In the OPAC display of titles on a list, the "Remove from list" control
needs to trigger a POST operation instead of GET. This patch
appends a form for handling single entry deletions, populating
the hidden input upon confirmation.
To test, apply the patch and create a list if necessary, adding multiple
titles to it.
- View the contents of your list.
- Each title on your list should have a "Remove from this list" link.
- Click one of these. You should see a modal confirmation, "Are you
sure you want to remove this item from the list?"
- Confirming should delete the title form the list.
- Check multiple checkboxes in the list of titles and click "Remove
from list" at the top of the list.
- You should see a modal confirmation, "Are you sure you want to
remove these items from the list?"
- Confirming should result in all checked titles being removed
from the list.
- Check one or more checkboxes and then click a single "Remove from
list" link. After confirming, you should find that only the one
title was removed from the list.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ace488e50f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you have an SQL report that selects cardnumber from borrowers, you
get a menuitem to send the results to Batch patron modification. Currently
that fails with a message about no card numbers or borrowernumbers given,
because it tries to do a GET with the op show, when modborrowers.pl is
expecting a POST with the op cud-show.
Test plan:
1. Without the patch, Reports - Create from SQL - name it and paste
select cardnumber from borrowers
in the SQL textarea and save, then Run report.
2. Above the results is a "Batch operations with 20 visible records" menu,
choose Batch patron modification
3. Note that instead of modifying the records, you're stuck with a message
saying "No patron card numbers or borrowernumbers given." even though
there's a whole string of them in the URL.
4. Apply patch, refresh the page with the results (oddly, no apparent need
to even restart_all), and choose the menuitem again, but this time with
a successful result.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a85086d827)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When duplicating a child card with a guarantor, the guarantor information
appears during the card creation process, but disappears as soon as saving
the card. To recreate:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
New test plan:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
Apply patch and repeat, the guarantor should stay after 3.
Note, I may not have understood the code but it looks like nothing is
searching for the content of the displayed information. Therefore I add
hidden fields that are copies of those provided in guarantor_template
class
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b64a3ce9ba)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The change on bug 30318 prevented setting the default messaging preferences when none were passed.
Self registration relied on this for setting borrower preferences from the defaults.
This patch removes the call to handle_form_action and replaces it with a call to:
SetMessagingPreferencesFromDefault
To test:
1 - Ensure self registration is enabled
2 - Set default messaging preferences for the self registration category
3 - Self register a patron from the OPAC, confirm defaults not set
4 - Apply patch, restart all
5 - Self register a patron
6 - Confirm defaults have been set
7 - Enable PatronSelfRegistrationVerifyByEmail
8 - Self register a patron on OPAC with an email
9 - Find the email and grab the verification link (unless you have emails enabled)
SELECT * FROM message_queue;
10 - Visit the link and confirm registration
11 - Confirm messaging defaults are set
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2accac5fd9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Add circulation rules for a specific library
2) Attempt to remove one of those library specific rules -> get redirected to 'All'
3) Notice the rule for that specific branch is still there
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 72fd2c580d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
After you upload a file or textarea of barcodes to inventory, the next step is
a list of the things that were missing, with checkboxes to check when you find
them, and buttons to Mark seen, which send a POST to
/cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't
have an $op) and without a csrf_token, so the POST fails with a 403.
Test plan:
1. Without the patch, Cataloging - Inventory - in Item location filters
set Library to Centerville, Shelving location to Audio visual, Collection
code to Reference, and in Optional filters for inventory list or comparing
barcodes set Last inventory date to today.
2. Click Submit, and you'll have a table of 23 items. Check the checkbox for
the first item, click Mark seen and continue
3. What was supposed to happen was that you would be taken to the next
page, but instead you are still in the same page, and if you had the
browser console open, you would have seen that you sent a POST to
ajax-inventory.pl, and got a 403 error in response
4. Apply patch, restart_all
5. Repeat step 1 and 2, this time getting to the second page. Check the
checkboxes for the last two items, and click Mark seen and quit
6. Repeat step 1 and click Submit. You should now have only 20 items, since
the three you checked now have a Last inventory date of today.
