Commit Graph

50255 Commits

Author SHA1 Message Date
Jonathan Druart af12bbf07c Bug 36816: Remove warning
Use of uninitialized value in string eq at /kohadevbox/koha/opac/opac-memberentry.pl line 629.

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:19 +00:00
Jonathan Druart accee940a1 Bug 36816: Restore clearing patron attributes - OPAC
1) Add a new patron attribute type, visit:
<staff_url>/cgi-bin/koha/admin/patron-attr-types.pl?op=add_attribute_type
2) Add a code and a description (whatever) - Make it 'Display in OPAC' and 'Editable in OPAC'
3) Access OPAC patron personal details page, visit:
<opac_url>/cgi-bin/koha/opac-memberentry.pl
4) Scroll down and add some info to 'whatever'. Click 'Submit update request'.
5) Visit the INTRA 'update patron requests from opac' page:
<staff_url>/cgi-bin/koha/members/members-update.pl
6) Notice the entry is there. Select 'approve' and click "Submit"
7) Repeat 3)
8) Scroll down and notice the approved value is there. Clear that data and "Submit update request" (as if you're requesting for that data to be removed/cleared)
9) Repeat 5)
10) Notice there's an entry, and it is not empty. Select 'approve' and click "Submit"
11) Repeat 3)
12) Scroll down and notice the request to update (clear) that field did go through, i.e. the data is not there anymore.

Also test self-registration and mandatory attributes

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:18 +00:00
Fridolin Somers acdf69f36d Bug 35441: Fix typo 'UniqueItemsFields' system preference
Typo in message :
NOTE: Fields listed in the 'UniqueItemsFields' system preference will not be copied

The preference is Item without 's' : 'UniqueItemFields'

Test plan :
1) Check system preference 'UniqueItemFields' contains values
2) Go to acquisition to create a new order from new record
3) Check the note you see with the system preference

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:18 +00:00
Emmi Takkinen 5db2e6ab2b Bug 37369: Fix filtering of search result table in item search
At the moment, the filtering on item results page
requires using the code in the following fields:
- Collection
- Home library
- Current library
- Shelving location
- Itemtype
- item status -fields (not for loan etc)

So e.g. "Centerville" in Home library -field doesn't
bring back results but code "CPL" does. This happens
because "columns" option in search results table
isn't working when its used in function columnFilter.
However option "aoColumns" works.

To test:
1. Navigate to item search and search items.
=> Note that all filters in search result table
are free text fields.
2. Attempt to filter search results by home library
with description of some library.
=> No results are displayed.
3. Now filter results with code of the library.
=> Results are now displayed.
4. Apply this patch and refresh page.
5. Search items again.
=> Note that now some of the filters are now using
dropdown select fields.
6. Attempt to filter results by home library again.
=> Results are now displayed correctly.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: Olivier Hubert <olivier.hubert@inlibro.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:18 +00:00
Jonathan Druart 6307c269b5 Bug 37983: Restore auto-focus on patron input when "Schedule a pickup" is selected
In the curbside pickup module, when the "Schedule a pickup" tab is selected we expect
the patron search box to get the focus. But it has been broken bug 30965 (which changed the id of the input).

Test plan:
Setup curbside pickup for your library
Go to Circulation > Curbside pickups
Click the last tab
Notice that you can directly search for a patron, the input has the
focus

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:17 +00:00
Chloe Zermatten dafb21b756 Bug 37730: Batch patron modification header scroll
When scroling down <staff_url>/cgi-bin/koha/tools/modborrowers.pl,
there is a point where the table header leaves the normal flow of
the page to stick to the top of the screen instead. When this
occurs, the header becomes fixed: if scrolling through the table
horizontally, only the body will move. This is an issue as it means
that in this situation, some column headers cannot be viewed and the
data does not necessarily match the header under which it is found.

This patch resolves this issue by allowing the header to scroll
horizontally and ensuring that the width of the column headers
still match that of the columns themselves.

Test plan:

A) Reproduce the bug as per Pedro's intructions:

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 13:30:17 +00:00
Phil Ringnalda 1471593254 Bug 37656: XSS in Advanced editor from Z39.50 search results
The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.

