Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9ad474c994b7e7b9f90821da35e030be98b8d58d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0974071966a2e2ad52931a7f12d7440d6a7deb5c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The custom/authorized-value status branch concatenated row.status
directly into a class="..." attribute string. escape_str() only
escapes &, <, > (not quotes), so a status code containing a double
quote could still break out of the attribute.
Build the status <span> via DOM APIs instead, the same way the
reason field was fixed: fixed statuses get a hardcoded class, and
the free-form status code goes into a data-status attribute via
dataset, which the DOM escapes safely regardless of content.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7ec92d492576215296bbee42669bcf6ed81c7626)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5e8c9e1529dcf76d065970451270878b4b473b27)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
escape_str all the things
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 522c932b2c3376b8c2f91d04dd83d7eabf067055)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The original fix only whitelisted agefield, condition_field, and
substitution_field at the point they're saved in
tools/automatic_item_modification_by_age.pl, leaving the actual
consumer of the stored syspref, C4::Items::ToggleNewStatus, trusting
agefield and substitution field unchecked. agefield is spliced
directly into raw SQL (TO_DAYS($agefield)) and so can't be
parameterized like an ordinary value; substitution field reaches a
dynamic method call ($item->$field($value)). Any future or
alternate writer of the automatic_item_modification_by_age_configuration
syspref would have reopened both holes without touching the form at
all.
This adds the same allow-list validation directly in ToggleNewStatus
(falling back to the safe default agefield, or skipping the
substitution/condition, exactly as before for missing values), shares
the age-field allow-list between the two files via a new
GetAutomaticItemModificationAgeFields() in C4::Items so it can't drift
between them, and logs rejected values via Koha::Logger instead of
silently discarding them so tampering leaves an audit trail.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9d6f6571f6c43baff87cfde43304dbe98f642535)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Amended-by: Jonathan Druart:
Replace , with ;
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 666767550ac75dbf56ec8b9843b43ecc4a7424ec)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9d3742b7d29cfed9b08327b5a36b190a575e0b6a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The original fix only whitelisted image_name at the point it's saved
in edit-layout.pl, leaving the actual injection sink in create-pdf.pl
unparameterized. This adds defense-in-depth by fixing the query itself,
avoids a redundant duplicate call to get_all_image_names() (already
fetched earlier in the script as $image_names), and logs rejected
image_name values instead of silently discarding them so tampering
attempts leave an audit trail.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5b9e06dafc78c7097ce4090b52fc63390df490fc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit afb01e704459f7adae7a780656b1eef5f9a011d7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9ed242f2e3ccdb944bac87f9033a695eac187f5c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f2c2314baa29ef39b2a0743d7838eb439de08c17)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
login_core only cleared leftover session state on the failed-auth
branch. The earlier 'SIP access not authorized' return (unknown
terminal id) left any account/ils/institution/policy/credentials from
a prior connection on a reused prefork worker in place.
Move the reset to the top of login_core so every non-success exit path
leaves clean state, and only a successful api_auth re-establishes the
session. This keeps the no-authenticated-state-until-auth invariant in
a single place rather than duplicating the key list per branch.
Also extend the unit test to cover the unknown-terminal path on a
reused worker.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c375a5cd34e88b0a1d2d0109a523199ef9a6dc06)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
After a SIP terminal logs in successfully, a later connection handled by the
same worker could bypass authentication entirely. login_core() stores the account
in the session before calling api_auth(), and left it in place when authentication
failed. The check in raw_transport() that is meant to drop unauthenticated connections
only looks at $self->{account}->{id}, which is now populated straight from the SIP config,
so the connection is treated as logged in.
Test Plan:
1) Create a SIP user with the username and password "term1"
2) Restart the SIP server
3) Apply the first patch
4) prove t/db_dependent/SIP/MsgType.t
5) Note the new test fails
6) Telnet to the SIP server port ( 6001 for ktd )
5) Send a successful login: 9300CNterm1|COterm1
6) Note you get a 941 back
7) Disconnect, then telnet to localhost 6001 again
8) Send a bad login: 9300CNterm1|COterm2
9) Note you get a 940 back, but the connection stays open
10) Send a patron information request, using a real patron cardnumber:
6300120260615 110310 AOCPL|AA23529001000463
11) Note you get a 64 patron information response with the patron's data back,
even though the login failed!
