Commit Graph

8322 Commits

Author SHA1 Message Date
Jonathan Druart e825b301e3
Bug 31244: [21.11.x] Fix 500 if logout and not logged in
Can't use an undefined value as a HASH reference at /kohadevbox/koha/C4/Auth.pm line 985
        C4::Auth::checkauth('CGI=HASH(0x5603b7dc4300)', 0, 'HASH(0x5603b2633238)', 'intranet', undef, 'intranet-main.tt') called at /kohadevbox/koha/C4/Auth.pm line 186
        C4::Auth::get_template_and_user('HASH(0x5603b7b83d08)') called at /kohadevbox/koha/mainpage.pl line 40

Test plan:
Open a private window
Hit /cgi-bin/koha/mainpage.pl?logout.x=1

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Rebased for 21.11.x
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2023-01-27 11:06:32 +01:00
Nick Clemens c0fa919492
Bug 22042: Block all return actions when BlockReturnOfWithdrawn items is set to block
Currently this syspref only bokcs the literal 'return' from a patron, i.e. the checkin

It still processes transfers, refunds lost items, updates NotForLoan status etc.

We should block all of these things

To test:
1 - Set BlockReturnOfWithdrawn to block
2 - Set an item as lost and withdrawn
3 - Check it in
4 - Item is found
5 - Apply patch
6 - Repeat 1-3
7 - Checkin is blocked, item still lost

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 321d8f7ce6)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-26 14:55:04 +01:00
Fridolin Somers 424caa64be
Bug 20596: (QA follow-up) perltidy
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit aa13c1a9d1)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d2ac793be2)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8441834b84)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-26 11:45:27 +01:00
David Cook 41d51f5cbb
Bug 20596: Join authority queries together with OR
This patch joins authority queries together with OR like Elasticsearch.

To the best of the author's knowledge, this code only gets triggered
when using record matching rules, but there may be other situations
where it's used.

Authority search in cataloguing plugins use a different path, and
authority search in authority home doesn't allow multiple queries,
so they'll never trigger this OR joining of queries.

Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Create a record matching rule with the following:
Matching rule code: NID
Description: NormdatenID
Match threshold: 100
Record type: Authority record
Search index: Any
Score: 101
Tag: 035
Subfields: a
Offset: 0
Length: 0
Normalization rule: None

Click "Remove this match check"

2. Stage gnd.xml (from BZ 20596 attachments)
- Choose "MARCXML" for "Format"
- Choose "Authority" for "Record type"
- Choose "NID" for "Record matching rule"
- Click "Stage for import"
3. Note the job gets to "100% Finished"
(Before this patch, it would say "0% Failed")

4. View the batch
5. Import the record
6. Repeat steps 2-4 and note that the record matching rule
worked

7. Go to http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl
8. Search for "e"
9. Note that the search works

10. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode=
11. Click tab 6
12. Click on the tag editor next to "a Personal Name"
13. Type "e" into each box and click "Search"
14. Note that the search works

Signed-off-by: Jan Kissig <jan.kissig@th-wildau.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b2a23149bd)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 9a319b8169)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f4462b8402)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-26 11:45:27 +01:00
Arthur Suzuki 39999fec0f
Revert "Bug 32208: Adjust Auth.pm for relogin without perms"
This reverts commit 44d991b0c4.

Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-13 14:56:03 +01:00
Arthur Suzuki 243efa7ee9
Revert "Bug 32208: (follow-up) Fix compile issue"
This reverts commit 610644ae89.

Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-13 14:55:49 +01:00
Marcel de Rooy c2e0bc2d2d
Bug 31908: [21.11.x] Fix Auth.pm
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-13 11:28:06 +01:00
Marcel de Rooy 415ec58c80
Bug 31908: [21.11.x] Revert "Resolve second login with another userid"
This reverts commit 0a89528d58.

Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2023-01-13 11:27:45 +01:00
Martin Renvoize 610644ae89
Bug 32208: (follow-up) Fix compile issue
The tests are failing, so this needs some more thought.
2023-01-11 12:07:04 +00:00
Marcel de Rooy 44d991b0c4
Bug 32208: Adjust Auth.pm for relogin without perms
If a second login on top of a current session fails on
permissions, we should not grant access without context.

Test plan:
[1] Run t/db../Auth.t, it should pass now.
[2] Test interface with/without this patch:
    Pick two users: A has perms, B has not.
    Put two staff login forms in two tabs.
    Login as A in tab1. Login as B in tab2.
    Without this patch, B gets in and crashes.
    With this patch, B does not get in ('no perms').
    Bonus: Go to opac if on same domain. You are still
    logged in as B.

NOTE: I added a FIXME here, since you could argue about filling
the session info or otoh deleting the session. We present an
authorization failure; people may not realize that they are
still logged in (see test plan - bonus).

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0cc7c4991c)
2023-01-11 12:07:04 +00:00
Marcel de Rooy 0a89528d58
Bug 31908: Resolve second login with another userid
Somewhere the line undef $userid got removed.
We need it to resolve the second login situation.

Test plan:
Login in staff with user missing privileges.
On the login form login again with another staff user.
Note that you do no longer crash.

Run t/db../Auth.t
Run t/db../Koha/Auth/TwoFactorAuth.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2d0a2c44e7)
2023-01-11 12:07:03 +00:00
Marcel de Rooy 640c8853aa
Bug 31908: Replace an exit by a safe_exit in Auth.pm L1314
No change in user experience. But since we can mock safe_exit,
we can enhance test results.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7373a1e414)
2023-01-11 12:07:02 +00:00
Nick Clemens 31ee9c363c Bug 27265: (follow-up) Use existing parameter
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit a39ecfd7f7)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6132f9708d)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-22 19:39:14 +01:00
Kyle M Hall 5b37d0bb81 Bug 27265: Enable message queue cron to accept multiple codes and types
It would be nice to be able to combine several types in a single run,
but exclude others, without having to have multiple cron lines

Test Plan:
1) Apply this patch
2) Run process_message_queue.pl with a single -c parameter
3) Note behavior is unchanged
4) Run process_message_queue.pl with multiple -c parameters
5) Note all the codes specified are processed
6) Repeat 2-5 with -t for type limits

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit da7bcc2252)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b51e6cd465)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-22 19:39:14 +01:00
Marcel de Rooy 2b15a60afd Bug 19693: (QA follow-up) Replace changed tag test
The test
  $MARCfrom->field('1..', '2..'))[0]->tag ne ($MARCto->field('1..', '2..'))[0]->tag
is not completely consistent with following code in sub merge.
I decided to get the authtype code from the old record that comes
from Koha and should include the type.
Remaining changes refer to indentation/comments.

Test plan:
Run t/db_dependent/Authority/Merge.t
Note: The test actually could be extended a bit for mocking MARC
flavor, but needs some additional framework support to work.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d7d33744ba)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 90e4cdb752)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-16 16:52:03 +01:00
Janusz Kaczmarek ae17e1bcb3 Bug 19693: Update of an authority record creates inconsistency when the heading tag is changed
In those rare cases when authorities are updated by an external agency (or
even internally, by reviewing and correcting an exported authority file)
when the heading tag will be changed (seems odd but happens:

111 Congress ==> 110 Corporate body.Congress ;
100 Person ==> 110 Corporate body (a company named with person's name ;
151 City--object ==> 150 Object (city) etc.)

and then the authority record in Koha database will be updated with
bulkmarcimport or by calling directly ModAuthority from a custom script,
the merge function "doesn't know" that the change to the authority type
has been made and, consequently, doesn't adequately change the tag in
related fields in biblio records (as it would if two different records
with different authtypecode were merged with Koha interface).

