When no item is available, with AllowHoldPolicyOverride, a triangle appears on
each item to be forced, but if you choose “next item available” without
having any item available, you won't see anything. Additionally, the top
warning message about "No items are available" does not show when
'AllowHoldPolicyOverride' is set to allow and no items are available
(e.g. withdrawn, lost, damanged, depending on settings)
This patch corrects an error in request.pl where no incrementation of
$num_override happens when an item is forced. This causes the warning
triangle to appear on the 'Place hold' button on the bib level. The top
warning message is restored as well.
Finally, this patch changes the display of the fa-warning-triangle icon on the
'Place hold' buttons to increase contrast with the button color, making it
easier to see and increasing accessibility.
Test plan:
1) Set circulations rules for specific category and/or itemtype (for example 1
hold allowed for staff on books). Set AllowHoldPolicyOverride on "Allow".
2) Search for a book biblio with multiple items, and set each item to a
non-circulating status (withdrawn, lost, etc.)
3) Place a hold for a staff category patron for this bib record.
4) Normally you will see triangles on each item on specific section but you can
force it. When you just select the next item available none triangle and
none alert showing.
5) Apply this patch and restart_all.
6) Refresh your browser page.
7) Normally now there is a triangle into 'Place hold' submit button and an
alert message appears on the top of the page. The triangle is also more
visible.
8) Test other hold limits, such as max holds per record, to ensure the
appropriate top alert message appears and the triangle alert appears on
the 'Place hold' button.
Co-authored-by: Thibaud Guillot <thibaud.guillot@biblibre.com>
Sponsored-by: BibLibre
Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1900effc9b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 9827914216)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The SIP server generates warnings when logging account information
for failed logins:
Use of uninitialized value $args[0] in sprintf at /kohadevbox/koha/C4/SIP/Sip.pm line 314
Use of uninitialized value $args[1] in sprintf at /kohadevbox/koha/C4/SIP/Sip.pm line 314
This occurs when $self->{account}->{id} or $self->{account}->{institution}
are undefined during failed authentication attempts.
This patch fixes the issue by:
1. Adding a safer sprintf implementation in siplog that handles undefined values
2. Providing default values for undefined account information in logging calls
To test:
1. Start SIP server
2. Attempt to connect with invalid credentials using sip_cli_emulator.pl:
./misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su invaliduser -sp wrongpass -l kohalibrary2 --patron koha -m patron_information
3. Check /var/log/koha/kohadev/sip-output.log
=> FAIL: 'Use of uninitialized value...' warns
4. Apply this patch
5. Repeat 2
=> SUCCESS: No "Use of uninitialized value" warnings appear
=> SUCCESS: Logging shows 'undef/undef' for failed logins instead of empty strings
6. Try a valid login
=> SUCCESS: Still works correctly for valid logins
7. Sign off :-D
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9cad25967d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 4e1cd02932)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1 - Tail the logs in a terminal:
tail -f /var/log/koha/kohadev/*.log
2 - Browse to Tools->IMport patrons
3 - Note warning when loading the page:
Use of uninitialized value $uploadborrowers in concatenation (.) or string at /kohadevbox/koha/tools/import_borrowers.pl line 105.
4 - Upload a patron file, under: Preserve existing borrowers
"If matching record is already in the borrowers table:" choose "Ignore..."
5 - Import the file
6 - Note an warning:
Use of uninitialized value $update_dateexpiry in string eq at /kohadevbox/koha/tools/import_borrowers.pl line 113.
7 - Apply patch, restart all
8 - Reload the tool
9 - Note no warning
10 - Upload the file again, same settings
11 - Note no warning
12 - Sign off!
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 58d14eccd0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 8c252eaa73)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The table global search didn't combine correctly with the status filters.
Test plan:
1. Have a patron with holds history
2. Go to members/holdshistory.pl?borrowernumber=x where x is the borrowernumber
3. Try to us the DT seacch to filter
=> Filtering is working as expected
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 088927aac1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 1ef30cc10c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change fixes the background jobs so that the list page loads
even when plugins are disabled.
