Commit Graph

37388 Commits

Author SHA1 Message Date
Kyle M Hall 21f47a0dfd Bug 25903: Add unit tests
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 49f5200374)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 73c246238b)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:25:14 +12:00
Kyle M Hall a43ab3ca9b Bug 25903: Sending a SIP patron information request with a summary field flag in indexes 6-9 will crash server
The 'summary' field in the patron information request specifies if detail information should be send for holds,
overdues, fines, etc. The field is 10 characters in length (0-9). However, the SIP2 spec only defines indexes 0
though 5, leave 6 though 9 undefined. Some ILSs specify behavior for these undefined indexes. Apparently the
7th field is often used to request 'Fees', as opposed to 'Fines' in some ILS. Some software that integrate via
SIP try both the 5th and 7th indexes to ensure they get all fines and fees.

The problem is that Koha's SIP server crashes if any 'summary' index beyond 5 is flagged. We should simply
ignore flags beyond 5 and act as if no flags were sent.

Test Plan:
1) Enable SIP for your instance
2) Send a patron information request with a summary flag in any index beyond 5.
   i.e.: 6300120200617    124846      Y   AOMIDAY|AA21030050054321
3) Note the SIP server just closes the connection without a response
4) Apply this patch
5) Restart the SIP server
6) Send the same request
7) Note you get back the patron information response!

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jeff Gaines <jgaine@arlingtonva.us>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit fd4dbba7fb)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b870bac520)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:24:20 +12:00
Kyle M Hall a108d56f91 Bug 26076: (QA Follow up) Prevent error by using a fresh resultset
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c9887a8753)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3a4f76b60d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:21:57 +12:00
Kyle M Hall 6ccd2a55e1 Bug 26076: Sum the amount due in the database query instead of a loop in Perl
This appears to be a bug due to inaccuracies in floating point math. I've been unable to reproduce it on demand. Sometimes when using the "Write off selected" button, Koha will give the error that the payment is more than the amount owed, even though they are the same. The solution I've implemented is to move the summation from Perl code to the database query. This video demonstrates the issue and afterward, shows the error goes away after the patch is applied: https://monosnap.com/file/pG69HC7iI9mU9kkuoCtbkVzVTffKlE

Test Plan:
1) Apply this patch
2) Restart all the things!
3) Verify that "Write off selected" functions as usual

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6441296903)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2e3b3a23fc)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:21:45 +12:00
Jonathan Druart 2a48a23c42 Bug 26233: (bug 25553 follow-up) Make date columns sortable on the edit items table
We were missing to pass the title-string to datatables.

Test plan:
Retest bug 26233, with appropriate dates

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit df5c9d0725)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:04:59 +12:00
David Cook b98755e4c9 Bug 25778: Fix var scope in koha-plack for PERL5LIB and KOHA_HOME
Currently, if a koha-plack is given multiple instances, it will create
duplicate $KOHA_HOME/installer and $KOHA_HOME/installer/lib entries
in PERL5LIB as these changes are done at the global rather than local level.

This issue can only be seen in non-dev Koha, since dev Koha installs
rewrite PERL5LIB.

This patch localizes PERL5LIB to each instance.

To test dev installs:
0. cp debian/scripts/koha-plack /usr/sbin/koha-plack
1. koha-plack --restart kohadev
2. Note that nothing breaks

To test non-dev installs:
0. Don't replace /usr/sbin/koha-plack yet
1. Create multiple non-dev installs with plack enabled and running
2. Set up one of these non-dev installs so you can use the web
UI (that is beyong the scope of this test plan)
3. koha-plack --restart test1 test2 test3
4. For test3, go to /cgi-bin/koha/about.pl
5. Note that there are duplicate /usr/share/koha/installer
and /usr/share/koha/lib/installer entries in PERL5LIB
6. cp debian/scripts/koha-plack /usr/sbin/koha-plack
7. koha-plack --restart test1 test2 test3
8. For test3, go to /cgi-bin/koha/about.pl
9. Note that there are no duplicates entries in PERL5LIB

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 89721cb42b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 670193ad16)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 21:02:41 +12:00
Owen Leonard 760faa0a7a Bug 26213: Remove the use of jquery.checkboxes plugin when adding orders from MARC file
This patch removes the use of the jquery.checkboxes plugin from the page
for adding orders to a basket from a staged MARC file.

