Commit Graph

59232 Commits

Author SHA1 Message Date
David Cook bc07155f03
Bug 42847: [24.11] Fix unit test
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-08-05 14:16:39 +12:00
Kyle M Hall 498c85b62a
Bug 42847: [24.11] Prevent previously authenticated user (squashed)
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-08-05 14:16:32 +12:00
Laura_Escamilla afdbbd117e
Bug 43019: Prevent access to pages belonging to another library (staff side)
To test:
1. Create two patron accounts:
    * One patron whose home library matches the library assigned to the page.
    * One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
    * Display location = OPAC
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
    * Confirm that the library-specific page is not displayed.
    * Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
    * Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
    * Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
    * Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
    * Display location = Staff interface
    * Library = a specific library
    * Publication date = Today
    * Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
    * Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
    * Confirm that the page is not displayed.
    * Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
    * Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
    * Confirm that the page is displayed in both interfaces for users from the matching library.
    * Confirm that users from a different library receive a 404 page.
    * Confirm that pages assigned to All libraries are available in both interfaces.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-08-04 14:01:22 +12:00
David Cook fad32519c1
Bug 43019: Fix branch comparison
This change fixes the branch comparison between the Page
and the user. Previously, it was doing a numeric "!=" and now it
does the string comparison "ne". Also, if no environmental variable
is set for the default branch, it defaults to an empty string
for anonymous (ie non-authenticated) users.

Test plan:
0. Apply the patch
1. restart_all
2. Log into the staff interface
3. Go to Tools
4. Click on "Pages"
5. Create a Page for All Libraries for the OPAC
6. Copy the "OPAC" link in the "Page URL" table cell and open it
in a private window or a separate browser
7. Note that the page appears
8. Now change the "Page" to a specific library
9. Revisit the URL in the private window
10. Note that it now gives a 404 error
11. Log into the OPAC with a user whose library matches the libary
of the Page
12. Note that now you can view the URL again
13. Change the library of the user or the Page
14. Note that you cannot see the Page now

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-08-04 13:45:36 +12:00
Martin Renvoize 9474e9e359
Bug 30233: (follow-up) Log a warning when _apply_substitution discards a bad pattern
When eval { qr/$pattern/ } fails (e.g. the admin-configured s/// contains
an invalid regex), _apply_substitution previously returned silently with no
indication of why the rule was skipped. Add a Koha::Logger warn so the
failure appears in the log and is diagnosable without a debugger.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-30 15:54:03 +12:00
David Cook cc6af33c1b
Bug 30233: (follow-up) fix some errors reported by QA tools
Note: While the methodology in Koha::Regex::Replacement may seem
bespoke, it's similar to how Python's re.sub(pattern, repl, string)
regex substitution works.

Unit tests:
prove -v t/Koha/Regex/Replacement.t \
    t/SimpleMARC.t \
    t/db_dependent/MarcModificationTemplates.t \
    t/Labels_split_Regex.t

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-30 15:53:54 +12:00
Sanjar Tulkinov Anvar o'g'li 0c718157be
Bug 30233: Stop running call number split regexes as code
C4::ClassSplitRoutine::RegEx::split_callnumber ran the admin-configured rule
through eval "\$cn_item =~ $regex", executing arbitrary Perl. Parse the
rule as s<DELIM>PATTERN<DELIM>REPLACEMENT<DELIM>FLAGS, reject the /e flag,
compile the pattern with qr// and expand the replacement as data via
Koha::Regex::Replacement::expand_template, so the rule is applied without
eval.

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-30 15:53:48 +12:00
Sanjar Tulkinov Anvar o'g'li 82a117c87b
Bug 30233: Stop running MARC modification replacements as code
Koha::SimpleMARC::_modify_values and Koha::Items::apply_regex wrapped the
user replacement in a string and ran it through s///ee, so an interpolation
block such as \@{[ system(...) ]} executed arbitrary Perl. Expand the
replacement as data via Koha::Regex::Replacement::expand_template under a
single /e instead, which keeps capture-group replacements working but never
runs the input as code.

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-30 15:53:43 +12:00
Sanjar Tulkinov Anvar o'g'li b0298e02ca
Bug 30233: Add Koha::Regex::Replacement to expand replacements as data
Add a small single-pass helper, Koha::Regex::Replacement::expand_template,
that expands a user-supplied regex replacement string as data: numbered
backreferences ($1..$n, ${n}, the legacy \1..\9 form), named captures
($+{name}, ${name}) and the \n \r \t escapes. Every other character is
copied through literally, so \@{...}/${...} interpolation blocks end up as
text rather than being run. This is used to replace the s///ee double-eval.

