From 6c303f3c1cdc3a9fd6b133716bcd11440f839f8b Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Wed, 27 Mar 2024 01:03:49 +0000
Subject: [PATCH 01/56] Bug 34893: [22.05] (follow-up) change number of tests

---
 t/db_dependent/ILSDI_Services.t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/t/db_dependent/ILSDI_Services.t b/t/db_dependent/ILSDI_Services.t
index cf0080b3cc..14580c4258 100755
--- a/t/db_dependent/ILSDI_Services.t
+++ b/t/db_dependent/ILSDI_Services.t
@@ -19,7 +19,7 @@ use Modern::Perl;
 
 use CGI qw ( -utf8 );
 
-use Test::More tests => 12;
+use Test::More tests => 13;
 use Test::MockModule;
 use t::lib::Mocks;
 use t::lib::TestBuilder;

From a4460bb5e08b0635683fe16e77c5e4e9a9648faa Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 5 Jan 2021 11:18:26 +0100
Subject: [PATCH 02/56] Bug 27342: Improve test for OPAC

We don't need to build allowed_scripts_for_private_opac for staff

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 C4/Auth.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 6ce57fe54f..2c34375f97 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -827,7 +827,7 @@ sub checkauth {
     my $template_name   = shift;
     $type = 'opac' unless $type;
 
-    unless ( C4::Context->preference("OpacPublic") ) {
+    if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
         my @allowed_scripts_for_private_opac = qw(
           opac-memberentry.tt
           opac-registration-email-sent.tt

From 25cd8e9239524f3d36820c8cbb42456376647038 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 5 Jan 2021 11:28:16 +0100
Subject: [PATCH 03/56] Bug 27342: Remove dbh from C4::Auth

We must not pass $dbh but retrieve it when needed instead

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 C4/Auth.pm                       | 33 ++++++++++++++++----------------
 C4/Auth_with_cas.pm              |  6 +++---
 C4/Auth_with_ldap.pm             |  4 ++--
 C4/SIP/ILS/Patron.pm             |  3 +--
 Koha/REST/V1/Auth.pm             |  3 +--
 Koha/REST/V1/Patrons/Password.pm |  3 +--
 opac/sco/sco-main.pl             |  3 +--
 t/db_dependent/Auth.t            | 23 +++++++++++-----------
 t/db_dependent/Auth_with_ldap.t  | 25 +++++++++++-------------
 t/db_dependent/Log.t             | 23 ++++++++++------------
 10 files changed, 57 insertions(+), 69 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 2c34375f97..1264ef8c1d 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -406,7 +406,6 @@ sub get_template_and_user {
                 # we add them to the logged-in search history
                 my @recentSearches = C4::Search::History::get_from_session( { cgi => $in->{'query'} } );
                 if (@recentSearches) {
-                    my $dbh   = C4::Context->dbh;
                     my $query = q{
                         INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, type,  total, time )
                         VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -840,7 +839,6 @@ sub checkauth {
           @allowed_scripts_for_private_opac;
     }
 
-    my $dbh     = C4::Context->dbh;
     my $timeout = _timeout_syspref();
 
     my $cookie_mgr = Koha::CookieManager->new;
@@ -1050,7 +1048,7 @@ sub checkauth {
                 my $retuserid;
 
                 # Do not pass password here, else shib will not be checked in checkpw.
-                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $q_userid, undef, $query );
+                ( $return, $cardnumber, $retuserid ) = checkpw( $q_userid, undef, $query );
                 $userid      = $retuserid;
                 $shibSuccess = $return;
                 $info{'invalidShibLogin'} = 1 unless ($return);
@@ -1061,7 +1059,7 @@ sub checkauth {
                 if ( $cas && $query->param('ticket') ) {
                     my $retuserid;
                     ( $return, $cardnumber, $retuserid, $cas_ticket ) =
-                      checkpw( $dbh, $userid, $password, $query, $type );
+                      checkpw( $userid, $password, $query, $type );
                     $userid = $retuserid;
                     $info{'invalidCasLogin'} = 1 unless ($return);
                 }
@@ -1130,7 +1128,7 @@ sub checkauth {
                     {
 
                         ( $return, $cardnumber, $retuserid, $cas_ticket ) =
-                          checkpw( $dbh, $q_userid, $password, $query, $type );
+                          checkpw( $q_userid, $password, $query, $type );
                         $userid = $retuserid if ($retuserid);
                         $info{'invalid_username_or_password'} = 1 unless ($return);
                     }
@@ -1180,6 +1178,7 @@ sub checkauth {
                     FROM borrowers
                     LEFT JOIN branches on borrowers.branchcode=branches.branchcode
                     ";
+                    my $dbh = C4::Context->dbh;
                     my $sth = $dbh->prepare("$select where userid=?");
                     $sth->execute($userid);
                     unless ( $sth->rows ) {
@@ -1544,7 +1543,6 @@ sub check_api_auth {
 
     my $query         = shift;
     my $flagsrequired = shift;
-    my $dbh     = C4::Context->dbh;
     my $timeout = _timeout_syspref();
 
     unless ( C4::Context->preference('Version') ) {
@@ -1597,7 +1595,7 @@ sub check_api_auth {
 
             # In case of a CAS authentication, we use the ticket instead of the password
             my $PT = $query->param('PT');
-            ( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $dbh, $PT, $query );    # EXTERNAL AUTH
+            ( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $PT, $query );    # EXTERNAL AUTH
         } else {
 
             # User / password auth
@@ -1607,7 +1605,7 @@ sub check_api_auth {
                 return ( "failed", undef, undef );
             }
             my $newuserid;
-            ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $dbh, $userid, $password, $query );
+            ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $userid, $password, $query );
         }
 
         if ( $return and haspermission( $userid, $flagsrequired ) ) {
@@ -1629,6 +1627,7 @@ sub check_api_auth {
                     $userflags,      $branchcode, $branchname,
                     $emailaddress
                 );
+                my $dbh = C4::Context->dbh;
                 my $sth =
                   $dbh->prepare(
 "select borrowernumber, firstname, surname, flags, borrowers.branchcode, branches.branchname as branchname, email from borrowers left join branches on borrowers.branchcode=branches.branchcode where userid=?"
@@ -1894,7 +1893,7 @@ sub get_session {
 # Currently it's only passed from C4::SIP::ILS::Patron::check_password, but
 # not having a userenv defined could cause a crash.
 sub checkpw {
-    my ( $dbh, $userid, $password, $query, $type, $no_set_userenv ) = @_;
+    my ( $userid, $password, $query, $type, $no_set_userenv ) = @_;
     $type = 'opac' unless $type;
 
     # Get shibboleth login attribute
@@ -1931,10 +1930,9 @@ sub checkpw {
 
         # In case of a CAS authentication, we use the ticket instead of the password
         my $ticket = $query->param('ticket');
-        $query->delete('ticket');                                         # remove ticket to come back to original URL
-        my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) =
-            checkpw_cas( $ticket, $query, $type );                        # EXTERNAL AUTH
-        if ($retval) {
+        $query->delete('ticket');                                   # remove ticket to come back to original URL
+        my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = checkpw_cas( $ticket, $query, $type );    # EXTERNAL AUTH
+        if ( $retval ) {
             @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket );
         } else {
             @return = (0);
@@ -1965,10 +1963,10 @@ sub checkpw {
     }
 
     # INTERNAL AUTH
-    if ($check_internal_as_fallback) {
-        @return = checkpw_internal( $dbh, $userid, $password, $no_set_userenv );
+    if ( $check_internal_as_fallback ) {
+        @return = checkpw_internal( $userid, $password, $no_set_userenv);
         push( @return, $patron );
-        $passwd_ok = 1 if $return[0] > 0;    # 1 or 2
+        $passwd_ok = 1 if $return[0] > 0; # 1 or 2
     }
 
     if ($patron) {
@@ -1993,11 +1991,12 @@ sub checkpw {
 }
 
 sub checkpw_internal {
-    my ( $dbh, $userid, $password, $no_set_userenv ) = @_;
+    my ( $userid, $password, $no_set_userenv ) = @_;
 
     $password = Encode::encode( 'UTF-8', $password )
       if Encode::is_utf8($password);
 
+    my $dbh = C4::Context->dbh;
     my $sth =
       $dbh->prepare(
         "select password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags from borrowers join branches on borrowers.branchcode=branches.branchcode where userid=?"
diff --git a/C4/Auth_with_cas.pm b/C4/Auth_with_cas.pm
index 753771cdee..c50e9c99dc 100644
--- a/C4/Auth_with_cas.pm
+++ b/C4/Auth_with_cas.pm
@@ -99,7 +99,7 @@ sub login_cas_url {
 # Checks for password correctness
 # In our case : is there a ticket, is it valid and does it match one of our users ?
 sub checkpw_cas {
-    my ($dbh, $ticket, $query, $type) = @_;
+    my ($ticket, $query, $type) = @_;
     my $retnumber;
     my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
 
@@ -117,7 +117,6 @@ sub checkpw_cas {
             # we should store the CAS ticekt too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
 
             # Does it match one of our users ?
-            my $dbh    = C4::Context->dbh;
             my $patron = Koha::Patrons->find( { userid => $userid } );
             if ($patron) {
                 return ( 1, $patron->cardnumber, $patron->userid, $ticket, $patron );
@@ -144,7 +143,7 @@ sub checkpw_cas {
 
 # Proxy CAS auth
 sub check_api_auth_cas {
-    my ($dbh, $PT, $query, $type) = @_;
+    my ($PT, $query, $type) = @_;
     my $retnumber;
     my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
 
@@ -161,6 +160,7 @@ sub check_api_auth_cas {
             # we should store the CAS ticket too, we need this for single logout https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#233-single-logout
 
             # Does it match one of our users ?
+            my $dbh = C4::Context->dbh;
             my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
             $sth->execute($userid);
             if ( $sth->rows ) {
diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm
index a7ffe5271b..3a4de52618 100644
--- a/C4/Auth_with_ldap.pm
+++ b/C4/Auth_with_ldap.pm
@@ -109,7 +109,7 @@ sub search_method {
 }
 
 sub checkpw_ldap {
-    my ($dbh, $userid, $password) = @_;
+    my ($userid, $password) = @_;
     my @hosts = split(',', $prefhost);
     my $db = Net::LDAP->new(\@hosts);
     unless ( $db ) {
@@ -356,7 +356,7 @@ sub _do_changepassword {
     #warn "changing local password for borrowernumber=$borrowerid to '$digest'\n";
     Koha::Patrons->find($borrowerid)->set_password({ password => $password, skip_validation => 1 });
 
-    my ($ok, $cardnum) = checkpw_internal(C4::Context->dbh, $userid, $password);
+    my ($ok, $cardnum) = checkpw_internal($userid, $password);
     return $cardnum if $ok;
 
     warn "Password mismatch after update to borrowernumber=$borrowerid";
diff --git a/C4/SIP/ILS/Patron.pm b/C4/SIP/ILS/Patron.pm
index fd8e92c617..e5542bfb2b 100644
--- a/C4/SIP/ILS/Patron.pm
+++ b/C4/SIP/ILS/Patron.pm
@@ -281,9 +281,8 @@ sub check_password {
     # If the record has a NULL password, accept '' as match
     return $pwd eq q{} unless $self->{password};
 
-    my $dbh = C4::Context->dbh;
     my $ret = 0;
-    ($ret) = checkpw( $dbh, $self->{userid}, $pwd, undef, undef, 1 ); # dbh, userid, query, type, no_set_userenv
+    ($ret) = checkpw( $self->{userid}, $pwd, undef, undef, 1 ); # userid, query, type, no_set_userenv
     return $ret;
 }
 
diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 182db518f6..7f99effbda 100644
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -486,8 +486,7 @@ sub _basic_auth {
     my $decoded_credentials = decode_base64( $credentials );
     my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );
 
-    my $dbh = C4::Context->dbh;
-    unless ( checkpw_internal($dbh, $user_id, $password ) ) {
+    unless ( checkpw_internal($user_id, $password ) ) {
         Koha::Exceptions::Authorization::Unauthorized->throw( error => 'Invalid password' );
     }
 
diff --git a/Koha/REST/V1/Patrons/Password.pm b/Koha/REST/V1/Patrons/Password.pm
index 35379edf18..96f259c381 100644
--- a/Koha/REST/V1/Patrons/Password.pm
+++ b/Koha/REST/V1/Patrons/Password.pm
@@ -119,8 +119,7 @@ sub set_public {
     }
 
     return try {
-        my $dbh = C4::Context->dbh;
-        unless ( checkpw_internal($dbh, $user->userid, $old_password ) ) {
+        unless ( checkpw_internal($user->userid, $old_password ) ) {
             return $c->render(
                 status  => 400,
                 openapi => { error => "Invalid password" }
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index a89f2538d6..ac89db749c 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -118,8 +118,7 @@ my $issuer   = Koha::Patrons->find( $issuerid )->unblessed;
 my $patronid = $jwt ? Koha::Token->new->decode_jwt({ token => $jwt }) : undef;
 unless ( $patronid ) {
     if ( C4::Context->preference('SelfCheckoutByLogin') ) {
-        my $dbh = C4::Context->dbh;
-        ( undef, $patronid ) = checkpw( $dbh, $patronlogin, $patronpw );
+        ( undef, $patronid ) = checkpw( $patronlogin, $patronpw );
     }
     else {    # People should not do that unless they know what they are doing!
               # SelfCheckAllowByIPRanges MUST be configured
diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index a7bc1c885e..ef9e445ad8 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -28,7 +28,6 @@ BEGIN {
 
 my $schema  = Koha::Database->schema;
 my $builder = t::lib::TestBuilder->new;
-my $dbh     = C4::Context->dbh;
 
 # FIXME: SessionStorage defaults to mysql, but it seems to break transaction
 # handling
@@ -411,14 +410,14 @@ subtest 'no_set_userenv parameter tests' => sub {
     t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
     $patron->set_password({ password => $password });
 
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
     is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
     C4::Context->_new_userenv('DUMMY SESSION');
     C4::Context->set_userenv(0,0,0,'firstname','surname', $library->branchcode, 'Library 1', 0, '', '');
     is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv gives correct branch' );
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
     is( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv branch is preserved if no_set_userenv is true' );
-    ok( checkpw( $dbh, $patron->userid, $password, undef, undef, 0 ), 'checkpw still returns true' );
+    ok( checkpw( $patron->userid, $password, undef, undef, 0 ), 'checkpw still returns true' );
     isnt( C4::Context->userenv->{branch}, $library->branchcode, 'Userenv branch is overwritten if no_set_userenv is false' );
 };
 
@@ -433,15 +432,15 @@ subtest 'checkpw lockout tests' => sub {
     t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
     $patron->set_password({ password => $password });
 
-    my ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->cardnumber, $password, undef, undef, 1 );
+    my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
     ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->userid, "wrong_password", undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->userid, "wrong_password", undef, undef, 1 );
     is( $checkpw, 0, 'checkpw returns false when given wrong password' );
     $patron = $patron->get_from_storage;
     is( $patron->account_locked, 1, "Account is locked from failed login");
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->userid, $password, undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->userid, $password, undef, undef, 1 );
     is( $checkpw, undef, 'checkpw returns undef with right password when account locked' );
-    ( $checkpw, undef, undef ) = checkpw( $dbh, $patron->cardnumber, $password, undef, undef, 1 );
+    ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
     is( $checkpw, undef, 'checkpw returns undefwith right password when logging in via cardnumber if account locked' );
 
 };
@@ -642,7 +641,7 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     $patron->password('123')->store; # yes, deliberately not hashed
 
     is( $patron->account_locked, 0, 'Patron not locked' );
-    my @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    my @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
         # Note: 123 will not be hashed to 123 !
     is( $test[0], 0, 'checkpw should have failed' );
     $patron->discard_changes; # refresh
@@ -650,7 +649,7 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     is( $patron->account_locked, 1, 'Check locked status' );
 
     # And another try to go over the limit: different return value!
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( @test, 0, 'checkpw failed again and returns nothing now' );
     $patron->discard_changes; # refresh
     is( $patron->login_attempts, 3, 'Login attempts not increased anymore' );
@@ -660,11 +659,11 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     my $auth = Test::MockModule->new( 'C4::Auth' );
     $auth->mock( 'checkpw_hash', sub { return 1; } ); # not for production :)
     $patron->login_attempts(0)->store;
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( $test[0], 1, 'Build confidence in the mock' );
     $patron->login_attempts(-1)->store;
     is( $patron->account_locked, 1, 'Check administrative lockout' );
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( @test, 0, 'checkpw gave red' );
     $patron->discard_changes; # refresh
     is( $patron->login_attempts, -1, 'Still locked out' );
diff --git a/t/db_dependent/Auth_with_ldap.t b/t/db_dependent/Auth_with_ldap.t
index 39f6e8ef02..df385e1569 100755
--- a/t/db_dependent/Auth_with_ldap.t
+++ b/t/db_dependent/Auth_with_ldap.t
@@ -28,8 +28,6 @@ use C4::Context;
 
 use Koha::Patrons;
 
-my $dbh = '';
-
 # Start transaction
 my $schema = Koha::Database->new->schema;
 $schema->storage->txn_begin();
@@ -131,12 +129,11 @@ subtest 'checkpw_ldap tests' => sub {
 
     plan tests => 4;
 
-    my $dbh = C4::Context->dbh;
     ## Connection fail tests
     $desired_connection_result = 'error';
     warning_is {
         $ret =
-          C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' );
+          C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' );
     }
     'LDAP connexion failed',
       'checkpw_ldap prints correct warning if LDAP conexion fails';
@@ -158,7 +155,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/Anonymous LDAP bind failed: LDAP error #1: error_name/,
@@ -171,7 +168,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -204,7 +201,7 @@ subtest 'checkpw_ldap tests' => sub {
             }
         );
 
-        C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' );
+        C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' );
         ok(
             Koha::Patrons->find($borrower->{borrowernumber})->extended_attributes->count,
             'Extended attributes are not deleted'
@@ -219,7 +216,7 @@ subtest 'checkpw_ldap tests' => sub {
         $patron->delete;
         reload_ldap_module();
         is(
-            C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ),
+            C4::Auth_with_ldap::checkpw_ldap( 'hola', password => 'hey' ),
             0,
             'checkpw_ldap returns 0 if user lookup returns 0'
         );
@@ -228,7 +225,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -246,7 +243,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
         qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
@@ -271,7 +268,7 @@ subtest 'checkpw_ldap tests' => sub {
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
@@ -286,7 +283,7 @@ qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP Auth rejected : invalid password for user 'hola'./,
@@ -300,7 +297,7 @@ qr/LDAP Auth rejected : invalid password for user 'hola'./,
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
@@ -313,7 +310,7 @@ qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er
         reload_ldap_module();
 
         warning_like {
-            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
+            $ret = C4::Auth_with_ldap::checkpw_ldap( 'hola',
                 password => 'hey' );
         }
 qr/LDAP Auth rejected : invalid password for user 'hola'./,
diff --git a/t/db_dependent/Log.t b/t/db_dependent/Log.t
index 0e46eea4c9..fd821252d3 100755
--- a/t/db_dependent/Log.t
+++ b/t/db_dependent/Log.t
@@ -30,7 +30,6 @@ use t::lib::TestBuilder;
 # Make sure we can rollback.
 our $schema  = Koha::Database->new->schema;
 $schema->storage->txn_begin;
-our $dbh = C4::Context->dbh;
 
 subtest 'Existing tests' => sub {
     plan tests => 3;
@@ -47,17 +46,15 @@ subtest 'Existing tests' => sub {
     ok($success, "logaction seemed to work");
 
     # We want numbers to be the same between runs.
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
 
     t::lib::Mocks::mock_preference('CronjobLog',0);
     cronlogaction();
-    my $cronJobCount = $dbh->selectrow_array("SELECT COUNT(*) FROM action_logs WHERE module='CRONJOBS';",{});
-    is($cronJobCount,0,"Cronjob not logged as expected.");
+    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,0,"Cronjob not logged as expected.");
 
     t::lib::Mocks::mock_preference('CronjobLog',1);
     cronlogaction();
-    $cronJobCount = $dbh->selectrow_array("SELECT COUNT(*) FROM action_logs WHERE module='CRONJOBS';",{});
-    is($cronJobCount,1,"Cronjob logged as expected.");
+    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,0,"Cronjob logged as expected.");
 };
 
 subtest 'logaction(): interface is correctly logged' => sub {
@@ -65,28 +62,28 @@ subtest 'logaction(): interface is correctly logged' => sub {
     plan tests => 4;
 
     # No interface passed, using C4::Context->interface
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'commandline' );
     logaction( "MEMBERS", "MODIFY", 1, "test operation");
     my $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'commandline', 'Interface correctly deduced (commandline)');
 
     # No interface passed, using C4::Context->interface
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'opac' );
     logaction( "MEMBERS", "MODIFY", 1, "test operation");
     $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'opac', 'Interface correctly deduced (opac)');
 
     # Explicit interfaces
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'intranet' );
     logaction( "MEMBERS", "MODIFY", 1, 'test info', 'intranet');
     $log = Koha::ActionLogs->search->next;
     is( $log->interface, 'intranet', 'Passed interface is respected (intranet)');
 
     # Explicit interfaces
-    $dbh->do("DELETE FROM action_logs;");
+    Koha::ActionLogs->search->delete;
     C4::Context->interface( 'sip' );
     logaction( "MEMBERS", "MODIFY", 1, 'test info', 'sip');
     $log = Koha::ActionLogs->search->next;
@@ -114,7 +111,7 @@ subtest 'GDPR logging' => sub {
     t::lib::Mocks::mock_preference('AuthFailureLog', 1);
     my $strong_password = 'N0tStr0ngAnyM0reN0w:)';
     $patron->set_password({ password => $strong_password });
-    my @ret = checkpw( $dbh, $patron->userid, 'WrongPassword', undef, undef, 1);
+    my @ret = checkpw( $patron->userid, 'WrongPassword', undef, undef, 1);
     is( $ret[0], 0, 'Authentication failed' );
     # Look for auth failure but NOT on patron id, pass userid in info parameter
     $logs = Koha::ActionLogs->search(
@@ -126,7 +123,7 @@ subtest 'GDPR logging' => sub {
     );
     is( $logs->count, 1, 'We should find one auth failure with this userid' );
     t::lib::Mocks::mock_preference('AuthFailureLog', 0);
-    @ret = checkpw( $dbh, $patron->userid, 'WrongPassword', undef, undef, 1);
+    @ret = checkpw( $patron->userid, 'WrongPassword', undef, undef, 1);
     $logs = Koha::ActionLogs->search(
         {
             module => 'AUTH',
@@ -136,7 +133,7 @@ subtest 'GDPR logging' => sub {
     );
     is( $logs->count, 1, 'Still only one failure with this userid' );
     t::lib::Mocks::mock_preference('AuthSuccessLog', 1);
-    @ret = checkpw( $dbh, $patron->userid, $strong_password, undef, undef, 1);
+    @ret = checkpw( $patron->userid, $strong_password, undef, undef, 1);
     is( $ret[0], 1, 'Authentication succeeded' );
     # Now we can look for patron id
     $logs = Koha::ActionLogs->search(

From f11737f987efe148cd4dd8e6d84cee573a2e265d Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Wed, 10 Aug 2022 08:12:53 +0100
Subject: [PATCH 04/56] Bug 27342: (QA follow-up) Remove dbh from new tests

---
 t/db_dependent/Auth.t | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index ef9e445ad8..a10ce20ade 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -678,11 +678,11 @@ subtest 'Check value of login_attempts in checkpw' => sub {
     my $patron = $builder->build_object({ class => 'Koha::Patrons' });
     $patron->set_password({ password => '123', skip_validation => 1 });
 
-    my @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    my @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( $test[0], 1, 'Patron authenticated correctly' );
 
     $patron->password_expiration_date('2020-01-01')->store;
-    @test = checkpw( $dbh, $patron->userid, '123', undef, 'opac', 1 );
+    @test = checkpw( $patron->userid, '123', undef, 'opac', 1 );
     is( $test[0], -2, 'Patron returned as expired correctly' );
 
 };

From e110f3cca51666a9f19d7fec3a4cbcc253f22f91 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Tue, 16 Aug 2022 10:50:47 -0300
Subject: [PATCH 05/56] Bug 27342: (QA follow-up) Fix test

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 t/db_dependent/Log.t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/t/db_dependent/Log.t b/t/db_dependent/Log.t
index fd821252d3..cfdbab3102 100755
--- a/t/db_dependent/Log.t
+++ b/t/db_dependent/Log.t
@@ -54,7 +54,7 @@ subtest 'Existing tests' => sub {
 
     t::lib::Mocks::mock_preference('CronjobLog',1);
     cronlogaction();
-    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,0,"Cronjob logged as expected.");
+    is(Koha::ActionLogs->search({ module => 'CRONJOBS' })->count,1,"Cronjob logged as expected.");
 };
 
 subtest 'logaction(): interface is correctly logged' => sub {

From 6a65e5ddfc8d6711082786e186199293c028b765 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 17 Aug 2022 10:33:07 -0300
Subject: [PATCH 06/56] Bug 27342: Fix C4::ILSDI::Services::AuthenticatePatron

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 C4/ILSDI/Services.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/C4/ILSDI/Services.pm b/C4/ILSDI/Services.pm
index eb5361ab84..ed23d464db 100644
--- a/C4/ILSDI/Services.pm
+++ b/C4/ILSDI/Services.pm
@@ -398,7 +398,7 @@ sub AuthenticatePatron {
     my ($cgi) = @_;
     my $username = $cgi->param('username');
     my $password = $cgi->param('password');
-    my ($status, $cardnumber, $userid, $patron) = C4::Auth::checkpw( C4::Context->dbh, $username, $password );
+    my ($status, $cardnumber, $userid, $patron) = C4::Auth::checkpw( $username, $password );
     if ( $status == 1 ) {
         # Track the login
         $patron->update_lastseen('connection');

From 937ff3d98451d23d8f58053acec6d305c1958df3 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Tue, 6 Dec 2022 17:07:02 -0300
Subject: [PATCH 07/56] Bug 35343: Add record accessor method to
 Koha::Authority

Code lifted from bug 31794 to fix already backported bug 26611.