This patch fixes an unreported bug wherein the "select all" and "clear
all" controls affected not only MARC record checkboxes but also the
"show inactive funds" checkboxes.

To test, apply the patch and go to Acquisitions.

- Go to Vendor -> Add to basket -> From a staged file.
- Select a staged file with multiple records.
- Test the "Select all" and "Clear all" links at the top of the "Select
  to import" tab. They should work correctly to select and deselect
  checkboxes corresponding to staged MARC records.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8344ee7b4c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f681964591)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 20:56:26 +12:00
Jonathan Druart edb729421f Bug 25751: Add ORDERED in dropdown list of suggestion's statuses
The status "ORDERED" is missing from the pull down list of
status values when editing a suggestion, so the first
option is selected "No status".

This leads to data loss when editing a suggestion in the
status "ORDERED". Worse: the status can't be reset to
"ORDERED" and so no AVAILABLE notice can be sent to the patron.

Test plan:
- Create a suggestion, accept it, create a new order from this suggestion.
- Verify status is "ORDERED"
- Edit the suggestion
=> Without this patch the dropdown list does not have
   "Ordered", and if you save you lost the status
=> With this patch applied the dropdown list has "Ordered"
   preselected. You can save and preserve the status.

Signed-off-by: Holly Cooper <hc@interleaf.ie>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit eeb7ac6fc0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c320dfa3be)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:52:18 +12:00
Alex Buckley b1924d2127 Bug 25750: fix fallback to ecost_tax_included/ecost_tax_excluded
If 'Actual cost' has not been set then it has the value of 0.00 which
Perl evaluates to true so this patchset resets it to 0, so the fallback
to ecost_tax_included/ecost_tax_excluded happens.

Test plan:
1. Add item to acquisition basket (make sure the vendor has: tax rate: 15%, 'List prices: Include tax', 'Invoice prices: Include tax')
2. Set 'Vendor price' = 10 and do not set 'Actual cost'
3. Save order
4. Observe basket.pl shows 'Total tax exc.' has a value of 0.00 and GST
column has value of -8.70

5. Jump into the database:
select tax_value_on_ordering from aqorders where
ordernumber=<ordernumber>;
[You can get the ordernumber from clicking on the 'Modify' line the item
is listed in]
6. Observe a negative value: -8.70

7. Apply patch and restart plack
8. Add a second item to the basket
9. Set 'Vendor price' = 10 and don't set 'Actual cost'
10. Save order
11. Observe basket.pl shows 'Total tax exc' has value of 8.70 and GST
has value of 1.30
12. Repeat step 5 and observe tax_value_on_ordering = 1.30
13. Run t/Prices.t unit test:
sudo koha-shell <instancename>
prove t/Prices.t

Sponsored-by: Horowhenua District Council, NZ

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7b66b90fe7)
(cherry picked from commit 3bbf638449)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:41:25 +12:00
Jonathan Druart 104fba4bb0 Bug 26119: Enable patron's attribute edition when PatronSelfRegistrationVerifyByEmail
There is no good reason remove the ability to edit patron's attributes
if PatronSelfRegistrationVerifyByEmail is set.

We cannot have them in the self-registration form (because we don't
store patron's attributes during self-ref), but we can have them when
a patron show/edit their information.

