This change removes an SQL injection vulnerability from catalogue_out.pl
Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.
That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.
This allows for different permissions per report for future devs
(see bugs 42406, 16631)
To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports
We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Scott Barter <sbarter@aacpl.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Bug 40524 fixed XSS issue in koha-tmpl/intranet-tmpl/prog/js/datatables.js
But in 24.11 and lower, DataTable are also build with koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
So same fix needs to applied.
Also in 24.11.x and lower the columns use "noExport" instead of "no-export"
Test plan:
Use the one from Bug 40524
Signed-off-by: David Cook <dcook@prosentient.com.au>
When a staff member writes off an accruing fine and the item is
subsequently checked in (backdated or in fine-free mode), the fine
amount is recalculated downward via adjust(). The previous code
unconditionally created an OVERPAYMENT credit whenever the adjusted
outstanding went negative, regardless of whether the existing credits
were reversible payments or non-reversible writeoffs/discounts.
This caused patrons to receive an erroneous credit equal to the
written-off amount, since writeoffs should simply be absorbed when
the underlying fine shrinks - no refund is due.
The fix calculates the total non-reversible credits (writeoffs,
discounts, cancellations) applied to the debit using the existing
filter_by_non_reversible method, and only generates an OVERPAYMENT
credit for the portion attributable to reversible cash payments that
exceed the recalculated fine amount.
Test plan:
1. Write off an accruing fine in full
2. Check the item in (backdated or fine-free)
3. Confirm no overpayment credit is generated for the patron
Signed-off-by: Benjamin Daeuber <BDaeuber@fargolibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 44483cab32)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The buttons in the plugins home page ("Upload plugin" and "View plugins by class") become misaligned when you have the git repository search bar.
To test:
1. Add a github/gitlab repository in koha-conf.xml
- In ktd shell, open /etc/koha/sites/kohadev/koha-conf.xml
- Somewhere under <config> insert the following (or your own)
<plugin_repos>
<repo>
<name>Solutions inLibro</name>
<org_name>inLibro</org_name>
<service>github</service>
</repo>
</plugin_repos>
- Save the file
- restart_all
2. Go to Administration > Manage plugins
--> Buttons are misaligned
3. Apply the patch
4. Run command « yarn build »
5. Repeat step 2
--> buttons are aligned nicely
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit d2d49dfdc6)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
To test:
1. Find or create a record in Kkoha.
2. From the record detail page click "Edit" and "Manage items"
3. Begin adding a new item
4. For any of the dropdowns that contain an authorized value ( LOST, DAMAGED, WITHDRAWN, CCODE, LOC ) click on the dropdown and begin typing an AV that doesn't exist.
5. You should see the text (select to create) appear, click it.
6. Now a modal appears "Create a new authorized value"
7. Fill out the required parts and click 'Save'.
8. Kaboom, 500 error:
9. APPLY PATCH, clear browser cache.
10. Try again, this time it should work.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 4ba95d70e8)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
It would be at least helpful to add a reference to get_transfer here,
since we are replacing it here.
Used the opportunity to update the older comments
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit eaa354e277)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch removes a fetch of the item object followed but get_transfer to simply search the
transfers by itemnumber and status
To test:
1 - Add many items to your records
https://github.com/kidclamp/handy-koha-script/blob/main/randitems.pl
NOTE: this script makes a lot of items withdrawn or damaged, undo that for more dramatic difference
UPDATE items SET withdrawn=0,damaged=0
perl misc/search_tools/rebuild_elasticsearch -v
2 - Set Koha system preferences to display more results and check more items:
maxItemsInSearchResults 60
numSearchResults 50
3 - Do a search, several times, note the time it takes
4 - Apply patch, restart all
5 - Repeat search several times, note the time it takes
6 - Confirm it is better after the patch
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5d62b4f614)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The "Copy shareable link" button on the item search table creates a link
based on the current URL, but an item search does not update the current URL
with the search parameters.
This patch copies the code to generate the URL with search parameters and
uses it to update the current URL.
Test plan:
1. Click "Item search".
2. Perform an item search (e.g. Home library is Centerville).
3. Click the "Copy shareable link" button on the right side of the screen
above the table.