This is because at the moment when merge function is being called
by ModAuthority:
Koha::Authority::Types->find($autfrom->authtypecode)
Koha::Authority::Types->find($authto->authtypecode)
both have the same value (because $mergefrom == $mergeto).

Therefore in case when $mergefrom == $mergeto and the heading tag changes,
$authtypefrom and $authfrom calculated in merge in the ordinar way are
misleading and should not be taken unto consideration.

Test plan:
==========

1. run t/db_dependent/Authority/Merge.t
2. you should see problems in "Test update A with modified heading tag
   (changing authtype)"
3. apply the patch
4. run t/db_dependent/Authority/Merge.t again
5. the test should pass

Alternatively:

1. have an authority record used in biblio;
   export it to file;
   change 1XX heading tag to a different (but reasonable) value
   and possibly change also the content of the heading
   (one can delete also 942 but it doesn't matter);
   make bulkmarcimport.pl -a -update -file <modified_auth_file> and
   see that the tag in biblio record has not been changed (whereas
   the type of authority record did change);

2. make orders in database (so that the authority type and the tag of
   the field in biblio record correspond); apply the patch;

3. repeat the test from 1.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 03da66ce20)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3cf8c3881d)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-16 16:52:03 +01:00
Kyle Hall 479ef38873 Bug 31552: SIP2 option format_due_date not honored for AH field in item information response
Bug 28730 added the ability to format due dates based on Koha's date format, but missed formatting the due date field in the item information response.

Test Plan:
1) Apply this patch
2) prove t/db_dependent/SIP/Message.t

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 93e418c0b3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0c7b340508)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-14 16:20:28 +01:00
Kyle Hall 305aaa36f6 Bug 31587: Basket not accessible from ACQORDER notice
The parameter "aqbasket" is passed to GetPreparedLetter, but is always undefined for the notice ACQORDER.

Test Plan:
1) Set your ACQORDER notice content to:
   ***[% basket %]***
2) Set up a vendor with an email, set contact for email so the "E-mail
   order" button shows on a basket for that vendor
3) E-mail the basket
4) Note the email contents are "******"
5) Apply this patch
6) Restart all the things!
7) Email the basket again
8) Note the content looks something like:
   ***Koha::Acquisition::Basket=HASH(0x55870acd96e0)***

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c89e886b6d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit aceaca5d29)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-14 15:24:21 +01:00
Fridolin Somers 25189d9847 Bug 31649: Fix acquisition basket group CSV export if biblio does not exist
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8d933d482a)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 36417312eb)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-14 14:38:57 +01:00
Fridolin Somers 1e58715fd5 Bug 31649: Fix acquisition basket CSV export if biblio does not exist
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 28b56098b5)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ace7e412a8)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-14 14:38:57 +01:00
Johanna Raisa 7b3662b37b Bug 30359: GetBudgetHierarchy is slow on order receive page
This patch adds skiptotals parameter to GetBudgetHierarchy so calculating
totals can be skipped from some pages.

Test plan:
1) Open browser's Inspect -> Network
2) Go to receive orders
3) Check the timings for page load
4) Apply the patch
5) Refresh the page
6) Check the timings again
7) prove t/db_dependent/Budgets.t

Sponsored-by: Koha-Suomi Oy

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 35724169c1)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3fa5d0a421)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-14 10:30:38 +01:00
Jeremy Breuillard 8be601a748 Bug 27550: "Duplicate budget" does not keep users associated with that budget
When a budget is duplicated, Owner is copied but not Users

Test plan :
Home > Administration > Budgets
1)Create a budget to allow (active or inactive)
2)Give it some funds by filling up the form, especially Owner and
User(s)
3)Submit then go back to the Budgets dashboard
4)Duplicate the Budget and click on its name
5)Edit it and notice that User(s) is empty
6)Apply the patch
7)Repeat from 1) to 5)

Signed-off-by: Samu Heiskanen <samu.heiskanen@hypernova.fi>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit ed97960cd7)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2d5529915b)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-11-14 17:50:42 +01:00
Katrin Fischer 5192d66beb Bug 31401: Update administration sidebar to match entries on administration start page
This makes sure that all entries on the administration start page
have a matching entry in the administration sidebar that shows
on the left side if you are on any of the administration sub pages.

