Commit Graph

41801 Commits

Author SHA1 Message Date
Martin Renvoize 178cd55fb4 Bug 29457: Generic warning at upgrade
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended: Adding exec flag and two dots.
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1dec6d9468)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit a28dd48b5e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-11 23:27:12 +01:00
Martin Renvoize 379e932df9 Bug 29457: Pass context borrowernumber
This patch updates the call to cancel such that we pass the currently
logged in users borrowernumber instead of their userid.

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0a79d25421)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 002954a83c)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-11 23:27:12 +01:00
Tomas Cohen Arazi cdca6f73d5 Bug 29736: (QA follow-up) No need to delete all clubs
There's no real need to delete all the existing clubs in the tests.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d4c628f171)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 4e4a452609)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-11 23:02:56 +01:00
Tomas Cohen Arazi 24991fed04 Bug 29736: Restore searching
Without this patch, the list will always display all clubs.

To test:
1. Have two clubs, with enrollemnts:
   - Cthulhu fans
   - The Shadow Out of Time fans
2. Search for the letter c
=> FAIL: You get both results
3. Apply this patch
4. Repeat 2
=> SUCCESS: Only Cthulhu is returned
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 96012930ee)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 91fd6ddd7c)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-11 23:02:39 +01:00
Jonathan Druart 8691aae755 Bug 29736: Don't return empty clubs
There is an error when placing a hold for a club without members:
Uncaught TypeError: err.responseJSON.error is undefined

It seems that we should remove clubs without members from the search.

Test plan:
Create 1 club xx with 2 patrons
Create 1 club xxx with 1 patron and cancel their enrolment
Create 1 club xxxx without patron

Place a hold for club "x", only the first one should be returned with
this patch.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b45e67e03e)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 4520178095)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-11 23:02:01 +01:00
Tomas Cohen Arazi df22d207f2 Bug 29018: Make DELETE /patrons/:patron_id check things
When the route was implemented, the checks were overlooked. This patch
adds checks for:
- Guarantees
- Debts
- Current checkouts

Any of those will block deletion, as it should.

To test:
1. Apply the regression tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: Tests fail, the route misses checks
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! The three conditions prevent deletion!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 4948faacc0)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-07 19:50:26 +01:00
Tomas Cohen Arazi c16e8c8174 Bug 29018: Regression tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 493db07948)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-07 19:50:20 +01:00
Mason James 2b19368e1c Bug 28926: Update cpanfile for Mojolicious::Plugin::OpenAPI v2.16
to test...
 - apply patch
 - build package
 - confirm in about.pl that minimum versions are updated

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit bfd033c68a)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 81ce0e2db5)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-07 12:26:57 +01:00
Jonathan Druart 2fbbca6cbd Bug 29696: Preserve link to biblio when creating a suggestion
Caused by
  commit 586bed1319
  Bug 28941: Filter suggestion inputs at the OPAC

We are loosing the link with the biblio (suggestion.biblionumber)

Test plan:
At the OPAC, go to the detail page of a bibliographic record, click
"Suggest for purchase" and submit the form.
Without this patch the suggestion is created but the link to the
bibliographic record is lost
With this patch applied you should see that suggestions.biblionumber has
correctly been preserved

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 9ae252946d)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit ad5a157c82)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-07 01:18:11 +01:00
Jonathan Druart feed7892a8 Bug 29696: Add tests
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 146c1e1d9f)

Bug 29696: correct number of tests for 21.05.x

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit c467f3faca)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-02-07 01:17:52 +01:00
Victor Grousset/tuxayo 81d83994a0 Update release notes for 20.11.14 release
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 20:47:08 +01:00
Victor Grousset/tuxayo 32a252c615 Increment version for 20.11.14 release
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 20:09:51 +01:00
Victor Grousset/tuxayo 1ca294f6f5 Fix translations for Koha 20.11.14
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 20:06:12 +01:00
Koha translators 3089bb94a1 Translation updates for Koha 20.11.14
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:16:03 +01:00
Jonathan Druart b730f85de8 Bug 29903: Prevent messages to be deleted from unauthorised users
The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a2b9a76431)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart 0bb3edf936 Bug 29542: Prevent access to private list to non authorized users
The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6ca49b550e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart 3afe1ccb6d Bug 29914: Remove 'Use of uninitialized value ' warnings
(cherry picked from commit 68c11c5179)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Nick Clemens c96e11338a Bug 29914: (QA follow-up) Add comment to explain last case
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

JD amended patch: remove ref to line number

(cherry picked from commit a866722ae6)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Nick Clemens 8c52a17ef2 Bug 29914: (QA follow-up) Expand tests to cover failure case before patches
When asking for permissions we get 'failed', without we get 'ok'
Adding explicit checks for not 'ok'

Add a FIXME:
We should cover the case where we return 'failed' after changes, but that is a larger undertaking

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit e956130f8f)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Marcel de Rooy 862836954b Bug 29914: Remove warn on timeout
The value of the system preference 'timeout' is not correct, defaulting to 600.

