Commit Graph

61728 Commits

Author SHA1 Message Date
David Cook 0a44bf4e8e
Bug 42612: Change button colours in manage-marc-import.pl
This patches changes the button colours in manage-marc-import.pl
so that "Import this batch into the catalog" is more prominent,
and "Apply different matching rules" is less prominent.

Test plan:
0. Apply the patch
1. Go to a bib record like
http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=29
2. Click "Save" and choose "MARCXML"
3. Go to http://localhost:8081/cgi-bin/koha/tools/stage-marc-import.pl
4. Click "Upload file"
5. Choose "MARCXML" for the "Format:"
6. Change "Check for embedded item record data" to "No"
7. Click "Stage for import"
8. Wait for the staging to complete. This will be show when the status
bar hits "100% Finished" and a "View batch" link appears.
9. Click "View batch"
10. Note that "Import this batch into the catalog" is a prominent yellow
button with black text
11. Note that "Apply different matching rules" is a less prominent dark grey
button with white text

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:21 -06:00
Owen Leonard ea10c84e80
Bug 42684: Capitalization: No Barcode
This patch corrects the capitalization of the phrase "No Barcode" and
several other instances of incorrect capitalization.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:21 -06:00
Jonathan Druart 91f2e47f49
Bug 41992: Do not restore pagination offset
When "Save configuration state on page change" is enabled, the page
number is kept in localStorage and restored.

To prevent that we can set the attribute "start" of the state to 0.

Test plan:
Go on a page with several pages, go to another page than the first one
Go the another view and get back
Without this patch the last visited page was preserved when returning to the previous view
With this patch applied the view now defaults to the first page

Note that this does not affect shareable links.

Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:20 -06:00
Owen Leonard efff7c7046
Bug 42229: (follow-up) Restore card number <label> when necessary
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:20 -06:00
Owen Leonard b9bff3256a
Bug 42229: (follow-up) Markup correction
The "Street type" fields had double "name" attributes.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:19 -06:00
Laura_Escamilla c416062ef0
Bug 42229: Avoid using form labels for static values in opac-memberentry.tt
The OPAC personal details page uses <label> elements in some places
where no visible form control is present. In these cases, the content
is display-only and the label is not associated with an interactive
field.

Replace those labels with non-form markup for static values while
preserving existing labels for actual form controls.

Test plan:
1. Log in to the OPAC and go to the "Personal details" page
2. Inspect display-only values such as Username and Expiration date
3. Confirm <label> elements are used for content that is not part of a
   form control
4. Apply the patch
5. Log in to the OPAC and go to the "Personal details" page
6. Confirm display-only values such as Username and Expiration date no
   longer use <label> elements
7. Confirm other static display-only values updated by the patch also no
   longer use <label> elements
8. Confirm actual form controls, such as text inputs and selects, still
   have proper associated labels
9. Run an accessibility checker and confirm the related label misuse
   issues are resolved
10. Sign off and have a great day!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:19 -06:00
Laura_Escamilla a8e7087ce8
Bug 42232: Add missing legend to action fieldset in OPAC
To test:
1. Log on to the OPAC and go to "Messaging" page.
2. The fieldset that contains the Save/Cancel button is missing a legend.
3. Apply the patch and refresh the "Messaging" page.
4. Notice that the fieldset now contains an accessible legend.
5. Sign off and have a great day!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:18 -06:00
Laura_Escamilla e07b92e48a
Bug 42233: Add accessible text to empty purchase suggestions table header
The first header cell in the OPAC purchase suggestions table contains
only an icon, leaving the <th> without accessible text. This causes
the column header to be announced unclearly by assistive technology
and can be flagged by accessibility testing as an empty table header.

Add visually hidden text to the header so the column has a meaningful
accessible name while preserving the current visual display.