Unit tests included.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 40115a2c8cba3e081ffd0710899ef4556a3bbb54)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha/Authority.pm                 | 45 ++++++++++++++++-
 t/db_dependent/Koha/Authorities.t | 81 ++++++++++++++++++++++++++++++-
 2 files changed, 123 insertions(+), 3 deletions(-)

diff --git a/Koha/Authority.pm b/Koha/Authority.pm
index cec6c662f4..828d4c75b2 100644
--- a/Koha/Authority.pm
+++ b/Koha/Authority.pm
@@ -95,8 +95,7 @@ sub controlled_indicators {
         ? 'UNIMARCAUTH'
         : 'MARC21';
     if( !$record ) {
-        $record = MARC::Record->new_from_xml(
-            $self->marcxml, 'UTF-8', $flavour );
+        $record = $self->record;
     }
 
     if( !$self->{_report_tag} ) {
@@ -114,6 +113,48 @@ sub controlled_indicators {
     });
 }
 
+=head3 get_identifiers
+
+    my $identifiers = $author->get_identifiers;
+
+Return a list of identifiers of the authors which are in 024$2$a
+
+=cut
+
+sub get_identifiers {
+    my ( $self, $params ) = @_;
+
+    my $record = $self->record;
+
+    my @identifiers;
+    for my $field ( $record->field('024') ) {
+        my $sf_2 = $field->subfield('2');
+        my $sf_a = $field->subfield('a');
+        next unless $sf_2 && $sf_a;
+        push @identifiers, {source => $sf_2, number => $sf_a, };
+    }
+
+    return \@identifiers;
+}
+
+=head3 record
+
+    my $record = $authority->record()
+
+Return the MARC::Record for this authority
+
+=cut
+
+sub record {
+    my ( $self ) = @_;
+
+    my $flavour =
+      C4::Context->preference('marcflavour') eq 'UNIMARC'
+      ? 'UNIMARCAUTH'
+      : 'MARC21';
+    return MARC::Record->new_from_xml( $self->marcxml, 'UTF-8', $flavour );
+}
+
 =head2 Class Methods
 
 =head3 type
diff --git a/t/db_dependent/Koha/Authorities.t b/t/db_dependent/Koha/Authorities.t
index 04ad663e28..699ee1c34a 100755
--- a/t/db_dependent/Koha/Authorities.t
+++ b/t/db_dependent/Koha/Authorities.t
@@ -19,7 +19,7 @@
 
 use Modern::Perl;
 
-use Test::More tests => 7;
+use Test::More tests => 9;
 use MARC::Field;
 use MARC::File::XML;
 use MARC::Record;
@@ -242,4 +242,83 @@ sub few_marc_records {
     return [ $marc ];
 }
 
+subtest 'get_identifiers' => sub {
+    plan tests => 1;
+
+    t::lib::Mocks::mock_preference( 'marcflavour', 'MARC21' );
+    my $record = MARC::Record->new();
+    $record->add_fields(
+        [
+            '100', ' ', ' ',
+            a => 'Lastname, Firstname',
+            b => 'b',
+            c => 'c',
+            i => 'i'
+        ],
+        [
+            '024', '', '',
+            a => '0000-0002-1234-5678',
+            2 => 'orcid',
+            6 => 'https://orcid.org/0000-0002-1234-5678'
+        ],
+        [
+            '024', '', '',
+            a => '01234567890',
+            2 => 'scopus',
+            6 => 'https://www.scopus.com/authid/detail.uri?authorId=01234567890'
+        ],
+    );
+    my $authid = C4::AuthoritiesMarc::AddAuthority($record, undef, 'PERSO_NAME');
+    my $authority = Koha::Authorities->find($authid);
+    is_deeply(
+        $authority->get_identifiers,
+        [
+            {
+                source  => 'orcid',
+                number  => '0000-0002-1234-5678',
+            },
+            {
+                source => 'scopus',
+                number => '01234567890',
+            }
+        ]
+    );
+};
+
+subtest 'record tests' => sub {
+    plan tests => 3;
+
+    t::lib::Mocks::mock_preference( 'marcflavour', 'MARC21' );
+    my $record = MARC::Record->new();
+    $record->add_fields(
+        [
+            '100', ' ', ' ',
+            a => 'Lastname, Firstname',
+            b => 'b',
+            c => 'c',
+            i => 'i'
+        ],
+        [
+            '024', '', '',
+            a => '0000-0002-1234-5678',
+            2 => 'orcid',
+            6 => 'https://orcid.org/0000-0002-1234-5678'
+        ],
+        [
+            '024', '', '',
+            a => '01234567890',
+            2 => 'scopus',
+            6 => 'https://www.scopus.com/authid/detail.uri?authorId=01234567890'
+        ],
+    );
+    my $authid = C4::AuthoritiesMarc::AddAuthority($record, undef, 'PERSO_NAME');
+    my $authority = Koha::Authorities->find($authid);
+    my $authority_record = $authority->record;
+    is ($authority_record->field('100')->subfield('a'), 'Lastname, Firstname');
+    my @fields_024 = $authority_record->field('024');
+    is ($fields_024[0]->subfield('a'), '0000-0002-1234-5678');
+    is ($fields_024[1]->subfield('a'), '01234567890');
+
+};
+
 $schema->storage->txn_rollback;

From 7c51874ab8bce848bb4783982bd87590c269c218 Mon Sep 17 00:00:00 2001
From: root <root@wainuiwitikapark-lp.dynamic.wgtn.cat-it.co.nz>
Date: Mon, 29 Jan 2024 12:37:54 +1300
Subject: [PATCH 08/56] Increment version for 22.05.18 release

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha.pm                                   | 2 +-
 installer/data/mysql/db_revs/220518000.pl | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100755 installer/data/mysql/db_revs/220518000.pl

diff --git a/Koha.pm b/Koha.pm
index f671fa9b07..148afdbac8 100644
--- a/Koha.pm
+++ b/Koha.pm
@@ -29,7 +29,7 @@ use vars qw{ $VERSION };
 # - #4 : the developer version. The 4th number is the database subversion.
 #        used by developers when the database changes. updatedatabase take care of the changes itself
 #        and is automatically called by Auth.pm when needed.
-$VERSION = "22.05.17.000";
+$VERSION = "22.05.18.000";
 
 sub version {
     return $VERSION;
diff --git a/installer/data/mysql/db_revs/220518000.pl b/installer/data/mysql/db_revs/220518000.pl
new file mode 100755
index 0000000000..16696ce466
--- /dev/null
+++ b/installer/data/mysql/db_revs/220518000.pl
@@ -0,0 +1,7 @@
+use Modern::Perl;
+
+return {
+    bug_number => undef,
+    description => 'Koha 22.05.18 release',
+    up => sub {},
+}

From 8589daa1103105a6657476eeb67927fcaca3cb62 Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Mon, 29 Jan 2024 00:06:42 +0000
Subject: [PATCH 09/56] Update release notes for 22.05.18 release

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../release_notes/release_notes_22_05_18.html | 292 ++++++++++++++++++
 misc/release_notes/release_notes_22_05_18.md  | 254 +++++++++++++++
 2 files changed, 546 insertions(+)
 create mode 100644 misc/release_notes/release_notes_22_05_18.html
 create mode 100644 misc/release_notes/release_notes_22_05_18.md

diff --git a/misc/release_notes/release_notes_22_05_18.html b/misc/release_notes/release_notes_22_05_18.html
new file mode 100644
index 0000000000..5bc7f2b645
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_18.html
@@ -0,0 +1,292 @@
+<h1 id="releasenotesforkoha22.05.18">RELEASE NOTES FOR KOHA 22.05.18</h1>
+
+<p>28 Jan 2024</p>
+
+<p>Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:</p>
+
+<ul>
+<li><a href="http://koha-community.org">Koha Community</a></li>
+</ul>
+
+<p>Koha 22.05.18 can be downloaded from:</p>
+
+<ul>
+<li><a href="http://download.koha-community.org/koha-22.05.18.tar.gz">Download</a></li>
+</ul>
+
+<p>Installation instructions can be found at:</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Installation_Documentation">Koha Wiki</a></li>
+<li>OR in the INSTALL files that come in the tarball</li>
+</ul>
+
+<p>Koha 22.05.18 is a bugfix/maintenance release.</p>
+
+<p>It includes 1 enhancements, 2 bugfixes.</p>
+
+<p><strong>System requirements</strong></p>
+
+<p>You can learn about the system components (like OS and database) needed for running Koha on the <a href="https://wiki.koha-community.org/wiki/System_requirements_and_recommendations">community wiki</a>.</p>
+
+<h2 id="securitybugs">Security bugs</h2>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893">34893</a> ILS-DI can return the wrong patron for AuthenticatePatron</li>
+</ul>
+
+<h2 id="criticalbugsfixed">Critical bugs fixed</h2>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35343">35343</a> record method, required for bug 26611, missing from Koha::Authority</li>
+</ul>
+
+<h2 id="enhancements">Enhancements</h2>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27342">27342</a> Improve readability and improvement of C4::Auth::get_template_and_user</li>
+</ul>
+
+<h2 id="documentation">Documentation</h2>
+
+<p>The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is</p>
+
+<ul>
+<li><p><a href="http://koha-community.org/documentation/">Koha Documentation</a>
+As of the date of these release notes, the Koha manual is available in the following languages:</p></li>
+<li><p><a href="https://koha-community.org/manual/22.05//html/">Chinese (Traditional)</a> (50%)</p></li>
+<li><a href="https://koha-community.org/manual/22.05//html/">English</a> (100%)</li>
+<li><a href="https://koha-community.org/manual/22.05/en/html/">English (USA)</a></li>
+<li><a href="https://koha-community.org/manual/22.05/fr/html/">French</a> (39%)</li>
+<li><a href="https://koha-community.org/manual/22.05/de/html/">German</a> (41%)</li>
+<li><a href="https://koha-community.org/manual/22.05/hi/html/">Hindi</a> (68%)</li>
+</ul>
+
+<p>The Git repository for the Koha manual can be found at</p>
+
+<ul>
+<li><a href="https://gitlab.com/koha-community/koha-manual">Koha Git Repository</a></li>
+</ul>
+
+<h2 id="translations">Translations</h2>
+
+<p>Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:</p>
+
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (68%)
+- Dutch (83%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (99%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (60%)
+- Persian (fa_ARAB) (68%)
+- Polish (100%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (77%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+<p>Partial translations are available for various other languages.</p>
+
+<p>The Koha team welcomes additional translations; please see</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Translating_Koha">Koha Translation Info</a></li>
+</ul>
+
+<p>For information about translating Koha, and join the koha-translate 
+list to volunteer:</p>
+
+<ul>
+<li><a href="http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate">Koha Translate List</a></li>
+</ul>
+
+<p>The most up-to-date translations can be found at:</p>
+
+<ul>
+<li><a href="http://translate.koha-community.org/">Koha Translation</a></li>
+</ul>
+
+<h2 id="releaseteam">Release Team</h2>
+
+<p>The release team for Koha 22.05.18 is</p>
+
+<ul>
+<li><p>Release Manager: Katrin Fischer</p></li>
+<li><p>Release Manager assistants:</p>
+
+<ul>
+<li>Tomás Cohen Arazi</li>
+<li>Martin Renvoize</li>
+<li>Jonathan Druart</li>
+</ul></li>
+<li><p>QA Manager: Marcel de Rooy</p></li>
+<li><p>QA Team:</p>
+
+<ul>
+<li>Marcel de Rooy</li>
+<li>Julian Maurice</li>
+<li>Lucas Gass</li>
+<li>Victor Grousset</li>
+<li>Kyle M Hall</li>
+<li>Nick Clemens</li>
+<li>Martin Renvoize</li>
+<li>Tomás Cohen Arazi</li>
+<li>Aleisha Amohia</li>
+<li>Emily Lamancusa</li>
+<li>David Cook</li>
+<li>Jonathan Druart</li>
+<li>Pedor Amorim</li>
+</ul></li>
+<li><p>Topic Experts:</p>
+
+<ul>
+<li>UI Design -- Owen Leonard</li>
+<li>Zebra -- Fridolin Somers</li>
+<li>REST API -- Tomás Cohen Arazi</li>
+<li>ERM -- Matt Blenkinsop</li>
+<li>ILL -- Pedro Amorim</li>
+<li>SIP2 -- Matthias Meusburger</li>
+<li>CAS -- Matthias Meusburger</li>
+</ul></li>
+<li><p>Bug Wranglers:</p>
+
+<ul>
+<li>Aleisha Amohia</li>
+<li>Indranil Das Gupta</li>
+</ul></li>
+<li><p>Packaging Managers:</p>
+
+<ul>
+<li>Mason James</li>
+<li>Indranil Das Gupta</li>
+<li>Tomás Cohen Arazi</li>
+</ul></li>
+<li><p>Documentation Manager: Aude Charillon</p></li>
+<li><p>Documentation Team:</p>
+
+<ul>
+<li>Caroline Cyr La Rose</li>
+<li>Kelly McElligott</li>
+<li>Philip Orr</li>
+<li>Marie-Luce Laflamme</li>
+<li>Lucy Vaux-Harvey</li>
+</ul></li>
+<li><p>Translation Manager: Jonathan Druart</p></li>
+<li><p>Wiki curators: </p>
+
+<ul>
+<li>Thomas Dukleth</li>
+<li>Katrin Fischer</li>
+</ul></li>
+<li><p>Release Maintainers:</p>
+
+<ul>
+<li>23.11 -- Fridolin Somers</li>
+<li>23.05 -- Lucas Gass</li>
+<li>22.11 -- Frédéric Demians</li>
+<li>22.05 -- Danyon Sewell</li>
+</ul></li>
+<li><p>Release Maintainer assistants:</p>
+
+<ul>
+<li>22.05 -- Wainui Witika-Park</li>
+</ul></li>
+</ul>
+
+<h2 id="credits">Credits</h2>
+
+<p>We thank the following individuals who contributed patches to Koha 22.05.18</p>
+
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (3)
+- David Cook (1)
+- Jonathan Druart (2)
+- Kyle M Hall (3)
+- Martin Renvoize (2)
+- root (1)
+- Wainui Witika-Park (1)
+</div>
+
+<p>We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.18</p>
+
+<div style="column-count: 2;">
+
+- ByWater-Solutions (3)
+- Catalyst (1)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (2)
+- Prosentient Systems (1)
+- PTFS-Europe (2)
+- Theke Solutions (3)
+- wainuiwitikapark-lp.dynamic.wgtn.cat-it.co.nz (1)
+</div>
+
+<p>We also especially thank the following individuals who tested patches
+for Koha</p>
+
+<div style="column-count: 2;">
+
+- Tomás Cohen Arazi (4)
+- Matt Blenkinsop (1)
+- Victor Grousset (4)
+- Martin Renvoize (2)
+- Wainui Witika-Park (6)
+</div>
+
+<p>We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.</p>
+
+<h2 id="revisioncontrolnotes">Revision control notes</h2>
+
+<p>The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:</p>
+
+<ul>
+<li><a href="https://git.koha-community.org/koha-community/koha">Koha Git Repository</a></li>
+</ul>
+
+<p>The branch for this version of Koha and future bugfixes in this release
+line is (HEAD detached from 63ec3760d2).</p>
+
+<h2 id="bugsandfeaturerequests">Bugs and feature requests</h2>
+
+<p>Bug reports and feature requests can be filed at the Koha bug
+tracker at:</p>
+
+<ul>
+<li><a href="http://bugs.koha-community.org">Koha Bugzilla</a></li>
+</ul>
+
+<p>He rau ringa e oti ai.
+(Many hands finish the work)</p>
+
+<p>Autogenerated release notes updated last on 28 Jan 2024 23:58:58.</p>
diff --git a/misc/release_notes/release_notes_22_05_18.md b/misc/release_notes/release_notes_22_05_18.md
new file mode 100644
index 0000000000..cb3be8eb20
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_18.md
@@ -0,0 +1,254 @@
+# RELEASE NOTES FOR KOHA 22.05.18
+28 Jan 2024
+
+Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:
+
+- [Koha Community](http://koha-community.org)
+
+Koha 22.05.18 can be downloaded from:
+
+- [Download](http://download.koha-community.org/koha-22.05.18.tar.gz)
+
+Installation instructions can be found at:
+
+- [Koha Wiki](http://wiki.koha-community.org/wiki/Installation_Documentation)
+- OR in the INSTALL files that come in the tarball
+
+Koha 22.05.18 is a bugfix/maintenance release.
+
+It includes 1 enhancements, 2 bugfixes.
+
+**System requirements**
+
+You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations).
+
+
+## Security bugs
+
+- [34893](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893) ILS-DI can return the wrong patron for AuthenticatePatron
+
+## Critical bugs fixed
+
+- [35343](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35343) record method, required for bug 26611, missing from Koha::Authority
+
+## Enhancements 
+
+- [27342](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27342) Improve readability and improvement of C4::Auth::get_template_and_user
+
+## Documentation
+
+The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is
+
+- [Koha Documentation](http://koha-community.org/documentation/)
+As of the date of these release notes, the Koha manual is available in the following languages:
+
+- [Chinese (Traditional)](https://koha-community.org/manual/22.05//html/) (50%)
+- [English](https://koha-community.org/manual/22.05//html/) (100%)
+- [English (USA)](https://koha-community.org/manual/22.05/en/html/)
+- [French](https://koha-community.org/manual/22.05/fr/html/) (39%)
+- [German](https://koha-community.org/manual/22.05/de/html/) (41%)
+- [Hindi](https://koha-community.org/manual/22.05/hi/html/) (68%)
+
+The Git repository for the Koha manual can be found at
+
+- [Koha Git Repository](https://gitlab.com/koha-community/koha-manual)
+
+## Translations
+
+Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (68%)
+- Dutch (83%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (99%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (60%)
+- Persian (fa_ARAB) (68%)
+- Polish (100%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (77%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+Partial translations are available for various other languages.
+
+The Koha team welcomes additional translations; please see
+
+- [Koha Translation Info](http://wiki.koha-community.org/wiki/Translating_Koha)
+
+For information about translating Koha, and join the koha-translate 
+list to volunteer:
+
+- [Koha Translate List](http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate)
+
+The most up-to-date translations can be found at:
+
+- [Koha Translation](http://translate.koha-community.org/)
+
+## Release Team
+
+The release team for Koha 22.05.18 is
+
+
+- Release Manager: Katrin Fischer
+
+- Release Manager assistants:
+  - Tomás Cohen Arazi
+  - Martin Renvoize
+  - Jonathan Druart
+
+- QA Manager: Marcel de Rooy
+
+- QA Team:
+  - Marcel de Rooy
+  - Julian Maurice
+  - Lucas Gass
+  - Victor Grousset
+  - Kyle M Hall
+  - Nick Clemens
+  - Martin Renvoize
+  - Tomás Cohen Arazi
+  - Aleisha Amohia
+  - Emily Lamancusa
+  - David Cook
+  - Jonathan Druart
+  - Pedor Amorim
+
+- Topic Experts:
+  - UI Design -- Owen Leonard
+  - Zebra -- Fridolin Somers
+  - REST API -- Tomás Cohen Arazi
+  - ERM -- Matt Blenkinsop
+  - ILL -- Pedro Amorim
+  - SIP2 -- Matthias Meusburger
+  - CAS -- Matthias Meusburger
+
+- Bug Wranglers:
+  - Aleisha Amohia
+  - Indranil Das Gupta
+
+- Packaging Managers:
+  - Mason James
+  - Indranil Das Gupta
+  - Tomás Cohen Arazi
+
+- Documentation Manager: Aude Charillon
+
+- Documentation Team:
+  - Caroline Cyr La Rose
+  - Kelly McElligott
+  - Philip Orr
+  - Marie-Luce Laflamme
+  - Lucy Vaux-Harvey
+
+- Translation Manager: Jonathan Druart
+
+
+- Wiki curators: 
+  - Thomas Dukleth
+  - Katrin Fischer
+
+- Release Maintainers:
+  - 23.11 -- Fridolin Somers
+  - 23.05 -- Lucas Gass
+  - 22.11 -- Frédéric Demians
+  - 22.05 -- Danyon Sewell
+
+- Release Maintainer assistants:
+  - 22.05 -- Wainui Witika-Park
+
+## Credits
+
+
+
+We thank the following individuals who contributed patches to Koha 22.05.18
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (3)
+- David Cook (1)
+- Jonathan Druart (2)
+- Kyle M Hall (3)
+- Martin Renvoize (2)
+- root (1)
+- Wainui Witika-Park (1)
+</div>
+
+We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.18
+<div style="column-count: 2;">
+
+- ByWater-Solutions (3)
+- Catalyst (1)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (2)
+- Prosentient Systems (1)
+- PTFS-Europe (2)
+- Theke Solutions (3)
+- wainuiwitikapark-lp.dynamic.wgtn.cat-it.co.nz (1)
+</div>
+
+We also especially thank the following individuals who tested patches
+for Koha
+<div style="column-count: 2;">
+
+- Tomás Cohen Arazi (4)
+- Matt Blenkinsop (1)
+- Victor Grousset (4)
+- Martin Renvoize (2)
+- Wainui Witika-Park (6)
+</div>
+
+
+
+
+
+We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.
+
+## Revision control notes
+
+The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:
+
+- [Koha Git Repository](https://git.koha-community.org/koha-community/koha)
+
+The branch for this version of Koha and future bugfixes in this release
+line is (HEAD detached from 63ec3760d2).
+
+## Bugs and feature requests
+
+Bug reports and feature requests can be filed at the Koha bug
+tracker at:
+
+- [Koha Bugzilla](http://bugs.koha-community.org)
+
+He rau ringa e oti ai.
+(Many hands finish the work)
+
+Autogenerated release notes updated last on 28 Jan 2024 23:58:58.

From d7041a36cc62e739b5bdddffb2497337d9c5cdf3 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Tue, 13 Feb 2024 12:36:44 +0000
Subject: [PATCH 10/56] Bug 36072: opac-request-article should check syspref

Note: This is handled now just like opac-reserve.

