Test plan:
1) Navigate to ERM agreements and create an agreement
2) In the agreements table, click on the filter for Is Perpetual
3) Only the option for 'Yes' will be shown
4) Apply patch
5) yarn js:build
6) Hard refresh the browser and repeat step 2
7) Filter options for Yes and No should be available
8) Check the filtering works appropriately
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5594945339)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit cf1464d290)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1 - apply patch
2 - make sure registers are enabled in system preferences so the permission shows
3 - find a patron, set permissions
4 - confirm the permission reads "Pefform refunds of point of sale transactions."
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 64702f4320)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 3d8a10a53b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch updates the terminology used in the overdue notice (ODUE)
to change 'branch' to 'library'.
Test plan:
1. Check the wording of the ODUE notice under Tools > Patrons and
circulation > Notices and slips.
2. Note that it includes this wording that uses 'branch':
"Please return or renew them at the branch below as soon as possible."
3. Apply the patch.
4. Check that the updated ODUE notice has changed 'branch' to 'library'
by either:
4.1 Resetting everything: reset_all
4.2 Viewing the default notice - click "View default" when viewing
the email notice
The updated text is now: "Please return or renew your overdue items
at the library as soon as possible."
5. Sign off.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4bd1bc0a6f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit b65e193871)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We are removing a wrong method name at the same time ;)
Test plan:
Read the patch. Just removing a few outdated POD lines.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 64b78fe3c4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 129012ff78)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Also corrects the alphabetic ordering for Calyx.
To test:
* Apply patch
* Go to About Koha: you can do so from the more menu or by clicking
on the version number in the bottom right corner
* Open the tab "Koha team"
* Scroll to the bottom of the page and verify that KIT and CLAMS show
up in the correct spot in the list of "Contributing companies and institutions"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bead469858)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 717eee0fcf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds <span>s with classes around the patron's email and phone
information in the results of the overdues report. This will allow for
greater flexibility in styling or hiding the information.
To test, apply the patch and go to Administration -> Sytem preferences
-> IntranetUserCSS.
- Add this to the preference:
.overdue_email { color: red; }
.overdue_phone { color: blue; }
- Go to Circulation -> Overdues and confirm that you can see the custom
colors in the results.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b70a325dd2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 739c4fa01c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch revises the breadcrumbs in the staff interface lists template
so that the correct link is shown when editing or viewing a public list.
To test, apply the patch and go to Lists in the staff interface.
- Create a public list
- Go to the list of public lists
- Click to view your newly created public list
- The breadcrumb menu should show Lists -> Public lists -> Contents of
[list name]
- The link to public lists should work correctly.
- Perform the same check when editing your public list.
- Check the viewing and editing of a private list to make sure no
breadcrumb errors were introduced.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 38a8428a0a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 731119a287)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Have some orders that are late.
2. Go to the late orders page (
http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl )
3. Try to use the export function, nothing happens.
4. APPLY PATCH
5. Try steps 1 and 3 again, this time the export function should work.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cdf88e0237)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Decoded the barcode in add items to collection.
Test plan:
1. Go to Tools -> Rotating collections
2. Create a rotating collection
3. Chose Actions -> Manage items
4. Paste a barcode and put some spaces around it, for example " 39999000010053 "
5. Click Submit => Shown an error, no item with matching barcode found, though the barcode is printed without all the whitespace
6. Apply patch
7. Repeat steps 1 - 5, barcode should be accepted
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2c730040b1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 80a1810316)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes selection of a library when editing a desk in
Administration. The form should provide all libraries as options, not
just the currently selected one.
To test, apply the patch and go to Administration -> Desks.
- If necessary, create a new desk.
- Edit the desk. The form should load with the correct library prefilled
in the <select>, but should offer all libraries as a choices.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20085be7fb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit f94664313d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bootstrap 5 sets the "resize" property on textareas to "vertical." For
our purposes this is a regression in functionality and should be
overridden.
To test, apply the patch and rebuild OPAC and staff interface CSS.
- Log into the OPAC and go to the "Your personal details" page.
- Under "Alternate address" -> "Contact note," check that the textarea
can be freely resized.
- In the staff client, create a new patron and test the same textarea in
that form.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit df3e44b88b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 694ff22961)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch improves the accessibility of the OPAC. It's a trivial patch
to help assistive technologies understand the different tables.
