This is a weird one. When using KohaTable the first button was not
displayed if it was a custom button.
Doing the following fixed the problem (adding an empty first elt):
dt_parameters["buttons"] = [{}]
dt_parameters["buttons"].push({the_clear_filter_button});
However adding the definition of the button to $.fn.dataTable.ext.buttons fixed the problem.
As described on https://datatables.net/extensions/buttons/custom#Custom-button-type
This will definitely need to be improved later.(see bug 26553)
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
From Owen:
"""
Table columns don't collapse as you change the browser width.
They start collapsed if you narrow the window and reload the page. But they don't expand as you widen the browser window.
"""
I have not found a reason for this in the changelog of the responsive
plugin. Maybe there is another way to fix this?
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds CSS fixes to try to keep styling of DataTables and
related controls consistent with how it looked before the upgrade.
This version of DataTables introduced a lot of usage of "!important" in
the CSS which severly limited our options. For that reason I modified
the file to remove all of those instances. Both the minified and
unminified versions are changed.
This patch continues the pre-upgrade practice of picking only the
relevant DataTables CSS and including it in our CSS build. This means a
smaller total CSS download for the user and eliminates the "!important"
problem.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
There was a behaviour change:
https://datatables.net/upgrade/2#Order-sequence
"""
When ordering columns by clicking on their header element, in v1 it would simply toggle between ascending and descending ordering for the columns (controllable with the columns.orderSequence option). DataTables 2 introduces a new option to this parameter, an empty string value which represents no ordering. The default has been updated to make use of this and the ordering sequence that is applied when clicking the header cell is now:
Ascending
Descending
No order
It will repeat that sequence indefinitely as the column header is clicked. As before, it can be controlled using the columns.orderSequence option, and if you wish to restore the default DataTables 1.x behaviour you can do so by setting the default:
DataTable.defaults.column.orderSequence = ['asc', 'desc'];
"""
This patch restore the behaviour we had before the upgrade.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
We use the regular _dt_add_filter and pass the filters_options for
selects \o/
We need to iterate again to make it easier to write (lot of duplicated
code to build the AV list) but that's for later!
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Didn't test. Not sure what is 'datatablesConfig', does not seem
something from DT so I don't expect regressions from there.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It's set to true by default now
https://datatables.net/upgrade/2#Deferred-rendering
"""
For this reason, deferRender's default value has been changed to be enabled (true) in DataTables 2.
"""
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Change in behaviour: now the filters are displayed automatically on the
"Lost items" report.
Note: We need bug 37238 for the item search.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
I don't really understand why this was not required on bug 33484, but
here this patch fixes a bug with the filters and the column visibility:
Fix: select an option in a column filter then hide a column that is before.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Also centralize and clean the delay code to use DT's debounce.
I have commented the code from initComplete as I don't think it's the
right place. Maybe we need to add it for other table, but then it should
be added when we init DT.
Removed blacklist_keys to keep code clean, could be re-added later if we
really need it.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Replace fnGetColumnData
No need delay, it's not ajax
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
t/db_dependent/Serials/ReNewSubscription.t .. Value not allowed for auto_incr id in Aqbookseller at /kohadevbox/koha/t/lib/TestBuilder.pm line 402.
Null value for subscriptionid in Subscriptionhistory not allowed at /kohadevbox/koha/t/lib/TestBuilder.pm line 415.
Can't call method "enddate" on an undefined value at t/db_dependent/Serials/ReNewSubscription.t line 102.
It's failing when no vendor with id=1 in DB.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Alexandre Noel <alexandre.noel@inlibro.com>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Also add an icon for the "Cite" entry.
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Adds a "cite" option in the tools menu in OPAC detail page for easy citations.
Test plan:
1. Apply this patch
2. Got to OPAC detail page
3. In the tools menu to the right, click the new "Cite" link
4. A modal should appear with four different citation styles (APA, Chicago,
Harvard, MLA)
Sponsored-by: Regionbibliotek Halland / County library of Halland
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection.
To test:
Enable the "SelfCheckInModule".
Open the barcode input form.
Enter a barcode with HTML or script tags.
Without the patch, observe that the script is executed.
Apply the patch.
Repeat step 2.
Verify that the input is escaped and no script execution occurs.
Check that the barcode is properly appended to the table.
Documentation:
No updates required.
Sponsored-by: KillerRabbitAos
Signed-off-by: Bo Gustavsson <bosse@gustavsson.one>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change removes the Koha version number from the OPAC generator
metadata.
Test plan:
0. Apply patch
1. Enable syspref SelfCheckInModule
2. Visit /cgi-bin/koha/opac-main.pl and confirm meta tag doesn't
include version number
3. Visit /cgi-bin/koha/sci/sci-main.pl and confirm meta tag doesn't
include version number
4. Visit /cgi-bin/koha/sco/sco-main.pl) and confirm meta tag doesn't
include version number
5. Click "Help" and confirm meta tag doesn't include version number
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()
Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Change the `dateformat` syspref to any value other than `us`(shows as mm/dd/yyyy)
2. Run:
$ ktd --shell
k$ prove t/db_dependent/SIP/Transaction.t
=> FAIL: Tests fail because of the resulting string containing an unexpected date format.
3. Repeat 1-2 with other formats
=> FAIL: SAme
4. Choose `us`
5. Repeat 2
=> SUCCESS: It passes
6. Apply this patch
7. Repeat 2
=> SUCCESS: Tests pass!
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
You are permitted to delete ILL batch statuses that you (rather than the
system) add, but the UI didn't get the CSRF memo about delete ops needing to
be POSTs with op="cud-delete", so it still uses a GET of ?op="delete" and
fails.
Test plan:
1. Set the preference ILLModule to 'Enable'
2. Administration - Interlibrary loan batch statuses - New batch status
3. Give it a name, an uppercase code, and Save
4. Click the Delete button to the right of your new status
5. The page is blank, and if you navigate back to Interlibrary loan batch
statuses, you'll see that yours was not deleted
6. Apply patch, reload page
7. Click the Delete button to the right of your new status, verify it is
deleted
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Jonathan Druart
Owen Leonard
Martin Renvoize
Thibaud Guillot
Jan Kissig
Martin Stenberg
Artur
David Cook
Magnus Enger
Kyle M Hall
Tomas Cohen Arazi
Phil Ringnalda