Test plan:
 1. Not a dependency, but you'll avoid getting even more alerts while batch
    importing by starting with the patch from bug 37654
 2. Without this patch applied, download attachment 170421
 3. Administration - set the preference EnableAdvancedCatalogingEditor to
    Enable
 4. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - Stage for import
 5. Once the background job finishes, View batch (getting alerts if you
    didn't apply the patch from bug 37654) - Import this batch into the
    catalog
 6. When the import finishes, Search the catalog for script, on the imported
    record Edit record (if you wind up in the basic editor, Settings - Switch
    to Advanced editor)
 7. In the left sidebar below the search inputs, click Advanced », check
    the checkbox for Local catalog and uncheck any others, then search for
    the Title script
 8. You'll get five alerts, and the word "edition" displayed in huge text
 9. Close the search popup, apply patch, shift+reload the advanced editor
    page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
    the title and the other <script> inclusions.

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:15 +00:00
Phil Ringnalda 73ded0316a Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading
We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.

Test plan:

1. Without the patch, search for any record in the catalog and click Edit
   record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
   at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
   of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
   should display in italics, and the "(Record number nnn)" after it should
   not be italicized.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:14 +00:00
Phil Ringnalda d5ddc1b542 Bug 37654: XSS in Batch record import for Citation column
Viewing a staged MARC record batch loads a DataTable from
/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the
DataTable just trust the author/title/isbn/issn to be free of HTML. They
shouldn't.

Test plan:
1. Without this patch applied, download attachment 170418, then Cataloging
   - Stage records for import - Select the downloaded file - Upload file -
   Stage for import
2. When the background job completes, View batch - you'll get three alert()s
   from the title, author, and ISSN, and the author and ISSN displayed huge
3. Apply patch, restart_all
4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero
   alerts and no <h2> display

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:14 +00:00
Lucas Gass 741fb833d0 Bug 37720: (follow-up) Adjust tests
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:14 +00:00
Jonathan Druart 26adab7f62 Bug 37720: Prevent XSS in label creator
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.

Test plan:
 1. Without this patch, but with the patch from bug 37654 so you don't get
    alert()s in batch import, download attachment 170675 [details]
 2. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - when the upload finishes Stage for import - when staging
    finishes View batch (get alert()s if you didn't apply bug 37654) - Import
    this batch into the catalog
 3. Once the import finishes, Cataloging - Manage staged records
 4. In the row for your import, in the # Items column, click "(Create label
    batch)"
 5. In the "Label batch #n created" message, click the link to the batch #
 6. Because the batch includes a call number with an open <script>, you'll
    get XSS alert()s and then one about something going wrong while loading
    the table, with only one of the two records showing in the batch editor
 7. Apply patch, restart_all
 8. Cataloging - Label creator - Manage Label batches
 9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
    rather than being interpreted as HTML

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:13 +00:00
Jonathan Druart 803e7a4b6d Bug 38035: Exclude "sound" from the list of installed languages
Not sure how this is coming from, neither why we have not noticed that
before, but "sound" is listed under `koha-translate --list`

It's coming from `ls koha-tmpl/intranet-tmpl/prog`

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:13 +00:00
Jonathan Druart 2ebfce62b2 Bug 38357: Prevent holidays to be wrongly added
This patch resets @holiday_list to an empty array, to prevent holidays
to be accumulated in worker's memory.

If you added single holidays to library A then others to library B,
holidays from A were also added to B.

Test plan:
Go to /cgi-bin/koha/tools/holidays.pl
Define the holidays for Centerville
 Select a date
 To: another date (pick only 2 days to ease testing)
 Set a title "cpl"
 Tick "Holidays on a range"
 Save
Define the holidays for Fairview
 Select *another* date
 To: another date (pick only 2 days to ease testing)
 Set a title "fpl"
 Tick "Holidays on a range"
 Save

=> Without this patch Fairview has 4 days of holidays instead of 2
=> With this patch applied the dates you selected are considered
holidays for Fairview

Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:12 +00:00
Owen Leonard a68a58fdce Bug 31450: Make additional contents publication date required
HTML customizations and news will not display without a publication
date, so we should make it required. This patch adds client-side
validation of the field to check that it's filled.