Test plan:
0. Apply the patch
1. Download https://github.com/HKS3/koha-normalize-marc2db/releases/download/v0.91/Koha.Plugin.HKS3.NormalizeMARC2DB-0.91.kpz
2. Upload plugin into KTD
3. Click "Run tool" for plugin
4. Go to http://localhost:8081/cgi-bin/koha/admin/background_jobs.pl
5. Note that you see a pretty "Type"
6. Go to /etc/koha/sites/kohadev/koha-conf.xml and turn enable_plugins to 0
7. sudo koha-plack --restart kohadev
8. Go to http://localhost:8081/cgi-bin/koha/admin/background_jobs.pl
9. Note it now says "Unknown job type 'plugin_marc2db_normalizeall'
10. Celebrate as this is preferable to a 500 error
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6e3d0b1e48)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit eb862bd552)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Navigate to ERM agreements and create an agreement
2) In the agreements table, click on the filter for Is Perpetual
3) Only the option for 'Yes' will be shown
4) Apply patch
5) yarn js:build
6) Hard refresh the browser and repeat step 2
7) Filter options for Yes and No should be available
8) Check the filtering works appropriately
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5594945339)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit cf1464d290)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1 - apply patch
2 - make sure registers are enabled in system preferences so the permission shows
3 - find a patron, set permissions
4 - confirm the permission reads "Pefform refunds of point of sale transactions."
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 64702f4320)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 3d8a10a53b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch updates the terminology used in the overdue notice (ODUE)
to change 'branch' to 'library'.
Test plan:
1. Check the wording of the ODUE notice under Tools > Patrons and
circulation > Notices and slips.
2. Note that it includes this wording that uses 'branch':
"Please return or renew them at the branch below as soon as possible."
3. Apply the patch.
4. Check that the updated ODUE notice has changed 'branch' to 'library'
by either:
4.1 Resetting everything: reset_all
4.2 Viewing the default notice - click "View default" when viewing
the email notice
The updated text is now: "Please return or renew your overdue items
at the library as soon as possible."
5. Sign off.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4bd1bc0a6f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit b65e193871)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We are removing a wrong method name at the same time ;)
Test plan:
Read the patch. Just removing a few outdated POD lines.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 64b78fe3c4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 129012ff78)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Also corrects the alphabetic ordering for Calyx.
To test:
* Apply patch
* Go to About Koha: you can do so from the more menu or by clicking
on the version number in the bottom right corner
* Open the tab "Koha team"
* Scroll to the bottom of the page and verify that KIT and CLAMS show
up in the correct spot in the list of "Contributing companies and institutions"
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bead469858)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 717eee0fcf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds <span>s with classes around the patron's email and phone
information in the results of the overdues report. This will allow for
greater flexibility in styling or hiding the information.
To test, apply the patch and go to Administration -> Sytem preferences
-> IntranetUserCSS.
- Add this to the preference:
.overdue_email { color: red; }
.overdue_phone { color: blue; }
- Go to Circulation -> Overdues and confirm that you can see the custom
colors in the results.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b70a325dd2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 739c4fa01c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch revises the breadcrumbs in the staff interface lists template
so that the correct link is shown when editing or viewing a public list.
To test, apply the patch and go to Lists in the staff interface.
- Create a public list
- Go to the list of public lists
- Click to view your newly created public list
- The breadcrumb menu should show Lists -> Public lists -> Contents of
[list name]
- The link to public lists should work correctly.
- Perform the same check when editing your public list.
- Check the viewing and editing of a private list to make sure no
breadcrumb errors were introduced.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 38a8428a0a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 731119a287)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Have some orders that are late.
2. Go to the late orders page (
http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl )
3. Try to use the export function, nothing happens.
4. APPLY PATCH
5. Try steps 1 and 3 again, this time the export function should work.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cdf88e0237)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Decoded the barcode in add items to collection.
