This change turns off ABSOLUTE and EVAL_PERL for user-entered templates,
as these options can allow for arbitrary code execution and information
disclosure.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a Notice for Reports with a report like:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
3. Run a report using this template
4. The report should show "Two"
5. Turn on CHECKOUT emails for a test patron
6. Perform a checkout
7. Look at the CHECKOUT email and note that the email body
is correctly generated
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Would be good to have this fixed as the default.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
The test plan should include PERL blocks or absolute paths! Tested those
instead. Testing x==1 seems irrelevant.
I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %]
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
When ILS-DI is disabled we still expect to return the correct service name/section in the
xml, but just indicate that it is disabled.
We should skip the check for authorized IPs in this case, as the IP only matters when service is enabled
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This lists the new syntax for allowing all IPs in the preference
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed
To test:
1 - Enable ILS-DI, leave ILS-DI:AuthorizedIPs blank
2 - In another window:
http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item
3 - You get a response
4 - Apply patch and restart all
5 - Reload ilsdi page, 'Not authorized'
6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs
7 - Reload the page, you get a response again
8 - Change ILS-DI:AuthorizedIPs to:
0:0:0:0/0
9 - You still have access
10 - Paste your specific IP again, and add a second made up IP (comma separated)
11 - Reload and confirm you still have access
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Typo in system preference 'minPasswordPreference' -> 'minPasswordLength'
in opac/opac-password-recovery.pl
There is no 'minPasswordPreference' system preference in database.
Bug 23816 added the capability to override minPasswordLength.
Test plan:
==========
1. Check 'minPasswordPreference' appearances:
git grep -i 'minPasswordPreference' **/*
--> Note: only one in opac-password-recovery.pl; no one in sysprefs.sql
2. Apply the patch.
3. Repeat p. 1. Note there is not 'minPasswordPreference' at all.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4b8db36d2a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Reorder logic slightly for each to only create the counter_file after the mock_userenv has taken place
prove t/db_dependent/api/v1/erm_custom_reports.t
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1e7c49ab98)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
The ud_provider->{report_type} is only defined on ->harvest_sushi, meaning it'll never be defined here.
We don't need this anyway. The filename should be the filename of the file being manually uploaded. We only need this concat logic for COUNTER files being generated by Koha following a SUSHI harvest, and that works.
This also gets rid of a warning when running the tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0231911c98)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This is in opac/opac-search.pl a call on system preference
OPACLocalCoverImagesPriority. This preference does not exists elsewhere
and dates back to Koha 3.8 from Bug 1633
This patch removes the call and fixes folding of if.
Check this returns empty : git grep OPACLocalCoverImagesPriority
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bf82831913)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch moves the logic up one level into the confirmModal function
to prevent future regressions
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1fc336d6bd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Templates that use confirmModal to show a pretty confirm() need to
remove the modal in their callback function, or they are at risk of
having the first callback called for subsequent calls that think they
will get their own callback called. opac-user.tt is already fixed,
opac-shelves.tt is currently affected, and opace-suggestions.tt,
opac-tags.tt, and sco/sco-main.tt are at risk of being affected if
anyone adds another confirmModal caller.
Test plan:
1. Without the patch, open the OPAC, log in, search for something that
will return several results
2. Select all - Add to list - New list
3. Lists - {your list name}
4. Click the checkboxes for the first two items
5. Instead of clicking Remove from list, accidentally click Delete list
6. In the confirmation popup, realize it was a mistake and click No, do
not delete
7. Click Remove from list
8. Poof, your whole list is gone
9. Apply patch
10. Repeat steps 1-7, but instead of the whole list being deleted, see
that only the selected two items were removed
11. Now intentionally click Delete list and click Yes, delete, you'll
see that it is deleted rather than getting a message about nothing
being removed like you would have gotten without the patch if you
started by removing an item
12. On any bib detail page, click Add tag(s) and add one
13. Your account - Tags, check the checkbox for the tag, Remove selected
tags, Yes, delete tag and verify that it was deleted
14. Purchase suggestions - New purchase suggestion, fill in a title and
submit your suggestion, click the checkbox for your suggestion,
Delete selected, Yes, delete suggestion and verify it was deleted
15. In the staff interface, find and copy the barcode for any item that can
be checked out, then go to /cgi-bin/koha/sco/sco-main.pl with the
OPAC hostname and port, not the staff, and log in
16. Paste the barcode in the input, click Submit, then click Finish, and
in the confirmation popup click Print recept and end session, and
verify that it tries to print
Sponsored-by: Chetco Community Public Library
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6b470caa92)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
1. Turn on UseRecalls
2. Set circ rules to allow for recalls ( Recalls allowed(total) and Recalls allowed(count))
3. Check something out to a patron, choose a record with multiple items on it
4. With another patron recall the item from the OPAC
5. Choose "Recall next available item"
6. Now go back to the item table and see that all items on the bib say something like: "Recalled by koha (42) on 11/21/2024"
7. APPLY PATCH
8. Do steps 3 - 6 again and now the items should correctly show as available.
9. Place a recall again but choose 'Recall a specific item'.
10. Look at the table again, it should accuretly show the recall in the status column. "recalled by koha (42) on 11/21/2024"
11. Turn off UseRecalls, make sure the table still loads properly.
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 52dd7302d2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
data-referer is the url for the current search page, to redirect
back after performing the operation. Since it is a url, variables within
this link all need to use the uri filter, not html or KohaDates.
