Commit Graph

57099 Commits

Author SHA1 Message Date
Emily Lamancusa 4b6325dfce
Bug 39183: Only check unresolved claims
To test:
1. Set up sysprefs:
   - Set any non-empty value for ClaimReturnedLostValue
   - Set AutoClaimReturnStatusOnCheckout to "found in library"
   - Set AutoClaimReturnStatusOnCheckin to "returned by patron"
2. Check out an item to a patron
3. On the patron's account page, click the "Claim Return" button next to
   that checkout
4. Check the item in. Note the message that the claim was auto-resolved.
5. Return to the patron's account page and open the Claims Returned tab
--> Note that the claim is resolved and hidden
6. Click the "Show all 1 claims" link to view the hidden claim. Make a
   note of the resolution code and timestamp.
7. Check the item out again
--> Note the message saying that the claim was resolved, even though it
    was already resolved previously
8. View the return claim again
--> Note that the timestamp and resolution code have changed
9. Apply patch and restart_all
10. Repeat steps 2-8 with a new item
--> Note you do not get a claim resolved message on checkout this time
--> Note that the timestamp and resolution code remain the same before
    and after the checkout

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:12 +01:00
Baptiste e0be89266d
Bug 38841: Check non-patron guarantor while deleting patron guarantor
When editing a child while Childneedsquarantor active, trying to delete
a guarantor while saving a non-patron guarantor will prevent the user
from saving. However, if an adult has expired, some librarian would like
to remove the account and let some information in non-patron guarantor.

TEST PLAN

Before applying patch
1 - Open Lisa Charles'page, add Henry Acevedo as Guarantor, also fill
  Guarantor surname and firstname
2 - Edit the page and try and remove Henry Acevedo, it won't work
  however there is still one guarantor

3 - Apply patch
4 - Try and remove Henry Acevedo -> it will work
5 - add HA as a guarantor again
6 - try and remove him AND let guarantor firstname and surname empty ->
  you can't
7 - Add HA and Edna Acosta as guarantor
8 - Remove HA and ler guarantor firstname and surname empty -> you can

Signed-off-by: Thibault Keromnes <thibault.keromnes@univ-paris8.fr>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:12 +01:00
Martin Renvoize d6af10d881
Bug 33284: (follow-up) Fix unit tests
We have a case here where we have checkout_id pointing at issues and
old_issues tables. We need to trick TestBuilder to NOT automagically
build our related checkout.. This patch passes 'undef' to the foreign
key field and then sets it after the fact to the related Old::Checkouts
objects we've already built above.

This patch should prevent the random failures we were seeing before

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:11 +01:00
Martin Renvoize 4f77ec8387
Bug 33284: Set renewer_id for sets of checkouts
This patch adds a trigger into the anonymize function of
Koha::Old::Checkouts such that we pass along the anonymize action to
the renewals record.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:11 +01:00
Martin Renvoize e6d0df1156
Bug 33284: Set renewer_id appropriately for anonymize settings
This patch adds a trigger into the anonymize function of
Koha::Old::Checkout such that we pass along the anonymize action to the
renewals record.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:10 +01:00
Martin Renvoize d82abae1da
Bug 33284: Unit test
This patch adds unit tests to ensure renewals properly respect the
patron privacy settings.

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-07 15:41:10 +01:00
Owen Leonard 08a9ded6b0
Bug 37266: patron_lists/delete.pl should have CSRF protection
This patch adds CSRF protection to patron list deletions.

Also changed: The "Delete selected lists" button is now in a floating
toolbar.

To test, apply the patch and go to Tools -> Patron lists.

