This change removes an SQL injection vulnerability from catalogue_out.pl
Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Now that we can explicitly list reports with any one of the permissions we need
to adjust some displays to ensure we can get to the list view.
Additionally I change 'Use saved' to 'View saved' since we may not be able to run.
I also fix the action buttons to show 'View' instead of 'Run' if user cannot execute.
I adjust reports home to check if the user can use report plugins before showing that link as well
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
0. Apply the patch and restart_all
1. Using a user with only "create_reports", "execute_reports", or "delete_reports",
try to perform operations not covered by that permission.
That is, if you have "create_reports", try to run, export, and delete reports.
If you have "execute_reports", try to create, modify, and delete reports
If you have "delete_reports", try to create, modify, and run reports
2. Note that a user with each of these permissions can list and view SQL.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.
That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.
This allows for different permissions per report for future devs
(see bugs 42406, 16631)
To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports
We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Scott Barter <sbarter@aacpl.net>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When a staff member writes off an accruing fine and the item is
subsequently checked in (backdated or in fine-free mode), the fine
amount is recalculated downward via adjust(). The previous code
unconditionally created an OVERPAYMENT credit whenever the adjusted
outstanding went negative, regardless of whether the existing credits
were reversible payments or non-reversible writeoffs/discounts.
This caused patrons to receive an erroneous credit equal to the
written-off amount, since writeoffs should simply be absorbed when
the underlying fine shrinks - no refund is due.
The fix calculates the total non-reversible credits (writeoffs,
discounts, cancellations) applied to the debit using the existing
filter_by_non_reversible method, and only generates an OVERPAYMENT
credit for the portion attributable to reversible cash payments that
exceed the recalculated fine amount.
Test plan:
1. Write off an accruing fine in full
2. Check the item in (backdated or fine-free)
3. Confirm no overpayment credit is generated for the patron
Signed-off-by: Benjamin Daeuber <BDaeuber@fargolibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
As Jan Kissig correctly mentioned on the BZ report, the various
summary info on charged items etc. are included.
This is done via the summary_info sub.
Note that the TODOs about
BZ FID_HOLD_ITEMS_LMT
CA FID_OVERDUE_ITEMS_LMT
CB FID_CHARGED_ITEMS_LMT
are still valid. This is not included yet.
Test plan.
Since we are just removing comments, read the code.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
The buttons in the plugins home page ("Upload plugin" and "View plugins by class") become misaligned when you have the git repository search bar.
To test:
1. Add a github/gitlab repository in koha-conf.xml
- In ktd shell, open /etc/koha/sites/kohadev/koha-conf.xml
- Somewhere under <config> insert the following (or your own)
<plugin_repos>
<repo>
<name>Solutions inLibro</name>
<org_name>inLibro</org_name>
<service>github</service>
</repo>
</plugin_repos>
- Save the file
- restart_all
2. Go to Administration > Manage plugins
--> Buttons are misaligned
3. Apply the patch
4. Run command « yarn build »
5. Repeat step 2
--> buttons are aligned nicely
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
We can add a toolbar of buttons to
A) batch enable all cells
B) batch populate empty cells with a value
C) batch disable empty cells
Test plan:
1) Apply this patch
2) Visit the TCM editor
3) Try out the 3 new buttons, verify they behave correctly
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch additionally fetches the reply to address for advance notices
To test:
1 - Have some issues that will be due soon for a patron(s)
Checkout with the due date set to tomorrow
2 - Verify the patron(s) have an email defined, verify the issuing branch has a reply to set
3 - Verify the patron(s) have messaging preference set to receive Advance notices by email 1 day in advance
4 - perl misc/cronjobs/advance_notices.pl -v -c
5 - Check the message queue
SELECT * FROM message_queue WHERE borrowernumber={##}
6 - Note no rpely to is set
7 - Apply patch
8 - perl misc/cronjobs/advance_notices.pl -v -c
9 - Check the message queue
10 - Confirm newer message has the reply to populated
11 - Ensure the issued item has a different homebranch with a reply to address se
12 - perl misc/cronjobs/advance_notices.pl -v -c --frombranch item-homebranch
13 - Confirm message has correct reply to
14 - Set patron to want digest in messaging preferences
15 - Generate notices
16 - Confirm digets has the right reply to
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tidied inline
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
To test:
1. Find or create a record in Kkoha.
2. From the record detail page click "Edit" and "Manage items"
3. Begin adding a new item
4. For any of the dropdowns that contain an authorized value ( LOST, DAMAGED, WITHDRAWN, CCODE, LOC ) click on the dropdown and begin typing an AV that doesn't exist.
5. You should see the text (select to create) appear, click it.
6. Now a modal appears "Create a new authorized value"
7. Fill out the required parts and click 'Save'.
8. Kaboom, 500 error:
9. APPLY PATCH, clear browser cache.
10. Try again, this time it should work.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
It would be at least helpful to add a reference to get_transfer here,
since we are replacing it here.
Used the opportunity to update the older comments
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch removes a fetch of the item object followed but get_transfer to simply search the
transfers by itemnumber and status
To test:
1 - Add many items to your records
https://github.com/kidclamp/handy-koha-script/blob/main/randitems.pl
NOTE: this script makes a lot of items withdrawn or damaged, undo that for more dramatic difference
UPDATE items SET withdrawn=0,damaged=0
perl misc/search_tools/rebuild_elasticsearch -v
2 - Set Koha system preferences to display more results and check more items:
maxItemsInSearchResults 60
numSearchResults 50
3 - Do a search, several times, note the time it takes
4 - Apply patch, restart all
5 - Repeat search several times, note the time it takes
6 - Confirm it is better after the patch
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
The "Copy shareable link" button on the item search table creates a link
based on the current URL, but an item search does not update the current URL
with the search parameters.
This patch copies the code to generate the URL with search parameters and
uses it to update the current URL.
Test plan:
1. Click "Item search".
2. Perform an item search (e.g. Home library is Centerville).
3. Click the "Copy shareable link" button on the right side of the screen
above the table.
4. Paste and visit the link.
5. Observe that you only see the search page without any results.
6. Apply patch.
7. Repeat steps 1-4.
8. Observe that you see the results with the table settings.
9. Sign off.
Sponsored-by: Lund University Library
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This change makes the "Scheduled for automatic renewal" text appear
in the staff interface and OPAC only if both the issue has auto_renew
and the borrower has autorenew_checkouts set. These are the criteria that
automatic_renewals.pl uses for processing automatic renewals.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Checkout an item as an automatic renewal
(ie either set it as Automatic renewal using the checkout option or have
the circ and fines rules set to use Automatic renewals)
3. View the checkout in both the staff interface and the OPAC
4. Note that they both show "Scheduled for automatic renewal" or
"This item is scheduled for auto renewal" for the OPAC
5. In the patron record change "Allow auto-renewal of items" from
"Yes" to "No"
6. Note that the text talking about the item being scheduled
for automatic renewal no longer displays
Bonus points:
1. Run 'perl ./misc/cronjobs/automatic_renewals.pl -v'
2. Note that the automatic renewal doesn't show when "Allow auto-renewal
of items" is set to "No" but it does show when it's set to "Yes"
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
We have different implemented solution to select a tab on opac-user:
* a "tab" variable (from bug 37972), it's never used
* several variables passed from the controller to the template, depending on the tab to select (it works and is used)
* use of anchors (it does not work and is used)
We should fix and standardize it.
I've linked to several reports that seem to conflict with each others.
This patch suggests to have a "tab" variable
Test plan:
Confirm that the different links to tab to opac-user are not using a
query parameter to pass the tab to select, e.g. from the opac-main page.
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Test plan:
1. In system preferences, set PatronQuickAddFields to include userid
(Username).
2. Go to Patrons and choose Quick add new patron.
3. Fill at least Surname, Card number, and Username
(use a value clearly different from a surname-based username).