Also specify scalar context when splitting the input parameter to
prevent param in list context warnings.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0f01f2b31d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch updates the reopen selected invoices link button to use
the form-submit.js method from bug 36246. The link needs to have a single
data-invoiceid parameter, so the js on invoices.tt creates a comma
separated list from the checkboxes.
The list of invoiceid is split into an array in invoice.pl
To test:
1. Add some invoices for a vendor using the 'receive shipments' button
2. Go to Acquisitions->Invoices
3. Select multiple invoices using the checkboxes
4. Click the 'Close selected invoices' button
5. Confirm it works
6. Go to the Closed invoices tab
7. Select multiple invoices using the checkboxes
8. Click the 'Reopen selected invoices' button
9. Confirm it works
6. Confirm reopening individual invoices from the Actions button still works
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8b038c880c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch updates the closed selected invoices link button to use
the form-submit.js method from bug 36246. The link needs to have a single
data-invoiceid parameter, so the js on invoices.tt creates a comma
separated list from the checkboxes.
The list of invoiceid is split into an array in invoice.pl
To test:
1. Add some invoices for a vendor using the 'receive shipments' button
2. Go to Acquisitions->Invoices
3. Select multiple invoices using the checkbox
4. Click the 'Close selected invoices' button
5. Confirm it works
6. Confirm closing individual invoices from the Actions button still works
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e15d90563f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save
6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"
12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"
16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.
Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
The code went back to step 3 but the error message is not there.
It is easier to go back to the start: no need to fetch columns.
And this is now an exception; it will only come up when trying
malicious things.
Also turned foreach and unless forbidden around. No need to go
into the loop when we found a forbidden field.
Test plan:
See first patch. You should see the message now.
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This patch prevents forbidden columns from being selected using the reports dictionary.
To test:
1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value
6. Apply patch and restart services
7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected
9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:
<option value="borrowers.password">Card number</option>
11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.
13. Ensure tests pass t/db_dependent/Reports/Guided.t
Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
C4::Heading::preferred_authorities seems to be not used for ages (maybe
never used?)
Test plan:
$ git grep preferred_authorities
--> should return nothing
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c70b09dfc)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Trivial leftover house-keeping from bug 35581.
Test plan:
$ prove t/db_dependent/Koha/ILL/*
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b26b7d740f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
The purpose of no block checkouts in SIP is to indicate that the SIP machine has made an offline ( "store and forward" ) transaction.
The patron already has the item. As such, the item must be checked out to the patron or the library risks losing the item do to lack of tracking.
As such, no block checkouts should not be blocked under any circumstances.
The sub C4::SIP::ILS::Transaction::Checkout::do_checkout already honors this, but it is wrapped by
C4::SIP::ILS::checkout which has additional checks that do not.
Test Plan:
1) Apply the unit test patch
2) prove t/db_dependent/SIP/Transaction.t will fail
3) Apply the second patch
4) prove t/db_dependent/SIP/Transaction.t will pass!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
To test:
1. Set up sysprefs:
- Set any non-empty value for ClaimReturnedLostValue
- Set AutoClaimReturnStatusOnCheckout to "found in library"
- Set AutoClaimReturnStatusOnCheckin to "returned by patron"
2. Check out an item to a patron
3. On the patron's account page, click the "Claim Return" button next to
that checkout
4. Check the item in. Note the message that the claim was auto-resolved.
5. Return to the patron's account page and open the Claims Returned tab
--> Note that the claim is resolved and hidden
6. Click the "Show all 1 claims" link to view the hidden claim. Make a
note of the resolution code and timestamp.
7. Check the item out again
--> Note the message saying that the claim was resolved, even though it
was already resolved previously
8. View the return claim again
--> Note that the timestamp and resolution code have changed
9. Apply patch and restart_all
10. Repeat steps 2-8 with a new item
--> Note you do not get a claim resolved message on checkout this time
--> Note that the timestamp and resolution code remain the same before
and after the checkout
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Because the mapping was defined in the wrong direction, it is not
possible to filter results in `GET /deleted/biblios` neither on the
`deleted_on` attribute, or even the fallback to DB fields when mappings
don't exist, on `timestamp`.
To test:
1. Apply the regression tests patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/api/v1/deleted_biblios.t
=> FAIL: A 200 returns a 500 instead
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass, behavior is correct
5. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5d59ec0baa)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 51e42cde54)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This change makes $sessionID consistently return using the session
ID and not sometimes the session object.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
-H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
'http://localhost:8081/cgi-bin/koha/svc/authentication' \
-d "login_userid=<USERID>&login_password=<PASSWORD>" \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
-XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies --data @rec.marcxml
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 04dbbcc2f2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This patch makes translatable the default patron restriction
types that come installed with Koha.
