To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm
More tests coming in following patches.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
This change invokes Template::Filters->use_rfc3986 in the C4::Template
module.
Test plan:
0. Apply the patch
1. Note that "uri" and "url" filters now escape single quotes
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.
Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()
Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.
Test plan:
Run t/SIP/Sip.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.
To test, in ktd:
- Run the new tests:
$ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
$ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
$ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
"9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)
Update 2024-12-03: Fix issues pointed out by QA.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.
Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>
3. Note that you're able to generate a print slip
(You may need to allow popups)
4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
On the left of the page. Just bellow the breadcrumb and
left of the record title.
4. Note that everything loads correctly
5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change prevents CSV Formula injection on DataTables exports
by escaping formula with a single quote prefix as per OWASP recommendations.
Test plan:
0. Apply patch
1. Go to http://localhost:8081/cgi-bin/koha/members/memberentry.pl
?op=edit_form&destination=circ&borrowernumber=51
2. Add the following in a "Circulation note"
=SUM(1+1)
3. Go to http://localhost:8081/cgi-bin/koha/members/member.pl
?quicksearch=1&circsearch=1&searchmember=koha
4. Click "Export" and choose "Excel" and "CSV"
5. Open those downloaded files in Excel
6. Note that the =SUM(1+1) function is prefixed with a single quote,
and is not automatically executed
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. The problematic "cell" is exported as "'=SUM(1+1)".
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This change adds the ability to enable and configure TCP keepalive
support for the SIP server using SIPconfig.xml.
For the sake of backwards compatibility, it defaults to disabled
and additional parameters default match typical kernel defaults.
Technical detail can be found in the perldoc for C4/SIP/SIPserver.pm
Test plan:
0. Apply the patch
1. koha-sip --restart kohadev
2. apt-get update && apt-get install tcpdump
3. In one window, run "tcpdump -A -n -v -i any 'port 6001'"
4. In another window, run the following:
echo -e "9300CNterm1|COterm1|CPCPL|\r" | nc 127.0.0.1 6001 -v
5. Note in tcpdump output that after the initial flood of packets,
nothing more is received
6. vi /etc/koha/sites/kohadev/SIPconfig.xml
7. In the "server-params" element, add attributes like the following:
custom_tcp_keepalive='1'
custom_tcp_keepalive_time='10'
custom_tcp_keepalive_intvl='5'
8. koha-sip --restart kohadev
9. In one window, run "tcpdump -A -n -v -i any 'port 6001'"
10. In another window, run the following:
echo -e "9300CNterm1|COterm1|CPCPL|\r" | nc 127.0.0.1 6001 -v
11. Note in tcpdump output that after the initial flood of packets,
ACK packets are sent out every 10+ seconds for the idle connection
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Follow the test plan from Bug 38326.
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 73c7acd33f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
to test:
1- try to save an agreement with 81+ characters in License Info
2- it does not save
3- apply patch, updatedatabase
4- repeat 1, it works!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2512392b2a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch adds a needed index to the column.
To test:
1. On a fresh KTD, run:
$ ktd --shell
k$ koha-mysql kohadev
> SHOW CREATE TABLE oauth_access_tokens;
=> FAIL: There's no 'KEY' entry for the `expires` column
2. Apply this patch
3. Run:
k$ updatedatabase
=> SUCCESS: A message tells the index was added
4. Repeat 1
=> SUCCESS: The index was actually added to the DB
5. Run:
k$ reset_all
6. Repeat 1
=> SUCCESS: The index is created at install time too!
7. Run:
k$ updatedatabase
=> SUCCESS: Nothing explodes, no message about index being created
8. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2e63ece6ae)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
rowGroup plugin is now part of the datatables.min.js bundle. We no
longer need to include its css and js files, and they no longer exist
anyway!
[2024/11/27 08:52:37] [WARN] File not found : lib/jquery/plugins/rowGroup/stylesheets/rowGroup.dataTables.min.css at /kohadevbox/koha/Koha/Template/Plugin/Asset.pm line 107
[2024/11/27 08:52:37] [WARN] File not found : lib/jquery/plugins/rowGroup/dataTables.rowGroup.min.js at /kohadevbox/koha/Koha/Template/Plugin/Asset.pm line 84.
Test plan:
Confirm that the checkouts are grouped "today" and "previous" on the
checkout page.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4b82e00416)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch updates the JavaScript on the patrons requesting modification
page in order to make it work following the upgrade to Bootstrap 5. The
automatic panel expansion is broken.
To test, apply the patch and enable, if necessary, the OPACPatronDetails
system preference.
- Log in to the OPAC and submit changes to your personal details.
- Do this again as a different user so that there is more than one
pending request.
- From the staff interface home page, follow the link for "Patrons
requesting modifications"
- Upon loading, the "Update patron records" page should automatically
expand the first panel.
- Locate the patron record for the second of the patrons you requested
updates for.
- From that patron's detail page, follow the "Review pending
modifications" link.
- The panel containing that patron's information should expand by
default.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a42686d891)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
So that we can open in a separate bug using right click.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d53784de3a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
To test from the OPAC:
1 - create a list with more than 10 items
2 - print the list -> there is a pagination and that only 10 items
are printed
3 - Apply patch
4 - print the list again -> every items are being printed
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Tidied: added a few spaces.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8d0e7ff906)
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
The cause was erroneous check `[% IF bundlesEnabled %]` before the parent bundle information is requested+shown. The `bundlesEnabled` variable checks if the current biblio ITSELF is of collection type, so should only be used for whether to show the button to add new items to the bundle items, NOT for querying whether current item is part of a bundle, as the items that make up the bundle aren't of collection type themselves.