Changes made:
* Rename 'Classification sources' to 'Classification configuration'
* Make Plugins entry show and appear in correct spot
  This relied on the variable plugins_enabled that wasn't available
  in all the different templates. I therefore moved it to Auth.pm
  and cleaned up the code for the admin start page.
* Move 'MARC overlay rules' and rename to 'Record overlay rules'

To test:
* Make sure plugins are enabled and visible on admin start page
* Compare admin start page and sidebar
  * Sequence should be the same
  * All entries should appear on both pages
  * Naming should be the same

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit aa90b60ea2)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cb5049a7bc)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-11-14 14:46:28 +01:00
Nick Clemens 0ce64c4469 Bug 31023: Quote authtypecode in FindDuplicateAuthorities
To test:
0 - Have Koha using Elasticsearch
1 - Set  QueryRegexEscapeOptions to 'unescape escaped'
2 - Attempt to add a new 'GENRE/FORM' authority record
3 - On save you get a 500 error
Unable to understand your search query, please rephrase and try again.
 at /kohadevbox/koha/Koha/SearchEngine/Elasticsearch/Search.pm line 102
4 - Apply patch, restart all
5 - Attempt to add a new 'GENRE/FORM' authority record
6 - Success!

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit dee864c1ed)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 970cf81514)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-11-14 14:34:44 +01:00
Nick Clemens 68c1318ff6 Bug 28290: Don't send subfields to 'as_string' if none to send
This fixes an error where we send a blank string to
Marc::Field->as_string

The subroutine fails as the regex is marked as incomplete as there is
nothing between the brackets

Also fixes a missing hidden input for 'item_action' when no items are
staged during import

 1 - Define a new matching rule with no subfields
    Match-threshold: 1000
    Record type: bibliographic record
    Search-index: Other-control-number
    Score: 1000
    Tag: 035
    Subfields:
    Offset:
    Length:
 2 - Attempt to stage a record with an 035 using this rule (i will
     attach example to bug)
 3 - Staging fails
 4 - Stage again with no matching rule
 5 - Manage the staged record, try to apply the matching rule
 6 - It fails, 500 error
 7 - Apply patch
 8 - Restart all the things
 9 - Apply rule again, it works!
10 - Stage the record again using the rule for matching
11 - It stages and matches!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit eded6edacc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0c8e4780d7)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-11-14 14:33:09 +01:00
David Cook 6451a70283 Bug 31390: Remove noisy warns in C4::Templates
This patch removes two noisy warnings from C4::Templates

0) Apply patch and koha-plack --restart kohadev
1) Go to http://localhost:8081/
2) Note no warnings in /var/log/koha/kohadev/plack-intranet-error.log
3) Go to http://localhost:8080/
3) Note no warnings in /var/log/koha/kohadev/plack-opac-error.log

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 368b1462e5)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 08dc25d757)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-19 05:07:19 +02:00
Nick Clemens 9e8006f3ee Bug 22605: (follow-up) Fix operators
- Don't add an operator on first loop
- Only add plus option on last loop
- Fix indentation of first search box
- Remove spaces from operators in query_cgi and add to query and query_desc

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 5bd71b5b7d)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-19 05:07:19 +02:00
Fridolin Somers fd853a50f3 Bug 28327: (follow-up) Comma as default CSV delimiter
Looks like most of existing code wants comma as default value.

Also impact installer/data/mysql/mandatory/sysprefs.sql.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 7b645b0208)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4cf509b248)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-19 05:07:19 +02:00
Fridolin Somers 32211362ab Bug 28327: Unify CSV delimiter special behavior for tabulation
System preference 'CSVdelimiter' has a special case for tabulation.
Preference value contains string 'tabulation' but string '\t' must be used in CSV file.