To test, apply the patch and go to Tools -> News (or HTML
customizations, or Pages).

- Click "New entry"
- Try to submit this new entry without entering a publication date.
- You should be prevented from submitting the form.
- Fill in the publication date and confirm that the form submits
  correctly.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:12 +00:00
David Cook 425b9d86a9 Bug 38826: Make check_api_auth $sessionID consistent
This change makes $sessionID consistently return using the session
ID and not sometimes the session object.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
    -H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
    'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    -d "login_userid=<USERID>&login_password=<PASSWORD>" \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
    --cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
    -XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
    --cookie /tmp/test.cookies --data @rec.marcxml

Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-03-31 09:42:12 +00:00
Paul Derscheid 270b3caf09
Correct generated release notes for 22.11.25
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 19:41:54 +01:00
Paul Derscheid 6e3eefa464
Also increment version for 22.11.25 release in Koha.pm
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 19:41:52 +01:00
JesseM d46bf54042 generate release notes for 22.11.25
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 16:15:04 +00:00
JesseM 0d7679f08b increment version for 22.11.25 release 2025-03-24 16:03:18 +00:00
JesseM 5c3ce15319 Merge branch '22.11.x-security' of git.koha-community.org:Koha-community/security into 22.11.x-security
modified:   misc/release_notes/release_notes_22_11_24.html
	modified:   misc/release_notes/release_notes_22_11_24.md
2025-03-24 15:46:26 +00:00
David Cook 54a804b0fe Bug 31165: Scrub "Public note" field for Course Reserves
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save

6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"

12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"

16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit cf3874f8a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 15:39:28 +00:00
Marcel de Rooy d45d82c2d9 Bug 37784: [24.05] (QA follow-up) Add few tables to Koha::Database::Columns
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.

Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit d485d1f2ae)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 15:33:41 +00:00
Marcel de Rooy fc318bf72d Bug 37784: [24.05] (QA follow-up) Bail out to new definition
The code went back to step 3 but the error message is not there.
It is easier to go back to the start: no need to fetch columns.
And this is now an exception; it will only come up when trying
malicious things.

Also turned foreach and unless forbidden around. No need to go
into the loop when we found a forbidden field.

Test plan:
See first patch. You should see the message now.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit a4888ff9a9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 15:33:19 +00:00
Aleisha Amohia 87587a17e6 Bug 37784: [24.05] Do not show forbidden columns in reports dictionary
This patch prevents forbidden columns from being selected using the reports dictionary.

To test:

1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value

6. Apply patch and restart services

7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected

9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:

<option value="borrowers.password">Card number</option>

11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.

13. Ensure tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit dbfb62c63b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 15:32:38 +00:00
Paul Derscheid 5116f99179
Correct release notes for 22.11.24 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-03 15:03:32 +01:00
JesseM 44070a1697 generate release notes for 22.11.24
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-26 17:28:39 +00:00
JesseM b78c5be5f6 increment version for 22.11.24 release 2025-02-26 17:01:39 +00:00
Tomas Cohen Arazi 7690c3933e
Bug 36081: Fix tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:35 -03:00
Marcel de Rooy 11a8bdc6b6
Bug 36081: (QA follow-up) Resolve IsNotDebit exception in ArticleRequests.t
Resolve (when running ArticleRequests.t):
Exception 'Koha::Exceptions::Account::IsNotDebit' thrown 'Account line 326 is not a debit'

This occurs after switching from ArticleRequest->new to TestBuilder.
TestBuilder creates an account line that has a credit_type_code and
a debit_type_code. (This could be fixed further somewhere else.)
For now, just setting debit_id to NULL.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:34 -03:00
Jonathan Druart 5edeb0cfa9
Bug 36081: Fix some failing tests
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:34 -03:00
Jonathan Druart c5b29fc66d
Bug 36081: Mock format
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:33 -03:00
Jonathan Druart 7a39c12f11
Bug 36081: Force TestBuilder to generate a valid format value
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:32 -03:00
Jonathan Druart ee8b3272a3
Bug 36081: Use multivalue_preference
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!

