This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.
Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update
4. Apply the patch
5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 35cdeadbdf)
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Passing a wrong biblionumber generates a warning:
GetMarcUrls called on undefined record at opac/tracklinks.pl line 58.
Test plan:
[1] Try it again with a wrong biblionumber and check the logs.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If you pass a URI with a biblionumber without specifying the itemnumber,
tracklinks did not redirect an item URI.
Test plan:
[1] Add URI in an item.
[2] Pass this URI with the itemnumber to tracklinks. Should pass.
[3] Pass this URI with the biblionumber to tracklinks. Should pass now too.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 19487 limited redirection to urls contained in a record/item if we were tracking.
We should probably limit forwarding if not tracking as well.
Additionally, if we don't have a soucre, let's not forward
To test:
0 - Set TrackClicks syspref to 'Don't track'
1 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
2 - You get forwarded to google
3 - Set TrackClicks to 'Track anonymously'
4 - You get a 404
5 - Apply patch
6 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
7 - You get a 404
8 - Set TrackClicks syspref to 'Don't track'
9 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
Choose a biblionumber that exists
10 - You get a 404
11 - Add http://www.google.com to the 856$u of the record used above
12 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
13 - You are redirected
14 - Confirm redirection and 404 as expected with other settings of TrackClicks
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
[1] Refining the regex on the format parameter in opac-search.pl
[2] Adding a colon to dc:identifier. The Dublin Core specs gives me this
example:
Identifier="ISBN:0385424728"
[3] Replacing last occurrence of rss2 in the rss template
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2bbd811027)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ad787464c9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
GET http://catalogue/cgi-bin/koha/opac-search.pl?idx=kw&q=perl&count=50&sort_by=acqdate_dsc&format=rss2
=> Without this patch it returns content type text/html
=> With this patch it returns text/xml
GET http://catalogue/cgi-bin/koha/opac-search.pl?idx=kw&q=perl&count=50&sort_by=acqdate_dsc&format=rss
=> Without this patch it does not work
=> With this patch it returns text/xml
Bug 16111: Fix atom support
Bug 16111: Remove 'rss2' which should be 'rss' or 'atom'
Bug 16111: Replace <link> with <link href...
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit b946e996ff)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 5a30719f84)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Items hidden with the OpacHiddenItems system preference
were still displayed in the OPAC cart and the normal items
were hidden instead. This patch corrects the display.
To test:
- prep a test bib with hidden and other items using
the OpacHiddenItems system preference
- add bib to cart
- observe that hidden items are displayed - non-hidden items are hidden
- apply patch, reload page
- observe that hidden items are hidden, non-hidden items are displayed
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 60ce66b6b6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 6e013cf383)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
DBIx::Class::Row::store_column(): No such column 'changed_fields' on
Koha::Schema::Result::Borrower at /home/vagrant/kohaclone/Koha/Object.pm
line 75
Test plan:
- Turn PatronSelfRegistrationVerifyByEmail on
- Register a new account
- Click on the link (see the message_queue table)
=> Without this patch you get the error
=> With this patch you will see the login form
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c5f73575ab)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a94bacb02a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
Turn on OPACPatronDetails
put dateofbirth in PatronSelfModificationBorrowerUnwantedField
Have a patron with a set date of birth
Attempt any modification on that patron through the OPAC
The date of birth will be one of the fields changed for that borrower
when you check it in the staff intranet.
Apply this patch, repeat the above.