Test plan:
1. Log in to the OPAC
2. Make a purchase suggestion
3. In the suggestions table, the first <th> contains no text
4. Apply the patch
5. Repeat steps 1-2
6. Inspect the suggestions table header
7. Confirm the first <th> now contains visually hidden text describing
   the checkbox selection column
8. Confirm the info icon still appears and its tooltip still works
9. Run an accessibility checker or inspect the DOM and confirm the
   empty table header issue is resolved

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:18 -06:00
Nick Clemens 183d1cf211
Bug 42245: Prevent preselecting sort values for guarantor search
av-build-dropbox.inc takes a 'default' param

When building the patron we are setting this to the value of sort1, then sort2
This seems to remain cached, and when we build the guarantor search the sort2 value is used as the default
This patch ensures we pass a blank default to the modal

To recreate:
1 - Define 2 values for 'BSort1' in Administration -> Authorised values
2 - Define 2 values for 'BSort2' in Administration -> Authorised values
3 - Find a borrower who is eligible to have a guarantor
4 - Edit patron and assign values to sort 1 and 2 for this borrower and save
5 - Edit patron again and click 'Add guarantor'
6 - Note that sort 2 is populated
7 - Apply patch
8 - Reload borrower
9 - Confirm sort1 and 2 are empty

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:17 -06:00
Laura_Escamilla fda196565d
Bug 42299: Add accessible label to star rating select in OPAC
To test:
1. Set  OpacStarRatings so it shows on the OPAC detail page
2. Notice star ratings has no associated label element
3. Apply the patch and refresh the OPAC detail page you were viewing.
4. Notice that the star ratings now have an accessible label.
5. Sign off and have a great day. :D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:17 -06:00
Johanna Räisä 07325de908
Bug 42395: Fix missing translations on load_patron_holds_table
This patch adds missing translations for the load_patron_holds_table function.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:16 -06:00
Saiful Amin 10fc3f3c64
Bug 29587: Test mail option in SMTP servers
Edit: Added CSRF protection.

This patch adds a "Send test email" action to the SMTP servers
administration page. It sends a test message to the address in
the KohaAdminEmailAddress system preference and reports success
or failure to the user.

Test plan:
1. Add a valid SMTP server in Administration → SMTP servers.
2. Set KohaAdminEmailAddress to a valid email address.
3. Apply the patch.
4. Click "Send test email" in the Actions column.
5. Confirm that Koha reports "Test email sent successfully".
6. Edit the SMTP server and change the domain to an invalid one.
7. Click "Send test email" again.
8. Confirm that Koha reports failure.
9. Sign off.

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:16 -06:00
Matt Blenkinsop b9d6d16f8e
Bug 41605: Fix incorrect default key
Test plan:
No behavioural change but it is an inconsistency in the code
1) Look in base-resource.js at the newResource computed method
2) Confirm that the code in the first conditional block is looking for 'hasOwnProperty("defaultValue")'
3) Check the new patch and confirm that the code has been changed from 'value: false' to 'defaultValue: false' to match this

There is no behaviour change as boolean fields default to false within the framework but we should remove this inconsistency

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:15 -06:00
Emmi Takkinen c28b9b86ca
Bug 41829: Set correct id to copied Tag editor button
When one copies MARC field, Tag editor button on fields
containing value builder plugin have same id as original
MARC field. This patch sets correct id to these buttons.

To reproduce:
1. Find MARC framework which has value builder plugin
   attached to one of its fields.
2. Navigate to Cataloging -> New record.
3. Navigate to MARC field with plugin attached to it.
4. Inspect fields Tag editor button with browsers developer
   tools.
   -> Check the id of Tag editor button.
5. Copy the field and check id of copied Tag editor button.
   -> Notice that it has the same id as in original field.
6. Apply this patch.
7. Referesh the page, navigate back to field and copy it.
8. Inspect Tag editors id.
   -> Id should now be same as in other copied fields.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:15 -06:00
Jonathan Druart bba0146b3d
Bug 42781: Do not modify window.name
https://developer.mozilla.org/en-US/docs/Web/API/Window/name

Test plan:
0. Do not apply this patch (you can apply the first one)
1. Go to /cgi-bin/koha/members/members-home.pl
2. Open the console
3. type "window.name", it's ""
4. Run a patron search, "d"
5. window.name is now "Duffy, Joann name"
6. Apply this patch, try again
7. window.name is still an empty string

Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:14 -06:00
Magnus Enger 7b02715f4f
Bug 42781: Declare 'name' before using it in patron-format.js
The code in koha-tmpl/intranet-tmpl/prog/js/patron-format.js uses
a variable called 'name' without declaring it first. The declaration
was removed in bug 32176. No deterioration of functionality has been
discovered in connection with this, but the declaration should be
restored.