Let support both here.

This patch also removes silly JS code in the template.

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:31 -03:00
Tomas Cohen Arazi a3f1b3a307
Bug 28907: (follow-up) $c->auth->public should be run inside a try block
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 09:37:58 -03:00
Marcel de Rooy fc5c82dc18
Bug 37816: (QA follow-up) Avoid repetition, typo and pipe test
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.

Test plan:
Run t/SIP/Sip.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-02-25 16:35:00 -05:00
Marcel de Rooy 177ce2f4bd Bug 36081: Check SupportedFormats server side
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-25 20:40:53 +00:00
Lari Taskula 6d386a490e Bug 28907: REST - Drop support for allow-owner functionality
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.

Old method, was applicable to both privileged and public routes:

  api/v1/swagger/paths/route.yaml

  x-koha-authorization:
    allow-owner: true
    allow-guarantor: true

New method, use public routes with no x-koha-authorization:

  GET /public/route/{patron_id}
  Koha/REST/V1/Controller#public_action:

  sub public_action {
      my $c = shift->openapi->valid_input or return;
      my $patron_id = $c->param( 'patron_id' );
      try {
          # Throws an exception that will render a response of 401 if not
          # authenticated and 403 if trying to access another user's resources
          $c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
          ...
          # other code
          ...
      }
      catch {
          $c->unhandled_exception($_);
      }
  }

  Another example of retrieving $patron_id when patron_id is not a request
  parameter:
  GET /public/another/object/{another_object_id}

  my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
  try {
      # 403 if $another_object_id does not belong to API user
      $c->auth->public($patron_id);
      ...

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:37:36 +00:00
Lari Taskula bdea221c9c Bug 28907: REST - Remove allow-owner from public article requests cancel route
To test:
1. prove t/db_dependent/api/v1/article_requests.t
2. Apply patch
3. prove t/db_dependent/api/v1/article_requests.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:37:36 +00:00
Lari Taskula a26ed2bb60 Bug 28907: REST - Remove allow-owner from public patron hold cancellation
To test:
1. prove t/db_dependent/api/v1/patrons_holds.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_holds.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:17:00 +00:00
Lari Taskula d89acecd45 Bug 28907: REST - Remove allow-owner from public guarantors can see charges and checkouts
To test:
1. prove t/db_dependent/api/v1/patrons.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:16:59 +00:00
Lari Taskula 330177c7d3 Bug 28097: REST - Remove allow-owner from public password route
To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:08:39 +00:00
Lari Taskula e0b56711b3 Bug 28907: Add Koha::REST::Plugin::Auth::PublicRoutes
To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:05:47 +00:00
Lari Taskula 281be087a6 Bug 28907: Add REST exceptions for public routes auth
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm

More tests coming in following patches.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:00:24 +00:00
David Cook 7c32c490ea Bug 39170: Improve validation of report ID
This change improves the validation of the report ID passed by the user.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-24 17:00:49 +00:00
David Cook 7152b64f67 Bug 38488: Add Template::Toolkit filter for C4::Scrubber
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-24 16:59:37 +00:00
David Cook 09a922b1ee Bug 38469: Replace single quotes with double quotes to prevent XSS
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)

3. To test the XSS is patched, try the proof-of-concept from the
bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-24 16:58:13 +00:00
Jonathan Druart a67fcb8cdf Bug 38829: Add a test
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 6388b14ba0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-19 14:33:46 +00:00
Jonathan Druart ec77a84c1c Bug 38829: Sanitize GetLateOrMissingIssues inputs
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 580fa86f25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-19 14:33:45 +00:00
Phil Ringnalda eea67c7254 Bug 38467: (follow-up) Update cpanfile
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 3371577b42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-19 14:33:45 +00:00
Phil Ringnalda 8ea6172e5b Bug 38467: (follow-up) Fix test
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 7f999e0699)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-19 14:33:45 +00:00