It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.
For example, using the demo instance:
1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22
2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).
3. Click any result.
Note that the result page now contains:
<a href="opac-search.pl?idx=&q=test&weight_search=1&">test<a foo=%22" title="...
i.e. `">test<a ...` was successfully injected into the HTML.
I'm attaching a quick patch I've used to patch up our instance. It just indiscriminately URI-escapes all parameter keys. I didn't decode them back since as far as I understand all valid keys do not contain special characters.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 863d8fed15)
Signed-off-by: danyonsewell <danyonsewell@catalyst.net.nz>
Resolve:
Can't call method "borrowernumber" on an undefined value at /usr/share/koha/opac/opac-illrequests.pl line 66
Test plan:
Put an unexisting illrequest_id in the URL parameter.
You should see a 404, not a crash.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Same as previous patch, but for 'update' and 'cancreq'.
We remove the redirect, but here we only want to focus on the security
fix.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Confirmed. Without this patch a patron can modify and cancel any ILL
request in the OPAC. With this patch the patron is redirected to the
404 page if modification or cancellation is attempted.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
To reproduce:
- Enable the ILL module
- Install the FreeForm backend as described here:
https://wiki.koha-community.org/wiki/ILL_backends
- Go to the ILL module and add two different ILL requests by
clicking on "New ILL request" and entering the necessary details.
- Make sure you connect the two requests to two *different* patrons
in the field marked "Card number, username or surname"
- Make the two titles different, and make a not of which title is
connected to which patron
- Log in as one of the two patrons who now have an ILL request each,
in the OPAC
- Go to the "Interlibrary loan requests" tab
- Click on "View" for the request connected to this patron. The URL
will look like something like this:
http://<opac>/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=2
- Now change the number at the end to correspond to the the ILL request
connected to the *other* patron
- Verify you can see the details of an ILL request conncted to another
patron than the patron you are logged in as
To test:
- Apply the patch
- Restart all the things if you are testing with ktd
- Reload the detail view of the ILL request that belongs to the patron
you are not logged in as
- Verify you are redirect to the 404 page and can not see the details
of the request that belongs to the patron you are not logged in as
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 9b231d0d5b)
Signed-off-by: Jacob O'Mara <jacobomara901@gmail.com>
(cherry picked from commit 52056bf4ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f5964148d3)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
When creating a suggestion for an existing biblio, biblio info like
title or author should not be editable.
Test plan:
1. Enable system preference 'suggestion'
2. Log in at OPAC
3. Go to a biblio record detail page
4. Click 'suggest for purchase'
5. Notice that all fields can be modified (title, author, ...)
6. Apply patch
7. Repeat steps 2 and 3 or refresh the page
8. Verify that the biblio fields cannot be modified now. The only fields
that should be editable are: quantity, item type, library, reason for
suggestion, and notes
Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d96393a52a)
Signed-off-by: Jacob O'Mara <jacobomara901@gmail.com>
(cherry picked from commit ca33ff04d6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b7e86347e6)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch sends out opac-search.osdx without running the entirety
of opac-search.pl without any search query.
This prevents unnecessary computations and warnings from appearing
in the logs.
Test plan:
1. Apply patch
2. Go to
http://kohadev.myDNSname.org:8080/cgi-bin/koha/opac-search.pl?format=opensearchdescription
3. Note that no errors appear in
/var/log/koha/kohadev/plack-opac-error.log
4. Verify that opac-search.pl still works as expected when
doing a search via the web UI
Signed-off-by: David Nind <david@davidnind.com>
JD Amended patch: remove ref to bug number, we use git!
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0cf434b7a2)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
(cherry picked from commit 9e4bf2945d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 19972170f1)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
To make it displayed correctly depending on the configuration of the
currency
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c6366c6d68)
Signed-off-by: Jacob O'Mara <jacob.omara@ptfs-europe.com>
(cherry picked from commit ae4e269b7b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 06d09180e6)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
Test plan:
1. Under administration and system preferences, enable WebBasedSelfCheck
2. In OPAC give user fine by going to 'my account' at top right
3. Then under fines tab 'create manual invoice'
4. Make sure this amount is more than noissuescharge which can be
changed under system preferences
5. Go to the web based self check from the OPAC URL
6. Log in as your user
7. Try to check out an item
7. Error 'Item cannot be checked out' should occur
8. With the patch, the currency symbol should show for the amount.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5eab08cc2e)
Signed-off-by: Jacob O'Mara <jacob.omara@ptfs-europe.com>
(cherry picked from commit 13f7ee3e93)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 32a589f7aa)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch just removes two redundant use directives in opac-memberentry.pl
Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6c893f7372)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit af0057ae32)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch trims whitespace off tracklinks.pl URLs so that
the URL is in the same format as the URLs returned by
C4::Biblio::GetMarcUrls, which is used by tracklinks.pl internally.
Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29
2. Add a 856 with $u of 'https://koha-community.org ' (note the space at the end0
3. Save record
4. Change 'TrackClicks' syspref to 'Track'
5. Go to http://localhost:8080/cgi-bin/koha/opac-detail.pl?biblionumber=29
6. Click on the online resource (eg
http://localhost:8080/cgi-bin/koha/tracklinks.pl?uri=https%3A%2F%2Fkoha-community.org%20&biblionumber=29
)
7. Note you are redirected to https://koha-community.org
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Added the link with a space at the end. Verified that without the
patch, clickin on "Click here to access online" gives a 404. After
applying the patch the redirect works as expected.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5fe49c7db1)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 088139a89e)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
We are sanitizing other attributes but "extended patron attributes".
Test plan:
Make a patron attribute editable at the OPAC
Edit an existing patron, or register a new one
Use a script tag in the new value ("<script>alert("booh!")</script>" for
instance)
With this patch the value is remove if containing an HTML tag that is
not br b i em big small strong (see C4::Scrubber)
Signed-off-by: Mark Hofstetter <koha@trust-box.at>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cf773c9f1c)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch adds an explanation when a hold cannot be placed, in some situation:
tooManyReserves
tooManyHoldsForThisRecord
tooManyReservesToday
itemAlreadyOnHold
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0198560543)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e1caed6c63)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
Before this patch the date formatting for the due date was done
in the .pl instead of the template and the branchcode would show
instead of the library's name in the list of items when placing
an item level hold in the OPAC.
To test:
* Find or create a record with mulitple items
* Check out one of the items
* Place a record level hold
* Return an item to set to waiting
* Place an item level hold
* Go to the OPAC and start placing an item level hold
* Verify the messages in the item table show the branchcode
* Apply patch
* Only visible change should be the library name replacing the branchcode
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2353893c1a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7459cbd399)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch does a second search if the first had no results and was a simple single term search
We simply quote the term, rebuild the query, and rerun the search
This targets both Zebra and ES, but is more relevant for ES
To test:
0 - Have Koha running using ES
1 - Add titles your system "Ivy + Bean" "The 6:20 Man"
2 - Search for these titles without quotes - NO results under ES
3 - Search with quotes - you find them
4 - Apply patch, restart all
5 - Search again without quotes
6 - Success!
7 - Confirm search still works under Zebra
Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2ce5f0532c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e1500c7c6b)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
We should not test the $hidingrules variable but the number
of keys it contains.
Test plan:
Clear OpacHiddenItems.
Check with and without this patch search result numbering on
the OPAC.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d7647052f2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b8f34e1acc)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
To test:
1/ Add 'Email' to the 'SMSSendDriver' system preference.
2/ Make sure 'EnhancedMessagingPreferencesOPAC' and 'EnhancedMessagingPreferences' are turned on.
3/ Add some SMS providers (/cgi-bin/koha/admin/sms_providers.pl) with different names.
4/ Notice on memberentry.pl and opac-messaging.pl the SMS providers sort by when they were added, not alphabetically.
5/ Apply patch and restart services.
6/ Look at memberentry.pl and opac-messaging.pl and notice that they SMS providers now sort alphabetically.
Signed-off-by: George Williams <george@nekls.org
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fd49601079)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 35b8967b84)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
This patch does the absolute bare minimum to prevent private notes from
appearing on the OPAC.
Test plan
1. Go to Koha Administration -> Koha bibliographic frameworks
2. View the MARC structure for your BKS framework (or something else)
3. Search for tag 583, edit subfields
4. Go to subfield 'x' - nonpublic note. Confirm the OPAC visibility
checkbox is UNCHECKED.
5. Edit or create a record using the BKS framework. Put a note in the
583$x.
6. View this record in the OPAC
7. Go to the Title notes tab. Confirm the non-public note is
showing, even though the framework says it should not be
visible via the OPAC.
8. Apply patch
9. Confirm the non-public note is no longer visible
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 0efae9ed05)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2ad8c15dbf)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
The current situation is that biblio-level holds can be assigned an item
type, so they can only be fulfilled by items matching that specified
item type (be it item-level itype or the fallback to biblio-level).
But there's the situation in which max holds limits for a specific item
type can be overridden by using biblio-level holds with item type
selection (AllowHoldItemTypeSelection) enabled.
To test:
1. Have a patron of category 'Staff' (S)
2. Have 3 records with items with the 'BK' item type, and maybe others
3. Enable AllowHoldItemTypeSelection
4. Set a limit of 2 max holds for that category+item type
5. In the OPAC. Place bibio-level holds, with item type contraint to 'BK' on those 3 records
=> FAIL: You can place the 3 holds
6. Cancel the holds
7. Apply this patch and restart all
8. Repeat 5
=> SUCCESS: You can only place 2 holds
9. Run:
$ kshell t/db_dependent/Reserves.t
=> SUCCESS: Tests pass!