Test plan:
Enable the system preferences: OPACShelfBrowser, OPACPrivacy,
ShowComponentRecords.
1- On the Koha OPAC, Research a record.
2- Inspect the result page HTML and notice that there is a
role='presentation' in the table tag.
3- Choose a record with a Component section and inspect the HTML, there
should be a role='presentation' in the table tag.
4- Open the Browse shelf. Inspect the HTML and notice that there is a
role='presentation' in the table tag of the browse shelf.
5- Log in to a patron account, go to the Your Summary page, and choose
Privacy in the menu.
6- Inspect the HTML of the page and notice that there is a
role='presentation' in the table tag of the 'Immediate deletion'.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bc9dfb4b8e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 428d787526)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1 - Create a patron in a category that can be a guarantee and do not assign any guarantor
2 - Create a patron in a 'Child' account type and do not assign a guarantor
3 - Enable system preference 'ChildNeedsGuarantor'
4 - View 'Check out' and 'Details' tabs for both patrons, note there is no warning
5 - Apply patch
6 - Repeat 4, note warning on all pages
7 - Add a patron gaurantor on the child - repeat 4 - warning is gone
8 - Add non-patron guarantor information to other patron - repeat 4 - warning is gone
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a catch during circulatoin actions and passes a message back to the caller
For checkouts and renewals we don't have a method for passing messages so we simply catch the exception
and warn - this seems reasonable, as we have now added a warning on the patron display that they are missing
a guarantor
To test:
1 - Create a Child type patron with no guarantor
2 - Create a patron in a non-child category that can_be_guarantee with no guarantor
3 - Check out an item to each patron above
4 - Enable system preference 'ChildNeedsGuarantor' and TrackLastPatronActivityTriggers - select all
5 - In mysql
UPDATE borrowers SET datelastseen = '2025-01-01';
6 - Restart all to clear cache (so update last seen will update)
7 - Attempt to checkout a book to either patron - 500 error
8 - Attempt to returnt he books the patrons have checked out - 500 error
9 - Attempt to renew their items - 500 error
10 - Apply patches, restart all
11 - Repeat checkout, renewal, checkin
12 - On checkout and renewal there should be a warning on the patron page, but actions succeed with no additional problems
13 - On return you get a warning letting you know the action succeeded but there is still a problem to resolve
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Uncaught TypeError: col.data is undefined
This patch removes the ability to
* search by status
* search or sort by "last run"
But fix the JS error that will restore the other features
Test plan:
- Activate the ERMModule via the system preference
- Add at least one data provider
- In the list of data providers, type anything in the general search field on top
=> Confirm that you can use the different features of the table without
JS errors
Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bd52dab411)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 3396a46c28)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
01:18:38 koha_1 | # Failed test 'no warnings'
01:18:38 koha_1 | # at /usr/share/perl/5.38/Test/Builder.pm line 193.
01:18:38 koha_1 | # There were 6 warning(s)
01:18:38 koha_1 | # Previous test 4 '401 Unauthorized'
01:18:38 koha_1 | # Use of uninitialized value $aMask[1079] in bitwise xor (^) at /usr/share/perl5/GD/Barcode/QRcode.pm line 217.
01:18:38 koha_1 | # at /usr/share/perl5/GD/Barcode/QRcode.pm line 217.
jammy (22.04LTS) (perl): 1.15-7
noble (24.04LTS) (perl): 2.00-1
I guess it's fixed by
85e7911e65
But it is not released yet: version 2 is from September 2023 and commit from March 2024.
Test plan:
Install version 2 of GD::Barcode:
`cpanm GD::Barcode@2.0.0`
Run the tests
Without this patch the "no warnings" test fails
With this patch applied the tests pass
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fd6ceb6b24)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit ddf1b9dfe3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
* on the patron page click edit at the top, entered a preferred name, and hit save
* we should see the preferred name being displayed instead of the first name for the user
* go back to the main edit page and change the preferred name to a blank space
* We should revert back to the first name being used
* if we open the edit page back up we should see the first name in the preferred name field
* Edit the preferred name again and click on details
* open up any of the sections other then contact information
* hit the save button on the section without changing anything
* you should still see the preferred name you set being used.
