Commit Graph

58512 Commits

Author SHA1 Message Date
Lucas Gass f58bb7823c
Bug 23010: Adjust tests
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9fefdd5674)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:07 +02:00
Emily Lamancusa 24dab792e3
Bug 23010: (QA follow-up) a few trivial fixes
- Update the dbrev to use say_success, and make dbrev and installer
  consistent
- Change error div in moredetail.tt from info to warning

Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3096833130)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:07 +02:00
Lucas Gass 5965abb919
Bug 23010: More unit tests
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7a299a8114)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:07 +02:00
Lucas Gass 772ad06f86
Bug 23010: Clean up try/catch in additem.pl
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f14ab6ba9d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:06 +02:00
Lucas Gass 820dbb3dfb
Bug 23010: Remove JS added by mistake
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3656abadad)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:06 +02:00
Lucas Gass 0dea596fbb
Bug 23010: Add tests for AutomaticItemModificationByAge
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7bc9a02bd2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:06 +02:00
Lucas Gass c6986364ef
Bug 23010: Handle error in C4/Items.pm using try/catch
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 316f8bc4b8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:05 +02:00
Lucas Gass 845171e4aa
Bug 23010: Report on count of items not modified via batchMod
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ccf4bc0626)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:05 +02:00
Lucas Gass af9615f3d9
Bug 23010: Update pref name to PreventWithdrawingItemsStatus
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c4acafe29b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:04 +02:00
Lucas Gass 22b32b2814
Bug 23010: Fix file permission of atomicupdate
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e5da98c353)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:04 +02:00
Lucas Gass 5aef212975
Bug 23010: Add unit tests
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b035515d1a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:04 +02:00
Lucas Gass 09fc5e8468
Bug 23010: Handle error in updateitem.pl and template
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 73505a73ec)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:03 +02:00
Lucas Gass 152af99174
Bug 23010: Add ability to block withdrawning of items with certain statuses
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b74dbf3d59)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:02:03 +02:00
Lucas Gass db1bca48e6
Bug 23010: Add system preference PreventWithdrawingItemsStatus
To test:

1. APPLY PATCH, updatedatabase, and restart_all
2. Search for the system preference, PreventWithDrawingItemsStatus
3. Select both in transit and checked out, then save
4. Find an item and put it in transit.
5. Now from the item detail page, go to manage items > edit item
6. Using the item that was put in transit, attempt to change the status to withdrawn.
7. You should see an error at the top of the page 'In transit item cannot be withdrawn.' Make sure the item did not get marked as withdrawn.
8. Using a different item, do a checkout
9. Now from the item detail page, go to manage items > edit item
10. Using the checked out item, attempt to change the status to withdrawn.
11. vYou should see an error at the top of the page 'Onloan item cannot be withdrawn.' Make sure the item did not get marked as withdrawn.

12. Now, using the in transit item, go to the items tab. ( catalogue/moredetail.pl?biblionumber=x )
13. Under Statuses, attempt to withdraw the item.
14. You should see an error near the top of the page "Cannot withdraw item in transit".
15. Now, using the checked out item, go to the items tab. ( catalogue/moredetail.pl?biblionumber=144 )
16. Under Statuses, attempt to withdraw the item.
17. You should see an error near the top of the page "Cannot withdraw checked out item.".

18. Using both the in-transit and checked out item, attempt to modify the status through batchMod.
19. Ensure that the items are not being updated to withdrawn.