Test plan:
0. Enable PatronSelfRegistrationVerifyByEmail and create patron's
attributes that can be edited at the OPAC
1. Create a new patron using the self-reg feature
=> You don't have the ability to fill in the patron's attribute
2. Edit your personal details (OPAC)
=> Without this patch you still don't see the patron's attribute that
can be edited at the OPAC
=> With this patch applied you can!
3. Notice the wording change on the "Modify patron attribute type" form
and confirm it makes sense

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit fc22fb308b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ae54212e7d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:32:25 +12:00
Tomas Cohen Arazi 518ea70806 Bug 26228: Update gulpfile to work with Node.js v12
This patch makes the gulpfile work with gulp v4 on Node v12. To test it,
make sure your dev env has Node.js v12.

It also replaces the use of 'gulp-util' (deprecated) by 'minimist' as
recommended on their site.

On both KTD and KohaDevBox edit your sources.list so the node line
points to 'node_12.x' instead of 'node_8.x'.

Once that's done:
1. On your clone run:
   $ yarn install
   $ npm install -E
2. Build the CSS:
   $ yarn build
   $ yarn build --view opac
=> SUCCESS: Things build correctly
3. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a7e3c12e61)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 65f443f22f)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:04:42 +12:00
Nick Clemens cf9d0e651b Bug 26078: (follow-up) Use a boolean rather than changing returnbranch
Bug 26078: (follow-up) used validTransfer instead of checking WrongTransfer message

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d8f3e0ec0d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0b444c4bc0)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:00:31 +12:00
Nick Clemens 1b2eedbea9 Bug 26078: Prevent generating a new transfer from return policy when resolving a transfer
To test:
- Have 2+ branches
- Set your default return policy to Item returns to issuing library
- Find an item with holding branch of Branch A
- Set your library to Branch B
- Check item in
- Koha generates a transfer to Branch A. In doing so, it sets the item holding branch to Branch B
- Set your library to Branch A
- Check item in
- Koha generate a transfer to Branch B. In doing so, it sets the item holding branch to Branch A
- Set you library to Branch A
- Check the item in
 . . . Repeat indefinitely.
 Apply patch
 Repeat
 No more loop

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4767112320)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8bd9c4b4fd)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 16:00:22 +12:00
Jonathan Druart 1e0c18d45e Bug 26090: Fix "item types" report
This report was broken with SQL strict mode, but also without.

DBD::mysql::st execute failed: 'koha_kohadev.itemtypes.itemtype' isn't
in GROUP BY [for Statement "

and, if no library was selected:

DBD::mysql::st execute failed: Unknown column 'biblioitems.itemtype' in
'field list' [for Statement "

This patch does the minimum to make it usable, but it would need more
love.

Test plan:
To test you will need to try the 4 combinaisons:
 item-level_itypes = item or biblio
 With or without a library selected in the dropdown list

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5bca73080f)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 69f16f7469)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-09 15:57:49 +12:00
Kyle M Hall 5646b2a6f7 Bug 25786: Holds Queue building may target the wrong item for item level requests that match holds queue priority
Bug 23934 removed the limitation that prevented item level holds from
getting local holds priority. The problem is the code has never checked
if the item level hold matches the given item! This means the wrong item
may be requested to fill an item level hold.

Test Plan:
1) Create 3 items on a record
2) Place a hold for the 2nd item you created
4) Ensure that hold would be picked up by local holds priority
5) Build the holds queue
6) Note the holds queue is asking for the wrong item!
7) Apply this patch
8) Rebuild the holds queue
9) Holds queue should now be asking for the correct item!

Signed-off-by: Kim Peine <kim@williston.lib.vt.us>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b17a04dd07)
(cherry picked from commit c6a1277fdb)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:56:59 +12:00
Kyle M Hall 85a648431b Bug 25783: Modify calls to AddReserve to match Koha 19.11.x AddReserve prototype
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:52:42 +12:00
Kyle M Hall b8de520952 Bug 25783: Holds Queue treating item-level holds as bib-level
The holds queue builder does not honor
the new item_level_hold flag. Instead, it only item_level_request if
in the loop dealing with item level holds. This is incorrect. Item level
holds may be trapped in the local holds priority loop as well. It's
trivial to just pass though the correct item/biblio level hold flag.

