At the OPAC, the AutoLocation feature should not be taken into account:
login to the OPAC from outside the IP range should work
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
`git grep ManualLocation` does not return any results
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Those 2 prefs can be independent and it does not make sense to consider
AutoLocation only if IndependentBranches is set.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
The example in branches.tt is:
Can be entered as a single IP, or a subnet such as 192.168.1.*
But actually the regex in C4::Auth does not handle subnets.
Test plan:
0/ Apply all the patches
1/ Switch AutoLocation on
2/ Define a subnet (192.168.0.* if your ip is like 192.168.0.X) in the IP
range of your library
3/ Log in on the staff interface
=> Should work
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
If an attacker can get an authenticated Koha user to visit their page
with the url below, privilege escalation is possible
The exploit can be simulated triggering
/cgi-bin/koha/members/member-flags.pl?member=42&newflags=1&flag=superlibrarian
Test plan:
Trigger the url above
=> Without this patch, 42 is now superlibrarian
=> With this patch, you will get the "Wrong CSRF token" error.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0c3c162f76)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To recreate:
/cgi-bin/koha/serials/claims.pl?serialid=1)and%20(select*from(select(sleep(20)))a)--%20&letter_code=0
Notice the delay.
The SQL query is not constructed correctly, placeholders must be used.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
See bug 15809 for more references.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit cb4fa17a27)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
It has been reported that
/cgi-bin/koha/opac-shelves.pl?op=edit&referer=view&shelfnumber=146&owner=4&shelfname=testX&sortfield=titleaaaaaa\`&category=1
Could lead to SQL injection
Actually it explodes because the generated SQL query is not correctly formated.
However it would be good to limit the possible values for sortfield.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 45cffd874c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 42460b8714)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To recreate:
/cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20
Look at the Profile dropdown list.
To fix this problem and to make sure it does not appears anywhere else
in the label and patroncards modules, I have refactored the way the
queries are built in C4::Creators::Lib
Now all of the subroutine takes a hashref in parameters with a 'fields'
and 'filters' parameters.
From these 2 parameters the new internal subroutine _build_query will
build the query and use placeholders.
Test plan:
1/ Make sure you do not recreate the vulnerability with this patch
applied.
2/ With decent data in the labels and patroncards modules, compare all
the different view (undef the New and Manage button groups) with and
without this patch applied.
=> You should not see any differences.
This vulnerability has been reported by MDSec.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a70980d825)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The code is duplicated, variable are not set ($_), code is hard to read,
not covered by tests and the subroutine has 2 completely different
behaviors depending on the presence of the "module" parameter.
No need more ti rewrite it.
Test plan:
- Use koha_perl_deps.pl with the different options (-u -m -a -i)
- Go on the about page, "Perl modules" tab
You should not see any differences from before and after this patch
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
It looks like I made a copy/paste error in a previous patch.
While the fix was working when you pass the param "module" to
version_info, it wasn't populating the version correctly
for the "all" param, which causes koha_perl_deps.pl to
think all OK modules actually need an upgrade.
TEST PLAN
0) Be on a system where you know your Koha Perl dependencies are
mostly up-to-date
1) Run ./koha_perl_deps.pl -a -c
2) Note that most modules say they need an upgrade even when
the installed version is the same as the minimum version
3) Apply patch
4) Run ./koha_perl_deps.pl -a -c
5) Note that most moduls say they're OK, especially when the
installed version is the same or greater than the minimum version
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Running koha_perl_deps.pl -u convinced me.
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Mason James <mtj@kohaaloha.com>
to test patch...
1/ set date between 00:00 and 00:59
$ sudo date -s 'Sun Jan 29 00:41:55 NZDT 2017'
2/ run prove, see fail
$ prove -v t/db_dependent/Members/IssueSlip.t
...
t/db_dependent/Members/IssueSlip.t (Wstat: 65280 Tests: 1 Failed: 0)
Result: FAIL
3/ apply patch
4/ run prove, see pass
$ prove -v t/db_dependent/Members/IssueSlip.t
...
All tests successful.
Result: PASS
Bug 12775 added a link "Show only mine" in newordersuggestion.pl.
This does not work, no results.
Also corrects the fact that click must not do default action by adding e.preventDefault().
Test plan :
- You must have suggestions you have accepted
- Create a new order from suggestion : /cgi-bin/koha/acqui/newordersuggestion.pl
- Click on Show only mine
=> Without patch the table is empty showing "No matching records found"
=> With patch you see only suggestions you have accpeted
Signed-off-by: Zoe Schoeler <crazy.mental.onion@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1104e61635)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The directory it attempts to create an xml file may not be writable for
the user running the test. By changing the directory from the current
directory to a temporary one, the test runs. After all 'chmod 777
t/db_dependent' is a bad idea.