This is OK in many places, for exemple Bug 17590.

This patch adds C4::Context->csv_delimiter to add a uniq metod dealing
with this behavior.
Also create Koha::Template::Plugin::Koha->CSVDelimiter for calls from
Toolkit Templates.

Test plan :
1) Set system preference 'CSVdelimiter' = 'tabs'.
2) Create CSV export in impacted pages
3) Check columns are separated by tabulation character and not string 'tabulation'
4) Check with another delimiter

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 381b79593e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9d8ddcc1b7)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-19 05:07:19 +02:00
Tomas Cohen Arazi 514b662861 Bug 29325: Fix commit_file.pl
This patch fixes the broken commit_file.pl script.

It doesn't deal with commiting the import from the UI.

To test:
1. Pick a file for staging:
   $ kshell
  k$ misc/stage_file.pl --file TestDataImportKoha.mrc
=> SUCCESS: All good
2. Commit!
  k$ misc/commit_file.pl --batch-number 1
=> FAIL: You see
DBIx::Class::Storage::DBI::_exec_txn_begin(): DBI Exception: DBD::mysql::db begin_work failed: Already in a transaction at /kohadevbox/koha/C4/Biblio.pm line 303
3. Apply this patch
4. Repeat 2
=> SUCCESS: Commit succeeds
5. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 29325: (QA follow-up) Remove unexisting parameters of BatchRevertRecords

There is no interval and callback as in BatchCommitRecords.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 29325: Call progress callback one last time to confirm comppletion

Previously after finishing the loop we were still in a transaction that never completed - we should report progress when done
one final time to commit the last records

To test:
1 - Stage a file with > 100 records
2 - Commit file
3 - Confirm batch is imported and no records left as staged

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 29325: Fix import from staff client

same test as before, but via the staff client

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 29325: Handle the transaction in BatchCommitRecords

Requiring the callback to commit was breaking reversion, and likely elsewhere

Let's simplify and say that the routine iteself will handle the txn and commit

TO test:
1 - Stage a file
2 - Import a file
3 - Revert a file
4 - Test staff client and command line

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Bug 29325: (QA follow-up) Tidy up

tools/manage-marc-import.pl: sub commit_batch does no longer need $schema
tools/manage-marc-import.pl: sub revert_batch: calling BatchRevertRecords which has no interval and callback
misc/commit_file.pl: sub print_progress_and_commit does no longer commit, renamed
misc/commit_file.pl: sub print_progress does no longer have a schema parameter
misc/commit_file.pl: sub revert_batch reported deleted items as added

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-14 22:22:04 +02:00
Arthur Suzuki 321d37f659 Revert Bug 29012:
Some rules are not saved when left blank while editing a 'rule' line in smart-rules.pl

Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-14 21:51:23 +02:00
Nick Clemens dd4deaadfc Bug 30779: Remove _update_import_record_marc and update tests
This patch removes the now unused: _update_import_record_marc

Additionally, as items are already present in import biblio we no longer need to embed
them, so that parameter is removed and the option removed from the sub and pod and everywhere
it was used

In all cases, we were embedding, so we don't need a way to get without

Tests updated

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b02b66acf5)
(cherry picked from commit 54ddc31c71)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 17:19:57 +02:00
Nick Clemens 94563abd41 Bug 30779: Do not update import marc after importing items
We are stripping the marc item tags at import - we save them when not importing items, but
strip when importing items

I think we can save on writes by leaving them in the record. This also allows comparison to what was staged
versus items created

To test:
 1 - Stage a marc record with items, but do not look for items
 2 - Confirm the item tags remain in staged marc
 3 - Import the record
 4 - Confirm items are nto in imported marc record
 5 - Stage the record again, but look for items
 6 - Confirm the item tags are stipped from imported record
 7 - Import and confirm imported record has no item tags
 8 - Apply patch and repeat 1-5
 9 - Confirm item tags remain in record
10 - Import and confirm item tags not in imported marc