12) Apply the second patch
13) prove t/db_dependent/SIP/MsgType.t
14) Note the subtest now passes!
15) Restart all the things!
16) Repeat steps 4 to 10
17) Note the the patron info request returns no patron data and the connection is dropped!
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b1f8256ab97913678aacd80c7d53deec72868876)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d12f0bb06300b194376d70d91d76e76876b3f739)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Create two patron accounts:
* One patron whose home library matches the library assigned to the page.
* One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
* Display location = OPAC
* Library = a specific library
* Publication date = Today
* Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
* Confirm that the library-specific page is not displayed.
* Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
* Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
* Confirm that the page is not displayed.
* Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
* Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
* Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
* Display location = Staff interface
* Library = a specific library
* Publication date = Today
* Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
* Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
* Confirm that the page is not displayed.
* Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
* Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
* Confirm that the page is displayed in both interfaces for users from the matching library.
* Confirm that users from a different library receive a 404 page.
* Confirm that pages assigned to All libraries are available in both interfaces.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bf5c5952105b5f881a1519b4f236c3d6d1b3d5ac)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change fixes the branch comparison between the Page
and the user. Previously, it was doing a numeric "!=" and now it
does the string comparison "ne". Also, if no environmental variable
is set for the default branch, it defaults to an empty string
for anonymous (ie non-authenticated) users.
Test plan:
0. Apply the patch
1. restart_all
2. Log into the staff interface
3. Go to Tools
4. Click on "Pages"
5. Create a Page for All Libraries for the OPAC
6. Copy the "OPAC" link in the "Page URL" table cell and open it
in a private window or a separate browser
7. Note that the page appears
8. Now change the "Page" to a specific library
9. Revisit the URL in the private window
10. Note that it now gives a 404 error
11. Log into the OPAC with a user whose library matches the libary
of the Page
12. Note that now you can view the URL again
13. Change the library of the user or the Page
14. Note that you cannot see the Page now
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit dcbb779d8f39d4fe403e0661335c4abaa8e06a28)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The angle-bracket delimiter notation in the POD prose (e.g.
PATTERN<DELIM>) caused the POD parser to treat the trailing letter of
each word as an unknown formatting code (N<>, T<>). Replace with
C<s/PATTERN/REPLACEMENT/FLAGS> and a parenthetical note that any
non-space delimiter is accepted.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2a733f8093181c2aa880f8e56626de83277b64e8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
- t/C4/ClassSplitRoutine/RegEx.t (new): exercises _apply_substitution via
the public split_callnumber interface — basic substitution, alternate
delimiters, \n/$n backrefs, /gi combined flag, /e rejection, and malformed
or uncompilable rules (including the new logger warn path).
- t/Koha/Regex/Replacement.t: extend the subst() helper to handle the ig/gi
combined modifier and add a subtest that confirms case-insensitive global
replacement and backref case preservation.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a4511cf84303aea7ffff09cbd5345b777b9623bd)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When eval { qr/$pattern/ } fails (e.g. the admin-configured s/// contains
an invalid regex), _apply_substitution previously returned silently with no
indication of why the rule was skipped. Add a Koha::Logger warn so the
failure appears in the log and is diagnosable without a debugger.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 79f23d017a5d6f611f37308cf6cca609a3e1b366)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Note: While the methodology in Koha::Regex::Replacement may seem
bespoke, it's similar to how Python's re.sub(pattern, repl, string)
regex substitution works.
