Commit Graph

1139 Commits

Author SHA1 Message Date
Amit Gupta 1f6220047e Bug 22990: Add CSRF protection to boraccount, pay and suggestion
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Test plan would have been nioe.
Tested by changing MAX_AGE with suggestions.

Bug 22990: Fix for shelves table

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Bug 22990: Fix template toolkit syntax issues in shelves_results.tt

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Bug 22990: (follow-up) Fix suggestion.pl

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e7e5a54dc8)
Signed-off-by: danyonsewell <danyonsewell@catalyst.net.nz>
2023-08-04 00:58:33 +00:00
Martin Renvoize 07d8edefd9 Bug 29987: (follow-up) Fix missing payment type
The payment type include has changed since the patch was first written,
we now require a 'type' is passed to properly set the field name.

This should fix the 'bankable' issue raised.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit a059392490)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6d0af80314)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-16 14:35:30 +01:00
Martin Renvoize 1cb69bc22a Bug 29987: Add register support to manual credits
This patch adds the register and transaction type selection options to
the manual credit page.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 529341c78b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 81d9692920)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-12-16 14:35:30 +01:00
Nick Clemens 7d7d8e1118 Bug 31562: [21.11.x] Treat flags as other borrower fields
Rather than generate a custom hash for these fields, we should treat them as other borrower data fields

To test:
 1 - Edit a patron, note the 'Lost card' and 'Gone no address' fields
 2 - Edit syspref BorrowerunwantedField
 3 - Set gonenoaddress and lost as unwanted
 4 - Edit patron, the fields remain
 5 - Apply patch
 6 - Edit a patron, fields are hidden
 7 - Unhide one of the fields
 8 - Edit a patron and confirm it shows and saves correctly
 9 - Unhide the other field
10 - Confirm it can be edited and saved

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 31562: Remove gonenoaddress and lost from OPAC borrower field preferences

These are not shown, so cannot be unwanted or mandatory

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Bug 31562: Respect mandatory fields pref

To test:
1 - Set gonenoaddress and lost in BorrowerMandatoryField
2 - Edit a patron, confirm fields are required

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3d6607567c)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-11-14 18:01:37 +01:00
Martin Renvoize bdaefd6745 Bug 26689: Prepend letter codes.
This patch prepends the credit_type_code and debit_type_code with
CREDIT_ and DEBIT_ respectively when doing a lookup on the notice letter
code.

Test plan
1) As previous patches, however instead of just naming your notice to
   match the credit_type_code or debit_type_code use
   CREDIT_credit_type_code and DEBIT_debit_type_code respectively.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 87aa05f9de)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6d9fd8160a)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:48:14 +02:00
Martin Renvoize e4f6538094 Bug 26689: Check for specific template then fallback - printinvoice
This patch adds a check for a more specific ACCOUNT_DEBIT template
(named to match the debit_type_code of the credit line) prior to
falling back to the ACCOUNT_DEBIT template.

Test plan
1/ On a patrons account page use the print option on a series of debit
lines with differing credit types (Overdue, Payout)
2/ Note that the same template 'ACCOUNT_DEBIT' is used for all types
3/ Apply the patch
4/ Run step 1 again and note all still print using ACCOUNT_DEBIT
5/ Add a new notice template under the 'circulation' module with a code
that matches one of your account debit types (OVERDUE, PAYOUT)
6/ Run step 1 again and note that where you have added a specific notice
for that debit type it has been used.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8e46612d7c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 021ca321ee)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:48:14 +02:00
Martin Renvoize 8463b63d9b Bug 26689: Check for specific template then fallback - printfeercpt
This patch adds a check for a more specific ACCOUNT_CREDIT template
(named to match the credit_type_code of the credit line) prior to
falling back to the ACCOUNT_CREDIT template.