4. Paste and visit the link.
5. Observe that you only see the search page without any results.
6. Apply patch.
7. Repeat steps 1-4.
8. Observe that you see the results with the table settings.
9. Sign off.
Sponsored-by: Lund University Library
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit bfd33ed339)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change makes the "Scheduled for automatic renewal" text appear
in the staff interface and OPAC only if both the issue has auto_renew
and the borrower has autorenew_checkouts set. These are the criteria that
automatic_renewals.pl uses for processing automatic renewals.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Checkout an item as an automatic renewal
(ie either set it as Automatic renewal using the checkout option or have
the circ and fines rules set to use Automatic renewals)
3. View the checkout in both the staff interface and the OPAC
4. Note that they both show "Scheduled for automatic renewal" or
"This item is scheduled for auto renewal" for the OPAC
5. In the patron record change "Allow auto-renewal of items" from
"Yes" to "No"
6. Note that the text talking about the item being scheduled
for automatic renewal no longer displays
Bonus points:
1. Run 'perl ./misc/cronjobs/automatic_renewals.pl -v'
2. Note that the automatic renewal doesn't show when "Allow auto-renewal
of items" is set to "No" but it does show when it's set to "Yes"
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 99e9bcf25e)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan:
1. In system preferences, set PatronQuickAddFields to include userid
(Username).
2. Go to Patrons and choose Quick add new patron.
3. Fill at least Surname, Card number, and Username
(use a value clearly different from a surname-based username).
4. Save the patron.
5. Observe on the patron details page that Username is auto-generated
(not the value entered in quick add).
6. Apply this patch.
7. Repeat steps 2-4 with a new patron.
8. Verify on the patron details page that Username now matches the
value entered in quick add.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 8903df398a)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The warnings:
[WARN] Argument "YYYY-MM-DD" isn't numeric in numeric lt (<)
at /kohadevbox/koha/reports/issues_stats.pl line 224.
appears in the plack-intranet-error.log.
It happens because a numerical comparison was used to compare the dates
instead of a string comparison.
To test:
========
1. Observe plack-intranet-error.log.
2. In staff interface go to Reports > Statistics wizards > Circulation.
3. Select date "From" and date "To" then submit.
4. Two warnings appear in plack-intranet-error.log.
5. Apply the patch; restart_all.
6. Repeat 2-3. No warnings appear in log.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 330d148704)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This bug adds Koha::Patron::Message::message_without_newlines, which has been added to C4::SIP::ILS::Patron in lieu of Koha::Patron::Message::message. The aim of this change is to prevent SIP2 units from crashing out when they encounter a patron message with newlines (\n or \r) in it, as units generally use a newline character to denote the end of a SIP2 transaction.
To test:
a) go to /cgi-bin/koha/sip2/institutions
*) create an institution, name CPL, timeout 300, the rest default
b) go to /cgi-bin/koha/sip2/accounts
*) create an account, userid koha, institution CPL, terminator crlf, the rest default
c) go to /cgi-bin/koha/members/moremember.pl?borrowernumber=51
*) click add message in toolbar
*) enter some multi-line message e.g. test[RETURN]1[RETURN]2[RETURN]3[RETURN][RETURN][RETURN]
d) run tail -f /var/log/koha/kohadev/sip-output.log, keep this window open
e) run ./misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su koha -sp koha -l CPL --patron 42 -m patron_information
f) look at the tail log, notice how the MSG 64 line has a newline before the final pipe (|) character
== APPLY PATCH ==
g) restart_all
h) repeat steps e-f
i) notice how in the tail log, the MSG 64 line now has the final pipe character contiguously placed with the successive characters
== SIGN OFF ==
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit a16316a5c3)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
If a message ends in a non-alphanumeric character, that character is stripped from the message.
For example:
6300120260210 182641 AOMPL|AA23529000035676(|
64 00120260210 182831000000000000000000000000AOCPL|AA23529000035676|AEHenry Acevedo|BLY|BHUSD|BV0|CC5|BD4345 Library Rd. Springfield, MA 44224|BF(212) 555-1212|PB19580530|PCS|PIY|AFGreetings from Koha. |
versus:
6300120260210 182641 AOMPL|AA23529000035676(|ACkoha|
64YYYY 00120260210 182835000000000000000000000000AOCPL|AA23529000035676(|AE|BLN|AFInvalid cardnumber|
The former should be returning the same "Invalid cardnumber" message the latter does.