Unit tests:
prove -v t/Koha/Regex/Replacement.t \
t/SimpleMARC.t \
t/db_dependent/MarcModificationTemplates.t \
t/Labels_split_Regex.t
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b8c554175f40b9cb1a31bff6d69c9eef1459df20)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
C4::ClassSplitRoutine::RegEx::split_callnumber ran the admin-configured rule
through eval "\$cn_item =~ $regex", executing arbitrary Perl. Parse the
rule as s<DELIM>PATTERN<DELIM>REPLACEMENT<DELIM>FLAGS, reject the /e flag,
compile the pattern with qr// and expand the replacement as data via
Koha::Regex::Replacement::expand_template, so the rule is applied without
eval.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c76e2dcc3360e2c4a7d3123f5625c3426dfe207e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Koha::SimpleMARC::_modify_values and Koha::Items::apply_regex wrapped the
user replacement in a string and ran it through s///ee, so an interpolation
block such as \@{[ system(...) ]} executed arbitrary Perl. Expand the
replacement as data via Koha::Regex::Replacement::expand_template under a
single /e instead, which keeps capture-group replacements working but never
runs the input as code.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 992a2642ca0cfe14a5fc0b13c828ce0658901ae8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Add a small single-pass helper, Koha::Regex::Replacement::expand_template,
that expands a user-supplied regex replacement string as data: numbered
backreferences ($1..$n, ${n}, the legacy \1..\9 form), named captures
($+{name}, ${name}) and the \n \r \t escapes. Every other character is
copied through literally, so \@{...}/${...} interpolation blocks end up as
text rather than being run. This is used to replace the s///ee double-eval.
The routine is fully qualified at the call sites rather than exported, and
case folding is left out to keep it small.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ac067c0dbb743a0d7e0918e9dc419194620245e8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If a patron is deleted and there's a checkout associated with them, an api call to {url}/api/v1/checkouts?checked_in=true
will result in an error. This patch updates the api to allow for a null value to be returned for patron_id
To test:
Before applying the patch:
1. In Administration->System preference enable the RESTBasicAuth system preference.
2. Checkout an item to a patron (I used item barcode: 39999000000252 and patron barcode 23529000121682)
3. Check the item back in
4. In your brower go to {sandbox/ktdurl}/api/v1/checkouts?checked_in=1
5. Observe there is a patron ID in the JSON response
6. Delete the patron
7. Repeat step 4
8. Observe an error because a "null" value was returned
9. Apply patch
Sandbox:
In sandbox management Actions->Apply patches
Once complete Actions->Build CSS and JS
Actions->Restart services
KTD:
ktd --shell
git bz apply 41889
yarn build
restart_all
10. Repeat step 4
11. Observe the checkout loads, but now has a null patron id.
12. Sign off
On KTD can also run the script: qa
to run tests.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch updates the markup structure of some OPAC include files in
order to make the translation process easier.
To test, apply the patch and test that the correct strings are
translatable. In this example I'm testing fr-FR:
- Update a translation:
> gulp po:update --lang fr-FR
> perl misc/translator/translate update fr-FR
- Open the corresponding .po file for the strings pulled from
the include file and locate the updated strings.
- misc/translator/po/fr-FR-messages.po
- opac-tmpl/bootstrap/en/includes/biblio-title.inc lines 4 & 5
- opac-tmpl/bootstrap/en/includes/date-format.inc lines 4, 6, 8
- opac-tmpl/bootstrap/en/includes/holds-table.inc lines 132 & 135
- opac-tmpl/bootstrap/en/includes/masthead.inc line 498
- misc/translator/po/fr-FR/fr-FR-opac-bootstrap.po
- opac-tmpl/bootstrap/en/includes/biblio-title-head.inc
- opac-tmpl/bootstrap/en/includes/holds-table.inc line 129 & 141
- Edit the "msgstr" string however you want (it's just for testing).
- Remove the "fuzzy, " text if it's there.
- Install the updated translation:
> perl mis/translator/translate install fr-FR
- Switch to your translated language in the OPAC.
- Confirm that the strings you translated show up correctly on these
pages:
- The page title when viewing a bibliographic record detail page for
a record without a title.
- On a user summary page, under the hold tab:
- A hold that is waiting
- A hold that is in transit
- In Administration -> Identity providers define a new identity provider
(it doesn't have to be functional).
- In the OPAC, test that the "Log in with [identity provider]" link is
correct in each of the three login forms:
- The modal triggered from the link in the header
- The form in the right-hand sidebar
- The form you see if you navigate directly to a user-related page
e.g. /cgi-bin/koha/opac-user.pl
- The changes to date-format.inc are only visible if JS is turned off
because Flatpickr hides the format hint when it loads.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
0/ APPLY PATCH
1/ View a record with some holds on it
2/ Look at the holds table ( reserve/request.pl?biblionumber=32 )
3/ Suspend at least one hold and notice the 'suspend' class on the <tr>
4/ Unsuspend the hold and notice the class is removed
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The patch updates the OPACAuthorIdentifiersAndInformation system preference
description so that identifiers are listed in alphabetical order.