Date of birth will not be one of the changed fields.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d71b263a89)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 936f1450b8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
For a biblio with multiple ISBNS we sometimes get our own record back when
check XISBN, we should test for this
To test:
1 - Edit a record in the catalogue, add two isbns:
0521240670
0521284198
2 - Enable ThingISBN and FRBRizeEditions and OPACFRBRizeEditions
3 - View the record in staff and OPAC
4 - You should see editions tab pointing to the same record
5 - Apply patch
6 - Reload the record details, you should no longer see editions tab
7 - Add the second ISBN to another record
8 - Reload details for original record, you shoudl see editions linking to the record with second ISBN
9 - prove -v t/db_dependent/XISBN.t
NOTE: Current tests don't work under elasticsearch, but the code does, tests should be rewritten on another bug
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Signed-off-by: Arthur Bousquet <arthur.bousquet@inlibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fd5686b156)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 005a799051)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When patrons have a lot of checkouts, GetPatronInfo can take a lot of
time. This patch introduces two new parameters to allow pagination of
this list of checkouts
Also, fix a warning in C4::ILSDI::Services::GetPatronInfo
Test plan:
1. Go to /cgi-bin/koha/ilsdi.pl?service=GetPatronInfo&patron_id=X&show_loans=1
where X is a borrowernumber of a patron who has several checkouts
Verify that all checkouts are listed
2. Add '&loans_per_page=1&loans_page=1' to the URL. Verify that you have
now only one checkout listed, and that there is a new element
<total_loans> which contain the total number of checkouts
3. Increase the page number in the URL until you have seen all checkouts
4. prove t/db_dependent/ILSDI_Services.t
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This will use changed_fields to know whether a
borrower field is actually modified.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 30fd4eb1a5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9ca074496d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When updating (patron modification), the field should not be required.
Test plan:
Check patron modification on opac.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6dc8306b58)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit b6b773c39a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It introduced a regression in the patron's self modification feature.
Patron's details are no longer modificable, the screen displays
"You have not filled out all required fields. Please fill in all missing
fields and resubmit."
Test plan:
- Set GDPR_Policy to either Enforced or Permissive
- Set PatronSelfRegistrationBorrowerMandatoryField to empty
- Set OPACPatronDetails to Allow
- Log into the OPAC
- Accept the GDPR screen
- Go to opac-memberentry.pl, change something, submit modification
request
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 3b14f7d636)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 502565a21c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit d7e3b48371)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This reverts commit 375dd35d53.
https://bugs.koha-community.org/show_bug.cgi?id=22836
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 7bed2a3fe6)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This is a follow-up for bug 22550, we do not need to use the $raw
filter.
Test plan:
Same as bug 22550:
Test plan:
Test plan:
1. OPAC->login->your purchase suggestions->New purchase suggestion
2. Click button "Submit your suggestion" directly without filling in any field.
Empty suggestion record was added succeffully.
3. Apply the patch.
4. Click button "Submit your suggestion" directly without filling in any field.
The required fields should be labeled in red.
(you can change the mandatory fields by preference
'OPACSuggestionMandatoryFields')
Signed-off-by: Bin Wen <bin.wen@inlibro.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit b9bff787ca)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Before the patch from bug 14385, the passed structure (that is returned
by get_approval_rows() looks like:
\ [
[0] {
approved 1,
approved_by 51,
approved_by_name undef,
date_approved "2019-02-26 15:36:42",
term "another",
weight_total 3
},
[1] {
...
After the introduced 'filtering', we loose the information about the
term weight!:
\ [
[0] {
approved 1,
author "Heylin, Clinton.",
biblionumber 1,
borrowernumber 51,
date_created "2019-02-26 15:36:37",
language undef,
subtitle [],
tag_id 1,
term "word",
time_created_display "15:36:37",
title "E Street shuffle :",
visible 1,
XSLTBloc "
<<<BUNCH OF GENERATED HTML HERE>>>
...
The code even calls GetMarcBiblio. This needs to be reverted as it is
plain wrong. If it was worth removing *some* biblios from the
weight_total value, then this calculation should be done somewhere else,
without fetching the MARC data again.
Signed-off-by: Claudio <costalc@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 28bcc5aa68)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
To test:
1 - Enable OverDrive and RecordedBooks (you can put anything in the
prefs)
2 - Search on the opac - verify you get results (or search error) on
first page of results'
3 - Go to second page of results - OD and RB are not searched
4 - Apply patch
5 - Verify nothing has changed
If you have valid credentials:
1 - Enable RB prefs
2 - Sign in with an account that has an email matching your registered
account for recordedbooks
3 - Confirm you RB account loads on opac-user.pl
Otherwise:
Read the patches, verify it all makes sense
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 7a44c9edb9)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Silly bug caused by:
commit ef410fd62f
Bug 20287: Replace occurrences of AddMember with Koha::Patron->new->store->borrowernumber
Constructors take a hashref!