Test plan:
1. Go to Tools -> Rotating collections
2. Create a rotating collection
3. Chose Actions -> Manage items
4. Paste a barcode and put some spaces around it, for example " 39999000010053 "
5. Click Submit => Shown an error, no item with matching barcode found, though the barcode is printed without all the whitespace
6. Apply patch
7. Repeat steps 1 - 5, barcode should be accepted
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2c730040b1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 80a1810316)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes selection of a library when editing a desk in
Administration. The form should provide all libraries as options, not
just the currently selected one.
To test, apply the patch and go to Administration -> Desks.
- If necessary, create a new desk.
- Edit the desk. The form should load with the correct library prefilled
in the <select>, but should offer all libraries as a choices.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20085be7fb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit f94664313d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bootstrap 5 sets the "resize" property on textareas to "vertical." For
our purposes this is a regression in functionality and should be
overridden.
To test, apply the patch and rebuild OPAC and staff interface CSS.
- Log into the OPAC and go to the "Your personal details" page.
- Under "Alternate address" -> "Contact note," check that the textarea
can be freely resized.
- In the staff client, create a new patron and test the same textarea in
that form.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit df3e44b88b)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 694ff22961)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch improves the accessibility of the OPAC. It's a trivial patch
to help assistive technologies understand the different tables.
Test plan:
Enable the system preferences: OPACShelfBrowser, OPACPrivacy,
ShowComponentRecords.
1- On the Koha OPAC, Research a record.
2- Inspect the result page HTML and notice that there is a
role='presentation' in the table tag.
3- Choose a record with a Component section and inspect the HTML, there
should be a role='presentation' in the table tag.
4- Open the Browse shelf. Inspect the HTML and notice that there is a
role='presentation' in the table tag of the browse shelf.
5- Log in to a patron account, go to the Your Summary page, and choose
Privacy in the menu.
6- Inspect the HTML of the page and notice that there is a
role='presentation' in the table tag of the 'Immediate deletion'.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bc9dfb4b8e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 428d787526)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1 - Create a patron in a category that can be a guarantee and do not assign any guarantor
2 - Create a patron in a 'Child' account type and do not assign a guarantor
3 - Enable system preference 'ChildNeedsGuarantor'
4 - View 'Check out' and 'Details' tabs for both patrons, note there is no warning
5 - Apply patch
6 - Repeat 4, note warning on all pages
7 - Add a patron gaurantor on the child - repeat 4 - warning is gone
8 - Add non-patron guarantor information to other patron - repeat 4 - warning is gone
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a catch during circulatoin actions and passes a message back to the caller
For checkouts and renewals we don't have a method for passing messages so we simply catch the exception
and warn - this seems reasonable, as we have now added a warning on the patron display that they are missing
a guarantor
To test:
1 - Create a Child type patron with no guarantor
2 - Create a patron in a non-child category that can_be_guarantee with no guarantor
3 - Check out an item to each patron above
4 - Enable system preference 'ChildNeedsGuarantor' and TrackLastPatronActivityTriggers - select all
5 - In mysql
UPDATE borrowers SET datelastseen = '2025-01-01';
6 - Restart all to clear cache (so update last seen will update)
7 - Attempt to checkout a book to either patron - 500 error
8 - Attempt to returnt he books the patrons have checked out - 500 error
9 - Attempt to renew their items - 500 error
10 - Apply patches, restart all
11 - Repeat checkout, renewal, checkin
12 - On checkout and renewal there should be a warning on the patron page, but actions succeed with no additional problems
13 - On return you get a warning letting you know the action succeeded but there is still a problem to resolve
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Uncaught TypeError: col.data is undefined
This patch removes the ability to
* search by status
* search or sort by "last run"
But fix the JS error that will restore the other features
Test plan:
- Activate the ERMModule via the system preference
- Add at least one data provider
- In the list of data providers, type anything in the general search field on top
=> Confirm that you can use the different features of the table without
JS errors
Signed-off-by: Michaela <michaela.sieber@kit.edu>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bd52dab411)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 3396a46c28)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
01:18:38 koha_1 | # Failed test 'no warnings'
01:18:38 koha_1 | # at /usr/share/perl/5.38/Test/Builder.pm line 193.