Caused by previous test. Actually an omission in another sub that
does not seem to support 10x.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit eea32e6c5d)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart 2189647bb0 Bug 29914: Add tests
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 3af901ae64)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart c986bd983b Bug 29914: Make check_cookie_auth compare the userid
check_cookie_auth is assuming that the user is authenticated if a cookie exists
and that the login/username exists in the DB.

So basically if you hit the login page, fill the login input with a
valid username, click "login"
=> A cookie will be generated, and the sessions table will contain a
line with this session id.
On the second hit, if the username is in the DB, it will be enough to be
considered authenticated.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7114dc2fb1)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Tomas Cohen Arazi 18a88ae463 Bug 29544: (QA follow-up) Simplify code
I think this is a better approach for the same thing. Posting it just in
case it helps.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart a553e927ee Bug 29544: Fix opac-issue-note.pl
We must check if logged in user is trying to modify one of their
checkouts

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:45 +01:00
Jonathan Druart 2c8b3a96bc Bug 29544: Ensure logged in user is allowed to modify checkout note
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart 2e7bbc6457 Bug 29541: Prevent users from another group to access patron's images
We should respect group restrictions here.

Test plan:
Create a patron from another group of libraries and don't let them
access info from patrons outside of this group.
Access the following link and confirm that you can see the image only
for patrons from their group
  /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart c141d203cb Bug 29541: Restrict access to patron's image to borrowers => * and circulate => *
The patron images is displayed on the 'circulation' and 'members'
modules.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Marcel de Rooy fc12d76c25 Bug 29540: Raise flagsrequired in modrequest
Test plan:
Try modrequest with a user having only 'catalogue' perms and the following URLs:
[1] /cgi-bin/koha/reserve/modrequest.pl?reserve_id=XX&CancelBorrowerNumber=XX&CancelItemnumber=XX&biblionumber=XX
    Fill the XXs with correct identifiers for some item level hold.
[2] /cgi-bin/koha/reserve/modrequest_suspendall.pl?suspend=1&suspend_until=2021-12-01&borrowernumber=XX
    Fill the XX with borrowernumber for borrower that has pending holds.
You should see: Error: You do not have permission to access this page.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[AMENDED] More consensus for using reserveforothers than circulate_remaining.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 15285ae209)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
David Cook 15535f9fd5 Bug 28735: Self-checkout users can access opac-user.pl for sco user when not using AutoSelfCheckID
This patch makes the sandboxing of the selfcheckout more robust by
adding a "sco_user" session variable which is turned on when
logging into the self-checkout (either by AutoSelfCheckAllowed or manually).

If a user with this session variable turned on tries to access
other parts of the system (like the rest of the OPAC), it will
"kick out", so that the browser user will lose the authenticated session.

Test plan:
1) Apply the patch
2) koha-plack --restart kohadev
3) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
4) Note that you are logged into the self-checkout
     So you see the login screen specific to the self-checkout.
     To log with the actual patron. It's a nested auth.
5) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
6) Note that you are not logged into the OPAC
7) Log into the staff interface and disable the
system preference AutoSelfCheckAllowed
8) Log out of the staff interface (this step is very important)
9) Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
10) Note that you are prompted to log into Koha
11) Login using the "koha" user (when using koha-testing-docker)
12) Note that you are logged into the self-checkout
13) Go to http://localhost:8080/cgi-bin/koha/opac-main.pl
14) Note that you are not logged into the OPAC
      Without the patch you would still be logged as "koha"
15) Go back to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
16) Note that you will need to log in again as you've lost your
session cookie
      Without the patch you will still be logged in the self-checkout
Voila!

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6d022889a2)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard b3cd880730 Bug 26102: Prevent XSS when To.json is used: unimarc_field_4XX.tt
To test, edit a MARC framework to link a subfield to the
unimarc_field_4XX.tt. The process of triggering the plugin and selecting
a search result from the plugin popup should work correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit dbd1359353)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard 0907aa7fe9 Bug 26102: Prevent XSS when To.json is used: subscription-add.tt
Test the process of adding a subscription, entering both a valid vendor
ID and a non-existent vendor ID. The non-existent vendor ID should
trigger a validation alert.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 583aad8e48)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard fb7da5bd15 Bug 26102: Prevent XSS when To.json is used: guarantor_search.tt
To test, edit a patron record and go through the process of adding a
guarantor. In the guarantor search results table the address should be
displayed correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 11d0a05eb9)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard 083ae794cc Bug 26102: Prevent XSS when To.json is used: catalogue/results.tt
To test, perform a search in the catalogue and verify that search term
highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0de86fd323)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard 690509d0bd Bug 26102: Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt
Test the process of searching for and selecting an authority record for
use in the basic MARC editor.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 57a2a82c50)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard f9e0b1d2ac Bug 26102: Prevent XSS when To.json is used: authorities/authorities.tt
Check that mandatory tags and subfields are correctly required when
editing an authority record.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d9ae296b23)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Owen Leonard a2b2e94686 Bug 26102: Prevent XSS when To.json is used: admin/preferences.tt
Test that preference search term highlighting works correctly.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5df95693f9)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Nick Clemens 3b1f14111c Bug 29543: Set autocomplete off for SCO login fields
Cardnumber already had it set, adding for username and password

