Commit Graph

3050 Commits

Author SHA1 Message Date
Jesse Maseto fecd3d02f0
Update release notes for 24.05.16 release
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-12-04 19:22:07 +01:00
Jesse Maseto 1248f17d82
generate release notes for 24.05.15
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-10-29 15:13:58 -04:00
Jesse Maseto 6cea33acd6
generate release notes for 24.05.15
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-10-29 15:13:56 -04:00
Paul Derscheid 6ad5eeefea
Update release notes for 24.05.14 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-30 18:22:51 +02:00
Jake Deery 78b0a04d6a
Bug 40748: [24.05.x] Fix RCE in update_social_data.pl
This patch fixes an identified RCE in the update_social_data.pl
social_data, which when executed, allows an attacker to run arbitrary
code on the system's shell.

TO TEST:

a)  In the Babeltheque_url_update syspref, wrap any bash in $(), and then
run the update_social_data.pl script.
    *)  For example, $(whoami >
/tmp/rce.log) will output to a file the username the perl script is
running as.
APPLY PATCH
b)  Run the update_social_data.pl script again. The string is now
meta-escaped, and the RCE no longer works.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 40748: Check for HTTP URLs and skip shell when using system()

This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-30 18:22:46 +02:00
Jesse Maseto 193efe1142
Update release notes for 24.05.13 release
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-08-28 12:02:41 -04:00
Jesse Maseto 111f2d2031
Update release notes for 24.05.12 release
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-07-24 10:05:06 -04:00
Martin Renvoize 2e115a41b1
Bug 39887: Improve documentation for overdue_notices.pl
This patch corrects a few spelling mistakes and missing grammer and adds
a little more detail to the '--date', '--email' and '--frombranch'
options.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>

	modified:   misc/cronjobs/overdue_notices.pl
2025-07-07 13:12:51 -04:00
Jesse Maseto d8893bca20
Update release notes for 24.05.11 release
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>

	new file:   misc/release_notes/release_notes_24_05_11-1.html
	new file:   misc/release_notes/release_notes_24_05_11.md

Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
2025-06-24 13:18:41 -04:00
Paul Derscheid 0487fc3499
Update release notes for 24.05.10 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-05-26 22:31:36 +02:00
Wainui Witika-Park 58302e1092 Update release notes for 24.05.09 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2025-04-24 17:06:15 +12:00
Alex Buckley 44f39493b8 Update release notes for 24.05.08 release
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
2025-03-24 08:30:40 +00:00
Nick Clemens 921c4a43b5 Bug 38382: Fresh connection when connexion CSRF token expires
This patch simply generates a new user agent when reauthenticating when the CSRF token
for the session has expired.

To test:
1 - Edit Koha/Token.pm, line 275
from:    { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS * 3600 ) },
to:      { MaxAge => $params->{MaxAge} // ( CSRF_EXPIRY_HOURS ) },
2 - This will make your CSRF tokens expire after 8 seconds
3 - vim /etc/koha/sites/kohadev/connexion.cnf
4 - Set content:
    host:
    port: 8888
    koha:http://localhost:8081
    log:/var/log/koha/kohadev/connexion.log
    match:ISBN
    user:kohauser
    password:kohapass
    overlay_action:replace
    nomatch_action:create_new
    item_action:always_add
    import_mode:direct
    framework:BKS
    overlay_framework:
    debug:1
5 - Save the sample file from this bug into your kohaclone (or copy and paste into a file your koha test site can reach)
6 - On the command line:
    perl misc/bin/connexion_import_daemon.pl -c /etc/koha/sites/kohadev/connexion.cnf
7 - In another terminal:
    cat bug_33418.test  | nc -v localhost 8888
8 - Successful request
9 - Wait 10 seconds (more than 8 anyways)
10 - Repeat 7
11 - Unsuccessful request - Invalid CSRF token
12 - Ctrl+C to stop the connexion daemon
13 - Apply patch
14 - repeat 6
15 - repeat 7, success
16 - Wait more than 8 seconds
17 - repeat 7, success!
18 - repeat again until you are satisfied
19 - Sign off!

