Commit Graph

54276 Commits

Author SHA1 Message Date
Jan Kissig 0729ee131b Bug 37324: Self registration complete login form won't login user
This patch fixes the self registration complete login form which appears after a complete self registration process.

To test:
a) open http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=PatronSelfRegistrationDefaultCategory
b) set PatronSelfRegistration to allow
c) set PatronSelfRegistrationDefaultCategory to Self registration
d) logout or open a private tab
e) http://localhost:8080/cgi-bin/koha/opac-memberentry.pl and enter required fields
f) Registration complete! appears with a prefilled login form. Click Log in.
g) Check you are not logged in

apply patch and redo steps e-f and check that login worked.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0988be4a59)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:00:20 +00:00
Lucas Gass 901c918ff4 Bug 29509: DBRev 24.05.03.002
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:58:39 +00:00
Kyle M Hall 95082c34db Bug 29509: (QA follow-up) Tidy atomic update
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0505531cde)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:58:39 +00:00
Martin Renvoize b33b9b5f61 Bug 29509: (QA follow-up) Check top level permissions too
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 56c7c3782b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:58:39 +00:00
Martin Renvoize 435211adbc Bug 29509: Update swagger specification and add permissions to users
This patch removes the 'edit_borrowers', 'manage_bookings',
'lable_creator', 'routing' and 'order_manage' permissions from the list
of options in the patrons list endpoint.

We then assign the new 'list_borrowers' permission to any users who have
those removed permissions

Test plan
1) Apply patch and run the database update
2) Users with any of the permissions listed above should now also have
   the 'list_borrowers' permission too.
3) Check that patron searching continues to work from the various
   locations in the UI for the above affected users

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Incorporated second patch and removed 1<<4. 16 reads much better :)

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 85ea79c45b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:58:39 +00:00
Emmi Takkinen 120d987d92 Bug 37399: Fix showing itemtype on holdings table
If syspref "noItemTypeImages" is disabled, holdings table won't display
itemtype column. This patch fixes this.

To reproduce:
1. Enable syspref "noItemTypeImages".
2. Find biblio with items.
   => Note that itemtype column is displayed on holdings table.
3. Disable syspref "noItemTypeImages".
   => Itemtype column is no longer displayed on holdings table.
4. Apply this patch.
   => Now column should be displayed correctly.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 313f7e86b8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:53:56 +00:00
Andreas Roussos 8add61d7f3 Bug 37226: append a random number to the `id` attribute of each <li>
When you view the authority details page for a term that contains more
than one terms with broader relationship, clicking on the expand/collapse
arrows next to the top-level terms in the hierarchy tree will not work
properly, i.e. *only one* broader term will show the narrower term under
it at any given time.

This is affecting both the OPAC and the Staff interface.

This is happening because in the HTML source of the page the individual
<li> elements associated with each node do not have unique `id` values,
which confuses the JavaScript library (jsTree) responsible for rendering
the hierarchy tree.

This patch fixes that by appending a random number to each `id` attribute.

Test plan:

0) Enable the AuthDisplayHierarchy System Preference (set to 'Show').

1) Copy the provided MARC21 Authority sample data (sample-data.mrc)
   to your KTD Koha container (it must have MARC21 marc flavour):

   docker cp sample-data.mrc koha-koha-1:/kohadevbox/

2) Import the provided authorities (the sample file contains three
   Geographic Name records):

   WARNING! the --delete switch is passed to bulkmarcimport.pl
   WARNING! this will erase any authority data you have in your instance!
   (this is done to retain the broader/narrower authid associations)

   misc/migration_tools/bulkmarcimport.pl --authorities --file=/kohadevbox/sample-data.mrc --verbose -c=MARC21 --delete -m=ISO2709

3) Visit the authority details page for 'Athens' in OPAC/Staff:

   http://localhost:8080/cgi-bin/koha/opac-authoritiesdetail.pl?authid=3
   http://localhost:8081/cgi-bin/koha/authorities/detail.pl?authid=3

   In the authority hierarchy tree, click the arrows next to 'Europe'
   and 'Greece' to expand and show the narrower term: notice how only
   one item works at any given time.

4) Apply the patch.