The second fixed problem was that `bundle_host` didn't contain `.biblio` subitem (which'd contain the actual host biblio title) as the JavaScript code assumed, and it wasn't possible to request it with the API either.
Test plan: please follow the reproduction instructions from bug and ensure that the described issue is gone.
If you run into an error 400 on the detail page, you need to refresh API definitions, in kts shell you'drun:
redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json
koha-plack --restart kohadev
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7df4eda9ec)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
The database columns for liblibrarian and libopac in marc_tag_structure and
marc_subfield_structure are 255 characters, but the HTML maxlength in
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt and
/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt
limit tags to 100 characters and subfields to 80 characters.
Test plan:
1. Apply patch, restart_all
2. Administration - MARC bibliographic framework - for Default, Actions -
MARC Structure
3. For the 000 tag, Actions - Edit tag
4. In both the "Description in staff interface" and "Description in OPAC"
paste the 255 character string
1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 1234567890 12
and click Save changes
5. Verify that the display shows all 255 characters, then Actions - Edit tag
and verify that the two inputs reloaded with all 255 characters, and that
you cannot type a 256th character, then click Cancel
6. For the 000 tag, Actions - Edit subfields
7. Paste the same string in both the staff interface and OPAC inputs, Save
changes, verify that all 255 characters show, click Edit subfields, verify
that all 255 characters reloaded in the inputs, verify that you cannot
type a 256th character
Sponsored-by: Chetco Community Public Library
Signed-off-by: Shi Yao Wang <shi-yao.wang@inlibro.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a9044f4b34)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch updates the teams.yaml to include the voted in 25.05
release team.
Test plan
1/ Check against https://wiki.koha-community.org/wiki/Release_Teams
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch adds a missing conditional for ADDITIONAL_MATERIALS to the batch checkout table
Test plan:
1. Set a staff member with circ permissions, including FORCE_CHECKOUT
2. Turn on: CircConfirmItemParts, BatchCheckouts, BatchCheckoutsValidCategories (all)
3. Log in as staff member in step 1
4. Attempt to checkout an item with a 952$3 from the batch checkout tab
5. The item with a 952$3 displays, but the copy/text of the materials specified note does not.
6. Do not confirm checkout
7. Apply patch
8. Try again, the materials note should show this time
9. Confirm checkout
10. Success! Item is checked out
Signed-off-by: Catrina Berka <catrina@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 03538b59aa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Might have been broken by the bootstrap 5 upgrade, but not sure.
Not sure why the click does not trigger the modal.
1. Place an order in acquisitions
1.1. Go to Acquisitions
1.2. Click 'Search' next to 'Search vendors'
1.3. Click 'Add to basket' next to 'My basket'
1.4. Search for an existing record (e.g. search for Shakespeare)
1.5. Click 'Add order' next to a result or in the detailed record
1.6. In the item form, choose an item type
1.7. Click 'Add item'
1.8. Choose a fund
1.9. Enter a price in 'Vendor price'
1.10. Click 'Save'
1.11. Click 'Close basket'
1.12. Click 'Yes, close'
2. Receive the order
2.1. Click 'Receive shipments'
2.2. Enter a value in 'Vendor invoice'
2.3. Click 'Next'
2.4. Click 'Receive' next to your order
=> The modal is shown
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ef455af344)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT} Added a html filter for qa tools..
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0be0f03d52)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adjusts the link to cancel jobs to be submitted as a POST with cud-cancel operation
To test:
1 - Stop your long tasks bacground jobs worker
sudo koha-worker --stop --queue long_tasks kohadev
2 - Stage a file for import
3 - Administration -> Manage jobs
4 - See your new job
5 - Click 'cancel'
6 - It didn't work
7 - Apply patch
8 - Browse to jobs again
9 - Click 'Cancel'
10 - Job is successfully cancelled
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d047776630)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This should do the tric: The test output shows that the second
mapping was not found (field 264); also the expected suspect btw.
So adding that here.
Test plan:
Run t/db_dependent/Biblio.t
See also comment28 on bug 19097.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Simulated the above by removing 264c from Koha to MARC mapping.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 28d24aaa08)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
17:39:54 koha_1 | # Failed test 'updated_on correctly saved on newly created user'
17:39:54 koha_1 | # at t/db_dependent/Auth_with_shibboleth.t line 319.
17:39:54 koha_1 | # Structures begin differing at:
17:39:54 koha_1 | # $got->[0] = '2024-11-19 16:39:30'
17:39:54 koha_1 | # $expected->[0] = '2024-11-19 16:39:29'
17:39:54 koha_1 | # Looks like you failed 1 test of 54.
We must use t::lib::Dates::compare to compare datetimes in tests.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ed25a48ccf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
With a over-sufficient number of items, when more than one patron has
placed hold, and the holds have been partially filled (checked-in =
waiting for pick up), the number of items to pull in the Holds
to pull table shows the total number of holds, including those waiting.
This erroneously suggests to the librarian to pull an excessive number
of items from the shelves.
Test plan:
==========
1. For a bibliographic record with more than two items (in ktd, e.g.
"Lanark a life in four books"), place hold for two patrons.
2. On the Holds to pull page control that there are two items to pull.
3. As a librarian from the library of one of the patrons, Check-in one
item.
4. Note that in Holds to pull table you still see two items to pull,
which is misleading.
5. Apply the patch; restart_all.
6. Now you should see only one item to be pulled.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit abfba936fb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lari Taskula
Phil Ringnalda
Jonathan Druart
David Cook
Marcel de Rooy
Magnus Enger
Julian Maurice
Wainui Witika-Park
Alex Buckley
Lucas Gass
Andrew Fuerste Henry
Tomas Cohen Arazi
Owen Leonard
Michał Kula
Martin Renvoize
Nick Clemens
Janusz Kaczmarek