20. Turn off PreventWithDrawingItemsStatus system preferece.
21. Going through each of the steps again, except this time your items should successfully withdraw.

prove t/db_dependent/Koha/Item.t

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4e920be91f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-16 14:01:58 +02:00
Paul Derscheid d528562116
Update release notes for 25.05.03 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:55:25 +02:00
Paul Derscheid a7d9b27728
Increment version for 25.05.03 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:47:58 +02:00
Tomas Cohen Arazi 8b494a3789
Bug 40579: Fix CSV formula injection vulnerabilities
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:14 +02:00
Tomas Cohen Arazi a07ffbf3d9
Bug 40579: Add author test for CSV formula injection protection
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:13 +02:00
Jonathan Druart 441c5ef081
Bug 40538: Simplify code
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:13 +02:00
David Cook 39daea4c76
Bug 40538: Fix XSS in suspend hold modal
This patch fixes a XSS vulnerability in the
suspend hold modal in the staff interface.

By building our Javascript using Web APIs rather
than with strings and jQuery's html() method,
we're able to securely handle malicious payloads.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29
2. Add a hold for "koha" patron
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "Holds" tab and click "Suspend"
5. Note the modal loads properly
6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
7. Click "Holds" tab and click "Suspend"
8. Note the modal loads properly

Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:13 +02:00
Marcel de Rooy f09fe9e56c
Bug 39906: (QA follow-up) Feature needs to be enabled specifically
See also comment33, point 4.

Test plan:
cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/
Test enabling/disabling by toggling the comment of the SetEnvIf line,
restart apache and remove the KOHA_INIT and CGISESSID cookie.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:12 +02:00
David Cook 89cb4ef77b
Bug 39906: Add a simple quick Apache-level bot challenge
This patch adds a fast simple bot challenge via Apache.

To test:
0. Apply the patch
1. sudo cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/.
2. sudo cp debian/templates/apache-shared-opac-plack.conf /etc/koha/.
3. curl http://localhost:8080/cgi-bin/koha/opac-search.pl
4. Note an instant response with a very simple HTML response
5. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-search.pl
6. Note a very brief loading animation before the OPAC search page appearing
7. Do a search
8. Note no more loading animation appears
9. Close the incognito browser
10. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-main.pl
11. Do a search via the "Library catalog" search bar
12. Note no loading animation appears

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Cornelius Hertfelder <cornelius.hertfelder@bsz-bw.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
We have tested this in production on at least three live sites for
several weeks, and it has worked as expected. We have not noticed any
negative side effects.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 21:05:08 +02:00
Lisette Scheer 642802d8cd
Bug 40620: Holds Queue will assign to the lowest item number if multiple branches have the same transport cost
To Test:
Before applying:
1. Turn on the UseTransportCostMatrix system preference
2. Create holds on a record with multiple items. (I used Lanark in KTD)
3. Set the item location to all be the same (I used MID)
4. Set the holds to pickup at Centerville, Fairfield, and Pleasant Valley
5. Set the transport cost matrix to
Centerville\fairfield 1
Centerville\Midway 1
Fairfield\Centerville 1
Fairfield\Midway 1
Midway\Centerville 1
Midway\Fairfield 1
Midway\Pleasant Valley 4

6. Build the holds queue (either turn on realtime hold queue and then edit the bib to update or run the cron on the command line)
7. Run a report: select * from hold_fill_targets where biblionumber=9 order by borrowernumber;
8. Rebuild the hold queue
9. Run the report again, the results should be the same.

10. Apply the patch
11. Run the hold queue again
12. Observe the results should now be different.
13. Try a few more times and ensure the numbers are changing, create some more items at midway and try again to see more variety in numbers.

Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5832521086)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:29 +02:00
Lucas Gass 4844ce3f18
Bug 40654: Adjust display to show current priority
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 58dc43e06e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:28 +02:00
Lucas Gass 369f8ae6e2
Bug 40654: Fix how rank/priority is adjusted when changing from the UI
To test:
0 - APPLY PATCH
1 - Place 50 holds on a bib record
https://github.com/kidclamp/handy-koha-script/blob/main/randhold.pl
2 - View the holds page for the record
3 - Sort the holds alphabetically
4 - Change the dropdown priortiy for the alphabetically first hold to 1
5 - All the priorities should now ajust accordingly but they will NOT be resorted on the fly
6 - Play with adjusting some priorities, making sure everything correctly adjusts.
7 - Click 'Update holds' to make sure the priorities adjust right
8 - Make sure you test with the 'del' option and the adjustments still work.

Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4b38f5acd5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:28 +02:00
Owen Leonard df6768d616
Bug 40590: Prevent OPACAuthorIdentifiersAndInformation from showing empty list elements for unknown 024$2
This patch modifies the template which is used to display additional
author information if OPACAuthorIdentifiersAndInformation is displayed.
The change prevents an empty list item from appearing.

To test, apply the patch and go to system preferences in the staff
interface.

- Search for OPACAuthorIdentifiersAndInformation and make sure that
  "Identifiers (024$2$a)" is checked.
- Have a record with at least 2 persons (100, 700) linked to an
  authority record
  - One of those authority records should not have an 024 tag
  - The other authority record should have two 024 tags:
    - 024 $a someidyoumakeup $2orcid
    - 024 $a someidyoumakeup $2somethingelse
- Check the detail page in OPAC -> "Author information" tab
- Check the authority detail page in OPAC, under "Author information"
  in the right-hand column.

Before the patch, '$2somethingelse' is not "supported" and will create
the empty list element. After the patch there should be no empty list
item.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 43dfb04536)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:28 +02:00
Andrew Fuerste Henry ae5df2bc75
Bug 40647: Spell dictionary correctly
To test:
1 - go to reports home
2 - inspect Reports dictionary
3 - see that it has class rep_dictonary
4 - apply patch, reload page
5 - see that class is now rep_dictionary

Signed-off-by:  Anneli Österman <anneli.osterman@koha-suomi.fi>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ea98862fa9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:27 +02:00
Lucas Gass 2cb92275a1
Bug 40296: Fix failing Returns.t test
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eab5aa774c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:27 +02:00
Paul Derscheid 6ec782810f
Bug 40296: (QA follow-up) Increment test count to include Test::NoWarnings
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fdd089a3ba)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:26 +02:00
Martin Renvoize cdb4e0dd30
Bug 40296: Add unit tests for booking status handling
This patch adds test coverage for the new booking status management
in AddIssue:

Test scenarios covered:
- Patron checking out their own booked item (marks as completed)
- Different patron checking out booked item during actual booking period
  (cancels booking)
- Checkout conflicts only during lead period (preserves booking, respects
  librarian decision)
- Checkout period encompassing entire booking period (cancels booking)
- No booking present (normal operation)

Tests ensure proper booking lifecycle management and validate that
librarian override scenarios work as intended.

To test:
1. Apply all patches
2. Run: prove t/db_dependent/Circulation.t
3. Verify all booking status handling scenarios pass

The test plans now provide:
- Step-by-step instructions for manual testing
- Multiple scenarios covering different use cases
- Clear expectations for what should happen in each case
- Practical workflow that staff would actually follow
- Edge cases like lead period conflicts and overrides

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0a2b541321)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:26 +02:00
Martin Renvoize dcd3bdbf28
Bug 40296: (follow-up) Fix booking patron ownership and cancellation logic
This follow-up addresses critical issues in the initial implementation:

1. **Patron Ownership Check**: Only mark bookings as 'completed' when
   the patron checking out the item is the same patron who made the booking

2. **Smart Cancellation**: When another patron checks out an item that
   conflicts with an existing booking:
   - Cancel the booking only if checkout overlaps with actual booking period
   - Respect lead/trail periods - don't cancel if conflict is only during
     preparation periods (allows librarian override scenarios)

3. **Date Logic**: Proper overlap detection using start_date and end_date
   rather than periods extended by lead time

This prevents incorrect booking completion and handles librarian override
scenarios appropriately.

