The PO files are not sorted when we update them which leads to
unnecessary changes that are commited: hard to see differences and
make git index grow superfluously.
Test plan:
0. Do not apply this patch
1. gulp po:update --lang es-ES
2. git commit -a -m"First PO update"
3. Run again the gulp update command
4. git diff
=> You have a lot of changes generated here, the po:update is not
idempotent.
5. Apply this patch
6. Run the gulp update command
7 git commit -a -m"PO update after 34959"
8. Run the gulp update command
9. git diff
=> No changes are generated
Note that this patch will all the entries by files, and per line
numbers.
It fixes a bug in some condition, where we add information/context about
the string. For instance search for "For the first occurrence" in the
file. Prior to this patch this was not correct, we didn't add info about
the first occurrence (but whichever in the list).
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Nothing special here, this sub is not used and we can remove it.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch fixes record matching for authorities to correctly apply required match checks.
To test:
1) Create a record matching rule:
Threshold: 100
Record type: Authority record
Match point 1
Search index: subject-topical
Score: 100
Tag: 150
Subfields: a
Match check 1
Both source and target record check fields:
Tag: 040
Subfields: a
This rule says we want to match on the topical term heading, then confirm the match with 040$a.
2) Create two topical term authority records
Authority 1:
150$a: Test
040$a: A
Authority 2:
150$a: Test
040$a: B
3) Export authority 2 and save
4) Go to Cataloging -> Stage records for import
5) Upload your downloaded authority 2 file. Change the record type to Authority. Choose your new record matching rule.
6) Stage for import.
7) Confirm that with the record matching rule applied, both authorities 1 and 2 show as possible matches, even though only authority 2 has a matching 040$a.
8) Apply the patch and restart services
9) Change the matching rule to "Do not look for matching records" and apply. This is to essentially refresh the page.
10) Change the matching rule to your new matching rule and apply. Confirm only the matching authority 2 shows and is selected.
Sponsored-by: Waikato Institute of Technology
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 33856898fd)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 11bce8210a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
Run t/db_dependent/Breeding.t
Run t/db_dependent/Breeding_Auth.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Amended patch: perltidy
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e9cab7f1fc)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fdcb386548)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit a9b50d6b57)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The array serverhost is not filled. Should be replaced with values
from servers array.
Test plan:
Nothing exciting here. Read the patch.
Note that we will test in the next patch if the hostname is saved
correctly in the import batch.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit eb75971990)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit ba442b1a3b)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 9b7218373a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
[1] If you have access to a Z3950 MARC8 auth server, search
for an authority record and import it.
[2] If you have access to a Z3950 UTF8 auth server, search
for an authority record and import it.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 1233480ffa)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 52a243e3ca)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit d25ad4d949)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 32412 added an additional "context" parameter to KOHA.coce.getURL.
The code which pulls a Coce image for the "main" cover image slider
needs to include the correct context parameter for the images to load.
This patch also makes a minor correction to CSS in order to make the
cover image slider "dots" change color to highlight the current slide.
To test, apply the patch and rebuild the OPAC CSS.
- Enable multiple cover image sources in the OPAC including Coce, e.g.
Amazon, Google, OpenLibrary, etc.
- Search for a title which will match multiple cover image sources. In
the sample data a search for "Perl" will return good results.
- Note the number of cover images loading for a title in the search
results.
- View the detail page for that title. There should be the same number
of covers in the cover image slider.
- Clicking the slider navigation dots should work to show each image,
and the dot should change color to highlight the current image.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d313f9b963)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4125aec704)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit fc3fde11d4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It's removed from coce.js
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit aa8dc28e97)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 6cef886164)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit be76f596a6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds the requirements that updating a system preference
requires a CSRF token. (Also, adding and deleting local system preferences.)
0. Apply patch
1. koha-plack --reload kohadev
2. Add local system preference
3. Update local system preference
4. Delete local system preference
5. Update normal system preference
6. Note no errors
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change validates and escapes inputs for task scheduler.
Test plan:
0. Apply patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/tools/scheduler.pl
3. Input a time a minute in the future and leave the date blank
4. Choose an existing report and output format
5. Type a malicious string which is also a valid email address
into the Email field
6. Click "Save"
7. Note that the job is added but the Email is wrapped in single
quotes
8. Try using a non-malicious email address with a single quote.
9. Note that the single quote is escaped, so that it will still
be used by runreport.pl
JD amended patch: tidy
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Removed pars for $email =~ regex, removed old commented lines.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch sets the $auth_state to failed when changing auth sessions,
so that the new login attempt gets processed correctly (instead
of skipping the authorization step).
Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=baseurl
3. Log in as an OPAC user with 0 permissions
4. Note the auth screen "Error: You do not have permission to access this page"
5. Click "Log in"
6. Note that you're still shown a login screen (and that you've been logged out of
your previous authenticated session)
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
44 'c|confirm' => \$confirm,
46 'm|matchpoint=s' => \$matchpoint,
The POD is wrong.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2442a4537d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 5fcaf0aa09)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit 54b530e351)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Found while running Items.t on top of 33608.
Another exception was thrown but not rethrown.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fa9750e24d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 2b1b8884cc)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit b431cd1d14)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
to test...
1/ run command
$ sudo koha-passwd dev1
Password for dev1: CraZyPa$$WoRD!!
Press enter to clear the screen...
^C
2/ apply patch
3/ run command again, note 'username' section
$ sudo koha-passwd dev1
Username for dev1: koha_dev1 <<<<<<<<<<<<
Password for dev1: CraZyPa$$WoRD!!
Press enter to clear the screen...
^C
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 4ce7f8c493)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ba51185fbd)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit 3ab7309e67)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When creating a circ rule, we can set overduefinescap to blank or 0 and no cap is enforced. If we edit that rule, the blank/0 is converted to "0.00" which perl considers true, thus zero-ing out any calculated fine.
Considering we've always ignored an overdue fines cap of 0, we should also ignore 0.00. However, perl is evaluating it as a string which makes it true instead of false as 0 is.
Test Plan:
1) Apply the first patch ( unit tests )
2) prove t/db_dependent/Circulation/CalcFine.t
3) Note the test fails
4) Apply the second patch as well
5) prove t/db_dependent/Circulation/CalcFine.t
6) Note the test passes
Test Plan 2:
1) Create an all/all/all rule with an overduefinescap of 0.00, with a
daily fine. Enable CalculateFinesOnReturn
2) Backdate a checkout so it is overdue
3) Return this item, note the lack of a fine
4) Apply this patch set
5) Backdate a checkout and return it again
6) Note the fine is generated!
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 1763b136d1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 662da18be2)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit 7cb0a706cc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8096ec9fff)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3e360c5637)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit 0860515897)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch carries this fix into the misc/cronjobs/recalls/expire_recalls.pl cronjob so that recalls are automatically expired when they have been waiting a problematic number of days, not considering hours, as expected.
To test, follow the test plan from the first patch. This will set you up with a waiting problematic recall.
Run the cronjob manually
perl misc/cronjobs/recalls/expire_recalls.pl
Refresh your 'Recalls awaiting pickup' page. Your problematic recall should be gone/expired.
Expiration dates will apply when expiring any 'unfulfilled' recall i.e. newly requested, overdue to be returned, and awaiting pickup.
Sponsored-by: Auckland University of Technology
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0d2052088e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3a5f4d1701)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit 4afe2a2b0a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
Run t/00-testcritic.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
JD amended patch: tidy
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2bc251cfdd)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 835bc43d31)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit f26621c8c4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
A misunderstanding of the intention of some dead code that probably wanted
to set biblio.series (which doesn't exist) left us setting biblio.serial
if biblio.seriestitle was set. The only thing series and serial have in
common is the first four letters. We shouldn't set serial on something
with a series (unless someone also sets serial on it, of course).
Test plan:
1. Administration - MARC bibliographic framework - Actions button next to
Default framework - MARC structure
2. In the Search for tag input type 942 and click search
3. Actions button next to 942 - Edit subfields
4. Tab s - check the checkbox for Editor, uncheck the checkbox for
Collapsed - Save changes
5. Cataloging - New record
6. Click in the input for 000 and hold down Tab until you get past 008
to fill in mandatory default values, then type any character in 040
subfield c
7. Tab 2 - In 245 subfield a type Series not serial
8. Tab 4 - In 490 subfield a type any character
9. Tab 9 - Set the value of subfield c to Books
10. Click save and leave the tab open to keep the biblionumber
11. Cataloging - New record - repeat step 6
12. Tab 2 - In 245 subfield a type Serial not series
13. Tab 9 - Set the value of subfield c to Books - Type 1 in subfield s
14. Click save, the biblionumber should be one higher than the first one
15. Reports - Create from SQL
16. Type something in Report name, paste in the SQL
SELECT biblio.serial, biblio.seriestitle, biblio.title FROM biblio WHERE
biblionumber IN ("","")
and put your first biblionumber in the first "", your second in the
second.