It also updates the identifier labels in the system preference
description and what is shown in the OPAC:
- ScopusID --> Scopus ID
- WIKIDATA ID --> Wikidata ID
Test plan:
1. For the OPACAuthorIdentifiersAndInformation system preference, select
"Identifiers (024$2$a)".
2. Note that in the system preference description the identifiers shown
in the note are not in alphabetical order.
3. Add identifiers to an authority record in the 024$2 (the code for the
identifier) and 024$a (the value for the identifier) subfields:
- Example authority record for authority #483, Wall, Larry:
. ISNI: isni, 0000000110763894
. Scopus ID: scopus, 57221714177 (note: not his real Scopus ID)
. VIAF ID: viaf, 91402770
. Wikidata ID: wikidata, Q92597
4. View the OPAC authority record details page for an authority record
with 024$2 and $024a information:
- Example authority record for authority #483, Wall, Larry
/cgi-bin/koha/opac-authoritiesdetail.pl?authid=483
5. In another tab view the author information tab for an OPAC
bibliographic record details page where the author is linked to an
authority record with 024$2 and $024a information:
- Example bibliographic record details page for Programming Perl:
/cgi-bin/koha/opac-detail.pl?biblionumber=262
6. Note for both steps 4 and 5 that:
- Scopus ID is shown as ScopusID
- Wikidata ID is shown as WIKIDATA ID
7. Apply the patch.
8. Refresh the OPAC authority record and bibliographic record pages.
9. Note that the identifier labels are now shown as Scopus ID and
Wikdiata ID.
10. View the OPACAuthorIdentifiersAndInformation system preference
description and note that the identifiers in the note are now
listed in alphabetical order.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Olivia Reynolds <olivia.reynolds@openfifth.co.uk>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Koha::SIP2::Object::store bumps the timestamp before SUPER::store,
opening a race condition where a worker reloading during db update
transaction caches a config that is missing the new row.
Bump the timestamp after the row has been written so it is not advanced
ahead of the data it represents.
Test Plan:
1) prove t/db_dependent/Koha/SIP2/SIP2ModuleMigration.t
2) prove t/db_dependent/api/v1/sip2_accounts.t
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
SIP2 accounts/institutions are stored in the database and the SIP server is supposed to reload its configuration when they change.
In practice, after adding or editing a SIP2 account, most SIP worker processes keep serving the old configuration (e.g. new accounts get "SIP access not authorized") until the SIP server is restarted ( I tested multiple times over 30 minutes ).
There seem to be two issues:
* L1 cache flushed too late. process_request() calls _config_up_to_date() before Koha::Caches->flush_L1_caches(). The SIP parent reads sip2_resource_last_modified into its own L1 cache at startup and never flushes it. Every worker inherits that stale L1, so a worker's first connection compares against the startup-era value instead of the current shared value.
* sip2_config_read_timestamp is stored in the shared (memcached) cache, but the configuration it tracks is per-process. When one worker reloads the config from the database, it bumps the shared timestamp, so every other worker then evaluates as "up to date" and never reloads its own stale in-memory config.
Test Plan:
1) Configure the SIP server with several worker processes (e.g. set
min_servers and max_servers to 5) and confirm an existing SIP2
account works
2) Add a new SIP2 account in the staff interface
3) Without restarting the SIP server, test the new account with misc/sip_cli_emulator.pl
4) Note the login fails
5) Apply this patch
6) Restart all the things!
7) Add another new SIP2 account
8) Without restarting the SIP server test this new account with sip_cli_emulator.pl
9) Note that the new account works!
10) prove t/db_dependent/SIP/SIPServer.t
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When a course reserve has a section defined, the OPAC course detail page
should display it alongside the course name in the page title, breadcrumb,
and main heading. A previous change inadvertently removed this, leaving only
the course name in all three places.
This patch restores the conditional logic so that:
- If a section is set, the format "Course reserves for 'Course name' - Section"
is used in the title, breadcrumb and <h1>.
- If no section is set, the existing "Course reserves for 'Course name'"
format is preserved.
