This is not used and not needed.
Noticed when evaluating every potential 'op'.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds select 2 to multi-select parameter fields in
SQL reports. If no selections are made for a multi-select
all authorised values will be used by default. This allows reports
to be written where a multi select parameter is optional.
To test:
1. Apply patch
2. Go to Reports and create a report from SQL
select *
from items
where
homebranch in <<Libraries|branches:in>>
and
itype in <<Item type|itemtypes:in>>
3. Run the report making multiple selections for each parameter
and making single selections for each parameter
4. Run the report making multiple selections for one parameter and no
selections in another parameter
5. Check that the results are as you would expect
6. On the results page click 'Show SQL code'
7. Confirm that the codes are included according to your selections
8. Note that when no selections are made for a parameter all codes are
used by defaut
Sponsored-by: CLAMS
Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
If the main heading is 111 and id contains subfield $n, the content of
this subfield is badly displayed in OPAC: at the beginning of the
heading text (right after "By:"), and then correctly, as the part of
the link.
Test plan:
==========
1. Check if the 111 $n subfield is available in the framework you are
using. If not, activate it (Editor checkbox).
2. Take any bibliographic record and replace the main heading with a
conference heading (111), e.g.:
111 $a Annual Koha Hackfest $n (13 : $c Marseille : $d 2025)
Control in OPAC that the $n subfield is displayed twice (first time
at the beginning)
3. Apply the patch ; restart_all
4. Check the result in OPAC: the main heading should be displayed
correctly now.
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
Add a line for All categories.
Delete it again. Check when refreshing the page.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
Go to smart rules.
Add a limit for All.
Refresh and check if it is still there.
Enable ArticleRequests and verify if the limit is working.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Set up a user with only catalogue and edit_items permissions
2. Create a Fast Add record with item
a. Go to Cataloging
b. Click on Fast Cataloging
c. Fill in mandatory fields and save the record
d. Fill in mandatory item fields and click Add item
3. Log in as the user you set up in step 1
4. Search for the record you created in step 2
5. Click Edit > Manage items in the menu at the top of the record
==> You do not have permission to access this page!
6. Go back to biblio record page
7. Apply patch and restart_all
8. Click Edit > Manage items again
==> Edit items page loads normally
9. Make a few edits and confirm that they save correctly
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change updates the required version for List::MoreUtils
following the inclusion of "zip6" function introduced in
List::MoreUtils version 0.423
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change adds a system preference OPACDisableSendList which
disables the ability to send lists from the OPAC, and hides the
"Send list" link on the opac-shelves.pl page.
This is useful in situations where you do not want OPAC users to be
able to generate emails to arbitrary addresses with arbitrary comments.
Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Create a public list with at least one record and view it in the OPAC
2. Click "Send list" and note you can fill out boxes for "Email address"
and "Comment"
3. Change syspref OPACDisableSendList to "Don't allow" and click "Send list"
again
4. Note the popup window now says "You do not have permission to send this list."
5. Reload the list web page and notice "Send list" no longer appears on the toolbar
next to "Print list"
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Commit https://github.com/Koha-Community/Koha/commit/f42df40 renamed 'Members' to 'Patrons' but didnt adjust h3->h2 as it did with every other entry in this page
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
TEST PLAN:
1 - go to /cgi-bin/koha/tools/letter.pl
2 - click on New notice -> claim serial issue (or any other one)
3 - Fill required fields with random string
4 - Save -> if it breaks, go to
5 - Open a network panel (F12 -> network)
6 - Filter on letter.pl
7 - Fill another new notice -> the arguments of the form page have been
passed in the address of the POST request.
8 - Apply patch
9 - Repeat the whole process and see it works now
Signed-off-by: Magnus Enger <magnus@libriotech.no>
I can't recreate the problem, but the change seems sensible enough
and does not seem to introduce a regression, I can still save a
new letter/notice.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In the current main branch, when linking authorities with other
authorities, if you select a relationship you no longer get the
associated letter (i.e. the "relationship code") copied to the
appropriate subfield. Rather, the whole description gets copied.
This patch fixes that.
Test plan:
0) [PREREQUISITES in order for the authority finder plugin to come up]
a) You must have at least one authority type besides the 'Default'.
b) View the MARC structure of the 'Default' auth type, then click
on 'Actions->Subfields' for tag 500; click on 'Edit subfields'.
Select the subfield 'a' tab, then pick an auth type from the
'Thesaurus:' dropdown menu; click 'Save changes' at the top.
1) In the Staff client, go to Authorities, then click 'New Authority'
and pick the 'Default' authority type (or edit an existing auth).
2) When the authority editor comes up, go to tag 500 and expand it.
