The "Most-circulated items" report built its SQL by concatenating the
Criteria and Filter request parameters directly into the query, with no
bind placeholders and no whitelist on the Criteria identifier. An
authenticated staff user with the reports permission could inject
arbitrary SQL and read any data reachable by the Koha database user.
This validates the Criteria parameter against a fixed allow-list of the
report's own column options (matching reports/cat_issues_top.tt) so it
is safe to use as a SQL identifier, and binds every Filter value with a
placeholder in both the column-header query and the main calculation
query. The Limit parameter is validated as a plain integer.
This mirrors the fix already applied to the sibling
reports/bor_issues_top.pl (bug 42369).
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to Reports > Most-circulated items (reports/cat_issues_top.pl)
3. Run the report with various Criteria and Filter values, confirm the
output is correct and no errors appear
4. Before the patch, a Filter value or the Criteria containing SQL (a
single quote followed by a subquery) broke out of the query. After
the patch, confirm such input is treated as a literal value: you get
normal output or an empty result, with no SQL error, no delay, and no
data leak
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Aleisha Amohia <aleisha@catalyst.net.nz>
Filters are broken for many reasons. Previous patch contains some
(little) tidying.
There are 3 parts in this patch:
1 - The column name is incorrectly named in the dropdown for "branch",
it is added in this patch
2 - There is a definition for 'Day' and 'Month', but not for 'Week', it
is also added in this patch
3 - Dbh variables are passed in the string definition AND in the call. I
removed them from the string definition since it violates the coding
guidelines.
Test plan:
1. On an fresh ktd db, run the script provided here (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8127#c3) to fill the database with checkins/checkouts:
Visit http://your_koha:8081/cgi-bin/koha/reports/cat_issues_top.pl
2. Run a baseline test with following params:
Checkout date from 01/01/2020
Checkout date to: tomorrow
Library: Any library
Fill nothing else
Notice it is works
3. Test with some limits (Library, Week, and any other), notice you encounter errors on Library and Week, and that any other is empty, without error.
4. Apply patch
5. Rerun 2-3 and notice you now have results. Check with each possible limit, limiting to 5. Test once with 10 as a limit.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2b78fd1de0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan
1. Search for a patron and open the patron details page.
2. Under "Patron restrictions", add a manual restriction with the following comment:
<img src=x onerror="alert(document.domain)">
3. Save the restriction.
4. Navigate to the patron checkouts page:
/cgi-bin/koha/circ/circulation.pl?borrowernumber=xxx
Verify that the JavaScript payload executes.
5. Edit the patron record:
/cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=xxx
Verify that the JavaScript payload executes.
6. For OPAC - Go to OPAC Verify that the JavaScript payload executes - /cgi-bin/koha/opac-user.pl
7. Apply the patch.
8. Repeat steps 4, 5 and 6.
9. Verify that:
1. No JavaScript is executed.
2. The page loads normally without any alert dialog. Applicable for both the staff and opac.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
erm.tt built the logged_in_user_lists JS array by manually
interpolating each shelf's id/name into a JS string literal, escaped
with the TT html filter:
id: "[% shelf.shelfnumber | html %]",
name: "[% shelf.shelfname | html %]",
The html filter escapes <, >, &, and " -- enough to stop the
<script>-tag and </script>-breakout scenario from the original bug --
but it does not escape backslashes. A list name ending in a backslash
(e.g. "foo\") escapes the closing quote of the JS string literal,
unbalancing it and throwing a JS syntax error that breaks the whole
inline <script> block on every ERM page (including the unrelated
`const logged_in_user = ...` a few lines below), reproducing the
"broken UI" half of the original bug via a different character.
Build the id/name pairs as an actual array of hashes and JSON-encode
them with To.json(), after escaping each value with the html
vmethod. JSON encoding (via the JSON module) correctly escapes
backslashes and quotes for use inside a JS string, while keeping the
values HTML-escaped so they stay inert if ever written into the DOM
via innerHTML (as the DataTables render callback in
EHoldingsLocalTitlesFormImport.vue does).
