The web-based self-checkout (opac/sco/sco-main.pl) builds the
response JWT cookie with -expires => $jwt ? '+1d' : ''. On logout
$jwt is undef, so the cookie is sent with an empty value and no
Expires attribute - i.e. a session cookie with an empty value
rather than a deletion. Some browsers/proxies retain the previous
valid JWT in this scenario, which presents as the Finish/close
button "doing nothing" or working only intermittently: the patron
appears to remain logged in despite clicking Finish.
Use a past Expires ('-1d') when no JWT is present so the browser
deletes the cookie entirely. The subsequent ?op=logout render
cannot then rediscover the patron from a stale cookie.
Test plan:
1. Enable web-based self-checkout (SelfCheckoutByLogin or
SelfCheckAllowByIPRanges).
2. Log in as a patron at /cgi-bin/koha/sco/sco-main.pl.
3. Open DevTools -> Application -> Cookies and note the JWT cookie.
4. Click the green "Finish" button.
5. Without the patch: Set-Cookie on the ?op=logout response shows
JWT= with no Expires; the cookie persists as an empty session
cookie.
6. With the patch: Set-Cookie shows JWT=; expires=<past date>; the
browser removes the cookie entirely.
7. Confirm the kiosk reliably returns to the login screen and
subsequent page loads do not re-authenticate from a stale JWT.
Sponsored-by: OpenFifth
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
AllowItemsOnHoldCheckoutSCO was previously passed through to
CanBookBeIssued as the ignore_reserves flag, which skipped the entire
holds branch in C4::Circulation and silently allowed checkout of
items already waiting on the hold shelf (reserves.found = 'W') or in
transit/processing for another patron's hold.
With the pref now a 3-value Choice:
0 = don't allow checkout of any held items
1 = allow checkout of items with a pending hold only
2 = allow checkout of items with any hold state
sco-main.pl now always calls CanBookBeIssued with ignore_reserves=0
and filters the needsconfirmation keys according to the pref value,
mirroring the pattern SIP already uses. RESERVE_WAITING, TRANSFERRED
and PROCESSING are added to the error-matching list and to the SCO
template so patrons see a specific "on the hold shelf" / "in transit"
/ "being processed" message instead of falling through to the generic
"please see a member of the library staff" line.
Test plan:
- Enable WebBasedSelfCheck; log in to /cgi-bin/koha/sco/sco-main.pl.
- Create an item with a pending hold for another patron
(reserves.found IS NULL).
- With AllowItemsOnHoldCheckoutSCO = 0, scan the barcode: checkout is
refused with "This item is on hold for another patron".
- Switch to 1 ("Allow pending holds only"): checkout succeeds.
- Set the hold to waiting (reserves.found = 'W') and try again with
the pref still at 1: checkout is refused with "This item is waiting
on the hold shelf for another patron".
- Switch to 2 ("Allow pending and waiting holds"): checkout succeeds.
- Repeat with found = 'T' and 'P' at pref = 1 -> refused with the
appropriate transit/processing message; at pref = 2 -> allowed.
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch applies the new style preferences to the preview display and
email sending code.
Sponsored-by: Open Fifth <https://openfifth.co.uk>
Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The code in the controller is not longer used. We should also restore
the default value (120)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This follow-up patch addresses feedback from the QA process:
1. System preference naming consistency
Renamed the following preferences to remove "OPAC" prefix and align
with the FineNoRenewals naming convention:
- OPACFineNoRenewalsIncludeCredits → FineNoRenewalsIncludeCredits
- OPACFineNoRenewalsBlockAutoRenew → FineNoRenewalsBlockAutoRenew
2. Self-checkout backward compatibility
Added new system preference FineNoRenewalsBlockSelfCheckRenew to
control whether fine limits block renewals via web-based self-checkout.
Previously, OPACFineNoRenewals did not block self-checkout renewals.
With the rename to FineNoRenewals, this behavior changed. The new
preference defaults to "0" (don't block) to maintain backward
compatibility, allowing sites to opt-in to blocking self-checkout
renewals when patrons exceed the fine threshold.
