This change prevents CSV Formula injection on DataTables exports
by escaping formula with a single quote prefix as per OWASP recommendations.
Test plan:
0. Apply patch
1. Go to http://localhost:8081/cgi-bin/koha/members/memberentry.pl
?op=edit_form&destination=circ&borrowernumber=51
2. Add the following in a "Circulation note"
=SUM(1+1)
3. Go to http://localhost:8081/cgi-bin/koha/members/member.pl
?quicksearch=1&circsearch=1&searchmember=koha
4. Click "Export" and choose "Excel" and "CSV"
5. Open those downloaded files in Excel
6. Note that the =SUM(1+1) function is prefixed with a single quote,
and is not automatically executed
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. The problematic "cell" is exported as "'=SUM(1+1)".
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
members/cancel-charge.pl will take either a POST or a GET, and as long as the
accountline_id it is passed can be cancelled, will cancel it. That means any
link you click anywhere while logged in to Koha might cancel a charge. It also
takes a borrowernumber which isn't used for the cancelling, only to determine
what account to show after a charge is cancelled, letting a malicious link
show an account other than the one whose charge was just cancelled.
Test plan:
1. Without the patch, Circulation - Checkout - search for the 'koha' patron
you log in as
2. Accounting - Create manual invoice - Make it a Manual fee of 100.00 and
Save
3. Pretending it's a well-disguised link in a spear-phishing email, load
http://localhost:8081/cgi-bin/koha/members/cancel-charge.pl?borrowernumber=5&accountlines_id=1
4. You are now looking at charges for the patron Acosta, Edna rather than for
the patron koha, but if you look at the patron koha, its 100.00 charge
has been cancelled.
5. Apply patch and reset_all (or if you don't, you'll have to manually adjust
the link to reflect the charge being accountlines_id 3 rather than 1)
6. Circulation - Checkout - search for the 'koha' patron you log in as
7. Accounting - Create manual invoice - Make it a Manual fee of 100.00 and
Save
8. Click the link http://localhost:8081/cgi-bin/koha/members/cancel-charge.pl?borrowernumber=5&accountlines_id=1
9. You got a 403 because you didn't pass the op cud-cancel, but if you did
pass that op, you would also get a 403 for having a cud- op in a GET (and
if you POST, you won't have a csrf_token)
10. Checkout - search for koha - Accounting - Cancel charge
11. Having done it the right way, you're now on koha's list of transactions,
where you can see you just cancelled it
Sponsored-by: Chetco Community Public Library
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()
Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change removes the Koha version number from the OPAC generator
metadata.
Test plan:
0. Apply patch
1. Enable syspref SelfCheckInModule
2. Visit /cgi-bin/koha/opac-main.pl and confirm meta tag doesn't
include version number
3. Visit /cgi-bin/koha/sci/sci-main.pl and confirm meta tag doesn't
include version number
4. Visit /cgi-bin/koha/sco/sco-main.pl) and confirm meta tag doesn't
include version number
5. Click "Help" and confirm meta tag doesn't include version number
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection.
To test:
Enable the "SelfCheckInModule".
Open the barcode input form.
Enter a barcode with HTML or script tags.
Without the patch, observe that the script is executed.
Apply the patch.
Repeat step 2.
Verify that the input is escaped and no script execution occurs.
Check that the barcode is properly appended to the table.
Documentation:
No updates required.
Sponsored-by: KillerRabbitAos
Signed-off-by: Bo Gustavsson <bosse@gustavsson.one>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Before bug 35138:
DisplayLibraryFacets had priority over the settings in the mappings page.
If you had DisplayLibraryFacets set to "holding library" (only) then only the holding library facet was displayed.
On 231200036 we were not adjusting the facet order/appearance, but the
label, which was wrong. The label must be adjusted for both facets and
the order depending on DisplayLibraryFacets.
Note that bug 37446 is adding a new db rev to adjust the label for
installations that have been updated already.
