If RealTimeHoldsQueue is on, touch_all_biblios triggers a update_holds_queue_for_biblios background job for each affected record. This will result in a as many background jobs being queued up as records! It makes far more sense for this script to not do that which gives the administrator the option for running the holds queue builder if the changes would affect holdability, or to not run it at all.
Test Plan:
1) Run touch_all_biblios.pl
3) Note a update_holds_queue_for_biblios background job is queued for each record touched
4) Apply this patch
5) Merge touch_all_biblios.pl again
6) Note that no update_holds_queue_for_biblios jobs were queued
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 45bfbd0e2d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 690ee4483b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This removes the "Dismiss" button from the SCO module. Currently, the
"Dismiss" button is present, however it does not function properly and
logs the user out if they press it. As noted on previous chats, keeping
the button would require serious changes, thus it's easier just to remove
the functionallity.
To test:
1) Enable WebBasedSelfCheck
2) Add an OPAC mesaage to a patron account
3) Login to self check ( http://localhost:8080/cgi-bin/koha/sco/sco-main.pl )
4) See the OPAC message, click dismiss.
5) Notice you are logged out at redirected to:
( http://localhost:8080/cgi-bin/koha/opac-dismiss-message.pl )
6) Apply patch
7) Log back into the self checkout module
8) Notice that there is no longer a "Dismiss" button for the message.
9) Log into OPAC into the same user's account
10) On the summary page, note that there is still a dismiss button.
11) Ensure this still works properly
12) sign-off
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2313bc3103)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4056c1e0c2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When one makes a GET call to holds endpoint and hold has
item attached to it, item_id is handled as string not integer
as it should.
To reproduce:
1. Make sure you have hold waiting in your database.
2. Call endpoint api/v1/holds/?q=[{"me.status":"W"}].
=> Note that holds item_id is displayed as item_id: "12345".
3. Apply this patch.
4. Call endpoint again.
=> item_id should now be displayed as 12345.
Also prove t/db_dependent/api/v1/holds.t.
Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 20e0c056c6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 310d19e6b3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Have a patron with some checkouts, holds, and charges that can login into the SCO module.
2. To go sco-main.pl and login
3. Try changing tabs and notice the console error:
dataTables is not defined
4. APPLY PATCH
5. Try again, there should be no error.
6. Make sure you can switch the tabs without any issues.
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit b9ca6b4a36)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 710e002b32)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit cbae441055)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7102672032)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes an error on the B_address2 field which sets it to be
required incorrectly
Test plan:
1) In PatronSelfRegistrationBorrowerMandatoryField, set B_address to be
required.
2) In the OPAC, navigate to the self registration form.
3) In the Alternate address section, fill in the Address field that you
have just set to be required. Ensure that you leave the Address 2
field blank.
4) Fill in all other required fields and submit the form, it should show
you that the Address 2 field is required, even though it shouldn't be
5) Apply patch
6) Refresh the page and repeat steps 1-5, it should allow youto submit
the form
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 009d83648c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 18a186969e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes the ILL request table to display authors for journal article request types
Test plan:
1) Create an ILL request with the type of Journal Article and add an author in the Article author field
2) Click on the List requests button to see the table
3) The Author field should be blank for the request you created
4) Apply patch
5) Hard refresh the browser to reload the javascript
6) The author field should now be visible
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 11eb0d1da7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b12f880c93)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We keep OPEN when people still use log_file or setsid.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c0d76f707b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2c156f8ce1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
My Koha testing docker SIP started dying repeatedly after launch. After investigation, I
found it was a problem with logging and default ports.
In D12 there is no syslog anymore, everythign uses journal. Four our purposes, lets log SIP issues
to sip.log by default
Attaching a patch to clear things up.
To test:
1 - Open KTD/D12
2 - tail -f /var/log/koha/kohadev/*.log
3 - On another terminal 'restart_all'
4 - Wait a bit, notice SIP dying
5 - Apply patch
6 - Update SIPconfig:
server-params:
log_file='/var/log/koha/kohadev/sip.log'
service with port 8023:
port="127.0.0.1:8023/tcp"
7 - Restart all
8 - Confirm SIP no longer dies
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 5dc1ec387d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7076762bba)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
1. Make sure AutoSelfCheckAllowed is Allowed and AutoSelfCheckID and AutoSelfCheckPass are in use.
2. Make sure AnonymousPatron is pointed to an account.
3. Set SelfCheckoutByLogin to cardnumber.
4. Verify that if you go to the anonymous patron account in the staff interface, you cannot checkout items.
5. Go to the selfcheck path of the library. It should auto login. Put in the cardnumber for the anonymous user.
6. Proceed to check out items!
7. APPLY PATCH, restart_all
8. Try step 5 again, you should not be able to log in as the AnonymousPatron. Instead you should be redirected to OPAC home page
9. Switch SelfCheckoutByLogin to 'username and pasword'.
10. Again try to log in as the AnonymousPatron, you should not be able to.
11. Make sure you can login as a regular patron when SelfCheckoutByLogin is set to 'cardnumber' and when it is set to 'username and pasword'.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 76075976ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 58b5228af0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When you try to dislpay a bibliographic record on unimarc that has subjects
linked with authorities then only the $9 is displayed as link instead of the
content of $a and it's subdivisions, if any.