Test plan:
1. Enable the ERMModule system preference.
2. Create a list named: backslash test \
3. Go to /cgi-bin/koha/erm/eholdings/local/titles/import (or any
other ERM page).
=> Without this patch: the page's inline script throws a syntax
error ("Invalid or unexpected token") and
"logged_in_user_lists is not defined", breaking the Vue
component.
=> With this patch: the page loads without errors and the list is
shown correctly in the table.
4. Also verify the original bug's script-tag scenario still works:
create a list named <script>alert("booh!");</script> and confirm
it displays as inert text, not executing, on the same pages.
const logged_in_user_lists = [% To.json(logged_in_user.virtualshelves.unblessed) | $raw %];
If you have a script tag in a list name the UI will be broken, and there
is potentially a XSS vulnerability
Test plan:
Create a new list with name="<script>alert("booh!");</script>"
Go to /cgi-bin/koha/erm/eholdings/local/titles/import
or any ERM views
=> Without this patch the UI is broken
=> With this patch applied it's not and the table is correctly populated
with the lists
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Caught by the xt test
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f73065b3c1)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Note that t/Makefile.t and xt/check_makefile.t were doing the same test.
Merging them.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 294970b5d6)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The ILL requests page loads css/ill-requests.css from the staff template. The stylesheet is generated by build-resources.PL and ignored by git, but Makefile.PL does not list it in the generated asset map.
As a result package installs do not copy the generated stylesheet into blib, so Asset.css cannot find it and no link tag is emitted.
Add ill-requests.css to the generated staff CSS file map so it is installed with the other generated staff stylesheets.
Test plan:
1. perl -c Makefile.PL
2. prove -v t/Makefile.t
3. Confirm that /cgi-bin/koha/ill/ill-requests.pl includes a link tag for css/ill-requests.css on a package/source-style install.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3ed26e8950)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch reverts a change made by bug 41705 that does not work in versions older than 26.05.
Only needed for 25.11.x
To test:
Before applying the patch:
1. Turn on the following system preferences:
EnablePointOfSale
UseCashRegisters
2. In Administration, add a cash register for your library
3. In Administration, set a debit type to be Saleable
4. In Point of Sale, add your debit type as a sale, set it to 1.00
5. In the 'tendered' box, put 2.00
6. Select 'Cash' for type
7. Hit pay, then again in the popup
8. Observe nothing happens.
9. Apply the patch
10. Refresh the point of sale
11. Repeat steps 4-7
12. The popup should properly clear.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Have some overdues
2. Go to circ/overdue.pl
3. Notice the the 'Patron' column the name is prefixed with the biblio title
4. This is meant to be the borrowertitle
5. APPLY PATCH, restart_all
6. Now you should see only the borrower/parton name and info.
7. Edit the patron and add a " Salutation"
8. In the overdue report this should now display
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7a392f111e)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0b3946c713)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a10ad06a93)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan :
01 - Clear your browser's local storage
02 - Go to Administration > Item types
03- You need to have more than 10 item types, add some if needed
04 - Observe "Showing 1 to 010 of XX" on top of the table
05 - Click on "next" button at the bottom of the table
06 - Nothing happens
07 - Go to Administration > Patron categories
08 - You need to have more than 20 patron categories, add some if needed
09 - Observe "Showing 1 to 020 of XX" on top of the table
10 - Click on "next" button at the bottom of the table
11 - Nothing happens
12 - Apply patch
13 - Clear your browser's local storage
14 - Repeat 2-5 and 7-10, observe that the leading 0 is gone, and that the
"next" button works
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 63611e5b58)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch fixes an Uncaught TypeError on Place request with partner libraries (op=generic_confirm) when at least one partner library is available (primary email is set) and system preference ILLCheckAvailability is enabled.
Reason for this is an undefined object services.