Test plan:
1. Apply previous patch and this follow-up
2. Enable bookings and create a bookable item

Test A - Patron's own booking completion:
3. Create booking for Patron A: start = today, end = +7 days
4. Check out item to Patron A (due date = +5 days)
5. Verify booking status = 'completed'

Test B - Lead period override scenario:
11. Return item, set bookings_lead_period circulation rule = 3 days
12. Create booking for Patron A: start = +5 days, end = +8 days
13. Check out item to Patron B (due date = +4 days) - conflicts with lead period
14. Override the booking conflict warning
15. Verify Patron A's booking status remains 'new' (not cancelled)
16. This respects librarian's decision that item will return in time

Test C - No booking scenario:
17. Return item, ensure no active bookings exist
18. Check out item to any patron
19. Verify checkout works normally without errors

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2f849fd79c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:26 +02:00
Lucas Gass aeb8648326
Bug 40296: Mark booking as completed when issuing to booking patron
This patch adds logic to automatically mark a patron's booking as
'completed' when they check out the item they have booked.

When AddIssue is called, the system now:
- Checks if there's a conflicting booking for the checkout period
- Marks the booking status as 'completed' if found

This ensures booking status accurately reflects when items are
actually checked out to fulfill bookings.

Test plan:
1. Enable bookings system preference
2. Create a bookable item (set bookable = 1 in items table or via item editor)
3. Create a booking for a patron for that item with start date = today,
   end date = 7 days from now
4. Go to circulation and check out the item to the same patron who made
   the booking
5. Check the booking status in the database or via the bookings interface
6. Verify the booking status has changed from 'new' to 'completed'
7. Confirm the checkout was successful and shows normally in patron's
   checkouts list

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a8fd9734c6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-26 20:37:21 +02:00
Nick Clemens 8eff6ac7fe
Bug 34127: (QA follow-up) Tidy
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ed1ce54918)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:41 +02:00
Arthur Suzuki fbb0967331
Bug 34127: add the "export to CSV link" for baskets which are closed or linked to a groups
Test :
 - create an acquisition basket
 - add at least one record
 - close the basket (the "export as CSV" link is present)
 - attach the basket to a basket group
 - check that the "export as CSV" link, next to "reopen the basket" is
 now gone.
 - apply patch and reload the page (may need reload plack, cache, etc...)
 - "export as CSV" link is now present even though the basket is
 closed and it is attached to a basket group.
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Dominique et Stephanie <stephanie.etallaz@univ-cotedazur.fr>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 174f243fd8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:40 +02:00
Emily Lamancusa 7be30834a2
Bug 36127: Adjust default HOLDPLACED and HOLD_CHANGED notices to use TT
To test:
1. Apply patch
2. reset_all (or start your testing environment in the first place)
3. Edit system preferences:
     emailLibrarianWhenHoldIsPlaced - Enable
     ReplyToDefault - enter a fake/test email address
     ExpireReservesMaxPickupDelay - Allow
     ExpireReservesAutoFill - Do
     ExpireReservesAutoFillEmail - same email address as ReplyToDefault
4. Place two holds on the same bib for two different patrons, Patron A
   and Patron B
5. Edit an item on that bib to set a call number (if it doesn't have one
   already)
6. Check in that item to set Patron A's hold to waiting
7. Edit the expiration date on Patron A's hold to yesterday's date
   To do this in KTD:
     ktd --shell
     koha-mysql kohadev
     UPDATE reserves SET expirationdate = <yesterday's date>
     WHERE borrowernumber = <Patron A's borrowernumber>;
8. Run misc/cronjobs/holds/cancel_expired_holds.pl to automatically
   cancel the expired hold and fill the next one
9. Open koha-mysql again and run the following query to view the
   generated notices:
   SELECT subject, content FROM message_queue
   WHERE to_address = '<the email address you set in step 3>';
--> Confirm that HOLDPLACED and HOLD_CHANGED notices were both generated
--> Confirm that all information has been filled in correctly for those
    notices

