Commit Graph

58829 Commits

Author SHA1 Message Date
Laura_Escamilla 5ecdbcae32
Bug 40886: Ensure patron messages display in proper chronological order
1. Create several random patron circ messages with different dates. I used the following sql for my ktd:
    -- INSERT INTO messages (borrowernumber, branchcode, message_type, message, message_date)
SELECT
    51 AS borrowernumber,
    'CPL' AS branchcode,
    ELT(FLOOR(1 + (RAND() * 3)), 'L','B','E') AS message_type,  -- L=Staff note, B=OPAC, E=Email (adjust to your codes)
    CONCAT('Random test message ', FLOOR(RAND()*1000)) AS message,
    DATE_ADD(CURDATE(), INTERVAL -FLOOR(RAND() * 1825) DAY) AS message_date  -- random day in last ~5 years (5*365)
FROM (
    SELECT 1 UNION ALL SELECT 2 UNION ALL SELECT 3 UNION ALL SELECT 4 UNION ALL SELECT 5
    UNION ALL SELECT 6 UNION ALL SELECT 7 UNION ALL SELECT 8 UNION ALL SELECT 9 UNION ALL SELECT 10
) AS x;

2. View the patron account and notice that messages are sorted by type, but not by date.
3. Apply the patch and restart_all
4. Refresh the patron account page and clear the browser cache if necessary.
5. View the patron account again and notice that the messages are still sorted by type, but they are also sorted in descending order (newest to oldest).
6. Sign off and have a great day!

Signed-off-by: Jen Tormey <jntormey@dmpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7be401fcbd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:48 +02:00
Lucas Gass 815019cc6c
Bug 40916: Fix another occurance
Signed-off-by: Michelle <mspinney@clamsnet.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ac80486f2e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:48 +02:00
Lucas Gass a7174af564
Bug 40916: Fix evaluation when editing a list
1. Create a list
2. Sort this list by: title
3. Save
4. Edit the list, changing the the "Sort this list by:" to copyrightdate
5. Try to edit it again to any other type of sort. Save
6. Look again, it is reverted to copyrightdate
7. APPLY PATCH, restart_all
8. Now when you edit the list any value you use in "Sort this list by:" should be retained.

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 83159051fe)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:47 +02:00
Lucas Gass 76dc30fd67
Bug 40655: Fix logic of adding the disabled class
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d6e5ee20b1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:47 +02:00
Emily Lamancusa ae48a61747
Bug 40888: Fix op drop-downs in advanced search
To test:
1. Go to the Advanced search page
2. Click "More options"
--> Note that the first line in the "Search" section has a drop-down for
    operation (and/or/not), but subsequent lines do not. It should be
    the other way around. Also, the alignment is strange.
3. Apply patch and refresh page
--> All lines except for the first line now have an op drop-down, and
    the alignment looks correct.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d42ce0a368)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:46 +02:00
Laura_Escamilla 9b4891ea2f
Bug 40897: Resized the field lengths to ensure even lengths
To test:
1. Select an existing record and manage items (or create a new record) so that you are on the additem.pl form.
2. Notice that the fields are uneven lengths.
3. Apply the patch. Do a yarn build and restart_all. Clear your browser cache if necessary.
4. Refresh the additem.pl page and notice that the fields are all the same length now.
5. Sign off and have a great day!

Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 932c1c07dd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:46 +02:00
Arthur Suzuki bcaebee9fc
Bug 40904: Fix item search by shelving location on catalogue/details.pl
Test plan :
- before patch on ktd, go to http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=155
- in the holdings table search for "general" like "General Stacks".
- see that no items appear
- apply patch
- repeat the search
- all items appear now.

Signed-off-by: Mathieu <mathsabypro@gmail.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7e4f2f7c29)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:45 +02:00
Marcel de Rooy 79c93d7a3d
Bug 40929: Add $hold test in opac-modrequest
Test plan:
Login at OPAC.
Pass an unexisting reserve_id in a opac-modrequest.pl URL.
Verify that you get a 403 redirect.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 013a469b45)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:45 +02:00
Lucas Gass 91a6481ab1
Bug 40908: Remove JS confirmation, fix link, fix modal
To test:
1. Without the patch:

-Clicking delete from the Actions button -> delete pops up both a JS alert and a BS confirmation modal. The deletion works.

