: David Nind <david@davidnind.com>
Amended-by: Jonathan Druart
Remove import of GetBudget
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch addresses
- Translation issues in VendorList
- Removing the pagers from the contracts table
- Removing redundant code from the vendors template file
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch restores any links that previously pointed to booksellers.pl as this script is still in use. All references to supplier.pl remain pointed at the new Vue app
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a permissions store and utility methods for implementing permissions checks in a Vue app
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds the base vue app as well as the component to list vendors
Amended-by: Jonathan Druart
chmod 755 acqui/vendors.pl
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Martin Renvoize
Baptiste Wojtkowski
Matt Blenkinsop
Jonathan Druart
Paul Derscheid
Nick Clemens
Kyle M Hall
David Cook
Eric Phetteplace
Petro Vashchuk
Laura_Escamilla
Tomas Cohen Arazi
Emily Lamancusa
Aleisha Amohia
Matt Blenkinsop