Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit d9735ae0d8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a69b874ee6)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Test plan:
1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8a20bfe5ea)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Test plan:
Behave like a robot, you will get 404
Be a human, you will be tracked
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 40ca9443a8)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Use of uninitialized value in concatenation (.) or string at C4/Biblio.pm line 1456.
Note: In current master this is now line 1370 (Oct 9, 2017).
Test plan:
Enable COinSinOPACResults.
Select a record with leader pos6==a and pos7==a. This triggers genre to be
journalArticle and titletype to be a.
Without this patch, do an opac search that includes this record.
Check the log. You should see the warning.
Apply this patch, search again and check the log. The warning should not be
repeated again.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a82d54d4b4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0e1bc5db82)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
The info "Subscription from..." is showing twice on the subscription
tab on the OPAC detail page because of a bad merge. This patch removes
the doubled up information.
To test:
- Add a subscription
- Search for the record in the OPAC
- Switch to the subscription tab
- Verify that the 'Subscription from...' line is repeated
- Apply patch
- Verify only one line remains and nothing is missing
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field firstname, surname that contains js
3. Save the page.
4. click on fine tab
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We already know if the bibliographic record exists (404 redirect),
we can avoid unecessary fetches
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Correcting a few biblionumber template var leftovers in opac-detail
template. They were combined with url filter instead of html.
Test plan:
[1] Look for [^.;?]biblionumber in opac-detail.tt and verify that these
occurrences are fine.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Try going to this URL on your site: /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>
Test Plan:
1) Go to /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>
2) Note <TEST> is embedded all over the html
3) Apply this patch
4) Refresh the page, note the injection is gone!
5) run koha qa test tools
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To confirm all the files were modified for opac, typed
this:
$ git grep -i password | grep opac | grep -v "[.]po:" | grep
"opac[^/]*[.]tt:" | cut -f1 -d: | sort -u
The follow output was handled as follows:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
These were already done in the first patch.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
This already had the autocomplete modification.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
This was a false-find. There was no modification necessary.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
This is the modal login in. This patch amends it.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To test:
1/ go to /cgi-bin/koha/acqui/booksellers.pl or
/cgi-bin/koha/acqui/supplier.pl
2/ Note that it displays the delete vendor button instead of the
receive shipments button
3/ Apply patch
4/ Reload the page and notice the button is fixed
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The build_object method of TestBuilder has been added by bug 18182,
which is not in 16.11.x
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
JSON does not allow real line-breaks. If a field contains them and they are not escaped, a JSON parser will be unable to convert the stringified JSON back into an object.
This is clearly exemplified by the guarantor search, where a multi-line note on the guarantor's record will break the ability to select that guarantor.
Test Plan:
1) Create Patron A with a "Circulation note" that has multiple lines in it
2) Create Patron B
3) Attempt to set Patron A to be the guarantor for Patron B
4) Note selecting the patron does nothing
5) Apply this patch
6) Repeat step 3
7) Selecting the guarantor now works!
Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9cd9240c36)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit efb28c4af1)
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Patch applies and functions as described.
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 48be40d1bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit fa0608bc4c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
This has been raised by failures on t/db_dependent/Circulation/issue.t
(thanks tests!)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 850243ee2e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9d3b39e94d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
MarkIssueReturned must now return directly if the issue does not exist.
We then check if the anonymous patron configuration is correct.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 60bb936bc2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 49beda2176)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To recreate:
1 - Manually add a lost fine to a ptron and include a barcode
2 - Attempt to write off the fine
3 - Internal server error
4 - Checkout an item and mark lost to checkin and fine
5 - Attempt to write off line
6 - Internal server error
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7b5c1fce58)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 243009bc9a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Allow patrons to enter either their library card number or user name in the "Log in" box for password recovery.
Most patrons at our library use their card number to log in and are unaware of what their userid is. However there are some who have set a
customized userid and would prefer to use that. This patch would allow either to be entered for password recovery.