- If necessary, create a few patron lists.
- Test the two methods for list deletion available on the page:
  - Check one or more checkboxes and then click the "Delete selected
    lists" at the top of the page.
  - Click the "Actions" button for an individual list and choose "Delete
    list."
- Open the checkout page for a patron.
  - Under the "Patron lists" tab, add the patron to a list.
  - Click the "Actions" button for an that list and choose "Delete
    list."
  - When you are taken to the patron lists page the list should have
    been deleted.
- Perform the same test on the patron details page.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:49 +01:00
David Cook b504d8c5e9
Bug 39170: Improve validation of report ID
This change improves the validation of the report ID passed by the user.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:48 +01:00
Phil Ringnalda b439003fba
Bug 38961: XSS in vendor search
acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:47 +01:00
Jonathan Druart 5e7b3167fd
Bug 38829: Sanitize GetLateOrMissingIssues inputs
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:47 +01:00
Jonathan Druart 943cc3ec2a
Bug 38829: Add a test
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:46 +01:00
David Cook 31ff6b69df
Bug 38488: Add Template::Toolkit filter for C4::Scrubber
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:45 +01:00
David Cook 4f294dec5f
Bug 38469: Replace single quotes with double quotes to prevent XSS
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)

3. To test the XSS is patched, try the proof-of-concept from the
bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:45 +01:00
Phil Ringnalda 85fc098983
Bug 38467: (follow-up) Update cpanfile
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:44 +01:00
Phil Ringnalda 14056e035a
Bug 38467: (follow-up) Fix test
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:43 +01:00
Jonathan Druart a2310c2f0a
Bug 38467: Add test
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:42 +01:00
David Cook 4b401010fb
Bug 38467: Make uri and url filters rfc3986 when using C4::Template
This change invokes Template::Filters->use_rfc3986 in the C4::Template
module.

Test plan:
0. Apply the patch
1. Note that "uri" and "url" filters now escape single quotes

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:42 +01:00
Julian Maurice e4bf517b55
Bug 38454: Flush memory cache before every API request
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:41 +01:00
Marcel de Rooy abb2fc36d3
Bug 37816: (QA follow-up) Avoid repetition, typo and pipe test
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.

Test plan:
Run t/SIP/Sip.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:40 +01:00
Magnus Enger cb9c2146db
Bug 37816: Stop SIP2 from logging passwords
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.

To test, in ktd:
- Run the new tests:
  $ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
  $ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
  $ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
  "9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
  which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)

Update 2024-12-03: Fix issues pointed out by QA.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:40 +01:00
Marcel de Rooy 57687742e3
Bug 36081: (QA follow-up) Resolve IsNotDebit exception in ArticleRequests.t
Resolve (when running ArticleRequests.t):
Exception 'Koha::Exceptions::Account::IsNotDebit' thrown 'Account line 326 is not a debit'

This occurs after switching from ArticleRequest->new to TestBuilder.
TestBuilder creates an account line that has a credit_type_code and
a debit_type_code. (This could be fixed further somewhere else.)
For now, just setting debit_id to NULL.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:39 +01:00
Jonathan Druart d421106c27
Bug 36081: Fix some failing tests
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:38 +01:00
Jonathan Druart ec3bffdb60
Bug 36081: Mock format
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:38 +01:00
Jonathan Druart 5baaecc58f
Bug 36081: Force TestBuilder to generate a valid format value
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:37 +01:00
Jonathan Druart ddc0e07bab
Bug 36081: Use multivalue_preference
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!

Let support both here.

This patch also removes silly JS code in the template.

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:36 +01:00
Marcel de Rooy 50fb4d5016
Bug 36081: Check SupportedFormats server side
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:36 +01:00
Katrin Fischer 4772ba6218
Bug 28907: (follow-up) Fix file permissions for t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:35 +01:00
Lari Taskula b75bf9a84a
Bug 28907: REST - Drop support for allow-owner functionality
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.

Old method, was applicable to both privileged and public routes:

  api/v1/swagger/paths/route.yaml

  x-koha-authorization:
    allow-owner: true
    allow-guarantor: true

New method, use public routes with no x-koha-authorization:

  GET /public/route/{patron_id}
  Koha/REST/V1/Controller#public_action:

  sub public_action {
      my $c = shift->openapi->valid_input or return;
      my $patron_id = $c->param( 'patron_id' );
      try {
          # Throws an exception that will render a response of 401 if not
          # authenticated and 403 if trying to access another user's resources
          $c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
          ...
          # other code
          ...
      }
      catch {
          $c->unhandled_exception($_);
      }
  }

  Another example of retrieving $patron_id when patron_id is not a request
  parameter:
  GET /public/another/object/{another_object_id}

  my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
  try {
      # 403 if $another_object_id does not belong to API user
      $c->auth->public($patron_id);
      ...