WNC amended and tidied

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e758492d99)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
2025-03-20 00:42:42 +00:00
Alex Buckley faf18a689e Add number of security bugs to the 24.05.07 release notes
Also fix lists in the 24.05.07 HTML release note file.

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
2025-02-26 20:04:32 +00:00
Alex Buckley 398c94836b Update release notes for 24.05.07 release
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
2025-02-26 19:32:21 +00:00
Wainui Witika-Park c555b06ae4 Update release notes for 24.05.06 release
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
2025-01-06 18:39:43 +13:00
Alex Buckley 987c61364f Revert "Bug 37478: Add strict mode to bulkmarcimport"
This reverts commit 49fef9bee9.
2024-12-27 09:29:55 +13:00
Alex Buckley 021257fe2e Revert "Bug 37478: Rename strict to skip_bad_records and add POD"
This reverts commit b3dd152c5e.
2024-12-27 09:29:33 +13:00
Jan Kissig 9d9027cb41 Bug 23426: (follow-up) Enhance sip_cli_emulator.pl for test plan
This follow up enhances the sip_cli_emulator.pl to use start-item and/or end-item as params. With these new params the original test plan can be extended:

Test plan:
a) create several manual invoices for patron 23529000035676 : http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=19
b) run
     perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1   -l CPL --patron 23529000035676 -m patron_information -s "   Y      " --start-item=1 --end-item=2
   to get fine 1 and 2 or
     perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1   -l CPL --patron 23529000035676 -m patron_information -s "   Y      " --start-item=3 --end-item=3
   to retrieve fine 3

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cfb841f9e6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-12-05 22:50:42 +00:00
Nick Clemens 3f2af68a05 Bug 37790: Add skip indexing and holds queue options and verbosity to update localuse script
This patch skips record indexing and real time holds queue updates when updating the localuse field
from statistics. A note is added to the script that the user should reindex if the localuse field is mapped.

Additionally a verbose option is added to the script, and doubled use of GetOptions is removed.

Lastly, a check is added to confirm the items value is being changed before the value is stored.

To test:
 1 - Enable the real time holds queue
 2 - Enable Elasticsearch
 3 - perl misc/maintenance/update_localuse_from_statistics.pl --confirm
 4 - Note all items are touched and reported
 5 - Check the background jobs table - there are many jobs generated
 6 - Apply patch
 7 - perl misc/maintenance/update_localuse_from_statistics.pl --confirm
 8 - Note 0 items are reported updated, no new background jobs
 9 - perl misc/maintenance/update_localuse_from_statistics.pl --confirm --verbose
10 - No items reported
11 - Update some items in the DB
     UPDATE items SET localuse = 99 WHERE itemnumber LIKE '%9';
12 - perl misc/maintenance/update_localuse_from_statistics.pl --confirm
13 - Only the number of items changed above reported
14 - UPDATE items SET localuse = 99 WHERE itemnumber LIKE '%9';
15 - perl misc/maintenance/update_localuse_from_statistics.pl --confirm --verbose
16 - Each item changed reported, and the amounts, and the total items updated.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1ba5e028cb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-12-05 22:41:21 +00:00
Nick Clemens b3dd152c5e Bug 37478: Rename strict to skip_bad_records and add POD
Option name changed, POD updated.
The reason not to do this by default is that it is an extra record conversion
to check the validity, so may slow down the import.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cfb72ca7fa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-12-05 22:06:17 +00:00
Nick Clemens 49fef9bee9 Bug 37478: Add strict mode to bulkmarcimport
This patch adds a conversion from MARC -> XML -> MARC to catch any parsing errors.
If errors are found, we then lint the record to catch any problems, output the
warnings, and skip the record.