4. Save the patron.
5. Observe on the patron details page that Username is auto-generated
(not the value entered in quick add).
6. Apply this patch.
7. Repeat steps 2-4 with a new patron.
8. Verify on the patron details page that Username now matches the
value entered in quick add.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
The warnings:
[WARN] Argument "YYYY-MM-DD" isn't numeric in numeric lt (<)
at /kohadevbox/koha/reports/issues_stats.pl line 224.
appears in the plack-intranet-error.log.
It happens because a numerical comparison was used to compare the dates
instead of a string comparison.
To test:
========
1. Observe plack-intranet-error.log.
2. In staff interface go to Reports > Statistics wizards > Circulation.
3. Select date "From" and date "To" then submit.
4. Two warnings appear in plack-intranet-error.log.
5. Apply the patch; restart_all.
6. Repeat 2-3. No warnings appear in log.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
If a message ends in a non-alphanumeric character, that character is stripped from the message.
For example:
6300120260210 182641 AOMPL|AA23529000035676(|
64 00120260210 182831000000000000000000000000AOCPL|AA23529000035676|AEHenry Acevedo|BLY|BHUSD|BV0|CC5|BD4345 Library Rd. Springfield, MA 44224|BF(212) 555-1212|PB19580530|PCS|PIY|AFGreetings from Koha. |
versus:
6300120260210 182641 AOMPL|AA23529000035676(|ACkoha|
64YYYY 00120260210 182835000000000000000000000000AOCPL|AA23529000035676(|AE|BLN|AFInvalid cardnumber|
The former should be returning the same "Invalid cardnumber" message the latter does.
Test Plan ( assumes you are using KTD ):
1) Install telnet: sudo apt install -y telnet
2) telnet 127.0.0.1 6001
3) Log in with: 9300CNkoha|COkoha|CPMPL|
4) Send the patron information request: 6300120260210 183346 AOMPL|AA23529000035676(|
5) Note you get a patron back
6) Apply this patch
7) Restart SIP!
8) Repeat steps 2-5
9) Noe you doe not get a patron back in the response!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This bug adds Koha::Patron::Message::message_without_newlines, which has been added to C4::SIP::ILS::Patron in lieu of Koha::Patron::Message::message. The aim of this change is to prevent SIP2 units from crashing out when they encounter a patron message with newlines (\n or \r) in it, as units generally use a newline character to denote the end of a SIP2 transaction.
To test:
a) go to /cgi-bin/koha/sip2/institutions
*) create an institution, name CPL, timeout 300, the rest default
b) go to /cgi-bin/koha/sip2/accounts
*) create an account, userid koha, institution CPL, terminator crlf, the rest default
c) go to /cgi-bin/koha/members/moremember.pl?borrowernumber=51
*) click add message in toolbar
*) enter some multi-line message e.g. test[RETURN]1[RETURN]2[RETURN]3[RETURN][RETURN][RETURN]
d) run tail -f /var/log/koha/kohadev/sip-output.log, keep this window open
e) run ./misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su koha -sp koha -l CPL --patron 42 -m patron_information
f) look at the tail log, notice how the MSG 64 line has a newline before the final pipe (|) character
== APPLY PATCH ==
g) restart_all
h) repeat steps e-f
i) notice how in the tail log, the MSG 64 line now has the final pipe character contiguously placed with the successive characters
== SIGN OFF ==
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
I think this happens because we select an option that didn't exist in
the dropdown, and "Sorry, there is no matching options" from select2 is
covering the discount input that is right under "Tax rates"
09:45:36 <testcase name="Vendor CRUD operations should add a vendor" time="0.000" classname="should add a vendor">
09:45:36 <failure message="Timed out retrying after 10000ms: `cy.type()` failed because this element:
09:45:36
09:45:36 `<input data-v-2a08b27a="" id="discount" inputmode="numeric" placeholder="Discount (%)" size="6">`
09:45:36
09:45:36 is being covered by another element:
09:45:36
09:45:36 `<li class="vs__no-options">Sorry, ...</li>`
09:45:36
09:45:36 Fix this problem, or use {force: true} to disable error checking.