Test plan:
1. Enable the CourseReserves system preference.
2. In the staff interface, go to Course Reserves and create (or edit) a course
that has a 'Section' value filled in (e.g. "Section A").
3. Add at least one item to that course reserve.
4. In the OPAC, browse to Course Reserves and click through to the detail
page for that course.
5. Confirm that the browser tab title, the breadcrumb trail, and the page
heading all show "Course reserves for '<course name>' - <section>".
6. Edit the course and clear the Section field.
7. Revisit the detail page and confirm that all three locations now show
only "Course reserves for '<course name>'" with no trailing dash or
section fragment.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@gmail.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Verify that the SMS fallback in ModSuggestion() respects EmailFieldPrimary
and EmailFieldPrecedence: a patron with smsalertnumber and an emailpro
address (but no borrowers.email) must receive the notice by email, not SMS.
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The FallbackToSMSIfNoEmail transport selection in ModSuggestion() was
checking $patron->email (the raw borrowers.email column) rather than
$patron->notice_email_address, which respects the EmailFieldPrimary and
EmailFieldPrecedence system preferences. Patrons with only emailpro or
B_email set were incorrectly receiving suggestion status-change notices
via SMS even when a valid email address was available.
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Skips the empty results; only reports the 'real failures'.
Includes adding a grand total of hits to the form.
Some preliminary work to remove the hardcoded 20 results per target
in the code.
This is not yet a complete solution, but an improvement. The code in
C4/Breeding needs a larger overhaul. (And there might be an issue on
the Folio server side at LOC.)
Test plan:
Without this patch:
Use the LOC SRU server (since if frequently generates errcode 61).
Try the same search several times in a row (with Go). You probably will
come across the "LOC SRU record x: 0" messages. (Random behavior.)
Apply this patch.
Repeat the above. Notice that you will sometimes see the error 61 (and the
tip to refresh) but not the code 0 messages.
Run t/db../Breeding.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
[WARN] Use of uninitialized value $index_count in numeric ne (!=) at /kohadevbox/koha/about.pl line 899.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If the elastic countainer is stopped, the about page crashes with a 500
"No nodes are available"
Test plan:
Startup ktd with `--search-engine es8`
Go to the about page
Notice that the "Elasticsearch" line contains the version and "running"
Stop the es container: `docker start koha-es-1`
Refresh the about page
=> Without this patch you get the 500
=> With this patch applied the page is rendered with:
"Version: Unkown" and "Status: not running"
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Apply encode_text function to all text fields in EDIfact Order messages
to properly escape special characters (?, ', :, +) that could break
message parsing. Previously only bibliographic description fields were
escaped, but GIR segments containing collection codes, branch codes,
item types, call numbers, and other data were vulnerable.
Test plan:
- Verify all existing tests pass
- Added comprehensive tests for special character escaping in GIR segments
- Confirmed that fields containing ?, ', :, + are properly escaped
Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Unit tests
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When the OPACAuthorIdentifiersAndInformation system preference is
enabled, selected information about authors is displayed. However, if
the main author is a corporate body or a meeting/conference (MARC 21
fields 110/111), the information is not shown.
Test plan:
==========
1. Enable the display of identifiers in
OPACAuthorIdentifiersAndInformation.
2. Add a 024 field with a VIAF ID to any corporate authority record,
e.g.:
024 7# $a 1234 $2 viaf
3. Use this authority heading as the main entry (110 or 111) in any
bibliographic record.
4. In the OPAC view of that bibliographic record, verify that the Author
information tab does not display information from the main entry.
5. Use the same heading as an added entry (710 or 711). In the OPAC
view, verify that the Author information tab now displays information
from the added entry, but still not from the main entry.
6. Apply the patch ; restart_all.
7. Verify that OPAC now displays information from the 110/111
heading fields in the bibliographic record.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The started_on field inside relationshipFields was missing indexRequired: true,
which is required to generate a unique DOM id per row and correctly bind the
flatpickr input to the Vue data model.
The date_to componentProp also needs indexRequired: true so it references the
correct indexed id of the ended_on field.
Additionally, add a null check in calendar.inc before accessing ._flatpickr
on the end date element to prevent a TypeError when the linked element is
not found.
