To test:
- enable WaitingNotifyAtCheckout
- have or create a waiting hold for a patron
- check out an item to a different patron who does not have a waiting hold
- Koha says "This patron has waiting holds that are available for checkout"
- Apply patch
- Reload patron (click 'Checkout' tab)
- Check out an item - no warning
- Find the patron with waiting hold
- Check out an item - warning
- Checkout the waiting item - no warning
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b5f122696c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you've catalogued a record with MARC framework that is for some reason missing
certain 952 subfields (8, a, b, c, or y), holdings table is no longer loading but
stuck in the "Processing..." loader.
To test, open Koha in two browser tabs:
IN TAB 1 (framework configuration):
1. Create a new MARC framework "TEST", based on the default MARC framework
IN TAB 2 (record view):
2. Create a new record using MARC framework "TEST"
3. Add an item to the newly created record
4. Observe item visible on the record's holdings list
IN TAB 1 (framework configuration):
5. Delete all 952 subfields in framework "TEST" except: 8, a, b, c, y
IN TAB 2 (record view):
6. Refresh page
7. Observe item visible on the record's holdings list
8. Open your browser's console for upcoming error messages
Iterating remaining subfields in following order,
| <FIELD> | <NAME>
------------------------------------------------------
| 952$8 | row._strings.collection_code
| 952$c | row._strings.location
| 952$a | row._strings.home_library_id
| 952$b | row._strings.holding_library_id
| 952$y | row._strings.item_type_id
IN TAB 1 (framework configuration):
9. Delete subfield <FIELD> in framework "TEST"
IN TAB 2 (record view):
10. Refresh page
11. Observe error "Uncaught TypeError: <NAME> is undefined" (Firefox)
(or Cannot read properties of undefined (reading 'str') (Chromium))
12. Apply patch
IN TAB 2:
13. Refresh page
14. Observe item visible on the record's holdings list
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c93ed758f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The rank parameter is passed per biblio record, not per item. When
placing multiple item-level holds on one bib record, only $rank[0] is
defined.
To test:
1. System preference and circulation rule setup
i. Set the system preference DisplayMultiItemHolds to Enable
ii. Edit the default circulation rule to allow 5 holds per record
2. Find or create a bib with 4 or more items
3. Place several bib-level holds
4. Place 4 or more item-level holds at once on that same record
i. Search for a patron to place the holds for (not one of the
patrons you used in step 3)
ii. Select "Hold a specific item"
iii. Check the checkboxes for 4 or more items
iv. Click Place hold
--> Note that one of the new item-level holds is at the end of the list
as it should be, but the rest are out of order
5. Cancel the item-level holds from step 4
6. Apply patch and restart_all
7. Repeat step 4
--> All the new item-level holds are now at the end of the list
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e1517fc8c8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch switch the check in the script to 'cud-list' - we use the same form
submission if listing for preview or directly updating dates, so this may or may
not be a cud- action - assuming it is restores script functionality.
See bug 37941 for updating forms to not share actions
To test:
1 - Checkout some items to patrons of at least two libraries
2 - Tools -> Batch extend due dates
3 - Select nothing except 'preview' and submit
4 - Blank screen
5 - Apply patch, repeat
6 - It works!
7 - Filter by library and confirm it still works
8 - Sign off!
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2e396f08d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.
Test plan:
1. Without the patch, search for any record in the catalog and click Edit
record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
should display in italics, and the "(Record number nnn)" after it should
not be italicized.
Signed-off-by: David Cook <dcook@prosentient.com.au>
The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.
Test plan:
1. Not a dependency, but you'll avoid getting even more alerts while batch
importing by starting with the patch from bug 37654
2. Without this patch applied, download attachment 170421
3. Administration - set the preference EnableAdvancedCatalogingEditor to
Enable
4. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - Stage for import
5. Once the background job finishes, View batch (getting alerts if you
didn't apply the patch from bug 37654) - Import this batch into the
catalog
6. When the import finishes, Search the catalog for script, on the imported
record Edit record (if you wind up in the basic editor, Settings - Switch
to Advanced editor)
7. In the left sidebar below the search inputs, click Advanced », check
the checkbox for Local catalog and uncheck any others, then search for
the Title script
8. You'll get five alerts, and the word "edition" displayed in huge text
9. Close the search popup, apply patch, shift+reload the advanced editor
page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
the title and the other <script> inclusions.
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Viewing a staged MARC record batch loads a DataTable from
/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the
DataTable just trust the author/title/isbn/issn to be free of HTML. They
shouldn't.