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 25856b460e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart 7e10e96b26 Bug 29543: Add Mojo::JWT dependency
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f07a666c2e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Nick Clemens 34757dcea7 Bug 29543: (follow-up) Add a warning to SelfCheckoutByLogin
This updates the language to warn users of risk if using cardnumber for login and auto-self-check is enabled

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b32dbaa9cf)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart 6674a3b80f Bug 29543: Prevent user to checkin or renew items they don't own
Checkin or renew must be restricted to the items they own.

Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
    /cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1

You should see an error message

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 839b7c4a5c)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart ef700ba5c2 Bug 29543: Enforce authentication for self-checkout
The self-checkout feature is assuming a patron is logged in if patronid
is passed. It also assumes that "We're in a controlled environment; we
trust the user", which is terribly wrong!

This patch is suggesting to generate a JSON Web Token (JWT) to store in
a cookie and only allow action (renew, check in/out) is the token is
valid. The token is only generated once the user has been authenticated
And is removed when the user finish the session/logout.

Test plan:
You must know exactly how the self-checkout feature works to test this patch.
The 4 following sysprefs must be tested:
 SelfCheckoutByLogin, AutoSelfCheckAllowed, AutoSelfCheckID, AutoSelfCheckPass
Confirm that you can renew, checkin for the items you own, and checkout new items.
Confirm that you are not allowed to access other account's info.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 77e21f3006)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart 37f1af8a19 Bug 29543: Add JWT token handling
Mojo::JWT is installed already, it's not a new dependency.
We need a way to send the patron a token when it's correctly logged in,
and not assumed it's logged in only if patronid is passed

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d978bf1506)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart fbb25be20b Bug 29543: Remove inputfocus variable
It's not used in template

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7ea2d7cd68)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Jonathan Druart 4a3397ad1b Bug 29543: Remove borrower variable
It's not needed, we have $patron

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4c398daaf5)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 19:15:44 +01:00
Fridolin Somers 7168229653 Bug 28698: Fix news for all displays in all locations
Some news are used for custom text with a specific language, for example "opacheader".
The bug is that in these locations, news for all (staff and opac) are displayed.
This is because GetNewsToDisplay uses SQL :
  opac_news.lang = '' OR opac_news.lang = ?

This patch is a quick fix.
This feature maybe needs a big revamping.

Test plan :
1) Remove any news
2) Create a news with empty 'Display location' and some content
3) Display OPAC interface
4) without patch you see in location of 'opacheader', 'opacnavright' ... the content
   of the news
5) With patch you see content of the news only in news table
6) Create a news for opacheader
7) Check it appears in correct language

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
(cherry picked from commit 33369d2522)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 18:08:17 +01:00
Marcel de Rooy b8418ee1a9 Bug 29437: (QA follow-up) Update TODO in Breeding.t
We now have some tests for BreedingSearch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0b428c36db)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 01:09:39 +01:00
Marcel de Rooy 6682e13b6c Bug 29437: (QA follow-up) Remove Business::ISBN from addbooks
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0b02e9ed4c)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 01:09:39 +01:00
Nick Clemens eb2f2aa604 Bug 29437: Search reservoir for term as title, author, or variations of ISBN
The code in the script and the module attempt to determine whether a term is an isbn, or not. Rather
than try to do this, we can simply search it on the three fields: isbn, title, author

Additionally, we should search as any of the ISBN variations to broaden our matches

Note: Curently only an ISBN 10 is stored in import biblios, so for an ISBN13 that doesn't convert
the value will be blank - this is another bug

To test:
1 - Perform a cataloging search for a valid ISBN 13 with no ISBN10 counterpart:
    9798200834976
2 - 500 error
3 - Apply patch
4 - Repeat, no results
5 - Import some records
6 - Search by title/author/isbn
7 - Confirm searching works as expected

WNC amended to fix spelling

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
AMENDED: Useless call of ISBNs (plural) when you only pass one parameter.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b422b7af23)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 01:09:39 +01:00
Nick Clemens ac4c5b3eaa Bug 29437: Unit tests
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4c2fc8eac5)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 01:09:39 +01:00
Lucas Gass 5d86cc7363 Bug 29319: Use Business::ISBN to check ISBNs on addbooks.pl/cataloging search
To test:
1. Go to cataloging search and enter something like "7th Heaven".
2. Get an error when searching, Koha thinks you entered an ISBN
3. Apply patch
4. Try the same search, it should be a proper title search now
5. Find some stuff in the catalog with ISBN numbers in them.
6. The search should properly return ISBN13/ISBN10 searches, without with out the '-'.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 14c8d4c230)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2022-01-31 01:09:01 +01:00