3) Click on the ellipsis (...) next to subfield $a.
4) When the authority finder comes up, search for an authority, pick
a relator code from the 'Special relationship:' dropdown, and then
click on the 'Choose' button for one of the authorities you found.
5) Notice that the whole description for the relationship you selected
gets copied (instead of just the single letter relationship code).
6) Apply this patch.
7) Repeat steps 1-4.
Notice that, this time, only the relationship code gets copied over.
Signed-off-by: Laurence <laurence.rault@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch reflects some rethinking on my part about how the Bootstrap
color classes are meant to be used, and makes some changes which I hope
will be more consistent with the Bootstrap 5 documentation while keeping
our interface usable.
The main difference is in the use of the classes "text-bg-*" and
"bg-*-subtle." For example the class "bg-info-subtle" will give an
element a subtle colored background. "text-bg-info" will have a more
saturated background color. The "text-" part of the class is a reference
to the fact that elements with that category of classes will have text
color which adapts to provide correct contrast.
This patch also makes a minor adjustment to the color used for "warning"
type elements (e.g. <div class="alert alert-warning">. I've adjusted the
color slightly in order to differentiate it from the "primary"
class color we use for submit buttons.
To test, apply the patch and rebuil the staff interface CSS. Clear your
browser cache if necessary.
Checkouts:
1. Have an item with a non-public note.
2. Check it out, it looks fine while under "Today's issues"
3. Set the issuedate to some time in the past
`update issues set issuedate = '2025-03-04 15:58:46';`
4. The non-public note should appear in legible red.
Return claims:
1. The "Claims" tab on the patron detail and checkout pages already used
the "text-bg-*" classes but the "-success" class didn't work well
with the tab background color so I removed it. I notice there is a bug
in the way the classes change as the tab is activated, but that will
have to be dealt with on another bug.
Bibliographic details:
1. Place at least one hold and at least one article request on a title.
2. The detail view should show "Holds: 1", and "Article requests: 1"
with the numbers in legible Bootstrap badges.
Holds:
1. Perform a catalog search which will return multiple titles.
2. Select multiple titles and click "Place hold."
3. Select a patron to place a hold for.
4. Confirm the holds by clicking "Place hold."
5. The holds should now be shown under the heading "Existing holds,"
with Bootstrap badgets showing the hold count on each.
Patrons requesting modification:
1. Submit an update to a patron record via the OPAC.
2. On the patrons home page in the staff interface there should be a
"Patrons requesting modifications" link at the top, with a count of
pending modifications shown in a Bootstrap badge.
Check-ins:
1. Check in an item from a patron account with multiple other checkouts.
2. In the table of checked-in items the patron's remaining checkout
count should be shown in a Bootstrap badge.
SMTP servers:
1. Go to Administration -> SMTP Servers.
2. Edit at least one server so that debug mode is enabled and it is
marked as a default server.
3. In the view of servers, the debug mode and default status should be
shown in Bootstrap badges.
Plugins:
1. Go to Administration -> Plugins.
2. Upload a plugin if necessary, and check the list of installed plugins
when the plugin is disabled and when it is enabled. In both cases the
status should appear in a Bootstrap badge.
About page:
1. Go to the About page.
2. Under the "Server information" tab, the status of Memcached and
Message broker should be shown with a background color--pale blue for
okay statuses.
Tools home page:
1. If necessary, go to the OPAC and submit at least one comment on a
bibliographic record and tag at least one record.
2. In the staff interface, on the Tools home page, the number of tags
pending approval and the number of comments awaiting moderation
should show in Bootstrap badges.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Enable AudioAlerts
2. Set something up in the SCO to play a sound from an external source. ( I used #sco_main as my selector )
3. Go to SCO and try to trigger the sound, nothing plays.
4. APPLY PATCH
5. Try steps 2 and 3 again, this time you should hear the sound from an external source.
Signed-off-by: Andrew <andrew.auld@openfifth.co.uk>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
An accessibility audit highlighted that the purchase suggestions
and search history tables in the 'My Account' section do not
have headings in the tickbox column. The report suggests headings
should be added to support those using screen readers.
To Test:
1) In the opac, navigate to 'Your Account'
2) Navigate to 'Purchase Suggestions'
3) Add a purchase suggestion if you currently have none
4) Note that the left column does not have a heading and you cannot tab to it
5) Navigate to 'Search History'
6) Note, you must have searched the catalogue at least once for this table to display
7) Note that the left column does not have a heading and you cannot tab to it
8) Apply the patch
9) Repeat the steps above
10) Note that the tables now have a tooltip with information relevant to the column
11) Note that this column heading can now be tabbed to
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In "Holds to pull" page, patron column should use patron-title.inc like in other pages (like waiting holds).
