Commit Graph

58971 Commits

Author SHA1 Message Date
Lucas Gass 09c3ae4c86
Bug 38330: DBRev 25.06.00.020
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:19 -06:00
David Cook 78109295f1
Bug 38330: (QA follow-up) Fix WHERE clause in SQL update and re-word warning
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:18 -06:00
David Cook e4822d590c
Bug 38330: (QA follow-up) Fix SQL syntax error
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:18 -06:00
Martin Renvoize fdfaeda9fc
Bug 38330: (QA follow-up) Add index to opac_suppressed
As suggested by David, this one adds an index on the new column

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:17 -06:00
Martin Renvoize 393c9fc2c8
Bug 38330: (QA follow-up) Improve resilience of DB update
David considered using boolean, but this would catch 'no' and 0 as
truthy.  I instead look for common values here more explicitly.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:17 -06:00
Martin Renvoize 354dbc9649
Bug 38330: (QA follow-up) Correction to field extaction
As pointed out by David.. it's the 942 not the 952 we have this data in.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:16 -06:00
Martin Renvoize 9173aa53b9
Bug 38330: (QA follow-up) Add population of opac_suppressed from biblio_metadata
This patch updates the database update to populate the new
opac_suppressed field in the bilios table using the data in the
biblio_metadata table.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:16 -06:00
Martin Renvoize de3f1abae8
Bug 38330: (QA follow-up) Remove use of metadata_extractor
We had a local method for getting opac_suppressed in Koha::Biblio which
relied on extracting from the MARC record.  Now that we have an
opac_suppressed field in the Biblio table, we no longer need this
wrapper method.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:15 -06:00
Tomas Cohen Arazi 2fdf0d12d0
Bug 38330: Make sure biblio.opac_suppressed is populated/updated on save
This patchset adds a new column to biblio/deletedbiblio for storing the
information about OPAC suppression for the record.

It works as any other framework-mapped attribute. It defaults to 0 (not
suppressed) and some sanitization is done on storing, because the DB
should only contain 0 or 1.

To test:
0. Have a couple records with 942$n set to suppress them.
1. Apply this patches
2. Run:
   $ ktd --shell
  k$ updatedatabase
=> SUCCESS: All good
3. Check the `opac_suppressed` column was added to both tables
4. Notice it tells you need to run `touch_all_biblios.pl`
5. Run:
  k$ koha-mysql kohadev
   > SELECT opac_suppressed,COUNT(opac_suppressed) FROM biblio GROUP BY opac_suppressed;
=> FAIL: There are no records with the opac_suppressed flag set to 1
6. Run:
  k$ perl misc/maintenance/touch_all_biblios.pl -v
=> SUCCESS: No failures
7. Repeat 5
=> SUCCESS: Your couple records have the flag set. This means ModBiblio
is doing the right thing
8. Play with adding new records (suppressed and not)
=> SUCCESS: Suppression status is set correctly
9. Change the status to select records
=> SUCCESS: The DB column and the MARC are in sync!
10. Sign off :-D

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:15 -06:00
Tomas Cohen Arazi c798f642bf
Bug 38330: Map to biblio.opac_suppressed on saving record
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:14 -06:00
Tomas Cohen Arazi 07119ca256
Bug 38330: DBIC updates
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:14 -06:00
Tomas Cohen Arazi b4c7f300f6
Bug 38330: DB changes
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:13 -06:00
Pedro Amorim 51ca5e9ead
Bug 40024: Update requested_partners check
Test plan, k-t-d, don't apply patch:
1) Enable ILLModule
2) Install a backend that does not provide the 'get_requested_partners' capability, e.g. the libkey lending tool (IncDocs) backend plugin:
   https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.0.3
3) Restart plack
   $ koha-plack --restart kohadev
4) Create a new IncDocs ILL request:
   <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=IncDocs
5) Add a DOI '123', a cardnumber '42' and any library. Click 'Make request'.
6) You should now be on the 'Manage request' page. Notice there's a '(0)' after the status 'New request'. This happens because '_backend_capability' method returns '0' if the backend does not implement the capability. The template checks for 'length', and length of '0' is '1'.
7) Apply patch. Refresh the 'Manage request' page. Notice the '(0)' is no longer shown.