Test plan
1/ On a patrons account page use the print option on a series of credit
lines with differing credit types (Payment, Lost Item Return, Writeoff)
2/ Note that the same template 'ACCOUNT_CREDIT' is used for all types
3/ Apply the patch
4/ Run step 1 again and note all still print using ACCOUNT_CREDIT
5/ Add a new notice template under the 'circulation' module with a code
that matches one of your account credit types (PAYMENT, WRITEOFF,
LOST_FOUND)
6/ Run step 1 again and note that where you have added a specific notice
for that credit type it has been used.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 422ab47283)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 32091958c7)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-09-14 11:48:14 +02:00
Nick Clemens cf35f971c4 Bug 7660: Use first available categorycode when none passed in
The code that populates the patron messaging preferences on initial form load
expects to have a category selected. Currently we only have one if one was
passed to the form. When creating an account from a parent, we don't have a
category explicitly selected - so we can just select the first of the possible
categories

To test:
 1 - In KTD set 'Juvenile' category to have some messaging preferences
 2 - Find a patron, say Edna Acosta, and 'Add guarantee'
 3 - In new form preferences are blank, cancel
 4 - Apply patch, restart all
 5 - Go to Edna, click 'Add guarantee'
 6 - Preferences are populated!
 7 - Cancel
 8 - Go to 'Patrons' module
 9 - Click "+ New patron"
10 - Confirm messaging preferences load correctly when not adding child

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 146423f1bc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1256907319)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 15:49:52 +02:00
Lucas Gass aabb010ec1 Bug 20439: Sort SMS providers in alphabetical order by DB field
To test:
1/ Add 'Email' to the 'SMSSendDriver' system preference.
2/ Make sure 'EnhancedMessagingPreferencesOPAC' and 'EnhancedMessagingPreferences' are turned on.
3/ Add some SMS providers (/cgi-bin/koha/admin/sms_providers.pl) with different names.
4/ Notice on memberentry.pl and opac-messaging.pl the SMS providers sort by when they were added, not alphabetically.
5/ Apply patch and restart services.
6/ Look at memberentry.pl and opac-messaging.pl and notice that they SMS providers now sort alphabetically.

Signed-off-by: George Williams <george@nekls.org
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fd49601079)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 35b8967b84)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
2022-08-26 14:57:15 +02:00
Martin Renvoize b3125c9f38 Bug 17648: (QA follow-up) Restore imediate sending of the notice
The original notice was sent using SendAlerts, which triggers
immediately on submission and doesn't wait for the cron task.

This patch restores that immediacy and also fixes a bug in the imports
on the original patch.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 09:32:21 -04:00
Martin Renvoize 1ccbd0b7a9 Bug 17648: (QA follow-up) Further code cleaning
We actually have a Koha::Patron method to do all the work of finding the
right patron primary email address for notices.. we can use that here
instead of doing it long hand.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 09:32:21 -04:00
Kyle Hall b12f857f4a Bug 17648: ACCTDETAILS notice does not show in notices.pl
The ACCTDETAILS notice apparently bypasses message_queue; notices are sent directly to the linux mail queue.

Test Plan:
1) Apply this patch
2) Create a new patron with an email address
3) Note the patron's ACCTDETAILS notice shows in the patron's messages

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 09:32:21 -04:00
Kyle M Hall 5e2b13825e Bug 27812: Email should send for all new patron as per the syspref description
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 09:30:19 -04:00
Kyle M Hall 49f36e7109 Bug 27812: Remove the ability to transmit a patron's plain text password over email
We should not give libraries the ability to compromise patron accounts,
it is considered a huge security issue and nobody in network security
would never recommend allowing passwords to be transmitted in clear text
over email.

It should simply not be possible to send a patron's password in plain text
via email. As such, we should remove this ability from Koha.