Test plan:
Disable ArticleRequests and hit the page.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 opac/opac-request-article.pl | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/opac/opac-request-article.pl b/opac/opac-request-article.pl
index dcf9f214a5..3fdb402118 100755
--- a/opac/opac-request-article.pl
+++ b/opac/opac-request-article.pl
@@ -33,6 +33,12 @@ use Try::Tiny;
 
 my $cgi = CGI->new;
 
+# If ArticleRequests is disabled, leave immediately
+if ( !C4::Context->preference('ArticleRequests') ) {
+    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
 my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
     {
         template_name   => "opac-request-article.tt",

From bdd288e3c464683ede8b22e20b4359083ef81fd1 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 30 Jan 2024 14:53:03 +0100
Subject: [PATCH 11/56] Bug 35941: Limit club list to those from the logged in
 user

clubs-tab get the patron's id from the parameter. At the OPAC we must
use the one from the logged in user, to prevent leak to other users

Test plan:
Have 2 clubs: A, B
Enroll to A with patron borrowernumber=1
Enroll to B with patron borrowernumber=2
Log in with patron 1 and hit:
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
=> OK
Now hit
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
=> oops

Apply this patch, try again.
The "borrowernumber" parameter is no longer used to fetch the club list.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt  |  8 ++++----
 .../opac-tmpl/bootstrap/en/modules/clubs/enroll.tt     |  3 +--
 opac/clubs/clubs-tab.pl                                | 10 ++++------
 opac/clubs/enroll.pl                                   |  8 ++------
 4 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
index 4358d097a3..5c0364ffb2 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt
@@ -55,8 +55,8 @@
                     <td>[% c.name | html %]</td>
                     <td>[% c.description | html %]</td>
                     <td>
-                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && borrower.first_valid_email_address ) %]
-                            <button class="btn btn-xs btn-default" onclick="loadEnrollmentForm([% c.id | html%])">
+                        [% IF !c.club_template.is_email_required || ( c.club_template.is_email_required && patron.notice_email_address ) %]
+                            <button class="btn btn-sm btn-primary load_enrollment" data-id="[% c.id | html%]">
                                 <i class="fa fa-plus" aria-hidden="true"></i> Enroll
                             </button>
                         [% ELSE %]
@@ -72,7 +72,7 @@
 <script>
 function loadEnrollmentForm( id ) {
     $("body").css("cursor", "progress");
-    $('#opac-user-clubs').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber | html %]&id=' + id, function() {
+    $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% patron.borrowernumber | html %]&id=' + id, function() {
         $("body").css("cursor", "default");
     });
 
@@ -87,7 +87,7 @@ function cancelEnrollment( id ) {
         data: { id: id },
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrower.borrowernumber | html %]', function() {
+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% patron.borrowernumber | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
index 6f6d62ee82..7ece58d063 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt
@@ -9,7 +9,6 @@
     <form id="patron-enrollment-form">
         <legend class="sr-only">Enrollment</legend>
         <input type="hidden" name="id" value="[% club.id | html %]" />
-        <input type="hidden" name="borrowernumber" value="[% borrowernumber | html %]" />
         <fieldset class="rows">
             <ol>
                 [% FOREACH f IN club.club_template.club_template_enrollment_fields %]
@@ -45,7 +44,7 @@ function addEnrollment() {
         data: $( "#patron-enrollment-form" ).serialize(),
         success: function( data ) {
             if ( data.success ) {
-                $('#opac-user-clubs').load('/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=[% borrowernumber | html %]&id=[% club.id | html %]', function() {
+                $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/clubs-tab.pl?id=[% club.id | html %]', function() {
                     $("body").css("cursor", "default");
                 });
             } else {
diff --git a/opac/clubs/clubs-tab.pl b/opac/clubs/clubs-tab.pl
index 8c3f758375..28fcd1ed69 100755
--- a/opac/clubs/clubs-tab.pl
+++ b/opac/clubs/clubs-tab.pl
@@ -35,17 +35,15 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
-my $borrowernumber = $cgi->param('borrowernumber');
+my $patron = Koha::Patrons->find( $loggedinuser );
 
-my $borrower = Koha::Patrons->find($borrowernumber);
-
-my @enrollments = $borrower->get_club_enrollments->as_list;
-my @clubs = $borrower->get_enrollable_clubs( my $opac = 1 )->as_list;
+my @enrollments = $patron->get_club_enrollments->as_list;
+my @clubs = $patron->get_enrollable_clubs( my $opac = 1 )->as_list;
 
 $template->param(
     enrollments => \@enrollments,
     clubs       => \@clubs,
-    borrower    => $borrower,
+    patron      => $patron,
 );
 
 output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );
diff --git a/opac/clubs/enroll.pl b/opac/clubs/enroll.pl
index a71990196f..9fcfd36004 100755
--- a/opac/clubs/enroll.pl
+++ b/opac/clubs/enroll.pl
@@ -35,14 +35,10 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     }
 );
 
-my $id             = $cgi->param('id');
-my $borrowernumber = $cgi->param('borrowernumber');
-
-my $club = Koha::Clubs->find($id);
+my $id = $cgi->param('id');
 
 $template->param(
-    club           => $club,
-    borrowernumber => $borrowernumber,
+    club => Koha::Clubs->find($id),
 );
 
 output_html_with_http_headers( $cgi, $cookie, $template->output, undef, { force_no_caching => 1 } );

From da9dc72de4384e99b413cbe79de7c57612fe5634 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Tue, 30 Jan 2024 14:32:12 +0000
Subject: [PATCH 12/56] Bug 35941: (QA follow-up) Tidy clubs-tab.pl

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 opac/clubs/clubs-tab.pl | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/opac/clubs/clubs-tab.pl b/opac/clubs/clubs-tab.pl
index 28fcd1ed69..03cc687f2e 100755
--- a/opac/clubs/clubs-tab.pl
+++ b/opac/clubs/clubs-tab.pl
@@ -21,7 +21,7 @@ use Modern::Perl;
 
 use CGI;
 
-use C4::Auth qw( get_template_and_user );
+use C4::Auth   qw( get_template_and_user );
 use C4::Output qw( output_html_with_http_headers );
 use Koha::Patrons;
 
@@ -29,16 +29,16 @@ my $cgi = CGI->new;
 
 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
     {
-        template_name   => "clubs/clubs-tab.tt",
-        query           => $cgi,
-        type            => "opac",
+        template_name => "clubs/clubs-tab.tt",
+        query         => $cgi,
+        type          => "opac",
     }
 );
 
-my $patron = Koha::Patrons->find( $loggedinuser );
+my $patron = Koha::Patrons->find($loggedinuser);
 
 my @enrollments = $patron->get_club_enrollments->as_list;
-my @clubs = $patron->get_enrollable_clubs( my $opac = 1 )->as_list;
+my @clubs       = $patron->get_enrollable_clubs( my $opac = 1 )->as_list;
 
 $template->param(
     enrollments => \@enrollments,

From 25d7ba548e0c4682a26b4e8b7db545b6824875c5 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 17 Nov 2021 18:02:17 -0300
Subject: [PATCH 13/56] Bug 29510: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 t/db_dependent/Koha/REST/Plugin/Objects.t | 56 ++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Koha/REST/Plugin/Objects.t b/t/db_dependent/Koha/REST/Plugin/Objects.t
index 8deee9da7d..724ce50d69 100755
--- a/t/db_dependent/Koha/REST/Plugin/Objects.t
+++ b/t/db_dependent/Koha/REST/Plugin/Objects.t
@@ -116,8 +116,21 @@ get '/my_patrons' => sub {
     );
 };
 
+get '/my_patrons/:patron_id' => sub {
+
+    my $c = shift;
+
+    my $patron_id = $c->param('patron_id');
+    my $patron    = $c->objects->find( scalar Koha::Patrons->new, $patron_id );
+
+    $c->render(
+        status => 200,
+        json   => $patron
+    );
+};
+
 # The tests
-use Test::More tests => 14;
+use Test::More tests => 15;
 use Test::Mojo;
 
 use t::lib::Mocks;
@@ -618,3 +631,44 @@ subtest 'objects.search helper, search_limited() tests' => sub {
 
     $schema->storage->txn_rollback;
 };
+
+subtest 'objects.find helper, search_limited() tests' => sub {
+
+    plan tests => 12;
+
+    $schema->storage->txn_begin;
+
+    my $library_1 = $builder->build_object( { class => 'Koha::Libraries' } );
+    my $library_2 = $builder->build_object( { class => 'Koha::Libraries' } );
+
+    my $patron_1 = $builder->build_object( { class => 'Koha::Patrons', value => { branchcode => $library_1->id } } );
+    my $patron_2 = $builder->build_object( { class => 'Koha::Patrons', value => { branchcode => $library_2->id } } );
+
+    my @libraries_where_can_see_patrons = ( $library_1->id, $library_2->id );
+
+    my $t = Test::Mojo->new;
+
+    my $mocked_patron = Test::MockModule->new('Koha::Patron');
+    $mocked_patron->mock(
+        'libraries_where_can_see_patrons',
+        sub {
+            return @libraries_where_can_see_patrons;
+        }
+    );
+
+    my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
+
+    t::lib::Mocks::mock_userenv( { patron => $patron } );
+
+    $t->get_ok( "/my_patrons/" . $patron_1->id )->status_is(200)->json_is( '/patron_id' => $patron_1->id );
+
+    $t->get_ok( "/my_patrons/" . $patron_2->id )->status_is(200)->json_is( '/patron_id' => $patron_2->id );
+
+    @libraries_where_can_see_patrons = ( $library_2->id );
+
+    $t->get_ok( "/my_patrons/" . $patron_1->id )->status_is(200)->json_is(undef);
+
+    $t->get_ok( "/my_patrons/" . $patron_2->id )->status_is(200)->json_is( '/patron_id' => $patron_2->id );
+
+    $schema->storage->txn_rollback;
+};

From a8211f9fa163d6b72ba19248f94a65f98c80f51b Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 17 Nov 2021 18:03:00 -0300
Subject: [PATCH 14/56] Bug 29510: Make objects.find call search_limited if
 present

This patch makes objects.find implicitly update the passed
*$result_set* to use search_limited. This way no object leaks could
happen without noticing.

To test:
1. Apply the regression tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t
=> FAIL: Tests fail because search_limited is not used
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Results are correctly filtered based on userenv!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha/REST/Plugin/Objects.pm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Koha/REST/Plugin/Objects.pm b/Koha/REST/Plugin/Objects.pm
index 4a5d29143c..cde3d8fe7a 100644
--- a/Koha/REST/Plugin/Objects.pm
+++ b/Koha/REST/Plugin/Objects.pm
@@ -62,6 +62,9 @@ the requested object. It passes through any embeds if specified.
                 }
             );
 
+            $result_set = $result_set->search_limited
+                if $result_set->can('search_limited');
+
             my $object = $result_set->find( $id, $attributes );
 
             return unless $object;

From 7165c186b0ac7e92b0c7c053a2f8fbc1e7d93ad7 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Wed, 17 Nov 2021 18:09:02 -0300
Subject: [PATCH 15/56] Bug 29510: (follow-up) Adapt GET /patrons/:patron_id

This patch makes GET /patrons/:patron_id rely on this new behavior from the
objects.find helper.

To test:
1. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> SUCCESS: Tests pass!
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests still pass!
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha/REST/V1/Patrons.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Koha/REST/V1/Patrons.pm b/Koha/REST/V1/Patrons.pm
index 576e4f8f2c..7d0817b637 100644
--- a/Koha/REST/V1/Patrons.pm
+++ b/Koha/REST/V1/Patrons.pm
@@ -74,8 +74,8 @@ sub get {
     my $c = shift->openapi->valid_input or return;
 
     return try {
-        my $patron_id = $c->validation->param('patron_id');
-        my $patron    = $c->objects->find( Koha::Patrons->search_limited, $patron_id );
+        my $patron_id = $c->param('patron_id');
+        my $patron    = $c->objects->find( Koha::Patrons->new, $patron_id );
 
         unless ($patron) {
             return $c->render(

From e1d18e9f57779be97735c1f3b290675ab9f91390 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 25 Jan 2024 10:35:41 +0100
Subject: [PATCH 16/56] Bug 35904: Make C4::Auth::checkauth testable easily

This patch suggests to add a new flag do_not_print to
C4::Auth::checkauth to not print the headers and allow to test this
subroutine more easily.

We do no longer need to mock safe_exit and redirect STDOUT to test its
return values.

There are still 3 left:
1.
733         # checkauth will redirect and safe_exit if not authenticated and not authorized
=> Better to keep this one, not trivial to replace

2.
806         # This will fail on permissions
This should be replaced but testing $template->{VARS}->{nopermission}
fails, I dont' think the comment is better.

3.
828         # Patron does not have the borrowers permission
Same as 2.

2. and 3. should be investigated a bit more.

This patch also move duplicated code to set patron's password to a
subroutine set_weak_password.

Test plan:
Read the code and confirm that everything makes sense.
QA: Do you have a better way for this? Yes it's dirty!

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Auth.pm            |  14 ++--
 t/db_dependent/Auth.t | 160 ++++++++++++++----------------------------
 2 files changed, 63 insertions(+), 111 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 1264ef8c1d..856960e680 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -824,6 +824,7 @@ sub checkauth {
     my $type            = shift;
     my $emailaddress    = shift;
     my $template_name   = shift;
+    my $params          = shift || {}; # do_not_print
     $type = 'opac' unless $type;
 
     if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
@@ -1352,8 +1353,10 @@ sub checkauth {
             $uri->query_param_delete('userid');
             $uri->query_param_delete('password');
             $uri->query_param_delete('koha_login_context');
-            print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');
-            safe_exit;
+            unless ( $params->{do_not_print} ) {
+                print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');
+                safe_exit;
+            }
         }
 
         return ( $userid, $cookie, $sessionID, $flags );
@@ -1487,8 +1490,11 @@ sub checkauth {
     );
     $template->param(%info);
 
-    #    $cookie = $query->cookie(CGISESSID => $session->id
-    #   );
+    if ( $params->{do_not_print} ) {
+        # This must be used for testing purpose only!
+        return ( undef, undef, undef, undef, $template );
+    }
+
     print $query->header(
         {   type              => 'text/html',
             charset           => 'utf-8',
diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index a10ce20ade..df6b8f1397 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -17,7 +17,8 @@ use t::lib::TestBuilder;
 
 use C4::Auth;
 use C4::Members;
-use Koha::AuthUtils qw/hash_password/;
+use Koha::AuthUtils qw( hash_password );
+use Koha::DateUtils qw( dt_from_string );
 use Koha::Database;
 use Koha::Patrons;
 use Koha::Auth::TwoFactorAuth;
@@ -87,9 +88,7 @@ subtest 'checkauth() tests' => sub {
 
         my $patron = $builder->build_object(
             { class => 'Koha::Patrons', value => { flags => 1 } } );
-        my $password = 'password';
-        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
-        $patron->set_password( { password => $password } );
+        my $password = set_weak_password($patron);
         $cgi = Test::MockObject->new();
         $cgi->mock( 'cookie', sub { return; } );
         $cgi->mock(
@@ -117,39 +116,20 @@ subtest 'checkauth() tests' => sub {
 
         my $password_expired;
 
-        my $patron_class = Test::MockModule->new('Koha::Patron');
-        $patron_class->mock( 'password_expired', sub { return $password_expired; } );
+        my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
 
-        my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 1 } });
-        my $password = 'password';
-        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
-        $patron->set_password( { password => $password } );
+        my $password = set_weak_password($patron);
+        $patron->password_expiration_date( dt_from_string->subtract(days => 1) )->store;
 
-        my $cgi_mock = Test::MockModule->new('CGI')->mock( 'request_method', 'POST' );
-        my $cgi = CGI->new;
-        $cgi->param( -name => 'userid',   -value => $patron->userid );
-        $cgi->param( -name => 'password', -value => $password );
+        my $cgi_mock = Test::MockModule->new('CGI');
+        $cgi_mock->mock( 'request_method', sub { return 'POST' } );
+        my $cgi  = CGI->new;
+        # Simulating the login form submission
+        $cgi->param( 'userid',   $patron->userid );
+        $cgi->param( 'password', $password );
 
-        my $auth = Test::MockModule->new( 'C4::Auth' );
-        # Tests will fail if we hit safe_exit
-        $auth->mock( 'safe_exit', sub { return } );
-
-        my ( $userid, $cookie, $sessionID, $flags );
-
-        {
-            t::lib::Mocks::mock_preference( 'DumpTemplateVarsOpac', 1 );
-            # checkauth will redirect and safe_exit if not authenticated and not authorized
-            local *STDOUT;
-            my $stdout;
-            open STDOUT, '>', \$stdout;
-
-            # Password has expired
-            $password_expired = 1;
-            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 } );
-            like( $stdout, qr{'password_has_expired' => 1}, 'password_has_expired is set to 1' );
-
-            close STDOUT;
-        };
+        my ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+        is( $template->{VARS}->{password_has_expired}, 1 );
     };
 
     subtest 'Reset auth state when changing users' => sub {
@@ -173,8 +153,6 @@ subtest 'checkauth() tests' => sub {
             C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
         is( $return, 'ok', 'Patron authenticated' );
 
-        my $mock1 = Test::MockModule->new('C4::Auth');
-        $mock1->mock( 'safe_exit', sub { return 'safe_exit_redirect' } );
         my $mock2 = Test::MockModule->new('CGI');
         $mock2->mock( 'request_method', 'POST' );
         $mock2->mock( 'cookie',         sub { return $sessionID; } );    # oversimplified..
@@ -183,21 +161,14 @@ subtest 'checkauth() tests' => sub {
         $cgi->param( -name => 'userid',             -value => 'Bond' );
         $cgi->param( -name => 'password',           -value => 'James Bond' );
         $cgi->param( -name => 'koha_login_context', -value => 1 );
-        my ( @return, $stdout );
-        {
-            local *STDOUT;
-            local %ENV;
-            $ENV{REMOTE_ADDR} = '1.2.3.4';
-            open STDOUT, '>', \$stdout;
-            @return = C4::Auth::checkauth( $cgi, 0, {} );
-            close STDOUT;
-        }
-        is( $return[0], 'safe_exit_redirect', 'Changing to non-existent user causes a redirect to login' );
+        my ( $userid, $cookie, $flags, $template );
+        ( $userid, $cookie, $sessionID, $flags, $template ) =
+            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+        is( $template->{VARS}->{loginprompt}, 1, 'Changing to non-existent user causes a redirect to login' );
     };
 
-
     subtest 'While still logged in, relogin with another user' => sub {
-        plan tests => 6;
+        plan tests => 5;
 
         my $patron = $builder->build_object({ class => 'Koha::Patrons', value => {} });
         my $patron2 = $builder->build_object({ class => 'Koha::Patrons', value => {} });
@@ -209,36 +180,28 @@ subtest 'checkauth() tests' => sub {
         $session->param( 'lasttime',     time() );
         $session->param( 'interface',    'opac' );
         $session->flush;
-        my $sessionID = $session->id;
-        C4::Context->_new_userenv($sessionID);
+        my $previous_sessionID = $session->id;
+        C4::Context->_new_userenv($previous_sessionID);
 
-        my ( $return ) = C4::Auth::check_cookie_auth( $sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
+        my ( $return ) = C4::Auth::check_cookie_auth( $previous_sessionID, undef, { skip_version_check => 1, remote_addr => '1.2.3.4' } );
         is( $return, 'ok', 'Former session in shape now' );
 
         my $mock1 = Test::MockModule->new('C4::Auth');
         $mock1->mock( 'safe_exit', sub {} );
         my $mock2 = Test::MockModule->new('CGI');
         $mock2->mock( 'request_method', 'POST' );
-        $mock2->mock( 'cookie', sub { return $sessionID; } ); # oversimplified..
+        $mock2->mock( 'cookie', sub { return $previous_sessionID; } ); # oversimplified..
         my $cgi = CGI->new;
         my $password = 'Incr3d1blyZtr@ng93$';
         $patron2->set_password({ password => $password });
         $cgi->param( -name => 'userid',             -value => $patron2->userid );
         $cgi->param( -name => 'password',           -value => $password );
         $cgi->param( -name => 'koha_login_context', -value => 1 );
-        my ( @return, $stdout );
-        {
-            local *STDOUT;
-            local %ENV;
-            $ENV{REMOTE_ADDR} = '1.2.3.4';
-            open STDOUT, '>', \$stdout;
-            @return = C4::Auth::checkauth( $cgi, 0, {} );
-            close STDOUT;
-        }
-        # Note: We can test return values from checkauth here since we mocked the safe_exit after the Redirect 303
-        is( $return[0], $patron2->userid, 'Login of patron2 approved' );
-        isnt( $return[2], $sessionID, 'Did not return previous session ID' );
-        ok( $return[2], 'New session ID not empty' );
+        my ( $userid, $cookie, $sessionID, $flags, $template ) =
+            C4::Auth::checkauth( $cgi, 0, {}, 'opac', undef, undef, { do_not_print => 1 } );
+        is( $userid, $patron2->userid, 'Login of patron2 approved' );
+        isnt( $sessionID, $previous_sessionID, 'Did not return previous session ID' );
+        ok( $sessionID, 'New session ID not empty' );
 
         # Similar situation: Relogin with former session of $patron, new user $patron2 has no permissions
         $patron2->flags(undef)->store;
@@ -246,22 +209,14 @@ subtest 'checkauth() tests' => sub {
         $session->param( 'id',           $patron->userid );
         $session->param( 'interface',    'intranet' );
         $session->flush;
-        $sessionID = $session->id;
-        C4::Context->_new_userenv($sessionID);
+        $previous_sessionID = $session->id;
+        C4::Context->_new_userenv($previous_sessionID);
         $cgi->param( -name => 'userid',             -value => $patron2->userid );
         $cgi->param( -name => 'password',           -value => $password );
         $cgi->param( -name => 'koha_login_context', -value => 1 );
-        {
-            local *STDOUT;
-            local %ENV;
-            $ENV{REMOTE_ADDR} = '1.2.3.4';
-            $stdout = q{};
-            open STDOUT, '>', \$stdout;
-            @return = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' ); # patron2 has no catalogue perm
-            close STDOUT;
-        }
-        like( $stdout, qr/You do not have permission to access this page/, 'No permission response' );
-        is( @return, 0, 'checkauth returned failure' );
+        ( $userid, $cookie, $sessionID, $flags, $template ) =
+            C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+        is( $template->{VARS}->{nopermission}, 1, 'No permission response' );
     };
 
     subtest 'Two-factor authentication' => sub {
@@ -405,10 +360,8 @@ subtest 'no_set_userenv parameter tests' => sub {
 
     my $library = $builder->build_object( { class => 'Koha::Libraries' } );
     my $patron  = $builder->build_object( { class => 'Koha::Patrons' } );
-    my $password = 'password';
 
-    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
-    $patron->set_password({ password => $password });
+    my $password = set_weak_password($patron);
 
     ok( checkpw( $patron->userid, $password, undef, undef, 1 ), 'checkpw returns true' );
     is( C4::Context->userenv, undef, 'Userenv should be undef as required' );
@@ -427,10 +380,8 @@ subtest 'checkpw lockout tests' => sub {
 
     my $library = $builder->build_object( { class => 'Koha::Libraries' } );
     my $patron  = $builder->build_object( { class => 'Koha::Patrons' } );
-    my $password = 'password';
-    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
+    my $password = set_weak_password($patron);
     t::lib::Mocks::mock_preference( 'FailedLoginAttempts', 1 );
-    $patron->set_password({ password => $password });
 
     my ( $checkpw, undef, undef ) = checkpw( $patron->cardnumber, $password, undef, undef, 1 );
     ok( $checkpw, 'checkpw returns true with right password when logging in via cardnumber' );
@@ -749,13 +700,11 @@ subtest 'check_cookie_auth' => sub {
 };
 
 subtest 'checkauth & check_cookie_auth' => sub {
-    plan tests => 31;
+    plan tests => 30;
 
     # flags = 4 => { catalogue => 1 }
     my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 4 } });
-    my $password = 'password';
-    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
-    $patron->set_password( { password => $password } );
+    my $password = set_weak_password($patron);
 
     my $cgi_mock = Test::MockModule->new('CGI');
     $cgi_mock->mock( 'request_method', sub { return 'POST' } );
@@ -782,16 +731,10 @@ subtest 'checkauth & check_cookie_auth' => sub {
     my $first_sessionID = $sessionID;
 
     $ENV{"HTTP_COOKIE"} = "CGISESSID=$sessionID";
-    # Not authenticated yet, checkauth didn't return the session
-    {
-        local *STDOUT;
-        my $stdout;
-        open STDOUT, '>', \$stdout;
-        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1} );
-        close STDOUT;
-    }
-    is( $sessionID, undef);
-    is( $userid, undef);
+    # Not authenticated yet, the login form is displayed
+    my $template;
+    ( $userid, $cookie, $sessionID, $flags, $template ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1}, 'intranet', undef, undef, { do_not_print => 1 } );
+    is( $template->{VARS}->{loginprompt}, 1, );
 
     # Sending undefined fails obviously
     my ( $auth_status, $session ) = C4::Auth::check_cookie_auth($sessionID, {catalogue => 1} );
@@ -814,13 +757,9 @@ subtest 'checkauth & check_cookie_auth' => sub {
     # Logging out!
     $cgi->param('logout.x', 1);
     $cgi->delete( 'userid', 'password' );
-    {
-        local *STDOUT;
-        my $stdout;
-        open STDOUT, '>', \$stdout;
-        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth($cgi, 0, {catalogue => 1});
-        close STDOUT;
-    }
+    ( $userid, $cookie, $sessionID, $flags, $template ) =
+        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+
     is( $sessionID, undef );
     is( $ENV{"HTTP_COOKIE"}, "CGISESSID=$first_sessionID", 'HTTP_COOKIE not unset' );
     ( $auth_status, $session) = C4::Auth::check_cookie_auth( $first_sessionID, {catalogue => 1} );
@@ -952,8 +891,7 @@ subtest 'checkpw() return values tests' => sub {
         $C4::Auth::ldap = 0;
 
         my $patron   = $builder->build_object( { class => 'Koha::Patrons' } );
-        my $password = 'thePassword123';
-        $patron->set_password( { password => $password, skip_validation => 1 } );
+        my $password = set_weak_password($patron);
 
         my $patron_to_delete  = $builder->build_object( { class => 'Koha::Patrons' } );
         my $unused_userid     = $patron_to_delete->userid;
@@ -1145,3 +1083,11 @@ subtest 'checkpw() return values tests' => sub {
         $schema->storage->txn_rollback;
     };
 };
+
+sub set_weak_password {
+    my ($patron) = @_;
+    my $password = 'password';
+    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
+    $patron->set_password( { password => $password } );
+    return $password;
+}

From c466bda90217cc418b6e963c50d07259854d46fc Mon Sep 17 00:00:00 2001
From: Victor Grousset/tuxayo <victor@tuxayo.net>
Date: Thu, 15 Feb 2024 04:18:37 +0100
Subject: [PATCH 17/56] Bug 35904: (QA follow-up): tidy up code