Test plan:
0. checkout c120975b78 (the commit right before 35138 has been pushed)
1. reset_all
2. holding library is set in DisplayLibraryFacets by default
3. checkout main (so without this patch)
4. updatedatabase
=> ES search result display both facets
5. Repeat 0,1,2 and checkout main + this patch, updatedatabase
=> ES search result display only the holding library facet
Feel free to try with another value in DisplayLibraryFacets
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 80d4d3a586)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8b691a2b9c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a new key 'notconsidered' to the authority cache when
linking to avoid doubling when creating new authorities and wishing
to ignore thesaurus
To test:
0 - Set LinkerConsiderThesaurus to "don't"
1 - Set AutCreateAuthorities to generate
2 - Set AutLinkBiblios to Do
3 - Set CataloguingModuleRelink to Do
4 - Save a new record in Koha with the same randomized heading repeated
but from 3 different authority sources
ensure source is defined by indicators only and by field $2 once
ensure the heading is random so that no matches will be found
5 - Confirm each authority is linked to a new unique authority
6 - Apply patch, restart all
7 - Repeat 4 with a new subject heading
8 - Confirm all headings are linked to the same authority
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1894fc5101)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Apply both patches
2) $ qa -c 2 -v 2
Amended-by: Jonathan Druart
Add the different attribute at the end of the node so that we can easily
see what's different between the two lines
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The bug is caused by the SMS data not being submitted as its fieldset is disabled if SMSSendDriver is empty.
This causes the SMS instance of the notice to not be updated when the edit happens, becoming out of sync.
Once it becomes out of sync with the other notices of same code but different transport_type, the 'GROUP BY branchcode,module,code,name,branchname' in letter.pl will fail, as the name no longer matches, listing the same notice twice on the notices table.
This patch updates the logic on the template to have the SMS input elements be disabled/readonly instead of having disabled='disabled' on the SMS fieldset.
This keeps the same functionality i.e. staff member is unable to edit SMS notice if SMSSendDriver is disabled, but ensures that SMS related data is submitted to the controller when the notice edit save happens.
Test plan:
1) Visit notices and slips:
<staff_url>/cgi-bin/koha/tools/letter.pl
2) Search for a notice code e.g. 'ILL_REQUEST_UPDATE'.
3) Notice only one result is returned. Click 'Edit'.
4) Edit the 'Name'. Click 'Save'.
5) Repeat 2. Notice two results are now returned.
6) Apply patch. Repeat test plan. Notice only one result is returned at the end.
Signed-off-by: Jason Robb <jrobb@sekls.org>
Amended-by: Jonathan Druart
Align
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch simply weeds out allocated holds before filling from the matrix
To test:
1 - Enable RealTimeHoldsQueue
2 - Enable UseTransportCostMatrix
3 - Enable LocalHoldsPriority Give/Home/Home
4 - Administration - Transport cost matrix - enable transfers to/from Centreville and other libraries, add a cost, and save
5 - Find a bib with a Centerville item
6 - Place a hold for a centerville patron
7 - Circulation - Holds queue - All libraries
8 - Note hold is entered twice
9 - On command line:
perl misc/cronjobs/holds/build_holds_queue.pl --force
10 - Run holds queue again, still there twice
11 - Apply patch
12 - On command line:
perl misc/cronjobs/holds/build_holds_queue.pl --force
Confirm allocated only once
13 - Delete hold, place again from bib record (to test real time allocation)
14 - Confirm allocated only once
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4ed5e6c248)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Have more than 1 staff member who can manage suggestions
2. Create some suggestions
3. Move some suggestions to different statuses (Pending/Accepted/Rejected) so you have multiple tabs on the "Suggestions management" page.
4. Go to the first tab, check some suggestions, and click "Select manager" under "Update manager".
5. Pick a new manager, notice nothing changes on that tab.
6. Now look at the last tab in your list of tabs, see the suggestion manager has been set incorrectly to the last tab.
7. APPLY PATCH
8. Try 4-5 again. The manager should be selected correctly.
9. Try setting the manaager from every tab, making sure it works right.
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2d28aa403a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The template for RSS and Atom feeds of search results (curiously named
opac-opensearch.tt) is careful to escape ampersands in the query_cgi param
while adding it to URLs, but doesn't escape the limit_cgi param at all. It
should.