09:45:36
09:45:36 https://on.cypress.io/element-cannot-be-interacted-with" type="CypressError"><![CDATA[CypressError: Timed out retrying after 10000ms: `cy.type()` failed because this element:
09:45:36
09:45:36 `<input data-v-2a08b27a="" id="discount" inputmode="numeric" placeholder="Discount (%)" size="6">`
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch fixes automatic tab selection on MARC subfield edit pages for
both authority and bibliographic records. The patch also removes some
unused markup and JS associated with old ways of handling tabs.
To test, apply the patch and go to Administration -> Authority types.
- Click the "Actions" button for one of the authority types and select
"MARC structure"
- Pick a tag which has multiple subfields, e.g. 020 and click Actions ->
Subfields.
- Click one of the subfield links (not the first one). On the subfield
edit page the corresponding tab should be selected when the page
loads.
- Go back and click the "Edit" button and confirm that this also
selects the correct tab.
- Go to Administration -> MARC bibliographic framework -> MARC
structure -> View subfields and perform the same tests.
Sponsored-by: Athens County Public Libraries
Signed-off-by: John Doe <you@example.com>
Signed-off-by: Nic Olsson <olsson.nic@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
- Biblio::check_booking counts current checkouts toward the
unavailable pool to detect booking clashes
- It counts checkouts on ALL items for the biblio, including
non-bookable ones (e.g. items with an excluded item type)
- When only a subset of items are bookable, checkouts on
non-bookable siblings incorrectly reduce the available pool,
producing false clashes
- Restrict the checkout query to only count items whose
itemnumber is in the bookable items set
To test:
1. Have a biblio with at least two items, where one item is
bookable and the other is not (bookable = 0).
2. Check out the non-bookable item to a patron.
3. Attempt to create a booking for the bookable item.
4. Without the patch: a clash is detected even though the
bookable item is available.
5. Apply the patch.
6. Repeat steps 2-3.
7. Verify the booking succeeds without a false clash.
8. Run: prove t/db_dependent/Koha/Biblio.t
and confirm the new subtest
"checkouts on non-bookable items do not cause false clashes"
passes.
Sponsored-by: Büchereizentrale Schleswig-Holstein <https://www.bz-sh.de/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
The warning
[WARN] Use of uninitialized value in string eq at
/kohadevbox/koha/circ/del_message.pl line 54.
appears in plack-intranet-error.log
Test plan:
==========
1. Observe plack-intranet-error.log
2. Search for any patron and go to "Check out" tab.
3. Add message for patron. Added message is shown in "Message" area
with "Edit" and "Delete" links.
4. Click "Delete" and confirm modal.
5. Warning appears in plack-intranet-error.log
6. Apply the patch; restart_all
7. Repeat 3-4. No warning appears.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch renames BibTex to BibTeX (with a capital X) for the staff interface
cart and list download options, to match the OPAC.
Test plan:
1. Log in to the staff interface and search for a term that returns
results.
2. Add some records from the results to the cart (select records >
Add to cart).
3. Add some records from the results to a new public list (select
records > Add to list > New list > name the list > make it a
public list > Save).
4. Note the download options for the cart and the spelling: Cart >
Download > BibTexi (with a lowercase X).
5. Note the download options for lists and the spelling: Lists >
Public lists > select the list > Download list > BibTex (with a
lowercase X).
6. Go to the OPAC and search for a term that returns results.
7. Add some records from the results to the cart (select records >
Add to cart).
8. Note the download options for the cart and the spelling (with a
capital X): Cart > Download > BibTeX.
9. Note the download options for lists and the spelling (with a
capital X): Lists > Public lists > the name of your list >
Download > BibTeX.
10. Apply the patch.
11. Recheck the download options in steps 4 and 5.
12. The option should now show as BibTeX (with a capital X).
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This change fixes a typo from pa_loo to pa_class, so that
the ID attribute of the fieldset is properly set when using PA_CLASS
to group patron attributes.