Test plan:
1. Without this patch applied, download attachment 170418, then Cataloging
- Stage records for import - Select the downloaded file - Upload file -
Stage for import
2. When the background job completes, View batch - you'll get three alert()s
from the title, author, and ISSN, and the author and ISSN displayed huge
3. Apply patch, restart_all
4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero
alerts and no <h2> display
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch uses Javascript objects and safe sinks to prevent XSS
in the item URLs on the staff interface detail page.
It also makes sure those URLs don't get double-escaped. Yippee!
Test plan:
0. Apply the patch
1. Add/edit an item with the following URL:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
2. Add/edit a different item with the following URLs:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au |
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
3. Go to the staff interface detail page
4. Notice that the URLs are not double-encoded!
5. Try out a malicious payload (talk to QA/security about this)
6. Confirm that the malicious payload fails to execute the XSS
7. Celebrate!
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We are able to comment a notice even when no user is connected
To test
1. Log in to OPAC.
2. Find a Biblio and open the comments tab.
3. Open another tab/window, and log out from the account.
4. Return to the first tab.
5. Click "Post your comments on this title."
--> We are able to post a comment
6. Apply the patch
7. Repeat step 1, 2, 3, 4, 5
--> You should be redirected to the login page.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Bug 13342: Tidy
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1. Run bin/opac daemon -l http://*:3001/
2. Go to http://localhost:3001/cgi-bin/koha/opac-user.pl
3. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
4. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
5. Reload the page, try to log in normally without modifying the DOM, it
should succeed
6. Run bin/intranet daemon -l http://*:3002/
7. Go to http://localhost:3002/cgi-bin/koha/mainpage.pl
8. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
9. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
10. Reload the page, try to log in normally without modifying the DOM,
it should succeed
11. Run prove t/db_dependent/mojo/csrf.t
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch removes setting AutoCommit to 0 and commiting only every X records.
Instead we commit as we go and report progress using a parameter.
Bug 36474 reduced the numebr of changes that are being committed, so this should be a reasonable change. The
use of commits without transactions was causing problems if the library was active while the script ran.
To test:
1 - perl misc/cronjobs/update_totalissues.pl -c
2 - Script runs, but with unknown parameter
3 - perl misc/cronjobs/update_totalissues.pl -p 10
4 - Script runs and reports every 10 records
5 - per; misc/cronjobs/update_totalissues.pl
6 - Script runs and reports every 100 records by default
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit dba9dd4053)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a new check in UpdateTotalIssues to check that we are changing the number
of total issues before calling ModBiblio
To test:
0 - Enable CataloguingLog
1 - Checkout an item
2 - Run : misc/cronjobs/update_totalissues.pl --use-stats --commit=1000 -v
3 - In report, note all biblios were updated
4 - Check action_logs - note a new entry for every biblio
5 - Apply patch
6 - Repeat
7 - Note no biblios reported updated
8 - Note no new cataloguing log entries
9 - Checkout the item again
10 - Run again
11 - Note biblionumber has updated count in verbose output
12 - Note report only rpeort 1 biblio modified, the rest only processed
13 - Only one line added to action_logs
14 - Run it again
15 - Confirm no updates
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d7b36d7f69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1c875b0157)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch restores the ability to delete a recipient from a serials routing list.
It also fixes the slip preview when using the "Save and preview slip", and removes
the koha staff intranet head from the slip when using 'Print list' from the
Serial collection information screen.
To test:
1) Login to the staff client.
2) Open the Serials module.
3) + New subscription to add a new serial.
4) Create a new subscription.
a) Search for a record (I searched for 'dog') and chose that record.
b) Under 'When receiving this serial', select 'Create an item record'
c) Under the 'Item type' dropdown, select anything.
d) Click Next -> (and confirm the popup).
e) Select any 'First issue date'.
f) Select any 'Frequency'.
g) Enter a number larger than 5 in the 'Subscription length'.
h) Select any 'Subscription start date'.
i) Select your favorite numbering pattern.
j) Verify your prediction pattern using "Test prediction pattern".
k) Click "Save subscription".
5) On the 'Subscription details' screen, click "Receive".
6) Under the first volume, click "Add item" then "Save".
7) Repeat step 6 to receive one more issue.
8) On the 'Serial collection information' page click "+ Create routing list"
9) Click "+ Add recipients".
10) Search for and add several recipients.
11) Click "Close" to exit the 'Add recipients' page.
12) Click "Delete" next to any recipient.
*Note that the recipient is not deleted.