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Auth.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 856960e680..8adbc78173 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -824,7 +824,7 @@ sub checkauth {
     my $type            = shift;
     my $emailaddress    = shift;
     my $template_name   = shift;
-    my $params          = shift || {}; # do_not_print
+    my $params          = shift || {};    # do_not_print
     $type = 'opac' unless $type;
 
     if ( $type eq 'opac' && !C4::Context->preference("OpacPublic") ) {
@@ -1354,7 +1354,7 @@ sub checkauth {
             $uri->query_param_delete('password');
             $uri->query_param_delete('koha_login_context');
             unless ( $params->{do_not_print} ) {
-                print $query->redirect(-uri => $uri->as_string, -cookie => $cookie, -status=>'303 See other');
+                print $query->redirect( -uri => $uri->as_string, -cookie => $cookie, -status => '303 See other' );
                 safe_exit;
             }
         }

From d5c8cb1f2162a2304d64d19de1e0ac04ddb55159 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 24 Jan 2024 16:24:51 +0100
Subject: [PATCH 18/56] Bug 35890: Remove var loggedin

It is never used and add confusion

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Auth.pm | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 8adbc78173..edc5e3ba64 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -847,7 +847,6 @@ sub checkauth {
     _version_check( $type, $query );
 
     # state variables
-    my $loggedin = 0;
     my $auth_state = 'failed';
     my %info;
     my ( $userid, $cookie, $sessionID, $flags );
@@ -884,7 +883,6 @@ sub checkauth {
             -secure => ( C4::Context->https_enabled() ? 1 : 0 ),
             -sameSite => 'Lax',
         ));
-        $loggedin = 1;
     }
     elsif ( $emailaddress) {
         # the Google OpenID Connect passes an email address
@@ -1228,7 +1226,6 @@ sub checkauth {
                         my $domain = $branches->{$branchcode}->{'branchip'};
                         $domain =~ s|\.\*||g;
                         if ( $ip !~ /^$domain/ ) {
-                            $loggedin = 0;
                             $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
                                 -name     => 'CGISESSID',
                                 -value    => '',

From 97b8502be760120c3f55fe5755defbe2799d6c67 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 24 Jan 2024 16:25:30 +0100
Subject: [PATCH 19/56] Bug 35890: Reject login if IP is not valid

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Auth.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index edc5e3ba64..65de5a8df7 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1234,6 +1234,7 @@ sub checkauth {
                                 -sameSite => 'Lax',
                             ));
                             $info{'wrongip'} = 1;
+                            $auth_state = "failed";
                         }
                     }
 

From 02103fa0d858b726f4c34caab2b9b403a86cb3f0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 25 Jan 2024 09:36:01 +0100
Subject: [PATCH 20/56] Bug 35890: Add tests for AutoLocation

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 t/db_dependent/Auth.t | 53 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index df6b8f1397..c11ea42e6b 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -10,7 +10,7 @@ use CGI qw ( -utf8 );
 use Test::MockObject;
 use Test::MockModule;
 use List::MoreUtils qw/all any none/;
-use Test::More tests => 17;
+use Test::More tests => 18;
 use Test::Warn;
 use t::lib::Mocks;
 use t::lib::TestBuilder;
@@ -1084,6 +1084,57 @@ subtest 'checkpw() return values tests' => sub {
     };
 };
 
+subtest 'AutoLocation' => sub {
+
+    plan tests => 6;
+
+    $schema->storage->txn_begin;
+
+    t::lib::Mocks::mock_preference( 'AutoLocation', 0 );
+
+    my $patron   = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 1 } } );
+    my $password = 'password';
+    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
+    $patron->set_password( { password => $password } );
+
+    my $cgi_mock = Test::MockModule->new('CGI');
+    $cgi_mock->mock( 'request_method', sub { return 'POST' } );
+    my $cgi  = CGI->new;
+    my $auth = Test::MockModule->new('C4::Auth');
+
+    # Simulating the login form submission
+    $cgi->param( 'userid',   $patron->userid );
+    $cgi->param( 'password', $password );
+
+    $ENV{REMOTE_ADDR} = '127.0.0.1';
+    my ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
+    is( $userid, $patron->userid );
+
+    my $template;
+    t::lib::Mocks::mock_preference( 'AutoLocation', 1 );
+
+    # AutoLocation: "Require staff to log in from a computer in the IP address range specified by their library (if any)"
+    $patron->library->branchip('')->store;    # There is none, allow access from anywhere
+    ( $userid, $cookie, $sessionID, $flags, $template ) =
+        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
+    is( $userid,   $patron->userid );
+    is( $template, undef );
+
+    $patron->library->branchip('1.2.3.4')->store;
+    ( $userid, $cookie, $sessionID, $flags, $template ) =
+        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+    is( $template->{VARS}->{wrongip}, 1 );
+
+    $patron->library->branchip('127.0.0.1')->store;
+    ( $userid, $cookie, $sessionID, $flags, $template ) =
+        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
+    is( $userid,   $patron->userid );
+    is( $template, undef );
+
+    $schema->storage->txn_rollback;
+
+};
+
 sub set_weak_password {
     my ($patron) = @_;
     my $password = 'password';

From f6950c001aa0b5aa78d286544d87d771fec545a8 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 26 Jan 2024 08:57:03 +0100
Subject: [PATCH 21/56] Bug 35918: Add test

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 t/db_dependent/Auth.t | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index c11ea42e6b..606ebf3808 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -1086,7 +1086,7 @@ subtest 'checkpw() return values tests' => sub {
 
 subtest 'AutoLocation' => sub {
 
-    plan tests => 6;
+    plan tests => 7;
 
     $schema->storage->txn_begin;
 
@@ -1131,6 +1131,13 @@ subtest 'AutoLocation' => sub {
     is( $userid,   $patron->userid );
     is( $template, undef );
 
+    my $other_library = $builder->build_object( { class => 'Koha::Libraries', value => { branchip => '127.0.0.1' } } );
+    $patron->library->branchip('127.0.0.1')->store;
+    ( $userid, $cookie, $sessionID, $flags, $template ) =
+        C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet' );
+    my $session = C4::Auth::get_session($sessionID);
+    is( $session->param('branch'), $patron->branchcode );
+
     $schema->storage->txn_rollback;
 
 };

From 7b3a8e5c46d3c635a1ddcfa4cd6053c5669d36e6 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 26 Jan 2024 08:58:17 +0100
Subject: [PATCH 22/56] Bug 35918: Fix auto library connect (AutoLocation)

This code is a bit weird, its purpose it to auto select the library depending on the IP.
A problem appears if the same IP is used, then the user's choice will
might be overwritten randomly by another library.

To recreate the problem:
Turn on AutoLocation
Use koha/koha @CPL for test
And the following config:
*************************** 1. row ***************************
branchcode: CPL
branchname: Centerville
  branchip: 172.18.0.1
*************************** 2. row ***************************
branchcode: FFL
branchname: Fairfield
  branchip: 172.18.0.1
*************************** 3. row ***************************
branchcode: FPL
branchname: Fairview
  branchip: 172.18.0.4

Connect and select CPL. Randomly FFL will be picked instead.

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tested this on top of 35890 and 35904 because git bz said they were required dependencies.
Figured out the IP Koha was seeing me as coming from in /var/log/koha/kohadev/plack.log.
Added that IP to the branchip for Centerville, Fairfield and Fairview. Set AutoLocation = Yes.
After this I could recreate the problem: If i left the "Library" field in the login screen
at "My Library" I got logged into a random library selected from the three i had set
branchip for. Applying the patches fixed this, as expected.
Tests pass, with AutoLocation off.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Auth.pm | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 65de5a8df7..24ddc6c27a 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -26,6 +26,7 @@ use CGI::Session;
 use CGI::Session::ErrorHandler;
 use URI;
 use URI::QueryParam;
+use List::MoreUtils qw( uniq );
 
 use C4::Context;
 use C4::Templates;    # to get the template
@@ -1238,15 +1239,18 @@ sub checkauth {
                         }
                     }
 
-                    foreach my $br ( keys %$branches ) {
+                    if ( C4::Context->preference('AutoLocation') && $auth_state ne 'failed' ) {
+                        foreach my $br ( uniq( $branchcode, keys %$branches ) ) {
 
-                        #     now we work with the treatment of ip
-                        my $domain = $branches->{$br}->{'branchip'};
-                        if ( $domain && $ip =~ /^$domain/ ) {
-                            $branchcode = $branches->{$br}->{'branchcode'};
+                            #     now we work with the treatment of ip
+                            my $domain = $branches->{$br}->{'branchip'};
+                            if ( $domain && $ip =~ /^$domain/ ) {
+                                $branchcode = $branches->{$br}->{'branchcode'};
 
-                            # new op dev : add the branchname to the cookie
-                            $branchname    = $branches->{$br}->{'branchname'};
+                                # new op dev : add the branchname to the cookie
+                                $branchname = $branches->{$br}->{'branchname'};
+                                last;
+                            }
                         }
                     }
 

From c922f7304b2aef06c17c2e7668f29eaa5ee4e344 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Tue, 30 Jan 2024 10:58:02 -0500
Subject: [PATCH 23/56] Bug 35942: OPAC user can enroll several times to the
 same club [23.05.x]

Test Plan:

1) Create 3 clubs, 1 limited to library A, 1 limited to library B and one not limited
2) Use a patron with home library A.
3) Go to the opac-user page, "Clubs" tab show 0/2 (the one from library B is not listed)
4) Browse to /cgi-bin/koha/svc/club/enroll?id=1
5) Reload that page a couple times
6) Note the patron is now enrolled in the same club multiple times
7) Delete those enrollments
8) Apply this patch
9) Restart all the things!
10) Repeat steps 2-7, note the lack of duplicate enrollments!
11) Repeat steps 2-10 for the staff interface

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9bdab108e22768b018b017ed7c0e0016270f2570)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
---
 opac/svc/club/enroll | 51 +++++++++++++++++++++++++++-----------------
 svc/club/enroll      | 18 ++++++++++------
 2 files changed, 43 insertions(+), 26 deletions(-)

diff --git a/opac/svc/club/enroll b/opac/svc/club/enroll
index aff1d51fb9..249a2bdd09 100755
--- a/opac/svc/club/enroll
+++ b/opac/svc/club/enroll
@@ -30,8 +30,8 @@ use Koha::Clubs;
 
 my $cgi = CGI->new;
 
-my ( $auth_status ) =
-  check_cookie_auth( $cgi->cookie('CGISESSID') );
+my ($auth_status) =
+    check_cookie_auth( $cgi->cookie('CGISESSID') );
 if ( $auth_status ne "ok" ) {
     exit 0;
 }
@@ -42,31 +42,42 @@ my $id = $cgi->param('id');
 
 my $enrollment;
 if ( $borrowernumber && $id ) {
+    my $already_enrolled = Koha::Club::Enrollments->search(
+        {
+            club_id        => $id,
+            borrowernumber => $borrowernumber,
+            date_canceled  => undef,
+        }
+    )->count();
+
     my $club = Koha::Clubs->find($id);
 
-    if ( $club->club_template()->is_enrollable_from_opac() ) {
-        $enrollment = Koha::Club::Enrollment->new()->set(
-            {
-                club_id        => $club->id(),
-                borrowernumber => $borrowernumber,
-                date_enrolled  => \'NOW()',
-                date_created   => \'NOW()',
-                branchcode     => C4::Context->userenv
-                ? C4::Context->userenv->{'branch'}
-                : undef,
-            }
-        )->store();
+    my $wrong_branch = $club->branchcode && C4::Context->userenv && C4::Context->userenv->{branch} ne $club->branchcode;
 
-        my @enrollment_fields = $club->club_template()->club_template_enrollment_fields->as_list;
+    unless ( $already_enrolled || $wrong_branch ) {
 
-        foreach my $e (@enrollment_fields) {
-            Koha::Club::Enrollment::Field->new()->set(
+        if ( $club->club_template()->is_enrollable_from_opac() ) {
+            $enrollment = Koha::Club::Enrollment->new(
                 {
-                    club_enrollment_id                => $enrollment->id(),
-                    club_template_enrollment_field_id => $e->id(),
-                    value                             => $cgi->param( $e->id() ),
+                    club_id        => $club->id(),
+                    borrowernumber => $borrowernumber,
+                    date_enrolled  => \'NOW()',
+                    date_created   => \'NOW()',
+                    branchcode     => C4::Context->userenv ? C4::Context->userenv->{branch} : undef,
                 }
             )->store();
+
+            my @enrollment_fields = $club->club_template()->club_template_enrollment_fields->as_list;
+
+            foreach my $e (@enrollment_fields) {
+                Koha::Club::Enrollment::Field->new()->set(
+                    {
+                        club_enrollment_id                => $enrollment->id(),
+                        club_template_enrollment_field_id => $e->id(),
+                        value                             => scalar $cgi->param( $e->id() ),
+                    }
+                )->store();
+            }
         }
     }
 }
diff --git a/svc/club/enroll b/svc/club/enroll
index 9c88c54717..87c6cddfdc 100755
--- a/svc/club/enroll
+++ b/svc/club/enroll
@@ -30,8 +30,8 @@ use Koha::Clubs;
 
 my $cgi = CGI->new;
 
-my ( $auth_status ) =
-  check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
+my ($auth_status) =
+    check_cookie_auth( $cgi->cookie('CGISESSID'), { clubs => 'enroll' } );
 if ( $auth_status ne "ok" ) {
     exit 0;
 }
@@ -43,15 +43,21 @@ my $club = Koha::Clubs->find($id);
 
 my $enrollment;
 if ($club) {
+    my $already_enrolled = Koha::Club::Enrollments->search(
+        {
+            club_id        => $id,
+            borrowernumber => $borrowernumber,
+            date_canceled  => undef,
+        }
+    )->count();
+
     $enrollment = Koha::Club::Enrollment->new(
         {
             club_id        => $club->id(),
             borrowernumber => $borrowernumber,
-            date_enrolled  => \'NOW()',
-            date_created   => \'NOW()',
-            branchcode     => C4::Context->userenv ? C4::Context->userenv->{'branch'} : undef,
+            date_canceled  => undef,
         }
-    )->store();
+    )->store() unless $already_enrolled;
 
     if ($enrollment) {
         my @enrollment_fields = $club->club_template()->club_template_enrollment_fields->as_list;

From e038ec2709080faaa76c29334bfcffbd00f74a9c Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 27 Jul 2023 07:45:57 -0400
Subject: [PATCH 24/56] Bug 30524: (QA follow-up) Only generate CSRF token if
 it will be used

This patch avoids generating CSRF tokens unless the csrf-token.inc file
is included in the template.

Passed token doesn't need HTML escaped. The docs for WWW::CSRF state:
  The returned CSRF token is in a text-only form suitable for inserting into a HTML form without further escaping (assuming you did not send in strange things to the Time option).

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit ddf1eb6cef14da365675890920ff72f010c59527)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 73ca151686b682aaa2b950ccbc89fcec14514112)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit b1bd7ec29a0febddc210dbdc3bef0a78e37c7719)
---
 C4/Auth.pm                                    |  1 -
 Koha/Template/Plugin/Koha.pm                  | 27 +++++++++++++++++++
 .../prog/en/includes/csrf-token.inc           |  4 ++-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 24ddc6c27a..bb3f661b14 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -303,7 +303,6 @@ sub get_template_and_user {
         $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
         $template->param( logged_in_user     => $patron );
         $template->param( sessionID          => $sessionID );
-        $template->param( csrf_token => Koha::Token->new->generate_csrf({ session_id => scalar $sessionID }));
 
         if ( $in->{'type'} eq 'opac' ) {
             require Koha::Virtualshelves;
diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm
index 5e7a303f70..ec5f975eb7 100644
--- a/Koha/Template/Plugin/Koha.pm
+++ b/Koha/Template/Plugin/Koha.pm
@@ -22,6 +22,7 @@ use Modern::Perl;
 use base qw( Template::Plugin );
 
 use C4::Context;
+use Koha::Token;
 use Koha;
 
 =head1 NAME
@@ -48,8 +49,22 @@ is necessary.
 
 =head2 Class Methods
 
+=head3 new
+
+This new method allows us to store the context which gives us
+access to the template vars already set. In particular this gives
+us access to the template vars set by C4::Auth::get_template_and_user
+
 =cut
 
+sub new {
+    my ( $class, $context ) = @_;
+    bless {
+        _CONTEXT => $context,
+    }, $class;
+}
+
+
 sub Preference {
     my ( $self, $pref ) = @_;
     return C4::Context->preference( $pref );
@@ -84,4 +99,16 @@ sub Version {
     };
 }
 
+=head3 GenerateCSRF
+
+Generate a new CSRF token.
+
+=cut
+
+sub GenerateCSRF {
+    my ($self) = @_;
+    my $session_id = $self->{_CONTEXT}->stash->{sessionID};
+    return Koha::Token->new->generate_csrf( { session_id => scalar $session_id } );
+}
+
 1;
diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
index 703d4eb036..bfc221faf4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/csrf-token.inc
@@ -1 +1,3 @@
-<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+[%- USE Koha %]
+[%- USE raw %]
+<input type="hidden" name="csrf_token" value="[% Koha.GenerateCSRF | $raw %]" />

From 6729dc0ddedd6542a9be4268378c2a47e1ad2b2a Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Thu, 27 Jul 2023 15:33:55 -0300
Subject: [PATCH 25/56] Bug 30524: (QA follow-up) Unit tests for GenerateCSRF()

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 60d11ae7251a227fab3977ecd61cb01d0f062f79)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit d4187c77eb3b39977b759af7df7641e70cd96358)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 26ab7e0b200ac8e5fe4d88603996d823bf63d8bc)
---
 t/db_dependent/Koha/Template/Plugin/Koha.t | 49 ++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100755 t/db_dependent/Koha/Template/Plugin/Koha.t

diff --git a/t/db_dependent/Koha/Template/Plugin/Koha.t b/t/db_dependent/Koha/Template/Plugin/Koha.t
new file mode 100755
index 0000000000..98318bdd53
--- /dev/null
+++ b/t/db_dependent/Koha/Template/Plugin/Koha.t
@@ -0,0 +1,49 @@
+#!/usr/bin/env perl
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+
+use Test::More tests => 1;
+
+use Template::Context;
+use Template::Stash;
+
+use C4::Auth;
+use Koha::Database;
+use Koha::Template::Plugin::Koha;
+
+my $schema = Koha::Database->new->schema;
+
+subtest 'GenerateCSRF() tests' => sub {
+
+    plan tests => 1;
+
+    $schema->storage->txn_begin;
+
+    my $session = C4::Auth::get_session('');
+
+    my $stash   = Template::Stash->new( { sessionID => $session->id } );
+    my $context = Template::Context->new( { STASH => $stash } );
+
+    my $plugin = Koha::Template::Plugin::Koha->new($context);
+
+    my $token = $plugin->GenerateCSRF();
+
+    ok( Koha::Token->new->check_csrf( { session_id => $session->id, token => $token } ) );
+
+    $schema->storage->txn_rollback;
+};

From 3a18cec9f92beb565d65376092d7ce8782a7abb6 Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Fri, 28 Jul 2023 10:40:28 -0300
Subject: [PATCH 26/56] Bug 30524: (QA follow-up) Fix tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 158edb411b32253fae4f068ce416d6ad4d1a67d3)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 38725ed0af95c318077c46f337795054e31c60e4)
---
 t/db_dependent/Auth.t | 1 -
 1 file changed, 1 deletion(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index 606ebf3808..d2b7873146 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -539,7 +539,6 @@ subtest 'get_template_and_user' => sub {   # Tests for the language URL paramete
     );
     is($template->{VARS}->{'opac_name'}, "multibranch-19", "Opac name was set correctly");
     is($template->{VARS}->{'opac_search_limit'}, "branch:multibranch-19", "Search limit was set correctly");
-    ok(defined($template->{VARS}->{'csrf_token'}), "CSRF token returned");
 
     delete $ENV{"HTTP_COOKIE"};
 };

From 569a6cbdecb7f9baa21a5ca5322f2d5ae57a00b8 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 14 Feb 2024 10:56:17 +0100
Subject: [PATCH 27/56] Bug 36092: Add test

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7bc46ea231c3e63e017da2a26a7a8918ed161cab)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit 14cce4e9364792e93c50a1d6bed01d4e85d150d4)
---
 t/db_dependent/Auth.t | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index d2b7873146..9ae2f68ade 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -42,7 +42,7 @@ $schema->storage->txn_begin;
 
 subtest 'checkauth() tests' => sub {
 
-    plan tests => 8;
+    plan tests => 9;
 
     my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => undef } });
 
@@ -110,11 +110,35 @@ subtest 'checkauth() tests' => sub {
         is( $userid, undef, 'If librarian user is used and password with GET, they should not be logged in' );
     };
 
-    subtest 'Template params tests (password_expired)' => sub {
+    subtest 'sessionID should be passed to the template for auth' => sub {
 
         plan tests => 1;
 
-        my $password_expired;
+        subtest 'hit auth.tt' => sub {
+
+            plan tests => 1;
+
+            my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 0 } } );
+
+            my $password = set_weak_password($patron);
+
+            my $cgi_mock = Test::MockModule->new('CGI');
+            $cgi_mock->mock( 'request_method', sub { return 'POST' } );
+            my $cgi = CGI->new;
+
+            # Simulating the login form submission
+            $cgi->param( 'userid',   $patron->userid );
+            $cgi->param( 'password', $password );
+
+            my ( $userid, $cookie, $sessionID, $flags, $template ) =
+                C4::Auth::checkauth( $cgi, 0, { catalogue => 1 }, 'intranet', undef, undef, { do_not_print => 1 } );
+            ok( $template->{VARS}->{sessionID} );
+        };
+    };
+
+    subtest 'Template params tests (password_expired)' => sub {
+
+        plan tests => 1;
 
         my $patron = $builder->build_object( { class => 'Koha::Patrons' } );
 

From b8539cc35c066cec9d908ad6b48eccec45c4315c Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 14 Feb 2024 10:33:11 +0100
Subject: [PATCH 28/56] Bug 36092: Pass the sessionID from checkauth if we hit
 auth

If we hit the auth page we were not passing sessionID to the template

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0decb260343455caabd4101b0b0e9499723f2951)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit 9580111a206522e90a76d0fbaafdaaca0401d6fd)
---
 C4/Auth.pm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index bb3f661b14..2096f8a31f 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1488,8 +1488,9 @@ sub checkauth {
 
     $template->param(
         LibraryName => C4::Context->preference("LibraryName"),
+        %info,
+        sessionID => $session->id,
     );
-    $template->param(%info);
 
     if ( $params->{do_not_print} ) {
         # This must be used for testing purpose only!