Test Plan ( assumes you are using KTD ):
1) Install telnet: sudo apt install -y telnet
2) telnet 127.0.0.1 6001
3) Log in with: 9300CNkoha|COkoha|CPMPL|
4) Send the patron information request: 6300120260210 183346 AOMPL|AA23529000035676(|
5) Note you get a patron back
6) Apply this patch
7) Restart SIP!
8) Repeat steps 2-5
9) Noe you doe not get a patron back in the response!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 4a03a9dce2)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
- Biblio::check_booking counts current checkouts toward the
unavailable pool to detect booking clashes
- It counts checkouts on ALL items for the biblio, including
non-bookable ones (e.g. items with an excluded item type)
- When only a subset of items are bookable, checkouts on
non-bookable siblings incorrectly reduce the available pool,
producing false clashes
- Restrict the checkout query to only count items whose
itemnumber is in the bookable items set
To test:
1. Have a biblio with at least two items, where one item is
bookable and the other is not (bookable = 0).
2. Check out the non-bookable item to a patron.
3. Attempt to create a booking for the bookable item.
4. Without the patch: a clash is detected even though the
bookable item is available.
5. Apply the patch.
6. Repeat steps 2-3.
7. Verify the booking succeeds without a false clash.
8. Run: prove t/db_dependent/Koha/Biblio.t
and confirm the new subtest
"checkouts on non-bookable items do not cause false clashes"
passes.
Sponsored-by: Büchereizentrale Schleswig-Holstein <https://www.bz-sh.de/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit e4be46c2c5)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The warning
[WARN] Use of uninitialized value in string eq at
/kohadevbox/koha/circ/del_message.pl line 54.
appears in plack-intranet-error.log
Test plan:
==========
1. Observe plack-intranet-error.log
2. Search for any patron and go to "Check out" tab.
3. Add message for patron. Added message is shown in "Message" area
with "Edit" and "Delete" links.
4. Click "Delete" and confirm modal.
5. Warning appears in plack-intranet-error.log
6. Apply the patch; restart_all
7. Repeat 3-4. No warning appears.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 42908f8c68)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch renames BibTex to BibTeX (with a capital X) for the staff interface
cart and list download options, to match the OPAC.
Test plan:
1. Log in to the staff interface and search for a term that returns
results.
2. Add some records from the results to the cart (select records >
Add to cart).
3. Add some records from the results to a new public list (select
records > Add to list > New list > name the list > make it a
public list > Save).
4. Note the download options for the cart and the spelling: Cart >
Download > BibTexi (with a lowercase X).
5. Note the download options for lists and the spelling: Lists >
Public lists > select the list > Download list > BibTex (with a
lowercase X).
6. Go to the OPAC and search for a term that returns results.
7. Add some records from the results to the cart (select records >
Add to cart).
8. Note the download options for the cart and the spelling (with a
capital X): Cart > Download > BibTeX.
9. Note the download options for lists and the spelling (with a
capital X): Lists > Public lists > the name of your list >
Download > BibTeX.
10. Apply the patch.
11. Recheck the download options in steps 4 and 5.
12. The option should now show as BibTeX (with a capital X).
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 07e1f36a63)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change fixes a typo from pa_loo to pa_class, so that
the ID attribute of the fieldset is properly set when using PA_CLASS
to group patron attributes.
Test plan:
0. Set up two PA_CLASS values
1. Set up two patron attributes which are viewable/editable on the
OPAC and assign them one class each
2. Go to http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
3. Look at the HTML and note that fieldsets for both PA classes
have the ID of "aai_"
4. Apply the patch
5. Reload the page http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
6. Note that now the fieldsets have ID attributes of
"aai_<PA_CLASS code>".
7. Rejoice as now it's easier to use Javascript and CSS and have valid
HTML!
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 28a54105ab)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch fixes a bug where, context-dependent, LinkWrapper can keep
referencing back to links that should be out of scope.
This was causing odd behaviour whilst writing Bug 14962 - namely, links
returning as the same value in a table of multiple rows due to
LinkWrapper treating linkData.href as one and the same for each row.