13) Click "Save" on the 'Modify routing list for ...' page.
14) Click "Save and preview routing slip" button.
*Note you are redirected to the Subscription details page, but no routing
slip preview appears.
15) Click "Serial collection" from the left-side menu.
16) Click "Print list" on either of the issues you previously received.
*Note the routing slip includes the staff intranet header, menu, etc.
17) Apply patch.
18) Return to the 'Serial collection information' screen for your subscription.
19) Click "Edit routing list".
20) Repeat steps 12-16 and verify the issues are fixed.
-"Delete" button works to remove a recipient from a list.
-"Save and preview routing list" button pops-up a preview before redirecting.
-"Print list" pops-up a vanilla routing list to print.
Sponsored-by: Westlake Porter Public Library
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0e359a5981)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects an error where the SQL editor screen would appear
after the report results when using 'Update and run SQL' when editing
reports.
This also corrects a related issue where the saved_sql.id of the report
would be repeatedly appended to SQL code when using 'Update and run
SQL'.
To test:
1) Login to staff client
2) Navigate to Reports -> Create from SQL
3) Create a short report (SELECT * FROM items), name it and SAVE it.
4) On the resulting "Edit SQL report' page, click 'Update and run SQL'
5) See the report runs, but at the 'Edit SQL report' screen shows at the
bottom.
6) Apply Patch
7) Return to Reports -> Saved Reports and Edit the report you created.
8) On "Edit SQL report' page, click 'Update and run SQL'
9) Verify that the report runs, but the 'Edit SQL report' section is
gone.
Sponsored-by: Westlake Porter Public Library
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bd79cbd858)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch fixes identity_providers.pl to remove the "cud-" prefix for
two operations which are not POSTed: editing identity providers and
editing domains.
To test, apply the patch and restart services.
- Go to Administration -> Identity providers.
- If necessary, create an identity provider and then click "Manage
domains" -> New identity provider domain to create a new domain.
- From the list of domains, click "Edit"
- The edit form should appear with all the correct details prefilled.
- Check that the page title, breadcrumbs, and page header all show the
correct domain.
- Make a change to the domain and confirm that the changes are saved.
- From the list of identity providers, click "Edit"
- This form should also load correctly.
- Submitted changes should be saved correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 32578e4f72)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Have a mrc file with some different prices. In my case I am using the mrc file attached here with different price values in the 975$p and 975$a
2. Set the MarcFieldsToOrder to "price: 975$p" and MarcItemFieldsToOrder to "price: 975$a"
3. In Acquisitions create a new basket > add to basket > from a new file
4. The value from MarcFieldsToOrder (975$p) is always set as the price when it should be the value from MarcItemFieldsToOrder (975$a)
5. APPLY PATCH, restart_all
6. Try steps 1 - 3 again, this time item price should be correctly handled.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Fix condition to ensure the itemnumber is sent
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 99c5e3bae4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch updates the call to dayjs to use strict parsing for patron search. See https://day.js.org/docs/en/parse/string-format
To test:
1. Create a patron with dateofbirth 1994-07-27
2. Add dateofbirth to DefaultPatronSearchFields
3. In patron or checkout search, type a cardnumber like '2908800092528'
4. Note the patron with that birth date is found in autocomplete
5. Apply patch and restart_all
6. Repeat step 3 and notice the patron is no longer found
7. In patron or checkout search, try searches using a formatted date
8. Confirm searches for '07/27/1994' and '1994-07-27' find the patron
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 764162cd6d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8619598d3b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a new modal for confirming vendor deletion. It fixes
the previous functionality, showing a confirmation modal for each
vendor and appropriately handling the response.
To test:
1) Visit Acquisitions home. Under where it says 'Manage orders', click
the search bar to bring up the list of vendors.
2) Add a few vendors by clicking 'New' and 'Vendor'. After this, go back
to the vendor search so that all the vendors are showing.
3) For each vendor, click on 'Delete vendor' and ensure the modal shows
properly.
4) Attempt to delete one of the vendors. Go back to the vendor search
and ensure they are deleted correctly.
5) Click on a vendor's name to go their supplier page. Make sure modal
works properly and attempt to delete a vendor from here.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 81af57344d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects formatting of amounts in both the POS and member
accounting module Payment, Discount, and Payout modals.
It also corrects an issue where amounts of a previous modal show up
when clicking on the same modal for a different accountline
the member Accounting page.
Finally, it corrects an issue with the member Accounting Discount
modal in that an amount without both decimal places will not
display.