I do not know how to write a reproducable test plan for these issues.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kim Peine <kim@williston.lib.vt.us>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit db235d33a4)
(cherry picked from commit aa4eba6d23)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:50:24 +12:00
Tomas Cohen Arazi 97ba8f85d7 Bug 25783: Regression tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kim Peine <kim@williston.lib.vt.us>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit dd4970860d)
(cherry picked from commit ad6b6db41e)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:50:10 +12:00
Lucas Gass 9b3addb185 Bug 26361: switch TableSettings to ColumnSettings
Test Plan:
-Be on 20.05.x
-Go to returns.tt
-See the error Uncaught SyntaxError: expected expression, got keyword 'var'.
-Apply patch
-Reload returns.tt, no error

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2b6b7cb265)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 15:46:08 +12:00
Jonathan Druart fba279050a Bug 25005: (bug 22868 follow-up) Fix suggestions pending on main page
There is a "Suggestions pending approval" link on the main page that is
displayed if there are new suggestions and the logged in user has the
permission to manage them.

On bug bug 22868 the permission changed from
acquisition.suggestions_manage to suggestions.suggestions_manage

But in the template, one occurrence has not been replaced correctly
(certainly because it was already wrong actually).

Test plan:
Create a suggestion at the OPAC
Create a patron with the suggestions permission
Use this patron to login at the staff interface
=> Without this patch the link does not appear on the main page
=> With this patch applied the link appears

Signed-off-by: David Roberts <david@koha-ptfs.co.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-03 16:12:39 +12:00
Jonathan Druart 7a34b88885 Bug 26270: Fix ThingISBN after a change in behaviour
This is just a guess! One of our tests is failing since today and we
don't modify anything in this area.
My guess is that the service is now returning the normalized version of
the ISBN

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-02 10:29:14 +12:00
Nick Clemens 90fdf1fa07 Bug 26136: Prevent double submit on checkin-form
To test:
 1 - Browse to Circulation->Check-in
 2 - Type a barcode into the Check in box
 3 - Hit Enter as many as times as you can
 4 - Check the statistics table:
    SELECT * FROM statistics WHERE itemnumber={itemnumber} AND DATE(datetime)=CURDATE();
 5 - Note you have multiple lines for the same item at the same time
 6 - Apply patch
 7 - Reload the page
 8 - Type the barcode
 9 - Press Enter even more fast and more furiously
10 - Check the statistics table
11 - Only one entry, huzzah!

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 44f54aac60)
(cherry picked from commit 9d85636bf0)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-09-02 10:25:44 +12:00
Aleisha Amohia d3b130d1ab Update release notes for 19.11.09 release
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 09:16:44 +12:00
Aleisha Amohia b98ca4bf46 Merge branch 'new/security-release-19.11.09' into 19.11.x
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 07:11:07 +12:00
Jonathan Druart 6b6f60056a Bug 24663: [19.11.x] Handle special cases for recovery password and selfreg
The password recovery and self-registration features need to be
accessible at the OPAC even if not public.

Test plan:
Self register a new account, then ask for a new password with OpacPublic
turned off

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:45:55 +12:00
Jonathan Druart ad45228921 Bug 24663: [19.11.x] Force authentication in svc/records/preview (?)
Was this wrong?

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:45:52 +12:00
Jonathan Druart d4fb79a97d Bug 24663: [19.11.x] Force auth in adveditorshortcuts.pl
This was wrong!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:45:49 +12:00
Jonathan Druart bbb16926c2 Bug 24663: [19.11.x] Remove authnotrequired if set to 0
It defaults to 0 in get_template_and_user

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:45:46 +12:00
Jonathan Druart fb7ce18b92 Bug 24663: [19.11.x] Test OpacPublic for all OPAC scripts
Prior to this patchset there were 3 different calls to
get_template_and_user (or checkauth) with the authnotrequired param:
 * authnotrequired => 0
 * authnotrequired => 1
 * authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 )

The first one says that an unauthenticated user can access the page, the
second that the user has to be authenticated, and the last one that it
depends on the OpacPublic syspref.
Actually we must replace the first one with the third one, if the OPAC
is not public, the authentication must be forced.

