This patch fixes a bad conflict between bug 18726 and bug 10357.
The alerttype variable was not passed to the template on 16.11.x
Test plan:
- Add a subscription
- Make sure you set a notice template for 'notification' on the first page
- Go to the record in the OPAC
- Subscribe to email notifications from the Subscriptions tab > More detail
- Verify that the alert table in the database has the entry for the subscribed patron
- Verify that in the OPAC it now asks you to cancel subscription
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
The password must be correctly escape, it can contains html character
and break the display.
Test plan:
Apply first patch and confirm that the display is broken
Apply second patch (this one) and confirm that the display is fixed
Signed-off-by: Arturo <alongoria@sll.texas.gov>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit f6adfb4257)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit eb2592e028)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
When the password is not generated automatically, we should not escape
the html characters. Otherwise it will be changed without any warnings.
Signed-off-by: Arturo <alongoria@sll.texas.gov>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 25b2cd2d72)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8e909bcdb1)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit d9735ae0d8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a69b874ee6)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Test plan:
1) do not apply this patch
2) Have at least one vendor which name does contain javascript, for
example: <i>Vendor 1</i><script>alert('Hi');</script>
3) go to serial module and create new subscription
4) use "Search for vendor"
5) Search for your vendor, when search results table is presented, the
javascript is executed
6) go through subscription creation and save the new subscription
7) On subscription detail page, the javascript is executed as well
8) apply this patch
9) Repeat 3-7, the script is not executed, the input is escaped
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8a20bfe5ea)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Test plan:
Behave like a robot, you will get 404
Be a human, you will be tracked
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 40ca9443a8)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Use of uninitialized value in concatenation (.) or string at C4/Biblio.pm line 1456.
Note: In current master this is now line 1370 (Oct 9, 2017).
Test plan:
Enable COinSinOPACResults.
Select a record with leader pos6==a and pos7==a. This triggers genre to be
journalArticle and titletype to be a.
Without this patch, do an opac search that includes this record.
Check the log. You should see the warning.
Apply this patch, search again and check the log. The warning should not be
repeated again.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a82d54d4b4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0e1bc5db82)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
The info "Subscription from..." is showing twice on the subscription
tab on the OPAC detail page because of a bad merge. This patch removes
the doubled up information.
To test:
- Add a subscription
- Search for the record in the OPAC
- Switch to the subscription tab
- Verify that the 'Subscription from...' line is repeated
- Apply patch
- Verify only one line remains and nothing is missing
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field firstname, surname that contains js
3. Save the page.
4. click on fine tab
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To Test
1. Hit the page /cgi-bin/koha/members/memberentry.pl
2. Add a text in the field address, address2, city, state, country,
zipcode, B_streetnumber, B_city, B_country, B_zipcode that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Test
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field Name that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
We already know if the bibliographic record exists (404 redirect),
we can avoid unecessary fetches
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Correcting a few biblionumber template var leftovers in opac-detail
template. They were combined with url filter instead of html.
Test plan:
[1] Look for [^.;?]biblionumber in opac-detail.tt and verify that these
occurrences are fine.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Try going to this URL on your site: /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>
Test Plan:
1) Go to /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2"><TEST>
2) Note <TEST> is embedded all over the html
3) Apply this patch
4) Refresh the page, note the injection is gone!
5) run koha qa test tools
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To confirm all the files were modified for opac, typed
this:
$ git grep -i password | grep opac | grep -v "[.]po:" | grep
"opac[^/]*[.]tt:" | cut -f1 -d: | sort -u
The follow output was handled as follows:
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt
These were already done in the first patch.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
This already had the autocomplete modification.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt
This was a false-find. There was no modification necessary.
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
This is the modal login in. This patch amends it.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To test:
1/ go to /cgi-bin/koha/acqui/booksellers.pl or
/cgi-bin/koha/acqui/supplier.pl
2/ Note that it displays the delete vendor button instead of the
receive shipments button
3/ Apply patch
4/ Reload the page and notice the button is fixed
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The build_object method of TestBuilder has been added by bug 18182,
which is not in 16.11.x
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
JSON does not allow real line-breaks. If a field contains them and they are not escaped, a JSON parser will be unable to convert the stringified JSON back into an object.
This is clearly exemplified by the guarantor search, where a multi-line note on the guarantor's record will break the ability to select that guarantor.
Test Plan:
1) Create Patron A with a "Circulation note" that has multiple lines in it
2) Create Patron B
3) Attempt to set Patron A to be the guarantor for Patron B
4) Note selecting the patron does nothing
5) Apply this patch
6) Repeat step 3
7) Selecting the guarantor now works!
Signed-off-by: Simon Pouchol <simon.pouchol@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9cd9240c36)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit efb28c4af1)
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Patch applies and functions as described.
Signed-off-by: Dilan Johnpullé <dilan@calyx.net.au>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 48be40d1bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit fa0608bc4c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
This has been raised by failures on t/db_dependent/Circulation/issue.t
(thanks tests!)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 850243ee2e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9d3b39e94d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
MarkIssueReturned must now return directly if the issue does not exist.
We then check if the anonymous patron configuration is correct.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 60bb936bc2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 49beda2176)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To recreate:
1 - Manually add a lost fine to a ptron and include a barcode
2 - Attempt to write off the fine
3 - Internal server error
4 - Checkout an item and mark lost to checkin and fine
5 - Attempt to write off line
6 - Internal server error
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7b5c1fce58)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 243009bc9a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Allow patrons to enter either their library card number or user name in the "Log in" box for password recovery.
Most patrons at our library use their card number to log in and are unaware of what their userid is. However there are some who have set a
customized userid and would prefer to use that. This patch would allow either to be entered for password recovery.
To test:
1. Enable the password recovery feature.
2. In the OPAC, click on "Forgot you password?" link and enter a valid library card number.
3. The error message "No account found with the provided information" appears.
4. Apply the patch.
5. Repeat step 2. The recovery email is now sent.
Note: Moved patch from 16711 back here and re-tested.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e29163af4c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 17085ea1cb)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
CanBookBeIssued returns STATS if categorycode is X
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 090b450a50)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit fc4ee4aeec)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
1 - Have a patron with guarantees
2 - Charge some fines to the guarantees
3 - View the patron
4 - Fines are displayed unformatted
5 - Apply patch
6 - Refresh
7 - Fines should now be formatted correctly
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0d124e1bc3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 448c1206f8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
TEST PLAN
---------
0) back up database
1) drop database; create database
2) run web installer
3) prove t/db_dependent/Search.t
-- the spammy warnings (other than zebra index warnings) may
already be fixed, but the mocked value was not realistic.
4) apply patch
5) prove t/db_dependent/Search.t
-- notice only zebra index warnings.
6) run qa test tools
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5e63a38381)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 23c8acd615)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Adds a missing error flag to the template->param { } call.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 078eb77451)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 96143e8d9e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
When searching for a patron from the circulation tab, the results table
shows the date of birth unformatted.
Test plan:
Apply this patch, search for patrons in the circ tab and confirm that
the date of birth are correctly formatted according to the dateformat
syspref
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4edfc7900f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 7453b2c5d8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
In the meantime bug 19403 added default nulls for gonenoaddress, lost
and debarred. So these lines can be removed safely.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 12a754a703)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3e45ba75e9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Jonathan Druart
Chris Cormack
Koha translators
Josef Moravec
Marcel de Rooy
Bernardo Gonzalez Kriegel
root
Katrin Fischer
Amit Gupta
Kyle M Hall
Mark Tompsett
Gwendal Joncour
David Cook
David Kuhn
Pongtawat C
Nick Clemens
David Bourgault