01:18:38 koha_1 | # There were 6 warning(s)
01:18:38 koha_1 | # Previous test 4 '401 Unauthorized'
01:18:38 koha_1 | # Use of uninitialized value $aMask[1079] in bitwise xor (^) at /usr/share/perl5/GD/Barcode/QRcode.pm line 217.
01:18:38 koha_1 | # at /usr/share/perl5/GD/Barcode/QRcode.pm line 217.
jammy (22.04LTS) (perl): 1.15-7
noble (24.04LTS) (perl): 2.00-1
I guess it's fixed by
85e7911e65
But it is not released yet: version 2 is from September 2023 and commit from March 2024.
Test plan:
Install version 2 of GD::Barcode:
`cpanm GD::Barcode@2.0.0`
Run the tests
Without this patch the "no warnings" test fails
With this patch applied the tests pass
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fd6ceb6b24)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit ddf1b9dfe3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
* on the patron page click edit at the top, entered a preferred name, and hit save
* we should see the preferred name being displayed instead of the first name for the user
* go back to the main edit page and change the preferred name to a blank space
* We should revert back to the first name being used
* if we open the edit page back up we should see the first name in the preferred name field
* Edit the preferred name again and click on details
* open up any of the sections other then contact information
* hit the save button on the section without changing anything
* you should still see the preferred name you set being used.
* open up an individual section other then contact method, change a value, then save
* you should still see the preferred name you set being used.
* open up the contact information section and save without changing anything
* the preferred name should be intact
* open up the contact information and change the preferred name, and save.
* you should see the new preferred name reflected.
* Open up the contact information section, change the preferred name field to a blank and save.
* you should see the first name being used now.
* Open up the contact information section, and put any number of spaces in the preferred name with nothing else and then save.
* you should still see the first name being used.
Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4356c14d29)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit bdefe52d46)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The patron search modal in the patron card creator -> new batch ->
patron search has two select2 modals, sort1 and sort2. If these are not
anchored to the modal they will be anchored to the body element and
appear behind the modal.
To test, apply the patch and go to Tools -> Patron card creator -> New
-> Card batch.
- Click "Add patron(s)"
- Test the "Sort 1" and "Sort 2" dropdowns. They should work correctly.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 20313df192)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 4afb657fe8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds an ID to the "Skip bibliographic records with open
acquisition orders" checkbox on the batch record deletion page (Cataloging >
Batch editing > Batch record deletion".
This is required so that when selecting or unselecting the checkbox, the focus
remains on the checkbox.
Test plan:
1. Navigate to Home > Cataloging > Batch record deletion
2. Click 'Skip bibliographic records with open acquisition orders' to toggle
the Record type checkbox (selected by default).
3. Inspect the page (right click the page, select Inspect, and look at the
values in the checheckbox input field):
. before the patch there is no id for the field
. after the patch there is an id="skip_open_orders" for the checkbox field
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b3666a7233)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 4038fcb6e0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
After changes to about.pl the checking of the Zebra status has landed
in "sysinfo" section instead of "about". As a result "Zebra status"
always reports "Running" even if Zebra is off.
Test plan:
==========
1. Turn zebra server off (koha-zebra --stop kohadev) and check in
"Server information" (More > About Koha) the "Zebra status" info.
You will see "Running".
2. Apply the patch ; restart_all ; koha-zebra --stop kohadev
3. Check "Zebra status" in "Server information". You should see now:
"Zebra server seems not to be available. Is it started?".
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1835ced4c0)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 35267ecfa8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch add support for AuthorLinkSortBy and AuthorLinkSortOrder in
the default UNIMARC XSLT files.
The description of the syspref is also slighly updated to hint users of
custom XSLT file about the need to update their template.