Test plan:
a) start a ktd instance
ktd --proxy --name main up -d
b) enable system preference ILLModule and ILLCheckAvailability
http://main-intra.localhost/cgi-bin/koha/admin/preferences.pl?tab=interlibrary_loans
ILLModule: 'enable'
ILLCheckAvailability: 'check'
c) edit an ILL patron and set an Primary email address:
http://main-intra.localhost/cgi-bin/koha/members/moremember.pl?borrowernumber=16 (Walker)
d) create an ill request (Interlibrary loans -> (Requests) -> New ILL request) and fill out mandatory data
e) open dev tools (F12 on Firefox) and go to 'Place requests with partners'
f) notice console error: Uncaught TypeError: can't access property "enabled", services[0] is undefined
g) apply patch and reload page 'Place requests with partners' -> no error
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 70820a2a3e)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch fixes the behavior of the Save (Save and list, Save and continue editing, Save and show) button which is controlled via useBaseResource.navigationOnFormSave on
Accounts, Institutions and System preference overrides in Administration -> Self-service circulation (SIP2)
To test:
a) go to Administration -> Self-service circulation (SIP2)
b) create one of the given resources (institution, account, system preference override) and fill out mandatory fields
c) click either Save or Save and continue editing or Save and show
d) check that you always end up on the list.
e) apply patch and run 'yarn js:build' , reload your browser
f) repeat b) and c)
g) check that the desired view is now shown
- show the edited/created resource
- list all created resources
- continue editing the resource
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a866e3d380)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change is unnoticeable in the UI, so the patch does not need before/after testing, but assurance that everything works. The affected code is used in 3 places for holds (cancelling a hold from reserve/request.pl, circ/circulation.pl, and members/moremember.pl) and 2 for cataloging (two different functions on cataloguing/additem.pl).
For holds:
1. Create three holds on different bibs for a patron
2. On the same page where you create the last hold (reserve/request.pl), delete it
3. Circulation > Check out (circ/circulation.pl) > Check out a different title to patron
4. Switch to patron's Holds tab, delete a hold
5. Go to Patrons account (members/moremember.pl) > Holds tab, delete a hold
6. All holds should delete successfully
For cataloging:
1. Go to any bib > New > New item
2. Select "Add Multiple Copies of this Item", add a note
3. Confirm multiple items are created with the note
4. Enter a new note, then select "Save as template"
5. Confirm the item template exists & create an item using it
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3aa58e05a0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change fixes the case where "Any library" and "Any item type"
weren't validating.
Test plan:
0) Apply the patch
1) Set strict_sql_modes to 0 in koha-conf.xml and restart plack
2) Go to Reports > Items with no checkouts:
<staff_url>/cgi-bin/koha/reports/catalogue_out.pl
3) Leave Library set to "Any library"
4) Pick a specific item type that you know has items (e.g. "BK")
5) Note that you get results
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c60f67e089)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Default to empty string if null to ensure that leaving it blank produces the required outcome: the replace value is an empty string
Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 15783cbc0e)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Check of biblioitemnumber in MARC uses $biblionumber instead of $biblioitemnumber
It returns for example :
Biblionumber 542620 has biblioitemnumber '542620' but should be '542620' in 090$a
Test plan (for MARC21 only) :
1) Choose a biblio record id=X
2) Change with SQL :
update biblio_metadata set metadata = UpdateXML( metadata , '//datafield[@tag="999"]/subfield[@code="d"]' , CONCAT('<subfield code="d">1111</subfield>') ) where biblionumber = X
3) Run audit on this record
4) Check message is correct
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c7d8dbf473)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The .news_delete elements have been removed on
commit c7b576ad7e
Bug 34478: Remove 'Delete' link for news on the homepage
- | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=delete_confirmed&ids=[% koha_new.additional_content_id | html %]&csrf_token=[% csrf_token | uri %]">Delete</a>
We can remove this code
Test plan:
Confirm that there is no "Delete" links to delete news on the main page
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 29f3b80e3a)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan
1. Go to Administration → MARC bibliographic frameworks.
2. Edit Books, Booklets, Workbooks (BKS) framework.
3. In tag 508, ensure subfield $a is visible in the editor.
4. Open a bibliographic record (e.g. /cgi-bin/koha/catalogue/detail.pl?biblionumber=90).
5. Edit the record and add a long block of text to 508$a (e.g. extended production credits with many names and separators).