Signed-off-by: Andrew <andrewfh@dubcolib.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b1ec071866)
(cherry picked from commit c2169d1dfe)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 17:19:57 +02:00
Nick Clemens 49d331c8e1 Bug 26632: (Bug 22532 follow-up) Remove random variables
AddBiblioToBatch and AddAuthToBatch were btoh passing a random number for the
parameter $update_counts

This simply removes that value as should have been done on 22532

To test:
1 - Stage a marc file
2 - Confirm it works befor and after patch

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 66c5ab528c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3a8709f0bd)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 16:37:34 +02:00
Kyle Hall 47ebd758c7 Bug 31276: Report results are limited to 999,999 no matter the actual number of results
In Koha, any report that uses C4::Reports::Guided will be limited to 999,999 rows. This is causing problems for larger libraries where some reports may have over a million results.

Test Plan:
1) Create a report "SELECT * FROM borrowers" and run it, note the number
   of results
2) Apply this patch
3) Add the line `<report_results_limit>3</report_results_limit>`
   within the <config> block of your koha-conf.xml
4) Restart all the things!
5) Run the report, download the results as a CSV
6) Note your CSV only has 4 lines, the header and 3 patrons

Signed-off-by: Rachael Laritz <rachael.laritz@inlibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5e29433bdc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ae71ac66f8)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 16:34:39 +02:00
Marcel de Rooy ffccde580a Bug 30984: (QA follow-up) Ternary formatting style
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b3a0d75a40)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1fe48f965c)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 13:12:37 +02:00
Kyle Hall dcb767b9bb Bug 30984: Action logs should log the cronjob script name that generated the given log
When something is changed by a cronjob, and that entity is logged via action logs, we can know what changed, and that it was via a cronjob, but we cannot necessarily know which cronjob made that change. The closest we can come is to find the action logs for the cronjob module which ran before the change which is by no means reliable assuming the CronLog is even enabled.

We should add a new column to action logs to store the name of the script ran for any action logs where the interface is "cron".

Test plan:
1) Apply this patch
2) Run updatedatabase.pl
3) Enable all the Log/Logging sysprefs
4) Run some cronjobs that will generate action logs
5) Note the new action_logs column "script" contains the filename of the
   cronjob that caused the change.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 18fd0c89cf)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5767add2cc)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 13:11:20 +02:00
Kevin Carnes c4829c0eac Bug 29012: Add default values for blank circulation rules that weren't saved to the database
There are 5 fields that are not set if no value is provided when saving/editing a rule in Administration->Circulation and fines rules
- issuelength
- hardduedate
- unseenrenewalsallowed
- rentaldiscount
- decreaseloanholds

This is problematic because it gives the impression these rules are set as blank, but in reality they don't exist and the rule will fal back to the higher level

To test:
1 - Set a rule for
    Patron category: Teacher
    Itemtype: All
    Hard due date: (Today)
    Lona period: 10
2 - Set a rule for
    Patron category: Teacher
    Itemtype: Books
    Hard due date: (leave blank)
    Loan period: 10
3 - Expected behaviour is Book item will checkout to teacher for 10 days, all other types will be due yesterday at 25:59:00
4 - Checkout an non-book item type to teacher
5 - Hard due date applies
6 - Checkout a 'book' item type to teacher
7 - Hard due date applies - FAIL

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit cf397ac3bc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 387900a65c)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-10-12 11:03:06 +02:00
Kyle M Hall 6c423f10d5 Bug 31120: Items will renew for zero ( 0 ) days if renewalperiod is blank/empty value
If the rule renewalperiod is the blank empty string instead of being null/undefined or non-existant, Koha will interpret the renewal period as being zero days instead of falling back to the issuelength rule.

It makes sense to me that a literal 0 here should make it renew for zero days even though that is nonsensical.