To test:
1) Search for "Manual restriction" in the translation files
`git grep "Manual restriction" misc/translator/po/fr-CA-installer.po`
--> No results
2) Apply patch
3) Update translations
`gulp po:update --lang fr-CA`
4) Repeat step 1
--> Manual restrictions (as well as the other restriction types
i.e. Overdues, Suspension, Discharge, and Notice failure
suspension) is in the .po file
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d350979d6b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
To test:
1 - place, capture, and revert a hold
2 - view action logs for your hold via SQL so you can see the diff column
3 - confirm reversion of waiting hold generates a MODIFY line in logs with no diff
4 - apply patch, restart_all
5 - capture and revert your hold again
6 - confirm logs include diff showing change to found and priority
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d86c662451)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
remove unrequired module
modified: cpanfile
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7283fa84b9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
this patch removes unneeded package dependencies
to test:
- apply patch
- build and install koha-common package, note success
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Not tested, I trust Mason to the right thing.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d5ba5c2879)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This patch simply generates a new user agent when reauthenticating when the CSRF token
for the session has expired.
To test:
1 - Edit Koha/Token.pm, line 275
from: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) },
to: { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) },
2 - This will make your CSRF tokens expire after 8 seconds
3 - vim /etc/koha/sites/kohadev/connexion.cnf
4 - Set content:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:direct
framework:BKS
overlay_framework:
debug:1
5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach)
6 - On the command line:
perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf
7 - In another terminal:
cat bug_33418.test | nc -v localhost 8888
8 - Successful request
9 - Wait 10 seconds (more than 8 anyways)
10 - Repeat 7
11 - Unsuccessful request - Invalid CSRF token
12 - Ctrl+C to stop the connexion daemon
13 - Apply patch
14 - repeat 6
15 - repeat 7, success
16 - Wait more than 8 seconds
17 - repeat 7, success!
18 - repeat again until you are satisfied
19 - Sign off!
WNC amended and tidied
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e758492d99)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
When we go to installer/install.pl and there is nothing to do we get a "Try again" button and never manage to finish the update.
https://snipboard.io/TplscJ.jpg
Test plan:
Go to installer/install.pl
Login
Click next
=> Without this patch you are stuck with a "Try again" button
=> With this patch applied you get a success screen
"Everything went okay. Update done."
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 75d9a38805)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
HTML customizations and news will not display without a publication
date, so we should make it required. This patch adds client-side
validation of the field to check that it's filled.
To test, apply the patch and go to Tools -> News (or HTML
customizations, or Pages).
- Click "New entry"
- Try to submit this new entry without entering a publication date.
- You should be prevented from submitting the form.
- Fill in the publication date and confirm that the form submits
correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1b1e96a17c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
801 should not be mandatory except in data exchange context (IFLA Manual)
In UNIMARC several subfields are mandatory only if the field is used.
This possibility is not available in MAR21, and Koha is currently not
able to manage this information in a useful way : it blocks the
validation of a record if the mandatory subfield is void, regardless
of the mandatory status of the field.
In consequence those subfields must be declared non mandatory in default framework.
Test plan:
1/ Open a UNIMARC Koha without patch. Try to create a record with
minimal information : 200$a and 100$a. A lot a alerts are displayed,
preventing Koha to add the record
2/ Apply the patch
3/ Run reset_all or restart KTD (to remake a fresh koha from scratch)
4/ Try to create a record with minimal information : 200$a and a 100$a.
There should only be 2 alerts, regarding 099$t and 942$c field.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 30a1c4bb45)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
To test:
1. Create an item give it a barcode like 'abc123';
2. Try creating a 2nd item with a barcode: 'ABC123', you get an error 'Error saving item: Barcode must be unique.'
3. Checkin the item 'ABC123', the 'abc123' item successfully checks in.
4. The case doesn't seem to matter elsewhere in Koha ( check-in, checkout, searching, batch tools )
5. Try the inventory tool and use 'ABC123'. The barcode is not found.
6. APPLY PATCH, restart_all
7. Try the inventory tool again with both 'abc123' and 'ABC123', they should now both work.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 70ea004f02)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Paul Derscheid
Wainui Witika-Park
David Cook
Nick Clemens
Jonathan Druart
Roman Dolny
Pedro Amorim
Fridolin Somers
Matt Blenkinsop
Phil Ringnalda
Lucas Gass
Emily Lamancusa
Brendan Lawlor
Alex Buckley
Marcel de Rooy
Aleisha Amohia
Janusz Kaczmarek
Kyle M Hall
Tomas Cohen Arazi
Caroline Cyr La Rose
Andrew Fuerste Henry
Mason James
Owen Leonard
Mathieu Saby