Test Plan:
1) Apply this patch
2) Create a patron to generate the ACCTDETAILS email
3) Note you can no longer transmit the patron's password in the email

Signed-off-by: Amit Gupta <amitddng135@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 09:30:19 -04:00
Andrew Nugged 36f80b99f8 Bug 29684: (QA follow-up) paycollect.pl don't needs borrower_data at all
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 08:18:16 -04:00
Petro Vashchuk ef8a6cd4e7 Bug 29684: Fix warn about js/locale_data.js (paycollect.pl)
To reproduce (paycollect.pl):
1) Prepare or use some existing patron with outstanding fines, go to
the accounting section and open page where you make payment towards all
fines.
2) The error message should have appeared in your log file about
"File not found : default/js/locale_data.js".
3) Apply the patch.
4) Open the edit page again, ensure that the new error massage like
that didn't appear.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 08:18:16 -04:00
Petro Vashchuk 2245b9c1df Bug 29684: Fix warn about js/locale_data.js (memberentry.pl)
To reproduce (memberentry.pl):
1) Head over to the patron details page, press edit button to open the
memberentry.pl page.
2) The error message should have appeared in your log file about
"File not found : default/js/locale_data.js".
3) Apply the patch.
4) Open the edit page again, ensure that the new error massage like
that didn't appear.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-03-25 08:18:16 -04:00
Tomas Cohen Arazi 990eccdec3 Bug 29758: Get rid of warning in members/boraccount.pl
This patch removes a noisy warning found in production logs.

To test:
1. Run:
   $ tail -f /var/log/koha/kohadev/plack-intranet-error.log
2. Open the 'Accounting' tab for a patron, then click on 'Transactions'
=> FAIL: You see this kind of warning in the logs:

[WARN] CGI::param called in list context from...
3. Apply this patch
4. Repeat 2 (change tab and go back)
=> SUCCESS: No more warning!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-02-07 06:17:21 -05:00
Jonathan Druart 57dbbabecd Bug 29541: Prevent users from another group to access patron's images
We should respect group restrictions here.

Test plan:
Create a patron from another group of libraries and don't let them
access info from patrons outside of this group.
Access the following link and confirm that you can see the image only
for patrons from their group
  /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-01-25 14:42:18 -05:00
Jonathan Druart afbe6adafa Bug 29541: Restrict access to patron's image to borrowers => * and circulate => *
The patron images is displayed on the 'circulation' and 'members'
modules.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-01-25 14:42:18 -05:00
Martin Renvoize 0a79d25421 Bug 29457: Pass context borrowernumber
This patch updates the call to cancel such that we pass the currently
logged in users borrowernumber instead of their userid.

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2022-01-07 05:58:09 -05:00
Jonathan Druart ee76f80a7b Bug 29524: (bug 28935 follow-up) Restore modification of some patron's attributes
On
  commit 5f37d8d2f4
  Bug 28935: No filtering on patron's data on member entry pages
we restricted the list of the columns from the borrowers table that can
be modified from the patron edit view.
We were too restrictive, the following 3 attributes can be edited from
this form: privacy_guarantor_fines, privacy_guarantor_checkouts,
checkprevcheckout and lang

Test plan:
Turn on the following prefs:
- AllowStaffToSetFinesVisibilityForGuarantor
- AllowStaffToSetCheckoutsVisibilityForGuarantor
- CheckPrevCheckout (set to 'unless overridden *')
- TranslateNotices
Edit a patron and see the 4 different options are now displayed.
Change their value, save, edit again
Confirm that the values have been saved

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-11-24 09:38:27 +01:00
Kyle M Hall 6fdf64e06b Bug 27145: Wrap delete and move_to_deleted in a transaction
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-11-15 12:38:39 +01:00
Kyle M Hall 83dcdf2a5a Bug 27145: Rethrow all other exceptions
Bug 14708 introduced a try catch around $patron->delete in commit:
  "Bug 14708: (QA follow-up) Use try/catch blocks when calling"

However, in the catch block it only assumes the exception was from trying to
delete anonymous patron when it can be anything else as well, the code should
be modified so that it will handle the anonymous patron case and if it is
anything else we log the other exception.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-11-15 12:38:39 +01:00
Kyle M Hall 18c1500772 Bug 28211: Replace use of call_recursive() with call()
This is based on Julian's idea on bug 28026 where we could get rid of call_recursive by passing refs as arguments to call.