Test plan:
1. Run prove t/db_dependent/Circulation.t - all tests should pass
2. Run prove t/db_dependent/api/v1/checkouts.t - all tests should pass
3. Verify system preferences are correctly renamed in the admin interface
4. Test self-checkout renewals with FineNoRenewalsBlockSelfCheckRenew
set to 0 (default) - renewals should work even when fines exceed limit
5. Test self-checkout renewals with FineNoRenewalsBlockSelfCheckRenew
set to 1 - renewals should be blocked when fines exceed limit
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
An alternative approach to the original submission for bug 9762. Instead
of recording a distinct action log line for a set of override messages
in addition to the standard issue record, this patch updates the
existing issue log to include any confirmation or impossible responses
from the preceeding CanBookBeIssued call.
We continue to record these as a JSON structure as the prior patch did,
but instead of human messages we use the predefined codes as returned
from the existing CanBookBeIssued response.
To test:
After each step, a single action log message should be displayed under
`Tools > Log viewer`. The message itself will now consist of a JSON
string with an array of 'confirmations' and 'forced' strings
representing the overriden feedback from CanBookBeIssued.
Circulation -- Checking out
1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride
syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit
(AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride
and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else
(AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions
Circulation -- Checking in
11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in
Circulation – Renewing
13) Renew an item on hold for someone else
(AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals
(AllowRenewalLimitOverride syspref)
Holds
15) Place a hold for a patron who is not allowed to place this item
type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of
holds
17) Place an item-level hold when rules dictate that this is not
allowed
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).
To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Bug 36586: Add sc-timer to sco
This patch implements the timer form the last patch on the sco
To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Bug 36586: Fix tidy
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Bug 35065 moved to additional contents.
Remove call in opac/sco/help.pl.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is generated using:
% perl misc/devel/tidy.pl
*within* ktd, to get the same version of perltidy than what will be used
by our CI (currently v20230309).
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. APPLY PATCH and restart_all
2. Make sure the following errors when issuing in SCO show just the error, no other info. on screen:
DEBT
RENEW_ISSUE
ISSUED_TO_ANOTHER
RESERVED
TRANSFERRED
INVALID_DATE ( cant test in SCO )
TOO_MANY
RECALLED
Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
So that this functionality can be controlled separately from staff-side batch checkouts
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This tidies the whole file as the patchset touched so much that we
basically needed to tidy all to make the QA scripts clean.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This enhancement modifies the self-checkout script to better handle 'impossible' and 'needs confirmation' checkout messages.
Test with a combination of barcodes that would invoke these messages, for example:
- impossible: barcode doesn't exist
- impossible: barcode is for a 'notforloan' item type
- impossible: debt
- needs confirmation: barcode already checked out, i.e. confirm renewal
Include barcodes that should have successful checkouts too.
Also, test with the following sysprefs:
- BatchCheckouts: enabled
- BatchCheckoutsValidCategories: none selected
Confirm SCO does not have a multi-line text area for more than one barcode, and doesn't accept more than one barcode.
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch encourages the user to check out certain items individually if they fail to be checked out in a batch.
This way they will be presented with more useful error messages.
To test:
1 - Enable BatchCheckouts, select nothing in BatchCheckoutsValidCategories
2 - Find three barcodes
3 - log into SCO with a user in category Patron, paste the barcodes separated by newlines and submit. confirm one item is succcessfully checked out and the other two barcodes are listed in the pop-up, encouraged to try checking out individually.
4 - select Patron in BatchCheckoutsValidCategories
5 - log into SCO with your Patron user again, confirm you can check out multiple items at a time
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch ensures we check the categorycode of the patron trying to issue the items is valid (based on BatchCheckoutsValidCategories), rather than the categorycode of the AutoSelfCheckAllowed patron.
To test:
1 - Enable BatchCheckouts, select nothing in BatchCheckoutsValidCategories
2 - confirm AutoSelfCheckAllowed is allowed and contains the username and password for the self_check user. Confirm self_check user is in category Staff
3 - log into SCO with a user in category Patron, confirm you can only check out 1 item at a time
4 - select Patron in BatchCheckoutsValidCategories
5 - log into SCO with your Patron user again, confirm you can check out multiple items at a time
Sponsored-by: Koha-US
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch allows more than one item to be scanned and processed at once in Koha's self-checkout module. The items in the batch will still be handled one-by-one, so if any item in the batch requires confirmation (i.e. to be renewed or returned) or is impossible to check out, the process will stop at that item. Any items earlier in the list will be processed, but any items coming after in the list will be ignored. This feature uses the existing BatchCheckouts and BatchCheckoutsValidCategories system preferences to determine if batch checkouts should be allowed.