The routine is fully qualified at the call sites rather than exported, and
case folding is left out to keep it small.

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-30 15:53:18 +12:00
Alex Buckley f998eae245
Update release notes for 25.05.12 release
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
2026-07-09 11:53:31 +12:00
Wainui Witika-Park 9c772a06b2
Increment version for 25.05.12 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:53:25 +12:00
Pedro Amorim 2ccc5c9f75
Bug 42783: Fix ManageMarcImport_spec.ts
If import_batch_profiles is slow to respond, it'll trigger select.change() in stage-marc-import.tt and change the format to ISO2709 before the form is submitted, causing the error.

cypress run --spec t/cypress/integration/Tools/ManageMarcImport_spec.ts

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:53:18 +12:00
Jonathan Druart 83a98b0134
Bug 42735: Fix SQL injection
This change fixes an SQL injection in the circulation stats.

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:50 +12:00
Jonathan Druart 58aa6d0e54
Bug 42369: Use C4::Context::csv_delimiter for delimiter validation
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:37 +12:00
David Cook fd7aa9aa02
Bug 42369: Fix SQL injection
This change fixes SQL injection in bor issues top

Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/bor_issues_top.pl
3. Try out all the different options
4. Try to break it
5. Note that you get output and no errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:30 +12:00
Jonathan Druart 028fa6b6ec
Bug 42368: Use C4::Context::csv_delimiter for delimiter validation
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:19 +12:00
David Cook 28650d0999
Bug 42368: Fix SQL injection in issue avg stats
This change fixes SQL injection in issues avg stats

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_avg_stats.pl
3. Try out all the different options
4. Try to break the report
5. Note that you always get output instead of errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:14 +12:00
Jonathan Druart c7be2c822d
Bug 42363: Use C4::Context::csv_delimiter for delimiter validation
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:06 +12:00
David Cook 88b007991b
Bug 42363: Fix SQL injection
This change cixes an SQL injection in cat stats

Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/catalogue_stats.pl
3. Try out different values
4. Try to break the report
5. Note that you just get output and not errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:52:00 +12:00
Jonathan Druart 71a4b9cb43
Bug 42360: [25.05] Move separator validation to C4::Context::csv_delimiter
So we protect other calls

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:51:49 +12:00
David Cook 1fe542cb2d
Bug 42360: [25.05] Also validate sep param
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:51:44 +12:00
David Cook 31ef896bff
Bug 42360: [25.05] Fix SQL injection
This change fixes an SQL injection in the acq stats.

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/acquisitions_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors
NOTE: In a fresh KTD you likely don't have any actual statistics

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-07-09 11:51:38 +12:00
Pedro Amorim 189e9d05aa
Bug 42733: Job progress fix
waitForJobFinished previously had no handling for failed jobs or
non-200 responses — if the job API returned anything unexpected,
the recursive cy.wait() would silently stall waiting for a 2nd
poll that never came, producing a confusing timeout. Adds an
explicit "failed" status check and updates the intercept
to reproduce the exact CI failure (Apache returning 503 during
reset_all).

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 74cf164d32)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-26 12:16:48 +12:00
Pedro Amorim 443f510b5f
Bug 42733: Add tests
Apply tests patch only, run:
yarn cypress run --spec t/cypress/integration/Tools/ManageMarcImport_spec.ts

Confirm it fails with the same error as Jenkins:
Timed out retrying after 10000ms: `cy.wait()` timed out waiting `10000ms` for the 2nd request to the route: `jobPoll`. No request ever occurred.

Apply fix patch. Run again.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 125416a92d)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-26 12:16:43 +12:00
Martin Renvoize 2292ef8805
Bug 41368: Fix ManageMarcImport Cypress test timing issue
Replace the no-op `#job_callback` existence check with a recursive
`cy.wait('@jobPoll')` that loops through each `/api/v1/jobs/*` poll
response (arriving every ~1s) until it sees `status: finished`. This
avoids any fixed timeout — the test proceeds as soon as the API signals
completion, however long that takes on a given machine.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c513dee502)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-26 12:05:58 +12:00
Lucas Gass 9168283582
Bug 41368: Fix View batch click
To test:
1. APPLY PATCH
2. yarn build
3. cypress run --spec t/cypress/integration/Tools/ManageMarcImport_spec.ts
4. It should now pass

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b190813020)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-26 12:04:47 +12:00
wainuiwitikapark c9e3ae8f57
Bug 38009: Add a generate next button in serials receive page
Adds a generate next button to the serials receive page (serials-edit.pl) that works similar to the button on the serials collection page.