Additional testing, ensure no regression is added:
1) Edit the only ILL partner present in k-t-d:
   <staff_url>/cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=16
2) Add a 'primary email'. Click 'Save'.
3) Do the same but for a Standard request:
   <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=Standard
4) Add a type, a cardnumber '42' and any library. Click 'Make request'.
5) You should now be on the 'Manage request' page. Click 'Place request with partners'. Select the only one available 'FRL - Walker' and click 'Send email'.
6) Notice the status shows 'Requested from partners (<the_email_you_entered_in_step_2)'. This is the expected behavior and working as before.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:12 -06:00
Lucas Gass 280b23e0f9
Bug 40284: DRRev 25.06.00.019
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:12 -06:00
Marcel de Rooy 94edeab0f1
Bug 40284: Fix typo in data/marc21_field_006.xml
It reads position 12-18 and "six positions". Since the length is
18, the final position is 17.

Test plan:
Test 006 plugin in basic editor.
Switch type of material to CF (computer files).
Check length of 006 in editor when saving the 006 form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:11 -06:00
Marcel de Rooy 7c3d9c6f33
Bug 40284: Adjust maxlength for 005-007.
Test plan:
Run dbrev or new install.
Verify the maxlength for 005-007 in marc_subfield_structure.
Restart all. Check maxlength on input tags in the basic editor
for fields 005-007.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-29 14:02:04 -06:00
Jonathan Druart f8138a73e8
Bug 40809: Also logs args in the console
For an unknown reason there are useful data that are displayed when
using console.log that we don't see when throwing the Error
This was the purpose of the previous patch (to have everything in
Error) but it didn't work. However we can keep it.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:07 -06:00
Jonathan Druart c481c6d081
Bug 40809: Display the whole error
Not only the first line

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:06 -06:00
Jonathan Druart 187a9b3572
Bug 40809: Fail on DataTables 'warnings'
They are not in the warn buffer but log
DataTables warning: table id=DataTables_Table_0 - Requested unknown parameter 'status' for row 0, column 4. For more information about this error, please see https://datatables.net/tn/4

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:05 -06:00
Jonathan Druart 4043e03cd6
Bug 40809: Fail Cypress tests on JS warnings
Currently JS warnings during Cypress tests are ignored.
This change intercepts console warnings in the browser and if any occurs
the test failed

This helps catch potential issues and ensures that warnings are not
silently ignored during test runs.

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:05 -06:00
Jonathan Druart d996664353
Bug 40467: Remove t/00-deprecated.t
it only tests for the presence of "switch"

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:04 -06:00
Jonathan Druart 5cf9f58426
Bug 40434: Add tests
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:03 -06:00
Jonathan Druart a98fc14148
Bug 40434: Add maxLength to vendor spec file
Test plan:
Apply the "tests" patch first
  prove xt/api.t
=> fail
Apply this patch
=> pass

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:02 -06:00
Marcel de Rooy f3d1f4a585
Bug 30915: Remove Context.Scalar calls from templates
Test plan:
git grep on "Context.Scalar"
Go to book with holdable items in staff catalogue detail. Check if
Place hold is seen in the horizontal toolbar above the title.
Place an article request with a patron. Check the article requests
tab on patron detail.
Same for the article requests tab on moremember (Patron details).

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:01 -06:00
Marcel de Rooy 2a7d8cddc2
Bug 40605: Copy sentence from opac-memberentry in opac-patron-consent
Test plan:
Enable PrivacyPolicyConsent; you can set it to Permissive.
Check if the OPAC user page (tab Consents) shows it correctly now.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:01 -06:00
Martin Renvoize 26f1f91a13
Bug 40625: Fix duplicate cashup records via POST/REDIRECT/GET pattern
The cashup functionality on both /pos/register.pl and /pos/registers.pl
pages was using GET requests via anchor tags, which could cause
duplicate cashup records when users refreshed the page after performing
a cashup.

This patch implements proper POST/REDIRECT/GET pattern with CSRF
protection:

1. Convert anchor tag buttons to proper HTML forms with submit buttons
2. Add CSRF token protection to all cashup operations
3. Change operation from 'cashup' to 'cud-cashup' for CSRF compliance
4. Implement redirects after successful cashup operations to prevent
   resubmission
5. Update JavaScript to populate form fields instead of href attributes

This ensures cashup operations follow HTTP semantics properly (POST for
state changes) and prevents duplicate submissions while maintaining the
existing user experience.