* open up an individual section other then contact method, change a value, then save
* you should still see the preferred name you set being used.
* open up the contact information section and save without changing anything
* the preferred name should be intact
* open up the contact information and change the preferred name, and save.
* you should see the new preferred name reflected.
* Open up the contact information section, change the preferred name field to a blank and save.
* you should see the first name being used now.
* Open up the contact information section, and put any number of spaces in the preferred name with nothing else and then save.
* you should still see the first name being used.
Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4356c14d29)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit bdefe52d46)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The patron search modal in the patron card creator -> new batch ->
patron search has two select2 modals, sort1 and sort2. If these are not
anchored to the modal they will be anchored to the body element and
appear behind the modal.
To test, apply the patch and go to Tools -> Patron card creator -> New
-> Card batch.
- Click "Add patron(s)"
- Test the "Sort 1" and "Sort 2" dropdowns. They should work correctly.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20313df192)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 4afb657fe8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds an ID to the "Skip bibliographic records with open
acquisition orders" checkbox on the batch record deletion page (Cataloging >
Batch editing > Batch record deletion".
This is required so that when selecting or unselecting the checkbox, the focus
remains on the checkbox.
Test plan:
1. Navigate to Home > Cataloging > Batch record deletion
2. Click 'Skip bibliographic records with open acquisition orders' to toggle
the Record type checkbox (selected by default).
3. Inspect the page (right click the page, select Inspect, and look at the
values in the checheckbox input field):
. before the patch there is no id for the field
. after the patch there is an id="skip_open_orders" for the checkbox field
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b3666a7233)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 4038fcb6e0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
After changes to about.pl the checking of the Zebra status has landed
in "sysinfo" section instead of "about". As a result "Zebra status"
always reports "Running" even if Zebra is off.
Test plan:
==========
1. Turn zebra server off (koha-zebra --stop kohadev) and check in
"Server information" (More > About Koha) the "Zebra status" info.
You will see "Running".
2. Apply the patch ; restart_all ; koha-zebra --stop kohadev
3. Check "Zebra status" in "Server information". You should see now:
"Zebra server seems not to be available. Is it started?".
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1835ced4c0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 35267ecfa8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch add support for AuthorLinkSortBy and AuthorLinkSortOrder in
the default UNIMARC XSLT files.
The description of the syspref is also slighly updated to hint users of
custom XSLT file about the need to update their template.
To test:
0. On a UNIMARC database
1. Set AuthorLinkSortBy to 'title' and AuthorLinkSortORder to
'descending'
2. On the intranet and OPAC, search for an author you have multiple
titles from and click on a result
3. Click on a link one a name for an author
4. Note a new search is performed, sorted by field from defaultSortField
preference and not by title descending
5. Apply the patch
6. restart_all
7. Check that the syspref description now include a note about custom
XSLT files
8. Repeat step 2 and 3
9. Note a new search is performed, sorted by title descending
10. Test other values - confirm links are updated in both staff and opac
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4581e399bb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit fa9279644a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch corrects a couple of templates which include a Bootstrap
popover component, updating the data attributes which were missed during
the BS5 upgrade.
The patch also makes a minor change to CSS in order for the popover
heading to not have unwanted margins.
To test, apply the patch and rebuild the staff interface CSS.
- Perform a catalog search in the staff interface.
- Add one or more items to the cart.
- Open the cart and hover your cursor over the "Items" heading. A
popover should be triggered with a message about item sorting.
- Go to Administration -> Circulation and Fine rules.
- Edit a rule to add content to the "Note" field.
- Save the rule and then hover your cursor over the "View note" text.
The note you added should appear in a popover.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eb1e00455e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit c0f86a7598)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes the column span in the table footer rows of the account
payment page (pay.tt). I've also added a couple of lines of CSS to style
the footer rows.
To test, apply the patch and rebuild the staff interface CSS.
- In the staff client, locate a patron with charges.
- If necessary, go to a patrons "Accounting" tab and use the "Create
manual invoice" page to add one or more charges to the account.
- Under the "Make a payment" tab there should be one or more footer rows
including "Total due." The "Total due" cell should be aligned right,
with a grey background.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 92c6516651)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.
Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
- Koha::Patrons::Import
- Koha::BackgroundJob::ImportKBARTFile
- Koha::ERM::EUsage::CounterFile
The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.
Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data
To test:
1. Apply the previous patch (author test)
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
- Koha/BackgroundJob/ImportKBARTFile.pm
- Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.
Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
- Koha::Patrons::Import
The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.
Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data
To test:
1. Apply the previous patch (author test)
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 1 file without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch fixes a XSS vulnerability in the
suspend hold modal in the staff interface.
By building our Javascript using Web APIs rather
than with strings and jQuery's html() method,
we're able to securely handle malicious payloads.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29
2. Add a hold for "koha" patron
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "Holds" tab and click "Suspend"
5. Note the modal loads properly
6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
7. Click "Holds" tab and click "Suspend"
8. Note the modal loads properly
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 40538: Simplify code
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
See also comment33, point 4.
Test plan:
cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/
Test enabling/disabling by toggling the comment of the SetEnvIf line,
restart apache and remove the KOHA_INIT and CGISESSID cookie.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This patch adds a fast simple bot challenge via Apache.
To test:
0. Apply the patch
1. sudo cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/.
2. sudo cp debian/templates/apache-shared-opac-plack.conf /etc/koha/.
3. curl http://localhost:8080/cgi-bin/koha/opac-search.pl
4. Note an instant response with a very simple HTML response
5. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-search.pl
6. Note a very brief loading animation before the OPAC search page appearing
7. Do a search
8. Note no more loading animation appears
9. Close the incognito browser
10. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-main.pl
11. Do a search via the "Library catalog" search bar
12. Note no loading animation appears
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Cornelius Hertfelder <cornelius.hertfelder@bsz-bw.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
We have tested this in production on at least three live sites for
several weeks, and it has worked as expected. We have not noticed any
negative side effects.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This patch changes the script to use 'Koha::PseudonymizedTransaction->new_from_statistic' directly
rather than calling 'Koha::Statistic->pseudonymize()' which generates a background job.
Additionally, some of the checks from 'pseudonymnize' and the background job are moved into the search
so we don't fetch any to pseudonymize that should not be.
To test:
1 - Generate some entries in statistics (checkin, checkout, renew, etc)
2 - Enable pseudonymization (see bug 28911 if you need bcrypt settings)
3 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
4 - Statistics pseudonymized
5 - Check the background jobs table, note jobs were generated
6 - Apply patch
7 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
8 - You get same count as before, and are warned of existing pseudonymized transactions
9 - enter 'Y' to continue
10 - Check the pseudonymized_transacations table
11 - Confirm same rows were generated twice
12 - Check the background jobs
13 - Confirm there were no new jobs generated (for pseudonymization)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 342c1d5993)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The koha-mysql didn't work when the instance was set up to use an encrypted
database connection.
Please note: this testplan is for ktd, not for a production environment!
Unfortunately, there are some issues with the database TLS configuration in koha-testing-docker.
This is described comment 14 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c14)
As a workaround, you can add "mysql_ssl_optional=1" in Koha/Database.pm.
See point (g) in comment 15 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c15)
Testing Database Connection Encryption:
1. Apply the patch.
2. Configure koha-conf.xml to use a TLS connection
(see comment 10 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c10, follow steps 3a-g + 4 )
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the encryption settings in the MySQL console:
- run:
SHOW VARIABLES LIKE '%ssl%';
- run:
STATUS;
Ensure that the following conditions are met:
- have_openssl and have_ssl are set to "YES".
- The SSL cipher in use is displayed.
Testing MySQL Timezone Configuration:
1. Apply the patch.
2. Configure the timezone in koha-conf.xml, for example:
<timezone>Antarctica/South_Pole</timezone>
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the timezone setting in the MySQL console by running:
SELECT @@session.time_zone;
6. Confirm that the output matches the timezone configured in koha-conf.xml.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 42ec5d36c2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We do not need 1 or 0 here btw. We just check for true.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 663830d9ed)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Set up a user with only catalogue and edit_items permissions
2. Create a Fast Add record with item
a. Go to Cataloging
b. Click on Fast Cataloging
c. Fill in mandatory fields and save the record
d. Fill in mandatory item fields and click Add item
3. Log in as the user you set up in step 1
4. Search for the record you created in step 2
5. Click Edit > Manage items in the menu at the top of the record
==> You do not have permission to access this page!