From 3882d8d7a7d783928ec021017315b6762113a92d Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 14 Feb 2024 09:45:45 +0100
Subject: [PATCH 29/56] Bug 36092: Pass sessionID at the end of
 get_template_and_user

It seems safer to pass the logged in user and session info at the end of
the sub.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c50372c0b5c490971e4e336541aa85fbb45033d2)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit 2ba597ea70612aec6880a583e9436da2367b5644)
---
 C4/Auth.pm | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 2096f8a31f..33f69a5152 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -277,12 +277,12 @@ sub get_template_and_user {
     }
 
     my $borrowernumber;
+    my $patron;
     if ($user) {
 
         # It's possible for $user to be the borrowernumber if they don't have a
         # userid defined (and are logging in through some other method, such
         # as SSL certs against an email address)
-        my $patron;
         $borrowernumber = getborrowernumber($user) if defined($user);
         if ( !defined($borrowernumber) && defined($user) ) {
             $patron = Koha::Patrons->find( $user );
@@ -298,12 +298,6 @@ sub get_template_and_user {
             # FIXME What to do if $patron does not exist?
         }
 
-        # user info
-        $template->param( loggedinusername   => $user ); # OBSOLETE - Do not reuse this in template, use logged_in_user.userid instead
-        $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
-        $template->param( logged_in_user     => $patron );
-        $template->param( sessionID          => $sessionID );
-
         if ( $in->{'type'} eq 'opac' ) {
             require Koha::Virtualshelves;
             my $some_private_shelves = Koha::Virtualshelves->get_some_shelves(
@@ -447,8 +441,6 @@ sub get_template_and_user {
             }
         }
 
-        $template->param( sessionID => $sessionID );
-
         if ( $in->{'type'} eq 'opac' ){
             require Koha::Virtualshelves;
             my $some_public_shelves = Koha::Virtualshelves->get_some_shelves(
@@ -664,6 +656,12 @@ sub get_template_and_user {
         $cookie = $cookie_mgr->replace_in_list( $cookie, $languagecookie );
     }
 
+    # user info
+    $template->param( loggedinusername   => $user ); # OBSOLETE - Do not reuse this in template, use logged_in_user.userid instead
+    $template->param( loggedinusernumber => $borrowernumber ); # FIXME Should be replaced with logged_in_user.borrowernumber
+    $template->param( logged_in_user     => $patron );
+    $template->param( sessionID          => $sessionID );
+
     return ( $template, $borrowernumber, $cookie, $flags );
 }
 

From 63b4195e20f0aaba9b1cc44c64c1de6a55e1c295 Mon Sep 17 00:00:00 2001
From: Nick Clemens <nick@bywatersolutions.com>
Date: Fri, 26 Jan 2024 14:10:01 +0000
Subject: [PATCH 30/56] Bug 35518: Check authentication and set userenv before
 fetching userenv variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we get the userenv before we have set it correctly for the session

To test:
 1 - Sign in as a user with fast cataloging permission
 2 - Bring up a patron, type gibberish into barcode field to get a fast cataloging link
 3 - Check the link, it should have your current signed in barcode
 4 - Sign in to a different browser with a different user and at a different branch
 5 - Bring up a aptron in circulation and type gibberish into barcode field to get a fast cataloging link
 6 - It may have your branch, but it may also have the other user's branch from the other window
 7 - Keep entering gibberish to get a link until one user has the correct branch
 8 - Then switch to the other browser, and keep entering gibberish, watch the branchcode change
 9 - Apply patch, restart all
10 - Test switching between browsers. generating fast cataloging links
11 - Users should now consistently have the correct branch

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 90b6f68616e2ba5ca3fcbbd9698c97ef41a45593)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 26722f2a08af99b9e3cb4eb50398df896085f527)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 1460974627a7c094144fe4b834f07a5ee0c5b493)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit 70c86eb8926def78636e69b02d4ad47cecce6323)
---
 circ/circulation.pl | 64 +++++++++++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 23 deletions(-)

diff --git a/circ/circulation.pl b/circ/circulation.pl
index 3f84be9314..eef1442de7 100755
--- a/circ/circulation.pl
+++ b/circ/circulation.pl
@@ -62,30 +62,9 @@ use List::MoreUtils qw( uniq );
 #
 my $query = CGI->new;
 
-my $override_high_holds     = $query->param('override_high_holds');
-my $override_high_holds_tmp = $query->param('override_high_holds_tmp');
-
-my $sessionID = $query->cookie("CGISESSID") ;
-my $session = get_session($sessionID);
-
+my $borrowernumber = $query->param('borrowernumber');
 my $barcodes = [];
 my $barcode =  $query->param('barcode');
-my $findborrower;
-my $autoswitched;
-my $borrowernumber = $query->param('borrowernumber');
-
-if (C4::Context->preference("AutoSwitchPatron") && $barcode) {
-    my $new_barcode = $barcode;
-    Koha::Plugins->call( 'patron_barcode_transform', \$new_barcode );
-    if (Koha::Patrons->search( { cardnumber => $new_barcode} )->count() > 0) {
-        $findborrower = $barcode;
-        undef $barcode;
-        undef $borrowernumber;
-        $autoswitched = 1;
-    }
-}
-$findborrower ||= $query->param('findborrower') || q{};
-$findborrower =~ s|,| |g;
 
 # Barcode given by user could be '0'
 if ( $barcode || ( defined($barcode) && $barcode eq '0' ) ) {
@@ -104,7 +83,6 @@ if ( $barcode || ( defined($barcode) && $barcode eq '0' ) ) {
         @$barcodes = $query->multi_param('barcodes');
     }
 }
-
 $barcodes = [ uniq @$barcodes ];
 
 my $template_name = q|circ/circulation.tt|;
@@ -130,6 +108,46 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user (
         flagsrequired   => { circulate => 'circulate_remaining_permissions' },
     }
 );
+
+my $override_high_holds     = $query->param('override_high_holds');
+my $override_high_holds_tmp = $query->param('override_high_holds_tmp');
+
+my $sessionID = $query->cookie("CGISESSID") ;
+my $session = get_session($sessionID);
+
+my $userenv = C4::Context->userenv;
+my $branch  = $userenv->{'branch'} // '';
+my $desk_id = $userenv->{"desk_id"} || '';
+
+my $findborrower;
+my $autoswitched;
+
+if (C4::Context->preference("AutoSwitchPatron") && $barcode) {
+    my $new_barcode = $barcode;
+    Koha::Plugins->call( 'patron_barcode_transform', \$new_barcode );
+    if (Koha::Patrons->search( { cardnumber => $new_barcode} )->count() > 0) {
+        $findborrower = $barcode;
+        undef $barcode;
+        undef $borrowernumber;
+        $autoswitched = 1;
+    }
+}
+$findborrower ||= $query->param('findborrower') || q{};
+$findborrower =~ s|,| |g;
+
+if ( $query->param('confirm_hold') ) {
+    my $reserve_id          = $query->param('confirm_hold');
+    my $hold_branch         = $query->param('hold_branch');
+    my $hold_itemnumber     = $query->param('hold_itemnumber');
+    my $hold_borrowernumber = $query->param('hold_borrowernumber');
+    my $diffBranchSend      = ( $branch ne $hold_branch );
+
+    # diffBranchSend tells ModReserveAffect whether document is expected in this library or not,
+    # i.e., whether to apply waiting status
+    ModReserveAffect( $hold_itemnumber, $hold_borrowernumber, $diffBranchSend, $reserve_id, $desk_id );
+}
+
+
 my $logged_in_user = Koha::Patrons->find( $loggedinuser );
 
 my $force_allow_issue = $query->param('forceallow') || 0;

From 808c1874086b85aeb07832a39d45ae4faa6cda2e Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 8 Feb 2024 15:55:43 +0000
Subject: [PATCH 31/56] Bug 35518: Tidy the moved blocks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch just tidies the moved blocks to get us past the QA script
check.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit b577b6567045184adcb5bb55b7e5c70428e124ee)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1f182d45aba607dbfaf63c98f97b8615e5eea09d)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit d44a697788c947b9deb08aafaeb965f0e2b069f0)
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit 870c18a6545092de9fd50c187f68dd0d6574b56b)
---
 circ/circulation.pl | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/circ/circulation.pl b/circ/circulation.pl
index eef1442de7..eea6e2d7c2 100755
--- a/circ/circulation.pl
+++ b/circ/circulation.pl
@@ -63,8 +63,8 @@ use List::MoreUtils qw( uniq );
 my $query = CGI->new;
 
 my $borrowernumber = $query->param('borrowernumber');
-my $barcodes = [];
-my $barcode =  $query->param('barcode');
+my $barcodes       = [];
+my $barcode        = $query->param('barcode');
 
 # Barcode given by user could be '0'
 if ( $barcode || ( defined($barcode) && $barcode eq '0' ) ) {
@@ -112,8 +112,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user (
 my $override_high_holds     = $query->param('override_high_holds');
 my $override_high_holds_tmp = $query->param('override_high_holds_tmp');
 
-my $sessionID = $query->cookie("CGISESSID") ;
-my $session = get_session($sessionID);
+my $sessionID = $query->cookie("CGISESSID");
+my $session   = get_session($sessionID);
 
 my $userenv = C4::Context->userenv;
 my $branch  = $userenv->{'branch'} // '';
@@ -122,10 +122,10 @@ my $desk_id = $userenv->{"desk_id"} || '';
 my $findborrower;
 my $autoswitched;
 
-if (C4::Context->preference("AutoSwitchPatron") && $barcode) {
+if ( C4::Context->preference("AutoSwitchPatron") && $barcode ) {
     my $new_barcode = $barcode;
     Koha::Plugins->call( 'patron_barcode_transform', \$new_barcode );
-    if (Koha::Patrons->search( { cardnumber => $new_barcode} )->count() > 0) {
+    if ( Koha::Patrons->search( { cardnumber => $new_barcode } )->count() > 0 ) {
         $findborrower = $barcode;
         undef $barcode;
         undef $borrowernumber;

From f79702cc0edeb4a852e683f9890f78f213980e79 Mon Sep 17 00:00:00 2001
From: Andreas Jonsson <andreas.jonsson@kreablo.se>
Date: Thu, 8 Feb 2024 11:57:03 +0100
Subject: [PATCH 32/56] Bug 36034: (bug 34893 follow-up) fix capture of return
 values from checkpw

Adapt code to the change of return value type of checkpw
introduced in bug 34893

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 C4/Auth.pm | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 33f69a5152..9ad264e18b 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1055,7 +1055,8 @@ sub checkauth {
             unless ($shibSuccess) {
                 if ( $cas && $query->param('ticket') ) {
                     my $retuserid;
-                    ( $return, $cardnumber, $retuserid, $cas_ticket ) =
+                    my $patron;
+                    ( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) =
                       checkpw( $userid, $password, $query, $type );
                     $userid = $retuserid;
                     $info{'invalidCasLogin'} = 1 unless ($return);
@@ -1123,8 +1124,9 @@ sub checkauth {
                             && $q_userid eq C4::Context->preference('AutoSelfCheckID') )
                       )
                     {
+                        my $patron;
 
-                        ( $return, $cardnumber, $retuserid, $cas_ticket ) =
+                        ( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) =
                           checkpw( $q_userid, $password, $query, $type );
                         $userid = $retuserid if ($retuserid);
                         $info{'invalid_username_or_password'} = 1 unless ($return);
@@ -1611,7 +1613,8 @@ sub check_api_auth {
                 return ( "failed", undef, undef );
             }
             my $newuserid;
-            ( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $userid, $password, $query );
+            my $patron;
+            ( $return, $cardnumber, $newuserid, $patron, $cas_ticket ) = checkpw( $userid, $password, $query );
         }
 
         if ( $return and haspermission( $userid, $flagsrequired ) ) {

From 9aa7b89960f2ee4bd45e1d691423378bfa4a649e Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 14 Feb 2024 08:49:33 +0100
Subject: [PATCH 33/56] Bug 36034: Add test

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
---
 t/db_dependent/Auth.t | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t
index 9ae2f68ade..5b09121884 100755
--- a/t/db_dependent/Auth.t
+++ b/t/db_dependent/Auth.t
@@ -42,7 +42,7 @@ $schema->storage->txn_begin;
 
 subtest 'checkauth() tests' => sub {
 
-    plan tests => 9;
+    plan tests => 10;
 
     my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => undef } });
 
@@ -136,6 +136,35 @@ subtest 'checkauth() tests' => sub {
         };
     };
 
+    subtest 'cas_ticket must be empty in session' => sub {
+
+        plan tests => 2;
+
+        my $patron = $builder->build_object(
+            { class => 'Koha::Patrons', value => { flags => 1 } } );
+        my $password = 'password';
+        t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
+        $patron->set_password( { password => $password } );
+        $cgi = Test::MockObject->new();
+        $cgi->mock( 'cookie', sub { return; } );
+        $cgi->mock(
+            'param',
+            sub {
+                my ( $self, $param ) = @_;
+                if    ( $param eq 'userid' )   { return $patron->userid; }
+                elsif ( $param eq 'password' ) { return $password; }
+                else                           { return; }
+            }
+        );
+
+        $cgi->mock( 'request_method', sub { return 'POST' } );
+        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired' );
+        is( $userid, $patron->userid, 'If librarian user is used and password with POST, they should be logged in' );
+        my $session = C4::Auth::get_session($sessionID);
+        is( $session->param('cas_ticket'), undef );
+
+    };
+
     subtest 'Template params tests (password_expired)' => sub {
 
         plan tests => 1;

From e395bd3c4aeb035b654a4361221d56277c3b9f57 Mon Sep 17 00:00:00 2001
From: Aleisha Amohia <aleishaamohia@hotmail.com>
Date: Wed, 28 Feb 2024 21:23:38 +0000
Subject: [PATCH 34/56] Increment version for 22.05.19 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
---
 Koha.pm                                   | 2 +-
 installer/data/mysql/db_revs/220519000.pl | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100755 installer/data/mysql/db_revs/220519000.pl

diff --git a/Koha.pm b/Koha.pm
index 148afdbac8..34e413ceea 100644
--- a/Koha.pm
+++ b/Koha.pm
@@ -29,7 +29,7 @@ use vars qw{ $VERSION };
 # - #4 : the developer version. The 4th number is the database subversion.
 #        used by developers when the database changes. updatedatabase take care of the changes itself
 #        and is automatically called by Auth.pm when needed.
-$VERSION = "22.05.18.000";
+$VERSION = "22.05.19.000";
 
 sub version {
     return $VERSION;
diff --git a/installer/data/mysql/db_revs/220519000.pl b/installer/data/mysql/db_revs/220519000.pl
new file mode 100755
index 0000000000..ca5e2f8928
--- /dev/null
+++ b/installer/data/mysql/db_revs/220519000.pl
@@ -0,0 +1,7 @@
+use Modern::Perl;
+
+return {
+    bug_number => undef,
+    description => 'Koha 22.05.19 release',
+    up => sub {},
+}

From 1c4c9e47f35d37e220f7c456adbcf23f7f6aa9fd Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Wed, 28 Feb 2024 21:50:56 +0000
Subject: [PATCH 35/56] Update release notes for 22.05.19 release

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../release_notes/release_notes_22_05_19.html | 329 ++++++++++++++++++
 misc/release_notes/release_notes_22_05_19.md  | 287 +++++++++++++++
 2 files changed, 616 insertions(+)
 create mode 100644 misc/release_notes/release_notes_22_05_19.html
 create mode 100644 misc/release_notes/release_notes_22_05_19.md

diff --git a/misc/release_notes/release_notes_22_05_19.html b/misc/release_notes/release_notes_22_05_19.html
new file mode 100644
index 0000000000..40b23bff5b
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_19.html
@@ -0,0 +1,329 @@
+<h1 id="releasenotesforkoha22.05.19">RELEASE NOTES FOR KOHA 22.05.19</h1>
+
+<p>28 Feb 2024</p>
+
+<p>Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:</p>
+
+<ul>
+<li><a href="http://koha-community.org">Koha Community</a></li>
+</ul>
+
+<p>Koha 22.05.19 can be downloaded from:</p>
+
+<ul>
+<li><a href="http://download.koha-community.org/koha-22.05.19.tar.gz">Download</a></li>
+</ul>
+
+<p>Installation instructions can be found at:</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Installation_Documentation">Koha Wiki</a></li>
+<li>OR in the INSTALL files that come in the tarball</li>
+</ul>
+
+<p>Koha 22.05.19 is a bugfix/maintenance release.</p>
+
+<p>It includes 11 bugfixes.</p>
+
+<p><strong>System requirements</strong></p>
+
+<p>You can learn about the system components (like OS and database) needed for running Koha on the <a href="https://wiki.koha-community.org/wiki/System_requirements_and_recommendations">community wiki</a>.</p>
+
+<h4 id="securitybugs">Security bugs</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29510">29510</a> objects.find should call search_limited if present</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30524">30524</a> Add base framework for dealing with CSRF in Koha</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35890">35890</a> AutoLocation system preference + setting the library IP field - can still login and unexpected results</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35918">35918</a> Incorrect library used when AutoLocation configured using the same IP</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35941">35941</a> OPAC user can guess clubs of other users</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942">35942</a> OPAC user can enroll several times to the same club</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36072">36072</a> Can request articles even if ArticleRequests is off</li>
+</ul>
+
+<h2 id="bugfixes">Bugfixes</h2>
+
+<h3 id="architectureinternalsandplumbing">Architecture, internals, and plumbing</h3>
+
+<h4 id="otherbugsfixed">Other bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36092">36092</a> sessionID not passed to the template on auth.tt</li>
+</ul>
+
+<h3 id="authentication">Authentication</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034">36034</a> cas_ticket is set to serialized patron object in session</li>
+</ul>
+
+<h3 id="circulation">Circulation</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35518">35518</a> Call to C4::Context->userenv happens before it's gets populated breaks code logic in circulation</li>
+</ul>
+
+<h3 id="testsuite">Test Suite</h3>
+
+<h4 id="otherbugsfixed">Other bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35904">35904</a> C4::Auth::checkauth cannot be tested easily</li>
+</ul>
+
+<h2 id="documentation">Documentation</h2>
+
+<p>The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is</p>
+
+<ul>
+<li><p><a href="http://koha-community.org/documentation/">Koha Documentation</a>
+As of the date of these release notes, the Koha manual is available in the following languages:</p></li>
+<li><p><a href="https://koha-community.org/manual/22.05//html/">Chinese (Traditional)</a> (61%)</p></li>
+<li><a href="https://koha-community.org/manual/22.05//html/">English</a> (100%)</li>
+<li><a href="https://koha-community.org/manual/22.05/en/html/">English (USA)</a></li>
+<li><a href="https://koha-community.org/manual/22.05/fr/html/">French</a> (39%)</li>
+<li><a href="https://koha-community.org/manual/22.05/de/html/">German</a> (40%)</li>
+<li><a href="https://koha-community.org/manual/22.05/hi/html/">Hindi</a> (75%)</li>
+</ul>
+
+<p>The Git repository for the Koha manual can be found at</p>
+
+<ul>
+<li><a href="https://gitlab.com/koha-community/koha-manual">Koha Git Repository</a></li>
+</ul>
+
+<h2 id="translations">Translations</h2>
+
+<p>Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:</p>
+
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (71%)
+- Dutch (83%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (100%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (61%)
+- Persian (fa_ARAB) (68%)
+- Polish (99%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (78%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+<p>Partial translations are available for various other languages.</p>
+
+<p>The Koha team welcomes additional translations; please see</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Translating_Koha">Koha Translation Info</a></li>
+</ul>
+
+<p>For information about translating Koha, and join the koha-translate 
+list to volunteer:</p>
+
+<ul>
+<li><a href="http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate">Koha Translate List</a></li>
+</ul>
+
+<p>The most up-to-date translations can be found at:</p>
+
+<ul>
+<li><a href="http://translate.koha-community.org/">Koha Translation</a></li>
+</ul>
+
+<h2 id="releaseteam">Release Team</h2>
+
+<p>The release team for Koha 22.05.19 is</p>
+
+<ul>
+<li><p>Release Manager: Katrin Fischer</p></li>
+<li><p>Release Manager assistants:</p>
+
+<ul>
+<li>Tomás Cohen Arazi</li>
+<li>Martin Renvoize</li>
+<li>Jonathan Druart</li>
+</ul></li>
+<li><p>QA Manager: Marcel de Rooy</p></li>
+<li><p>QA Team:</p>
+
+<ul>
+<li>Marcel de Rooy</li>
+<li>Julian Maurice</li>
+<li>Lucas Gass</li>
+<li>Victor Grousset</li>
+<li>Kyle M Hall</li>
+<li>Nick Clemens</li>
+<li>Martin Renvoize</li>
+<li>Tomás Cohen Arazi</li>
+<li>Aleisha Amohia</li>
+<li>Emily Lamancusa</li>
+<li>David Cook</li>
+<li>Jonathan Druart</li>
+<li>Pedor Amorim</li>
+</ul></li>
+<li><p>Topic Experts:</p>
+
+<ul>
+<li>UI Design -- Owen Leonard</li>
+<li>Zebra -- Fridolin Somers</li>
+<li>REST API -- Tomás Cohen Arazi</li>
+<li>ERM -- Matt Blenkinsop</li>
+<li>ILL -- Pedro Amorim</li>
+<li>SIP2 -- Matthias Meusburger</li>
+<li>CAS -- Matthias Meusburger</li>
+</ul></li>
+<li><p>Bug Wranglers:</p>
+
+<ul>
+<li>Aleisha Amohia</li>
+<li>Indranil Das Gupta</li>
+</ul></li>
+<li><p>Packaging Managers:</p>
+
+<ul>
+<li>Mason James</li>
+<li>Indranil Das Gupta</li>
+<li>Tomás Cohen Arazi</li>
+</ul></li>
+<li><p>Documentation Manager: Aude Charillon</p></li>
+<li><p>Documentation Team:</p>
+
+<ul>
+<li>Caroline Cyr La Rose</li>
+<li>Kelly McElligott</li>
+<li>Philip Orr</li>
+<li>Marie-Luce Laflamme</li>
+<li>Lucy Vaux-Harvey</li>
+</ul></li>
+<li><p>Translation Manager: Jonathan Druart</p></li>
+<li><p>Wiki curators: </p>
+
+<ul>
+<li>Thomas Dukleth</li>
+<li>Katrin Fischer</li>
+</ul></li>
+<li><p>Release Maintainers:</p>
+
+<ul>
+<li>23.11 -- Fridolin Somers</li>
+<li>23.05 -- Lucas Gass</li>
+<li>22.11 -- Frédéric Demians</li>
+<li>22.05 -- Danyon Sewell</li>
+</ul></li>
+<li><p>Release Maintainer assistants:</p>
+
+<ul>
+<li>22.05 -- Wainui Witika-Park</li>
+</ul></li>
+</ul>
+
+<h2 id="credits">Credits</h2>
+
+<p>We thank the following individuals who contributed patches to Koha 22.05.19</p>
+
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (5)
+- Nick Clemens (1)
+- Jonathan Druart (11)
+- Victor Grousset (1)
+- Kyle M Hall (3)
+- Andreas Jonsson (1)
+- Martin Renvoize (1)
+- Marcel de Rooy (1)
+</div>
+
+<p>We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.19</p>
+
+<div style="column-count: 2;">
+
+- ByWater-Solutions (4)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (12)
+- Kreablo AB (1)
+- PTFS-Europe (1)
+- Rijksmuseum (1)
+- Theke Solutions (5)
+</div>
+
+<p>We also especially thank the following individuals who tested patches
+for Koha</p>
+
+<div style="column-count: 2;">
+
+- Aleisha Amohia (6)
+- Tomás Cohen Arazi (1)
+- Matt Blenkinsop (6)
+- Frédéric Demians (2)
+- Jonathan Druart (2)
+- Magnus Enger (2)
+- Lucas Gass (1)
+- Victor Grousset (1)
+- Kyle M Hall (11)
+- David Nind (1)
+- Martin Renvoize (13)
+- Marcel de Rooy (3)
+- Fridolin Somers (4)
+- Wainui Witika-Park (13)
+</div>
+
+<p>We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.</p>
+
+<h2 id="revisioncontrolnotes">Revision control notes</h2>
+
+<p>The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:</p>
+
+<ul>
+<li><a href="https://git.koha-community.org/koha-community/koha">Koha Git Repository</a></li>
+</ul>
+
+<p>The branch for this version of Koha and future bugfixes in this release
+line is 22.05.x.</p>
+
+<h2 id="bugsandfeaturerequests">Bugs and feature requests</h2>
+
+<p>Bug reports and feature requests can be filed at the Koha bug
+tracker at:</p>
+
+<ul>
+<li><a href="http://bugs.koha-community.org">Koha Bugzilla</a></li>
+</ul>
+
+<p>He rau ringa e oti ai.
+(Many hands finish the work)</p>
+
+<p>Autogenerated release notes updated last on 28 Feb 2024 21:48:13.</p>
diff --git a/misc/release_notes/release_notes_22_05_19.md b/misc/release_notes/release_notes_22_05_19.md
new file mode 100644
index 0000000000..ffb7316eeb
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_19.md
@@ -0,0 +1,287 @@
+# RELEASE NOTES FOR KOHA 22.05.19
+28 Feb 2024
+
+Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:
+
+- [Koha Community](http://koha-community.org)
+
+Koha 22.05.19 can be downloaded from:
+
+- [Download](http://download.koha-community.org/koha-22.05.19.tar.gz)
+
+Installation instructions can be found at:
+
+- [Koha Wiki](http://wiki.koha-community.org/wiki/Installation_Documentation)
+- OR in the INSTALL files that come in the tarball
+
+Koha 22.05.19 is a bugfix/maintenance release.
+
+It includes 11 bugfixes.
+
+**System requirements**
+
+You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations).
+
+
+#### Security bugs
+
+- [29510](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29510) objects.find should call search_limited if present
+- [30524](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30524) Add base framework for dealing with CSRF in Koha
+- [35890](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35890) AutoLocation system preference + setting the library IP field - can still login and unexpected results
+- [35918](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35918) Incorrect library used when AutoLocation configured using the same IP
+- [35941](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35941) OPAC user can guess clubs of other users
+- [35942](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942) OPAC user can enroll several times to the same club
+- [36072](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36072) Can request articles even if ArticleRequests is off
+
+## Bugfixes
+
+### Architecture, internals, and plumbing
+
+#### Other bugs fixed
+
+- [36092](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36092) sessionID not passed to the template on auth.tt
+
+### Authentication
+
+#### Critical bugs fixed
+
+- [36034](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034) cas_ticket is set to serialized patron object in session
+
+### Circulation
+
+#### Critical bugs fixed
+
+- [35518](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35518) Call to C4::Context->userenv happens before it's gets populated breaks code logic in circulation
+
+### Test Suite
+
+#### Other bugs fixed
+
+- [35904](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35904) C4::Auth::checkauth cannot be tested easily
+
+## Documentation
+
+The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is
+
+- [Koha Documentation](http://koha-community.org/documentation/)
+As of the date of these release notes, the Koha manual is available in the following languages:
+
+- [Chinese (Traditional)](https://koha-community.org/manual/22.05//html/) (61%)
+- [English](https://koha-community.org/manual/22.05//html/) (100%)
+- [English (USA)](https://koha-community.org/manual/22.05/en/html/)
+- [French](https://koha-community.org/manual/22.05/fr/html/) (39%)
+- [German](https://koha-community.org/manual/22.05/de/html/) (40%)
+- [Hindi](https://koha-community.org/manual/22.05/hi/html/) (75%)
+
+The Git repository for the Koha manual can be found at
+
+- [Koha Git Repository](https://gitlab.com/koha-community/koha-manual)
+
+## Translations
+
+Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (71%)
+- Dutch (83%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (100%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (61%)
+- Persian (fa_ARAB) (68%)
+- Polish (99%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (78%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+Partial translations are available for various other languages.
+
+The Koha team welcomes additional translations; please see
+
+- [Koha Translation Info](http://wiki.koha-community.org/wiki/Translating_Koha)
+
+For information about translating Koha, and join the koha-translate 
+list to volunteer:
+
+- [Koha Translate List](http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate)
+
+The most up-to-date translations can be found at:
+
+- [Koha Translation](http://translate.koha-community.org/)
+
+## Release Team
+
+The release team for Koha 22.05.19 is
+
+
+- Release Manager: Katrin Fischer
+
+- Release Manager assistants:
+  - Tomás Cohen Arazi
+  - Martin Renvoize
+  - Jonathan Druart
+
+- QA Manager: Marcel de Rooy
+
+- QA Team:
+  - Marcel de Rooy
+  - Julian Maurice
+  - Lucas Gass
+  - Victor Grousset
+  - Kyle M Hall
+  - Nick Clemens
+  - Martin Renvoize
+  - Tomás Cohen Arazi
+  - Aleisha Amohia
+  - Emily Lamancusa
+  - David Cook
+  - Jonathan Druart
+  - Pedor Amorim
+
+- Topic Experts:
+  - UI Design -- Owen Leonard
+  - Zebra -- Fridolin Somers
+  - REST API -- Tomás Cohen Arazi
+  - ERM -- Matt Blenkinsop
+  - ILL -- Pedro Amorim
+  - SIP2 -- Matthias Meusburger
+  - CAS -- Matthias Meusburger
+
+- Bug Wranglers:
+  - Aleisha Amohia
+  - Indranil Das Gupta
+
+- Packaging Managers:
+  - Mason James
+  - Indranil Das Gupta
+  - Tomás Cohen Arazi
+
+- Documentation Manager: Aude Charillon
+
+- Documentation Team:
+  - Caroline Cyr La Rose
+  - Kelly McElligott
+  - Philip Orr
+  - Marie-Luce Laflamme
+  - Lucy Vaux-Harvey
+
+- Translation Manager: Jonathan Druart
+
+
+- Wiki curators: 
+  - Thomas Dukleth
+  - Katrin Fischer
+
+- Release Maintainers:
+  - 23.11 -- Fridolin Somers
+  - 23.05 -- Lucas Gass
+  - 22.11 -- Frédéric Demians
+  - 22.05 -- Danyon Sewell
+
+- Release Maintainer assistants:
+  - 22.05 -- Wainui Witika-Park
+
+## Credits
+
+
+
+We thank the following individuals who contributed patches to Koha 22.05.19
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (5)
+- Nick Clemens (1)
+- Jonathan Druart (11)
+- Victor Grousset (1)
+- Kyle M Hall (3)
+- Andreas Jonsson (1)
+- Martin Renvoize (1)
+- Marcel de Rooy (1)
+</div>
+
+We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.19
+<div style="column-count: 2;">
+
+- ByWater-Solutions (4)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (12)
+- Kreablo AB (1)
+- PTFS-Europe (1)
+- Rijksmuseum (1)
+- Theke Solutions (5)
+</div>
+
+We also especially thank the following individuals who tested patches
+for Koha
+<div style="column-count: 2;">
+
+- Aleisha Amohia (6)
+- Tomás Cohen Arazi (1)
+- Matt Blenkinsop (6)
+- Frédéric Demians (2)
+- Jonathan Druart (2)
+- Magnus Enger (2)
+- Lucas Gass (1)
+- Victor Grousset (1)
+- Kyle M Hall (11)
+- David Nind (1)
+- Martin Renvoize (13)
+- Marcel de Rooy (3)
+- Fridolin Somers (4)
+- Wainui Witika-Park (13)
+</div>
+
+
+
+
+
+We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.
+
+## Revision control notes
+
+The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:
+
+- [Koha Git Repository](https://git.koha-community.org/koha-community/koha)
+
+The branch for this version of Koha and future bugfixes in this release
+line is 22.05.x.
+
+## Bugs and feature requests
+
+Bug reports and feature requests can be filed at the Koha bug
+tracker at:
+
+- [Koha Bugzilla](http://bugs.koha-community.org)
+
+He rau ringa e oti ai.
+(Many hands finish the work)
+
+Autogenerated release notes updated last on 28 Feb 2024 21:48:13.