To test:
1 - Download the sample records from this bug report
2 - perl misc/migration_tools/bulkmarcimport.pl -b --file=520_nosubfield.mrc -v
    fails!
3 - perl misc/migration_tools/bulkmarcimport.pl -b --file=003_subfielda.mrc -v
    fails!
4 - Apply patch
5 - Repeat 2 & 3 - no change
6 - Add -st switch to the commands:
    perl misc/migration_tools/bulkmarcimport.pl -b --file=520_nosubfield.mrc -v -st
    perl misc/migration_tools/bulkmarcimport.pl -b --file=003_subfielda.mrc -v -st
7 - The records are now skipped, and the script completes
8 - Confirm the warnings generated are useful
9 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0306281e41)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-12-05 22:06:17 +00:00
Nick Clemens f7402371c0 Bug 37550: Move item check after error handling
To test:
1 - Grab the sample file on this bug report
2 - perl misc/migration_tools/bulkmarcimport.pl -b --file=spaceditems.pl -v
3 - An exception for 'Duplicate ID' is thrown and script dies
4 - Apply patch
5 - run script again
6 - The script finishes, no items are added, but record is

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5e15ede505)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-12-05 21:50:38 +00:00
Jonathan Druart 82ecc318f9 Bug 38085: Pick multiple_sortable options for translation
Bug 29948 added a "multiple_sortable" type for sysprefs, to have the
options sortable. But the options were not picked for translation.

This patch fixes it.

Test plan:
Run `cd misc/translator && perl translate update LANG` before and after
this patch. Notice that with this patch you see the different options of
OPACAuthorIdentifiersAndInformation in the LANG-pref.po file (eg.
"Associated group (373$a$s$t$u$v$0)")
Translate the options
Install the translated version of the templates and confirm that the
strings appear translated on the interface.

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 738c641bcc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 23:30:45 +00:00
Nick Clemens 6264f861a3 Bug 38237: Add POD
This patch adds POD to the script and rpelaces the custom help script with pod2usage

TO test:
perl misc/cronjobs/erm_run_harvester.pl
Confirm you get helpful usage data

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0ff61ab9d9)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 18:41:50 +00:00
Nick Clemens 3bdb9a9624 Bug 38237: Add logging to erm_run_harvester cronjob
This patch simply adds logging to the cronjob

To test:
1 - Enable CronjobLog
    http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=CronjobLog
2 - Enable ERMModule
    http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ERMModule
3 - Home -> E-resource Management -> Data providers -> New data provider
    Fill from registry or create your own, but change the URL and put in any required numbers
    We don't need a real test, just to run the ob
4 - perl misc/cronjobs/erm_run_harvester.pl --begin-date 2024-01-01 --dry-run --debug
5 - View the logs, no log of the script
6 - Apply patches
7 - Run the job again
8 - Check logs
9 - Success!

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6ce5df7f8e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 18:41:50 +00:00
Magnus Enger 193f5676bf Bug 37787: Remove mention of elastic_index from POD
After the introduction of misc/workers/es_indexer_daemon.pl,
misc/workers/background_jobs_worker.pl should not handle the
elastic_index queue. But the latter script still mentions this
queue in the POD. This patch removes that mention.

To test:
- Run perldoc misc/workers/background_jobs_worker.pl
- Verify "elastic_index" is mentioned under --queue
- Apply this patch
- Run perldoc again and verify the mention of "elastic_index"
  is gone

Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 476ae27df0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 18:32:53 +00:00
Matthias Meusburger 0acc0dffb1 Bug 18273: Do not insert authority if there already are duplicates in koha
Test plan:

1) Create an authority with a unique value in a searchable field, for instance a PERSO_NAME authority with 'BZ18273' in the 100$a field.

2) Create a second authority with the same value in the same field.

3) Export this second authority as iso2709 (Save -> MARC (Unicode/UTF-8))

4) Run bulkmarcimport.pl with the following parameters:
perl bulkmarcimport.pl -a --file=/kohadevbox/koha/auth-xxxx.utf8 --match='Heading,100$a' -l /kohadevbox/koha/bulk.log

5) Check in the log file and/or through search that a third authority has been added (despite using the --match option)

6) Apply the patch

7) Delete the 3 authorities and repeat step 1 to 4.