6. Go back to biblio record page
7. Apply patch and restart_all
8. Click Edit > Manage items again
==> Edit items page loads normally
9. Make a few edits and confirm that they save correctly
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6bfcd23bdb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1. Go to Administration > MARC Bibliographic framework
2. On the right side of the default framework, click on "Actions" >
"MARC Structure"
3. Search for field 780
4. Click on "Actions" > "Edit subfields"
5. Click on the "t" tab
6. Check "Editor" under the "Visibility" section
7. Click on "Save Changes"
8. Repeat steps 1 to 7 for field 785$t
9. Have or create a record with a value for 780 and 785 with the first
indicator at 0 and the other left empty
10. Look at the record on the staff interface and the OPAC
11. Notice that in Normal View, the values entered for 780 and 785 do
not have labels
12. Apply the patch
13. There are now labels in the staff interface and the OPAC
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ba2ec1d202)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1. Go to Administration > MARC Bibliographic framework
2. On the right side of the default framework, click on "Actions" >
"MARC Structure"
3. Search for field 780
4. Click on "Actions" > "Edit subfields"
5. Click on the "t" tab
6. Check "Editor" under the "Visibility" section
7. Click on "Save Changes"
8. Repeat steps 1 to 7 for field 785$t
9. Have or create a record with a value for 780 and 785 with the first
indicator at 0 and the other left empty
10. Go see the record on the OPAC
11. Notice that in Normal View, the value entered for 780 and 785 do not
have labels
12. Apply the patch
13. There are now labels
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a3bfa55919)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Because the template uses the wrong op, add_item rather than cud-additem, to
decide whether to include a hidden input with the itemnumber, if you edit an
item and then add another item you wind up submitting a form that includes the
previous itemnumber when you add a new one. Nothing happens, because the code
for adding an item doesn't look at $input->param('itemnumber'), but since it
doesn't mean anything we shouldn't be submitting it.
Test plan:
1. Without the patch, find any biblio with at least one item attached, and
in the items table click Edit item on one of them
2. Without needing to making any changes, click Save changes
3. In the page that loads, scroll down to the bottom of the Add item form,
right-click the Add item button, and choose Inspect
4. A few lines up, above a '<fieldset class="action">,' there will be an
'<input type="hidden" name="itemnumber" value="633">' with the itemnumber
of the item you previously edited
5. Apply patch
6. Scroll up, click Actions - Edit on any item, then Save changes
7. Again, right-click the Add item button, Inspect, note that there isn't a
itemnumber input with the number of the item you previously edited
Sponsored-by: Chetco Community Public Library
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit bcc6c2175a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When creating a new record starting from Normal records view, by using
New > New record warnings in the log will be generated like:
[2025/04/03 12:45:33] [WARN] Use of uninitialized value $frameworkcode
in string eq at /kohadevbox/koha/cataloguing/addbiblio.pl line 513.
Test plan:
==========
1. In staff interface, open any record in Normal view.
2. From upper menu chose New > New record.
3. Check the plack-intranet-error.log file, you should see fresh
warnings with "Use of uninitialized value $frameworkcode".
4. Apply the patch ; restart_all.
5. Repeat p. 1.-3. No new warnings.
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 70e43a0553)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The biblio details page Edit menu has three different elements which all
have id="modifybibilio", two of which also have another id. Neither of those
things is allowed.
Test plan:
1. Without the patch, load the details view for any biblio record and View
source
2. Search for id="modifybiblio"
3. You will get three results, the second and third shown with id in red
4. Apply patch, reload the page, View source and search again
5. You will get one result, without any red
Sponsored-by: Chetco Community Public Library
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8251e854d4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Matt Blenkinsop
Andrew Fuerste Henry
Courtney Brown
Marcel de Rooy
Katrin Fischer
Fridolin Somers
Owen Leonard
Emily Lamancusa
Lucas Gass
Yvonne Waterman
nina martinez
Nick Clemens
Jonathan Druart
Imani Thomas
Michael Hafen
Aman Pilgrim
Janusz Kaczmarek
Marion Durand
Pedro Amorim
Tomas Cohen Arazi
Mason James
Baptiste Wojtkowski
David Cook
Lukas Koszyk
William Lavoie
Phil Ringnalda
Julian Maurice