6. Save the record and view it in the staff interface.
* Before patch: The Production Credits field does not wrap and overflows off the page.
7. Apply the patch and run yarn build.
8. Refresh the record detail page.
* After patch: The Production Credits field wraps correctly within the page.
9. Confirm that shorter repeatable fields still display inline with separators (|) as expected.
10. Sign off and have a great day!
Signed-off-by: Lawrence O'Regan-Lloyd <loreganlloyd@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 18f1e259e2)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch fixes some JavaScript errors on the patron attributes page.
Vanilla JS doesn't automatically handle null variables like jQuery does.
To test, apply the patch and go to Administration -> Patron attribute
types.
- If necessary, add multiple attribute types.
- The table listing all attributes should be displayed as DataTable and
there should be no errors in the console.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 430bfcd76b)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change unfilters the branches for OPAC search, news, and most popular.
This is most noticeable when using the IndependentBranches system preference.
This change aligns the UX for both logged in and not logged in users
__SETUP__
- Do not apply the patch yet
- Log into Koha
- Go to Administration > System preferences
- Search for OpacAddMastheadLibraryPulldown system preference
- Change it to "Add" and save the preference
- Search for IndependentBranches system preference
- Set it to "Yes" and save the preference
- Search for OpacTopissue system preference
- Set it to "Allow" and save the preference
- Search for OpacNewsLibrarySelect system preference
- Set it to "Show" and save the preference
- Go to Patrons
- Create or modify a patron with a username/password but no superlibrarian
permission
__TESTS__
- Go to the OPAC (and logout if you're already logged in)
- Note that the library pull down saying "All libraries" is present
in the masthead
- Log in as your unprivileged user
- Note that the library pull down saying "All libraries" is now hidden
- Go to Advanced search and note there's no "Location and availability" option
- Go to "Most popular" and note there's no "From:" library filter
- Go to the home page and note it does not show a library selector for news
- Apply the patch
- Refresh the page
- Note that the library pull down saying "All libraries" is present
in the masthead
- Note that the "From:" library filter now appears
- Go to Advanced search and note "Location and availability" now appears
- Go to the home page and note it now shows a library selector for news
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 15a30e13d0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Steps to reproduce, do not apply patch
1 - Go to any record and click save -> marc (Unicode/utf8)
2 - Go to any vendor and add a basket
3 - In your acquisition grid, make sure "barcode" is mandatory
4 - In this basket, create a new order from file, use the generated file and wait for the end of the import. Click on add staged files to basket.
5 - Select the record, make sure no Fund or barcode is filled, neither in first or third tab.
6 - Validate: There will be an error due to the missing barcode. If
there is another error, fill the missing part of the form.
7 - Apply patch, repeat 6, the error will be due to the missing fund
8 - Select a fund in the first panel -> the error will be due to the
missing barcode
9 - Select a fund in the third panel -> the error will be due to the
missing barcode
Note: the point about the barcode are not relevant for the bug, they are
just here to prevent the submission of the form. And avoid repeating
steps 4-5.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 956b039907)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The stockrotation cronjob was only sending email reports when there were
actionable items (items that needed to be moved between branches). This
meant that libraries would not receive any notification when all items
in their rotation were stationary, even when the --send-all flag was
passed to the script.
This patch modifies the report logic to also send reports when there are
only stationary items, ensuring libraries have visibility into the complete
status of their stock rotation items.
Test plan:
1. Set up a stock rotation rota with items that are all stationary
(items that should stay at their current branch)
2. Run the stockrotation cronjob: perl misc/cronjobs/stockrotation.pl
3. Without this patch: No email report is generated
4. Apply this patch
5. Run the cronjob again
6. Verify that an email report is now generated showing the stationary items
7. Test with mixed scenarios (some actionable, some stationary items)
8. Confirm reports are sent in all cases where items exist in the rotation
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 539e160383)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan:
1. Navigate to Reports > Create from SQL.
2. Create a new report with a name and the following SQL query:
SELECT 'test', 1, '2'
3. Run the report.
4. Under the Download dropdown, select "Open Document Spreadsheet".
5. Verify a ".ods" file is downloaded.
6. Open the downloaded spreadsheet.
7. Verify the two number-like columns are handled as such. This depends
on your choice of spreadsheet software:
- In Excel, the numbers should not have a leading single quote in the
edit-bar when selected.