Signed-off-by: Marion Durand <marion.durand@biblibre.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f869d42807)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:39 +02:00
Matt Blenkinsop 6af70de8ec
Bug 37115: Add unit tests
prove t/db_dependent/Koha/Item.t
prove t/db_dependent/Koha/BackgroundJobs/BatchDeleteItem.t

Signed-off-by: Boubacar OUATTARA <boubacar.ouattara@biblibre.com>
Signed-off-by: Nathalie <nathalie.savarit@univ-amu.fr>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 66d10246a3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:39 +02:00
Matt Blenkinsop e766667c91
Bug 37115: Batch delete linked serials
Test plan:
- Add a new subscription to a serial record (with the option 'create an item record' selected)
- Receive several issues and create the linked items
- Return to the bibliographic record
- Select several items
- Click to 'Delete selected items'
- Tick the box 'delete serial issues linked to items' and confirm
- The items should be deleted correctly
- Back to subscription : the issues linked to items should no longer exist

Signed-off-by: Boubacar OUATTARA <boubacar.ouattara@biblibre.com>
Signed-off-by: Nathalie <nathalie.savarit@univ-amu.fr>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 69b1d07d76)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:39 +02:00
Matt Blenkinsop 88304db54b
Bug 37115: Delete linked serial when deleting a single item
Test plan:
- Add a new subscription to a serial notice (with the option 'create an item record' selected)
- Receive one issue and create the linked item
- Return to the bibliographic record
- Edit item - Action - Delete
- Tick the box 'delete serial issues linked to item' and confirm
- The item should still be deleted correctly
- Back to subscription : the issue linked to the item doesn't exist any more

Signed-off-by: Boubacar OUATTARA <boubacar.ouattara@biblibre.com>
Signed-off-by: Nathalie <nathalie.savarit@univ-amu.fr>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4260c84cde)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:38 +02:00
Nick Clemens b13602054f
Bug 39917: (QA follow-up) Correct spelling and remove <p> tag around form
QA tools complained

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d2f007320a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:38 +02:00
Pedro Amorim 45cde551d9
Bug 39917: (QA follow-up): Fix xt/find-missing-filters.t
prove xt/find-missing-filters.t

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 91dd2049f3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:37 +02:00
Pedro Amorim 316b1d37b8
Bug 39917: Add new optional 'mark_completed' ILL screen
This new 'Mark completed' screen only shows when ILL_STATUS_ALIAS is not empty, i.e. Koha installations that are not using ILL_STATUS_ALIAS will not see any change in their workflow.
Backends that don't implement 'mark_completed' are inherently already making use of core 'mark_completed' and will automatically adopt this enhancement.
Backends that do implement their own mark_completed don't automatically adopt this enhancement and will not see any change in their workflow.

Test plan:
1) Enable ILLModule sys pref
2) Create a new ILL request:
   <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=Standard
3) Add a type, cardnumber and library. Click 'Create'.
4) You should now be on the manage request screen. Click 'Confirm' and 'Confirm request'.
5) You should be on the manage request screen again. Click 'Mark completed'. The request's status became 'Completed'.
6) Add at least one AV entry to ILL_STATUS_ALIAS av category, visit:
   <staff_url>/cgi-bin/koha/admin/authorised_values.pl?op=add_form&category=ILL_STATUS_ALIAS
7) Add 'abc_code' to 'Authorized value' and 'abc_description' to 'Description'. Click 'Save'.
8) Repeat steps 2 to 5. Notice that when you 'Mark completed' now, a new screen is shown prompting for a status_alias.
9) Pick a status_alias and save. Notice the 'status' now shows the alias.