Test plan:
1. Apply patch and restart services
2. Go to Point of Sale > Cash registers
3. Click "Record cashup" on any register - should open modal
4. Click "Confirm" - should perform cashup and reload page
5. Refresh the page - should NOT create duplicate cashup record
6. Go to Point of Sale > Register for individual register
7. Click "Record cashup" - should open modal
8. Click "Confirm" - should perform cashup and reload page
9. Refresh the page - should NOT create duplicate cashup record
10. On registers page, try "Cashup all" button - should work correctly
11. Verify all existing functionality (modals, summaries) still works
12. Check browser developer tools - all requests should be POST for
    cashup operations

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:37:00 -06:00
Matt Blenkinsop a1fc548519
Bug 40593: Restore searchable columns to the suggestions table
This patch adds search functionality to the following columns: Suggester category, Patron reason, Library, Fund, Status.

Test plan:
1) Add some suggestions and navigate to the suggestions page
2) Use the search bar to search for data in any of the columns mentioned above.
3) It will not filter the results based on those columns
4) Apply patch and hard refresh
5) Use the search bar again, this time it should return results

Signed-off-by: Ludovic <ludovic.julien@inlibro.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:59 -06:00
Tomás Cohen Arazi 9ca0e183b5
Bug 40820: (follow-up) es_indexer_daemon.pl missed on 34070
The es_indexer_daemon.pl was missing handling for the case where
Koha::BackgroundJob->connect() returns undef without throwing
an exception (which happens when connection fails silently).

This adds the missing warning for that case, matching the behavior
in background_jobs_worker.pl.

Test plan:
1. Set JobsNotificationMethod to 'STOMP'
2. Configure invalid STOMP settings that cause connect() to return undef
3. Run es_indexer_daemon.pl - should show connection warning
4. Verify jobs are still processed via database polling

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:58 -06:00
Tomás Cohen Arazi 4ff1f4ca9c
Bug 40820: Fix STOMP connection warnings when JobsNotificationMethod is 'polling'
The background job workers are showing STOMP/RabbitMQ connection error
warnings even when the JobsNotificationMethod system preference was set
to 'polling', which doesn't require a message broker connection.

This patch adds checks for the JobsNotificationMethod preference before
displaying connection warnings, so warnings only appear when STOMP is
actually expected to be available.

Changes:
- misc/workers/background_jobs_worker.pl: Check syspref before warning
- misc/workers/es_indexer_daemon.pl: Check syspref before warning

Test plan:
1. Set JobsNotificationMethod to 'polling'
2. Run background_jobs_worker.pl - should not show STOMP warnings
3. Run es_indexer_daemon.pl - should not show STOMP warnings
4. Set JobsNotificationMethod to 'STOMP' without RabbitMQ running
5. Run workers - should show appropriate STOMP connection warnings
6. Sign off :-D

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:57 -06:00
Nick Clemens e9c6c0ee43
Bug 40880: Correct columns headers for CSV export from item search
To test:
1 - Do an item search, select some rows
2 - Export selected rows as 'CSV'
3 - IMport into a spreadsheet or view and note missing/doubled delimiters after damaged status
4 - Apply patch
5 - Repeat export
6 - It works!

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:57 -06:00
Paul Derscheid f6df86c170
Bug 40857: add context parameter for modal overlay
- The combobox dropdown in modals scrolled with the modal body instead of overlaying, due to Bootstrap's overflow: hidden on
modals clipping extending content.
- Added context parameter to combobox config; setting context: 'modal' uses Popper's fixed positioning strategy for proper
overlay.
- For reference: https://popper.js.org/docs/v2/constructors/#strategy

To test:
1. Make an item bookable
   1.1. Go to a record (e.g. http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=285)
   1.2. Go to the Items tab on the left side of the screen
   1.3. Under Bookable, choose Yes and click 'Update'

2. Place a booking
   2.1. Click 'Place booking' at the top of the detailed record screen
   2.2. Fill out the form
   2.3. Click 'Submit'