Test Plan:
1) Apply this patch
2) prove t/db_dependent/Koha/Plugins/Plugins.t
3) prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-10-18 11:28:41 +02:00
Nick Clemens c7a7e45812 Bug 15812: Use patron search in place of circ search
The 'Checkout' search hijacks some of the DataTables searching code used for 'Search patrons'
Rather than try to implement the search again on another page, we can simply send the user
to the patron search if the cardnumber is not found

Additionally, this patch adds a 'Check out' button to the patron search results to allow
going to checkotus directly

To test:
1 - Apply patch
2 - Perform a 'Checkout' search from the header
3 - Note that:
    For a cardnumber, you are redirected directly to checkouts page for the borrower
    For a search with one result, you are redirected directly to the checkout page for the borrower
    For a search with many results, you are redirected to the patron search results
    and there is a 'Checkout' button under the cardnumber
4 - Confirm circulation page works as expected (i.e. checkout to a patron)

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-10-14 09:19:30 +02:00
Nick Clemens 814789f8cb Bug 29062: Use primary key issued_id to fetch old_issues for letters
The code currently uses itemnumber to fetch old_issues for notices.
This doesn't seem to be used in any current notices except the CHECKINSLIP:
SELECTY letter.code,content FROM letter WHERE content LIKE 'old\\_%'\G

For issues we use itemnumber, however, issues has a constraint to limit issues for an itemnumber to 1
Old issues has no such constraint, we try to rectify this in the old code by adding 'ORDER BY returndate DESC LIMIT 1"

As the code is not used by default and buggy I think we can make a change to using 'issue_id' as the key and
announcing the change - it prevents leaky data

To test:
1. Check something out to patron A. Check it in.
2. Check something out to patron B. Check it in.
3. Check something out to patron C. Check it in and print the check-in slip. (Leave the checkin paghe open)
4. You will see the checkin repeat itself 3 times, one for each line in old_issues.
5. Apply patch and restart_all
6. Click the 'Print checkin slip' button again
7. You see a single checkin
8. Checkout a different item to patron A. Check it in and print the check-in slip
9. See the correct checkins

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-10-07 15:49:01 +02:00
Kyle M Hall 4f533776c6 Bug 26352: Switch from using call() to call_recursive()
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-10-06 14:56:09 +02:00
Kyle M Hall aea8ce7fcc Bug 26352: Add plugin hooks to transform patron barcodes
Some of our partners have unusual barcode requirements that have
required us to transform scanned barcodes using javascript. This is not
the most reliable method. It would make more sense to have Koha
transform the barcodes on the backend using a plugin. We should add
hooks to transform and generate new item and patron barcodes.

Test Plan:
1) Apply this patch
2) Download and install the Barcode Transformer plugin
   https://github.com/bywatersolutions/koha-plugin-barcode-transformer/releases/download/v1.0.1/koha-plugin-barcode-transformer-v1.0.1.kpz
3) Go to the plugin configuration page, set the configuration to the example configuration from the same page
4) In the patron search and anywhere else you can scan a patron
   cardnumber, type in some cardnumbers but prefix them with A and postfix
   them with A or B, e.g. A12345A, A12345B
5) Note the letters are removed by Koha!
6) Try a cardnumber like X123456Y
7) Note Koha converts it to Z13456Z

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-10-06 14:56:09 +02:00
Tomas Cohen Arazi da758626fe Bug 28772: Display API secret once
This patch makes the apikeys.pl display the generated API secret once,
when generated. After that, it won't be displayed by the UI.

To test:
1. Generate a new API key
=> FAIL: The secret is displayed in the API keys table
2. Visit some other page, and go back to the API keys page
=> FAIL: The API key secret is there
3. Apply this patch
4. Go to More > Manage API keys
=> SUCCESS: It no longer displays the secret
5. Generate a new API key
=> SUCCESS: The API key details (including the secret) are displayed.
=> SUCCESS: A message telling to copy the secret because it won't be
            displayed again is shown.
6. Repeat 4
=> SUCCESS: The secret is no longer displayed
7. Sign off :-D

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-30 09:19:05 +02:00
Petro Vashchuk fcb87024ad Bug 28759: limit accessibility for "Manage API keys"
This patch limits the accessibility for "Manage API keys" section only
to superlibrarians and the owner of that said API key account.