To do so we are going to remove the "authnotrequired => 0" occurrences,
and check the OpacPublic syspref's value in C4::Auth

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:44:56 +12:00
Marcel de Rooy c37c0fba96 Bug 25360: (follow-up) Remove the https FIXME in Auth.pm
The FIXME is no longer valid since we fixed the X-Forwarded headers
for Plack. And since we do not even use using_https anymore in
the templates (see bug 21094).

Test plan:
Run Auth.t
Git grep for using_https

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:41:52 +12:00
David Cook 2e544f127c Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS
This patch adds the secure flag to the CGISESSID cookie when using HTTPS.
This prevents the cookie being used again over a normal HTTP
request.

Bug 25360: [Follow-up] Test for "on" or "ON" value for HTTPS env var

This patch tests for HTTPS "on" or "ON" before setting the secure
cookie.

Bug 25360: [Follow-up] Fix typo in C4/InstallAuth.pm

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Amended number of tests in Context.t
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:41:41 +12:00
Tomas Cohen Arazi cd8ecbfed0 Bug 23634: (QA follow-up) Our PUT is really a PATCH
This patch makes the controller not expect that there will always be all
the email fields. So it now checks if an email field was passed, and
changed, and renders the error if that stands.

To test:
1. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: Tests written by Nick highlight a problem
2. Apply this patch
3. Repeat 1
=> SUCCESS: Problems solved
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:36:33 +12:00
Nick Clemens a6d5004569 Bug 23634: (QA follow-up) Adjust tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:36:30 +12:00
Martin Renvoize ccd95fdb45 Bug 23634: (QA follow-up) Catch all email cases in API
The API was only catching the primary email change case, but we need to
catch email, emailpro and B_email.

We were also not accounting for any of the emails (on PUT or from the
DB) being undefined.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:36:27 +12:00
Martin Renvoize d867d1b8dd Bug 23634: (follow-up) Prevent updates on POST
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:36:16 +12:00
Tomas Cohen Arazi f0276149f4 Bug 23634: Secure the email on the API
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:34:36 +12:00
Martin Renvoize 813a45767d Bug 23634: Prevent non-superlibrarians from editing superlibarian emails
This patchset prevents a non-superlibrarian user from editing a
superlibrarians email address via memberentry.  This is to prevent a
privilege escalation vulnerability whereby a user could update a
superlibrarians contact details to match their own and then request a
password reset via the OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:34:25 +12:00
Tomas Cohen Arazi 6b9e3dfae1 Bug 23634: Add tests for is_superlibrarian
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:30:10 +12:00
Martin Renvoize b8329f7da7 Bug 23634: Add is_superlibrarian method to Koha::Patron
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 15:29:37 +12:00
Aleisha Amohia b06292b883 Increment version for 19.11.09 release
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 09:52:50 +12:00
Aleisha Amohia 808c6264c6 Fixing po files for 19.11.09
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-25 09:39:58 +12:00
Koha translators a320e96ab7 Translation updates for Koha 19.11.09
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-24 18:26:37 -03:00
Jonathan Druart 9c7069aab8 Bug 25641: [19.11.x] Fix XSLT_Handler.t failures on U20
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-18 02:16:37 +12:00
Jonathan Druart 8d1e45727b Bug 26162: [19.11] Fix DT info label
There is an inconsistency in 19.11:
% grep Showing koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc koha-tmpl/intranet-tmpl/prog/js/datatables.js
koha-tmpl/intranet-tmpl/prog/en/includes/datatables.inc:    var MSG_DT_INFO = _("Showing _START_ to _END_ of _TOTAL_");
koha-tmpl/intranet-tmpl/prog/js/datatables.js:        "sInfo"             : window.MSG_DT_INFO || "Showing _START_ to _END_ of _TOTAL_ entries",