Two drive-by fixes for Atom: because the <title> when your search has a limit
includes , which isn't an XML character entity, you couldn't get as far
as the error from the <link> URL, and as long as I was going to have blame for
the line, I couldn't bear to leave the stray undefined SEARCH_RESULT. in the
(hard-coded and bogus) <link rel="last">.
Test plan:
1. In the OPAC, Advanced search - check the boxes to limit by item type Books
and Mixed Materials and search for the keyword Perl
2. At the top of the search results, click the orange RSS icon
3. That gives you an ugly "not well-formed" error, so in the URL for the page
change the final "format=rss" to "format=atom"
4. That gives you an ugly "undefined entity" error, so apply the patch
5. Reload the page with the Atom feed, it should change from an error page
to a garbled display of the feed. Click Back to go back to the RSS feed
and reload it if it's still cached on the error page. That should give
a pretty-printed display of the RSS feed without parsing errors
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8298e708b9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When one tries to edit circulation rule "When to charge"
columns value is always set as "End of interval". This patch adds
data-code attribute to chargeperiod_charge_at selector
to define existing rules value.
To reproduce:
1. Navigate to Circulation and fine rules page.
2. Find or create a rule with a "When to charge" value set as
"Start of interval".
3. Edit rule.
=> Note that "When to charge" value is now "End of interval",
while as the other values should be copied as they were.
4. Apply this patch.
5. Edit rule again.
=> "When to charge" should now be copied correctly.
Sponsored-by: Koha-Suomi Oy
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2ca65e0a06)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1d6f3c4cbe)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch fixes deletion of saved reports in two instances which
were broken by the CSRF changes: From the dropdown menu in the table of
saved reports, and in the modal window which appears if you click the
"Preview" dropdown menu in the table of saved reports.
The patch also makes a minor change to form-submit.js so that the event
handler will attach to dynamically-generated elements (as is the case
with the preview modal).
To test, apply the patch and go to Reports -> Use saved.
- Add one or more reports if necessary.
- In the table of reports, click the secondary dropdown link in the
"Run" button.
- Click "Delete." You should be asked to confirm, and confirming should
correctly delete the report.
- Now test the "Preview SQL" link in the menu.
- A modal window should appear showing you the SQL of the report.
- In the footer of the modal, test the "Delete" button.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 44d0703b4a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Now that deleting an authority record uses a form, rather than building up a
URL in JavaScript, using the filter | uri on the value (confusingly named
value) which passes along the search terms to reload after deleting results
in a bad search. It should instead use the filter | html.
Test plan:
1. Without the patch, top menu - Authorities
2. The default search, Main heading ($a only), Authority type Default,
Operator contains, Order by Heading A-Z will work fine. You need to a
search which will return more than one of the same thing (not hard in
ktd) - for MARC21 search for a professional
3. You should get five results. For one of them, Actions - Delete - Confirm
that you meant to click it
4. You now have a%20professional in the search box, and search results for
whatever ElasticSearch thinks a% means. It's certainly not professional -
you can change that term to any random string and get the same results
5. Apply patch, top menu - Authorities
6. Repeat steps 2 and 3, but this time after deleting another result,
you will get a professional without the %20 in the search box, and
your results will be the remaining Addison-Wesley professional computing
series authorities
Sponsored-by: Chetco Community Public Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6eb4d5804b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Find an item to checkout that doesn't belong to the branch you are logged in at.