TO TEST:
== APPLY PATCH ==
a) enable ERMModule syspref, go to /cgi-bin/koha/erm/erm.pl
b) notice all links and buttons still work as expected
c) go to /cgi-bin/koha/sip2/sip2.pl
d) notice all links and buttons still work as expected
e) go to /cgi-bin/koha/acquisition/vendors
f) notice all links and buttons still work as expected
g) enable PreservationModule syspref, go to
/cgi-bin/koha/preservation/home.pl
h) notice all links and buttons still work as expected
== SIGN OFF ==
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 12fdf33139)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch adds the "Middle name" to the Contact information on moremember.pl,
and it adds "Preferred name:" when it differs from the "First name:". This
provides maximum clarity to staff users.
Test plan:
0. Apply the patch
1. Go to the "Patrons" module and search for or add a new patron
2. Add a firstname, a middle name, and a surname. Also add a "Preferred name"
which matches the firstname.
3. Go to "Details" on the sidebar, and note that "First name", "Middle name",
and "Surname" appear in the "Contact information".
4. Edit the patron and change "Preferred name" to a name that does not
match the "First name"
5. Go to "Details" on the sidebar, and note that "Preferred name" now shows
as well.
6. Enjoy fully comprehending which name is which for the patron!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5ecf2cc9b0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
- The empty state message was shown when available_lists was empty
but the patron was already on all existing lists
- Add !in_lists guard so the message only displays when the patron
is truly not on any list
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 53a8761a42)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
- When no patron lists exist in the system, the patron lists
tab on the patron detail page renders completely blank
- Other tabs follow the convention of showing a message in
the empty state (e.g. "Patron has nothing on hold.")
- Add an empty state message with a link to create a new
patron list, matching the established pattern
To test:
- Go to a patron detail page and click the "Patron lists" tab
- If no patron lists exist, observe the tab is blank
- Apply patch
- Repeat the above steps
- Verify the tab now shows "Patron is not on any list." with
a link to create a new patron list
- Click the link and create a patron list
- Return to the patron detail page and verify the "Add patron
to list" dropdown now appears instead
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5d9a2ec188)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan:
Before applying the patch:
1. Go to acquisitions
2. Go to Purchase Suggestions
3. Create a purchase suggestion (for ease of testing, select Centerville for the library)
4. On the table, click on the suggestion number
5. Observe the suggestion does not populate, including the breadcrumbs, but the url does contain the suggestion number.
6. Apply the patch
7. restart_all
8. Rpeat steps 1-4
9. Observe the suggestion now populates and can be edited.
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 6cb1868e19)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch prevents the UI to randomly change the language when reaching
addbooks
The problem is that getlanguage is called BEFORE get_template_and_user,
without, and "interface" (C4::Context->interface) is not set yet.
Open C4/Languages.pm, search "sub getlanguage"
We first read the cache, then if there is no interface we reach
GetTranslatedLanguages that does return languages in a random order,
then we pick the first one
765 @languages = map { $_->{rfc4646_subtag} } @{ getTranslatedLanguages( $interface, $theme ) };
783 $language = shift @languages unless $language;
We must call getlanguage AFTER that the cache is populated.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit da64305067)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The Handler::run change to skip disabled plugins broke the
RecordsFromMarcPlugin subtest in ImportBatch.t. The MarcFieldValues
plugin was installed but never enabled, so Handler::run returned
early. Add $plugin->enable() before calling RecordsFromMarcPlugin.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 645ace7353)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
It appears that edi_cron.pl will run disabled EDI plugins. It uses Koha::Plugins::Handler::run that does not check if the plugins is gets are disabled.
Koha::Plugins::Handler::run needs to be fixed to not run disabled plugins.
Test Plan:
1) Apply this patch
2) prove t/db_dependent/Koha/Plugins/Plugins.t
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 435cf5cba1)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Adds a new subtest to t/db_dependent/Koha/Patron.t covering
fixup_cardnumber and the autoMemberNumValue counter:
- Normal increment bumps the counter
- Renaming a patron's cardnumber does not free it for reuse
- Deleting a patron does not free their cardnumber for reuse
- Counter wins when ahead of db_max
- db_max wins when ahead of counter
- Legacy fallback when the syspref row is absent
Also adds autoMemberNumValue to the exceptions list in
t/db_dependent/check_sysprefs.t. The preference is managed internally
by Koha::Patron::fixup_cardnumber -- it is not user-configurable and
has no entry in the admin preference YAML files.