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 59b740613e)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This is a follow-up of bug 5371
The following command must not return anything:
grep ^output_html_with_http_headers `git grep -l -P "authnotrequired\s*=>\s*0" opac`|grep -v force_no_caching
This must be a test somehwere to prevent further regressions.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The category parameter should be restricted to 1 or 2 (private/public). In
order to keep same behavior, no parameter means 1 (private).
Note: Adding the same line in intranet counterpart.
Test plan
[1] Check for category empty, '1a', '11' etc. And with script ;)
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The cart uses the same item-status.inc that the details page uses, however, we don't
set the waiting or reserved flags. This patch adds those flags to the script
To test:
1 - Find an item on the opac
2 - Place a hold on the item
3 - Check in the item to confirm the hold
4 - Note the details page on OPAC shows 'On hold'
5 - Add the item to a basket
6 - Note the basket shows 'Available'
7 - Apply patch
8 - Check the cart, should show as 'On hold'
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit e2fa6d97ef)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
On sci-main.pl the preference value is tested for 'defined'. This patch
tests it is different than empty string too. This was causing a
JavaScript syntax error, that made it display a wrong message.
To test:
1 - Blank the syspref SelfCheckInTimeout
2 - Attempt to checkin something via sci
=> FAIL: The 'Your request included no check-ins.' message is printed.
3 - Apply this patch, reload the sci-main.pl page
4 - Attempt to checkin something via sci
=> SUCCESS: The UI correctly stacks the scanned barcodes
5 - Sign off :-D
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit c1949cda9b)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Trivial fix, similar to opac-detail, applied to ISBD and MARC detail.
Test plan:
Enable ArticleRequests pref.
Make sure you have a biblio with no item type in 942c. (Perhaps you need to
make 942c not mandatory temporarily and save a biblio record without this
field being filled.)
If you are logged in, log out.
Go to MARC or ISBD detail page. No crash anymore?
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit b78bd2faec)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
In the case of a specific item hold, it can only be fulfilled if the pickup library
matches the hold fulfillment policy. Therefore, if OPACAllowUserToChooseBranch is
set to don't allow, the pickup library should correspond to the policy.
In case of hold that does not specify an item, the homebranch or holdingbranch
can't be determined at this time, so the pickup library still defaults to the
homebranch of the borrower. Same if there is no policy or it states 'any'.
To test:
- Make sure OPACAllowUserToChooseBranch is set to don't allow
- Make sure you have two branches A and B
- Have one item whose homebranch is B
- Have one user whose homebranch is A
- Make sure the circulation rules allow the user to reserve the item's item type
1. Go to Administration > Circulation and fines rules
2. Create a Default holds policy by item type for that item type
- Item type = item's item type
- Hold policy = From any library
- Hold pickup library match = item's home library
- Return policy = item returns home
3. Go to the OPAC and log in with the user's credentials
4. Search for the item
5. Click on "Place hold"
6. Select a specific item and confirm hold
7. In the user's file on the OPAC and check the reservation's pickup library. It should be the item's homebranch
You can then repeat the steps for 'item's holding library' or 'any library' as
the Hold pickup library match. It should also work the same way if there is no
'Default holds policy by item type' for this item type but a 'Default checkout,
hold and return policy' set.
Finally, check that placing a hold without selecting a specific item still
defaults the pickup library to the borrower's homebranch.
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 275dee5f9b)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
When exporting a record with diacritics in RIS
format from the detail page in OPAC the encoding
is not correct and the diacritics appear broken.
This patch fixes it.
To test:
- Find or create a record with some special
chars in your OPAC
- Go to the detail page
- Save as > RIS
- Verify the diacritics are broken in an editor
- Apply patch
- Repeat and verify everything now displays correctly
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit bfeac64865)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit e98dacf9f1)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
opac-article-request-cancel.pl doesn't check that the article request to
be cancelled actually belongs to the logged-in borrower. This results in
any logged-in user being able to cancel any article request just by
changing the id in the URL.
Test plan:
- Login with Patron P1, create an article request
- Cancel it
- Create another one
- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
- Login with Patron P2
- Hit the cancellation link
=> Without this patch the article request is cancelled
=> With this patch applied there is a 404 redirection
Note that the 404 will also appears when the article request id does not
exist.
Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 0b931d5de3)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Caused by
commit 7d10549ae8
Bug 21205: Replace C4::Items::GetOrderFromItemnumber calls
At this point $order is a Koha::Acquisition::Order object, not a hashref
anymore.