-Clicking the "Delete item" button that appears when you hover over any cell pops up both a JS alert and a BS confirmation modal. The deletion does NOT work.

-The "Cancel" button in the delete-item-modal does nothing.

2. APPLY THE PATCH:

-Clicking delete from the Actions button -> 1 modal for confirmation. The deletion works.

-Clicking the "Delete item" button that appears when you hover over any cell pops up only a modal confirmation. The deletion works.

-The "Cancel" button in the delete-item-modal properly closes the modal.

Signed-off-by: Jason <jvasche@roundrocktexas.gov>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 51f2b5e12d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:45 +02:00
Pedro Amorim ded9e8584d
Bug 40171: Add tests
prove t/db_dependent/Koha/ILL/Requests.t

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 46ffd07b85)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:44 +02:00
Jonathan Druart 77a78121f2
Bug 40320: Use insertSamplePatron
On
  commit 959b7e8f05
  Bug 40345: Add insertSamplePatron

We remove the ability to insert a patron using insertObject, we need to
use insertSamplePatron instead.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit be0dd91c41)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:44 +02:00
Jonathan Druart c1bd4858a7
Bug 40320: (bug 40319 follow-up) Add Cypress tests
Test plan:
Make sure the display of city, state and zipcode is the same as before
the patch
Confirm that the new Cypress tests pass

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Amended-by: Jonathan Druart
Added $raw filter to [% ", " %]

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 67e04b039a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:43 +02:00
Matt Blenkinsop 2cdbf324c4
Bug 40868: Restore full list of permissions to the vendors app
This patch adjusts the logic to consider all permissions and not just the top level flags

Test plan:
1) Create or edit a user to have all acquisitions permissions except one (not relevant which one, any will do)
2) Log into the staff interface and go to acquisitions > vendors and click the vendor in the table
3) The left menu will be missing everything except invoices
4) Apply patch and restart_all
5) Refresh the page, the menu should now be populated

Signed-off-by: Michaela Sieber <michaela.sieber@kit.edu>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 23fe21df61)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:43 +02:00
Jonathan Druart 316c59c3e3
Bug 40467: Remove t/00-deprecated.t
it only tests for the presence of "switch"

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d996664353)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:42 +02:00
Marcel de Rooy eb8b5e60cb
Bug 40605: Copy sentence from opac-memberentry in opac-patron-consent
Test plan:
Enable PrivacyPolicyConsent; you can set it to Permissive.
Check if the OPAC user page (tab Consents) shows it correctly now.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2a7d8cddc2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:42 +02:00
Matt Blenkinsop a3c8166dae
Bug 40593: Restore searchable columns to the suggestions table
This patch adds search functionality to the following columns: Suggester category, Patron reason, Library, Fund, Status.

Test plan:
1) Add some suggestions and navigate to the suggestions page
2) Use the search bar to search for data in any of the columns mentioned above.
3) It will not filter the results based on those columns
4) Apply patch and hard refresh
5) Use the search bar again, this time it should return results

Signed-off-by: Ludovic <ludovic.julien@inlibro.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a1fc548519)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:42 +02:00
Tomás Cohen Arazi f39c370980
Bug 40820: (follow-up) es_indexer_daemon.pl missed on 34070
The es_indexer_daemon.pl was missing handling for the case where
Koha::BackgroundJob->connect() returns undef without throwing
an exception (which happens when connection fails silently).

This adds the missing warning for that case, matching the behavior
in background_jobs_worker.pl.

Test plan:
1. Set JobsNotificationMethod to 'STOMP'
2. Configure invalid STOMP settings that cause connect() to return undef
3. Run es_indexer_daemon.pl - should show connection warning
4. Verify jobs are still processed via database polling

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9ca0e183b5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:41 +02:00
Tomás Cohen Arazi c9f4566aa6
Bug 40820: Fix STOMP connection warnings when JobsNotificationMethod is 'polling'
The background job workers are showing STOMP/RabbitMQ connection error
warnings even when the JobsNotificationMethod system preference was set
to 'polling', which doesn't require a message broker connection.

This patch adds checks for the JobsNotificationMethod preference before
displaying connection warnings, so warnings only appear when STOMP is
actually expected to be available.