8) Check that a third authority has not been added (--match worked)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2e2fba91bf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 17:54:43 +00:00
Thomas Klausner ca526d63c7 Bug 35466: (follow-up) document skip_indexing parameter to bulkmarciport.pl
Add documentation for the new -si, --skip_indexing parameter

Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e200988cb8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 14:47:19 +00:00
Nick Clemens 9266f2b63f Bug 35466: (follow-up) Go to next if error, add to indexing call if not
Before the previous patch we were indexing with every AddAuthority/ModAuthority call and I assumed
we were also indexing during the commity, however, it appears we were not. This patch ensures we push
the record and ids into the arrays for indexing during commit.

Additionally I add a skip to next record on error, to match biblio behaviour.
I also correct a log referring to biblios during authority importing

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f522fbff32)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 14:47:19 +00:00
Nick Clemens 76c1387263 Bug 35466: Add skip_indexing parameter to bulkmarcimport.pl
This patch adds a new optoin to skip indexing to bulkmarcimport.
It also fixes a bug where authorities were being indexed multiple times
during import.

To test:
 1 - Apply patch
 2 - Download the sample files on this bug
 3 - Perform asearch engine search that should retrieve all records( 'a' in Zebra, '*' in ES)
 4 - Note the total (435 in KTD)
 5 - perl misc/migration_tools/bulkmarcimport.pl -b -v --file=bug_35466_b.mrc
 6 - Search again, note increaed by 100
 7 - perl misc/migration_tools/bulkmarcimport.pl -b -v --file=bug_35466_b.mrc --skip_indexing
 8 - Search again, no increase
 9 - perl misc/search_tools/rebuild_elasticsearch.pl -v
10 - Search again, increase, records were added but not initially indexed
11 - Browse to authorities and search as for biblios
12 - perl misc/migration_tools/bulkmarcimport.pl -a -v --file=bug_35466_a.mrc
13 - Search again, note increase
14 - perl misc/migration_tools/bulkmarcimport.pl -a -v --file=bug_35466_a.mrc --skip_indexing
15 - Search again, no increase
16 - perl misc/search_tools/rebuild_elasticsearch.pl -v
17 - Search again, increase, records were added but not initially indexed
18 - Sign off! Hi5!

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e01fb16455)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-20 14:47:18 +00:00
Nick Clemens c41dacb551 Bug 37709: Die and notify if file cannot be opened
1 - perl misc/migration_tools/bulkmarcimport.pl -b --file=notafile.mrc -v
2 - Output:
    Characteristic MARC flavour: MARC21

    0 MARC records done in 0.00804400444030762 seconds
3 - Apply patch
4 - perl misc/migration_tools/bulkmarcimport.pl -b --file=notafile.mrc -v
5 - Output:
    Characteristic MARC flavour: MARC21
    Could not open notafile.mrc: No such file or directory at misc/migration_tools/bulkmarcimport.pl line 262.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0546217cdc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 22:52:49 +00:00
Fridolin Somers f054a8f4d5 Bug 35442: Script migration_tools/build_oai_sets.pl add ORDER BY
Script migration_tools/build_oai_sets.pl is missing ORDER BY
biblionumber.
This is a problem when using OFFSET and LIMIT, the results may be
differenly orderder between two calls of this script.

Test plan :
1) Create a OAI SET with all records
2) Run migration_tools/build_oai_sets.pl with the first half of records
3) Run migration_tools/build_oai_sets.pl with the second half of records
4) Check all records are in the OAI set

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 996c9d9fdc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 22:17:47 +00:00
Janusz Kaczmarek 23660524f2 Bug 37271: Recall status should be 'requested' in overdue_recalls.pl
In "Bug 19532: Make recalls.status an ENUM" one-letter statuses were
replaced by their verbal equivalents.  But in overdue_recalls.pl
remained "R".  As a result, recalls never overdue.