The way it does it is by checking if user is superlibrarian or if
logged-in user is the same as a patron id/borrower number is the same
as logged-in user number both in template and apikeys.pl and making sure
the link is inaccessible or redirects to the 403 page if user tries to
go there directly.

To reproduce:
1) create/pick existing patron, set Staff access, allows viewing
of catalogue in staff interface (catalogue)" and "Add, modify and
iew patron information (borrowers)" permissions on;
2) enable "RESTOAuth2ClientCredentials" in sysprefs;
3) login with that user into staff interface;
4) check any other patron, go to the "More"->"Manage API keys" and
check that you can see, add delete their API keys;
5) apply patch;
6) with that same user try to access "Manage API keys" page again.
Ensure that you can't access that page of other patrons but can
access your own page and manage your own API keys.
7) log in with superlibrarian now and ensure that you can access every
"Manage API keys" page of every patron and apply changes there.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-30 09:19:02 +02:00
Nick Clemens 6b5cf0ca84 Bug 28935: (QA follow-up) Use BorrowerUnwantedField on staff client
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-30 09:18:57 +02:00
Marcel de Rooy 5f37d8d2f4 Bug 28935: No filtering on patron's data on member entry pages
Security patch. Follow-up for 28929.
Including correction for gonenoaddress and two others.
Includes unwanted fields too now.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-30 09:18:57 +02:00
Jonathan Druart 6def280427 Bug 28929: Prevent flags to be sent during patron's edition
* selfreg and selfmod for OPAC
* patron's edition on staff

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested OPAC and staff side. Prevents mangling flags column.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-30 09:18:56 +02:00
Jonathan Druart ddb24eb403 Bug 28870: Move email address validation to a specific class method
To ease testing and future changes if needed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-28 10:22:36 +02:00
Tomas Cohen Arazi 481f52308a Bug 28870: Remove traces of Email::Valid
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-09-28 10:22:35 +02:00
Martin Renvoize c475d4d97b Bug 22435: Update accountline-details page to show all history
The accountline-details page took a simplistic approach to displaying
the history of an accountline. This patch drops the now defunct
offset_type_description template block from it's respective include
files, and then updates the accountline-details template and controller
to show the full history of what's happend to the accountline passed.
This includes the creation, any increments/decrements (for fines), and
finally any offsets against the total (payments, cancellations, voids).

Test plan
1/ Create some credits and debits and apply them to each other in
various combinations.
2/ View the 'Details' page for some of the debit/credits
3/ Compare before patch and after for the Details page.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-08-04 14:06:43 +02:00
Owen Leonard 7e1227890b Bug 28073: Patron modifications should auto-open panel for referring patron record
This patch makes it possible to link directly to the correct panel on
the "Update patron records" page. The link on the checkout and patron
details screen has been updated to read "Patron has pending
modifications."

Also changed: Moved the "Patron's address in doubt" message so that it
is above the table of changed fields.

To test, apply the patch and if necessary submit patron modification
requests from multiple patrons via the OPAC.

 - Open the checkout page for one of these patrons.
   - If you are logged in as a user with permission to edit patron
     records you should see a message, "Pending modifications: Review
     pending modifications," which links to the pending modifications
     page.
     - Clicking the link should open the page for reviewing pending
       patron modifications, and the correct panel should be
       automatically expanded.
   - If you are logged in as a user without permission to edit patrons
     you should see the message "Pending modifications: Patron has
     pending modifications," which isn't linked.
 - The process should work exactly the same from the patron detail page.
 - Following the "Pending modifications" link from the staff interface
   home page or the patrons home page should work as before: The page
   opens with the first panel expanded.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-26 12:46:32 +02:00
Jonathan Druart cb2eae80d9 Bug 28624: Remove Smart::Comments
It's not used in those files (there is no occurrence of ###), and it's
not installed anyway (it is by koha-testing-docker however).