TEST PLAN
---------
1) sudo koha-shell "prove t/db_dependent/Sitemapper.t" kohadev
-- fails
2) apply patch
3) sudo koha-shell "prove t/db_dependent/Sitemapper.t" kohadev
-- succeeds
4) run koha qa test tools
Tested without qa tools
Signed-off-by: Claire Gravely <claire_gravely@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7401d9422b)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
The original behavior is broken, see https://stackoverflow.com/questions/21410484/jquery-selector-to-find-out-count-of-non-empty-inputs
Test plan:
Edit a circ rule
=> Without this patch you get a useless message
=> With this patch, no message
Edit a circ rule with content in inputs
=> With or without this patch you get a useful message
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5a9ffa92ce)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
UNIMARC inserts field 100. This interferes the field count and order
in the test.
Note: This is a quick fix. Will polish it after bug 17913.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
EDIT:
Adjusted three small typos that did not disturb the test in its current
form, but do when we are fixing bugs on bug 17913.
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
No spectacular things:
[1] Move the framework modifications to a sub. Use same style to create auth types and linked fields.
[2] Change some new Object occurrences to Object->new.
[3] Add tests for field count and field order in the first two subsets.
[4] Few whitespace changes (sorry) and comment lines.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Originally aimed for bug 9988. Adjusted in line with other subtests.
Will polish the three subtests a little more on a follow-up.
Test plan:
Run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Based on original patch from Maxime Beaulieu on bug 11315.
Amended by Marcel de Rooy on report 17909.
EDIT:
Original tests have been adjusted in view of:
[1] Test on bug 11315 heavily leaned on DBD::Mock. Since we are
using Test::DBIx::Class on such tests now, this would need attention.
Moreover, the advantage of mocking the database in this case is at
least arguable.
[2] Matching the first (somewhat older) subtest of 11700.
[3] Simplification and readability.
Look e.g. at the use of $MARCto and $MARCfrom on 11315.
This made me merge them in the db_dependent counterpart.
Also note that this subtest adds another needed test case: the merge from
auth1 to modified auth1, while 11700 tested auth1 to auth2.
Test plan:
Just run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Original patch from Julian Maurice on bug 11700.
With sign offs by:
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Amended by Marcel de Rooy on report 17909.
EDIT (January 2017):
Removed some tests not related to merge.
Put remaining tests in a subtest, made them working on current merge.
Slightly revised the mocking.
Note: I plan to move the zebra retrieval stuff outside merge in one of
the next stages, and replace it by calling Koha::SearchEngine. This will
reduce mocking complexity here.
Test plan:
Just run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
It looks like I made a copy/paste error in a previous patch.
While the fix was working when you pass the param "module" to
version_info, it wasn't populating the version correctly
for the "all" param, which causes koha_perl_deps.pl to
think all OK modules actually need an upgrade.
TEST PLAN
0) Be on a system where you know your Koha Perl dependencies are
mostly up-to-date
1) Run ./koha_perl_deps.pl -a -c
2) Note that most modules say they need an upgrade even when
the installed version is the same as the minimum version
3) Apply patch
4) Run ./koha_perl_deps.pl -a -c
5) Note that most moduls say they're OK, especially when the
installed version is the same or greater than the minimum version
https://bugs.koha-community.org/show_bug.cgi?id=17880https://bugs.koha-community.org/show_bug.cgi?id=17986
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b732963e2f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 2321ae0d79)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
EDIT (from Marcel):
Previous patch fixes issue caused by Search.t.
This patch still adds some small changes to check_sysprefs.t.
Signed-off-by: Grace McKenzie <grace.mcky@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
The config tweaks from Search.t break check_sysprefs.t later on.
Clearing the cache resolves that.
Test plan:
[1] Run prove t/db_dependent/Search.t t/db_dependent/check_sysprefs.t (in
one statement) before and after applying this patch.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
A prove t/db_dependent did not fail check_sysprefs.t (only skipping two
tests: 00-strict.t and Koha/IssuingRules.t; not enough patience)
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Oliver Bock <oliver.bock@aei.mpg.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
Add fr-CA installer to xt/sample_letter.t
To test:
- Verify xt/sample_letter.t test checks fr-CA now and
fails for just fr-CA.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Caitlin Goodger <caitlingoodger.student@wegc.school.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 3c09fefb1d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Test Plan
1: Add something inside c and h of 245 on a Bibliographic Record. There won't be a space between
the c and h
2: This will occur on both the search results and the details pages of
the record in both the intranet and opac.