Sponsored-by: NHS England
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bb790bea23)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:37 +02:00
Pedro Amorim 7d01add921
Bug 39917: Add tests
prove t/db_dependent/Koha/ILL/Requests.t

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 10fdcf23ee)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:36 +02:00
Pedro Amorim 78b4c764e2
Bug 40026: (QA follow-up): Only compare string if defined
prove /kohadevbox/koha/t/db_dependent/Koha/ILL/Requests.t

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cb074686b8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:36 +02:00
Pedro Amorim 45fe7bdc9b
Bug 40026: 'Cancel' edit item metadata returns to request, not table view
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3449cb8eee)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:35 +02:00
Pedro Amorim 1ea5ece70f
Bug 40026: Update edit item metadata screen header
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6b8b964ae7)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:35 +02:00
Pedro Amorim b88aed78a7
Bug 40026: Edit item metadata should present Standard form if AutoILLBackendPriority is in use
When the AutoILLBackendPriority system preference is enabled, the form that was used is always the Standard form, regardless of which backend the request ends up on.
It only makes sense that when editing an ILL request's item metadata, the form shown is also the Standard form if AutoILLBackendPriority is in use.

Test plan, k-t-d, don't apply patch:
1) Enable ILLModule
2) Install an external backend, e.g. the libkey lending tool (IncDocs) backend plugin:
   https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.0.3
3) Restart plack
   $ koha-plack --restart kohadev
4) Create a new IncDocs ILL request:
   <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=IncDocs
5) Add a DOI '123', a cardnumber '42' and any library. Click 'Make request'.
6) Enable AutoILLBackendPriority system preference by ticking 'IncDocs'. This is only done now to simplify the test plan, as creating an 'IncDocs' request using AutoILLBackendPriority requires credentials configuration.
7) Back on the 'Manage request' page for the request created in step 5, click 'Edit item metadata'. Notice the form shown is not the 'Standard' form (its the IncDocs one). Edit any of the metadata values, click 'Save'. Verify the new metadata is saved correctly.
8) Apply patch. Repeat 7). Notice the form shown is the 'Standard' form  now. Edit any of the metadata values, click "Save". Verify the new medata is saved correctly.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ed3b233f63)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:35 +02:00
Pedro Amorim d165bfd019
Bug 40075: Only show pickup_location libraries in OPAC
And list alphabetically on branchname

Signed-off by: Chris Rowlands <chris.rowlands6@nhs.net>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9657c19608)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:34 +02:00
Pedro Amorim 946a0625b9
Bug 40075: Only show pickup_location libraries
And list alphabetically on branchname

Signed-off by: Chris Rowlands <chris.rowlands6@nhs.net>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8698c8f7c5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:34 +02:00
Janusz Kaczmarek 3a22c2efb2
Bug 40156: Advanced editor should not create empty fields and subfields
Currently, advanced bibliographic records editor creates empty
subfields (or even empty fields) when no content is placed after
‡<code> (or, in case of control fields, after <tag>).

Test plan:
==========
1. Enable EnableAdvancedCatalogingEditor (have StripWhitespaceChars
   set to "Don't strip" - the default setting).
2. Open a record in the advanced editor, create empty subfield and
   empty fields, e.g.:

007
500 _ _ ‡a
246 3 1 ‡aAdditional title :‡b

3. Save the record. Go to bibliographic record Normal view and in
   modal "MARC preview" notice that the fields / subfields you entered as
   empty exist in the record with no data. This is wrong.
4. Apply the patch ; restart_all.
5. Repeat p. 2 and 3. Note that empty fields/subfields have not been
   created.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Wojciech Baran <wojciech.baran@ignatianum.edu.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d56b15d29c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:33 +02:00
Janusz Kaczmarek cd788e34ed
Bug 40540: OPAC generates warnings in logs when no results are found
When no results are found, a warning:

[WARN] Argument "" isn't numeric in numeric gt (>) at /kohadevbox/koha/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt line 76.

is generated in [plack-]opac-error.log

Test plan:
==========
1. In OPAC, perform a search for a random string of characters to get no
   results.
2. Check plack-opac-error.log. You should see a warning as above.
3. Apply the patch ; restart_all.
4. Repeat the search. Check the log -- there should be no new warning.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ee7fa9f3f6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:33 +02:00