This allows to use surname first to allow better sorting/finding.
Test plan :
1) Place an hold on some record
2) Go to Circulation > Holds to pull
3) Check you see in column "First patron" : surname then firstname
Signed-off-by: Emmanuel Bétemps <e.betemps@gmail.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch changes the script to use 'Koha::PseudonymizedTransaction->new_from_statistic' directly
rather than calling 'Koha::Statistic->pseudonymize()' which generates a background job.
Additionally, some of the checks from 'pseudonymnize' and the background job are moved into the search
so we don't fetch any to pseudonymize that should not be.
To test:
1 - Generate some entries in statistics (checkin, checkout, renew, etc)
2 - Enable pseudonymization (see bug 28911 if you need bcrypt settings)
3 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
4 - Statistics pseudonymized
5 - Check the background jobs table, note jobs were generated
6 - Apply patch
7 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
8 - You get same count as before, and are warned of existing pseudonymized transactions
9 - enter 'Y' to continue
10 - Check the pseudonymized_transacations table
11 - Confirm same rows were generated twice
12 - Check the background jobs
13 - Confirm there were no new jobs generated (for pseudonymization)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This applies only to the basic editor, but for both bibs and authorities
To test:
1 - Open a bib in the basic editor, see that the control fields show the subfield tag value label and that the value of 00 is slightly cut off in the display
2 - Open an authority in the basic editor and confirm same
3 - apply patch
4 - reload your records and see that the subfield value and label are now hidden for control fields in both bib and authrority editing
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The koha-mysql didn't work when the instance was set up to use an encrypted
database connection.
Please note: this testplan is for ktd, not for a production environment!
Unfortunately, there are some issues with the database TLS configuration in koha-testing-docker.
This is described comment 14 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c14)
As a workaround, you can add "mysql_ssl_optional=1" in Koha/Database.pm.
See point (g) in comment 15 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c15)
Testing Database Connection Encryption:
1. Apply the patch.
2. Configure koha-conf.xml to use a TLS connection
(see comment 10 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c10, follow steps 3a-g + 4 )
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the encryption settings in the MySQL console:
- run:
SHOW VARIABLES LIKE '%ssl%';
- run:
STATUS;
Ensure that the following conditions are met:
- have_openssl and have_ssl are set to "YES".
- The SSL cipher in use is displayed.
Testing MySQL Timezone Configuration:
1. Apply the patch.
2. Configure the timezone in koha-conf.xml, for example:
<timezone>Antarctica/South_Pole</timezone>
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the timezone setting in the MySQL console by running:
SELECT @@session.time_zone;
6. Confirm that the output matches the timezone configured in koha-conf.xml.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a "data-sort" attribute to the columns in the results
table which contain dates. This allows DataTables to sort using the
unformatted date.
The patch also adds the "anti-the" class to the column containing
titles, ensuring that the sort excludes articles.
To test, apply the patch and go to Reports -> Statistics wizards -> Cash
register. You must have multiple entries in the results, which could be
generated by using the "Create manual invoice" form under a patron's
account tab. Unfortunately that won't create entries with multiple dates
to sort on. I assume a proper test will require some manual SQL updates.
To test title sorting you should have some transactions which are tied
to an item. To generate this data:
- Set the 'WhenLostChargeReplacementFee' system preference to "Charge"
- Add a replacement cost to some items in the catalog.
- Check those items out ot a patron.
- From the "Item details" tab for those records, mark each item lost.
- The charges should now be on the patron's account.
- On the Cash register statistics page, submit the form using parameters
which will return multiple results.
- Test that the "Transaction date" and "Updated" columns work correctly
with various settings of the "dateformat" system preference.
- Test that the "Bibliographic record title" column sorts correctly,
excluding initial articles (a, an, the) from the sort.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Changing "nosort" to "NoSort". Also adding an "order" option to the
table configuration so that the table isn't sorted by default on the
first column (overriding the NoSort option).
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Why no sort on item type? Why no sort on #checkouts_result?
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
it does not make sense to remove sorting only for the last 2 fields
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In those occurrences we can simply use NoSort. It fixes some bugs, where
the display of the column depends on some pref's values
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Same as previouly for anti-the
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
We don't need nosort and NoSort, use NoSort everywhere
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
No need to pass it to the constructor as it's defined already in
datatables.js
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch updates the self checkout page so that it uses the same
message as the regular OPAC in response to a user trying to log in with
incorrect credentials.
To test, apply the patch enable the self checkout module if necessary.
- Set the SelfCheckoutByLogin system preference to "cardnumber"
- Test the process of logging in as a patron to self checkout:
Submitting an invalid library card number should trigger an error.