To test:
1) Open the staff interface. Go to Koha Administration -> Global system preferences. Search for "BatchCheckouts". Confirm BatchCheckouts syspref is disabled, and no categories are selected for the BatchCheckoutsValidCategories syspref.
2) In another tab, open the OPAC self checkout (found out OPACBaseURL/cgi-bin/koha/sco/sco-main.pl) and log in
3) Confirm the self-checkout works as normal for checking out, returning or renewing one item at a time
4) Go back to the staff interface tab (you may need to log back in). Enable the BatchCheckouts syspref but leave the BatchCheckoutsValidCategories syspref empty.
5) Refresh the OPAC self checkout tab. The barcode input field will now be bigger to support a list of barcodes. Enter a list of barcodes separated by newlines and Submit.
6) Only the first barcode should be processed. This is because no categories are valid for BatchCheckouts.
7) Go back to the staff interface tab (you may need to log back in). Select at least your patron category for the BatchCheckoutsValidCategories syspref and Save.
8) Refresh the OPAC self checkout tab. Enter a list of barcodes separated by newlines and Submit. Confirm all valid items are checked out as expected.
9) Test with a few items that are notforloan or would not be valid checkouts. Confirm they are not checked out, but other valid items in the batch are checked out successfully.
10) Test with a batch where one of the items is already checked out to the patron. The batch should get blocked at this item as the self-checkout asks for confirmation.
11) Test with both renewing and returning of items that are already checked out to the patron. This will only work with one item at a time and later items in the list will be ignored.
Sponsored-by: Koha-US
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Move the check to C4::Auth.
Yes, it's not nice, I didn't expect to add exception to this code, and
it's adding more ugly code to get_template_and_user, but... Suggestions
welcome!
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
We should no longer need to check CSRF token from pl files
TODO - there is a change for some files where we returned 403
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We do not longer need to generate_csrf from pl files
TODO - members/boraccount.tt and sco/sco-main.tt needs to be adjusted
Bug 34478: [TO SQUASH] Remove generate_csrf from pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This patch adds a enw system preference SCOLoadCheckoutsByDefault
When enabled, a patron's list o fcurrent checkouts will be loaded when the sign in to the SCO
module. If disabled, they will see link to load their checkouts. In either case, a new section
is added to the SCO to show a brief display of the last checked out it
To test:
1 - Enable WebBasedSelfCheck system preference
2 - Browse to:
http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
3 - Sign in the SCO user (or enable AutoSelfCheck)
4 - Sign in as a user with several items checked out
5 - Confirm you see a list of items checked out
6 - Apply patches, updatedatabase, restart_all
7 - 'Finish' and login patron to SCO again
8 - Confirm you still see the list
9 - 'Finish'
10 - Chenge the system preference
11 - Sign in to SCO, confirm checkouts do not load
12 - Confirm you see 'Load your checkouts' link
13 - Check an item out
14 - Confirm you see the last checkout, but not a list
15 - Attempt to checkout an item that cannot be checked out
16 - Confirm "Return to account summary" does not load checkouts
17 - Click "Load your checkouts"
18 - Confirm they load
19 - Check out another item, confrim they remain and are updated
20 - Checkout an item that cannot be issued
21 - Confirm 'Return to account summary' loads the checkouts again
Signed-off-by: Andrew Auld <andrew.auld@ptfs-europe.com>
Signed-off-by: AndrewA <andrew.auld@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed skip_record_index => 1 from automatic_renewals.pl. See BZ.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
To test:
1) Run the following test and make sure all pass:
t/db_dependent/api/v1/biblios.t
t/db_dependent/api/v1/checkouts.t
t/db_dependent/api/v1/return_claims.t
t/db_dependent/Circulation/CalcDateDue.t
t/db_dependent/Circulation/CheckIfIssuedToPatron.t
t/db_dependent/Circulation/dateexpiry.t
t/db_dependent/Circulation/GetPendingOnSiteCheckouts.t
t/db_dependent/Circulation/GetTopIssues.t
t/db_dependent/Circulation_holdsqueue.t
t/db_dependent/Circulation/IsItemIssued.t
t/db_dependent/Circulation/issue.t