No test plan provided--obvious correction.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 771db8c399)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 18:11:58 +00:00
Tomas Cohen Arazi cc8f03cf2b Bug 36901: Add logging for uncaught exceptions in background job classes
This patch adds logging of unhandled exceptions that could occur. This
is happening on busy production sites right now. This is also useful for
plugin jobs that might not be 100% following the guidelines and would
benefit from this.

But as the [DO NOT PUSH] patch highlights, this is something we really
want to have on our current codebase, as a database connection drop
might make us reach that `catch` block we are adding logging to on this
patch.

To test:
1. Apply the [DO NOT PUSH] patch
2. Run:
   $ ktd --shell
  k$ restart_all ; tail -f /var/log/koha/kohadev/worker*.log
3. Pick a valid barcode on the staff UI
4. Use the 'Batch delete items' tool in the cataloguing section
5. Start the job for deleting the item
=> FAIL: The item got deleted, but the job marked as failed and no logs
about the reasons
6. Apply this patch and repeat 2-5
=> SUCCESS: Same scenario but there's a log with the error message
7. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b54c854d24)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 17:18:00 +00:00
David Cook fc50580c29 Bug 32575: Add an empty text body to fix multipart/mixed handling
By adding an empty text body, we force Email::Stuffer/Email::MIME
to use multipart/mixed handling for the attachment instead of forcing
a single part (ie direct attachment) email, which is not consistently
handled by different email clients.

An empty text body is language-neutral (ie not imposing English),
and it allows SMTP servers to inject organisational footers into
the email (e.g. confidentiality notices).

Signed-off-by: Magnus Enger <magnus@libriotech.no>
I have tested this solution in production, and it works for me.

Bug 32575: Tidy patch

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3e1d8b0628)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 17:10:34 +00:00
Kyle M Hall fc09b18ea2 Bug 37075: Message queue processor will fail to send any message unless letter_code is passed
For reasons unknown, GetOptions is inserting an empty string into the letter_code list. If you are running the script with a letter code filter, the empty string is added to the OR so it functions. If no letter_code is passed, the search requires the letter code to be an empty string, which will of course fail. Even more perplexing is that this does not happen for the type list which is essentially identical code.

Test Plan:
1) Generate some messages in the message queue
2) Run `process_message_queue.pl -v -c`
3) Note nothing happens
4) Apply this patch
5) Repeat step 2
6) Messages are sent!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a6eab64e53)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-18 16:26:17 +00:00
Wainui Witika-Park 4bb4a27fcb Bug 31143: (follow-up) Add description to fix_invalid_dates.pl
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 769b394292)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:01:44 +00:00
Nick Clemens c90b470c3e Bug 31143: (QA follow-up) Tidy
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a900e9307b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:00:29 +00:00
Nick Clemens 698056d183 Bug 31143: (QA follow-up) move script to maintenance
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b598154fbf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:00:29 +00:00
wainuiwitikapark 0abf2ede21 Bug 31143: Fix/identify all cases where '0000-00-00' may still remain in the database
This patch identifies date fields in the database (timestamp, datetime, date) that are 0000-00-00 and sets them to NULL

Test plan -

Examples of setting up some 0000-00-00 date fields:

e.g. Borrowers table
update borrowers set dateexpiry="0000-00-00" where borrowernumber=49;

e.g. Items table
update items set datelastseen="0000-00-00" where itemnumber=12;

To identify the cases:
1) Set up some 0000-00-00 date fields
2) Run the misc/maintenance/search_for_data_inconsistencies.pl script
3) Run fix_invalid_dates.pl -v

To fix the cases:
1) Run fix_invalid_dates.pl -c -v
2) Notice the value has changed from 0000-00-00 to NULL

e.g. Borrowers table
select dateexpiry from borrowers where borrowernumber=49;

e.g. Items table
select datelastseen from items where itemnumber=12;

Signed-off-by: Shi Yao Wang <shi-yao.wang@inlibro.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d4bfae0977)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:00:29 +00:00
Lucas Gass 2896429708 Generate release notes for 24.05.05 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-07 23:15:54 +00:00
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-07 23:02:54 +00:00
Tomas Cohen Arazi 3c84a93e36 Bug 38164: Skip fuzzy translations
This patch was envisioned by Julian Maurice.