To test:
0. On a UNIMARC database
1. Set AuthorLinkSortBy to 'title' and AuthorLinkSortORder to
'descending'
2. On the intranet and OPAC, search for an author you have multiple
titles from and click on a result
3. Click on a link one a name for an author
4. Note a new search is performed, sorted by field from defaultSortField
preference and not by title descending
5. Apply the patch
6. restart_all
7. Check that the syspref description now include a note about custom
XSLT files
8. Repeat step 2 and 3
9. Note a new search is performed, sorted by title descending
10. Test other values - confirm links are updated in both staff and opac
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4581e399bb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit fa9279644a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch corrects a couple of templates which include a Bootstrap
popover component, updating the data attributes which were missed during
the BS5 upgrade.
The patch also makes a minor change to CSS in order for the popover
heading to not have unwanted margins.
To test, apply the patch and rebuild the staff interface CSS.
- Perform a catalog search in the staff interface.
- Add one or more items to the cart.
- Open the cart and hover your cursor over the "Items" heading. A
popover should be triggered with a message about item sorting.
- Go to Administration -> Circulation and Fine rules.
- Edit a rule to add content to the "Note" field.
- Save the rule and then hover your cursor over the "View note" text.
The note you added should appear in a popover.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eb1e00455e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit c0f86a7598)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch fixes the column span in the table footer rows of the account
payment page (pay.tt). I've also added a couple of lines of CSS to style
the footer rows.
To test, apply the patch and rebuild the staff interface CSS.
- In the staff client, locate a patron with charges.
- If necessary, go to a patrons "Accounting" tab and use the "Create
manual invoice" page to add one or more charges to the account.
- Under the "Make a payment" tab there should be one or more footer rows
including "Total due." The "Total due" cell should be aligned right,
with a grey background.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 92c6516651)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.
Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
- Koha::Patrons::Import
- Koha::BackgroundJob::ImportKBARTFile
- Koha::ERM::EUsage::CounterFile
The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.
Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data
To test:
1. Apply the previous patch (author test)
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
- Koha/BackgroundJob/ImportKBARTFile.pm
- Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.
Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
- Koha::Patrons::Import
The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.
Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data
To test:
1. Apply the previous patch (author test)
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 1 file without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This patch fixes a XSS vulnerability in the
suspend hold modal in the staff interface.
By building our Javascript using Web APIs rather
than with strings and jQuery's html() method,
we're able to securely handle malicious payloads.
Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=29
2. Add a hold for "koha" patron
3. Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
4. Click "Holds" tab and click "Suspend"
5. Note the modal loads properly
6. Go to http://localhost:8081/cgi-bin/koha/members/moremember.pl?borrowernumber=51
7. Click "Holds" tab and click "Suspend"
8. Note the modal loads properly
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 40538: Simplify code
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
See also comment33, point 4.
Test plan:
cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/
Test enabling/disabling by toggling the comment of the SetEnvIf line,
restart apache and remove the KOHA_INIT and CGISESSID cookie.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This patch adds a fast simple bot challenge via Apache.
To test:
0. Apply the patch
1. sudo cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/.
2. sudo cp debian/templates/apache-shared-opac-plack.conf /etc/koha/.
3. curl http://localhost:8080/cgi-bin/koha/opac-search.pl
4. Note an instant response with a very simple HTML response
5. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-search.pl
6. Note a very brief loading animation before the OPAC search page appearing
7. Do a search
8. Note no more loading animation appears
9. Close the incognito browser
10. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-main.pl
11. Do a search via the "Library catalog" search bar
12. Note no loading animation appears
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Cornelius Hertfelder <cornelius.hertfelder@bsz-bw.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
We have tested this in production on at least three live sites for
several weeks, and it has worked as expected. We have not noticed any
negative side effects.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This patch changes the script to use 'Koha::PseudonymizedTransaction->new_from_statistic' directly
rather than calling 'Koha::Statistic->pseudonymize()' which generates a background job.
Additionally, some of the checks from 'pseudonymnize' and the background job are moved into the search
so we don't fetch any to pseudonymize that should not be.