Yeah, when you did Mark seen and continue they ought to have been removed from
the list, I agree. I had to go back to 23.11.x and make sure that was really
how it was supposed to function, but that is the existing behavior. Even
though they get marked as seen, nothing changes about your list until you quit
and go back to it. Maybe because then something that wasn't on the current
page would have moved there. Another bug.
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sonia Bouis <sonia.bouis@univ-lyon3.fr>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 801fa43c7c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
In additem.pl and additem.tt all instances of 'saveitem' have been updated to 'cud-saveitem'
The javascript needs to be updated in the same way.
Test plan:
- Make sure acqcreateitem is set to "when placing an order"
- Create a basket with some orders
- Close the basket
- Go to your vendor and receive an order
- On the receive page, try to edit your item
=> Without the patch, the pop up page will open and then close, not allowing the item to be edited.
=> With this patch applied you will see the item edit form. Save and
confirm that the parent window is updated with the new value (actually
it's refreshed)
QA notes:
1. git grep 'saveitem'
2. Notice all instances in additem.pl and additem.tt have been updated to 'cud-saveitem'
3. Notice cataloging_additem.js checks if op != 'saveitem'
4. Check the files and verify the change makes sense
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e6b2b342d2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you click on a cell in the Item circulation alerts table, the page sends
a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
csrf_token, which gets back a 403 error because that's sketchy behavior. It
needs to include the token.
Test plan:
1. Administration - Item circulation alerts
2. Open the browser devtools to the console
3. Click on any green table cell
4. It should have turned red, but instead your console turned red with a 403
5. Apply patch, reload
6. Click on any green table cell, it will turn red
Sponsored-by: Chetco Community Public Library
https://bugs.koha-community.org/show_bug.cgi?id=37959
Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
On bug 37429 we reordered the global var to assign them before anything
else. The logic is correct except for $frameworkcode, we want to do some
processings (like defaulting to "" if eq "Default") BEFORE we retrieve
the MARC structure ($tagslib, $usedTagsLib).
This patch also moved this code after get_template_and_user (and so
authentication), like it should be everywhere.
Test plan:
1. Go to Cataloging
2. Click on New from Z39.50/SRU
3. Make a search in the library of congress server for anything (Caroline searched for author: shakespeare)
4. Click on one of the results and choose Import
Without this patch the basic editor appears, but not the record
With this patch applied the bug is fixed and you can edit the record
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit dffc8cdd2c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The new API driven items view defaults to 20 per page. This is a bit low, it would be great if it could be configurable to a higher value per the table configuration.
Test plan:
1. Apply this patch
2. restart_all (memcached restart is required)
3. Go to Administration > Table settings
4. Catalogue > holdings_table | otherholdings_table
=> Notice the new "Default display length"
5. Select something else than 20
6. Go to the detail page of a record with lot of records
=> Notice that the default value defined in the settings is used.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8e211a1fef)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
- enable WaitingNotifyAtCheckout
- have or create a waiting hold for a patron
- check out an item to a different patron who does not have a waiting hold
- Koha says "This patron has waiting holds that are available for checkout"
- Apply patch
- Reload patron (click 'Checkout' tab)
- Check out an item - no warning
- Find the patron with waiting hold
- Check out an item - warning
- Checkout the waiting item - no warning
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b5f122696c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you've catalogued a record with MARC framework that is for some reason missing
certain 952 subfields (8, a, b, c, or y), holdings table is no longer loading but
stuck in the "Processing..." loader.
To test, open Koha in two browser tabs:
IN TAB 1 (framework configuration):
1. Create a new MARC framework "TEST", based on the default MARC framework
IN TAB 2 (record view):
2. Create a new record using MARC framework "TEST"
3. Add an item to the newly created record
4. Observe item visible on the record's holdings list
IN TAB 1 (framework configuration):
5. Delete all 952 subfields in framework "TEST" except: 8, a, b, c, y
IN TAB 2 (record view):
6. Refresh page
7. Observe item visible on the record's holdings list
8. Open your browser's console for upcoming error messages
Iterating remaining subfields in following order,
| <FIELD> | <NAME>
------------------------------------------------------
| 952$8 | row._strings.collection_code
| 952$c | row._strings.location
| 952$a | row._strings.home_library_id
| 952$b | row._strings.holding_library_id
| 952$y | row._strings.item_type_id
IN TAB 1 (framework configuration):
9. Delete subfield <FIELD> in framework "TEST"
IN TAB 2 (record view):
10. Refresh page
11. Observe error "Uncaught TypeError: <NAME> is undefined" (Firefox)
(or Cannot read properties of undefined (reading 'str') (Chromium))
12. Apply patch
IN TAB 2:
13. Refresh page
14. Observe item visible on the record's holdings list
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c93ed758f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The rank parameter is passed per biblio record, not per item. When
placing multiple item-level holds on one bib record, only $rank[0] is
defined.