t/db_dependent/Circulation/MarkIssueReturned.t
t/db_dependent/Circulation/maxsuspensiondays.t
t/db_dependent/Circulation/ReturnClaims.t
t/db_dependent/Circulation/Returns.t
t/db_dependent/Circulation/SwitchOnSiteCheckouts.t
t/db_dependent/Circulation.t
t/db_dependent/Circulation/TooMany.t
t/db_dependent/Circulation/transferbook.t
t/db_dependent/DecreaseLoanHighHolds.t
t/db_dependent/Holds/DisallowHoldIfItemsAvailable.t
t/db_dependent/HoldsQueue.t
t/db_dependent/Holds/RevertWaitingStatus.t
t/db_dependent/Illrequests.t
t/db_dependent/ILSDI_Services.t
t/db_dependent/Items.t
t/db_dependent/Koha/Account/Line.t
t/db_dependent/Koha/Acquisition/Order.t
t/db_dependent/Koha/Biblio.t
t/db_dependent/Koha/Holds.t
t/db_dependent/Koha/Items.t
t/db_dependent/Koha/Item.t
t/db_dependent/Koha/Object.t
t/db_dependent/Koha/Patrons.t
t/db_dependent/Koha/Plugins/Circulation_hooks.t
t/db_dependent/Koha/Pseudonymization.t
t/db_dependent/Koha/Recalls.t
t/db_dependent/Koha/Recall.t
t/db_dependent/Koha/Template/Plugin/CirculationRules.t
t/db_dependent/Letters/TemplateToolkit.t
t/db_dependent/Members/GetAllIssues.t
t/db_dependent/Members/IssueSlip.t
t/db_dependent/Patron/Borrower_Discharge.t
t/db_dependent/Patron/Borrower_PrevCheckout.t
t/db_dependent/Reserves/GetReserveFee.t
t/db_dependent/Reserves.t
t/db_dependent/rollingloans.t
t/db_dependent/selenium/regressions.t
t/db_dependent/SIP/ILS.t
t/db_dependent/Holds.t
t/db_dependent/Holds/LocalHoldsPriority.t
t/db_dependent/Holds/HoldFulfillmentPolicy.t
t/db_dependent/Holds/HoldItemtypeLimit.t
t/db_dependent/Circulation/transferbook.t
2) Performe one or more checkouts for a patron, making sure
that the circulation rules allows for renewals (for example by
setting an earlier due-date).
3) Log in as this patron in OPAC and make sure the list of
checkouts is displayed correctly, and that renewing an issue
still works.
Sponsored-by: Gothenburg University Library
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
To make it displayed correctly depending on the configuration of the
currency
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Test plan:
1. Under administration and system preferences, enable WebBasedSelfCheck
2. In OPAC give user fine by going to 'my account' at top right
3. Then under fines tab 'create manual invoice'
4. Make sure this amount is more than noissuescharge which can be
changed under system preferences
5. Go to the web based self check from the OPAC URL
6. Log in as your user
7. Try to check out an item
7. Error 'Item cannot be checked out' should occur
8. With the patch, the currency symbol should show for the amount.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
When you print a receipt slip in SCO, the library/branch you are at
in should be fetched from the logged in staff member's data (staff login
done before entering SCO view) instead of the patron's own who has signed
in to the SCO. Printing a slip shows patron's own home branch in the slip
as the branch they're in. This causes confusion with patrons who want to
print receipts/slips.
Test plan:
1) Make sure the staff user's library (used to login into SCO patron
view) is not the same as the patron's who is logging into SCO
2) Print a slip in SCO and notice patron's home library printed on the slip
3) Apply patch
4) Print a slip in SCO and notice the library is now the staff user's library
used to sign in to SCO patron view.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
We must not pass $dbh but retrieve it when needed instead
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch modifies the way Koha sets cookies so that the "sameSite"
attribute is explicitly set to "Lax." This option is chosen because it
is the value which is currently assumed by browsers when the sameSite
attribute is not set.
To test, apply the patch and restart services.
- Log in to the staff interface and open your browser's developer tools.
- In Firefox, look for a "Storage" tab.
- In Chrome, look for an "Application" tab.
- Under "Cookies," click the URL of the staff interface.
- You should see all the cookies which are set for that domain.
- The CGISESSID cookie should have sameSite set to "Lax."
- Go to Cataloging -> New record.
- Check the "marcdocs" and "marctags" cookies.
- Switch to the Advanced MARC editor (you may need to enable
theEnableAdvancedCatalogingEditor preference).
- Check the "catalogue_editor" cookie.
- Add a new item to an existing bibliographic record.
- Check the "LastCreatedItem" cookie which is set after you save the
new item.