2. Check the item out.
3. Go to Circulation > Check in
4. Using the check in input in the main area ("Check in"), check the item in
5. A modal should appear, "Please return this item to {branch}"
6. Click "Print slip"
7. Deal with the browsers print dialouge. ( print, cancel, or save should work for testing)
8. After the modal closes focus is not brought back to the barcode field.
9. Check the item in again, this should trigger the "Wrong transfer detected, please return item to: {branch}" modal.
10. Click "Print transfer slip", here the modal closes and properly gives focus to the #barcode input.
11. APPLY PATCH, clear browser cache.
12. Try all the steps again, each time focus should be restored to the #barcode input
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch was envisioned by Julian Maurice.
Test plan:
0. Apply the 1st patch (the revert)
1. Go to `misc/translator/po`
2. es-ES-messages-js.po
3. Mark "Edit" string as fuzzy (around line 48). It should look like:
```
msgid "Edit"
msgstr "Editar"
```
4. Edit ./intranet-main.tt and add the following lines at the bottom,
inside the `$(document).ready` block:
```javascript
console.log(_("Edit"));
console.log(__("Edit"));
```
5. Install the templates
k$ koha-translate --install es-ES --dev kohadev && restart_all
6. Enable *es-ES* by searching for `language` in the sysprefs and switch
to it for the staff interface.
7. Go to the Koha home page, open the browser console
=> FAIL: Notice that the second log in the console is displaying the
fuzzy string (i.e. is being translated when it shouldn't)
8. Apply this patch
9. Re-install the translated templates:
k$ koha-translate --update es-ES --dev kohadev && restart_all
10. Repeat 7
=> SUCCESS: With this patch applied both logs show the English version of the
string.
11. Remove the fuzzy flag on `es-ES-messages-js.po`
12. Repeat 9 and 10
=> SUCCESS: The results are similar to step 7, but in this case they are
expected as the string is not marked fuzzy.
13. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5102f708a5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This reverts commit 4eb9816354.
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b285fd57c8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It's a stupid global variable, we MUST have this init line BEFORE we
read it!
Test plan:
See the other bugs linked with this one, confirm the test plan for all
of them still pass.
Test plan for this specific bug report:
1. Cataloging - New record -> Audio Cassettes, CDs
2. Fill in the required fields and save
3. Switch to 'Normal', Edit - Edit record
4. Note that 001 and 003 are not visible, and the Settings menu has a checkmark by Audio Cassettes, CDs
5. Click the browser Back button, then Edit - Edit record
6. Note that 001 and 003 are not visible, and the Settings menu has a checkmark by Audio Cassettes, CDs
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e44927842b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 51055d892b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The ability to create fast add records was fixed on bug 38076, but they still cannot be edited after they are saved.
Test Plan:
1) Create a librarian with only fast add cataloging permissions
2) Create a fast add record, save it
3) Attempt to edit that record, you cannot!
4) Apply this patch
5) Restart all the things!
6) Attempt to edit that record, you can!
7) Attempt to edit a non-FA record, you cannot!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 664cbb5bc5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4623dce6f7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Any librarian with the edit_catalogue sub-permission should also be able
to edit fast catalog records. If that was not true, a cataloger could
not convert fast adds into full records.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 20c38762b8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
If a librarian does not have the editcatalogue permission, but does have the fast_cataloging permission, they should be able to add and edit fast cataloging records. Instead they are presented with a login screen and the message that they do not have sufficient permissions.
Test Plan:
1) Create a librarian with only fast add cataloging permissions
2) Attempt to create a fast cat item from the circ menu
3) Note the login screen and error
4) Apply this patch
5) Restart all the things!
6) Try again, you can now create FA records!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5b124f7a1e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 38e33074b6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
And update the first conditional logic.
This patch aims to maintain the logic behind the first patch, but restore get_effective_rule.
get_effective_rule_value is using cache and I believe that is the reason why Items.t fail when using that.
Test plan:
1) Search for 'music' on OPAC
2) Notice records have the 'place hold' link
3) Visit circulation rules on Staff:
<staff_url>/cgi-bin/koha/admin/smart-rules.pl
4) On 'Default checkout, hold and return policy' , under 'Hold policy' pick 'From any library'. Hit 'Save'.