To test:
1. Enable the password recovery feature.
2. In the OPAC, click on "Forgot you password?" link and enter a valid library card number.
3. The error message "No account found with the provided information" appears.
4. Apply the patch.
5. Repeat step 2. The recovery email is now sent.
Note: Moved patch from 16711 back here and re-tested.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e29163af4c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 17085ea1cb)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
CanBookBeIssued returns STATS if categorycode is X
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 090b450a50)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit fc4ee4aeec)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
1 - Have a patron with guarantees
2 - Charge some fines to the guarantees
3 - View the patron
4 - Fines are displayed unformatted
5 - Apply patch
6 - Refresh
7 - Fines should now be formatted correctly
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0d124e1bc3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 448c1206f8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
TEST PLAN
---------
0) back up database
1) drop database; create database
2) run web installer
3) prove t/db_dependent/Search.t
-- the spammy warnings (other than zebra index warnings) may
already be fixed, but the mocked value was not realistic.
4) apply patch
5) prove t/db_dependent/Search.t
-- notice only zebra index warnings.
6) run qa test tools
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5e63a38381)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 23c8acd615)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Adds a missing error flag to the template->param { } call.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 078eb77451)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 96143e8d9e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
When searching for a patron from the circulation tab, the results table
shows the date of birth unformatted.
Test plan:
Apply this patch, search for patrons in the circ tab and confirm that
the date of birth are correctly formatted according to the dateformat
syspref
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4edfc7900f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 7453b2c5d8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
In the meantime bug 19403 added default nulls for gonenoaddress, lost
and debarred. So these lines can be removed safely.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 12a754a703)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3e45ba75e9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Depending on the values used by TestBuilder, some tests from t/db_dependent/SIP/Patron.t can fail
# Failed test 'Not blocked without overdues when set to 'Don't block''
# at t/db_dependent/SIP/Patron.t line 55.
# got: '0'
# expected: '1'
# Failed test 'Not blocked without overdues when set to 'confirmation''
# at t/db_dependent/SIP/Patron.t line 61.
# got: '0'
# expected: '1'
# Failed test 'Not blocked without overdues when set to 'Block''
# at t/db_dependent/SIP/Patron.t line 67.
# got: '0'
# expected: '1'
Caused by this check in C4::SIP::ILS::Patron->new
110 for (qw(EXPIRED CHARGES CREDITS GNA LOST DBARRED NOTES)) {
111 ($flags->{$_}) or next;
[...]
115 if ($flags->{$_}->{noissues}) {
116 foreach my $toggle (qw(charge_ok renew_ok recall_ok hold_ok inet)) {
117 $ilspatron{$toggle} = 0; # if we get noissues, disable everything
118 }
119 }
120 }
Test plan:
Execute several times (50x?) these tests.
Without this patch they may fail
With this patch they must never fail
Signed-off-by: David Bourgault <david.bourgault@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6545cfe3f3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 40c444cc2b)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Works as outlined in test plan, search terms now appear at top as h1 as well
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit f24e339dd6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0cad7e54cd)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To test:
1) Go to Admin -> search for a system preference
2) Notice your search stays in the search box (this is inconsistent with
search behaviour across Koha)
3) Apply patch and refresh page
4) Make another search
5) Confirm search still works as expected and search terms have been
cleared from search box
6) Confirm search terms show at the top of the results
Sponsored-by: Catalyst IT
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit f10f6a19c5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit e6fc2dfc80)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The two categories created by this test script are not removed
Test plan:
without this patch, the two authorised value categories 学協会μμ and
tòmas are not removed when the script finishes.
Now it does!
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 269c21d984)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 354645ef30)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
cataloging.js might not always be loaded with select2.js, so we should
check its availability to prevent JS errors
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 56a0aabc58)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1d450ad13a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Overview:
Repeat tag fails if authority field has select subfield (for example, UNIMARC 700$8, 800$a)
This patch adds Select2 to authority editor
Steps to Reproduce:
In authority editor repeat field that has select subfield
Actual Results:
Field does not repeat (copy is not created).
Console shows a js TypeError in cataloging.js: «$(...).select2 is not a function»
Expected Results:
Field will repeat (copy is created)
Additional Information:
Error happens in version 16.11+ after adding Select2 js functions. The easiest way to fix is to add Select2 to authority editor
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2f5a319b0a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit de4fd901d3)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Jonathan Druart
Josef Moravec
Marcel de Rooy
Chris Cormack
Bernardo Gonzalez Kriegel
root
Katrin Fischer
Amit Gupta
Kyle M Hall
Mark Tompsett
Gwendal Joncour
David Cook
David Kuhn
Pongtawat C
Nick Clemens
David Bourgault
Aleisha Amohia
Julian Maurice
Oleg Vasylenko