Test plan:
0. Set up two PA_CLASS values
1. Set up two patron attributes which are viewable/editable on the
OPAC and assign them one class each
2. Go to http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
3. Look at the HTML and note that fieldsets for both PA classes
have the ID of "aai_"
4. Apply the patch
5. Reload the page http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
6. Note that now the fieldsets have ID attributes of
"aai_<PA_CLASS code>".
7. Rejoice as now it's easier to use Javascript and CSS and have valid
HTML!
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch fixes a bug where, context-dependent, LinkWrapper can keep
referencing back to links that should be out of scope.
This was causing odd behaviour whilst writing Bug 14962 - namely, links
returning as the same value in a table of multiple rows due to
LinkWrapper treating linkData.href as one and the same for each row.
TO TEST:
== APPLY PATCH ==
a) enable ERMModule syspref, go to /cgi-bin/koha/erm/erm.pl
b) notice all links and buttons still work as expected
c) go to /cgi-bin/koha/sip2/sip2.pl
d) notice all links and buttons still work as expected
e) go to /cgi-bin/koha/acquisition/vendors
f) notice all links and buttons still work as expected
g) enable PreservationModule syspref, go to
/cgi-bin/koha/preservation/home.pl
h) notice all links and buttons still work as expected
== SIGN OFF ==
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch adds the "Middle name" to the Contact information on moremember.pl,
and it adds "Preferred name:" when it differs from the "First name:". This
provides maximum clarity to staff users.
Test plan:
0. Apply the patch
1. Go to the "Patrons" module and search for or add a new patron
2. Add a firstname, a middle name, and a surname. Also add a "Preferred name"
which matches the firstname.
3. Go to "Details" on the sidebar, and note that "First name", "Middle name",
and "Surname" appear in the "Contact information".
4. Edit the patron and change "Preferred name" to a name that does not
match the "First name"
5. Go to "Details" on the sidebar, and note that "Preferred name" now shows
as well.
6. Enjoy fully comprehending which name is which for the patron!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
- The empty state message was shown when available_lists was empty
but the patron was already on all existing lists
- Add !in_lists guard so the message only displays when the patron
is truly not on any list
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
- When no patron lists exist in the system, the patron lists
tab on the patron detail page renders completely blank
- Other tabs follow the convention of showing a message in
the empty state (e.g. "Patron has nothing on hold.")
- Add an empty state message with a link to create a new
patron list, matching the established pattern
To test:
- Go to a patron detail page and click the "Patron lists" tab
- If no patron lists exist, observe the tab is blank
- Apply patch
- Repeat the above steps
- Verify the tab now shows "Patron is not on any list." with
a link to create a new patron list
- Click the link and create a patron list
- Return to the patron detail page and verify the "Add patron
to list" dropdown now appears instead
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Test plan:
Before applying the patch:
1. Go to acquisitions
2. Go to Purchase Suggestions
3. Create a purchase suggestion (for ease of testing, select Centerville for the library)
4. On the table, click on the suggestion number
5. Observe the suggestion does not populate, including the breadcrumbs, but the url does contain the suggestion number.
6. Apply the patch
7. restart_all
8. Rpeat steps 1-4
9. Observe the suggestion now populates and can be edited.
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch prevents the UI to randomly change the language when reaching
addbooks
The problem is that getlanguage is called BEFORE get_template_and_user,
without, and "interface" (C4::Context->interface) is not set yet.
Open C4/Languages.pm, search "sub getlanguage"
We first read the cache, then if there is no interface we reach
GetTranslatedLanguages that does return languages in a random order,
then we pick the first one
765 @languages = map { $_->{rfc4646_subtag} } @{ getTranslatedLanguages( $interface, $theme ) };
783 $language = shift @languages unless $language;
We must call getlanguage AFTER that the cache is populated.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
The Handler::run change to skip disabled plugins broke the
RecordsFromMarcPlugin subtest in ImportBatch.t. The MarcFieldValues
plugin was installed but never enabled, so Handler::run returned
early. Add $plugin->enable() before calling RecordsFromMarcPlugin.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
It appears that edi_cron.pl will run disabled EDI plugins. It uses Koha::Plugins::Handler::run that does not check if the plugins is gets are disabled.