To test:

1. Go to Staff Client > Serials
2. Find an existing subscription or create a new one
3. Go to the Serials collection page for your serial e.g. /cgi-bin/koha/serials/serials-collection.pl?subscriptionid=1
4. Click on the "Generate next" button and notice that the table adds
   another row
5. Click on the "Receive" button at the top of the page
6. Notice that the page also shows the issues like the rows in the
   previous page
7. Apply patch
8. Repeat steps 1-5
9. Notice that the page also has a "Generate next" button at the top
10. Check that the button generates a new issue row on the page

Sponsored-by: Pymble Ladies' College
Signed-off-by: esther <esther@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7b1a348ac9)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-24 15:06:37 +12:00
Lucas Gass 01df1563bf
Bug 37143: Do not allow required fields with only whitespace to be submitted
To test:
1. Make some fields for OPAC self registration required.
2. Create a new patron via self reg.
3. Fill out those required fields as an empty string like "  ".
4. Submit the form, it succeeds.
5. APPLY PATCH, restart_all
6. Try again. Required fields with only whitespace are treated as if they were empty.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 12426b5924)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-24 14:57:32 +12:00
Paul Derscheid d6f529c38c
Bug 41352: Add link to the manual for the Bookings to Collect page
To test:
- Go to Circulation > Bookings to collect
- Click Help
- Verify it links to the correct manual section

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f53159bfa4)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-24 14:34:11 +12:00
David Nind e5d2f5a962
Bug 41427: (QA follow-up) Add new line at end of file
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 052c93dbb5)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-24 14:30:51 +12:00
Caroline Cyr La Rose 9c3c971bc7
Bug 41427: Rephrase FilterSearchResultsByLoggedInBranch description
This patch rephrases the description of the
FilterSearchResultsByLoggedInBranch system preference to make it
clear it filters items by the library where the user is currently
logged in at. It also changes "branch" to "library" in the
system preference description.

To test:
1. Apply patch
2. Go to Administration > System preferences
3. Search for FilterSearchResultsByLoggedInBranch
4. Read the description, make sure it makes sense, and that the
   grammar and spelling are correct

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5fbe31b52b)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-24 14:30:45 +12:00
Jonathan Druart 1dac2edcf6
Bug 42130: ERM - Index biblio when local title is created/updated
The indexation step has been removed by
  commit d2820f57d6
  Bug 34788: (QA follow-up)

Koha/ERM/EHoldings/Title.pm
-            C4::Biblio::ModBiblio( $record, $self->biblio_id, '' );
+            C4::Biblio::ModBiblio( $record, $self->biblio_id, '', { skip_record_index => 1 } );

From the commit message:
2) The background job now uses skip_record_index to avoid queuing indexing jobs for every new biblio and instead queues one job at the end

it's then missing when we add or edit a local title.

Test plan:
1 - Enable ERMModule
2 - Go to ERM
3 - eHoldings->Titles
4 - New title
5 - Populate the form
6 - Check the create bibliographic record box
7 - Save
=> Confirm that the biblio is now indexed
8. Edit the title, modify a value, tick the box, save
=> Confirm that the biblio is now indexed with the new value

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5dcec8b803)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 14:38:35 +12:00
Eric Phetteplace f699bb4c50
Bug 42723: Purchase suggestion 500 when EmailPurchaseSuggestions is set to BranchEmailAddress
Testing plan:
- Set EmailPurchaseSuggestions to BranchEmailAddress
- Go to create suggestion on the staff side /suggestion/suggestion.pl?op=add_form
- Create a suggestion with Library: Any
- 500 error: inbound_email_address is not a method of undef
- Apply patch & repeat
- Suggestion created

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 33a8dc5d6f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 14:31:59 +12:00
Jonathan Druart 88a131b777
Bug 41546: Restore the ability to unarchive suggestions
There is a TT condition that has not been moved to JS.