Test plan:
1. prove t/db_dependent/Koha/Patron.t
2. prove t/db_dependent/check_sysprefs.t
3. prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t
(confirm the patron_barcode_transform hook is still called twice
during store when autoMemberNum is enabled).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
When autoMemberNum is enabled, Koha picks the next cardnumber as
MAX(numeric cardnumber in borrowers) + 1. If patron A's auto-generated
cardnumber is later changed (e.g. they get a physical card) or the
patron is deleted, the original number becomes "free" and the next
self-registrant is assigned it -- inheriting anything third-party
services (OverDrive, Hoopla, unauthenticated self-check) have keyed on
the cardnumber.
This patch makes Koha::Patron::fixup_cardnumber use a monotonic counter
(the autoMemberNumValue syspref) so that once a number has been
auto-generated for any patron, it is never auto-generated again.
The syspref row is locked with SELECT ... FOR UPDATE inside the
existing txn_do, which serialises concurrent callers via InnoDB
row-level locking and addresses the race condition raised against
earlier revisions of this patch.
The formula is: next = MAX(counter, db_max) + 1. When the counter is 0
(pre-upgrade or missing syspref), this degrades gracefully to
db_max + 1 -- the legacy behaviour -- so no feature toggle is needed.
The counter is only bumped when Koha actually auto-generates a
cardnumber; plugin- or caller-supplied values do not touch it.
Test plan:
1. Enable autoMemberNum.
2. Self-register patron A via OPAC, note cardnumber N.
3. Edit patron A in the staff interface, change cardnumber to
something non-numeric like "MANUAL-XYZ".
4. Self-register patron B.
5. Confirm B gets N+1, NOT N.
6. Delete patron A.
7. Self-register patron C.
8. Confirm C gets N+2, NOT A's original number.
9. Install a plugin implementing the patron_barcode_transform hook;
confirm it still runs and its value is honoured (counter is not
bumped when the plugin supplies a cardnumber).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Introduces a new system preference, autoMemberNumValue, which tracks
the highest auto-generated cardnumber ever issued. It is seeded from
the MAX cardnumber across both borrowers and deletedborrowers so
pre-upgrade deletions do not free numbers for re-issuance.
This preference is managed internally by Koha::Patron::fixup_cardnumber
and has no UI (no YAML entry).
Test plan:
1. Apply the atomicupdate:
perl installer/data/mysql/updatedatabase.pl
2. Verify the preference exists:
SELECT * FROM systempreferences WHERE variable = 'autoMemberNumValue';
3. Confirm the seed value matches:
SELECT GREATEST(
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM borrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0),
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM deletedborrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0)
);
4. Re-run the atomicupdate and confirm the already-exists warning.
5. Drop the syspref, re-apply the atomicupdate, confirm it seeds
correctly on fresh installs via mandatory/sysprefs.sql.
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
Read the patch. Look for the var in the script.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
/cgi-bin/koha/cataloguing/editor.pl
Click "Macros", "New macro..."
Enter <script>alert("booh");</script>
OK
Click on the macro name, run macro, delete macro, mark as public:
Nothing should trigger an alert
QA:
- $( '#macro-list li[data-name="' + name + '"][data-id="' + id + '"]' ).addClass( 'active' );
+ $( '#macro-list li[data-id="' + id + '"]' ).addClass( 'active' );
Why did we need name and id to select the macro?
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Replace the no-op `#job_callback` existence check with a recursive
`cy.wait('@jobPoll')` that loops through each `/api/v1/jobs/*` poll
response (arriving every ~1s) until it sees `status: finished`. This
avoids any fixed timeout — the test proceeds as soon as the API signals
completion, however long that takes on a given machine.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c513dee502)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Baptiste Wojtkowski
David Cook
Jonathan Druart
Fridolin Somers
Martin Renvoize
Hammat Wele
Lucas Gass
Marcel de Rooy
Nick Clemens
Kevin Carnes
Slava Shishkin
Roman Dolny
Kyle M Hall
Jake Deery
Paul Derscheid
David Nind
Lisette Scheer
Jacob O'Mara