We should remove those lines.

Test plan:
Confirm the above

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-26 12:46:32 +02:00
Jonathan Druart 9d6d641d1f Bug 17600: Standardize our EXPORT_OK
On bug 17591 we discovered that there was something weird going on with
the way we export and use subroutines/modules.
This patch tries to standardize our EXPORT to use EXPORT_OK only.

That way we will need to explicitely define the subroutine we want to
use from a module.

This patch is a squashed version of:
Bug 17600: After export.pl
Bug 17600: After perlimport
Bug 17600: Manual changes
Bug 17600: Other manual changes after second perlimports run
Bug 17600: Fix tests

And a lot of other manual changes.

export.pl is a dirty script that can be found on bug 17600.

"perlimport" is:
git clone https://github.com/oalders/App-perlimports.git
cd App-perlimports/
cpanm --installdeps .
export PERL5LIB="$PERL5LIB:/kohadevbox/koha/App-perlimports/lib"
find . \( -name "*.pl" -o -name "*.pm" \) -exec perl App-perlimports/script/perlimports --inplace-edit --no-preserve-unused --filename {} \;

The ideas of this patch are to:
* use EXPORT_OK instead of EXPORT
* perltidy the EXPORT_OK list
* remove '&' before the subroutine names
* remove some uneeded use statements
* explicitely import the subroutines we need within the controllers or
modules

Note that the private subroutines (starting with _) should not be
exported (and not used from outside of the module except from tests).

EXPORT vs EXPORT_OK (from
https://www.thegeekstuff.com/2010/06/perl-exporter-examples/)
"""
Export allows to export the functions and variables of modules to user’s namespace using the standard import method. This way, we don’t need to create the objects for the modules to access it’s members.

@EXPORT and @EXPORT_OK are the two main variables used during export operation.

@EXPORT contains list of symbols (subroutines and variables) of the module to be exported into the caller namespace.

@EXPORT_OK does export of symbols on demand basis.
"""

If this patch caused a conflict with a patch you wrote prior to its
push:
* Make sure you are not reintroducing a "use" statement that has been
removed
* "$subroutine" is not exported by the C4::$MODULE module
means that you need to add the subroutine to the @EXPORT_OK list
* Bareword "$subroutine" not allowed while "strict subs"
means that you didn't imported the subroutine from the module:
  - use $MODULE qw( $subroutine list );
You can also use the fully qualified namespace: C4::$MODULE::$subroutine

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-16 08:58:47 +02:00
Owen Leonard dffb3fede8 Bug 27873: Improve message consistency: checkout and patron detail pages
This patch creates a new include for showing circulation and
patron-related messages on both the checkout page and the patron detail
page. This allows the two pages to be consistent with each other.

The patch also makes some minor CSS adjustments, including the addition
of an SVG to replace an old GIF, arrow-bullet.gif.

To test, apply the patch and rebuild the staff interface CSS
(https://wiki.koha-community.org/wiki/Working_with_SCSS_in_the_OPAC_and_staff_client).

- View both the checkout and patron details page for patrons in the
  staff interface, confirming that the information is displayed in the
  same way, including:

  - Pending modifications
  - Pending expiration
  - Expired
  - Address in doubt
  - Card lost
  - Restricted (indefinite and with expiration)
  - Outstanding overdues
  - Outstanding return claims
  - Patron age incorrect for their category
  - Outstanding charges
  - Account credit
  - Waiting holds (at logged-in library or other library)
  - Circulation note (from borrowers.borrowernotes)
  - Messages (added at logged-in library or other library)

EDIT: Fixed merge error.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-12 15:47:34 +02:00
Julian Maurice a1bee1b210 Bug 26760: Escape URI parameters in redirect URI to paycollect.pl
Also remove useless '%.2f' formatting of amount and amountoutstanding

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-12 15:47:33 +02:00
Julian Maurice 3b99ebe032 Bug 26760: Redirect to paycollect.pl when clicking on "Save and pay"
Bug 14898 added the "Save and pay" button that redirects to "Make a
payment" tab after creating a manual invoice
This requires the user to click on another "Pay" button before being
taken to the real payment form.
By redirecting directly to paycollect.pl, this useless step will no
longer be needed.