Steps to test:
1) Login to staff client
2) Enable the 'EnablePointOfSale' system preference
3) Enable the 'UseCashRegisters' system preference
4) Open POS module and configure a cash register
5) In the POS module -> 'Configure items for purchase', create some
items with different costs (divisible by .10, e.g 25 or 1.10, etc.))
6) Use the POS module to make a few transactions
7) Open POS -> 'Cash Summary for [BRANCH]', and open your configured
register
8) Click 'Issue Refund' and check the formatting of the paid and
returned to patron numbers
*** Issue A) See that numbers are not formatted with two decimal places
9) Pull up the 'Accounting' tab for a borrower
10) Create at least 3 invoices for different amounts (divisible by .10,
e.g 25 or 1.10, etc.)
11) Pay TWO of your invoices then open the 'Transactions' tab
12) Create a manual credit for an amount (divisible by .10, e.g 25 or
1.10, etc.)
13) Click the 'Apply discount' button on one of your invoices
*** Issue B) No 'Amount charged' appears
14) Click 'Issue refund' for one of the paid invoices.
*** Issue C) The 'Return to Patron' line does not have 2 decimal places
15) Click 'Issue refund' for another paid invoice
*** Issue D) The 'Amount Paid' shows the amount from the first modal
16) Click 'Apply discount' for one of the unpaid invoices
*** Issue E) The 'Amount charged' line is blank
*** Issue F) The discount line is also blank, should at least have a
0.00 value
17) Click 'Issue Payout' for your manual credit.
*** Issue G) The 'Return to Patron' line does not have 2 decimal places
18) Apply patch
19) Repeat steps 7 & 8 and check the formatting is correct for issue A
20) Repeat steps 13-17 and check behavior and formatting is correct
for issues B-G
21) Celebrate that you are done with all the steps and looking at
numbers, and that all is right in the Koha payment world (maybe)
Sponsored by: Westlake Porter Public Library
Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 538c943faa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 57dc65bed5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Update to my last comment: The Lists aria-label had an accessibility issue as the label did not match the visible text.
New test plan:
Check the OPAC Interface:
* Open the OPAC in a normal-sized browser window.
* You’ll see the text next to the 'Cart', 'Lists', and 'Login' icons clearly.
* Gradually reduce the window size until the text next to these icons disappears.
* Inspect the icon elements. You’ll find that there is no alternative text (like aria-label) provided for 'Cart' and 'Login'. The aria-label for 'Lists' does not match the visible text. It currently says "Show dropdown with detailed list information". This lack of alternative text is an accessibility issue and labels should match visible text.
Apply the Patch:
* Apply the patch
* Restart_all
Verify the Fix:
* Inspect the icons again.
* For the 'Cart' icon, you should see an aria-label attribute with the text "View your shopping cart".
* For the 'Login' icon, you should see an aria-label attribute with the text "Log in to your account".
* For the 'Lists' icon, you should see an updated aria-label attribute with the new text of "Lists".
* These changes will improve accessibility for users relying on screen readers.
Sign Off:
* Sign off and Have an amazing day!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8318d27a7d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Just like with batch item modification, batch patron modification can accept
either a POST of a lot of data, which might be more than Apache's default
URL length limit, or a GET of a little data. Or at least it could, if both
the op 'cud-show' and the op 'show' were accepted. Show isn't doing any
creation or updating or deleting, it just has to be cud-show because it needs
to be able to accept large POSTs. So when it is only getting a little data, it
should be willing to take a GET with op=show just like batch item
modification does.
Test plan:
1. Without the patch, Tools - Patron lists - New patron list - give it a
name and Save
2. Type enough characters in the Patron search input to find a patron (I
like ace for poor often-used Henry Acevedo) and click on a patron in
the list of results
3. Click Add patrons
4. Click Patron lists, and in the Actions menu for your list, choose
Batch edit patrons. Note that the page that loads doesn't show any patrons
or UI to edit them, only a message about "No patron card numbers or
borrowernumbers given."
5. Apply patch, restart_all
6. Repeat step 4, but this time get a page with your patron listed, and a
form to change things about the patron record.