5) Repeat step 3) (refresh the pages) -- this time you should be able
   to view 'Athens' as a narrower term of both 'Europe' and 'Greece'
   at the same time.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 24e54b1fd4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:44:22 +00:00
Eric Garcia d46f5ceaae Bug 37343: Fixed search for vendors when transferring an item in acquistions
To test:
1. Have several vendors in acquistions
2. Add a basket and click "+Add to basket"
3. I used an mrc file to add an order from a new file
4. Stage for import -> add staged files to basket
5. Select the items and choose an item type
6. In the Orders table click 'Transfer' under the 'Modify' column
7. Try searching for vendors, nothing happens.
8. Apply patch restart_all
9. Click 'Transfer' again and try searching for vendors.
10. Notice vendors appear

NOTE:
Vendor search is a GET operation not POST. Use 'do_search' instead of 'cud-do_search'.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 54575f3c30)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:43:10 +00:00
Matt Blenkinsop b7ec2d2131 Bug 29087: (QA follow-up): Fix QA tests
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Conform BZ comment31
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7f5e1fac86)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:40:41 +00:00
Matt Blenkinsop a35333a327 Bug 29087: Add unit tests
prove t/db_dependent/Koha/Items.t

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 44d3762a69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:40:41 +00:00
Jonathan Druart 34be9ab95b Bug 29087: Prevent filter_by_for_hold to crash if default holdallowed is not_allowed
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8c804c1749)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:40:41 +00:00
Pedro Amorim 54e63c94d7 Bug 37260: Check message broker for both 'about' and 'sysinfo' tabs
Test plan:
1) Apply test patch only
2) Visit <staff_url>/cgi-bin/koha/about.pl
3) Notice it shows 'Using RabbitMQ' (it should show 'Using SQL polling')
4) Apply this patch, repeat 3)
5) Notice it now shows 'Using SQL polling'
6) Remove test patch. Notice it shows 'Using RabbitMQ' again.
7) Repeat test plan but for /cgi-bin/koha/about.pl?tab=sysinfo tab

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6a321c6ee4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:38:52 +00:00
Lucas Gass ce2f4219de Bug 37111: Fix renew link on opac-user.tt
To test:
1. Check some items out to a patron
2. Set the username and apssword for the patron so that you can log in as that patron.
3. Log in to the OAPC as that patron.
4. Go to Your account > Summary (the default landing page after you log in).
5. Click "Renew" for one of the items.
6. You get the error as above.
7. APPLY PATCH
8. Try steps 1 -5 again, you should not get an error.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Alexander Wagner <alexander.wagner@desy.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 58838fc263)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:36:00 +00:00
Lucas Gass 15316dda98 Bug 37111: Add submit-form asset to OPAC assets
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Alexander Wagner <alexander.wagner@desy.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6c56d3d90b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:36:00 +00:00
Lucas Gass 26c27a59e9 Bug 37371: Move Maskito instantiation to onReady ( OPAC )
To test:
1. Find a any date picker in Koha, like DOB in the patron record.
2. Add a date, either manually or using the date picker.
3. Once there is a date like 07/15/2024 try to edit only part of the
   date, or the '15'.
4. The date easily becomes malformed.
5. APPLY PATCHSET, maybe clear your browser cache too
6. Try directly inputing dates. I would suggest the following places:

-Patron record DOB
-Specify due date on circ/circulation.pl as this includes time
-Add item screen, this is the dateaccessioned plugin
-OPAC self reg/self modify

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit bae3203f70)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:34:11 +00:00
Lucas Gass 89f5e8223c Bug 37371: Move Maskito init to onReady in dateaccessioned.pl
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit f723c33d48)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:34:10 +00:00
Lucas Gass 22e7e6f137 Bug 37371: Set overwrite mode to replace
In our case I think overwriteMode needs to be set to replace:

https://maskito.dev/core-concepts/overwrite-mode
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0f04c9a26a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:34:10 +00:00
Martin Renvoize 26e5625b1d Bug 37371: Move Maskito instantiation to onReady
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7e1de5b557)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:34:10 +00:00
Lucas Gass 6fc4f3fad9 Bug 37216: DBRev 24.05.03.001
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:26:52 +00:00
Emily Lamancusa 6a65701e22 Bug 37216: (follow-up) Clear invalid value
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 37683ffd69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:26:51 +00:00
Martin Renvoize e6a48be025 Bug 37216: (QA follow-up) Add update to set existing options
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit fbcdce5e0a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:26:51 +00:00
Emily Lamancusa 5e5b3106b0 Bug 37216: Fix SQL for EmailFieldSelection
Test plan:
Part A: New installation
1. Start a fresh test instance
2. Set EmailFieldPrimary to "selected addresses", and do not touch
    EmailFieldSelection
3. Edit a patron to ensure the following fields are set:
   - Primary email
   - Secondary email
   - Alternate email
   - Enable email notices for item checkout
4. Attempt to check an item out to that patron
--> Koha explodes!
5. Apply patch
6. reset_all
7. Repeat steps 2-4
--> Checkout succeeds!
8. Ensure test plan for bug 12802 still passes