Test plan:
Create a suggestion, archive it
List suggestions and tick "include archived"
Notice that with this patch applied you are able to unarchive the
suggestion

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 69c8a91cd9)
Signed-off-by: Chloé Zermatten <chloe.zermatten@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 14:14:16 +12:00
Nick Clemens 276d9169ea
Bug 39514: Only mark the affected rows as problematic
Before this patch we were setting a variable and nebver unsetting it

Now we can add the conditional directly to the row, so don't need a variable

To test:
1. Go to Acquisitions
2. Click 'Search' in the vendor search
3. Click 'Add to basket' next to 'My basket'
4. Click 'From a new (empty) record'
5. Fill out the form
   - Title: enter a title
   - Koha item type: choose an item type
   5.1. Click 'Add item'
   - Fund: choose a fund
   - Uncertain price: check
6. Click 'Save'
7. Go back to Acquisitions
8. Click 'Search' in the vendor search
9. Click 'New' > 'Basket'
10. Enter a basket name
11. Click 'Save'
12. Go back to Acquistions
13. Click 'Search' in the vendor search
--> Notice the empty basket is also in bold red, even if it doesn't have uncertain prices
14. Click 'Add to basket'
--> Notice everything is in bold and some in red
15. Apply patch, reload
16. Only affected basket is in red

Signed-off-by: Samuel <sam.sowanick@corvallisoregon.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7b1d11da74)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 14:07:44 +12:00
Michael Hafen ab67d91f0d
Bug 40288: Apply overflow css to all of patronbriefinfo li's
and patroninfo-section li's too.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 13:58:35 +12:00
Michael Hafen b9be0ef1db
Bug 40288: constrain patron brief info in patron sidebar to parent width
The patron info in the patron / circ-menu sidebar is not constrained to
it's parent's width.  I found this with a very long email address, where
the ul grew to match the email address length, and the patron image
container also grew.  Both overflowed the sidebar.

Test plan:
1. find or make a patron with a very long email address (more tha 50
   characters).
2. open the patron details page for that patron.  Observe the patron
   image and patron details overflows the patron sidebar (the email
   address will be hidden under the contact information panel.
3. Apply patch and rebuild css files.  It may be necessary to clear the
   browser cache.
4. open the patron details page for that patron again.  Observe the
   patron image and details does not overflow the patron sidebar.

Signed-off-by: George <george@nekls.org>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 13:58:24 +12:00
Martin Renvoize bbff807136
Bug 42726: Add 26.11 release team
Add the 26.11 release team as voted at the development meeting.

Pedro Amorim as Release Manager, with Tomás Cohen Arazi and Martin
Renvoize as RM Assistants. Lisette Scheer as QA Manager with a
19-person QA team. David Cook as Security Release Manager.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f0bb03d6e9)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-23 13:46:37 +12:00
Jan Kissig f79d2a29eb
Bug 42412: Fix Incorrect date error in db-revs when using MySQL
In Bug 36466 db_revs/251200019.pl was introduced to update wrong date values (0000-00-00) with NULL.
This can fail on MySQL as it is running with sql_mode NO_ZERO_DATE activated which does not allow to select or update date fields with values='0000-00-00'.

This patch changes the update queries in db_revs/251200019.pl to use Installer::sanitize_zero_date on both columns.

Test plan:
As the test shall be done using MysQL and Mariadb start 2 ktds:
MySQL) DB_IMAGE=mysql:8.0 ktd --proxy --name mysql8 up -d
MariaDB) ktd --proxy --name maria up -d

a) checkout a version prior 36466: git checkout v24.11.14-1
b) reset_all
c) Connect to staff interface (mysql8-intra.localhost and maria-intra.localhost)
d) Go to Serials and create a new subscription
e) run the following to enter database client in each ktd shell: koha-mysql kohadev
f-mysql) run the following commands to be allowed to change planneddate and publisheddate to '0000-00-00':
 SET SESSION sql_mode = 'ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION';
 update serial set planneddate = '0000-00-00', publisheddate = '0000-00-00';
f-maria)
 update serial set planneddate = '0000-00-00', publisheddate = '0000-00-00';
g) verify via: select * from serial;
h) checkout main via: git checkout main
i-mysql) run  updatedatabase
 Upgrade to 25.12.00.019  [09:35:55]: Bug 36466 - Fix the incorrect 0000-00-00 date in planneddate and publisheddate field
        ERROR: {UNKNOWN}: DBI Exception: DBD::mysql::db do Incorrect date error in db-revs when using MySQL

        In 36466 db_revs/251200019.pl
        for column 'planneddate' at row 1 at /kohadevbox/koha/C4/Installer.pm line 818
i-maria) do not run updatedatabase yet
j) apply patch
k-mysql) run  updatedatabase
Upgrade to 25.12.00.019  [09:37:02]: Bug 36466 - Fix the incorrect 0000-00-00 date in planneddate and publisheddate field
        Incorrect date planneddate and publisheddate fixed
...
-> is successful now
k-maria) run updatedatabase
l) verify via: select * from serial;