5) Repeat 1). Notice the 'place hold' link is gone.
6) Apply patch. restart plack. Repeat 1). Notice the 'place hold' is shown again
Run:
$ prove t/db_dependent/Koha/Items.t
Signed-off-by: andrewa <andrew.auld@ptfs-europe.com>
Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c7c24aa8d3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It was noted on Bug 29087 that the value of circulation rules needs to be checked differently, so this follow-up addresses that.
To test:
1. Apply patch and restart services
2. Search for a record on the OPAC. Confirm you can see a link to place a hold.
3. Search for this record on the staff interface and place a hold. Go to Circulation -> Holds to pull and confirm your hold shows in the list.
4. Confirm tests still pass t/db_dependent/Koha/Holds.t
Sponsored-by: Whanganui District Council
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: andrewa <andrew.auld@ptfs-europe.com>
Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e2be4e00a5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 76352200ca)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
In the OPAC display of titles on a list, the "Remove from list" control
needs to trigger a POST operation instead of GET. This patch
appends a form for handling single entry deletions, populating
the hidden input upon confirmation.
To test, apply the patch and create a list if necessary, adding multiple
titles to it.
- View the contents of your list.
- Each title on your list should have a "Remove from this list" link.
- Click one of these. You should see a modal confirmation, "Are you
sure you want to remove this item from the list?"
- Confirming should delete the title form the list.
- Check multiple checkboxes in the list of titles and click "Remove
from list" at the top of the list.
- You should see a modal confirmation, "Are you sure you want to
remove these items from the list?"
- Confirming should result in all checked titles being removed
from the list.
- Check one or more checkboxes and then click a single "Remove from
list" link. After confirming, you should find that only the one
title was removed from the list.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ace488e50f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you have an SQL report that selects cardnumber from borrowers, you
get a menuitem to send the results to Batch patron modification. Currently
that fails with a message about no card numbers or borrowernumbers given,
because it tries to do a GET with the op show, when modborrowers.pl is
expecting a POST with the op cud-show.
Test plan:
1. Without the patch, Reports - Create from SQL - name it and paste
select cardnumber from borrowers
in the SQL textarea and save, then Run report.
2. Above the results is a "Batch operations with 20 visible records" menu,
choose Batch patron modification
3. Note that instead of modifying the records, you're stuck with a message
saying "No patron card numbers or borrowernumbers given." even though
there's a whole string of them in the URL.
4. Apply patch, refresh the page with the results (oddly, no apparent need
to even restart_all), and choose the menuitem again, but this time with
a successful result.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a85086d827)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When duplicating a child card with a guarantor, the guarantor information
appears during the card creation process, but disappears as soon as saving
the card. To recreate:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
New test plan:
1. Find a card with a guarantor, either patron or non-patron guarantor.
2. Duplicate the card. Note that it appears to be working on the card
creation screen.
3. Save the patron after completing the form. The guarantor is now gone.
Apply patch and repeat, the guarantor should stay after 3.
Note, I may not have understood the code but it looks like nothing is
searching for the content of the displayed information. Therefore I add
hidden fields that are copies of those provided in guarantor_template
class
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b64a3ce9ba)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The change on bug 30318 prevented setting the default messaging preferences when none were passed.
Self registration relied on this for setting borrower preferences from the defaults.
This patch removes the call to handle_form_action and replaces it with a call to:
SetMessagingPreferencesFromDefault
To test:
1 - Ensure self registration is enabled
2 - Set default messaging preferences for the self registration category
3 - Self register a patron from the OPAC, confirm defaults not set
4 - Apply patch, restart all
5 - Self register a patron
6 - Confirm defaults have been set
7 - Enable PatronSelfRegistrationVerifyByEmail
8 - Self register a patron on OPAC with an email
9 - Find the email and grab the verification link (unless you have emails enabled)
SELECT * FROM message_queue;
10 - Visit the link and confirm registration
11 - Confirm messaging defaults are set
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2accac5fd9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Add circulation rules for a specific library
2) Attempt to remove one of those library specific rules -> get redirected to 'All'
3) Notice the rule for that specific branch is still there
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 72fd2c580d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
After you upload a file or textarea of barcodes to inventory, the next step is
a list of the things that were missing, with checkboxes to check when you find
them, and buttons to Mark seen, which send a POST to
/cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't
have an $op) and without a csrf_token, so the POST fails with a 403.