To test:
- Apply the patch.
- HidePatronName = Show
- Look at the staff detail view for a record that has at least one
  item on loan.
- Verify the name of the patron is displayed as expected.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:14 -06:00
Jan Kissig a26800691f
Bug 42844: Fix broken subscription search when using additional fields as seach criteria
This fixes an error when searching for a subscription with an additional field when no result is found by changing the call of SearchSubscriptions to expect an array instead of an hash ref.
Serials.pm, when using filter_by_additional_fields may return an empty array, but the calling function only checked for an hash ref which lead to an error when no result was found.

Testplan:
a) create an additional field for subscriptions: More -> Serials -> Manage subscription fields
   f.e. use an AV CCODE as additional field
   make sure "searchable" is checked
   No subscription should use this additional field by now.
b) go to More -> Serials
c1) if bug 40201 is pushed you can search for that additional field on serials-home
   -> An error stack trace will appear.
c2) otherwise perform an empty search on serials home to end on serials-search. In the search form on the left select that additional field as search criteria.
   -> An error stack trace will appear.
d) add a subscription using that additional field
  -> More -> Serials -> New subscription.
  On step two there is a section for Additional fields. Select f.e. CCODE Fiction
e) redo c1 or c2 using that additonal field value as search criteria.
f) Check that the search result shows your subscription.
g) apply patch and redo c1 or c2 for an additional field value that is not used (f.e. Non-fiction)
h) The search should work now, returning 0 results instead of an error
i) check that searching for a used additional field (f.e. Fiction) still works

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-15 18:12:05 -06:00
Pedro Amorim 838fa2f78b
Bug 42783: Fix ManageMarcImport_spec.ts
If import_batch_profiles is slow to respond, it'll trigger select.change() in stage-marc-import.tt and change the format to ISO2709 before the form is submitted, causing the error.

cypress run --spec t/cypress/integration/Tools/ManageMarcImport_spec.ts

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-12 09:28:29 -06:00
Lucas Gass b8fab422f4
Bug 42764: (RMaint follow-up) Fix DBIC
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 12:56:17 -06:00
Pedro Amorim 2f03758634
Bug 42764: (QA Follow-up): Fix DB update mismatch
perl /kohadevbox/misc4dev/run_tests.pl --run-db-compare-only --compare-with v24.05.00

Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:41 -06:00
Lucas Gass 2cd11ac987
Bug 42764: DBRev 26.05.00.001
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:41 -06:00
Lucas Gass 606450fd56
Bug 42764: DBIC
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:40 -06:00
Pedro Amorim c5d078eccf
Bug 42764: (QA follow-up): Update DB schema
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:39 -06:00
Pedro Amorim 919b5e9e93
Bug 42764: (QA follow-up): Atomicupate: Fix typo in SQL table comment
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:38 -06:00
Martin Renvoize 9f3cdb665c
Bug 42764: Use inline codespell:ignore for SAN-Ouest Provence in templates
Rather than excluding the entire about.tt files from codespell scanning,
annotate only the specific lines containing the proper noun "Provence"
(SAN-Ouest Provence, a French library co-operative and Koha sponsor) with
an inline TT comment that codespell recognises as a per-line ignore.

This lets codespell continue to check the rest of each file for genuine
spelling mistakes, while still catching accidental "Provence" for
"Province" in any other template not carrying this annotation.

Replaces the file-level exceptions added to Koha::Devel::Files in
favour of the more surgical inline approach.

Test plan:
1. Apply patch
2. Verify "Provence" on the annotated lines produces no codespell output:
   codespell -d --ignore-words .codespell-ignore \
     koha-tmpl/intranet-tmpl/prog/en/modules/about.tt
   => no output
3. Verify the rest of about.tt is still checked by introducing a
   deliberate typo elsewhere in the file and confirming codespell flags it
4. prove xt/author/codespell.t
=> All tests pass

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:37 -06:00
Martin Renvoize 1c0de7e971
Bug 42764: Fix false positives caused by mixed filetypes in CI failure store
The ci-results repo stores all failures from a single test run as one
flat JSON array, regardless of whether they came from the pl, tt, or js
filetype pass. On the next incremental run, get_files_to_test('pl') reads
that entire list -- including any .tt failures -- and calls
remove_exceptions with the 'pl' context. Since .tt files only appear in
the tt exception list, they survive the filter and get codespell'd in the
pl pass where nothing is configured to exclude them.

The fix filters stored failures by filetype before applying exceptions,
so each pass only re-checks failures that belong to its own type.