The "entries" is not always displayed.

datatables.inc has been removed from 20.05 by
Bug 24662: Remove global variables MSG_* from datatables.inc

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:52:12 +12:00
Jonathan Druart 73f3a843fc Bug 26162: Don't fall into an infinite loop
If something went wrong we do want to stop the script!

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:52:09 +12:00
Nick Clemens 1d9737486c Bug 26000: Make exception_holidays cache with branch in key
In light of 25723 offering a simpler solution here.
This would just let us avoid backporting larger changes, but this can be
marked as a duplicate if 25723 is preferred to this change

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:32:57 +12:00
Nick Clemens 45f3645aeb Bug 26000: Unit test
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-19 17:32:53 +12:00
Jonathan Druart 1c1c97d7ca Bug 26012: Correctly format "paid for" info on the item details view
The string is built controller side, which does not let the template
format the info nicely.
We want to display patron's info using patron-title.inc and the date
with the KohaDates plugin

Test plan:
- Make sure there is a replacement cost in the item
- check it out
- Mark it lost
- Pay the lost item fee
- Go to the detail page and look on the items tab for the item
- It will show an entry with "Paid for?" label
The patron's info and date must be correctly formatted

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ed4fc58894)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f16934384e)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-17 22:11:27 +12:00
Jonathan Druart 9b21b01670 Bug 26165: Fix duplication of large saved reports
If the combined character length of a saved report's
title, notes and SQL is too long then pressing the
'duplicate' button will lead to an error:

"Request-URI Too Long
The requested URL's length exceeds the capacity limit
for this server."

Test plan:
1. Create a simple SQL report and add a lot of text
   into the notes field (the combined URL lenth must be
   >8225 characters)
2. Save the report
3. Press the duplicate the report from the saved reports page

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 81f06881a4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 50cbaa3262)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-17 22:01:00 +12:00
Fridolin Somers 7494cea82f Bug 23542: Fix SRU import encoding
When importing records from a SRU server, the diacritics have bad encoding.
I reproduce with BNF server so it may be a UNIMARC issue.

Tests show that difference between Z39.50 server and SRU is that leader contains 'a' at postion 9.
Looking at MARC::Record->encoding() shows that encoding depends on leader even for UNIMARC.
So this patch adds a call to MARC::Record->encoding('UTF-8') in case of a SRU server in C4::Breeding.

Same use exists in Koha::MetadataRecord::Authority::get_from_breeding().

In case of import via Z3950, MarcToUTF8Record() is called,
 which calls SetMarcUnicodeFlag(),
 which calls MARC::Record->encoding('UTF-8')

Test plan :
1) Use a UNIMARC database
2) Configure a connexion to a UNIMARC SRU, for example BNF,
   see https://doc.biblibre.com/koha/autour_de_koha/serveurs_z3950_sru#serveur_de_la_bnf
3) Go to cataloguing module
4) Click on 'New from Z39.50/SRU'
5) Choose only the SRU target
6) Search for ISBN 2266072889
7) Confirm you see good encoding : diacritic on 'a' of title 'Strate-a-gemmes'
8) Click on 'Marc preview'
9) Confirm you see good encoding
10) Click import
11) Confirm you see good encoding
12) Check also Authorities import via SRU
13) Check also SRU imports on a MARC21 database

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Amended: Removed change to new_from_xml call. We should respect syntax.
But the added MARC::Record encoding does the tric! Which is implicit
for Z3950 targets where MarcToUTF8Record does the same.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 19d9ba176d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 79855e9f5b)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
2020-08-17 21:53:46 +12:00