17. Save report - Run report
18. Series not serial should have a blank in the serial column and the
character you typed in the seriestitle column; Serial not series
should have a 1 in the serial column and a blank in the seriestitle
column.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 65b7c67319)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a25c9e637b)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit fe01585fcb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Currently when editing a suggestion, the document type will preselect to the
first entry as we don't have an empty entry.
This can lead to data errors easily.
Test plan:
Create a new suggestion
=> Notice that "document type" is empty by default, pick one
Edit it again
=> Notice that the value is kept and empty can be picked, pick empty
Edit again
=> Empty is selected and saved in DB
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6485f244e0)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit cb07de6a98)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 339e7adfbc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The dropdowns have different hints after bug 22802. We need to preserve those when adding
or hiding inactive budgets
To test:
1 - Add some inactive budgets to Koha
2 - Use the settings and file from bug 22802 to stage a file and begin adding to basket
3 - When adding to basket test the 'Show inactive funds' on both the 'Select to import' tab and the 'Default accounting details' tab
4 - Ensure the dropdown hints/defaults don't change when hiding/showing budgets
5 - Confirm inactive budgets are correctly shown/hidden
Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 80eb5ac35b)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a2a8cb86b0)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 2ee83ca00a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
Run prove again. Run qa tools.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c0f2a47d3c)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8ecb70b338)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 08741b6426)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The old t tests become part of the first subtest.
Test plan:
Run the new t/db_dependent/Calendar.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2eb6c36c4d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6052f0ec17)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 419d3ca563)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Update test while removing need for Test::DBIx::Class.
Test plan:
Run t/Calendar.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6e736a5d5f)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d77d59fcaa)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 06a85cc894)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Two occurrences.
Just comments.
Test plan:
Read the patch.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 308d75d05d)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit ef77656e85)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit d2498373a6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1. Find a record with several items (in ktd "MacLaren's Gaelic
self-taught" will do nicely
2. Click the Edit button next to one of the items
3. Click the "..." to the right of "d - Date acquired" and verify that the
page doesn't scroll up to the top, and that the current date is
inserted in the field
4. Click the "..." to the right of "w - Price effective from" and verify
that the page doesn't scroll up and the current date is inserted
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3824547e5c)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2d24f269f5)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 9fef2b809d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds an aria-label and an aria-haspopup to Download buttons
identified as non-descriptive in accessibility testing
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8fac9067b2)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit eba9d13660)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 1e621efd8c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.
For example, using the demo instance:
1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22
2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).
3. Click any result.
Note that the result page now contains:
<a href="opac-search.pl?idx=&q=test&weight_search=1&">test<a foo=%22" title="...
i.e. `">test<a ...` was successfully injected into the HTML.
I'm attaching a quick patch I've used to patch up our instance. It just indiscriminately URI-escapes all parameter keys. I didn't decode them back since as far as I understand all valid keys do not contain special characters.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Test plan would have been nioe.
Tested by changing MAX_AGE with suggestions.
Bug 22990: Fix for shelves table
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 22990: Fix template toolkit syntax issues in shelves_results.tt
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 22990: (follow-up) Fix suggestion.pl
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Split out from bug 22990 as requested.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 30524: Add xt/find-missing-csrf.t
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 30524: (QA follow-up) Polishing xt script
Test plan:
Run it again. Same results?
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 30524: Unit tests
Test plan:
Run t/Output.t
Run t/db_dependent/Auth.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch corrects a typo in the output of
search_for_data_inconsistencies.pl when a bibliographic record has no
title.
The patch also replaces biblio to bibliographic record in the same
sentence for terminology consistency.
To test:
- Have a bibliographic record without a title
- Run misc/maintenance/search_for_data_inconsistencies.pl
- Read output, make sure the sentence is correct
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 27a086b91e)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
(cherry picked from commit ed32f9812d7ddebc862360662772505cffbb1aa8)
(cherry picked from commit d54de73bff)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Just send the codes and descriptions only to client.
Adding a few comments to the reduce construction.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 020bc275b0)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 7eabf447d1)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 706cd01ba2)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 04ce17dde5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Jonathan Druart
Aleisha Amohia
Marcel de Rooy
Owen Leonard
Lucas Gass
David Cook
Nick Clemens
Koha translators
Mason James
Kyle M Hall
Phil Ringnalda
Matt Blenkinsop
Tomas Cohen Arazi
Michał Górny
Amit Gupta
Martin Renvoize
Caroline Cyr La Rose