10. Sign off :-D
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit cc40bbf195)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 55fc22117f)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
When viewing the detail page of the first or last record of a result page,
it's not possible to browse to another page when using Elasticsearch.
To test:
1) Search for "*" in the OPAC
2) Click on the last result of the page
3) Observe that you cannot browse to the next page
4) Apply the patch
5) Search for "*" in the OPAC
6) Click on the last result of the page
7) Observe that you can browse to the next page
8) Sign off
Sponsored-by: Lund University Library
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 71f54a7571)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a07e38eb1b)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
We got
Can't call method "value" on unblessed reference at /kohadevbox/koha/opac/opac-messaging.pl line 86
$cookie can be an arrayref, we should retrieve the session id using
CGI->cookie('CGISESSID')
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This alters the svc scripts to set the report id after fetchign the report object
to ensure it is passed to exectue query
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The last run of a report is updated only if method execute_query() is
called with report_id.
This whas missing for :
- when report is run publicly
- when report is sent by email
- when report is exported
Patch changes the method signature to use a hash of params, in order to
easily avoid some params.
Test plan :
1) Create a report.
2) Run report.
3) Check the report listing. Confirm that the last run info on the report is updated.
4) Make report public.
5) Run report via public url.
6) Check the report listing. Confirm that the last run info on the report IS NOT updated.
7) Schedule the report to run at a given time and e-mailed to an address.
8) After the report runs at the scheduled time, check the report listing. Confirm that the last run info on the report IS NOT updated.
9) Run report.
10) Export results.
11) Check the report listing. Confirm that the last run info on the report IS NOT updated AT THE TIME OF THE EXPORT.
Questionable (I don't know if this is addressed):
12) Run report on backend through a cron job and send results via e-mail.
13) Check the report listing. Confirm that the last run info on the report IS NOT updated.
14) Apply patch.
15) Rerun steps 2-13. Confirm that steps 3, 6, 8, 11, and 13 DO UPDATE the last run info.
Signed-off-by: Séverine Queune <severine.queune@bulac.fr>
Signed-off-by: Séverine Queune <severine.queune@bulac.fr>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Trivial fix.
Test plan:
Delete two lines from opac search history.
Verify results. Check plack-opac-error.log.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This is a follow-up patch for bug 29543. If an invalid cardnumber has
been used we should not generate a token.
Test Plan:
1. Set SelfCheckoutByLogin to 'cardnumber'.
2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
3. Enter an invalid carnumber like 'thisisabadcardnumber'
4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again."
5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber.
6. Apply this patch
7. Restart all the things!
8. Repeat steps 2-4
9. Try again with a different cardnumber, you should now see the correct
cardnumber!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch adds the ACCTDETAILS notice trigger to the opac self
registration process. Allowing new users, with varification enabled,
to receive the ACCTDETAILS notice immediately after their account is
varified.
Test plan
1) Enable AutoEmailOpacUser system preference
2) Ensure the ACCTDETAILS notice is configured
3) Ensure `PatronSelfRegistrationVerifyByEmail` is enabled
4) Register a new user via the opac self registration process using an
email address you have access to
5) Verify the user by following the link in the verification email you
should have received.
6) The new user should have been created and you should be able to see
the account details notice in their associated notices
7) Confirm that the email address used above has received the notice.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch adds the ACCTDETAILS notice trigger to the opac self
registration process. Allowing new users, without varification enabled,
to receive the ACCTDETAILS notice immediately after their account is
created.
Test plan
1) Enable AutoEmailOpacUser system preference
2) Ensure the ACCTDETAILS notice is configured
3) Ensure `PatronSelfRegistrationVerifyByEmail` is disabled
4) Register a new user via the opac self registration process using an
email address you have access to
5) The new user should have been created and you should be able to see
the account details notice in their associated notices
6) Confirm that the email address used above has received the notice.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
On the ktd sample database when trying to go to the detail page from the result list:
Undefined subroutine &CGI::Compile::ROOT::kohadevbox_koha_opac_opac_2ddetail_2epl::searchResults called at /kohadevbox/koha/opac/opac-detail.pl line 260
Turning off OpacBrowseResults makes the error disappear.
In opac-detail.pl, use C4::Search is missing searchResults and getRecords
To test:
- Search for something that gives several result pages in OPAC, example: e
- Switch to one of the last pages using link on top of results, example: 10
- Open any of the records listed in detail view
- Verify that the error is shown
- Apply patch and repeat, error is gone and browsing behaves as expected
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a 'holdable' and 'unholdable' class to the rows of the table
Additionally I rename the 'backgroundcolor' field to 'onloan' as that is what it contains.