To test:
1. System preference and circulation rule setup
i. Set the system preference DisplayMultiItemHolds to Enable
ii. Edit the default circulation rule to allow 5 holds per record
2. Find or create a bib with 4 or more items
3. Place several bib-level holds
4. Place 4 or more item-level holds at once on that same record
i. Search for a patron to place the holds for (not one of the
patrons you used in step 3)
ii. Select "Hold a specific item"
iii. Check the checkboxes for 4 or more items
iv. Click Place hold
--> Note that one of the new item-level holds is at the end of the list
as it should be, but the rest are out of order
5. Cancel the item-level holds from step 4
6. Apply patch and restart_all
7. Repeat step 4
--> All the new item-level holds are now at the end of the list
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e1517fc8c8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch switch the check in the script to 'cud-list' - we use the same form
submission if listing for preview or directly updating dates, so this may or may
not be a cud- action - assuming it is restores script functionality.
See bug 37941 for updating forms to not share actions
To test:
1 - Checkout some items to patrons of at least two libraries
2 - Tools -> Batch extend due dates
3 - Select nothing except 'preview' and submit
4 - Blank screen
5 - Apply patch, repeat
6 - It works!
7 - Filter by library and confirm it still works
8 - Sign off!
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2e396f08d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.
Test plan:
1. Without the patch, search for any record in the catalog and click Edit
record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
should display in italics, and the "(Record number nnn)" after it should
not be italicized.
Signed-off-by: David Cook <dcook@prosentient.com.au>
The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.
Test plan:
1. Not a dependency, but you'll avoid getting even more alerts while batch
importing by starting with the patch from bug 37654
2. Without this patch applied, download attachment 170421
3. Administration - set the preference EnableAdvancedCatalogingEditor to
Enable
4. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - Stage for import
5. Once the background job finishes, View batch (getting alerts if you
didn't apply the patch from bug 37654) - Import this batch into the
catalog
6. When the import finishes, Search the catalog for script, on the imported
record Edit record (if you wind up in the basic editor, Settings - Switch
to Advanced editor)
7. In the left sidebar below the search inputs, click Advanced », check
the checkbox for Local catalog and uncheck any others, then search for
the Title script
8. You'll get five alerts, and the word "edition" displayed in huge text
9. Close the search popup, apply patch, shift+reload the advanced editor
page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
the title and the other <script> inclusions.
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Viewing a staged MARC record batch loads a DataTable from
/tools/batch_records_ajax.pl, and both batch_records_ajax.pl and the
DataTable just trust the author/title/isbn/issn to be free of HTML. They
shouldn't.
Test plan:
1. Without this patch applied, download attachment 170418, then Cataloging
- Stage records for import - Select the downloaded file - Upload file -
Stage for import
2. When the background job completes, View batch - you'll get three alert()s
from the title, author, and ISSN, and the author and ISSN displayed huge
3. Apply patch, restart_all
4. Manage staged records - click HTMLescapingimporttestrecord.mrc - get zero
alerts and no <h2> display
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch uses Javascript objects and safe sinks to prevent XSS
in the item URLs on the staff interface detail page.
It also makes sure those URLs don't get double-escaped. Yippee!
