Bug 38414: Fix permission controller-side
This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.
That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.
This allows for different permissions per report for future devs
(see bugs 42406, 16631)
To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports
We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Scott Barter <sbarter@aacpl.net>
Bug 38414: (follow-up) comprehensively cover ops with required permissions
Test plan:
0. Apply the patch and restart_all
1. Using a user with only "create_reports", "execute_reports", or "delete_reports",
try to perform operations not covered by that permission.
That is, if you have "create_reports", try to run, export, and delete reports.
If you have "execute_reports", try to create, modify, and delete reports
If you have "delete_reports", try to create, modify, and run reports
2. Note that a user with each of these permissions can list and view SQL.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Bug 38414: (QA follow-up) Adjust templates
Now that we can explicitly list reports with any one of the permissions we need
to adjust some displays to ensure we can get to the list view.
Additionally I change 'Use saved' to 'View saved' since we may not be able to run.
I also fix the action buttons to show 'View' instead of 'Run' if user cannot execute.
I adjust reports home to check if the user can use report plugins before showing that link as well
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Bug 38414: (follow-up) Fix OR operator
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Bug 40524 fixed XSS issue in koha-tmpl/intranet-tmpl/prog/js/datatables.js
But in 24.11 and lower, DataTable are also build with koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
So same fix needs to applied.
Also in 24.11.x and lower the columns use "noExport" instead of "no-export"
Test plan:
Use the one from Bug 40524
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change removes an SQL injection vulnerability from catalogue_out.pl
Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Adds a new subtest to t/db_dependent/Koha/Patron.t covering
fixup_cardnumber and the autoMemberNumValue counter:
- Normal increment bumps the counter
- Renaming a patron's cardnumber does not free it for reuse
- Deleting a patron does not free their cardnumber for reuse
- Counter wins when ahead of db_max
- db_max wins when ahead of counter
- Legacy fallback when the syspref row is absent
Also adds autoMemberNumValue to the exceptions list in
t/db_dependent/check_sysprefs.t. The preference is managed internally
by Koha::Patron::fixup_cardnumber -- it is not user-configurable and
has no entry in the admin preference YAML files.
Test plan:
1. prove t/db_dependent/Koha/Patron.t
2. prove t/db_dependent/check_sysprefs.t
3. prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t
(confirm the patron_barcode_transform hook is still called twice
during store when autoMemberNum is enabled).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
When autoMemberNum is enabled, Koha picks the next cardnumber as
MAX(numeric cardnumber in borrowers) + 1. If patron A's auto-generated
cardnumber is later changed (e.g. they get a physical card) or the
patron is deleted, the original number becomes "free" and the next
self-registrant is assigned it -- inheriting anything third-party
services (OverDrive, Hoopla, unauthenticated self-check) have keyed on
the cardnumber.
This patch makes Koha::Patron::fixup_cardnumber use a monotonic counter
(the autoMemberNumValue syspref) so that once a number has been
auto-generated for any patron, it is never auto-generated again.
The syspref row is locked with SELECT ... FOR UPDATE inside the
existing txn_do, which serialises concurrent callers via InnoDB
row-level locking and addresses the race condition raised against
earlier revisions of this patch.
The formula is: next = MAX(counter, db_max) + 1. When the counter is 0
(pre-upgrade or missing syspref), this degrades gracefully to
db_max + 1 -- the legacy behaviour -- so no feature toggle is needed.
The counter is only bumped when Koha actually auto-generates a
cardnumber; plugin- or caller-supplied values do not touch it.
Test plan:
1. Enable autoMemberNum.
2. Self-register patron A via OPAC, note cardnumber N.
3. Edit patron A in the staff interface, change cardnumber to
something non-numeric like "MANUAL-XYZ".
4. Self-register patron B.
5. Confirm B gets N+1, NOT N.
6. Delete patron A.
7. Self-register patron C.
8. Confirm C gets N+2, NOT A's original number.
9. Install a plugin implementing the patron_barcode_transform hook;
confirm it still runs and its value is honoured (counter is not
bumped when the plugin supplies a cardnumber).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Introduces a new system preference, autoMemberNumValue, which tracks
the highest auto-generated cardnumber ever issued. It is seeded from
the MAX cardnumber across both borrowers and deletedborrowers so
pre-upgrade deletions do not free numbers for re-issuance.
This preference is managed internally by Koha::Patron::fixup_cardnumber
and has no UI (no YAML entry).
Test plan:
1. Apply the atomicupdate:
perl installer/data/mysql/updatedatabase.pl
2. Verify the preference exists:
SELECT * FROM systempreferences WHERE variable = 'autoMemberNumValue';
3. Confirm the seed value matches:
SELECT GREATEST(
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM borrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0),
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM deletedborrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0)
);
4. Re-run the atomicupdate and confirm the already-exists warning.
5. Drop the syspref, re-apply the atomicupdate, confirm it seeds
correctly on fresh installs via mandatory/sysprefs.sql.
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Test plan:
Read the patch. Look for the var in the script.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Test plan:
/cgi-bin/koha/cataloguing/editor.pl
Click "Macros", "New macro..."
Enter <script>alert("booh");</script>
OK
Click on the macro name, run macro, delete macro, mark as public:
Nothing should trigger an alert
QA:
- $( '#macro-list li[data-name="' + name + '"][data-id="' + id + '"]' ).addClass( 'active' );
+ $( '#macro-list li[data-id="' + id + '"]' ).addClass( 'active' );
Why did we need name and id to select the macro?
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Should be reverted as soon as Bug 40163 is backported.