Test plan:
Create an order, receive items
Enable OPACAcquisitionDetails
At the detail page of the bibliographic record you should see
"X items are on order." at the bottom of the items list
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 2331b8a295)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Like Bug 20702 defined GetHostItemsInfo does nothing if EasyAnalyticalRecords pref is disabled, there are other places where code must be dependant on this pref.
Test plan :
1) Build an analitical record with 773$0 and $9
2) Enable EasyAnalyticalRecords
3) Don't apply patch
4) Go to OPAC
5) Perform a search that displays the record, check there is the linked item
6) Open record detail page, check there is the linked item
7) Apply patch and redo 5) and 6)
8) Disable EasyAnalyticalRecords
9) redo 5) and 6), you should not see the linked item
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 7266d50dd2)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit d4726c7132)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
When Koha charges for holds, a message with the fee is
shown before the patron places the hold. The amount needs
to be formatted according to CurrencyFormat system preference.
To test:
- Add a hold fee to your patron category
- Log into the OPAC
- Search for a record to place a hold on
- Click Place hold
- Verify there is a note showing about the hold fee
- Toggle CurrencyFormat and HoldFeeMode and verify
that the formatting is always correct
Signed-off-by: Jack Kelliher <jke0429@stacmail.net>
Signed-off-by: Mikael Olangcay Brisebois <mikael.olangcay-brisebois@inlibro.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 4f0618a888)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Also fully qualifies some subroutine calls that fail for reasons unkown.
Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 2cd3a71871)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch fixes an issue where patron is not allowed to place a hold in OPAC
while their home library is not a pickup library.
Instead, they should be presented with a list of other available pickup locations.
Signed-off-by: Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 3a69ec5e05)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
There was a mix up between "modification" and "edit" for $action in
opac-memberentry.pl.
If a patron is logged into the OPAC and they attempt to submit changes to their
personal details without having actually changed anything, the page reloads with
a message stating 'No changes were made.' However, the fields that now appear
are those that have been allowed/hidden according to the preferences set for
patron self registration, even if patron self registration is disabled. This can
lead to problems if there are discrepancies between the fields allowed for self
register settings and those allowed for patron self modification settings.
To replicate:
1.) In Administration › System preferences > OPAC, set PatronSelfRegistration to
'don't allow'
2.) Modify the unwanted fields for PatronSelfModificationBorrowerUnwantedField
and PatronSelfRegistrationBorrowerUnwantedField so that at least one field is
different between the two settings and save (for example, specify 'mobile' to be
hidden in the former, but don't include in the list of fields to be hidden in
the latter).
3.) Log into the OPAC and navigate to the 'your personal details' tab. Notice
that the editable fields correspond to those not hidden by
PatronSelfModificationBorrowerUnwantedField
4.) Without making any changes, click on 'Submit update request'.
5.) Note that on this page the fields correspond to those not hidden by
PatronSelfRegistrationBorrowerUnwantedField and are now editable (including any
fields that would otherwise be hidden by the Self Modification settings).
Reported-By: Chris Slone <cslone@camdencountylibrary.org>
Signed-off-by: Devinim <kohadevinim@devinim.com.tr>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit e0b1f945f9)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Overdrive configuration generally defaults to cardnumber, however, they
have confirmed that some libraries use usernames. We need to allow for
both scenarios.
To test:
1 - Have an OverDrive account setup with SIP authentication
Note: You can apply for a testing account at developer.overdrive.com
and setup an environment
2 - Fill in all your OverDrive system preferences
3 - Test with a patron whose username is their cardnumber
4 - Confirm their overdrive account tab on opac loads
5 - Change the username to be another value like "borked_wont_work"
6 - Note the overdrive account tab won't load
7 - Apply patch, update database, not new system preference
OverDriveUsername (default to 'cardnumber)
8 - Note the OD account loads successfully
9 - Change the system preference to 'user name' - the account load fails
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 96adab7af8)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This patch makes the controller just call $patron->set_password and use
the exceptions it might raise instead of manually checking the passwor
strength.
No behaviour change should be expected. It also removes some leftovers.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 3f734900f0)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Remove sql statement to change password by calling set_password.