Test plan:
0. Apply the patch
1. Add/edit an item with the following URL:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
2. Add/edit a different item with the following URLs:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au |
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
3. Go to the staff interface detail page
4. Notice that the URLs are not double-encoded!
5. Try out a malicious payload (talk to QA/security about this)
6. Confirm that the malicious payload fails to execute the XSS
7. Celebrate!
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We are able to comment a notice even when no user is connected
To test
1. Log in to OPAC.
2. Find a Biblio and open the comments tab.
3. Open another tab/window, and log out from the account.
4. Return to the first tab.
5. Click "Post your comments on this title."
--> We are able to post a comment
6. Apply the patch
7. Repeat step 1, 2, 3, 4, 5
--> You should be redirected to the login page.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Bug 13342: Tidy
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1. Run bin/opac daemon -l http://*:3001/
2. Go to http://localhost:3001/cgi-bin/koha/opac-user.pl
3. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
4. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
5. Reload the page, try to log in normally without modifying the DOM, it
should succeed
6. Run bin/intranet daemon -l http://*:3002/
7. Go to http://localhost:3002/cgi-bin/koha/mainpage.pl
8. With browser devtools, locate csrf_token hidden input within the
login form and remove it or modify it
9. Try to submit the form with correct credentials, it should fail
("Wrong CSRF token")
10. Reload the page, try to log in normally without modifying the DOM,
it should succeed
11. Run prove t/db_dependent/mojo/csrf.t
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch removes setting AutoCommit to 0 and commiting only every X records.
Instead we commit as we go and report progress using a parameter.
Bug 36474 reduced the numebr of changes that are being committed, so this should be a reasonable change. The
use of commits without transactions was causing problems if the library was active while the script ran.
To test:
1 - perl misc/cronjobs/update_totalissues.pl -c
2 - Script runs, but with unknown parameter
3 - perl misc/cronjobs/update_totalissues.pl -p 10
4 - Script runs and reports every 10 records
5 - per; misc/cronjobs/update_totalissues.pl
6 - Script runs and reports every 100 records by default
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit dba9dd4053)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a new check in UpdateTotalIssues to check that we are changing the number
of total issues before calling ModBiblio
To test:
0 - Enable CataloguingLog
1 - Checkout an item
2 - Run : misc/cronjobs/update_totalissues.pl --use-stats --commit=1000 -v
3 - In report, note all biblios were updated
4 - Check action_logs - note a new entry for every biblio
5 - Apply patch
6 - Repeat
7 - Note no biblios reported updated
8 - Note no new cataloguing log entries
9 - Checkout the item again
10 - Run again
11 - Note biblionumber has updated count in verbose output
12 - Note report only rpeort 1 biblio modified, the rest only processed
13 - Only one line added to action_logs
14 - Run it again
15 - Confirm no updates
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d7b36d7f69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1c875b0157)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch restores the ability to delete a recipient from a serials routing list.
It also fixes the slip preview when using the "Save and preview slip", and removes
the koha staff intranet head from the slip when using 'Print list' from the
Serial collection information screen.
To test:
1) Login to the staff client.
2) Open the Serials module.
3) + New subscription to add a new serial.
4) Create a new subscription.
a) Search for a record (I searched for 'dog') and chose that record.
b) Under 'When receiving this serial', select 'Create an item record'
c) Under the 'Item type' dropdown, select anything.
d) Click Next -> (and confirm the popup).
e) Select any 'First issue date'.
f) Select any 'Frequency'.
g) Enter a number larger than 5 in the 'Subscription length'.
h) Select any 'Subscription start date'.
i) Select your favorite numbering pattern.
j) Verify your prediction pattern using "Test prediction pattern".
k) Click "Save subscription".
5) On the 'Subscription details' screen, click "Receive".
6) Under the first volume, click "Add item" then "Save".
7) Repeat step 6 to receive one more issue.
8) On the 'Serial collection information' page click "+ Create routing list"
9) Click "+ Add recipients".
10) Search for and add several recipients.
11) Click "Close" to exit the 'Add recipients' page.
12) Click "Delete" next to any recipient.
*Note that the recipient is not deleted.
13) Click "Save" on the 'Modify routing list for ...' page.
14) Click "Save and preview routing slip" button.
*Note you are redirected to the Subscription details page, but no routing
slip preview appears.
15) Click "Serial collection" from the left-side menu.
16) Click "Print list" on either of the issues you previously received.
*Note the routing slip includes the staff intranet header, menu, etc.
17) Apply patch.
18) Return to the 'Serial collection information' screen for your subscription.
19) Click "Edit routing list".
20) Repeat steps 12-16 and verify the issues are fixed.
-"Delete" button works to remove a recipient from a list.
-"Save and preview routing list" button pops-up a preview before redirecting.