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:34 +01:00
Lari Taskula 423588a060
Bug 28907: REST - Remove allow-owner from public article requests cancel route
To test:
1. prove t/db_dependent/api/v1/article_requests.t
2. Apply patch
3. prove t/db_dependent/api/v1/article_requests.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:33 +01:00
Lari Taskula 41cac0d9fc
Bug 28907: REST - Remove allow-owner from public checkout availability route
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:33 +01:00
Lari Taskula 53d4a37b2b
Bug 28907: REST - Remove allow-owner from public patron hold cancellation
To test:
1. prove t/db_dependent/api/v1/patrons_holds.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_holds.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:32 +01:00
Lari Taskula 3a1e5d74f7
Bug 28907: REST - Remove allow-owner from public guarantors can see charges and checkouts
To test:
1. prove t/db_dependent/api/v1/patrons.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:31 +01:00
Lari Taskula b2e1ac1299
Bug 28907: REST - Remove allow-owner from public checkouts route
To test:
1. prove t/db_dependent/api/v1/checkouts.t
2. Apply patch
3. prove t/db_dependent/api/v1/checkouts.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:31 +01:00
Lari Taskula 3ccf9d4ee1
Bug 28907: REST - Remove allow-owner from public password route
To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:30 +01:00
Lari Taskula f648aa453f
Bug 28907: Add Koha::REST::Plugin::Auth::PublicRoutes
To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:29 +01:00
Lari Taskula c18964a48f
Bug 28907: Add REST exceptions for public routes auth
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm

More tests coming in following patches.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:29 +01:00
Tomas Cohen Arazi e360959752
Bug 28478: Make opac-*detail.pl scripts use Koha::Biblio->opac_suppressed()
This patch makes the following scripts use the new method for checking
suppression:

* opac/opac-ISBDdetail.pl
* opac/opac-MARCdetail.pl
* opac/opac-detail.pl

In the `opac-detail.pl` case, it is a simple change by removing MARC
data traversal in favor of the new method. The code checking
suppression gets moved up so we don't process or make any other
calculations if the record is suppressed.

The other two scripts where completely missing the check and thus
leaking suppressed records.

To test:
1. Pick two records, one marked as suppressed, and the other not
   suppressed.
2. Try acessing them in the OPAC detail page.
=> SUCCESS: Suppressed records are suppressed, and not suppressed ones
are not.
3. Try the same records on the ISBD and MARC view
=> FAIL: They are not suppressed!
4. Apply this patch
5. Repeat 2
=> SUCCESS: Suppression is still respected
6. Repeat 3
=> SUCCESS: Suppression is respected on the ISBD and MARC views
7. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. Remember to activate OPAC suppression with
OpacSuppression.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:28 +01:00
Tomas Cohen Arazi 1b4bb57092
Bug 28478: Add Koha::Biblio->opac_suppressed()
This patch adds a convenient method at the Koha::Biblio level, as a
wrapper for the extrator added on this bug. Following the established
pattern we adopted a while back.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio.t
=> SUCCESS: Tests pass! All use cases covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:27 +01:00
Tomas Cohen Arazi c50b8dc50e
Bug 28478: Add get_opac_suppression extractor
This patch adds an extractor method for the historically hardcoded field
942$n. This way we have a single place in which we code the extraction
and sanitization of its value.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio/Metadata/Extractor/MARC.t
=> SUCCESS: Tests pass! All use cases are covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-06 13:54:26 +01:00
Owen Leonard 8abf287e6d
Bug 37094: Improve layout of serial claims page
This patch updates the serial claims interface to hopefully make it more
usable:

- Vendor selection and filter issues forms are in the sidebar
- The "Download selected" and "Send notification" forms are now in their
  own columns at the bottom of the table of issues.
- NEW: The "Download selected" and "Send notification" forms are
  disabled unless one or more issues are selected.

To test you'll need more than one vendor with subscriptions that have
late issues.