- Go to Authorities -> Authority search.
- In authority search results, click "Merge" from the "Actions" menu
next to one of the results..
- Check the "auth_to_merge" cookie.
- Go to Administration -> MARC bibliographic framework
- Choose "MARC structure" from the menu corresponding to one of the
frameworks.
- Check the "Display only used tags/subfields" checkbox.
- Check the "marctagstructure_selectdisplay" cookie.
- Go to Circulation -> Check out to a patron with checkouts.
- Check the "Always show checkouts immediately" checkbox.
- Check the "issues-table-load-immediately-circulation" cookie.
- Go to Tools -> Patron clubs. You will need at least one active club
with one or more patrons enrolled.
- From the list of clubs, click Actions -> Search to hold.
- Check the "holdforclub" cookie.
- Go to Tools -> Batch item modification and submit a batch of items.
- Uncheck one or more checkboxes in the "Show/hide columns" area.
- Check the "showColumns" cookie.
- View a patron -> Search to hold.
- Check the 'holdfor' cookie.
- With WebBasedSelfCheck enabled, log in to the self-checkout page.
- Check the "JWT" cookie.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This is a follow-up patch for bug 29543. If an invalid cardnumber has
been used we should not generate a token.
Test Plan:
1. Set SelfCheckoutByLogin to 'cardnumber'.
2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
3. Enter an invalid carnumber like 'thisisabadcardnumber'
4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again."
5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber.
6. Apply this patch
7. Restart all the things!
8. Repeat steps 2-4
9. Try again with a different cardnumber, you should now see the correct
cardnumber!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Logout in OPAC.
Goto sco help page.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Certainly since bug 29543 and bug 29914.
We should do the same authentication check than sco-main.pl, and also
make sure to generate the checkout history only for the logged in patron
(the OPAC one, not staff member)
Test plan:
Use the different combinations of the SCO config (AutoSelfCheckAllowed,
SelfCheckoutByLogin and WebBasedSelfCheck) and confirm that this patch
fixes the SCO print slip feature.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Checkin or renew must be restricted to the items they own.
Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
/cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
/cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1
You should see an error message
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The self-checkout feature is assuming a patron is logged in if patronid
is passed. It also assumes that "We're in a controlled environment; we
trust the user", which is terribly wrong!
This patch is suggesting to generate a JSON Web Token (JWT) to store in
a cookie and only allow action (renew, check in/out) is the token is
valid. The token is only generated once the user has been authenticated
And is removed when the user finish the session/logout.
Test plan:
You must know exactly how the self-checkout feature works to test this patch.
The 4 following sysprefs must be tested:
SelfCheckoutByLogin, AutoSelfCheckAllowed, AutoSelfCheckID, AutoSelfCheckPass
Confirm that you can renew, checkin for the items you own, and checkout new items.
Confirm that you are not allowed to access other account's info.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
It's not used in template
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
It's not needed, we have $patron
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This is based on Julian's idea on bug 28026 where we could get rid of call_recursive by passing refs as arguments to call.
Test Plan:
1) Apply this patch
2) prove t/db_dependent/Koha/Plugins/Plugins.t
3) prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Some of our partners have unusual barcode requirements that have
required us to transform scanned barcodes using javascript. This is not
the most reliable method. It would make more sense to have Koha
transform the barcodes on the backend using a plugin. We should add
hooks to transform and generate new item and patron barcodes.
Test Plan:
1) Apply this patch
2) Download and install the Barcode Transformer plugin
https://github.com/bywatersolutions/koha-plugin-barcode-transformer/releases/download/v1.0.1/koha-plugin-barcode-transformer-v1.0.1.kpz
3) Go to the plugin configuration page, set the configuration to the example configuration from the same page
4) In the patron search and anywhere else you can scan a patron
cardnumber, type in some cardnumbers but prefix them with A and postfix
them with A or B, e.g. A12345A, A12345B
5) Note the letters are removed by Koha!
6) Try a cardnumber like X123456Y
7) Note Koha converts it to Z13456Z
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Some of our partners have unusual barcode requirements that have
required us to transform scanned barcodes using javascript. This is not
the most reliable method. It would make more sense to have Koha
transform the barcodes on the backend using a plugin. We should add
hooks to transform and generate new item and patron barcodes.