3. Try to cancel the booking
   3.1. Go to the 'Bookings' tab on the left side of the screen
   3.2. Click 'Cancel' next to the booking
   --> A modal appears with a text field for the cancellation reason
   3.3. Click 'No, do not cancel'

4. Add one authorised value in BOOKING_CANCELLATION
   4.1. Go to Administration > Authorized values
   4.2. Search for BOOKING_CANCELLATION
   4.3. Click 'Add'
   4.4. Fill out the form
   4.5. Click 'Save'

5. Redo step 3
   --> The option appears as a dropdown below the text field -- OK

6. Add one or two more authorised values

7. Redo step 3
   --> The options appear as a dropdown below the text field -- OK

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:56 -06:00
Jonathan Druart 93a78880cb
Bug 40865: Add a cypress test
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:55 -06:00
Jonathan Druart 1b57d75e96
Bug 40865: Redirect if only one patron is found
Regression from
  commit e9b8004d19
  Bug 38255: Replace dataTable constructor with kohaTable - Staff

We should keep the params passed and not override them

Test plan:
1 - Search for 'edna acosta' in check out search on koha home page
2 - See the one result
3 - You are expected to be redirected to the patron's page

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:54 -06:00
Jonathan Druart 73719c417f
Bug 40265: (try to) prevent OAI/Server.t to fail on slow server
Jenkins failed with:
21:50:07 koha_1       |     #    got : '2025-06-26T19:50:06Z'
21:50:07 koha_1       |     # expect : '2025-06-26T19:50:07Z'

A guess is that we change second between the 2 dt_from_string calls, and
the comparison fails.

One thing however: it seems that we want to deal with timezone correctly
here, but if we change the timezone in koha-conf.xml, the tests fail...

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Change looks good, but does not work for another timezone.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:54 -06:00
Jonathan Druart 1a2a7e4619
Bug 37622: Remove location from 2 preservation 'update' routes
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:53 -06:00
Jonathan Druart 9e8b9f607a
Bug 37622: Fix add_debit
We should not call discard_changes after accessing ->id but before

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:52 -06:00
Jonathan Druart a32495bf58
Bug 37622: Adjust 'location' header test
We were ignoring whole files and parsing the whole file to check if
location and 201 were together. It's way better to check per subroutine.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:51 -06:00
Hammat Wele ddbd11cbad
Bug 37622: Error in erm module when editing an agreement, a license, a package or a titles
To reproduce

1- Enable the ERMModule system preference
    1- Go to Administration > System Preferences
    2- Search for ERMModule
    3- Change the value to "Enable"
    4- Click on "Save all e-resource management preferences"
    5- Return to the main screen
1- Create an agreement
    1- Go to e-resource management
    2- Click on "Agreements"
    3- Click on "New agreement"
    4- Fill out the form (mandatory fields)
        - Agreement name: Natural Medicines
        - Status: Active
    5- Click on "Submit"
2- Edit the agreement
    1- Click on "Agreements"
    2- Click on "Edit" to the right of the Natural Medicines agreement
    3- Click on "Submit"
        --> Something went wrong: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data
We got the same error when editing a license, a package or a title

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:50 -06:00
David Cook 9da5f23f96
Bug 40473: Use better algorithm for calculating Code39 barcode length
This patch uses the PDF::Reuse::Barcode algorithm for calculating barcode
background box length relative to barcode length in order to determine
the actual barcode width and thus the X scale factor required to re-size
that barcode so that it fits on the label width (or rather the
"Barcode width" which is a percentage applied to the label width
to create a narrower usable surface for the barcode and barcode background
box).

To test:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
2. Add an item with barcode 123456, add an item with barcode 39999000001310399991,
    and ensure an item with barcode 39999000001310 already exists
3. Go to http://localhost:8081/cgi-bin/koha/labels/label-manage.pl?label_element=batch
4. Create a patch that uses 3 items using 39999000001310, 2 items with 123456,
    and 2 items with 39999000001310399991
4. Go to http://localhost:8081/cgi-bin/koha/labels/label-manage.pl?label_element=layout
5. Edit the layout "Label Test"
6. Change the "Barcode width" to 1, and enable "Draw guide boxes", and click "Save"
7. Export the batch using the template "Avery 5160 | 1 x 2-5/8" and the layout "Label Test" and open as PDF
8. Note that the whole barcode fits inside the red guidebox (there should be some
overlap of white on top of the red guidebox but that is normal since we're using 100% of the
barcode label width).
9. Edit the "Label Test" layout to try "Code39 + Modulo43" and "Code39 + Modulo10" and retry batch export
10. Edit the "Label Test" and try different "Barcode width" like the usual default .8
11. Celebrate that your barcodes fit on the label!