To reproduce:
1. Go to ERM > eHoldings > Local > Titles
2. Create or edit a local title
3. Link it to a package and enter a Start date, End date and Proxy
4. Save
5. Reopen the title and click on the linked package row
=> Start date is empty; End date and Proxy are saved correctly
Apply patch, then:
1. Go to ERM > eHoldings > Local > Titles
2. Create or edit a local title
3. Link it to a package and enter a Start date, End date and Proxy
4. Save
5. Reopen the title and click on the linked package row
=> Start date is now saved and displayed correctly
=> No TypeError in the browser console when selecting a start date
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Like Bug 32012 for runreport.pl the script search_for_data_inconsistencies.pl should use binmode UTF-8 to correctly display datas.
Test plan:
1) Edit an authorised value to add some diacritics in code, in "LOC" for example
2) Edit an item to use this code
3) Delete this authorised value
4) Run misc/maintenance/search_for_data_inconsistencies.pl
=> Check you have a correct message with diacritics
Signed-off-by: Chris Mathevet <chris.mathevet@inLibro.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch reintroduces patron details in 'Existing holds' table by using $patron_to_html.
test plan:
a) get a nice fresh ktd and navigate to /cgi-bin/koha/reserve/request.pl?biblionumber=262
b) place a hold for a patron f.e. 23529000035676
c) take a look at the Existing holds tables patron column which only shows the patrons card number.
d) apply patch and run 'yarn js:build'
e) refresh /cgi-bin/koha/reserve/request.pl?biblionumber=262
f) the patron column now should show patrons name
g) set system preference HidePatronName to 'Don't show'
h) go to /cgi-bin/koha/reserve/request.pl?biblionumber=262
f) the patron column now should only show the patrons card number.
Signed-off-by: Lawrence O'Regan-Lloyd <loreganlloyd@clamsnet.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The static 'hidden' attribute on #addNoteTitle and #suspendHoldTitle was never
removed, so the item title was populated but stayed invisible.
- Toggle 'hidden' off when a modal is populated with a title
- Toggle 'hidden' on when a modal is closed/cleared
Test plan:
- Enable AllowCheckoutNotes
- OPAC > Summary > Checked out: click 'Add note', confirm the item title shows
- OPAC > Summary > Holds: click 'Suspend', confirm the item title shows
- Reopen each modal on a different item, confirm the title updates
- Run an accessibility checker, confirm no empty-heading errors return
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The OPAC summary page contains several accessibility issues including an unlabeled renew checkbox, unlabeled textarea in the add note modal, and empty headings rendered before JavaScript population.
Test plan:
1. Have a user with checkouts
2. Log into the OPAC and go to "Summary"
3. Notice the renew checkbox does not have a corresponding label
4. Apply the patch
5. Repeat steps 1-2
6. Confirm the renew checkbox now has a corresponding label
Additional accessibility fixes:
7. Open the "Report a problem" modal
8. Confirm the note textarea has a corresponding label
9. Confirm addNoteTitle and suspendHoldTitle are not exposed as empty headings
10. Run an accessibility checker and confirm the related errors are resolved
11. Sign off and have a great day! :D
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan :
01 - Clear your browser's local storage
02 - Go to Administration > Item types
03- You need to have more than 10 item types, add some if needed
04 - Observe "Showing 1 to 010 of XX" on top of the table
05 - Click on "next" button at the bottom of the table
06 - Nothing happens
07 - Go to Administration > Patron categories
08 - You need to have more than 20 patron categories, add some if needed
09 - Observe "Showing 1 to 020 of XX" on top of the table
10 - Click on "next" button at the bottom of the table
11 - Nothing happens
12 - Apply patch
13 - Clear your browser's local storage
14 - Repeat 2-5 and 7-10, observe that the leading 0 is gone, and that the
"next" button works
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass
Martin Renvoize
David Cook
Jonathan Druart
Kyle M Hall
Laura_Escamilla
Sanjar Tulkinov Anvar o'g'li
Lisette Scheer
Owen Leonard
David Nind
Marcel de Rooy
Janusz Kaczmarek
Adolfo Rodríguez
Fridolin Somers
Jan Kissig
Paul Derscheid
Pedro Amorim
Chris Mathevet