Test Plan:
1) Apply this patch
2) Download and install the Barcode Transformer plugin
https://github.com/bywatersolutions/koha-plugin-barcode-transformer/releases/
3) Go to the plugin configuration page, set the configuration to the example configuration from the same page
4) In the item barcode field on the checkin and checkout pages,
and anywhere else you can scan an item barcode, type in some
valid barcodes, but prefix them with X and postfix them with
Y, e.g. X123456Y
5) Note the letters are removed by Koha!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Fix QA script issue
* Fixes issue with barcode generate stub so perlcritic is happy
* Removes extra semicolon from return call in configure method
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: Add unit tests
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Remove unused method barcode_transform
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Rename barcode_transform to item_barcode_transform
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Barcodes inputted into Koha should always pass though barcodedecode
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Catch one last case of itemBarcodeInputFilter
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: (QA follow-up) Fix Checkouts.t
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: Use call_recursive() as a replacement for call()
The method `call()` is not sufficient for barcode transformations. It's
possible that more than one barcode transformation plugin will be
installed. The `call_recursive()` method takes the output of the first
plugin and uses it as the input for the next plugin and so on. This allowes
each plugin to see the current version of the barcode and modify it if
necessary.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 26351: Fix t/db_dependent/Koha/Plugins/Circulation_hooks.t
Bug 26351: Revert improper change to unit test, fix number of tests
Bug 26351: Remove uneeded use Koha::Plugins statements
Left over from previous changes
Bug 26351: Add missing barcodedecode import
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
On bug 17591 we discovered that there was something weird going on with
the way we export and use subroutines/modules.
This patch tries to standardize our EXPORT to use EXPORT_OK only.
That way we will need to explicitely define the subroutine we want to
use from a module.
This patch is a squashed version of:
Bug 17600: After export.pl
Bug 17600: After perlimport
Bug 17600: Manual changes
Bug 17600: Other manual changes after second perlimports run
Bug 17600: Fix tests
And a lot of other manual changes.
export.pl is a dirty script that can be found on bug 17600.
"perlimport" is:
git clone https://github.com/oalders/App-perlimports.git
cd App-perlimports/
cpanm --installdeps .
export PERL5LIB="$PERL5LIB:/kohadevbox/koha/App-perlimports/lib"
find . \( -name "*.pl" -o -name "*.pm" \) -exec perl App-perlimports/script/perlimports --inplace-edit --no-preserve-unused --filename {} \;
The ideas of this patch are to:
* use EXPORT_OK instead of EXPORT
* perltidy the EXPORT_OK list
* remove '&' before the subroutine names
* remove some uneeded use statements
* explicitely import the subroutines we need within the controllers or
modules
Note that the private subroutines (starting with _) should not be
exported (and not used from outside of the module except from tests).
EXPORT vs EXPORT_OK (from
https://www.thegeekstuff.com/2010/06/perl-exporter-examples/)
"""
Export allows to export the functions and variables of modules to user’s namespace using the standard import method. This way, we don’t need to create the objects for the modules to access it’s members.
@EXPORT and @EXPORT_OK are the two main variables used during export operation.
@EXPORT contains list of symbols (subroutines and variables) of the module to be exported into the caller namespace.
@EXPORT_OK does export of symbols on demand basis.
"""
If this patch caused a conflict with a patch you wrote prior to its
push:
* Make sure you are not reintroducing a "use" statement that has been
removed
* "$subroutine" is not exported by the C4::$MODULE module
means that you need to add the subroutine to the @EXPORT_OK list
* Bareword "$subroutine" not allowed while "strict subs"
means that you didn't imported the subroutine from the module:
- use $MODULE qw( $subroutine list );
You can also use the fully qualified namespace: C4::$MODULE::$subroutine
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
There is a "debug" parameter we are passing from the controller scripts
to C4::Auth::get_template_and_user, but it's not actually used!
Test plan:
Confirm the assumption
Review the changes from this patch
Generated with:
perl -p -i -e 's#\s*debug\s*=\>\s*(0|1),?\s*##gms' **/*.pl
git checkout misc/devel/update_dbix_class_files.pl # Wrong catch
+ Manual fix in acqui/neworderempty.pl
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Martin Renvoize
Martin Renvoize
Jonathan Druart
Tomas Cohen Arazi
Lucas Gass
David Cook
Fridolin Somers
Koha Development Team
Aleisha Amohia
Nick Clemens
David Gustafsson
Jenny Way
Lari Strand
Owen Leonard
Marcel de Rooy
Kyle M Hall
Andrew Isherwood