-"Print list" pops-up a vanilla routing list to print.
Sponsored-by: Westlake Porter Public Library
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0e359a5981)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects an error where the SQL editor screen would appear
after the report results when using 'Update and run SQL' when editing
reports.
This also corrects a related issue where the saved_sql.id of the report
would be repeatedly appended to SQL code when using 'Update and run
SQL'.
To test:
1) Login to staff client
2) Navigate to Reports -> Create from SQL
3) Create a short report (SELECT * FROM items), name it and SAVE it.
4) On the resulting "Edit SQL report' page, click 'Update and run SQL'
5) See the report runs, but at the 'Edit SQL report' screen shows at the
bottom.
6) Apply Patch
7) Return to Reports -> Saved Reports and Edit the report you created.
8) On "Edit SQL report' page, click 'Update and run SQL'
9) Verify that the report runs, but the 'Edit SQL report' section is
gone.
Sponsored-by: Westlake Porter Public Library
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bd79cbd858)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch fixes identity_providers.pl to remove the "cud-" prefix for
two operations which are not POSTed: editing identity providers and
editing domains.
To test, apply the patch and restart services.
- Go to Administration -> Identity providers.
- If necessary, create an identity provider and then click "Manage
domains" -> New identity provider domain to create a new domain.
- From the list of domains, click "Edit"
- The edit form should appear with all the correct details prefilled.
- Check that the page title, breadcrumbs, and page header all show the
correct domain.
- Make a change to the domain and confirm that the changes are saved.
- From the list of identity providers, click "Edit"
- This form should also load correctly.
- Submitted changes should be saved correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 32578e4f72)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Have a mrc file with some different prices. In my case I am using the mrc file attached here with different price values in the 975$p and 975$a
2. Set the MarcFieldsToOrder to "price: 975$p" and MarcItemFieldsToOrder to "price: 975$a"
3. In Acquisitions create a new basket > add to basket > from a new file
4. The value from MarcFieldsToOrder (975$p) is always set as the price when it should be the value from MarcItemFieldsToOrder (975$a)
5. APPLY PATCH, restart_all
6. Try steps 1 - 3 again, this time item price should be correctly handled.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Fix condition to ensure the itemnumber is sent
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 99c5e3bae4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch updates the call to dayjs to use strict parsing for patron search. See https://day.js.org/docs/en/parse/string-format
To test:
1. Create a patron with dateofbirth 1994-07-27
2. Add dateofbirth to DefaultPatronSearchFields
3. In patron or checkout search, type a cardnumber like '2908800092528'
4. Note the patron with that birth date is found in autocomplete
5. Apply patch and restart_all
6. Repeat step 3 and notice the patron is no longer found
7. In patron or checkout search, try searches using a formatted date
8. Confirm searches for '07/27/1994' and '1994-07-27' find the patron
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 764162cd6d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8619598d3b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a new modal for confirming vendor deletion. It fixes
the previous functionality, showing a confirmation modal for each
vendor and appropriately handling the response.
To test:
1) Visit Acquisitions home. Under where it says 'Manage orders', click
the search bar to bring up the list of vendors.
2) Add a few vendors by clicking 'New' and 'Vendor'. After this, go back
to the vendor search so that all the vendors are showing.
3) For each vendor, click on 'Delete vendor' and ensure the modal shows
properly.
4) Attempt to delete one of the vendors. Go back to the vendor search
and ensure they are deleted correctly.
5) Click on a vendor's name to go their supplier page. Make sure modal
works properly and attempt to delete a vendor from here.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 81af57344d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects formatting of amounts in both the POS and member
accounting module Payment, Discount, and Payout modals.
It also corrects an issue where amounts of a previous modal show up
when clicking on the same modal for a different accountline
the member Accounting page.
Finally, it corrects an issue with the member Accounting Discount
modal in that an amount without both decimal places will not
display.
Steps to test:
1) Login to staff client
2) Enable the 'EnablePointOfSale' system preference
3) Enable the 'UseCashRegisters' system preference
4) Open POS module and configure a cash register
5) In the POS module -> 'Configure items for purchase', create some
items with different costs (divisible by .10, e.g 25 or 1.10, etc.))