Test plan:
1. Without the patch, Cataloging - Inventory - in Item location filters
set Library to Centerville, Shelving location to Audio visual, Collection
code to Reference, and in Optional filters for inventory list or comparing
barcodes set Last inventory date to today.
2. Click Submit, and you'll have a table of 23 items. Check the checkbox for
the first item, click Mark seen and continue
3. What was supposed to happen was that you would be taken to the next
page, but instead you are still in the same page, and if you had the
browser console open, you would have seen that you sent a POST to
ajax-inventory.pl, and got a 403 error in response
4. Apply patch, restart_all
5. Repeat step 1 and 2, this time getting to the second page. Check the
checkboxes for the last two items, and click Mark seen and quit
6. Repeat step 1 and click Submit. You should now have only 20 items, since
the three you checked now have a Last inventory date of today.
Yeah, when you did Mark seen and continue they ought to have been removed from
the list, I agree. I had to go back to 23.11.x and make sure that was really
how it was supposed to function, but that is the existing behavior. Even
though they get marked as seen, nothing changes about your list until you quit
and go back to it. Maybe because then something that wasn't on the current
page would have moved there. Another bug.
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sonia Bouis <sonia.bouis@univ-lyon3.fr>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 801fa43c7c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
In additem.pl and additem.tt all instances of 'saveitem' have been updated to 'cud-saveitem'
The javascript needs to be updated in the same way.
Test plan:
- Make sure acqcreateitem is set to "when placing an order"
- Create a basket with some orders
- Close the basket
- Go to your vendor and receive an order
- On the receive page, try to edit your item
=> Without the patch, the pop up page will open and then close, not allowing the item to be edited.
=> With this patch applied you will see the item edit form. Save and
confirm that the parent window is updated with the new value (actually
it's refreshed)
QA notes:
1. git grep 'saveitem'
2. Notice all instances in additem.pl and additem.tt have been updated to 'cud-saveitem'
3. Notice cataloging_additem.js checks if op != 'saveitem'
4. Check the files and verify the change makes sense
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e6b2b342d2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you click on a cell in the Item circulation alerts table, the page sends
a POST to /cgi-bin/koha/admin/item_circulation_alerts.pl without including a
csrf_token, which gets back a 403 error because that's sketchy behavior. It
needs to include the token.
Test plan:
1. Administration - Item circulation alerts
2. Open the browser devtools to the console
3. Click on any green table cell
4. It should have turned red, but instead your console turned red with a 403
5. Apply patch, reload
6. Click on any green table cell, it will turn red
Sponsored-by: Chetco Community Public Library
https://bugs.koha-community.org/show_bug.cgi?id=37959
Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
On bug 37429 we reordered the global var to assign them before anything
else. The logic is correct except for $frameworkcode, we want to do some
processings (like defaulting to "" if eq "Default") BEFORE we retrieve
the MARC structure ($tagslib, $usedTagsLib).
This patch also moved this code after get_template_and_user (and so
authentication), like it should be everywhere.
Test plan:
1. Go to Cataloging
2. Click on New from Z39.50/SRU
3. Make a search in the library of congress server for anything (Caroline searched for author: shakespeare)
4. Click on one of the results and choose Import
Without this patch the basic editor appears, but not the record
With this patch applied the bug is fixed and you can edit the record
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit dffc8cdd2c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The new API driven items view defaults to 20 per page. This is a bit low, it would be great if it could be configurable to a higher value per the table configuration.