Koha::Plugins::Handler::run needs to be fixed to not run disabled plugins.
Test Plan:
1) Apply this patch
2) prove t/db_dependent/Koha/Plugins/Plugins.t
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
This patch fixes the patron header search, so that you can do
patron searches from the header, but empty patron searches
are prevented and show a tooltip.
Test plan:
0. DO NOT APPLY THE PATCH YET
1. Log into the staff interface and try to search for anything
in the "Search patrons" header search
2. Note that nothing happens at all no matter how much you click
3. Apply the patch
4. Refresh the browser page
5. Try to search for anything in the "Seearch patrons" header search
6. Note that it performs the search
7. Empty out the input box and hit Enter or the search button
8. Note that a tooltip appears saying "Please enter a card number or name"
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
Read the patch. Look for the var in the script.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Adds a new subtest to t/db_dependent/Koha/Patron.t covering
fixup_cardnumber and the autoMemberNumValue counter:
- Normal increment bumps the counter
- Renaming a patron's cardnumber does not free it for reuse
- Deleting a patron does not free their cardnumber for reuse
- Counter wins when ahead of db_max
- db_max wins when ahead of counter
- Legacy fallback when the syspref row is absent
Also adds autoMemberNumValue to the exceptions list in
t/db_dependent/check_sysprefs.t. The preference is managed internally
by Koha::Patron::fixup_cardnumber -- it is not user-configurable and
has no entry in the admin preference YAML files.
Test plan:
1. prove t/db_dependent/Koha/Patron.t
2. prove t/db_dependent/check_sysprefs.t
3. prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t
(confirm the patron_barcode_transform hook is still called twice
during store when autoMemberNum is enabled).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
(cherry picked from commit 2091ef0fea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When autoMemberNum is enabled, Koha picks the next cardnumber as
MAX(numeric cardnumber in borrowers) + 1. If patron A's auto-generated
cardnumber is later changed (e.g. they get a physical card) or the
patron is deleted, the original number becomes "free" and the next
self-registrant is assigned it -- inheriting anything third-party
services (OverDrive, Hoopla, unauthenticated self-check) have keyed on
the cardnumber.
This patch makes Koha::Patron::fixup_cardnumber use a monotonic counter
(the autoMemberNumValue syspref) so that once a number has been
auto-generated for any patron, it is never auto-generated again.
The syspref row is locked with SELECT ... FOR UPDATE inside the
existing txn_do, which serialises concurrent callers via InnoDB
row-level locking and addresses the race condition raised against
earlier revisions of this patch.
The formula is: next = MAX(counter, db_max) + 1. When the counter is 0
(pre-upgrade or missing syspref), this degrades gracefully to
db_max + 1 -- the legacy behaviour -- so no feature toggle is needed.
The counter is only bumped when Koha actually auto-generates a
cardnumber; plugin- or caller-supplied values do not touch it.
Test plan:
1. Enable autoMemberNum.
2. Self-register patron A via OPAC, note cardnumber N.
3. Edit patron A in the staff interface, change cardnumber to
something non-numeric like "MANUAL-XYZ".
4. Self-register patron B.
5. Confirm B gets N+1, NOT N.
6. Delete patron A.
7. Self-register patron C.
8. Confirm C gets N+2, NOT A's original number.
9. Install a plugin implementing the patron_barcode_transform hook;
confirm it still runs and its value is honoured (counter is not
bumped when the plugin supplies a cardnumber).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
(cherry picked from commit ccfbb35de5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass
David Cook
Nick Clemens
Jonathan Druart
Martin Renvoize
Marcel de Rooy
Hammat Wele
Kyle M Hall
Kevin Carnes
Slava Shishkin
Roman Dolny
Jake Deery
Owen Leonard
Paul Derscheid
David Nind
Lisette Scheer