Part B: Upgraded installation
1. Start a fresh test instance at version 23.11
2. Switch to main
3. Install database update
4. Set EmailFieldPrimary to "selected addresses", and do not touch
    EmailFieldSelection
5. Edit a patron to ensure the following fields are set:
   - Primary email
   - Secondary email
   - Alternate email
   - Enable email notices for item checkout
6. Attempt to check an item out to that patron
--> Koha explodes!
7. Go back to 23.11 and reset_all
8. Switch to main and apply patch
9. Repeat steps 4-6
--> Checkout succeeds!
10. Ensure test plan for bug 12802 still passes

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 89a0c62da4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:26:51 +00:00
Tomas Cohen Arazi 19682f614a
Update release notes for 24.05.03 release
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:17 -03:00
Tomas Cohen Arazi 08e2721c28
Increment version for 24.05.03 release
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:16 -03:00
Nick Clemens 4107765cdb
Bug 37508: Don't return Internal server error when running report
To test:
1 - Create a report like:
SELECT "a"
FROM borrowers
WHERE <<Test>> != ''
2 - Run report
3 - Enter "password"
4 - Internal server error / stacktrace
5 - Apply patch
6 - Repeat
7 - Get a yellow warning box

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:16 -03:00
Marcel de Rooy 4b32d4f531
Bug 37508: (QA follow-up) Use ->check_columns
Add shebang to Guided.t too.

Test plan:
See also previous commits.
Try sql like:
  select access_token from oauth_access_tokens

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:15 -03:00
Marcel de Rooy 6bbea258fb
Bug 37508: (QA follow-up) Move check to Koha::Report, extend
Do not allow password but allow password_expiry_days etc.
Do not allow token, secret and uuid too.

Test plan:
Run t/db_dependent/Koha/Reports.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:15 -03:00
Aleisha Amohia 133b17036b
Bug 37508: (follow-up) Don't pass the column or sql containing password
This patch replaces these variables with a non-translatable message.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:14 -03:00
Aleisha Amohia fe2be0330c
Bug 37508: (follow-up) Throw error is password is in SQL query at all
Confirm tests pass t/db_dependent/Reports/Guided.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:13 -03:00
David Cook 91f7f79fe1
Bug 37508: Test for errors when returning an aliased password column
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:13 -03:00
Aleisha Amohia 62874e328d
Bug 37508: Throw error if password column is detected in SQL report
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:12 -03:00
Tomas Cohen Arazi a9a81c97e4
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit a164c51d78f375d9d660e2c079cc7e05d2d1d326)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:11 -03:00
David Cook 8cda1a307d
Bug 37466: Add correct filter for sort_by in results.tt
This patch replaces the $raw filter with the correct uri filter
for the sort_by in results.tt

Test plan:
1. Apply patch
2. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=1
3. Click on "Edit this search"
4. Note that the "Popularity (most to least)" Sort by option is selected
5. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=24y24ty2498294t9824yt9y23
6. Click on "Edit this search"
7. Note that the "Popularity (most to least)" Sort by option is selected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5148e05d408b43c0eb330683ffa4c26c90faa696)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:11 -03:00
David Cook 1401959db4
Bug 37464: Validate "type" sent to barcode/svc
This change validates the "type" sent to the barcode/svc. Without this
change, we pass the user input directly to GD::Barcode, which passes
the input into an eval{} block without any validation of its own.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
3. Note that a Code39 barcode is provided for an invalid type
4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
5. Note that a Code39 barcode is provided
6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
7. Note that a non-Code39 barcode is provided (presumably UPCE)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 73b0c3cf621250008845f22f7a36f90a48e00b06)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:10 -03:00
David Cook 838de7c597
Bug 37488: Validate paths in datalink.txt/idlink.txt files
This change validates the paths in datalink.txt/idlink.txt,
so that only images in the unpacked archive directory are allowed

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Create a datalink.txt file with the following:
42,selfie.jpg
3. Create a jpeg at selfie.jpg
4. ZIP the datalink.txt and selfie.jpg files
5. Upload to the "Upload patron images" tool
(after enabling the "patronimages" system preference)
6. Note that the image uploads correctly

