In koha-tmpl/intranet-tmpl/prog/en/includes/search_indexes.inc some calls do not set 'index' var generating idx="idx_".
Set 0 has default value.
Test plan :
1) Enable system preference 'IntranetCatalogSearchPulldown'
2) Go to catalogue advanced search
3) Look HTML source and check you see:
<select class="advsearch" name="idx" id="idx_0">
<select class="advsearch" name="idx" id="idx_1">
<select class="advsearch" name="idx" id="idx_2">
4) In page page toolbar, click 'Search catalog'
5) Click on 'More options' icon
6) Look HTML source of this part and check you see:
<select class="advsearch" name="idx" id="idx_0">
Without patch you see:
<select class="advsearch" name="idx" id="idx_">
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0d39336f71)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This followup corrects a problem in image deletion which isn't really
the same issue (it's not CSRF related) but is another problem with
deletion. The JS for grabbing all the checkboxes by name wasn't working
when there is only one checkbox.
To test, apply the patch and delete all but one image from the patron
card creator image manager.
- Check the checkbox for the last image and click the "Delete selected"
button.
- The image should be deleted successfully.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 727b9d2dde)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
The patron image deletion operation was not fully updated in Bug 34478.
The individual "Delete" buttons in the table of images need to be
updated to use form-submit.js
Unrelated: I removed an invalid "align" attribute from a <td>.
To test, apply the patch and go to Tools -> Patron card creator -> Image
manager.
- Upload multiple images
- Test the individual "Delete" buttons in the table of images.
- Test that both the "OK" and "Cancel" operations work correctly.
- Test the process of checking one or more checkboxes and clicking the
"Delete selected" button.
- Test that both the "OK" and "Cancel" operations work correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3f3bfcfa66)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan (ktd):
1) reset_all
2) Run first part of the 241200017.pl atomicupdate manually
koha-mysql kohadev
ALTER TABLE illrequests DROP FOREIGN KEY illrequests_bnfk;
3) Create an ILL request linked to a borrower that doesn't exist (simulate old data):
INSERT INTO illrequests (`backend`, `borrowernumber`,`branchcode` ) VALUES ('Standard', '99999', 'CPL');
4) Run the 2nd part of the atomicupdate manually:
ALTER TABLE illrequests ADD CONSTRAINT illrequests_bnfk FOREIGN KEY(`borrowernumber`) REFERENCES `borrowers` (`borrowernumber`) ON DELETE SET NULL ON UPDATE CASCADE;
5) Notice you get the error:
ERROR 1452 (23000): Cannot add or update a child row: a foreign key constraint fails (., CONSTRAINT FOREIGN KEY () REFERENCES () ON DELETE SET NULL ON UPDATE CASCADE)
6) Run the added query in the patch:
UPDATE illrequests SET borrowernumber = NULL WHERE borrowernumber NOT IN (SELECT borrowernumber FROM borrowers);
7) Repeat step 4)
8) Notice there's no errors
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 94d5c37db8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 688b5961c9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 79567178ec)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7715e3ae4e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1) Navigate to a vendor record
2) Click the Receive shipments button
3) It will open in a new tab
4) Apply patch - yarn js:build
5) Hard refresh the browser
6) Repeat steps 1 - 2
7) The page will open in the same tab
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 052cc1b6ef)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This followup replaces the $raw filter with `scrub_html type => 'note' |
$raw`.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eb19513f48)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch updates the notes field to a $raw filter to prevent html
escaping of the data within it.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3bcbb66ded)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1) Choose a staff patron and assign them the following permissions
- catalogue
- edi_manage
2) Enable the edifact syspref
3) Log in as the chosen staff patron and navigate to Acquisitions > EDI accounts from the left hand menu
4) The breadcrumb will contain Administration
5) Clicking this will result in a permissions error
6) Apply patch
7) Refresh the page and the breadcrumb will now read Acquisitions and will work
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ff366554fe)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch simply adds 'timestamp = current_timestamp()' to the SQL statements
run when editing a biblio. This ensures the tables timestamps are kept in sync
To test:
1 - Choose a biblio in the database and make an update to a 650 field
2 - Check the timestamps in MySQL:
SELECT biblio.timestamp, biblioitems.timestamp, biblio_metadata.timestamp FROM biblio JOIN biblioitems USING (biblionumber) JOIN biblio_metadata USING (biblionumber) WHERE biblionumber=9;
3 - Note the timestamps
4 - Edit the same 650 again
5 - Check the timestamps and note that the biblio_metadata is updated, but the others are not
6 - Apply patch, restart all
7 - Update the 650 again
8 - Check the timestamps, all are updated!
9 - Sign off
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0aa820de32)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1) Navigate to a vendor record and select the baskets view from the left menu
2) Click "add to basket" in the table
3) A modal will display requiring the user to define a budget and fund
4) Apply patch and restart_all
5) Repeat steps 1 and 2
6) You will get the modal to add to the basket
Signed-off-by: David Nind <david@davidnind.com>
Amended-by: Jonathan Druart
Remove import of GetBudget
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3293ae32bc)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
prove /kohadevbox/koha/t/db_dependent/Koha/Item.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 53a9631335)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1. Install a plugin that does not have any background_tasks, e.g. https://github.com/HKS3/HKS3GeoSearch/releases/tag/v0.12
2. Navigate to http://localhost:8081/cgi-bin/koha/admin/background_jobs.pl, observe a 500
3. Apply patch
4. Observe no 500
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 53630add0d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Prevent SQL injection.