3: Apply the patch
4: Refresh and see that there is now a space between c and h.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 8fcfdf6853)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Change to Modern::Perl.
Remove null_to_zzempty and add a few blank lines between subs.
Remove unused vars: $podsp, $type, $daysel, $monthsel and $mime.
Removing trailing 1;
Test plan:
Run a few reports from reports/reserves_stats.pl
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Emma Smith <emma.nakamura.smith@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Wrongly pasted from reports/issues_stats.pl initially
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 639489f48f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To test:
- Set OpacResetPassword = allowed
- Make sure you have a user with a username and email
- Go to the OPAC and make sure you are not logged in
- Click on the "Forgot your password?" link
- Fill in "Login" and "Email" and click on "Submit"
- You will get an error that says:
Undefined subroutine &C4::Letters::GetPreparedLetter called at
/home/vagrant/kohaclone/Koha/Patron/Password/Recovery.pm line 142.
- Apply the patch
- The steps above will have added your user to the borrower_password_recovery
table in the database. Delete it from there to make sure you start a
fresh reset request.
- Repeat the steps above and notice that the error is gone. You should
get a nice message instead that says "An email has been sent to [your
email]".
- Sign off
Signed-off-by: Zoe Schoeler <crazy.mental.onion@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b43b79156f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
If the temporary upload folder exists, it should be discarded when
removing an instance. If we do not, it may/will create problems when
recreating the same instance.
A function in koha-functions.sh is added to determine the temp directory
instead of hardcoding /tmp.
Test plan:
[1] Copy koha-functions.sh to /usr/share/koha/bin
[2] Run koha-create --create-db newinstancexx
[3] Run mkdir /tmp/koha_newinstancexx_upload (if /tmp is your temp!)
[4] Run debian/scripts/koha-remove newinstancexx
Do not run the regular one, but verify that you use the updated one.
[5] Check that /tmp/koha_newinstancexx_upload is gone.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Karen Jen <karenliang.student@wegc.school.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 2c40579077)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Bug 10459 has been backported and the DB entry (add borrowers.updated_on and
deletedborrower.updated_on) is now played in
- 16.06.00.027
- 16.05.00.002
- 3.22.08.001
This will raise a MySQL warning if the column already exists.
DBD::mysql::db do failed: Duplicate column name 'updated_on'
Since bug 17234 we have now a subroutine (C4::Installer::column_exists) to test
if a column exists.
When a DB entry modifying the DB structure is backported, it HAS TO check if the
column, constraint or table exists before executing the query.
Test plan:
git checkout 3.22.x (16.05.x or 16.11.x)
install Koha
git checkout master
execute the installer
=> Without this patch you will get a warning when adding borrowers.updated_on)
=> With this patch, you should not get it
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 2b303129b8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
This patch changes the code to use the filename of the uploaded image if
no specific image name is entered.
To test:
1) Go to Tools -> Patron card creator -> Manage images
2) Upload an image and leave the image name field empty
3) Notice this works and 'Name' is left empty.
4) Apply patch and refresh page
5) Upload an image and leave the image name field empty
6) Notice the image name is given the filename so that 'Name' is no
longer empty.
Sponsored-by: Catalyst IT
Signed-off-by: Claire Gravely <claire_gravely@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d3752c85dc)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
To reproduce:
admin-menu
1) Go to a page like admin/categories.pl
2) Click New Category
3) Notice Patron categories in the sidebar menu is no longer bold
tools-menu
4) Go to a page like reviews/reviewswaiting.pl
5) Notice bold Comments in sidebar menu
6) Click Approved Comments tab
7) Notice no longer bold in sidebar menu
To test:
8) Apply patch and refresh page
9) Follow above steps to reproduce bug, confirm that active links are
always bold
10) Test with other links to confirm nothing has broken
Special cases
11) Go To admin -> MARC bibliographic frameworks -> Actions for any
framework -> MARC structure
12) Confirm sidebar menu link is still bold
13) Go to admin -> Authority types -> Actions for any auth type -> MARC
structure
14) Confirm sidebar menu link is still bold
15) Click Actions for any tag -> Subfields
16) Confirm sidebar menu link is still bold
17) Go to admin -> OAI sets config -> Actions for any set -> Define
mappings
18) Confirm sidebar menu link is still bold
Sponsored-by: Catalyst IT
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit bee87e4f61)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Jonathan Druart
David Cook
Mason James
Fridolin Somers
Mark Tompsett
Julian Maurice
Marcel de Rooy
Josef Moravec
mbeaulieu
Alex Arnaud
Katrin Fischer
Caitlin Goodger
Magnus Enger
Aleisha Amohia