Test plan:
1. Apply this patch
2. restart_all (memcached restart is required)
3. Go to Administration > Table settings
4. Catalogue > holdings_table | otherholdings_table
=> Notice the new "Default display length"
5. Select something else than 20
6. Go to the detail page of a record with lot of records
=> Notice that the default value defined in the settings is used.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8e211a1fef)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
- enable WaitingNotifyAtCheckout
- have or create a waiting hold for a patron
- check out an item to a different patron who does not have a waiting hold
- Koha says "This patron has waiting holds that are available for checkout"
- Apply patch
- Reload patron (click 'Checkout' tab)
- Check out an item - no warning
- Find the patron with waiting hold
- Check out an item - warning
- Checkout the waiting item - no warning
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b5f122696c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When you've catalogued a record with MARC framework that is for some reason missing
certain 952 subfields (8, a, b, c, or y), holdings table is no longer loading but
stuck in the "Processing..." loader.
To test, open Koha in two browser tabs:
IN TAB 1 (framework configuration):
1. Create a new MARC framework "TEST", based on the default MARC framework
IN TAB 2 (record view):
2. Create a new record using MARC framework "TEST"
3. Add an item to the newly created record
4. Observe item visible on the record's holdings list
IN TAB 1 (framework configuration):
5. Delete all 952 subfields in framework "TEST" except: 8, a, b, c, y
IN TAB 2 (record view):
6. Refresh page
7. Observe item visible on the record's holdings list
8. Open your browser's console for upcoming error messages
Iterating remaining subfields in following order,
| <FIELD> | <NAME>
------------------------------------------------------
| 952$8 | row._strings.collection_code
| 952$c | row._strings.location
| 952$a | row._strings.home_library_id
| 952$b | row._strings.holding_library_id
| 952$y | row._strings.item_type_id
IN TAB 1 (framework configuration):
9. Delete subfield <FIELD> in framework "TEST"
IN TAB 2 (record view):
10. Refresh page
11. Observe error "Uncaught TypeError: <NAME> is undefined" (Firefox)
(or Cannot read properties of undefined (reading 'str') (Chromium))
12. Apply patch
IN TAB 2:
13. Refresh page
14. Observe item visible on the record's holdings list
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c93ed758f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The rank parameter is passed per biblio record, not per item. When
placing multiple item-level holds on one bib record, only $rank[0] is
defined.
To test:
1. System preference and circulation rule setup
i. Set the system preference DisplayMultiItemHolds to Enable
ii. Edit the default circulation rule to allow 5 holds per record
2. Find or create a bib with 4 or more items
3. Place several bib-level holds
4. Place 4 or more item-level holds at once on that same record
i. Search for a patron to place the holds for (not one of the
patrons you used in step 3)
ii. Select "Hold a specific item"
iii. Check the checkboxes for 4 or more items
iv. Click Place hold
--> Note that one of the new item-level holds is at the end of the list
as it should be, but the rest are out of order
5. Cancel the item-level holds from step 4
6. Apply patch and restart_all
7. Repeat step 4
--> All the new item-level holds are now at the end of the list
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e1517fc8c8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch switch the check in the script to 'cud-list' - we use the same form
submission if listing for preview or directly updating dates, so this may or may
not be a cud- action - assuming it is restores script functionality.
See bug 37941 for updating forms to not share actions
To test:
1 - Checkout some items to patrons of at least two libraries
2 - Tools -> Batch extend due dates
3 - Select nothing except 'preview' and submit
4 - Blank screen
5 - Apply patch, repeat
6 - It works!
7 - Filter by library and confirm it still works
8 - Sign off!
Signed-off-by: Janusz Kaczmarek <januszop@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2e396f08d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
David Cook
Lucas Gass
Phil Ringnalda
Magnus Enger
Kyle M Hall
Artur
Jonathan Druart
Nick Clemens
Pedro Amorim
Emmi Takkinen
Owen Leonard
Tomas Cohen Arazi
Aleisha Amohia
Baptiste Wojtkowski
Janusz Kaczmarek
Brendan Lawlor
Lari Taskula
Paul Derscheid
Emily Lamancusa