Test plan:
1. Apply all patches
2. Add a file to the tt codespell exceptions in Koha::Devel::Files that
   contains a word codespell would flag
3. Introduce a deliberate failure in another file so the ci-results repo
   records the excepted .tt file as a previous failure
4. On the next incremental run, confirm the excepted .tt file is not
   re-tested in the pl or js pass
5. prove xt/author/codespell.t
=> Tests pass; no false positives from cross-filetype re-checks

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:37 -06:00
Martin Renvoize 952e60e221
Bug 42764: Include filename in codespell test output
Without a test comment, failures appear as bare 'not ok N' lines with
no indication of which file failed or what codespell found.

Passing the filename as the third argument to is() means:
- Every passing test shows: ok N - path/to/file
- Every failing test shows: not ok N - path/to/file

Test plan:
1. Apply patch
2. Introduce a deliberate spelling error in any .pl file
3. prove xt/author/codespell.t
=> Failing line shows the filename and the codespell finding inline,
   without needing to dig into full console logs

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:36 -06:00
Martin Renvoize e7dc04a178
Bug 42764: Fix false positives caused by POD letter-code formatting
Two patterns in the codebase produce spurious codespell hits because
codespell tokenises word fragments out of formatted letter codes:

- B<P>rovider in C4/Auth_with_shibboleth.pm produces 'rovider'
- T(ransit), W(aiting), F(inished), P(rocessing) in C4/Reserves.pm
  produce 'ransit', 'aiting', 'inished', 'rocessing'

For the shibboleth POD line the bold-letter markup cannot be simplified
without losing the formatting intent, so a per-line # codespell:ignore
comment is the right suppression.

For the Reserves.pm status table the fix is made at source: the notation
is changed from X(word) to X (Word) so codespell sees the full English
word and no fragment is produced.

Because the per-line comment on the shibboleth line now suppresses
'rovider' directly, the global .codespell-ignore entry for that fragment
is removed as redundant.

Test plan:
1. Apply patch
2. prove xt/author/codespell.t
=> No new codespell failures

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:35 -06:00
Lucas Gass f6deb07bdf
Bug 42764: Fix spelling errors across the codebase
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:34 -06:00
Martin Renvoize bb7b3aa9a0
Bug 42764: Update .codespell-ignore for valid technical terms
Add words to .codespell-ignore that codespell 2.4.x flags but are
valid technical terms, domain vocabulary, or proper names:

- checkin: core library circulation term (check-in as noun/verb)
- plack: Perl PSGI middleware framework (proper software name)
- requestor: COUNTER 5 standard term used in ERM usage statistics
- laf: EDIFACT 3-letter segment code
- vai/lamba: Unicode script and language names in character set data
- aas: acronym used in Cypress test support files
- carmel: contributor name in about.tt
- prfile: legacy variable abbreviation in C4/Creators/PDF.pm

Test plan:
1. Apply patch
2. prove xt/author/codespell.t
=> Test passes (or only genuine spelling errors remain)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-11 09:53:26 -06:00
Owen Leonard f4c0819644
Bug 42518: Capitalization: Refund Payout Receipt
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-10 12:35:45 -06:00
David Nind d2df80f20d
Bug 42695: (follow-up) Format paragraph
Moves the explanation sentence into its own paragraph.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-10 12:35:44 -06:00
Owen Leonard 6fa6228f73
Bug 42695: Minor language and markup corrections to reports error messages
This patch makes a vew minor corrections to guided_reports_start.tt.

To test apply the patch and go to Reports.

- Try to create an SQL report which uses UPDATE, e.g.
  UPDATE items SET barcode = 1 WHERE itemnumber = 1
- Confirm that the text of the error message reads well and is formatted
  well.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-10 12:35:44 -06:00
Owen Leonard 19bc16654a
Bug 42692: Typo: regarless
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-10 12:35:43 -06:00
Owen Leonard 889ab52a33
Bug 42691: Typo: automaticaly
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-10 12:35:37 -06:00
Pedro Amorim 64e4501129
Bug 42705: Fix SCO spec WebBasedSelfCheck setup
cy.login() in beforeEach broke the test in two ways: the intranet staff session cookie bled into the OPAC request (HTTP cookies have no port scope in
browsers), and navigating from intranet→OPAC mid-test hit a cross-origin block in Cypress. The afterEach suffered the same race condition - the syspref POST fired before the login redirect completed.