To test:
1) You will need to have a bibliographic record with at least one subject
autority connected in unimarc framework.
2) View that record on OPAC on detail display. The subject will display as
a number ( $9 ) and you cannot see the text/term of the subject ( $a )
3) Apply patch
4) Repeat step 2
5) The subject display in a normal way based on content $a - or more subfields
Sponsored-by: National Library of Greece
Signed-off-by: David Nind <david@davidnind.com>
Bug 29539: (follow-up) remove tag_onesubject template
Also:
Restores the <span class="value">
Replaces "not(position()=last())" with the more used "position() != last()"
Removes unecessary change in <xsl:param name="spanclass" />
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a7fbe80af1)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit dda63ffc37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch silences more warnings. To test
1. Be on 23.11.x
2. Apply the patches before this one
3. Run:
$ ktd --shell
k$ prove t/db_dependent/Illrequests.t
=> FAIL: Lots of warnings like this:
Subroutine Koha::Illrequest::SUPER::status redefined at /kohadevbox/koha/Koha/Object.pm line 955.
Subroutine Koha::Illrequest::SUPER::status_alias redefined at /kohadevbox/koha/Koha/Object.pm line 955.
illrequestattributes is DEPRECATED in favor of extended_attributes at t/db_dependent/Illrequests.t line 1071.
4. Apply this patch
5. Repeat 3
=> SUCCESS: No more warnings!
6. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This check is required because when the existing_statuses method checks for the existing status_alias, it'll leave out the status from the query, so the status will be NULL for those particular query results when calling strings_map, throwing a warning
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Because its highly likely that at least one request will have status_alias null in the database, the select MAX query will always return at least one result with NULL status_alias, throwing a warning, so we skip that
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
I'm not 100% happy with this but I'm out of ideas.
I think the problem warning happens because there is no method status or status_alias directly defined in Object.pm so it tries to define it, but it has already been defined by AUTOLOAD previously.
Test plan:
prove t/db_dependent/Koha/Illbackend.t
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Removed extraneous sort_1 data elements
Update selectors to use field names for statistics field
Updated code to set the value after finding the correct selector
To test:
* Make sure you have at least 2 funds with different stat settings, using AV and not
* Create a basket with an order line
* Close it and receive shipment
* Create an invoice and receive the order line
* Finish receiving
* Click "Modify fund"
* Switch fund, verify the stat fields are updated accordingly
* Change values for statistical values
* Update fund
* Edit fund again, pull downs are correct
* Change values in form and close, do not update
* Click 'Modify fund' - confrim form is filled with the saved values
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 596d6b74ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 572ce3af4a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Some file tidying to pass the QA tests
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 361ec4b2ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eff4e19ef8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Before this patch if a record had a 751 and a 781 you could have fields repeated.
This patch reduces the scope of the fields to subdivision variable as it is only used in processing 7xx
fields and should not be shared between fields.
I also add unit tests
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 95f2aecc1b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4ca639a5f6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Currently when searching for a geographic authority record the search will fail if the record has a heading in a 78X field. The system tries to do a regex match against an undefined variable causing an error. This patch makes that regex match conditional on the variable being defined to allow the search to succeed.
Test plan:
1) Navigate to Authorities
2) In the search bar at the top of the page, click on the dropdown options and in the 'Authority type' field, select 'Geographic Name'
3) Click search
4) You should have a list of authorities
5) Click on any authority record and then click edit and select to edit the record
6) Click on the "7" button
7) Click on the green text next to the '781' field to get the list of fields
8) In field 'v' enter any string you like
9) Click save
10) Repeat steps 1-3, this time it should display an error message for an Unmatched [ in regex
11) Apply patch
12) restart_all
13) Refresh the page, the results should show and the string you entered in the 'v' field should display on the record you edited
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6c9482f213)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6dfb1dd931)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The bug report addresses an issue where the message "Item was not checked in" erroneously appears during the second POST after a manual or modal check-in process.
1. In circ/returns.pl:
- Introduced a new hash `%rinot_returned` to track items not returned across pages.
- Updated the logic to capture the "not returned" status from the query parameters.
- Adjusted the input processing loop to include `not_returned` status.
- Modified the section handling barcode check-ins to appropriately initialize and update the `not_returned` status.
2. returns.tt:
- Added hidden input fields in the template to include `not_returned` status in the form submissions.
The changes ensure that the "not_returned" status is correctly tracked and displayed, preventing the erroneous message from appearing on subsequent POST requests.
1. Perform a manual check-in of an item, but make some warning modal appear: for ex., transfer: check-in the item in not home library.
2. Press OK on the modal. There will be a POST transition again to redraw the checked-in items list.
3. Verify that the "Item was not checked in" message appears erroneously near the item's row.
4. Apply the patch.
5. Repeat steps 1-3 and check that there will be no erroneous "Item was not checked in" message.
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f567d41b91)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 12edba3773)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Run Letters.t (outside kohadevbox :)
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b52c32e13e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch moves the language selection into GetPreparedLetter, drops
the interface check step and ensures the default template always uses
the default include language as per the OPACLanguages settings.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c50bb140a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch re-arranges the unit tests and sets them to ensure we
consistently return the notice and notice includes in the same language.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 25d64cc6b2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds the display of 'Default language' to the 'Default'
language in the notices editor tool.