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 43c06a34ce)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
For some reasons, with Search::Elasticsearch 8.0 JSON::true is
interpreted as 1 and Elasticsearch will always respond that it found "at
least 1 record". Something like this:
{
total => {
value => 1,
relation => 'gte'
}
}
Replacing JSON::true by \1 works with every version of
Search::Elasticsearch I tested (6.80, 7.717, 8.0)
Also worth noting:
Search::Elasticsearch will stop being supported by Elastic
https://github.com/elastic/elasticsearch-perl/issues/220
We might need to find an alternative for future versions of
Elasticsearch
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Philip Orr <philip.orr@lmscloud.de>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Elasticsearch 8 removed the support of types. This patch adapts the
requests accordingly.
With this patch, Koha will still be compatible with Elasticsearch 7.x
but will no longer work with Elasticsearch 6.x
Since Elasticsearch 6.x is no longer maintained, this should not be a
problem.
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/removal-of-types.html
Tested with Search::Elasticsearch 6.80 and 7.717
Test plan:
1. Install Elasticsearch 8
(use docker image: docker.io/koha/elasticsearch-icu:8.x)
2. Change the elasticsearch server location in $KOHA_CONF
3. Run misc/search_tools/rebuild_elasticsearch.pl -r -b -v
It should fail
4. Apply the patch
5. Run misc/search_tools/rebuild_elasticsearch.pl -r -b -v
It should end with "Total XXX records indexed"
6. Try to search some biblios and verify that it works the same as
before
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Philip Orr <philip.orr@lmscloud.de>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This patch makes it so that invoice-files.pl returns 404 if
AcqEnableFiles is disabled
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
3. Note that you see a 404 page
4. Change "AcqEnableFiles" syspref to "Do"
5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
6. Note that you now see a "Files for invoice" page
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This patch adds debug logging to C4::SIP::Sip::MsgType::_initialize() to help
identify when critical fields (patron_id, item_id) are parsed as empty values.
Empty critical fields in SIP messages can later cause DBIx::Class constraint
errors when passed to Koha::Objects->find() operations, generating confusing
'Odd number of elements in anonymous hash' errors in SIP server logs.
The enhanced logging helps administrators identify the root cause by logging
when empty patron_id or item_id fields are detected during message parsing.
To test:
1. Apply regression tests patch first
2. Run:
$ ktd --shell
k$ prove t/db_dependent/SIP/MsgType.t
=> FAIL: Debug logging tests fail (no enhanced logging present)
3. Apply this patch
4. Run:
$ ktd --shell
k$ prove t/db_dependent/SIP/MsgType.t
=> SUCCESS: All tests pass, debug logging works correctly
5. Sign off :-D
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
These tests verify that C4::SIP::Sip::MsgType correctly parses SIP messages without
creating problematic arrayref field values, and validates enhanced debug logging for
empty critical fields.
Test Coverage:
• Message parsing with correct protocol versions (PATRON_INFO/HOLD/RENEW use v2, CHECKOUT
uses v1)
• Empty patron_id and item_id field detection with debug logging
• Malformed delimiter handling (double delimiters, trailing empty fields)
• Multiple consecutive empty fields in single message
• Confusing delimiter patterns that could break parsing
• Verification that parsed fields are strings, not arrayrefs
• Working siplog mock infrastructure in C4::SIP::Sip::MsgType
Arrayref Prevention Tests:
Tests verify message parsing DOESN'T create empty arrayrefs that would later cause "Odd
number of elements in anonymous hash" errors when passed to Koha::Objects->find()
operations.
Enhanced Debug Logging Tests:
Tests validate that empty critical fields (patron_id, item_id) are detected during
parsing and generate appropriate debug messages to help troubleshoot downstream
constraint errors.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
We should not allow anonymizing patrons with failed login attempts
when the pref FailedLoginAttempts has not been set.
Test plan:
Run the test again from the previous patch. This should pass now.
Choose a patron with a positive value (say 55) in borrowers.login_attempts
or modify one. (NOTE: This patron will be anonymized in the test plan.)
Empty pref value for FailedLoginAttempts.
Set PatronAnonymizeDelay to 1.
Fill dateexpiry for this patron to yesterday.
Run cleanupdatabase.pl -confirm -v and check if the patron was NOT anonymized.
* Anonymized 0 patrons
Now set FailedLoginAttempts to a value (say 55) so that the patron is
considered as locked. (This unrealistic value is for testing only.)
MAKE SURE that you will not be anonymizing more patrons than you like
in the next step! (Set login_attempts to value < 55 for all other patrons.)
Run cleanupdatabase.pl -confirm -v again and check if the patron was anonymized.
* Anonymized 1 patrons
Restore the changed pref values.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Test plan:
Run the test without applying the follow-up patch.
The test should fail. This shows that we need the fix and will help
avoid future regressions.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
It has been removed in the controller by the previous patch.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Update the teams list to reflect the reality of the 25.11 cycle with an
updated release date and updates to the QA team to reflect those who
performed duties during the cycle.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.
Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear
5. Apply the patch
6. koha-plack --restart kohadev
7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This change updates the print format to use the built-in formatter
for operations like trim, strip HTML, strip newlines, and not
decoding entities.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/acqui/basket.pl?basketno=1
2. Click "add to basket"
3. Type "test" next to "From an existing record" and click "Submit"
4. On the "Gairm" row, click "Add order"
5. Fill in the required fields
6. In the "Internal note" put the following:
abc123
7. Click "Save"
8. In the Orders table, click "Export" and then "Print"
9. Note that the print page loads correctly, you can see the internal note,
and you cannot see lines for "Add internal note",
"Edit internal note", or "Add vendor note"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Wainui Witika-Park
Jonathan Druart
David Cook
Fridolin Somers
Jacob O'Mara
Martin Renvoize
Marcel de Rooy
Paul Derscheid
Lucas Gass
Julian Maurice
Tomás Cohen Arazi
Aleisha Amohia