To test:
1 - Generate some entries in statistics (checkin, checkout, renew, etc)
2 - Enable pseudonymization (see bug 28911 if you need bcrypt settings)
3 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
4 - Statistics pseudonymized
5 - Check the background jobs table, note jobs were generated
6 - Apply patch
7 - perl misc/maintenance/pseudonymize_statistics.pl -v -c
8 - You get same count as before, and are warned of existing pseudonymized transactions
9 - enter 'Y' to continue
10 - Check the pseudonymized_transacations table
11 - Confirm same rows were generated twice
12 - Check the background jobs
13 - Confirm there were no new jobs generated (for pseudonymization)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 342c1d5993)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The koha-mysql didn't work when the instance was set up to use an encrypted
database connection.
Please note: this testplan is for ktd, not for a production environment!
Unfortunately, there are some issues with the database TLS configuration in koha-testing-docker.
This is described comment 14 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c14)
As a workaround, you can add "mysql_ssl_optional=1" in Koha/Database.pm.
See point (g) in comment 15 of bug 36026 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c15)
Testing Database Connection Encryption:
1. Apply the patch.
2. Configure koha-conf.xml to use a TLS connection
(see comment 10 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026#c10, follow steps 3a-g + 4 )
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the encryption settings in the MySQL console:
- run:
SHOW VARIABLES LIKE '%ssl%';
- run:
STATUS;
Ensure that the following conditions are met:
- have_openssl and have_ssl are set to "YES".
- The SSL cipher in use is displayed.
Testing MySQL Timezone Configuration:
1. Apply the patch.
2. Configure the timezone in koha-conf.xml, for example:
<timezone>Antarctica/South_Pole</timezone>
3. Run:
koha-mysql <koha_instance>
4. Verify that the MySQL console opens successfully.
5. Check the timezone setting in the MySQL console by running:
SELECT @@session.time_zone;
6. Confirm that the output matches the timezone configured in koha-conf.xml.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 42ec5d36c2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We do not need 1 or 0 here btw. We just check for true.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 663830d9ed)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Set up a user with only catalogue and edit_items permissions
2. Create a Fast Add record with item
a. Go to Cataloging
b. Click on Fast Cataloging
c. Fill in mandatory fields and save the record
d. Fill in mandatory item fields and click Add item
3. Log in as the user you set up in step 1
4. Search for the record you created in step 2
5. Click Edit > Manage items in the menu at the top of the record
==> You do not have permission to access this page!
6. Go back to biblio record page
7. Apply patch and restart_all
8. Click Edit > Manage items again
==> Edit items page loads normally
9. Make a few edits and confirm that they save correctly
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6bfcd23bdb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1. Go to Administration > MARC Bibliographic framework
2. On the right side of the default framework, click on "Actions" >
"MARC Structure"
3. Search for field 780
4. Click on "Actions" > "Edit subfields"
5. Click on the "t" tab
6. Check "Editor" under the "Visibility" section
7. Click on "Save Changes"
8. Repeat steps 1 to 7 for field 785$t
9. Have or create a record with a value for 780 and 785 with the first
indicator at 0 and the other left empty
10. Look at the record on the staff interface and the OPAC
11. Notice that in Normal View, the values entered for 780 and 785 do
not have labels
12. Apply the patch
13. There are now labels in the staff interface and the OPAC
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ba2ec1d202)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
CJ Lynce
Tomas Cohen Arazi
Nick Clemens
Jonathan Druart
David Cook
Matt Blenkinsop
Andrew Fuerste Henry
Courtney Brown
Marcel de Rooy
Katrin Fischer
Fridolin Somers
Owen Leonard
Emily Lamancusa
Lucas Gass
Yvonne Waterman
nina martinez
Imani Thomas
Michael Hafen
Aman Pilgrim
Janusz Kaczmarek
Marion Durand
Pedro Amorim
Mason James
Baptiste Wojtkowski
Lukas Koszyk
William Lavoie