From d83f4c85e5970506da2a9fa53f7ef5a6dc8ba9ff Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 28 Feb 2024 16:28:33 +0100
Subject: [PATCH 36/56] Bug 36176: Reject cud- for stable branches

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-cud.t | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100755 xt/find-cud.t

diff --git a/xt/find-cud.t b/xt/find-cud.t
new file mode 100755
index 0000000000..0f0805773a
--- /dev/null
+++ b/xt/find-cud.t
@@ -0,0 +1,26 @@
+#!/usr/bin/perl
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+use Test::More tests => 1;
+use Data::Dumper;
+
+my @files = `git grep 'cud-' ':(exclude)xt/find-cud.t'`;
+chomp for @files;
+
+is( @files, 0, "This branch is not supposed to have 'cud-', see bug 34478." )
+    or diag( Dumper \@files );

From 7f604bc96b26cb8fef4783d99d9e3c28999a154c Mon Sep 17 00:00:00 2001
From: Lucas Gass <lucas@bywatersolutions.com>
Date: Tue, 26 Mar 2024 20:32:15 +0000
Subject: [PATCH 37/56] Bug 36176: Exclude misc/releases_notes/*

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-cud.t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xt/find-cud.t b/xt/find-cud.t
index 0f0805773a..67721bf1e8 100755
--- a/xt/find-cud.t
+++ b/xt/find-cud.t
@@ -19,7 +19,7 @@ use Modern::Perl;
 use Test::More tests => 1;
 use Data::Dumper;
 
-my @files = `git grep 'cud-' ':(exclude)xt/find-cud.t'`;
+my @files = `git grep 'cud-' ':(exclude)xt/find-cud.t' ':(exclude)misc/release_notes/*'`;
 chomp for @files;
 
 is( @files, 0, "This branch is not supposed to have 'cud-', see bug 34478." )

From be99f17c78ccf2d6c387f373b9edc76e69cba429 Mon Sep 17 00:00:00 2001
From: Andreas Jonsson <andreas.jonsson@kreablo.se>
Date: Thu, 7 Mar 2024 09:07:49 +0000
Subject: [PATCH 38/56] Bug 36244: Unit test for tt syntax in parameters

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 t/db_dependent/Letters.t | 47 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Letters.t b/t/db_dependent/Letters.t
index 7afcc60814..1ddf3bc673 100755
--- a/t/db_dependent/Letters.t
+++ b/t/db_dependent/Letters.t
@@ -18,7 +18,7 @@
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use Modern::Perl;
-use Test::More tests => 85;
+use Test::More tests => 86;
 use Test::MockModule;
 use Test::Warn;
 use Test::Exception;
@@ -995,3 +995,48 @@ subtest 'Test message_id parameter for SendQueuedMessages' => sub {
     is( $message_1->{status}, 'failed', 'Message 1 status is unchanged' );
     is( $message_2->{status}, 'sent', 'Valid from_address => status sent' );
 };
+
+subtest 'Template toolkit syntax in parameters' => sub {
+
+    my $borrowernumber = Koha::Patron->new(
+        {
+            firstname      => 'Robert',
+            surname        => '[% USE Categories %][% Categories.all().search_related("borrowers").count() %]',
+            categorycode   => $patron_category,
+            branchcode     => $library->{branchcode},
+            dateofbirth    => $date,
+            smsalertnumber => undef,
+        }
+    )->store->borrowernumber;
+
+    my $title   = q|<<branches.branchname>> - <<status>>|;
+    my $content = q{Dear <<borrowers.firstname>> <<borrowers.surname>>};
+
+    $dbh->do(
+        q|INSERT INTO letter(branchcode,module,code,name,is_html,title,content,message_transport_type) VALUES (?,'my module','tt test','my name',1,?,?,'email')|,
+        undef, $library->{branchcode}, $title, $content
+    );
+
+    my $tables = {
+        borrowers => $borrowernumber,
+        branches  => $library->{branchcode},
+        biblio    => $biblionumber,
+    };
+    my $substitute = {
+        status => 'overdue',
+    };
+    my $prepared_letter = GetPreparedLetter(
+        module      => 'my module',
+        branchcode  => $library->{branchcode},
+        letter_code => 'tt test',
+        tables      => $tables,
+        substitute  => $substitute,
+        repeat      => [],
+    );
+
+    is(
+        $prepared_letter->{content},
+        'Dear Robert [% USE Categories %][% Categories.all().search_related("borrowers").count() %]',
+        'Template toolkit syntax in parameter was not evaluated.'
+    );
+};

From f6094bd90a3c81f8c9c30f45fab1b7c9a0e3f7e2 Mon Sep 17 00:00:00 2001
From: Andreas Jonsson <andreas.jonsson@kreablo.se>
Date: Thu, 7 Mar 2024 09:12:25 +0000
Subject: [PATCH 39/56] Bug 36244: Do template toolkit processing first

To avoid injection of template toolkit code
from database fields that are controlled by
untrusted sources.

Test plan:

* review subtest 'Template toolkit syntax in
  parameters' in t/db_dependent/Letters.t
* Run the unit test:
  prove t/db_dependent/Letters.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 C4/Letters.pm | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/C4/Letters.pm b/C4/Letters.pm
index 6b19fc7252..1e4e817e03 100644
--- a/C4/Letters.pm
+++ b/C4/Letters.pm
@@ -597,6 +597,25 @@ sub GetPreparedLetter {
          return;
     my $want_librarian = $params{want_librarian};
 
+    $letter->{content} = _process_tt(
+        {
+            content => $letter->{content},
+            tables  => $tables,
+            loops  => $loops,
+            substitute => $substitute,
+            lang => $lang
+        }
+    );
+
+    $letter->{title} = _process_tt(
+        {
+            content => $letter->{title},
+            tables  => $tables,
+            loops  => $loops,
+            substitute => $substitute,
+        }
+    );
+
     if (%$substitute) {
         while ( my ($token, $val) = each %$substitute ) {
             $val //= q{};
@@ -667,25 +686,6 @@ sub GetPreparedLetter {
         }
     }
 
-    $letter->{content} = _process_tt(
-        {
-            content => $letter->{content},
-            tables  => $tables,
-            loops  => $loops,
-            substitute => $substitute,
-            lang => $lang
-        }
-    );
-
-    $letter->{title} = _process_tt(
-        {
-            content => $letter->{title},
-            tables  => $tables,
-            loops  => $loops,
-            substitute => $substitute,
-        }
-    );
-
     $letter->{content} =~ s/<<\S*>>//go; #remove any stragglers
 
     return $letter;

From 17891dcac5431a8696b39ca45c9ac4b552c0e056 Mon Sep 17 00:00:00 2001
From: Kyle M Hall <kyle@bywatersolutions.com>
Date: Thu, 7 Mar 2024 11:10:35 -0500
Subject: [PATCH 40/56] Bug 36244: Add atomic update to check for affected
 notices

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Fixed some typos in bug numbers and text.

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../data/mysql/atomicupdate/bug_36244.pl      | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100755 installer/data/mysql/atomicupdate/bug_36244.pl

diff --git a/installer/data/mysql/atomicupdate/bug_36244.pl b/installer/data/mysql/atomicupdate/bug_36244.pl
new file mode 100755
index 0000000000..5fd40ecb2d
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_36244.pl
@@ -0,0 +1,27 @@
+use Modern::Perl;
+
+return {
+    bug_number  => "36244",
+    description => "Template Toolkit syntax not escaped in letter templates",
+    up          => sub {
+        my ($args) = @_;
+        my ( $dbh, $out ) = @$args{qw(dbh out)};
+
+        my $query = q{SELECT * FROM letter WHERE content LIKE "[|%%SET%<<%|%]" ESCAPE '|'};
+        my $sth   = $dbh->prepare($query);
+        $sth->execute();
+        if ( $sth->rows ) {
+            say $out "You have one or more templates that have been affected by bug 36244.";
+            say $out "These templates assign template toolkit variables values";
+            say $out "using the double arrows syntax. E.g. [% SET name = '<<branches.branchname>>' %]";
+            say $out
+                "This will no longer function correctly as Template Toolkit is now rendered before the double arrow syntax.";
+            say $out "The following notices will need to be updated:";
+
+            while ( my $row = $sth->fetchrow_hashref() ) {
+                say $out
+                    "ID: $row->{id} / MODULE: $row->{module} / CODE: $row->{code} / BRANCHCODE: $row->{branchcode} / NAME: $row->{name}";
+            }
+        }
+    },
+};

From 931a02f54ac7b8e76c1bd290cae0ca59fdd1bf18 Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Tue, 26 Mar 2024 01:16:03 +0000
Subject: [PATCH 41/56] Bug 36244: DBRev 22.05.19.001

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha.pm                                                         | 2 +-
 .../mysql/{atomicupdate/bug_36244.pl => db_revs/220519001.pl}   | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename installer/data/mysql/{atomicupdate/bug_36244.pl => db_revs/220519001.pl} (100%)

diff --git a/Koha.pm b/Koha.pm
index 34e413ceea..000c7bde99 100644
--- a/Koha.pm
+++ b/Koha.pm
@@ -29,7 +29,7 @@ use vars qw{ $VERSION };
 # - #4 : the developer version. The 4th number is the database subversion.
 #        used by developers when the database changes. updatedatabase take care of the changes itself
 #        and is automatically called by Auth.pm when needed.
-$VERSION = "22.05.19.000";
+$VERSION = "22.05.19.001";
 
 sub version {
     return $VERSION;
diff --git a/installer/data/mysql/atomicupdate/bug_36244.pl b/installer/data/mysql/db_revs/220519001.pl
similarity index 100%
rename from installer/data/mysql/atomicupdate/bug_36244.pl
rename to installer/data/mysql/db_revs/220519001.pl

From dca99588e790093e18a67d1206dd732352538015 Mon Sep 17 00:00:00 2001
From: Julian Maurice <julian.maurice@biblibre.com>
Date: Thu, 1 Feb 2024 09:15:23 +0100
Subject: [PATCH 42/56] Bug 35960: Use .val() instead of string concat to
 prevent potential XSS

Test plan:
1. Log out
2. Go to /cgi-bin/koha/mainpage.pl#somestring"with<html>char
3. Open the brower's inspector and find "auth_forwarded_hash" input
4. Make sure the value attribute is there and corresponds to the URL's
   fragment. It should be URI-encoded.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index 47e135312c..8219c0d4e0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -185,7 +185,9 @@
     <script>
         $(document).ready( function() {
             if ( document.location.hash ) {
-                $( '#loginform' ).append( '<input name="auth_forwarded_hash" type="hidden" value="' + document.location.hash + '"/>' );
+                const input = $('<input name="auth_forwarded_hash" type="hidden">')
+                input.val(document.location.hash);
+                $( '#loginform' ).append( input );
             }
             // Clear last borrowers, rememberd sql reports, carts, etc.
             logOut();

From 78b46e0cabb6cbb593118166ed5d4a7f9c60a399 Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Mon, 18 Mar 2024 16:32:57 +0100
Subject: [PATCH 43/56] Bug 36323: Move koha_perl_deps.pl to misc/devel

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 koha_perl_deps.pl => misc/devel/koha_perl_deps.pl | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename koha_perl_deps.pl => misc/devel/koha_perl_deps.pl (100%)

diff --git a/koha_perl_deps.pl b/misc/devel/koha_perl_deps.pl
similarity index 100%
rename from koha_perl_deps.pl
rename to misc/devel/koha_perl_deps.pl

From 647d6ce4b71174a2f79a1ba0d754a6dc9972c025 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 14 Mar 2024 16:42:08 +0100
Subject: [PATCH 44/56] Bug 36322: Redirect docs dir to 404

http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl

Test plan:
Hit the link
=> Erk
Copy the apache config to /etc/koha/apache-shared-intranet-git.conf
restart_all
Hit the link
=> 404

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 debian/templates/apache-shared-intranet.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/templates/apache-shared-intranet.conf b/debian/templates/apache-shared-intranet.conf
index 7e58a48158..93366da628 100644
--- a/debian/templates/apache-shared-intranet.conf
+++ b/debian/templates/apache-shared-intranet.conf
@@ -13,7 +13,7 @@ ScriptAlias /search "/usr/share/koha/intranet/cgi-bin/catalogue/search.pl"
 
 # Protect dev package install
 RewriteEngine on
-RewriteRule ^/cgi-bin/koha/(C4|debian|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]
+RewriteRule ^/cgi-bin/koha/(C4|debian|docs|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]
 
 RewriteRule ^/bib/([^\/]*)/?$ /cgi-bin/koha/catalogue/detail.pl?biblionumber=$1 [PT]
 RewriteRule ^/isbn/([^\/]*)/?$ /search?q=isbn:$1 [PT]

From 606b530885fe7b10700e0fa9534a5ad8f6db609c Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 15 Mar 2024 10:12:41 +0100
Subject: [PATCH 45/56] Bug 31988: Remove reports/itemtypes.plugin

This "plugin system" is only used for the itemtypes report. We can
simply remove the reports/manager.pl script and this plugin in favor of
a dedicated report.

Test plan:
Same behaviour expected before and after this patch

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 .../prog/en/includes/reports-menu.inc         |  2 +-
 .../prog/en/modules/reports/itemtypes.tt      |  4 +-
 .../prog/en/modules/reports/reports-home.tt   |  2 +-
 reports/catalog_by_itemtype.pl                | 99 +++++++++++++++++++
 reports/itemtypes.plugin                      | 85 ----------------
 reports/manager.pl                            | 53 ----------
 6 files changed, 103 insertions(+), 142 deletions(-)
 create mode 100755 reports/catalog_by_itemtype.pl
 delete mode 100755 reports/itemtypes.plugin
 delete mode 100755 reports/manager.pl

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-menu.inc
index 3727737311..212313086a 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/reports-menu.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/reports-menu.inc
@@ -52,7 +52,7 @@
         <ul>
             <li><a href="/cgi-bin/koha/reports/itemslost.pl">Lost items</a></li>
             <li><a href="/cgi-bin/koha/reports/orders_by_fund.pl">Orders by fund</a></li>
-            <li><a href="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">Catalog by item type</a></li>
+            <li><a href="/cgi-bin/koha/reports/catalog_by_itemtype.pl">Catalog by item type</a></li>
             <li><a href="/cgi-bin/koha/reports/issues_avg_stats.pl">Average loan time</a></li>
         </ul>
     </div>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
index 57fe194b5b..6ed74f8878 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt
@@ -24,7 +24,7 @@
         </li>
         [% IF ( do_it ) %]
             <li>
-                <a href="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">Catalog by item type</a>
+                <a href="/cgi-bin/koha/reports/catalog_by_itemtype.pl">Catalog by item type</a>
             </li>
             <li>
                 <a href="#" aria-current="page">
@@ -75,7 +75,7 @@
 [% END %]
 [% ELSE %]
         <h1>View a count of items held at your library grouped by item type</h1>
-        <form method="post" action="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">
+        <form method="get" action="/cgi-bin/koha/reports/catalog_by_itemtype.pl">
           <fieldset class="rows">
             <ol>
               <li>
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt
index 7dd20f34dd..ea5e893bb5 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reports-home.tt
@@ -91,7 +91,7 @@
         <ul>
             <li><a href="/cgi-bin/koha/reports/itemslost.pl">Items lost</a></li>
             <li><a href="/cgi-bin/koha/reports/orders_by_fund.pl">Orders by fund</a></li>
-            <li><a href="/cgi-bin/koha/reports/manager.pl?report_name=itemtypes">Catalog by item type</a></li>
+            <li><a href="/cgi-bin/koha/reports/catalog_by_itemtype.pl">Catalog by item type</a></li>
             <li><a href="/cgi-bin/koha/reports/issues_avg_stats.pl">Average loan time</a></li>
             [% SET koha_version = Koha.Version %]
             [% IF koha_version.development %]
diff --git a/reports/catalog_by_itemtype.pl b/reports/catalog_by_itemtype.pl
new file mode 100755
index 0000000000..fcaf5f17ef
--- /dev/null
+++ b/reports/catalog_by_itemtype.pl
@@ -0,0 +1,99 @@
+#!/usr/bin/perl
+
+# Copyright 2000-2002 Katipo Communications
+#
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+use C4::Auth qw( get_template_and_user );
+use CGI qw ( -utf8 );
+use C4::Context;
+use C4::Output qw( output_html_with_http_headers );
+
+my $input          = CGI->new;
+my $report_name    = $input->param("report_name");
+my $do_it          = $input->param('do_it');
+my $fullreportname = "reports/itemtypes.tt";
+my @values         = $input->multi_param("value");
+my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
+    {
+        template_name => $fullreportname,
+        query         => $input,
+        type          => "intranet",
+        flagsrequired => { reports => '*' },
+    }
+);
+$template->param(
+    do_it => $do_it,
+);
+if ($do_it) {
+    my $results = calculate( \@values );
+    $template->param( mainloop => $results );
+}
+output_html_with_http_headers $input, $cookie, $template->output;
+
+sub calculate {
+    my ($parameters) = @_;
+    my @results      = ();
+    my $branch       = @$parameters[0];
+    my $dbh          = C4::Context->dbh;
+    my $sth;
+    if ( C4::Context->preference('item-level_itypes') ) {
+        $sth = $dbh->prepare(
+            q|
+            SELECT itemtypes.itemtype, description, COUNT(*) AS total
+            FROM itemtypes, items
+            WHERE items.itype=itemtypes.itemtype
+            | . ( $branch ? q| AND items.holdingbranch=? | : () ) . q|
+            GROUP BY itemtypes.itemtype, description, items.itype
+            ORDER BY itemtypes.description
+        |
+        );
+    } else {
+        $sth = $dbh->prepare(
+            q|
+            SELECT itemtypes.itemtype, description, COUNT(*) AS total
+            FROM itemtypes, biblioitems, items
+            WHERE biblioitems.itemtype=itemtypes.itemtype
+            AND items.biblioitemnumber=biblioitems.biblioitemnumber
+            | . ( $branch ? q| AND items.holdingbranch=? | : () ) . q|
+            GROUP BY itemtypes.itemtype, description
+            ORDER BY itemtypes.description
+        |
+        );
+    }
+    $sth->execute( $branch || () );
+    my ( $itemtype, $description, $total );
+    my $grantotal = 0;
+    my $count     = 0;
+    while ( ( $itemtype, $description, $total ) = $sth->fetchrow ) {
+        my %line;
+        $line{itemtype} = $itemtype;
+        $line{count}    = $total;
+        $grantotal += $total;
+        push @results, \%line;
+        $count++;
+    }
+    my @mainloop;
+    my %globalline;
+    $globalline{loopitemtype} = \@results;
+    $globalline{total}        = $grantotal;
+    $globalline{branch}       = $branch;
+    push @mainloop, \%globalline;
+    return \@mainloop;
+}
+
+1;
diff --git a/reports/itemtypes.plugin b/reports/itemtypes.plugin
deleted file mode 100755
index ec2c535182..0000000000
--- a/reports/itemtypes.plugin
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/perl
-
-
-# Copyright 2000-2002 Katipo Communications
-#
-# This file is part of Koha.
-#
-# Koha is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# Koha is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Koha; if not, see <http://www.gnu.org/licenses>.
-
-use strict;
-use C4::Auth;
-use CGI qw ( -utf8 );
-use C4::Context;
-use C4::Search;
-use C4::Output;
-use C4::Koha;
-=head1
-
-=cut
-
-sub set_parameters {
-    my ($template) = @_;
-    return $template;
-}
-
-sub calculate {
-	my ($parameters) = @_;
-	my @results =();
-	my $branch = @$parameters[0];
-	my $dbh = C4::Context->dbh;
-	my $sth;
-    if ( C4::Context->preference('item-level_itypes') ) {
-        $sth = $dbh->prepare( q|
-            SELECT itemtypes.itemtype, description, COUNT(*) AS total
-            FROM itemtypes, items
-            WHERE items.itype=itemtypes.itemtype
-            | . ( $branch ? q| AND items.holdingbranch=? | : () ) . q|
-            GROUP BY itemtypes.itemtype, description, items.itype
-            ORDER BY itemtypes.description
-        |);
-    }
-    else {
-        $sth = $dbh->prepare( q|
-            SELECT itemtypes.itemtype, description, COUNT(*) AS total
-            FROM itemtypes, biblioitems, items
-            WHERE biblioitems.itemtype=itemtypes.itemtype
-            AND items.biblioitemnumber=biblioitems.biblioitemnumber
-            | . ( $branch ? q| AND items.holdingbranch=? | : () ) . q|
-            GROUP BY itemtypes.itemtype, description
-            ORDER BY itemtypes.description
-        |);
-    }
-    $sth->execute($branch || ());
-    my ($itemtype, $description,$total);
-	my $grantotal = 0;
-	my $count = 0;
-    while (($itemtype, $description,$total) = $sth->fetchrow) {
-		my %line;
-        $line{itemtype} = $itemtype;
-		$line{count} = $total;
-		$grantotal += $total;
-		push @results,\%line;
-		$count ++;
-	}
-	my @mainloop;
-	my %globalline;
-	$globalline{loopitemtype} = \@results;
-	$globalline{total} = $grantotal;
-	$globalline{branch} = $branch;
-	push @mainloop,\%globalline;
-	return \@mainloop;
-}
-
-1;
diff --git a/reports/manager.pl b/reports/manager.pl
deleted file mode 100755
index ff174f00d3..0000000000
--- a/reports/manager.pl
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/usr/bin/perl
-
-# Copyright 2000-2002 Katipo Communications
-#
-# This file is part of Koha.
-#
-# Koha is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# Koha is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Koha; if not, see <http://www.gnu.org/licenses>.
-
-use Modern::Perl;
-use CGI qw ( -utf8 );
-use C4::Auth qw( get_template_and_user );
-use C4::Context;
-use C4::Output qw( output_html_with_http_headers );
-
-
-my $input = CGI->new;
-my $report_name=$input->param("report_name");
-my $do_it=$input->param('do_it');
-my $fullreportname = "reports/".$report_name.".tt";
-my @values = $input->multi_param("value");
-my ($template, $borrowernumber, $cookie)
-	= get_template_and_user({template_name => $fullreportname,
-				query => $input,
-				type => "intranet",
-				flagsrequired => {reports => '*'},
-				});
-$template->param(do_it => $do_it,
-		report_name => $report_name,
-		);
-my $cgidir = C4::Context->config('intranetdir')."/cgi-bin/reports/";
-unless (-r $cgidir and -d $cgidir) {
-    $cgidir = C4::Context->config('intranetdir')."/reports/";
-} 
-my $plugin = $cgidir.$report_name.".plugin";
-require $plugin;
-if ($do_it) {
-	my $results = calculate(\@values);
-	$template->param(mainloop => $results);
-} else {
-	$template = set_parameters($template);
-}
-output_html_with_http_headers $input, $cookie, $template->output;