This is so that librarians know which language they are expected to be
writing the notice in so we can remain consistent in both template and
include language used.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit dc55479043)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch tries to clarify the tests a little and expand their
coverage whilst also adding some defualt translated includes to the test
area and mocking the config to allow the tests to run without installing
translations.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a773770f73)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This restores the final fallback to 'en' as mentioned by Jonathan
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 45e4d9a04a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ef558f072f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch set the language used in slips folloinw this logic:
--> uses patron's preferred language
--> if patron's preferred language is 'default', use the interface language
--> if there is no interface (for overdue_notices for example), use the first language in 'language' system preference
To Test:
1. Install the other language (i used fr-CA here)
1.1.
gulp po:update fr-CA
./misc/translator/translate install fr-CA
1.2. In Administration > Global system preferences, search for language and check the added language
2. Create a manual invoice in a patron's account and pay it
3. From the Transactions tab, click 'Print' next to the payment line
--> On the printed slip, there's the word 'Payment' in English (OK)
4. Switch interface to other language
5. Redo step 3
--> On the printed slip, the word 'Payment' is still in English (not ok)
6. In Administration > Global system preferences, enable TranslateNotices
7. Go to Tools > Notices and slips > ACCOUNT_CREDIT and copy the content of the letter into all the languages
8. Redo step 3 (you should still be in the other language interface)
--> On the printed slip, the word 'Payment' is still in English (not ok)
9. Edit the patron's account and change the preferred language to the other language
10. Redo step 3
--> On the printed slip, the word 'Payment' is in the other language (Paiement) (OK)
11. Apply the patch
12. Reset config
12.1. Edit the patron's account and change back the preferred language to 'default'
12.2. In Administration > Global system preferences, disable TranslateNotices
13. Redo step 3 (you should still be in the other language interface)
--> On the printed slip, the word 'Payment' is in the other language (Paiement)
14. Switch interface to the english language
15. Redo step 3
--> On the printed slip, the word 'Payment' is in English
16. In Administration > Global system preferences, enable TranslateNotices
17. Edit the patron's account and change the preferred language to the other language
18. Redo step 3
--> On the printed slip, the word 'Payment' is in the other language (Paiement)
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4f7ae9c1c4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
They refer to Koha::Installer::Output methods which aren't available in 23.11.x
This reverts them to the standard `say $out` syntax.
Sponsored-by: Catalyst IT
Signed-off-by: Mason James <mtj@kohaaloha.com>
This removes the MySQLism for FIELD(..).
In this case we just want to get the non-default records in
the front. So we can just test lang=default. And prevent inserting
$lang in the expression. And so prevent execution in ORDER BY.
No longer needing the ->quote call too.
Test plan:
Run Koha/AdditionalContents.t again.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c16f5c61849460489992977812f020ec7fa5c9f3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Run Koha/AdditionalContents.t without next patch.
Should fail on the sleep execution.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 58573f139427fa15c2c600edc65d0d263cd00222)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Same change.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 73423bd894d5365ac491c92c6d5576052e4732f0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
Try to access opac-page.pl with a language not in OPACLanguages.
Verify that this 'language' was not passed to sql. Simplest perhaps
by debugging AdditionalContent.pm. Something like:
sub translated_content {
my ( $self, $lang ) = @_;
+warn "L137: $lang";
Now have a public additional_contents page and hit it:
/cgi-bin/koha/opac-page.pl?page_id=5&language=badsql
Check your log and find:
[2024/05/16 07:25:53] [WARN] L137: en at [etc] line 137.
So badsql was caught.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 1a9e3647095eaf9563db59bd8b3a759a0875cc39)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works
Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 14bdaae3f257a321f8ec0d32c6b1e9bc6ed6033d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+- to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent
Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 2f3f42ba98b698871bc473d65a14b5e89d0ae86c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Actually in _get_tt_params
The following query will delay the response
SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle`
, `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract`
FROM `biblio` `me`
WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -'
ORDER BY field( biblionumber, 1 ) AND (
SELECT 1
FROM
SELECT SLEEP( 6 ) x
) -- - )
To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+- to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 0b3c98b0ba01ea5c886ecfe8eef174b5b7c6ec25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch refactors checkpw_internal to remove the SQL code, use patron ojbects, and return the
patron that correctly matches the userid/caerdnumber when auth is successful
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit fe78f06a50c41a7dbac24206e31bc5b1189ee185)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Kyle M Hall
Sam Lau
Emmi Takkinen
Lucas Gass
Lari Strand
Matt Blenkinsop
Marcel de Rooy
Nick Clemens
George Veranis
Pedro Amorim
Tomas Cohen Arazi
Andrii Nugged
Martin Renvoize
Hammat Wele
Aleisha Amohia
Fridolin Somers
Chris Cormack
Jonathan Druart