Test Plan:
1) Delete all your rules
2) Create an all/all/all rules with an empty string for renewal base
   period
3) Note that renewing an item does nothing
4) Apply this patch
5) Restart all the things!
6) Renew again
7) Note the renewal uses the issuelength rule as intended

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 9b010d99df)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e20879a8f5)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:54:53 +02:00
Kyle Hall 1b1931c93f Bug 30838: (QA follow-up) Add missing semicolon
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 008e6ae9eb)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3805235e45)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:43:53 +02:00
Martin Renvoize bcc36081f4 Bug 30838: Set to_address to smsalertnumber at send
It may be helpful to know exactly what number was used for the sms alert
that was sent. As such, we should ensure it's set at the time of
sending.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e9cdc1da65)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 625b354f8a)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:43:53 +02:00
Martin Renvoize 6fe74607d1 Bug 30838: Don't fallback through phone numbers for sms
This patch removes the fallback handling for smsalartnumber as the
to_address in notices. We ignore the to_address field in the message
queue at send time for sms anyway and use smsalertnumber exclusively so
having this field populated is just confusing to the end user

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5e388ed509)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20b17b5167)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:43:53 +02:00
Frédéric Demians 084c14787f Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData)
Test plan:

(A) Reproduce the bug:

A1 In Administration > System preferences > Web services:
   - Enable OAI-PMH
   - Enable OAI-PMH:AutoUpdateSets
   - Enable OAI-PMH:AutoUpdateSetsEmbedItemData

A2 In Tools > Export data > Export bibliographic records, export 1 (one)
   biblio record. Be sure that this biblio record has at least one item.
   Don't tick "Don't export items".

A3 Delete the exported biblio record, and its items.

A4 In command line, on the server load the exported file:
   ./bulkmarcimport.pl -b -v -file /path/to/koha.mrc

A5 Retrieve the biblio record in Koha. Note the absence of the item(s). This is
   the bug.

(B) Apply the patch

B1 Delete the record (without item) loaded at A4.

B2 In command line, on the server load the exported file:
   ./bulkmarcimport.pl -b -v -file /path/to/koha.mrc

B2 Retrieve the biblio record in Koha. Note the presence of the item(s).

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d5e65dd4c0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 06b48f16e4)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-12 13:50:06 +02:00
Kyle Hall 6a26ee39ec Bug 31202: Don't remove optional SIP fields with a value of "0"
If the value of a SIP field is "0", that evaluates to false, so any calls to maybe_add with a value of "0" will not get added to the SIP response message.

Test Plan:
1) Apply this patch
2) prove t/db_dependent/SIP/Message.t

Signed-off-by: Michal Urban <michalurban177@gmail.com>
JK: Adjust commit title

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8b957a69d4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5775f6c9a9)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-12 10:38:08 +02:00
Katrin Fischer 6c47479066 Bug 27045: (follow-up) Fix delimiter in header rows
The header rows still showed \t because the newly defined
variable wasn't used there.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2eea061ca3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ed114537d3)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 15:54:19 +02:00
Jonathan Druart cdfecb6fb7 Bug 27045: Fix other exports using CSV profiles
This patch corrects the export of the 2 other reports
using CSV profiles:

* Late issues (serials)
* Basket (acquisitions)

To test:
1) Late issues
* Update the late issues sample report to use tab as separator
* Create a subscription
* Go to serial collection and 'generate next' to get some late issues
* Go to Claims
* Export the late issues and verify format is correct
* Verify exported file has tabs

2) Basket summary
* Create an order with several order lines
* Create an SQL type CSV profile for basket export using tab as separator
  Example: aqorders.quantity|aqordres.listprice|Title=biblio.title
* Export the basket using your configured CSV profile
* Verify exported file has tabs

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 7cd84171ab)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9af01ea2e3)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 15:54:14 +02:00
Fridolin Somers b91d31c02e Bug 27683: Bind results of GetAnalyticsCount to the EasyAnalyticalRecords pref
C4::Items::GetAnalyticsCount is part of the easy analytics feature.
Like Bug 20702 make early return when the system preference EasyAnalyticalRecords is disabled.
Actually it may block an item deletion for wrong reason.