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8fcb767fe2836c90ceacb5b5d8211524571eb8aa)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:09 -03:00
David Cook 8c948ee349
Bug 37323: Tidy
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 579c28c764257a250c12aa11207772c074c1335e)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:09 -03:00
Chris Cormack df3ecb46ed
Bug 37323: Don't allow symlinks in link files in zip and validate filepaths
Test plan:
0. Apply patch and restart/reload Koha
1. Test that uploading a patron image still works, in single file format and as a zip

Work as suggested

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 9bc0521493fbe2f9fe0dde051d0b2f52c8a14a9a)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:08 -03:00
Amit Gupta 7a15b321a3
Bug 37323: Escape characters in patron image picture upload
To Test
1. Create a file name for example: test.zip`curl xxxxtesting.informaticsglobal.com`.zip
   where the domain is one you can watch the logs from.
2. Go to Tools and click on Upload patron images choose option zip file and upload the file.
3. Check /var/log/apache2/access.log and see the curl with the IP
   "xx.xxx.xx.xxx - - [11/Jul/2024:23:10:33 +0530] "GET / HTTP/1.1" 200 267 "-" "curl/7.68.0"
4. Apply the patch
5. Repeat 2 and 3 step and check no error is coming for the Remote execution error.
6. Test uploading actual zip file and images still works.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5c931e00f73e91467581fd29721e5af8d7fa98ab)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:07 -03:00
Emmi Takkinen 8d1d824436
Bug 37255: Fix handling of "All" values on waiting hold cancellation policy
If one creates a default waiting hold cancellation policy with
patron categories set as "All" and itemtype set as "All", Koha
breaks on 500 error. This happens because in we try to match
template policy with "All" values either in category or itemtype
with *, not undef. This patch fixes this.

To test:
1. Create a new default waiting hold cancellation policy and
set both patron category and itemtype as "All".
2. Save policy.
=> Error page for error 500 is displayed.
3. Apply this patch.
4. Reload page.
=> Page is displayed and policy listing displays new policy
as it should.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:07 -03:00
Andreas Jonsson 29daece9bc
Bug 37533: Fix query in orderreceive.tt
The new validation in the REST API will no longer allow
the operator "in".  Consequently, it has to be replaced
with the allowed "-in".

Test plan:

 * Open an invoice and click "Go to receipt page" and
   on any basket click "receive" and make sure the dialog
   box appears.

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:06 -03:00
Lucas Gass 4ebbff7390 Generate release notes for 24.05.02 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 17:32:07 +00:00
Lucas Gass 576c5381cc Increment version for the 24.05.02 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 17:09:44 +00:00
Julian Maurice 64563441af Bug 37210: Properly escape SQL query parameters by using bind values
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:17:43 +00:00
Hammat Wele 23a83cf7c2 Bug 37210: Escape single quote in search string in overdue.pl
To Test:
1. Go to /cgi-bin/koha/circ/overdue.pl
2. In the «Name or card number» field, type «Tommy'and(select(0)from(select(sleep(10)))v)and'»
3. Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
4. Inspect the page, in «Patron category:» field, put «Tommy'and(select(0)from(select(sleep(10)))v)and'» in one of his option's value
5. select the option from the filter and Apply the filter
   ==> It takes 10 seconds, sleep(10) is executed
we can inject SQL to the followin field : borname, itemtype, borcat, holdingbranch, homebranch and branch
6. Apply the patch
7. Repeat step 1,2,3
   ==> it doesn't take 10 seconds, the injected sql is not executed
8. Repeat step 5
==> it doesn't take 10 seconds, the injected sql is not executed
9. Repeat step 5 with the followin field : itemtype, holdingbranch, homebranch and branch
   ==> it doesn't take 10 seconds, the injected sql is not executed

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:17:43 +00:00
Martin Renvoize ec20812852 Bug 36481: (follow-up) Add missing library_id parameter
The /libraries/{library_id}/cash_registers endpoint was missing the
library_id parameter definition from the swagger specification.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 466d38f18d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize 51d15f7ca8 Bug 36480: (follow-up) Add missing library_id parameter
The /libraries/{library_id}/desks endpoint was missing the
library_id parameter definition from the swagger specification.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6aadc4a423)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi b4e3a0aaea Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize e7b3d05bc7 Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi b81b388db3 Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi 21fd44f505 Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00