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit fc5eed80a3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1) Go to circulation.pl (checking out to a patron)
2) Click the settings in the barcode input
3) Set any due date with the time set to 00:00
4) Note that the picker resets the time to 23:59
5) Apply the patch
6) Repeat 1-3
7) Note that the time (00:00) stays put
8) Sign off
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e96a334aa8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
There is an unnecessary import that has been left over from when KBART file processing logic was being handled directly in the API controller. This patch removes that import as it is no longer needed
Test plan:
1) Look at the patch diff and confirm that the import for Text::CSV_XS has been removed
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3c94b26c66)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Add a patron attribute type:
http://localhost:8081/cgi-bin/koha/admin/patron-attr-types.pl?op=add_attribute_type
2) Make sure its repeatable + is_date
3) Visit overdues:
http://localhost:8081/cgi-bin/koha/circ/overdue.pl
4) Click the 'add' button under the date custom attribute
5) Click on the newly created input, notice the flatpickr pop up doesnt
show
6) Apply patch. Repeat.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c3ef3b69d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a maxlength attribute to the field, subfield, and value
fields in the OAI set mapping form. This helps prevent an error when the
form data is too long for the database columns.
Unrelated: The patch also adds quotes around two unquoted name
attributes.
To test, apply the patch and go to Administration -> OAI sets.
- If necessary, create a new set.
- Click Actions -> Define mappings.
- Test that each form field is limited correctly:
Field: 3
Subfield: 1
Value: 80
- Test that the form can be submitted successfully with the maximum
number of characters in each field.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c3f47091de)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Added unit tests.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit da5aa7faba)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If an item is due sooner than the recall due date interval then placing
a recall on it can inadvertently extend the book's due date, possibly
causing the recalling patron to receive the item later than they would
otherwise.
Test plan:
=========
1. Turn on recalls with UseRecalls.
2. In circulation rules, set the recall due date interval to 7 days
or any other arbitrary period.
3. Check out an item to one patron & set the due date to be before the
recall due date interval will have elapsed (e.g. the next day)
4. As a second patron, place a recall on the item in question.
5. See that the item's due date is extended to the current date plus
the recalls due date interval.
6. Apply the patch, restart_all;
7. Repeat steps 3. and 4. See that the due date has not been extended.
BTW, the calculation of $due_interval has been changed, because with
the current code and empty 'Recall due date interval' $due_interval
is undefined, despite the intention of the author of the code.
(after calling get_effective_rule $recall_due_date_interval is defined, but
$recall_due_date_interval->rule_value is undefined; the patron gets
a message: '... return the item within days, by ...' - no days count).
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e584b9adcb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The tests should be unaffected by system preference settings, such as EmailFieldPrimary.
To test:
1. Log into the staff interface
2. Go to Koha Administration -> Global system preferences, and search for EmailFieldPrimary
3. Change the EmailFieldPrimary preference to something other than 'primary email' and 'first valid email address', i.e. any of the following:
* alternate email
* card number
* secondary email
* selected addresses
4. Run tests t/db_dependent/Letters.t and notice they fail
5. Apply the patch
6. Run the tests again t/db_dependent/Letters.t with different settings of EmailFieldPrimary. The tests should always pass.
Sponsored-by: Pymble Ladies' College
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0e61e56e57)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes some improvements to the Infinite Scroll cypress test to try and prevent random test failures
- Fixes X-Base-Count and X-Total-Count for intercepted requests
- Makes element selection more precise
- Adds an intercepted request returning the requrired result for the filtered search
- Awaits this request before selecting an element from the dropdown
- Awaits all 10 requests triggered by typing "License 50" rather than just the first one
- Ensures that the select dropdown is closed between operations by clicking into another field to remove focus from the select dropdown
Test plan:
1) yarn cypress run --spec t/cypress/integration/InfiniteScrollSelect_spec.ts
or
1) yarn cypress open and select the InfiniteScrollSelect test from the Cypress GUI
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 538868d5f5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Tools -> Rotating collections
2. Create a rotating collection
3. In new collection Actions -> Delete
4. Notice collection is not deleted
5. Apply patch
6. In new collection Actions -> Delete
7. Notice collection is deleted
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 37cb3f35a3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes the tests check for the added exception instead of the
generic DBIx::Class::Exception.
A FIXME was set in place proposing we should throw a Koha::Exception
instead, so removing the FIXME as that's what this patch actually did.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8da67cec72)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Nick Clemens
Lari Taskula
Paul Derscheid
Emily Lamancusa
Lucas Gass
Jonathan Druart
Phil Ringnalda
David Cook
Hammat Wele
Victor Grousset/tuxayo
Julian Maurice
CJ Lynce
Owen Leonard
Pedro Amorim
Brendan Lawlor
Sam Lau
Laura_Escamilla
Matt Blenkinsop
Janusz Kaczmarek
Aleisha Amohia
Eric Garcia
Tomas Cohen Arazi