Test plan :
1) Dont apply patch
2) Build an item and a linked analytical record with 773$0 and $9
3) Enable EasyAnalyticalRecords
4) Try to delete the item
5) You have an alert because linked to analytics
6) Disable EasyAnalyticalRecords
7) Try to delete the item
8) You have an alert because linked to analytics
9) Apply patch
10) Try to delete the item
11) No alert, it works :D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit dfc390940d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 28b5880d71)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 15:10:37 +02:00
Julian Maurice df9b4c2256 Bug 29333: Fix encoding of imported UNIMARC authorities
MARC::Record and MARC::File::* modules sometimes use the position 09 of
the leader to detect encoding. A blank character means 'MARC-8' while an
'a' means 'UTF-8'.

In a UNIMARC authority this position is used to store the authority type
(see https://www.transition-bibliographique.fr/wp-content/uploads/2021/02/AIntroLabel-2004.pdf [FR]).
In this case, 'a' means 'Personal Name'.

The result is that the import will succeed for a Personal Name
authority, but it will fail for all other authority types.

Steps to reproduce:
0. Be sure to have a Koha UNIMARC instance.
1. Download the MARCXML for "Honoré de Balzac"
   curl -o balzac.marcxml https://www.idref.fr/02670305X.xml
2. Verify that it's encoded in UTF-8
   file balzac.marcxml
   (should output "balzac.marcxml: XML 1.0 document, UTF-8 Unicode
   text")
3. Go to Tools » Stage MARC for import and import balzac.marcxml with
   the following settings:
   Record type: Authority
   Character encoding: UTF-8
   Format: MARCXML
   Do not touch the other settings
4. Once imported, go to the staged MARC management tool and find your
   batch. Click on the authority title "Balzac Honoré de 1799-1850" to
   show the MARC inside a modal window. There should be no encoding
   issue.
5. Write down the imported record id (the number in column '#') and go
   to the MARC authority editor. Replace all URL parameters by
   'breedingid=THE_ID_YOU_WROTE_DOWN'
   The URL should look like this:
   /cgi-bin/koha/authorities/authorities.pl?breedingid=198
   You should see no encoding issues. Do not save the record.
6. Import the batch into the catalog. Verify that the authority record
   has no encoding issue.
7. Now download the MARCXML for "Athènes (Grèce)"
   curl -o athènes.marcxml https://www.idref.fr/027290530.xml
8. Repeat steps 2 to 6 using athènes.marcxml file. At steps 4 and 5 you
   should see encoding issues and that the position 9 of the leader was
   rewritten from 'c' to 'a'. Strangely, importing this batch fix the
   encoding issue, but we still lose the information in position 09 of
   the leader

This patch makes use of the MARCXML representation of the record instead
of the ISO2709 representation, because, unlike
MARC::Record::new_from_usmarc, MARC::Record::new_from_xml allows us to
pass directly the encoding and the format, which prevents data to be
double encoded when position 09 of the leader is different that 'a'

Test plan:
- Follow the "steps to reproduce" above and verify that you have no
  encoding issues.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 01d78e1ec7)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 76e980bb1a)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 09:47:06 +02:00
Jonathan Druart 148086f7d6 Bug 29951: Fix EXPORT for C4::ClassS*Routine modules
Can't locate object method "subclasses" via package "C4::ClassSplitRoutine" at /kohadevbox/koha/C4/ClassSplitRoutine.pm line 53

Certainly from bug 17600.

Test plan:
Home -> Administration -> Classification sources -> New splitting rule

And create classification sources and filing rules.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 69513449db)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7f52fa4a73)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-16 15:00:35 +02:00
Kyle Hall b466dab6e2 Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )
There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-07-25 10:27:24 +02:00