Replace with cy.request(), which makes HTTP calls at the runner level without touching the browser's current origin. cy.visitOpac() is then the first
browser navigation, so no cross-origin issue arises. A three-step flow satisfies Koha's CSRF middleware:
1) GET the login page to obtain a session and its token
2) POST credentials to authenticate
3) POST to the svc endpoint.

This fixes the #barcode and #patronlogin not found issues

The CSRF token also requires encodeURIComponent() — base64 uses +, which a
URL-encoded form body decodes as a space, silently corrupting the token and causing the login to fail.

This resolves the 403 Forbidden issue

Everything must pass:
$ cypress run --spec t/cypress/integration/OPAC/SCO_spec.ts

as well as npm run cypress open (cypress ui)

ktd selenium:
$ perl /kohadevbox/misc4dev/run_tests.pl --run-only t/cypress/integration/OPAC/SCO_spec.ts

squash

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-09 15:42:26 -06:00
Pedro Amorim 5baf1ce6e0
Bug 42705: Add HttpClient_spec.ts
This fails without the fix patch in this set:
cypress run --spec t/cypress/integration/HttpClient_spec.ts

It passes with the fix

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-09 15:42:26 -06:00
Pedro Amorim 4e87782636
Bug 42705: Make http-client.js handle svc endpoint error
The afterEach calls cy.login() then immediately posts to the syspref endpoint. On CI, the machine is slow enough that the POST fires before the login
redirect completes — no valid session yet — so the endpoint returns a C4::Service auth error in this format:

{ "type": "auth", "message": "expired" }

http-client.js only knew how to parse modern REST API errors (json.error or json.errors[]). Neither field exists here, so json.errors.map(...) crashed with a TypeError instead of surfacing the actual error message.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-09 15:42:25 -06:00
Lucas Gass 87a552d8a7
Bug 34973: Update yarn.lock
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-09 15:42:19 -06:00
David Cook bcbe93fbea
Bug 42361: Fix SQL injection in catalogue_out.pl
This change removes an SQL injection vulnerability from catalogue_out.pl

Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-09 08:18:59 -06:00
Lucas Gass 9122ad9dc6
Bug 42757: Use default suggestor or fallback to librarian
To test:
1. Find a patron
2. From the patron account click the "Purchase suggestions" button
3. Make a suggestion
4. That suggestion is not associated with the patron from step 1
5. APPLY PATCH and restart_all
6. Repeart steps 1 -3. The purchase suggestion suggesedby should be the patron from step 1
7. Go  Acquisitions -> Suggestions -> Add suggestion
8. Make sure when you do it this way the suggestedby is set to the logged-in-user by default

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:26 -06:00
Lucas Gass eca5b83960
Bug 42750: Add redirect params back and exit after redirect
To test:
1. Find a patron
2. From the patron account click the "Purchase suggestions" button
3. Make a suggestion
4. Your are redirected to suggestion/suggestion.pl
5. APPLY PATCH, restart_all
6. Try again, this time you should be properly redirected back to the patron account: ( members/purchase-suggestions.pl?borrowernumber=X )

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:25 -06:00
Lucas Gass 885577073c
Bug 42740: Fix suggestion status when editing
To test:
1. Make a purchase suggestion.
2. Set the status to something, anything.
3. Edit that suggestion, notice that the "Status:" is set to 'No Status'
4. Now when you save, they actual status is lost.
5. APPLY PATCH, restart_all
6. Try steps 1 - 3. This time at step 3 the suggestion status should be properly set.
7. Save the suggestion, make sure it saves with the correct status.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:25 -06:00
Eric Phetteplace 33a8dc5d6f
Bug 42723: Purchase suggestion 500 when EmailPurchaseSuggestions is set to BranchEmailAddress
Testing plan:
- Set EmailPurchaseSuggestions to BranchEmailAddress
- Go to create suggestion on the staff side /suggestion/suggestion.pl?op=add_form
- Create a suggestion with Library: Any
- 500 error: inbound_email_address is not a method of undef
- Apply patch & repeat
- Suggestion created

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:24 -06:00
Lucas Gass 2f08c5b8ae
Bug 42710: Set library to logged in library for new suggestions
To test:
1.  Acquisitions -> Suggestions ->Add suggestion
2.  Notice the under Acquisition information the library is set to Any
3.  APPLY PATCH
4.  Try again, library should be set to the logged in library.
5.  Make a suggestion and set it to some branch other then the logged in branch
6   Edit the suggestion from step 5, ensure that the "Library:" is properly set

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:23 -06:00
Emily Lamancusa 35e670c886
Bug 42701: Fix editable class on additem.pl
When editing the items on a biblio record, you should be able to select
an item to edit by clicking anywhere on the item row. This functionality
was lost because the "editable" class was not getting added correctly to
the table row. This patch fixes that issue.