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-22 13:59:26 +12:00
Pedro Amorim fb8d6658c8
Bug 41614: available options template params also needed for op=list
Test plan, before applying patch:
1) Visit additional contents for HTML customizations:
<staff_url>/cgi-bin/koha/tools/additional-contents.pl?category=html_customizations
2) Click the left side 'Display location' filter. No options show under OPAC or Staff interface
3) Apply patch, restart plack, refresh. All options should now show (and working filter as expected) under OPAC and Staff interface

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-19 13:02:18 +12:00
Kyle M Hall 91f9d780e3
Bug 39164: (QA follow-up) Add setting to koha conf files
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-19 12:47:43 +12:00
Mark Hofstetter a70ac8f320
Bug 39164: Add max_statement_time to SQL report queries
Reports may consume too much resources of the db. To avoid that a new config param
'report_sql_max_statement_time_seconds' was created, which sets the maximum time a report statement may
take to execute in seconds. If it takes longer it will be aborted.

reflowed the code, so that is is executed after is_sql_valid, and put
the code in a subroutine

Test plan:
0. if you run this test in ktd you should check if you are running
   mysql or mariadb, and then be able to switch database
1. create a new report by going to
More > Reports > New SQL Report
(/cgi-bin/koha/reports/guided_reports.pl?op=add_form_sql)

enter the following SQL (which only purpose is to run long)

select ExtractValue(bm1.metadata,'//controlfield[@tag="001"]')
  from biblio_metadata bm1
  join biblio_metadata bm2 on
    ExtractValue(bm1.metadata,'//controlfield[@tag="001"]') =
    ExtractValue(bm2.metadata,'//datafield[@tag="773"]/subfield[@code="w"]')

give the Report a name eg "extract_long"
2. run the report
3. report should be executed and return several 1000 lines on ktd
4. apply patch
5. add a the parameter to koha-conf.xml to the <config> </config> part
<report_sql_max_statement_time_seconds>0.001</report_sql_max_statement_time_seconds>

OR use the following statemtn
sed -i '/<biblioserver>/a <report_sql_max_statement_time_seconds>0.001<\/report_sql_max_statement_time_seconds>' /etc/koha/sites/kohadev/koha-conf.xml
6. restart koha
    koha-plack --restart kohadev
7. go back to the report page and rerun report which now should lead to an error
The following error was encountered:
The database returned the following error:
Query execution was interrupted, maximum statement execution time exceeded
Please check the log for further details.
8. in koha-conf.xml set
<report_sql_max_statement_time_seconds>20</report_sql_max_statement_time_seconds>
9. restart koha
10. rerun query, which now should execute as before
11. stop ktd, and restart with the "other" database

DB_IMAGE=mysql:8.0 ktd up
DB_IMAGE=mariadb:10.5 ktd up

12. repeat from step 1 (omit applying the patch)
13. Sign off
14. Thx

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-19 12:47:37 +12:00
David Cook 4c8e0f0a6d
Bug 41045: Fix BZ 33363 database update
This patch fixes the BZ 33363 database update, so that it
selects uses with the "suggestions" permission rather than the "catalogue"
permission.

Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 0442f4ce2c)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-12 14:48:38 +12:00
David Cook 773eaebf83
Bug 41646: Fix HTML display for self-checkin
This change moves the wrapper so that the web page display correctly

Test plan:
0. Apply the patch
1. Enable the SelfCheckInModule system preference
2. Go to http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3. Note that there isn't a lot of whitespace between
the word "koha" and "Self check-in"
4. Celebrate

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2026-06-10 13:27:12 +12:00
Lucas Gass 1dbc309e9f
Update release notes for the 25.05.11 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:41 -06:00
Lucas Gass 184fc33d48
Increment version for 25.05.11.000 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:41 -06:00
Lucas Gass dcad6c052f
Revert "Revert "Revert "Bug 41328: [25.05.x] Fix incorrect use of ref in KohaTable.vue"""
This reverts commit eb40aba260797b88759ab3b57ffae4a3259936a1.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:40 -06:00
Lucas Gass 4ada9a14c9
(follow-up) Fix failing Dialog_spec.ts test
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:40 -06:00
Lucas Gass 2b32a15fc1
Revert "Revert "Bug 41328: [25.05.x] Fix incorrect use of ref in KohaTable.vue""
This reverts commit 259b98f1c208226d274a3084054820f74819e578.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:39 -06:00
Lucas Gass bc928dfa93
Revert "Bug 41328: [25.05.x] Fix incorrect use of ref in KohaTable.vue"
This reverts commit 535b103a01b0fd1451354873f6866f1c7da62c00.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-05 14:02:39 -06:00