Note: Out of the box, there is no css associated with this class
I add a div around the table to allow hiding the new buttons as well when optiuons are hidden
It would be nice in the future to utilise a Koha table here, however, it is complicated by multi-holds
To test:
1 - Add a number of items to a record, ensuring they belong to different libraries
2 - Set 'Default checkout, hold and return policy'->'Hold policy' to 'From home library'
3 - Sign in to opac and attempt to placehold on the record
4 - Click 'show more options' and 'a specificitem'
5 - Note holds table includes items that cannot be held
6 - Apply patch
7 - Reload holds page
8 - Note items that cannot be heldare hidden
9 - Click 'Show unholdable items' and note they appear
10 - Click 'Hide unholdable items' and veriofy they hide
11 - Test with multi holds
Signed-off-by: The Minh Luong <the-minh.luong@inlibro.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Test plan:
Logout in OPAC.
Goto sco help page.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Certainly since bug 29543 and bug 29914.
We should do the same authentication check than sco-main.pl, and also
make sure to generate the checkout history only for the logged in patron
(the OPAC one, not staff member)
Test plan:
Use the different combinations of the SCO config (AutoSelfCheckAllowed,
SelfCheckoutByLogin and WebBasedSelfCheck) and confirm that this patch
fixes the SCO print slip feature.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Although less harmful indeed. No borrowernumber, no image.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested: logged in, logged out, prefs toggled. All fine.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch updates the call to overdrive_proxy to allow passing a version
and updates the code to use V2 for availability
To test:
1 - Enable OverDrive integration by setting the sysprefs
2 - Log in to your overdrive account in the Koha opac
3 - Perform a search and note availability display
4 - Confirm you can checkout/hold/return books
5 - Apply patch
6 - Repeat search and test functionality
7 - Note that title with '0 out of 0 copies available' now say 'Currently unavailable'
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This patch modifies the checkout_download_url routine in
WebSerivce::ILS::OverDrive::Patron
We now directly hit the fulfillment endpoint with redirects disabled
and fetch the URL
The overdrive.js is modified to use a single 'Get item' button for all
checked out items and to refer to the fulfillment page
To test:
1 - Enable all OverDrive system preferences
2 - Search on opac and confirm OD results returned
3 - Checkout an item
4 - Confirm you have the new 'Get item' button on 'OverDrive account'
tab on opac-user.pl
5 - Confirm the 'Get item' button works
NOTE:
Most items will also show the 'Get item' button in results, however,
magazines may not as each checkout has a unique 'reserve id' and the
'parent' id is not checked in our current code
Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
We should not explode if the biblionumber passed in not in DB.
Test plan:
Hit /cgi-bin/koha/opac-reserve.pl?biblionumber=42424
and notice the error message.
Without this patch you got
Can't call method "holds" on an undefined value at
/kohadevbox/koha/opac/opac-reserve.pl line 172
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The crash is a result of a not found borrower. This is typically
a bad or repeated recovery attempt.
Test plan:
Do a password recovery.
Use the mailed URL twice.
Without this patch, the second attempt crashes.
With this patch, the second attempt shows an error dialog.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
I think this is a better approach for the same thing. Posting it just in
case it helps.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
We must check if logged in user is trying to modify one of their
checkouts
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Checkin or renew must be restricted to the items they own.
Test plan:
Create an item with barcode bc_1
Check it in to user A
Login to SCO with user B
Get the token using the browser dev tool, from the cookie
Hit (replace $JWT)
/cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=renew&barcode=bc_1
/cgi-bin/koha/sco/sco-main.pl?jwt=$JWT&op=returnbook&barcode=bc_1
You should see an error message
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
The self-checkout feature is assuming a patron is logged in if patronid
is passed. It also assumes that "We're in a controlled environment; we
trust the user", which is terribly wrong!
This patch is suggesting to generate a JSON Web Token (JWT) to store in
a cookie and only allow action (renew, check in/out) is the token is
valid. The token is only generated once the user has been authenticated
And is removed when the user finish the session/logout.
Test plan:
You must know exactly how the self-checkout feature works to test this patch.
The 4 following sysprefs must be tested:
SelfCheckoutByLogin, AutoSelfCheckAllowed, AutoSelfCheckID, AutoSelfCheckPass
Confirm that you can renew, checkin for the items you own, and checkout new items.
Confirm that you are not allowed to access other account's info.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
It's not used in template
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
It's not needed, we have $patron
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Michał Górny
Marcel de Rooy
Jonathan Druart
Magnus Enger
Nick Clemens
jeremy breuillard
David Cook
Jenny Way
Katrin Fischer
Lucas Gass
Martin Renvoize
Tomas Cohen Arazi
Kevin Carnes
Fridolin Somers
Kyle Hall