Remove sub goodkey by calling C4::Auth::checkpw_hash.
Adding the scalar before param Oldkey (from bug 21036).
Rebased on top of 21178 (using set_password instead of update_password).
Test plan:
Try to change password in OPAC with good and bad pw.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 085cfc6bca)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
In several places we escape quotation marks using
$value =~ s/"/"/g;
All the occurrences are wrong and must be removed.
Most of them are leftover of bug 11638 (Remove HTML from
addbiblio.pl), which removes the construction of html from pl scripts.
The problem has been highlighted by bug 13618, I did not track down why
the issue did not exist before (?)
Test plan:
0/ Use strings with quotation marks, like:
'Fiddle tune history : "bad" tunes'
You can also use other html characters to make the tests more complete,
like 'Fiddle tune history : <"bad" tunes>'
1/ authorities/authorities.pl
a. Edit an authority filling different fields with quotation marks
b. Edit it again
=> The display (inputs' values) is wrong, if you save the escaped quotes
will be inserted
2/ cataloguing/addbiblio.pl
Same editing a bibliographic record
3/ cataloguing/additem.pl
Same editing items
4/ members/memberentry.pl
Edit a patron's record and fill some fields with quotation marks
+ fields borrowernotes and opacnotes
=> The quotes are inserted directly in DB (escape is done before the
insert!)
5/ opac/opac-review.pl
For QA only: $js_ok_review is never used
6/ tools/batchMod.pl
For QA only: $value is always undefined at that point
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit d561273ef8)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
The subject of the cart and list emails is not correctly
encoded and displays incorrectly in some email clients.
To test:
Lists:
- Create a list, name it using umlauts or other diacritics
Example: Jugendbücher (books for youths in German)
- Add some items to your list
- Email yourself the list
- Verify that the email subject is broken
Cart:
- Install another language with non-latin characters like Greek
- Fill the cart with some titles
- Send yourself the cart
- Verify that the email subject is broken
Note: Some email clients display correctly, others not.
It's known to be incorrect in Outlook and web.de,
displaying nicely in Thunderbird.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested all four scripts by manipulating the cart text too in templates.
Follow-up handles intranet sendshelf.
Note: I asked Katrin to remove the encode UTF-8 statements, since we
convert to MIME and the subject line should never be UTF-8.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This is done to ease the move of C4::Items (bug 18252) to Koha::Items
my @itemnumbers = GetItemnumbersFromOrder($order->{ordernumber});
will become
my @itemnumbers = $order_object->items->get_column('itemnumbers');
Test plan:
- Create an order with several items
- Receive some items
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch was generated using codespell
Test plan:
Read through changes and confirm they make sense
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
https://bugs.koha-community.org/show_bug.cgi?id=21706
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Test plan (having Koha working with Elasticsearch):
- apply this patch,
- try searches with and without weight defined on search fields
https://bugs.koha-community.org/show_bug.cgi?id=20262
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
See QA request at comment7.
Removing camelcase from subroutinename.
Renaming module to Koha::Util::Navigation (after cmty feedback).
Test plan:
Run t/Koha/Util/Navigation.t.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
With the work from the former patch, we now have a nice and easy replace..
NOTE: The additional logic in opac-changelanguage.pl is now also applied
to the intranet counterpart (changelanguage.pl). This effectively makes
changelanguage.pl no longer refer to external URLs (as the opac already
did by testing the referer). Might be just theoretical, but consistent.
Test plan:
Test changing language from various OPAC and staff locations.
Include language=[some_language] in the URL before changing language.
[Bonus] Test calling changelanguage.pl from another server. You should no
longer be referred back to the calling server. (See below.)
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Added link <a href="[mystaffserver]/cgi-bin/koha/changelanguage.pl?language=en">link</a> somewhere on external server.
Verified that without this patch, it hits the staff server and refers back to the caller. But with this patch, it refers to staff homepage.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
David Cook
Jonathan Druart
Nick
Marcel de Rooy
Tomas Cohen Arazi
Mason James
Liz Rea
Julian Maurice
Mark Tompsett
Maryse Simard
Katrin Fischer
Fridolin Somers
Kyle M Hall
Lari Taskula
Katrin Fischer
Josef Moravec
Alex Arnaud