From 0f3d6db806aec9d3ad62f048a92026ed6195f169 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 17 Mar 2020 11:54:12 +0100
Subject: [PATCH 46/56] Bug 24879: Add new test to catch missing auth statement

in intranet scripts

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-missing-auth_checks.t | 72 +++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100755 xt/find-missing-auth_checks.t

diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t
new file mode 100755
index 0000000000..bc9af3a6c2
--- /dev/null
+++ b/xt/find-missing-auth_checks.t
@@ -0,0 +1,72 @@
+#!/usr/bin/perl
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+use Test::More;
+
+use File::Spec;
+use File::Find;
+
+my @files;
+sub wanted {
+    my $name = $File::Find::name;
+    push @files, $name
+      if $name =~ m{^\./(
+           acqui
+          |admin
+          |authorities
+          |basket
+          |catalogue
+          |cataloguing
+          |circ
+          |clubs
+          |course_reserves
+          |installer
+          |labels
+          |members
+          |patroncards
+          |pos
+          |reports
+          |reserve
+          |reviews
+          |rotating_collections
+          |serials
+          |services
+          |suggestion
+          |svc
+          |tags
+          |tools
+          |virtualshelves
+        )}xms
+      && $name =~ m{\.(pl)$}
+      && -f $name;
+}
+
+find({ wanted => \&wanted, no_chdir => 1 }, File::Spec->curdir());
+
+my @missing_auth_check;
+FILE: foreach my $name (@files) {
+    open( FILE, $name ) || die "cannot open file $name $!";
+    while ( my $line = <FILE> ) {
+        for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth ) ) {
+            next FILE if $line =~ m|^[^#]*$routine|;
+        }
+    }
+    push @missing_auth_check, $name;
+}
+is( scalar @missing_auth_check, 0 ) or diag "No auth check in the following files:\n" . join "\n", @missing_auth_check;
+done_testing;

From c18b672c04e16a712ef93090d79dcff6b12c5ce0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 14 Mar 2024 16:14:17 +0100
Subject: [PATCH 47/56] Bug 24879: Remove installer/externalmodules.pl

It is not used, if we need it back it must be moved to misc.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 installer/externalmodules.pl | 27 ---------------------------
 1 file changed, 27 deletions(-)
 delete mode 100755 installer/externalmodules.pl

diff --git a/installer/externalmodules.pl b/installer/externalmodules.pl
deleted file mode 100755
index f836ccf023..0000000000
--- a/installer/externalmodules.pl
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/perl
-
-# This Script can be used to provide a list of ALL external modules ***used*** (uncommented) in Koha.
-# It provides you not only the list of modules BUT ALSO the files that uses those modules.
-# utf8 or warnings or other lib use are not taken into account at the moment.
-
-use Modern::Perl;
-use C4::Context;
-
-my $dir=C4::Context->config('intranetdir');
-qx(grep -r "^ *use" $dir | grep -v "C4\|strict\|vars" >/tmp/modulesKoha.log);
-$dir=C4::Context->config('opacdir');
-qx(grep -r "^ *use" $dir | grep -v "C4\|strict\|vars" >>/tmp/modulesKoha.log);
-
-open my $fh, '<', '/tmp/modulesKoha.log' ||die "unable to open file /tmp/modulesKoha.log";
-my %modulehash;
-while (my $line=<$fh>){
-  if ( $line=~m#(.*)\:\s*use\s+([A-Z][^\s;]+)# ){
-    my ($file,$module)=($1,$2);
-    my @filename = split /\//, $file;
-    push @{$modulehash{$module}},$filename[scalar(@filename) - 1];
-  }
-}
-print "external modules used in Koha ARE :\n";
-map {print "* $_ \t in files ",join (",",@{$modulehash{$_}}),"\n" } sort keys %modulehash;
-close $fh;
-unlink "/tmp/modulesKoha.log";

From 32e13b47929677e7ac187ff00ea3d6572c426ebd Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 14 Mar 2024 16:17:55 +0100
Subject: [PATCH 48/56] Bug 24879: Adjust tests

Installer scripts cannot be run from the UI:
debian/templates/apache-shared-intranet.conf:RewriteRule ^/cgi-bin/koha/(C4|debian|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-missing-auth_checks.t | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t
index bc9af3a6c2..77909bd5c9 100755
--- a/xt/find-missing-auth_checks.t
+++ b/xt/find-missing-auth_checks.t
@@ -35,7 +35,6 @@ sub wanted {
           |circ
           |clubs
           |course_reserves
-          |installer
           |labels
           |members
           |patroncards
@@ -62,7 +61,7 @@ my @missing_auth_check;
 FILE: foreach my $name (@files) {
     open( FILE, $name ) || die "cannot open file $name $!";
     while ( my $line = <FILE> ) {
-        for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth ) ) {
+        for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init ) ) {
             next FILE if $line =~ m|^[^#]*$routine|;
         }
     }

From 78144993858053942fc591dd30294e73e02c03ad Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 14 Mar 2024 16:19:06 +0100
Subject: [PATCH 49/56] Bug 24879: Add check_cookie_auth when missing

This can certainly be improved to adjust the permissions, but at least
they are no longer opened to the world..

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 acqui/check_uniqueness.pl                      |  7 +++++++
 catalogue/image.pl                             |  7 +++++++
 cataloguing/plugin_launcher.pl                 |  8 ++++++++
 cataloguing/value_builder/barcode.pl           | 10 ++++++++++
 cataloguing/value_builder/barcode_manual.pl    | 10 ++++++++++
 cataloguing/value_builder/dateaccessioned.pl   |  9 +++++++++
 cataloguing/value_builder/marc21_field_005.pl  | 10 ++++++++++
 cataloguing/value_builder/marc21_field_245h.pl | 12 +++++++++++-
 cataloguing/value_builder/marc21_field_260b.pl | 10 ++++++++++
 cataloguing/value_builder/marc21_orgcode.pl    |  9 +++++++++
 cataloguing/value_builder/stocknumber.pl       |  9 +++++++++
 cataloguing/value_builder/upload.pl            | 10 ++++++++++
 labels/label-create-csv.pl                     |  6 ++++++
 labels/label-create-xml.pl                     |  6 ++++++
 serials/lateissues-export.pl                   |  7 +++++++
 15 files changed, 129 insertions(+), 1 deletion(-)

diff --git a/acqui/check_uniqueness.pl b/acqui/check_uniqueness.pl
index b665b34c3a..791814095f 100755
--- a/acqui/check_uniqueness.pl
+++ b/acqui/check_uniqueness.pl
@@ -37,6 +37,13 @@ use C4::Output qw( output_with_http_headers );
 use C4::Items qw( SearchItems );
 
 my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my @field = $input->multi_param('field[]');
 my @value = $input->multi_param('value[]');
 
diff --git a/catalogue/image.pl b/catalogue/image.pl
index 62e1ebb7ca..6d2cc6d092 100755
--- a/catalogue/image.pl
+++ b/catalogue/image.pl
@@ -34,6 +34,13 @@ use Koha::Exceptions;
 $| = 1;
 
 my $data  = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $data->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $data->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $imagenumber;
 
 =head1 NAME
diff --git a/cataloguing/plugin_launcher.pl b/cataloguing/plugin_launcher.pl
index 90105f326c..b31ca52c89 100755
--- a/cataloguing/plugin_launcher.pl
+++ b/cataloguing/plugin_launcher.pl
@@ -19,10 +19,18 @@
 
 use Modern::Perl;
 use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
 
 use Koha::FrameworkPlugin;
 
 my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $plugin= Koha::FrameworkPlugin->new( {
     name => scalar $input->param("plugin_name"),
 });
diff --git a/cataloguing/value_builder/barcode.pl b/cataloguing/value_builder/barcode.pl
index f9b83a44e1..2b8dffca08 100755
--- a/cataloguing/value_builder/barcode.pl
+++ b/cataloguing/value_builder/barcode.pl
@@ -29,6 +29,16 @@ use Koha::DateUtils qw( dt_from_string output_pref );
 
 use Algorithm::CheckDigits qw( CheckDigits );
 
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $builder = sub {
     my ( $params ) = @_;
     my $function_name = $params->{id};
diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl
index 5c38c2f926..0efbd45334 100755
--- a/cataloguing/value_builder/barcode_manual.pl
+++ b/cataloguing/value_builder/barcode_manual.pl
@@ -27,6 +27,16 @@ use C4::Barcodes::ValueBuilder;
 use C4::Biblio qw( GetMarcFromKohaField );
 use Koha::DateUtils qw( dt_from_string output_pref );
 
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $builder = sub {
     my ( $params ) = @_;
     my $function_name = $params->{id};
diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl
index dc5d771a12..cf59053e1b 100755
--- a/cataloguing/value_builder/dateaccessioned.pl
+++ b/cataloguing/value_builder/dateaccessioned.pl
@@ -22,6 +22,15 @@
 
 use Modern::Perl;
 use Koha::DateUtils qw( dt_from_string output_pref flatpickr_date_format );
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
 
 my $builder = sub {
     my ( $params ) = @_;
diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl
index 6b5263163a..1f0aeaf1a5 100755
--- a/cataloguing/value_builder/marc21_field_005.pl
+++ b/cataloguing/value_builder/marc21_field_005.pl
@@ -21,6 +21,16 @@
 
 use Modern::Perl;
 
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $builder = sub {
     my ( $params ) = @_;
     my $function_name = $params->{id};
diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl
index 667ae2249a..4fe4a2f1e7 100755
--- a/cataloguing/value_builder/marc21_field_245h.pl
+++ b/cataloguing/value_builder/marc21_field_245h.pl
@@ -20,7 +20,17 @@
 # along with Koha; if not, see <http://www.gnu.org/licenses>.
 
 use Modern::Perl;
-use C4::Context;
+
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 
 my $builder = sub {
     my ( $params ) = @_;
diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl
index 406feb4122..e9a74a07ba 100755
--- a/cataloguing/value_builder/marc21_field_260b.pl
+++ b/cataloguing/value_builder/marc21_field_260b.pl
@@ -27,6 +27,16 @@ biblioitems.publishercode
 use Modern::Perl;
 use C4::Context;
 
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $builder = sub {
     my ( $params ) = @_;
     my $function_name = $params->{id};
diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl
index aa9142cfc7..0dd985803c 100755
--- a/cataloguing/value_builder/marc21_orgcode.pl
+++ b/cataloguing/value_builder/marc21_orgcode.pl
@@ -24,6 +24,15 @@ use Modern::Perl;
 use C4::Context;
 
 use Koha::Libraries;
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
 
 my $builder = sub {
     my ( $params ) = @_;
diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl
index 51d7a1986c..61885d12b0 100755
--- a/cataloguing/value_builder/stocknumber.pl
+++ b/cataloguing/value_builder/stocknumber.pl
@@ -21,6 +21,15 @@
 
 use Modern::Perl;
 use C4::Context;
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
 
 my $builder = sub {
     my ( $params ) = @_;
diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl
index 82b9816f62..eeb422d525 100755
--- a/cataloguing/value_builder/upload.pl
+++ b/cataloguing/value_builder/upload.pl
@@ -30,6 +30,16 @@ use Modern::Perl;
 # the possibility to delete the uploaded file. If the field is empty, you
 # can upload a new file.
 
+use CGI qw ( -utf8 );
+use C4::Auth qw( check_cookie_auth );
+my $input = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $input->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $builder = sub {
     my ( $params ) = @_;
     return <<"SCRIPT";
diff --git a/labels/label-create-csv.pl b/labels/label-create-csv.pl
index 8c06a41a0b..80c662e85a 100755
--- a/labels/label-create-csv.pl
+++ b/labels/label-create-csv.pl
@@ -26,6 +26,12 @@ use Text::CSV_XS;
 use C4::Labels;
 
 my $cgi = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
 
 my $batch_id;
 my @label_ids;
diff --git a/labels/label-create-xml.pl b/labels/label-create-xml.pl
index 3962cfb502..a3bec34ec0 100755
--- a/labels/label-create-xml.pl
+++ b/labels/label-create-xml.pl
@@ -26,6 +26,12 @@ use XML::Simple;
 use C4::Labels;
 
 my $cgi = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
 
 my $batch_id;
 my @label_ids;
diff --git a/serials/lateissues-export.pl b/serials/lateissues-export.pl
index af83f2c6f6..f82b9f1e18 100755
--- a/serials/lateissues-export.pl
+++ b/serials/lateissues-export.pl
@@ -27,6 +27,13 @@ use Koha::CsvProfiles;
 use Text::CSV_XS;
 
 my $query = CGI->new;
+my ($auth_status) =
+    check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } );
+if ( $auth_status ne "ok" ) {
+    print $query->header( -type => 'text/plain', -status => '403 Forbidden' );
+    exit 0;
+}
+
 my $supplierid = $query->param('supplierid');
 my @serialids = $query->multi_param('serialid');
 my $op = $query->param('op') || q{};

From 1b65d2ec591643ba2bc84bd93465ba5666de3dd1 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 14 Mar 2024 16:53:35 +0100
Subject: [PATCH 50/56] Bug 24879: Use perl shebang to list the exec

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-missing-auth_checks.t | 50 +++++++----------------------------
 1 file changed, 10 insertions(+), 40 deletions(-)

diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t
index 77909bd5c9..d86fab2917 100755
--- a/xt/find-missing-auth_checks.t
+++ b/xt/find-missing-auth_checks.t
@@ -18,54 +18,24 @@
 use Modern::Perl;
 use Test::More;
 
-use File::Spec;
-use File::Find;
+use File::Slurp qw(read_file);
 
-my @files;
-sub wanted {
-    my $name = $File::Find::name;
-    push @files, $name
-      if $name =~ m{^\./(
-           acqui
-          |admin
-          |authorities
-          |basket
-          |catalogue
-          |cataloguing
-          |circ
-          |clubs
-          |course_reserves
-          |labels
-          |members
-          |patroncards
-          |pos
-          |reports
-          |reserve
-          |reviews
-          |rotating_collections
-          |serials
-          |services
-          |suggestion
-          |svc
-          |tags
-          |tools
-          |virtualshelves
-        )}xms
-      && $name =~ m{\.(pl)$}
-      && -f $name;
-}
+my @excluded_paths = qw(C4 debian docs etc installer/data install_misc Koha misc selenium t test tmp xt changelanguage.pl build-resources.PL fix-perl-path.PL );
+push @excluded_paths, 'opac'; # We cannot test the OPAC scripts, some can be accessed without authentication
 
-find({ wanted => \&wanted, no_chdir => 1 }, File::Spec->curdir());
+my $grep_cmd      = q{git grep -l '#!/usr/bin/perl' -- } . join( ' ', map { qq{':!$_'} } @excluded_paths );
+my @files         = `$grep_cmd`;
 
 my @missing_auth_check;
-FILE: foreach my $name (@files) {
-    open( FILE, $name ) || die "cannot open file $name $!";
-    while ( my $line = <FILE> ) {
+FILE: foreach my $file (@files) {
+    chomp $file;
+    my @lines = read_file($file);
+    for my $line ( @lines ) {
         for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init ) ) {
             next FILE if $line =~ m|^[^#]*$routine|;
         }
     }
-    push @missing_auth_check, $name;
+    push @missing_auth_check, $file;
 }
 is( scalar @missing_auth_check, 0 ) or diag "No auth check in the following files:\n" . join "\n", @missing_auth_check;
 done_testing;

From 8def6ea4d6e79fda6c13ca8edad52f80c13191db Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Fri, 15 Mar 2024 10:19:16 +0100
Subject: [PATCH 51/56] Bug 24879: Exclude koha_perl_deps.pl

And tidy.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 xt/find-missing-auth_checks.t | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t
index d86fab2917..a1a5c0d594 100755
--- a/xt/find-missing-auth_checks.t
+++ b/xt/find-missing-auth_checks.t
@@ -20,18 +20,19 @@ use Test::More;
 
 use File::Slurp qw(read_file);
 
-my @excluded_paths = qw(C4 debian docs etc installer/data install_misc Koha misc selenium t test tmp xt changelanguage.pl build-resources.PL fix-perl-path.PL );
-push @excluded_paths, 'opac'; # We cannot test the OPAC scripts, some can be accessed without authentication
+my @excluded_paths =
+    qw(C4 debian docs etc installer/data install_misc Koha misc selenium t test tmp xt changelanguage.pl build-resources.PL fix-perl-path.PL koha_perl_deps.pl );
+push @excluded_paths, 'opac';    # We cannot test the OPAC scripts, some can be accessed without authentication
 
-my $grep_cmd      = q{git grep -l '#!/usr/bin/perl' -- } . join( ' ', map { qq{':!$_'} } @excluded_paths );
-my @files         = `$grep_cmd`;
+my $grep_cmd = q{git grep -l '#!/usr/bin/perl' -- } . join( ' ', map { qq{':!$_'} } @excluded_paths );
+my @files    = `$grep_cmd`;
 
 my @missing_auth_check;
 FILE: foreach my $file (@files) {
     chomp $file;
     my @lines = read_file($file);
-    for my $line ( @lines ) {
-        for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init ) ) {
+    for my $line (@lines) {
+        for my $routine (qw( get_template_and_user check_cookie_auth checkauth check_api_auth C4::Service->init )) {
             next FILE if $line =~ m|^[^#]*$routine|;
         }
     }

From 96a93f1563b03a3154ef7d94c90b2c8b09f40484 Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Wed, 27 Mar 2024 01:11:42 +0000
Subject: [PATCH 52/56] Bug 23352: [22.05] (follow-up) change number of tests

---
 t/db_dependent/Serials.t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/t/db_dependent/Serials.t b/t/db_dependent/Serials.t
index 41e77bc40c..99aede4f19 100755
--- a/t/db_dependent/Serials.t
+++ b/t/db_dependent/Serials.t
@@ -16,7 +16,7 @@ use Koha::DateUtils qw( dt_from_string output_pref );
 use Koha::Acquisition::Booksellers;
 use t::lib::Mocks;
 use t::lib::TestBuilder;
-use Test::More tests => 52;
+use Test::More tests => 15;
 
 BEGIN {
     use_ok('C4::Serials', qw( updateClaim NewSubscription GetSubscription GetSubscriptionHistoryFromSubscriptionId SearchSubscriptions ModSubscription GetExpirationDate GetSerials GetSerialInformation NewIssue AddItem2Serial DelSubscription GetFullSubscription PrepareSerialsData GetSubscriptionsFromBiblionumber ModSubscriptionHistory GetSerials2 GetLatestSerials GetNextSeq GetSeq CountSubscriptionFromBiblionumber ModSerialStatus findSerialsByStatus HasSubscriptionStrictlyExpired HasSubscriptionExpired GetLateOrMissingIssues check_routing addroutingmember GetNextDate ));

From d8b9f8e79b324f5f50c0e03d663cf94c32d57f9e Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Wed, 27 Mar 2024 10:20:03 +0100
Subject: [PATCH 53/56] Bug 24879: (follow-up) Fix test suite
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running cataloguing pluings (in cataloguing/value_builder) now requires
authentification.