Note: output_error in Output.pm needs further attention, but out
of scope here. (The error passed gets replaced by 404 here too.)
Test plan:
Pass something else than table.field in Line or Column URL param.
(Manipulate URL.)
You should be redirected to 404 error instead of 500.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eedb6cece6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch fixes the exection of the report Acquisitions statistics if you fill only the To date
Test plan:
1 Execute the report Acquisitions statistics filling only To date filter in Placed on or Received on (/cgi-bin/koha/reports/acquisitions_stats.pl) Koha returns an Internal Server Error
2 Apply patch, restart services
3 Repeat step 1, now the report returns the results page as expected
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed superfluous COALESCEs.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 856a85d3af)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch adds handling for the 264 field in precedence to the 260 for
the generate_marc_host_field method and also adds subfields n and p to
the 245 handling.
Test plan
1) The routine is currently only called during bundle linking so...
1a) Creating a new bundle
* Add a new bib record
* Mark the bib record as a 'collection' type by setting leader
position 7 to 'c'
* Add a new item to this bib record
* You should see a new 'Manage bundle' button available in the
'Actions' column of the Holdings table.
* Clicking 'Manage bundle' should expand the table to include a new
row directly beneath this one.
* Use the new 'Add to bundle' button that appears in this row to
trigger a modal that allows entering the barcode of items you wish
to add to the bundle
* Ensure the 'Add MARC link' checkbox is checked to create 773 links
and trigger the code above
2) Inspect the MARC record for the host biblio and confirm the 773 has
been built.
3) Run unit tests to confirm they now pass
Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 300247d2c6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch adds unit tests to confirm that the 773 record created by
Koha::Biblio now takes account of RDA updates and subfield ordering.
Test plan
1. Apply patch
2. Run `prove ./t/db_dependent/Koha/Biblio.t`.
3. Test fails.
4. Apply next patch in series
5. Run `prove ./t/db_dependent/Koha/Biblio.t`.
6. All tests pass.
Signed-off-by: Lin Wei Li <lin-wei.li@inLibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f234fe5a1c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch fixes the JS on the saved SQL reports page so that the
subgroup column filter is correctly cleared when the tab changes. The
wrong table column is targeted.
To test, apply the patch and go to Reports -> Saved SQL reports.
- If necessary, at least two SQL reports, each with in a different group
and different subgroup. For example:
- sql: SELECT * FROM items LIMIT 10;
- group: Catalog
- subgroup: Statistics
...and...
- sql: SELECT * FROM borrowers LIMIT 10;
- group: Patrons
- subgroup: Statistics
- From the saved reports page, go to the tab for one of your reports and
filter by subgroup.
- Switch to a different tab containing SQL reports. The reports should
be shown as expected.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Anneli Österman <anneli.osterman@koha-suomi.fi>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2de0265166)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
To test:
1. Download a record you already have in Koha
2. Cataloging > Stage MARC records for import
3. Record matching rule: KohaBiblio (99$c)
4. Stage for import > View batch
5. In the table results there should be a link to 'View' in the 'Diff' column.
6. Notice the Record comparison is not side by side.
7. APPLY PATCH
8. Try steps 1 - 6 again, this time the record comparison should be side by side.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0cafda92b6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Even if severity does not exist. Additionally, only add severity to message if it exists.
Test plan:
1) Apply tests patches. Run tests (they should fail):
prove t/db_dependent/Koha/BackgroundJobs/ErmSushiHarvester.t
2) Apply this patch and run tests again (they should pass this time).
UI test:
1) Create a new data provider linked to Gale Cengage, service url:
https://api.siqcloud.online/counterapi/r51
2) Add report release 5, customer id: '123', requestor id: '123', report types: 'TR_J1'
3) Run a report for this data provider, from Feb 2025 to Apr 2025. Notice that before applying patches, the job report results in a red bar with no error message.
4) Apply patches, repeat 3. Notice it now results in a nice error message.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 023f935360)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9b0d6260bb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d618dc808f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
In order to remove false positives with the QA script we should replace some tabs with spaces.