To test:
1. Find a biblio record that has at least one item
2. Click on Edit > Manage items
3. In the table that lists editable items, click on any cell of any item
   (other than the Actions button)
--> Nothing happens; the buttons to "Edit item" and "Delete item" do not
    appear as expected
4. Apply patch and refresh the page
5. Repeat step 3
--> The buttons to "Edit item" and "Delete item" appear

Signed-off-by: Barbara Johnson <barbara.johnson@bedfordtx.gov>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:22 -06:00
Janusz Kaczmarek dbd51e342c
Bug 42555: (Bug 25314 follow-up) Destroyed labels for customized facets
After applying Bug 25314, customized facets generated from
mappings.yaml are displayed with the technical type_id instead of the
proper label.

Test plan:
==========
1. In KTD with Elasticsearch enabled, add the following to
   admin/searchengine/elasticsearch/mappings.yaml

  su-gen:
    facet_order: 33
    label: Genre/Form
    mappings:
    - facet: 1
      marc_field: 655a
      marc_type: marc21
      sort: 1
      suggestible: ''
    opac: 1
    staff_client: 1
    type: ''

   Reindex with: koha-elasticsearch --rebuild -r -d -b kohadev
2. In the OPAC, at the bottom of the facets area, you should see a
   facet labeled su-gen_id instead of Genre/Form.
3. Apply the patch ; restart_all.
4. The facet should now display the correct label: Genre/Form.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:21 -06:00
Owen Leonard c64f707691
Bug 42498: Fix invalid aria attribute in OPAC search results pagination
This patch corrects the aria-current attribute in OPAC search results
pagination. There should be no aria-current attribute on the list item,
and the aria-current value on the link should be "page."

To test, apply the patch and perform a catalog search in the OPAC which
will return multiple pages of results.

View the page source or use the developer console to inspect the HTML of
the active pagination link. It should have an aria-current label with
the value "page." The containing list item should not have an
aria-current label.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:21 -06:00
David Nind f545db2179
Bug 42454: Terminology: Use "and" instead of "&" for curbside pickups tab
The "Staged & ready (0)" tab for curbside pickups (Circulation > Holds
and bookings > Curbside pickup) should use "and" instead of "&".

See terminology guidelines for "& (ampersand)" - Only use "&" when part
of a proper noun or a common abbreviation,... Otherwise, use "and":
https://wiki.koha-community.org/wiki/Terminology#characters

Test plan:
1. Enable the CurbsidePickup system preference.
2. Configure curbside pickup for Centerville:
   - Go to Administration > Patrons and circulation > Curbside pickup
   - Set values:
     . Enable: selected
     . Pickup interval: 5
     . Maximum patrons per interval: 1
     . Patron-scheduled pickup: selected
     . Enable for waiting holds only: selected
     . Curbside pickup hours: add from and to hours for some days
     . Click Save configuration
3. Go to Circulation > Holds and bookings > Curbside pickup.
4. Note that there is an '&' in the "Staged & ready (0)" tab title.
5. Apply the patch.
6. Refresh the page.
7. Note that and is spelt in full "Stage and ready (0)".

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Alex Carver [Acerock7] <alex@rcls.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:20 -06:00
Julian Maurice 39a090affe
Bug 42194: Fix redirect after sharing a report to Mana
Bug 34478 removed a '&' by mistake in the redirect URL

Test plan:
1. Setup a local instance of Mana
   (https://gitlab.com/koha-community/koha-mana) with disabled email
   validation (skip_email_validation in config.yml)
2. Connect Koha to this local instance (mana_config in $KOHA_CONF)
3. From Koha Admin interface, create a Mana security token
4. Share a report to Mana
5. You should be redirected to the list of reports with a message saying
   the report was saved successfully

Signed-off-by: Emmanuel Bétemps <e.betemps@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-06-08 13:53:19 -06:00