This patch adds in failing unit tests a mock of C4::Auth::check_cookie_auth

Test with:
prove t/db_dependent/FrameworkPlugin.t t/db_dependent/Koha/UI/Form/Builder/Biblio.t t/db_dependent/Koha/UI/Form/Builder/Item.t t/db_dependent/Serials.t

(cherry picked from commit f8a23b8ef46aea60eda9211a3e89af85d650ac26)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

suite

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 t/db_dependent/FrameworkPlugin.t           | 1 +
 t/db_dependent/Koha/UI/Form/Builder/Item.t | 5 +++++
 t/db_dependent/Serials.t                   | 7 ++++++-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/FrameworkPlugin.t b/t/db_dependent/FrameworkPlugin.t
index 41baf49153..c3031ac22f 100755
--- a/t/db_dependent/FrameworkPlugin.t
+++ b/t/db_dependent/FrameworkPlugin.t
@@ -144,6 +144,7 @@ sub test05 {
     my $mOutput = Test::MockModule->new('C4::Output');
     $mContext->mock( 'userenv', \&mock_userenv );
     $mAuth->mock( 'checkauth', sub { return ( 1, undef, 1, all_perms() ); } );
+    $mAuth->mock( 'check_cookie_auth', sub { return ('ok') } );
     $mOutput->mock('output_html_with_http_headers',  sub { ++$launched; } );
 
     my $cgi=CGI->new;
diff --git a/t/db_dependent/Koha/UI/Form/Builder/Item.t b/t/db_dependent/Koha/UI/Form/Builder/Item.t
index caa538b7cc..14f65131f5 100755
--- a/t/db_dependent/Koha/UI/Form/Builder/Item.t
+++ b/t/db_dependent/Koha/UI/Form/Builder/Item.t
@@ -17,6 +17,7 @@
 
 use Modern::Perl;
 use Test::More tests => 9;
+use Test::MockModule;
 use Data::Dumper qw( Dumper );
 use utf8;
 
@@ -28,6 +29,10 @@ use Koha::UI::Form::Builder::Item;
 use t::lib::TestBuilder;
 use t::lib::Mocks;
 
+# Auth required for cataloguing plugins
+my $mAuth = Test::MockModule->new('C4::Auth');
+$mAuth->mock( 'check_cookie_auth', sub { return ('ok') } );
+
 my $schema = Koha::Database->new->schema;
 $schema->storage->txn_begin;
 
diff --git a/t/db_dependent/Serials.t b/t/db_dependent/Serials.t
index 99aede4f19..036a4f38e2 100755
--- a/t/db_dependent/Serials.t
+++ b/t/db_dependent/Serials.t
@@ -16,12 +16,17 @@ use Koha::DateUtils qw( dt_from_string output_pref );
 use Koha::Acquisition::Booksellers;
 use t::lib::Mocks;
 use t::lib::TestBuilder;
-use Test::More tests => 15;
+use Test::MockModule;
+use Test::More tests => 52;
 
 BEGIN {
     use_ok('C4::Serials', qw( updateClaim NewSubscription GetSubscription GetSubscriptionHistoryFromSubscriptionId SearchSubscriptions ModSubscription GetExpirationDate GetSerials GetSerialInformation NewIssue AddItem2Serial DelSubscription GetFullSubscription PrepareSerialsData GetSubscriptionsFromBiblionumber ModSubscriptionHistory GetSerials2 GetLatestSerials GetNextSeq GetSeq CountSubscriptionFromBiblionumber ModSerialStatus findSerialsByStatus HasSubscriptionStrictlyExpired HasSubscriptionExpired GetLateOrMissingIssues check_routing addroutingmember GetNextDate ));
 }
 
+# Auth required for cataloguing plugins
+my $mAuth = Test::MockModule->new('C4::Auth');
+$mAuth->mock( 'check_cookie_auth', sub { return ('ok') } );
+
 my $schema = Koha::Database->new->schema;
 $schema->storage->txn_begin;
 my $dbh = C4::Context->dbh;

From 18594a1861c5ae59859f8a159632c9f68ad68768 Mon Sep 17 00:00:00 2001
From: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Date: Wed, 27 Mar 2024 23:04:09 +0000
Subject: [PATCH 54/56] Increment version for 22.05.20 release

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
---
 Koha.pm                                   | 2 +-
 installer/data/mysql/db_revs/220520000.pl | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 installer/data/mysql/db_revs/220520000.pl

diff --git a/Koha.pm b/Koha.pm
index 000c7bde99..d2b6441bd8 100644
--- a/Koha.pm
+++ b/Koha.pm
@@ -29,7 +29,7 @@ use vars qw{ $VERSION };
 # - #4 : the developer version. The 4th number is the database subversion.
 #        used by developers when the database changes. updatedatabase take care of the changes itself
 #        and is automatically called by Auth.pm when needed.
-$VERSION = "22.05.19.001";
+$VERSION = "22.05.20.000";
 
 sub version {
     return $VERSION;
diff --git a/installer/data/mysql/db_revs/220520000.pl b/installer/data/mysql/db_revs/220520000.pl
new file mode 100644
index 0000000000..1927ffd9ad
--- /dev/null
+++ b/installer/data/mysql/db_revs/220520000.pl
@@ -0,0 +1,7 @@
+use Modern::Perl;
+
+return {
+    bug_number => undef,
+    description => 'Koha 22.05.20 release',
+    up => sub {},
+}

From fc33a4668818e093bf689e16fe354fa88f20d3cb Mon Sep 17 00:00:00 2001
From: Aleisha Amohia <aleisha@catalyst.net.nz>
Date: Thu, 28 Mar 2024 00:09:48 +0000
Subject: [PATCH 55/56] Update release notes for 22.05.20 release

Signed-off-by: Aleisha Amohia <aleisha@catalyst.net.nz>
---
 .../release_notes/release_notes_22_05_20.html | 405 ++++++++++++++++++
 misc/release_notes/release_notes_22_05_20.md  | 347 +++++++++++++++
 2 files changed, 752 insertions(+)
 create mode 100644 misc/release_notes/release_notes_22_05_20.html
 create mode 100644 misc/release_notes/release_notes_22_05_20.md

diff --git a/misc/release_notes/release_notes_22_05_20.html b/misc/release_notes/release_notes_22_05_20.html
new file mode 100644
index 0000000000..8431185ebb
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_20.html
@@ -0,0 +1,405 @@
+<h1 id="releasenotesforkoha22.05.20">RELEASE NOTES FOR KOHA 22.05.20</h1>
+
+<p>28 Mar 2024</p>
+
+<p>Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:</p>
+
+<ul>
+<li><a href="http://koha-community.org">Koha Community</a></li>
+</ul>
+
+<p>Koha 22.05.20 can be downloaded from:</p>
+
+<ul>
+<li><a href="http://download.koha-community.org/koha-22.05.20.tar.gz">Download</a></li>
+</ul>
+
+<p>Installation instructions can be found at:</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Installation_Documentation">Koha Wiki</a></li>
+<li>OR in the INSTALL files that come in the tarball</li>
+</ul>
+
+<p>Koha 22.05.20 is a security bugfix/maintenance release.</p>
+
+<p>It includes 2 enhancements, 20 bugfixes.</p>
+
+<p><strong>System requirements</strong></p>
+
+<p>You can learn about the system components (like OS and database) needed for running Koha on the <a href="https://wiki.koha-community.org/wiki/System_requirements_and_recommendations">community wiki</a>.</p>
+
+<h4 id="securitybugs">Security bugs</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24879">24879</a> Add missing authentication checks</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30524">30524</a> Add base framework for dealing with CSRF in Koha</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35960">35960</a> XSS in staff login form</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36244">36244</a> Template toolkit syntax not escaped in letter templates</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36322">36322</a> Can run docs/<em>*/</em>.pl from the UI</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36323">36323</a> koha_perl_deps.pl can be run from the UI</li>
+</ul>
+
+<h2 id="bugfixes">Bugfixes</h2>
+
+<h3 id="architectureinternalsandplumbing">Architecture, internals, and plumbing</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29510">29510</a> objects.find should call search_limited if present</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35890">35890</a> AutoLocation system preference + setting the library IP field - can still login and unexpected results</li>
+</ul>
+
+<h4 id="otherbugsfixed">Other bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35918">35918</a> Incorrect library used when AutoLocation configured using the same IP</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36072">36072</a> Can request articles even if ArticleRequests is off</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36092">36092</a> sessionID not passed to the template on auth.tt</li>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36176">36176</a> [23.11 and below] We need tests to check for 'cud-' operations in stable branches (pre-24.05)</li>
+</ul>
+
+<h3 id="authentication">Authentication</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034">36034</a> cas_ticket is set to serialized patron object in session</li>
+</ul>
+
+<h3 id="cataloging">Cataloging</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35343">35343</a> record method, required for bug 26611, missing from Koha::Authority</li>
+</ul>
+
+<h3 id="circulation">Circulation</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35518">35518</a> Call to C4::Context->userenv happens before it's gets populated breaks code logic in circulation</li>
+</ul>
+
+<h3 id="opac">OPAC</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35941">35941</a> OPAC user can guess clubs of other users</li>
+</ul>
+
+<h4 id="otherbugsfixed">Other bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942">35942</a> OPAC user can enroll several times to the same club</li>
+</ul>
+
+<h3 id="reports">Reports</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31988">31988</a> manager.pl is only user for "Catalog by item type" report</li>
+</ul>
+
+<h3 id="testsuite">Test Suite</h3>
+
+<h4 id="otherbugsfixed">Other bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35904">35904</a> C4::Auth::checkauth cannot be tested easily</li>
+</ul>
+
+<h3 id="webservices">Web services</h3>
+
+<h4 id="criticalbugsfixed">Critical bugs fixed</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893">34893</a> ILS-DI can return the wrong patron for AuthenticatePatron</li>
+</ul>
+
+<h2 id="enhancements">Enhancements</h2>
+
+<h3 id="architectureinternalsandplumbing">Architecture, internals, and plumbing</h3>
+
+<h4 id="enhancements">Enhancements</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27342">27342</a> Improve readability and improvement of C4::Auth::get_template_and_user</li>
+</ul>
+
+<h3 id="serials">Serials</h3>
+
+<h4 id="enhancements">Enhancements</h4>
+
+<ul>
+<li><a href="http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23352">23352</a> Define serial's collection in the subscription</li>
+</ul>
+
+<h2 id="documentation">Documentation</h2>
+
+<p>The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is</p>
+
+<ul>
+<li><p><a href="http://koha-community.org/documentation/">Koha Documentation</a>
+As of the date of these release notes, the Koha manual is available in the following languages:</p></li>
+<li><p><a href="https://koha-community.org/manual/22.05//html/">Chinese (Traditional)</a> (63%)</p></li>
+<li><a href="https://koha-community.org/manual/22.05//html/">English</a> (100%)</li>
+<li><a href="https://koha-community.org/manual/22.05/en/html/">English (USA)</a></li>
+<li><a href="https://koha-community.org/manual/22.05/fr/html/">French</a> (41%)</li>
+<li><a href="https://koha-community.org/manual/22.05/de/html/">German</a> (40%)</li>
+<li><a href="https://koha-community.org/manual/22.05/hi/html/">Hindi</a> (75%)</li>
+</ul>
+
+<p>The Git repository for the Koha manual can be found at</p>
+
+<ul>
+<li><a href="https://gitlab.com/koha-community/koha-manual">Koha Git Repository</a></li>
+</ul>
+
+<h2 id="translations">Translations</h2>
+
+<p>Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:</p>
+
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (71%)
+- Dutch (84%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (99%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (61%)
+- Persian (fa_ARAB) (69%)
+- Polish (99%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (79%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+<p>Partial translations are available for various other languages.</p>
+
+<p>The Koha team welcomes additional translations; please see</p>
+
+<ul>
+<li><a href="http://wiki.koha-community.org/wiki/Translating_Koha">Koha Translation Info</a></li>
+</ul>
+
+<p>For information about translating Koha, and join the koha-translate 
+list to volunteer:</p>
+
+<ul>
+<li><a href="http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate">Koha Translate List</a></li>
+</ul>
+
+<p>The most up-to-date translations can be found at:</p>
+
+<ul>
+<li><a href="http://translate.koha-community.org/">Koha Translation</a></li>
+</ul>
+
+<h2 id="releaseteam">Release Team</h2>
+
+<p>The release team for Koha 22.05.20 is</p>
+
+<ul>
+<li><p>Release Manager: Katrin Fischer</p></li>
+<li><p>Release Manager assistants:</p>
+
+<ul>
+<li>Tomás Cohen Arazi</li>
+<li>Martin Renvoize</li>
+<li>Jonathan Druart</li>
+</ul></li>
+<li><p>QA Manager: Marcel de Rooy</p></li>
+<li><p>QA Team:</p>
+
+<ul>
+<li>Marcel de Rooy</li>
+<li>Julian Maurice</li>
+<li>Lucas Gass</li>
+<li>Victor Grousset</li>
+<li>Kyle M Hall</li>
+<li>Nick Clemens</li>
+<li>Martin Renvoize</li>
+<li>Tomás Cohen Arazi</li>
+<li>Aleisha Amohia</li>
+<li>Emily Lamancusa</li>
+<li>David Cook</li>
+<li>Jonathan Druart</li>
+<li>Pedor Amorim</li>
+</ul></li>
+<li><p>Topic Experts:</p>
+
+<ul>
+<li>UI Design -- Owen Leonard</li>
+<li>Zebra -- Fridolin Somers</li>
+<li>REST API -- Tomás Cohen Arazi</li>
+<li>ERM -- Matt Blenkinsop</li>
+<li>ILL -- Pedro Amorim</li>
+<li>SIP2 -- Matthias Meusburger</li>
+<li>CAS -- Matthias Meusburger</li>
+</ul></li>
+<li><p>Bug Wranglers:</p>
+
+<ul>
+<li>Aleisha Amohia</li>
+<li>Indranil Das Gupta</li>
+</ul></li>
+<li><p>Packaging Managers:</p>
+
+<ul>
+<li>Mason James</li>
+<li>Indranil Das Gupta</li>
+<li>Tomás Cohen Arazi</li>
+</ul></li>
+<li><p>Documentation Manager: Aude Charillon</p></li>
+<li><p>Documentation Team:</p>
+
+<ul>
+<li>Caroline Cyr La Rose</li>
+<li>Kelly McElligott</li>
+<li>Philip Orr</li>
+<li>Marie-Luce Laflamme</li>
+<li>Lucy Vaux-Harvey</li>
+</ul></li>
+<li><p>Translation Manager: Jonathan Druart</p></li>
+<li><p>Wiki curators: </p>
+
+<ul>
+<li>Thomas Dukleth</li>
+<li>Katrin Fischer</li>
+</ul></li>
+<li><p>Release Maintainers:</p>
+
+<ul>
+<li>23.11 -- Fridolin Somers</li>
+<li>23.05 -- Lucas Gass</li>
+<li>22.11 -- Frédéric Demians</li>
+<li>22.05 -- Danyon Sewell</li>
+</ul></li>
+<li><p>Release Maintainer assistants:</p>
+
+<ul>
+<li>22.05 -- Wainui Witika-Park</li>
+</ul></li>
+</ul>
+
+<h2 id="credits">Credits</h2>
+
+<p>We thank the following individuals who contributed patches to Koha 22.05.20</p>
+
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (7)
+- Nick Clemens (1)
+- Jonathan Druart (22)
+- Lucas Gass (1)
+- Victor Grousset (1)
+- Kyle M Hall (4)
+- Andreas Jonsson (3)
+- Julian Maurice (1)
+- Martin Renvoize (3)
+- root (1)
+- Marcel de Rooy (1)
+- Fridolin Somers (2)
+- Wainui Witika-Park (6)
+</div>
+
+<p>We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.20</p>
+
+<div style="column-count: 2;">
+
+- BibLibre (3)
+- ByWater-Solutions (6)
+- Catalyst (6)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (23)
+- Kreablo AB (3)
+- PTFS-Europe (3)
+- Rijksmuseum (1)
+- Theke Solutions (7)
+- wainuiwitikapark-lp.dynamic.wgtn.cat-it.co.nz (1)
+</div>
+
+<p>We also especially thank the following individuals who tested patches
+for Koha</p>
+
+<div style="column-count: 2;">
+
+- Aleisha Amohia (6)
+- Tomás Cohen Arazi (2)
+- Matt Blenkinsop (7)
+- Nick Clemens (1)
+- Frédéric Demians (3)
+- Jonathan Druart (4)
+- Magnus Enger (2)
+- Lucas Gass (2)
+- Victor Grousset (2)
+- Kyle M Hall (13)
+- Andrew Fuerste Henry (1)
+- Owen Leonard (1)
+- David Nind (2)
+- Martin Renvoize (24)
+- Marcel de Rooy (6)
+- Fridolin Somers (4)
+- Wainui Witika-Park (29)
+</div>
+
+<p>We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.</p>
+
+<h2 id="revisioncontrolnotes">Revision control notes</h2>
+
+<p>The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:</p>
+
+<ul>
+<li><a href="https://git.koha-community.org/koha-community/koha">Koha Git Repository</a></li>
+</ul>
+
+<p>The branch for this version of Koha and future bugfixes in this release
+line is 22.05.x.</p>
+
+<h2 id="bugsandfeaturerequests">Bugs and feature requests</h2>
+
+<p>Bug reports and feature requests can be filed at the Koha bug
+tracker at:</p>
+
+<ul>
+<li><a href="http://bugs.koha-community.org">Koha Bugzilla</a></li>
+</ul>
+
+<p>He rau ringa e oti ai.
+(Many hands finish the work)</p>
+
+<p>Autogenerated release notes updated last on 28 Mar 2024 00:07:46.</p>
diff --git a/misc/release_notes/release_notes_22_05_20.md b/misc/release_notes/release_notes_22_05_20.md
new file mode 100644
index 0000000000..e46a3f981d
--- /dev/null
+++ b/misc/release_notes/release_notes_22_05_20.md
@@ -0,0 +1,347 @@
+# RELEASE NOTES FOR KOHA 22.05.20
+28 Mar 2024
+
+Koha is the first free and open source software library automation
+package (ILS). Development is sponsored by libraries of varying types
+and sizes, volunteers, and support companies from around the world. The
+website for the Koha project is:
+
+- [Koha Community](http://koha-community.org)
+
+Koha 22.05.20 can be downloaded from:
+
+- [Download](http://download.koha-community.org/koha-22.05.20.tar.gz)
+
+Installation instructions can be found at:
+
+- [Koha Wiki](http://wiki.koha-community.org/wiki/Installation_Documentation)
+- OR in the INSTALL files that come in the tarball
+
+Koha 22.05.20 is a security bugfix/maintenance release.
+
+It includes 2 enhancements, 20 bugfixes.
+
+**System requirements**
+
+You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations).
+
+
+#### Security bugs
+
+- [24879](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=24879) Add missing authentication checks
+- [30524](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30524) Add base framework for dealing with CSRF in Koha
+- [35960](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35960) XSS in staff login form
+- [36244](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36244) Template toolkit syntax not escaped in letter templates
+- [36322](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36322) Can run docs/**/*.pl from the UI
+- [36323](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36323) koha_perl_deps.pl can be run from the UI
+
+## Bugfixes
+
+### Architecture, internals, and plumbing
+
+#### Critical bugs fixed
+
+- [29510](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29510) objects.find should call search_limited if present
+- [35890](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35890) AutoLocation system preference + setting the library IP field - can still login and unexpected results
+
+#### Other bugs fixed
+
+- [35918](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35918) Incorrect library used when AutoLocation configured using the same IP
+- [36072](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36072) Can request articles even if ArticleRequests is off
+- [36092](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36092) sessionID not passed to the template on auth.tt
+- [36176](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36176) [23.11 and below] We need tests to check for 'cud-' operations in stable branches (pre-24.05)
+
+### Authentication
+
+#### Critical bugs fixed
+
+- [36034](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36034) cas_ticket is set to serialized patron object in session
+
+### Cataloging
+
+#### Critical bugs fixed
+
+- [35343](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35343) record method, required for bug 26611, missing from Koha::Authority
+
+### Circulation
+
+#### Critical bugs fixed
+
+- [35518](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35518) Call to C4::Context->userenv happens before it's gets populated breaks code logic in circulation
+
+### OPAC
+
+#### Critical bugs fixed
+
+- [35941](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35941) OPAC user can guess clubs of other users
+
+#### Other bugs fixed
+
+- [35942](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942) OPAC user can enroll several times to the same club
+
+### Reports
+
+#### Critical bugs fixed
+
+- [31988](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31988) manager.pl is only user for "Catalog by item type" report
+
+### Test Suite
+
+#### Other bugs fixed
+
+- [35904](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35904) C4::Auth::checkauth cannot be tested easily
+
+### Web services
+
+#### Critical bugs fixed
+
+- [34893](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34893) ILS-DI can return the wrong patron for AuthenticatePatron
+
+## Enhancements 
+
+### Architecture, internals, and plumbing
+
+#### Enhancements
+
+- [27342](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27342) Improve readability and improvement of C4::Auth::get_template_and_user
+
+### Serials
+
+#### Enhancements
+
+- [23352](http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23352) Define serial's collection in the subscription
+
+## Documentation
+
+The Koha manual is maintained in Sphinx. The home page for Koha
+documentation is
+
+- [Koha Documentation](http://koha-community.org/documentation/)
+As of the date of these release notes, the Koha manual is available in the following languages:
+
+- [Chinese (Traditional)](https://koha-community.org/manual/22.05//html/) (63%)
+- [English](https://koha-community.org/manual/22.05//html/) (100%)
+- [English (USA)](https://koha-community.org/manual/22.05/en/html/)
+- [French](https://koha-community.org/manual/22.05/fr/html/) (41%)
+- [German](https://koha-community.org/manual/22.05/de/html/) (40%)
+- [Hindi](https://koha-community.org/manual/22.05/hi/html/) (75%)
+
+The Git repository for the Koha manual can be found at
+
+- [Koha Git Repository](https://gitlab.com/koha-community/koha-manual)
+
+## Translations
+
+Complete or near-complete translations of the OPAC and staff
+interface are available in this release for the following languages:
+<div style="column-count: 2;">
+
+- Arabic (ar_ARAB) (81%)
+- Armenian (hy_ARMN) (100%)
+- Bulgarian (bg_CYRL) (100%)
+- Chinese (Traditional) (95%)
+- Czech (71%)
+- Dutch (84%)
+- English (100%)
+- English (New Zealand) (69%)
+- English (USA)
+- Finnish (95%)
+- French (99%)
+- French (Canada) (99%)
+- German (100%)
+- German (Switzerland) (61%)
+- Greek (61%)
+- Hindi (100%)
+- Italian (100%)
+- Norwegian Bokmål (61%)
+- Persian (fa_ARAB) (69%)
+- Polish (99%)
+- Portuguese (Brazil) (83%)
+- Portuguese (Portugal) (85%)
+- Russian (79%)
+- Slovak (71%)
+- Spanish (100%)
+- Swedish (87%)
+- Telugu (85%)
+- Turkish (99%)
+- Ukrainian (73%)
+- hyw_ARMN (generated) (hyw_ARMN) (76%)
+</div>
+
+Partial translations are available for various other languages.
+
+The Koha team welcomes additional translations; please see
+
+- [Koha Translation Info](http://wiki.koha-community.org/wiki/Translating_Koha)
+
+For information about translating Koha, and join the koha-translate 
+list to volunteer:
+
+- [Koha Translate List](http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-translate)
+
+The most up-to-date translations can be found at:
+
+- [Koha Translation](http://translate.koha-community.org/)
+
+## Release Team
+
+The release team for Koha 22.05.20 is
+
+
+- Release Manager: Katrin Fischer
+
+- Release Manager assistants:
+  - Tomás Cohen Arazi
+  - Martin Renvoize
+  - Jonathan Druart
+
+- QA Manager: Marcel de Rooy
+
+- QA Team:
+  - Marcel de Rooy
+  - Julian Maurice
+  - Lucas Gass
+  - Victor Grousset
+  - Kyle M Hall
+  - Nick Clemens
+  - Martin Renvoize
+  - Tomás Cohen Arazi
+  - Aleisha Amohia
+  - Emily Lamancusa
+  - David Cook
+  - Jonathan Druart
+  - Pedor Amorim
+
+- Topic Experts:
+  - UI Design -- Owen Leonard
+  - Zebra -- Fridolin Somers
+  - REST API -- Tomás Cohen Arazi
+  - ERM -- Matt Blenkinsop
+  - ILL -- Pedro Amorim
+  - SIP2 -- Matthias Meusburger
+  - CAS -- Matthias Meusburger
+
+- Bug Wranglers:
+  - Aleisha Amohia
+  - Indranil Das Gupta
+
+- Packaging Managers:
+  - Mason James
+  - Indranil Das Gupta
+  - Tomás Cohen Arazi
+
+- Documentation Manager: Aude Charillon
+
+- Documentation Team:
+  - Caroline Cyr La Rose
+  - Kelly McElligott
+  - Philip Orr
+  - Marie-Luce Laflamme
+  - Lucy Vaux-Harvey
+
+- Translation Manager: Jonathan Druart
+
+
+- Wiki curators: 
+  - Thomas Dukleth
+  - Katrin Fischer
+
+- Release Maintainers:
+  - 23.11 -- Fridolin Somers
+  - 23.05 -- Lucas Gass
+  - 22.11 -- Frédéric Demians
+  - 22.05 -- Danyon Sewell
+
+- Release Maintainer assistants:
+  - 22.05 -- Wainui Witika-Park
+
+## Credits
+
+
+
+We thank the following individuals who contributed patches to Koha 22.05.20
+<div style="column-count: 2;">
+
+- Aleisha Amohia (1)
+- Tomás Cohen Arazi (7)
+- Nick Clemens (1)
+- Jonathan Druart (22)
+- Lucas Gass (1)
+- Victor Grousset (1)
+- Kyle M Hall (4)
+- Andreas Jonsson (3)
+- Julian Maurice (1)
+- Martin Renvoize (3)
+- root (1)
+- Marcel de Rooy (1)
+- Fridolin Somers (2)
+- Wainui Witika-Park (6)
+</div>
+
+We thank the following libraries, companies, and other institutions who contributed
+patches to Koha 22.05.20
+<div style="column-count: 2;">
+
+- BibLibre (3)
+- ByWater-Solutions (6)
+- Catalyst (6)
+- Catalyst Open Source Academy (1)
+- Koha Community Developers (23)
+- Kreablo AB (3)
+- PTFS-Europe (3)
+- Rijksmuseum (1)
+- Theke Solutions (7)
+- wainuiwitikapark-lp.dynamic.wgtn.cat-it.co.nz (1)
+</div>
+
+We also especially thank the following individuals who tested patches
+for Koha
+<div style="column-count: 2;">
+
+- Aleisha Amohia (6)
+- Tomás Cohen Arazi (2)
+- Matt Blenkinsop (7)
+- Nick Clemens (1)
+- Frédéric Demians (3)
+- Jonathan Druart (4)
+- Magnus Enger (2)
+- Lucas Gass (2)
+- Victor Grousset (2)
+- Kyle M Hall (13)
+- Andrew Fuerste Henry (1)
+- Owen Leonard (1)
+- David Nind (2)
+- Martin Renvoize (24)
+- Marcel de Rooy (6)
+- Fridolin Somers (4)
+- Wainui Witika-Park (29)
+</div>
+
+
+
+
+
+We regret any omissions.  If a contributor has been inadvertently missed,
+please send a patch against these release notes to koha-devel@lists.koha-community.org.
+
+## Revision control notes
+
+The Koha project uses Git for version control.  The current development
+version of Koha can be retrieved by checking out the master branch of:
+
+- [Koha Git Repository](https://git.koha-community.org/koha-community/koha)
+
+The branch for this version of Koha and future bugfixes in this release
+line is 22.05.x.
+
+## Bugs and feature requests
+
+Bug reports and feature requests can be filed at the Koha bug
+tracker at:
+
+- [Koha Bugzilla](http://bugs.koha-community.org)
+
+He rau ringa e oti ai.
+(Many hands finish the work)
+
+Autogenerated release notes updated last on 28 Mar 2024 00:07:46.

From 41c3959a5eba0caa465fd667da0b76565a49b97f Mon Sep 17 00:00:00 2001
From: Tomas Cohen Arazi <tomascohen@theke.io>
Date: Thu, 28 Mar 2024 08:32:19 -0300
Subject: [PATCH 56/56] Make DBRev 220520000 executable

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
---
 installer/data/mysql/db_revs/220520000.pl | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 installer/data/mysql/db_revs/220520000.pl

diff --git a/installer/data/mysql/db_revs/220520000.pl b/installer/data/mysql/db_revs/220520000.pl
old mode 100644
new mode 100755