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 10:36:41 -06:00
Andrew Fuerste Henry 0547534fc3
Bug 40854: Correct menu name in browser.js
To test:
1 - perform a search in the staff interface, click a title to go to biblio details
2 - note lack of search results browsing tools at top left of page
3 - apply patch
4 - repeat your search, click a title to go to biblio details
5 - note browsing results tools at top left of page

Signed-off-by: Kevin Kellenberger <kkellenberger@mrcpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 09:10:21 -06:00
David Cook f199a09668
Bug 40748: Check for HTTP URLs and skip shell when using system()
This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 09:10:20 -06:00
Jake Deery 0d89cb1f01
Bug 40748: Fix RCE in update_social_data.pl
This patch fixes an identified RCE in the update_social_data.pl
social_data, which when executed, allows an attacker to run arbitrary
code on the system's shell.

TO TEST:

a)  In the Babeltheque_url_update syspref, wrap any bash in $(), and then
run the update_social_data.pl script.
    *)  For example, $(whoami >
/tmp/rce.log) will output to a file the username the perl script is
running as.
APPLY PATCH
b)  Run the update_social_data.pl script again. The string is now
meta-escaped, and the RCE no longer works.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 09:10:20 -06:00
Marcel de Rooy 39fe0a8312
Bug 40766: (QA follow-up) Operator precedence, quoting
Adding parentheses since I was not sure about precedence here. The filter
should be applied to the whole expression.
Adjusted double to single quotes in the second change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 09:10:19 -06:00
Jonathan Druart 638fe291c2
Bug 40766: Prevent XSS on set-library
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-26 09:10:12 -06:00
Jonathan Druart 9af7d9dfd7
Bug 40565: Correctly fix the retrieval of 'id'
For other tables than those from Vue apps, table_node is the node and we
need to retrieve the object before accessing the attr function

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-25 11:07:51 -06:00
Jonathan Druart 7bb704294b
Revert "Bug 40565: (follow-up) Make sure there is a table_node"
This reverts commit addd5e3a0d.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-25 11:07:50 -06:00
Jonathan Druart 9e437a4089
Bug 40876: Apply 'exact' to all attributes when column filtering
If you select an option in a column filter, the "exact" behaviour will
only apply to the first attribute mapped to this column

eg. on the patron search we have "Libraries" mapped to library.name and
library.library_id. If you select Centerville/CPL, the generated q
parameter will be {name: CPL, id: {like: "%CPL%"}}

This is caused by:
    if (value.match(/^\^(.*)\$$/)) {
        value = value.replace(/^\^/, "").replace(/\$$/, "");
On the second parameter we have lost the ^$ markers

Moving it out of the loop fixes the problem (and does not impact the
other behaviours: we search the same value for all the attributes

Test plan:
Create a library with code=CPLL and use if for a patron
Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl
Click search
Select "Centerville" in the "Libraries" column filter
=> Without this patch you get the patrons from CPL and CPLL
=> With this patch applied only patrons from CPL are listed

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-25 11:07:42 -06:00
Lucas Gass addd5e3a0d
Bug 40565: (follow-up) Make sure there is a table_node
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-24 16:14:54 -06:00
Tomás Cohen Arazi cd44d6e430
Bug 40872: (follow-up) Tidy opac/unapi
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-24 09:25:06 -06:00
Tomás Cohen Arazi 406e2534ae
Bug 40872: List opac/unapi as a Perl file
This patch makes `tidy.pl` treat the file as a Perl one.

To test:

1. Run:
   $ ktd --shell
  k$ misc/devel/tidy.pl opac/unapi
=> FAIL: You get:

```
Cannot guess filetype for opac/unapi at /kohadevbox/koha/Koha/Devel/Files.pm line 241.
```
2. Apply this patch
3. Repeat 1
=> SUCCESS: The file is now tidy.
4. Sign off :-D

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-24 09:25:05 -06:00