6) Use the POS module to make a few transactions
7) Open POS -> 'Cash Summary for [BRANCH]', and open your configured
register
8) Click 'Issue Refund' and check the formatting of the paid and
returned to patron numbers
*** Issue A) See that numbers are not formatted with two decimal places
9) Pull up the 'Accounting' tab for a borrower
10) Create at least 3 invoices for different amounts (divisible by .10,
e.g 25 or 1.10, etc.)
11) Pay TWO of your invoices then open the 'Transactions' tab
12) Create a manual credit for an amount (divisible by .10, e.g 25 or
1.10, etc.)
13) Click the 'Apply discount' button on one of your invoices
*** Issue B) No 'Amount charged' appears
14) Click 'Issue refund' for one of the paid invoices.
*** Issue C) The 'Return to Patron' line does not have 2 decimal places
15) Click 'Issue refund' for another paid invoice
*** Issue D) The 'Amount Paid' shows the amount from the first modal
16) Click 'Apply discount' for one of the unpaid invoices
*** Issue E) The 'Amount charged' line is blank
*** Issue F) The discount line is also blank, should at least have a
0.00 value
17) Click 'Issue Payout' for your manual credit.
*** Issue G) The 'Return to Patron' line does not have 2 decimal places
18) Apply patch
19) Repeat steps 7 & 8 and check the formatting is correct for issue A
20) Repeat steps 13-17 and check behavior and formatting is correct
for issues B-G
21) Celebrate that you are done with all the steps and looking at
numbers, and that all is right in the Koha payment world (maybe)
Sponsored by: Westlake Porter Public Library
Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 538c943faa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 57dc65bed5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Update to my last comment: The Lists aria-label had an accessibility issue as the label did not match the visible text.
New test plan:
Check the OPAC Interface:
* Open the OPAC in a normal-sized browser window.
* You’ll see the text next to the 'Cart', 'Lists', and 'Login' icons clearly.
* Gradually reduce the window size until the text next to these icons disappears.
* Inspect the icon elements. You’ll find that there is no alternative text (like aria-label) provided for 'Cart' and 'Login'. The aria-label for 'Lists' does not match the visible text. It currently says "Show dropdown with detailed list information". This lack of alternative text is an accessibility issue and labels should match visible text.
Apply the Patch:
* Apply the patch
* Restart_all
Verify the Fix:
* Inspect the icons again.
* For the 'Cart' icon, you should see an aria-label attribute with the text "View your shopping cart".
* For the 'Login' icon, you should see an aria-label attribute with the text "Log in to your account".
* For the 'Lists' icon, you should see an updated aria-label attribute with the new text of "Lists".
* These changes will improve accessibility for users relying on screen readers.
Sign Off:
* Sign off and Have an amazing day!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8318d27a7d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Just like with batch item modification, batch patron modification can accept
either a POST of a lot of data, which might be more than Apache's default
URL length limit, or a GET of a little data. Or at least it could, if both
the op 'cud-show' and the op 'show' were accepted. Show isn't doing any
creation or updating or deleting, it just has to be cud-show because it needs
to be able to accept large POSTs. So when it is only getting a little data, it
should be willing to take a GET with op=show just like batch item
modification does.
Test plan:
1. Without the patch, Tools - Patron lists - New patron list - give it a
name and Save
2. Type enough characters in the Patron search input to find a patron (I
like ace for poor often-used Henry Acevedo) and click on a patron in
the list of results
3. Click Add patrons
4. Click Patron lists, and in the Actions menu for your list, choose
Batch edit patrons. Note that the page that loads doesn't show any patrons
or UI to edit them, only a message about "No patron card numbers or
borrowernumbers given."
5. Apply patch, restart_all
6. Repeat step 4, but this time get a page with your patron listed, and a
form to change things about the patron record.
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit fc5eed80a3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Owen Leonard
Phil Ringnalda
Baptiste Wojtkowski
Nick Clemens
Janusz Kaczmarek
Brendan Lawlor
Jonathan Druart
Lari Taskula
Paul Derscheid
Emily Lamancusa
Lucas Gass
David Cook
Hammat Wele
Victor Grousset/tuxayo
Julian Maurice
CJ Lynce
Pedro Amorim
Sam Lau
Laura_Escamilla