- In Google Sheets, the numbers should be right-aligned, and
selecting both of them should display their sum in the bottom
toolbar.
8. Run `prove t/Koha/Util/OpenDocument.t` and verify all tests were
successful.
Sponsored-by: Open Fifth
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7edaba25d9)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The ratings.js file uses raw fetch() to POST to the REST API without
including the CSRF-TOKEN header. This will fail once CSRF enforcement
is enabled on the REST API.
Test plan:
1. Apply patch
2. Enable star ratings in OPAC (StarRatings syspref)
3. Log in to the OPAC
4. Rate a biblio using the star widget
=> SUCCESS: Rating is saved without errors
5. Sign off :-D
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cf825d3829)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Currently at checking we display the number and parts all grouped,this is different than
other places in Koha, we should use the same include here
To test:
1 - Edit a record and set the title like:
245 1 4 ‡aThe passion according to G.H. ‡bsubtitle ‡nnumber1 ‡ppart1 ‡nnumber2 ‡ppart2 /‡cClarice Lispector ; translation by Ronald W. Sousa.
2 - Enable syspref 'ShowAllCheckins'
3 - Checkin an item from that record, display is like:
The passion according to G.H. subtitle number1 number2 part1 part2 /
4 - Apply patch
5 - Check in again
6 - Display is now:
The passion according to G.H. subtitle number1 part1 number2 part2 /
7 - Sign off!
Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d829ac3219)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch updates the SQL report results markup in order to make sure
Bootstrap dropdowns are formatted correctly.
To test, apply the patch and locate or create a report which returns
patron card number, e.g.
SELECT cardnumber, borrowernumber FROM borrowers LIMIT 10
In the results, test the menus triggered when you click a card number or
a borrowernumber. The menu in the cardnumber column should be
formatted like the menu for borrowernumber.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2ab181a7af)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The custom/authorized-value status branch concatenated row.status
directly into a class="..." attribute string. escape_str() only
escapes &, <, > (not quotes), so a status code containing a double
quote could still break out of the attribute.
Build the status <span> via DOM APIs instead, the same way the
reason field was fixed: fixed statuses get a hardcoded class, and
the free-form status code goes into a data-status attribute via
dataset, which the DOM escapes safely regardless of content.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
The angle-bracket delimiter notation in the POD prose (e.g.
PATTERN<DELIM>) caused the POD parser to treat the trailing letter of
each word as an unknown formatting code (N<>, T<>). Replace with
C<s/PATTERN/REPLACEMENT/FLAGS> and a parenthetical note that any
non-space delimiter is accepted.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
- t/C4/ClassSplitRoutine/RegEx.t (new): exercises _apply_substitution via
the public split_callnumber interface — basic substitution, alternate
delimiters, \n/$n backrefs, /gi combined flag, /e rejection, and malformed
or uncompilable rules (including the new logger warn path).
- t/Koha/Regex/Replacement.t: extend the subst() helper to handle the ig/gi
combined modifier and add a subtest that confirms case-insensitive global
replacement and backref case preservation.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
When eval { qr/$pattern/ } fails (e.g. the admin-configured s/// contains
an invalid regex), _apply_substitution previously returned silently with no
indication of why the rule was skipped. Add a Koha::Logger warn so the
failure appears in the log and is diagnosable without a debugger.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Baptiste Wojtkowski
Sanjar Tulkinov Anvar o'g'li
Amit Gupta
Martin Renvoize
Jonathan Druart
David Cook
Andrii Nugged
Lucas Gass
Lisette Scheer
Pedro Amorim
Chris Mathevet
Jan Kissig
Eric Phetteplace
Fridolin Somers
Laura_Escamilla
Owen Leonard
Olivia Reynolds
Tomás Cohen Arazi
Nick Clemens