- Set the SelfCheckoutByLogin system preference to "username and
password."
- Test this login form by submitting a valid card number or username and
an invalid password. You should see the same error message.
- NOTE: If you submit an invalid card number or username you will get no
message at all, which is a bug in and of itself.
QA note: I think the qa tool warning is an error in the tidy check.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
TEST PLAN:
1 - In the intranet add fines to a client and ensure they have no checkout
2 - Set syspref useDischarge to 'Allow'
3 - On client profile click on "Discharge", see it is possible
4 - On the opac, go to the tab "Ask for discharge", see it is possible
5 - Apply patch
6 - Click on the button "Ask for discharge" -> it will not be possible
and you will be propperly messaged
7 - Return to the tab "Ask for a discharge", there will be no button
anymore
8 - On the intranet page, there will be no button anymore
9 - Check out a book
10 - Repeat 7 and 8 and see the message include issue with checkout
11 - Remove fine and repeat 7 & 8
Bug 14250: (QA follow-up) Deduplicate checks
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Bug 14250: (follow-up) Update messages
Update the text for the reasons the patron cannot be discharged.
Bug 14250: (follow-up) Refacto the algorithm for discharge messages
TEST PLAN:
1 - In the intranet add fines to a client and ensure they have no checkout
2 - Set syspref useDischarge to 'Allow'
3 - On client profile click on "Discharge", see it is possible
4 - On the opac, go to the tab "Ask for discharge", see it is possible
5 - Apply patch
6 - Click on the button "Ask for discharge" -> it will not be possible
and you will be propperly messaged
7 - Return to the tab "Ask for a discharge", there will be no button
anymore
8 - On the intranet page, there will be no button anymore
9 - Check out a book
10 - Repeat 7 and 8 and see the message include issue with checkout
11 - Remove fine and repeat 7 & 8
Note: removing the useless has_checkout and has_debt
Bug 14250: (follow-up) Refacto discharge messages display
The script that determines if one should display messages to the user,
informing him whether they are allowed or not to ask for a discharge is
quite hard to understand.
For sake of readability, transforming the unless to an if since the
error behaviour was in the unless and the success in the else.
Changing to success behaviour in the if and failure in the else.
Bug 14250: Tidy
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Jenkins is not failing when git command fails.
We edited the config and it broke the git repo:
13:32:35 koha_1 | error: unable to normalize alternate object path: /srv/jenkins/workspace/Koha_Source/.git/objects
13:32:35 koha_1 | fatal: not a tree object
13:32:35 koha_1 | [12:29:31] xt/check_makefile.t
So tests were not running correctly
Maybe it will be a problem for people running the tests without being
inside a git repo, but for now we need to ensure the community CI does
what we think it does.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
We add an `ORDER BY` clause to the SQL statement to ensure we
consistently order accross databases by the iso code.
This fixes the failing test on MariaDB as it's default sort order
appears to differ from MySQL for this.
This also ensure we are consistently ordering which will lead to more
consistent and clear results for end users.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.
Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The code went back to step 3 but the error message is not there.
It is easier to go back to the start: no need to fetch columns.
And this is now an exception; it will only come up when trying
malicious things.
Also turned foreach and unless forbidden around. No need to go
into the loop when we found a forbidden field.
Test plan:
See first patch. You should see the message now.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch prevents forbidden columns from being selected using the reports dictionary.
To test:
1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value
6. Apply patch and restart services
7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected
9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:
<option value="borrowers.password">Card number</option>
11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.
13. Ensure tests pass t/db_dependent/Reports/Guided.t
Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save
6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"
12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"
16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It was not failing when warnings were found
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
podchecker is used by the QA script and catch more than Test::Pod
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It only tested files within C4 and Koha directories.
Now we test all the perl files that are in the git index.
Test plan:
0. Do not apply those patches
1. prove xt/author/podcorrectness.t
Notice "Tests=1208" meaning that 1208 files are tested
2. Apply this patch (not the second one)
It fails, and more files are being tested (3254)
xt/author/podcorrectness.t .. 1994/3254
xt/author/podcorrectness.t .. 2726/3254 # Looks like you failed 1 test of 3254.
3. Apply the second patch
=> It passes!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Pedro Amorim
Brendan Lawlor
Janusz Kaczmarek
Marcel de Rooy
Emily Lamancusa
David Cook
Katrin Fischer
Pedro Amorim
Baptiste Wojtkowski
Andreas Roussos
Owen Leonard
Lucas Gass
Alexander Blanchard
Fridolin Somers
Nick Clemens
Andrew Fuerste Henry
Lukas Koszyk
Jonathan Druart
Martin Renvoize
Aleisha Amohia