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-07-12 15:47:33 +02:00
Jonathan Druart 41a8005d10 Bug 28606: Remove $DEBUG and $ENV{DEBUG}
We should remove the debug statements or use Koha::Logger when we want
to keep it.

Test plan:
Confirm that occurrences of remaining occurrences of DEBUG need to be
kept (historical scripts for instance)
Confirm that the occurrences removed by this patch can be removed
Confirm that the occurrences replaced by Koha::Logger are correct

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Looks good to me, noting a few minor points on BZ.

JD amended patch: replace "warn #Finished" with "#warn Finished", and
put the statement on a single line

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-06-24 11:53:44 +02:00
Jonathan Druart 3fe837bc74 Bug 28572: Remove C4::Debug
We are using Koha::Logger when it makes sense to keep the info,
otherwise we simply remove it

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Bug 28572: Replace missing occurrence in misc/admin/koha-preferences

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-06-22 12:04:32 +02:00
Jonathan Druart 6f204fdf96 Bug 28591: Don't pass debug to get_template_and_user
There is a "debug" parameter we are passing from the controller scripts
to C4::Auth::get_template_and_user, but it's not actually used!

Test plan:
Confirm the assumption
Review the changes from this patch

Generated with:
perl -p -i -e 's#\s*debug\s*=\>\s*(0|1),?\s*##gms' **/*.pl

git checkout misc/devel/update_dbix_class_files.pl # Wrong catch
+ Manual fix in acqui/neworderempty.pl

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-06-22 12:04:32 +02:00
Martin Renvoize 138fb47e1f Bug 15788: Use delete_borrowers permission
Link the new delete_borrowers sub-permission to the delete actions.

Test plan
1/ Remove the delete_borrowers permission from a staff user
2/ Check that the user cannot use the 'Delete' option from the members
menu.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-06-21 13:50:26 +02:00
Jonathan Druart a98759e3b7 Bug 18112: Use GetAuthValueDropbox from the template
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-05-11 15:37:42 +02:00
Martin Renvoize cff7ed4fd3 Bug 26734: Convert printfeercpt/printinvoice to use GetPreparedLetter
This patch updates C4::Letters to allow use of existing koha template
includes from notices, then updates the printfeercpt and printinvoice
slip print option to use GetPreparedLetter rather than calling getletter
directly.

As part of this work, we also add credits and debits handling to the
_parseletter_sth and _get_tt_params routines in C4::Letters to allow for
recognisable variable names in the notice template.

Test plan
1/ Update the ACCOUNT_CREDIT and ACCOUNT_DEBIT notices to use
'accounts.inc' include for account descriptions
1a/ Add `[% PROCESS 'accounts.inc' %]` to the top of the notice
1b/ Replace manual account descriptions with `[% PROCESS
account_type_description account=credit %]`
2/ Print one of each slip and check that descriptions are properly
substituted
3/ Clone the notice to another language
4/ Print the in the other language and note the translated descriptions
are properly substituted.
5/ Signoff

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-04-27 16:23:49 +02:00
Martin Renvoize 90d8667cf9 Bug 26734: Ratify account slip printing
This patch simplifies the members/print*.pl controller scripts to only
pass around the minimum required data for the templates.

Test plan
Slips should continue to print as they did prior to the patch
1/ Add a manual invoice and manual debit to a patrons account
2/ Print a slip for the manual invoice, compare to a printed slip prior
to the patch.
3/ Print a slip for the manual debit, compare to a printed slip prior to
the patch.
4/ Signoff.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2021-04-27 16:23:49 +02:00