There are more but I wanted to make sure no regression would be
introduced
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 492e6814a1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c81784956b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
1) Apply this test patch. Run. Verify it fails
2) Apply other patch. Run. Verify it passes.
prove t/db_dependent/api/v1/patrons.t
Verify no other regressions are introduced, run:
prove t/db_dependent/Koha/Patron/Attribute.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit efe048ec66)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Set these sysprefs:
- FinesMode: Calculate and Charge
- WhenLostForgiveFine: Forgive
- WhenLostChargeReplacementFee: Charge
In circ rules:
- Have a rule that charges fines
- Set Refund lost item replacement fee to "Refund lost item charge and charge new overdue fine"
1 - Have/create item with replacement price
2 - Check item out to patron 1, due date in past
3 - Run fines.pl
4 - confirm fines on patron 1
5 - mark item lost
6 - confirm replacement cost generated and fine forgiven on patron 1
7 - check item in
8 - confirm replacement cost forgiven and new fine generated on patron 1
9 - check item out to patron 2, due date in future
10 - check item in
11 - mark item lost (no replacement fee generated because item is not checked out)
12 - in database, update date_due for checkout to patron 2, set to a date in the past
13 - check item in
14 - confirm patron 2 now has a fine
15 - Apply patches, restart all
16 - Repeat test plan with another item and confirm no fine is added for patron 2
Note: At step 12 we're pushing the date_due of the old issue into the past to make date_due<curdate(). In production, this comes up when there are days between steps 10 and 13.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 67c95addeb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 732c7d11ce)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch adds th del=1 param to the batchMod link in the breadcrumbs to ensure we return to batch item
deletion and not modification
To test:
1 - Browse to Cataloging->Batch item deletion
2 - Click the 'Batch item deletion' link in the breadcrumbs
3 - You are now at 'Batch item modification'
4 - Apply patch
5 - Repeat, you stay on the correct page
6 - Complete a batch item deletion and confirm the breadcrum is correct at each stage.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fd2c0709bb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Due to a bad rebase we ended up changing subtest names in commit 1b4bb57092
This patch restores them and has no effect on the tests themselves.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9fcf329dcf)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Test plan:
select count(*) from itemtypes;
run the tests
exectute the select query again
=> No itemtypes should have been created
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 89c42eda9f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch modifies the template for adding to a basket from a new
(empty) record in order to make the "Add user" patron search results
correct. The patron search results table headers must be defined in the
template before they are used.
To test, apply the patch and go to Acquisitions.
- Search for a vendor.
- Add or create a basket for that vendor.
- Click "Add to basket" and select "From a new (empty) record."
- In the "New order" form, under the "Patrons" heading, click "Add user"
- Search for patrons to add.
- In the patron search results, each column should have a heading: Card,
Name, Category, Library.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b4171a1522)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch corrects a few spelling mistakes and missing grammer and adds
a little more detail to the '--date', '--email' and '--frombranch'
options.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f6fd9f2e90)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch alters the query for checking previous checkouts to use
IN instead of a list of OR for itemnumbers.
To test:
1 - On the command line:
export DBIC_TRACE=1
2 - perl -e 'use Koha::Patrons;my $patron = Koha::Patrons->find(5);my $item = Koha::Items->find(54);warn $item->itemnumber;$patron->do_check_for_previous_checkout( $item->unblessed );'
3 - Note the query
4 - Apply patch
5 - Repeat 2
6 - Note the shorter query
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 64ec35b2a5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This patch removes a few instances of the "bg-*" class from our
templates, and adds some CSS to ensure that we can safely add the
".bg-*-subtle" class to a div with ".page-section."
To test, apply the patch and rebuild the staff interface CSS.
- Go to Administration -> Circulation and fine rules. The information
about rules specificity should have a pale blue background matching
the color found in an "info" style alert.
- Go to Tools -> Import patrons. The "Notes" section should match what
you saw in the previous step.
NOTE: I made a small change to whitespace in the markup of this
section to prevent the database column list from displaying without
line breaks--an issue introduced by the global tidy.
- Go to Authorities and perform a search which will return results.
- Click Actions -> Merge on one of the results. An "info" style alert
should be shown at the top of the page, "Merging with authority..."
- Without completing a merge, go to the Authorities home page. You
should see an identical alert.
- In KTD, bibliographic record 369 can be used to test errors related to
encoding problems:
- Go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=369
and confirm that you see a "warning" style alert (a pale yellow
background).
- Edit that record and confirm you see a similar error messages on
that page.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 753ce067e6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit da75bdc692)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
We cannot longer filter patrons by first letter, the browser errors
"Uncaught TypeError: v.replace is not a function"
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ea359a10a9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This change turns off ABSOLUTE and EVAL_PERL for user-entered templates,
as these options can allow for arbitrary code execution and information
disclosure.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a Notice for Reports with a report like:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
3. Run a report using this template
4. The report should show "Two"
5. Turn on CHECKOUT emails for a test patron
6. Perform a checkout
7. Look at the CHECKOUT email and note that the email body
is correctly generated
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Would be good to have this fixed as the default.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
The test plan should include PERL blocks or absolute paths! Tested those
instead. Testing x==1 seems irrelevant.
I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %]
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Fridolin Somers
Owen Leonard
Pedro Amorim
Jonathan Druart
Matt Blenkinsop
Martin Renvoize
Theodoros Theodoropoulos
Matt Blenkinsop
Nick Clemens
Lucas Gass
Tadeusz „tadzik” Sośnierz
Marcel de Rooy
Adolfo Rodríguez
Martin Renvoize
Tomas Cohen Arazi
Katrin Fischer
David Cook