Test plan:
0. Apply the 1st patch (the revert)
1. Go to `misc/translator/po`
2. es-ES-messages-js.po
3. Mark "Edit" string as fuzzy (around line 48). It should look like:

```
msgid "Edit"
msgstr "Editar"
```

4. Edit ./intranet-main.tt and add the following lines at the bottom,
   inside the `$(document).ready` block:

```javascript
  console.log(_("Edit"));
  console.log(__("Edit"));
```

5. Install the templates
  k$ koha-translate --install es-ES --dev kohadev && restart_all
6. Enable *es-ES* by searching for `language` in the sysprefs and switch
   to it for the staff interface.
7. Go to the Koha home page, open the browser console
=> FAIL: Notice that the second log in the console is displaying the
fuzzy string (i.e. is being translated when it shouldn't)
8. Apply this patch
9. Re-install the translated templates:
  k$ koha-translate --update es-ES --dev kohadev && restart_all
10. Repeat 7
=> SUCCESS: With this patch applied both logs show the English version of the
string.
11. Remove the fuzzy flag on `es-ES-messages-js.po`
12. Repeat 9 and 10
=> SUCCESS: The results are similar to step 7, but in this case they are
expected as the string is not marked fuzzy.
13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5102f708a5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:51:09 +00:00
Tomas Cohen Arazi cfafd7bc2a Bug 38164: Revert "Bug 37303: Replace po2json with a JS version"
This reverts commit 4eb9816354.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b285fd57c8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:51:09 +00:00
Lucas Gass 475cd151c3 Generate release notes for 24.05.04 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-02 14:54:10 +00:00
Nick Clemens ae84680c4d Bug 37775: Spelling and tidy
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d785fb1c1e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-24 15:25:26 +00:00
Nick Clemens 8fd510cc56 Bug 37775: Remove delayed commits from update_totalissues.pl and add progress option
This patch removes setting AutoCommit to 0 and commiting only every X records.
Instead we commit as we go and report progress using a parameter.

Bug 36474 reduced the numebr of changes that are being committed, so this should be a reasonable change. The
use of commits without transactions was causing problems if the library was active while the script ran.

To test:
1 - perl misc/cronjobs/update_totalissues.pl -c
2 - Script runs, but with unknown parameter
3 - perl misc/cronjobs/update_totalissues.pl -p 10
4 - Script runs and reports every 10 records
5 - per; misc/cronjobs/update_totalissues.pl
6 - Script runs and reports every 100 records by default

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit dba9dd4053)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-24 15:25:26 +00:00
Nick Clemens a40b6d538d Bug 36474: Don't update records when total issues has not changed
This patch adds a new check in UpdateTotalIssues to check that we are changing the number
of total issues before calling ModBiblio

To test:
0 - Enable CataloguingLog
1 - Checkout an item
2 - Run : misc/cronjobs/update_totalissues.pl --use-stats --commit=1000 -v
3 - In report, note all biblios were updated
4 - Check action_logs - note a new entry for every biblio
5 - Apply patch
6 - Repeat
7 - Note no biblios reported updated
8 - Note no new cataloguing log entries
9 - Checkout the item again
10 - Run again
11 - Note biblionumber has updated count in verbose output
12 - Note report only rpeort 1 biblio modified, the rest only processed
13 - Only one line added to action_logs
14 - Run it again
15 - Confirm no updates

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d7b36d7f69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-24 15:22:52 +00:00
David Cook b2fcb1a875 Bug 37553: Tidy to make QA tools happy
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1a747ddcb7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 15:51:31 +00:00