- Go to Serials -> Claims.
- You should see a "Choose vendor" form in the main part of the page.
  - Choose a vendor.
  - After selecting a vendor you should see the vendor selection form in
    the sidebar along with a "Filter missing issues" form.
  - Confirm that both forms work correctly.
- In the main body of the page you should see the table of missing
  issues.
  ** Previously this table was sorted by default on the checkbox column.
     Since that doesn't make sense I moved the default sort to the
     "Since" column.
- Below the table of issues should should see the "Download selected"
  form. If you have a claim notice defined, you'll also see a "Send
  notification" form, each in their own column.
  - These forms should initially be disabled.
  - When you check a checkbox or click the "Select all" control at the
    top of the checkbox column the forms should become active.
  - Confirm that both forms work correctly.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-28 16:05:57 +01:00
Kyle M Hall b66ccc1258
Bug 39214: Mock preferences in t/db_dependent/Koha/Session.t for subtest 'test session driver'
The "test session driver" unit test assume SessionStorage is set to MySQL and will fail if it is set to anything else. We should mock the values, and test the other supported values.

Test Plan:
1) Set SessionStorage to File
2) prove t/db_dependent/Koha/Session.t
3) Note test failure
4) prove t/db_dependent/Koha/Session.t
5) Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-28 16:05:57 +01:00
Katrin Fischer 4278abd185
Bug 39075: DBRev 24.12.00.015
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:37 +01:00
Marcel de Rooy 0334dd9093
Bug 39075: (QA follow-up) Use new bug number. refer to old
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:36 +01:00
Matt Blenkinsop 50ef9576d2
Bug 39075: Fix DB inconsistencies
This patch fixes DB inconsistencies introduced in bug 34587

Test plan:
1) Run 'updatedatabase'
2) There should be no errors
3) Check the database and observe the correct assignment of the following columns
- erm_counter_logs.importdate
- erm_counter_files.date_uploaded

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] chmod 755 on new dbrev
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:36 +01:00
Marcel de Rooy 59bab75070
Bug 30975: (QA follow-up) Improve copyright and author line
This fundamental improvement may well be reflected in those
lines.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:35 +01:00
Marcel de Rooy 4837aa9a1c
Bug 30975: (QA follow-up) Fix for authorities and upload plugin
Authorities still needed a few tweaks for text2 (obscure name for
plugins).
Upload plugin does not have buttonDot 'mark'. Cloning was still
an issue. Not the most elegant solution but it works. We should
not have this exception for just another icon or so.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:35 +01:00
Julian Maurice 05946c473b
Bug 30975: Fix upload plugin
The upload plugin button has no 'buttonDot' class (unlike other plugins
buttons) so its click event were not listened to.
This patch fix the CSS selector in order to listen on click events for
all plugins buttons

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:34 +01:00
Julian Maurice 1a91b01977
Bug 30975: Fix framework plugins on acqui/neworderempty.pl
Test plan:
- Activate UseACQFrameworkForBiblioRecords
- Make sure you have an ACQ cataloguing framework that uses at least one
  plugin
- Create a new basket, create an order from 'new'
- Verify that framework plugins work

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:34 +01:00
Julian Maurice f000278b32
Bug 30975: Use event delegation for framework plugins
This is to avoid using private jQuery method _data.
Here's what jQuery 1.8.0 release notes says about it:
"this is not a supported public interface; the actual data structures
may change incompatibly from version to version."
So we should not rely on it.

What this patch does is use event delegation [1].
Events are bound to a parent container, so when elements are added
dynamically inside that container, we don't need to re-attach event
handlers manually

This patch also comes with a bit of cleanup, and introduce "breaking
changes" (they are breaking changes only if you happen to have custom
framework plugins):
1) 'mouseover', 'mousemove', 'keypress' events are no longer listened to
   'mouseover' and 'mousemove' are not used and would trigger too much
   events.
   'keypress' is also not used, and is deprecated
2) Event handlers now takes a single parameter that is an Event object
   It just makes the code a lot less complicated.
3) Event handlers do not pollute the global scope anymore

[1] https://learn.jquery.com/events/event-delegation/

Test plan:
- Go to every page that has a MARC editor and verify that plugins still
  work. This includes addbiblio.pl, additem.pl, authorities.pl,
  neworderempty.pl, orderreceive.pl
- Test plugins that use 'focus' event (for instance barcode.pl), 'blur'
  event (callnumber.pl) and 'click' event (almost all the others)
- Test that plugins work on cloned fields/subfields

Rebased-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:33 +01:00
Caroline Cyr La Rose 3bf4121b13
Bug 38180: Don't show label if 520 ind1=8 (MARC21)
This patch amends the display constant for field 520 if the first
indicator is set to 8. According to MARC21 documentation
(https://www.loc.gov/marc/bibliographic/bd520.html), the field's
labels depend on the value of indicator 1.

First Indicator	Second Indicator
Display constant controller
empty - Summary
0 - Subject
1 - Review
2 - Scope and content
3 - Abstract
4 - Content advice
8 - No display constant generated

Prior to this patch, a 520 field with ind1 = 8 is displayed as
'Summary'. After this patch, there is no label.

To test:
1. Create or edit a record, and add 7 x 520 tags:
   - Add one 520 tag with no value in ind1, enter 'Summary' in 520$a
   - Add one 520 tag with 0 in ind1, enter 'Subject' in 520$a
   - Add one 520 tag with 1 in ind1, enter 'Review' in 520$a
   - Add one 520 tag with 2 in ind1, enter 'Scope and content' in 520$a
   - Add one 520 tag with 3 in ind1, enter 'Abstract' in 520$a
   - Add one 520 tag with 4 in ind1, enter 'Content advice' in 520$a
   - Add one 520 tag with 8 in ind1, enter 'No display constant
     generated' in 520$a

2. View the record in the staff interface
   --> The labels should be
       - 'Summary' for the field that contains 'Summary' (OK)
       - 'Subject' for the field that contains 'Subject' (OK)
       - 'Review' for the field that contains 'Review' (OK)
       - 'Scope and content' for the field that contains 'Scope and
         content' (OK)
       - 'Abstract' for the field that contains 'Abstract' (OK)
       - 'Content advice' for the field that contains 'Content advice'
         (OK)
       - 'Summary' for the field that contains 'Subject' **(NOT OK)**

3. View the record in the OPAC
   --> The labels should be
       - 'Summary' for the field that contains 'Summary' (OK)
       - 'Subject' for the field that contains 'Subject' (OK)
       - 'Review' for the field that contains 'Review' (OK)
       - 'Scope and content' for the field that contains 'Scope and
         content' (OK)
       - 'Abstract' for the field that contains 'Abstract' (OK)
       - 'Content advice' for the field that contains 'Content advice'
         (OK)
       - 'Summary' for the field that contains 'Subject' **(NOT OK)**

4. Apply patch

5. Repeat step 2 (view the record in the staff interface; make sure to
   refresh the page)
   --> The labels should be
       - 'Summary' for the field that contains 'Summary' (OK)
       - 'Subject' for the field that contains 'Subject' (OK)
       - 'Review' for the field that contains 'Review' (OK)
       - 'Scope and content' for the field that contains 'Scope and
         content' (OK)
       - 'Abstract' for the field that contains 'Abstract' (OK)
       - 'Content advice' for the field that contains 'Content advice'
         (OK)
       - Nothing for the field that contains 'Subject' (OK!!)

6. Repeat step 3 (view the record in the OPAC; make sure to refresh the
   page)
   --> The labels should be
       - 'Summary' for the field that contains 'Summary' (OK)
       - 'Subject' for the field that contains 'Subject' (OK)
       - 'Review' for the field that contains 'Review' (OK)
       - 'Scope and content' for the field that contains 'Scope and
         content' (OK)
       - 'Abstract' for the field that contains 'Abstract' (OK)
       - 'Content advice' for the field that contains 'Content advice'
         (OK)
       - Nothing for the field that contains 'Subject' (OK!!)

https://bugs.koha-community.org/show_bug.cgi?id=38081
Signed-off-by: esther <esther@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-02-27 17:32:33 +01:00