Changes:
- misc/workers/background_jobs_worker.pl: Check syspref before warning
- misc/workers/es_indexer_daemon.pl: Check syspref before warning

Test plan:
1. Set JobsNotificationMethod to 'polling'
2. Run background_jobs_worker.pl - should not show STOMP warnings
3. Run es_indexer_daemon.pl - should not show STOMP warnings
4. Set JobsNotificationMethod to 'STOMP' without RabbitMQ running
5. Run workers - should show appropriate STOMP connection warnings
6. Sign off :-D

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4ff1f4ca9c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:41 +02:00
Nick Clemens 4cd910b176
Bug 40880: Correct columns headers for CSV export from item search
To test:
1 - Do an item search, select some rows
2 - Export selected rows as 'CSV'
3 - IMport into a spreadsheet or view and note missing/doubled delimiters after damaged status
4 - Apply patch
5 - Repeat export
6 - It works!

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e9c6c0ee43)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:40 +02:00
Paul Derscheid 4b734ebaca
Bug 40857: add context parameter for modal overlay
- The combobox dropdown in modals scrolled with the modal body instead of overlaying, due to Bootstrap's overflow: hidden on
modals clipping extending content.
- Added context parameter to combobox config; setting context: 'modal' uses Popper's fixed positioning strategy for proper
overlay.
- For reference: https://popper.js.org/docs/v2/constructors/#strategy

To test:
1. Make an item bookable
   1.1. Go to a record (e.g. http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=285)
   1.2. Go to the Items tab on the left side of the screen
   1.3. Under Bookable, choose Yes and click 'Update'

2. Place a booking
   2.1. Click 'Place booking' at the top of the detailed record screen
   2.2. Fill out the form
   2.3. Click 'Submit'

3. Try to cancel the booking
   3.1. Go to the 'Bookings' tab on the left side of the screen
   3.2. Click 'Cancel' next to the booking
   --> A modal appears with a text field for the cancellation reason
   3.3. Click 'No, do not cancel'

4. Add one authorised value in BOOKING_CANCELLATION
   4.1. Go to Administration > Authorized values
   4.2. Search for BOOKING_CANCELLATION
   4.3. Click 'Add'
   4.4. Fill out the form
   4.5. Click 'Save'

5. Redo step 3
   --> The option appears as a dropdown below the text field -- OK

6. Add one or two more authorised values

7. Redo step 3
   --> The options appear as a dropdown below the text field -- OK

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f6df86c170)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:40 +02:00
Jonathan Druart 8ae89b639b
Bug 40865: Add a cypress test
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 93a78880cb)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:39 +02:00
Jonathan Druart bd82d678a0
Bug 40865: Redirect if only one patron is found
Regression from
  commit e9b8004d19
  Bug 38255: Replace dataTable constructor with kohaTable - Staff

We should keep the params passed and not override them

Test plan:
1 - Search for 'edna acosta' in check out search on koha home page
2 - See the one result
3 - You are expected to be redirected to the patron's page

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1b57d75e96)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:39 +02:00
Jonathan Druart a712b68635
Bug 40265: (try to) prevent OAI/Server.t to fail on slow server
Jenkins failed with:
21:50:07 koha_1       |     #    got : '2025-06-26T19:50:06Z'
21:50:07 koha_1       |     # expect : '2025-06-26T19:50:07Z'

A guess is that we change second between the 2 dt_from_string calls, and
the comparison fails.

One thing however: it seems that we want to deal with timezone correctly
here, but if we change the timezone in koha-conf.xml, the tests fail...

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Change looks good, but does not work for another timezone.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 73719c417f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:38 +02:00
Jonathan Druart 428ea2baf6
Bug 37622: Remove location from 2 preservation 'update' routes
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1a2a7e4619)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:38 +02:00
Jonathan Druart 3c55573d4f
Bug 37622: Fix add_debit
We should not call discard_changes after accessing ->id but before

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9e8b9f607a)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:37 +02:00
Jonathan Druart 4c331a9bc8
Bug 37622: Adjust 'location' header test
We were ignoring whole files and parsing the whole file to check if
location and 201 were together. It's way better to check per subroutine.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a32495bf58)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:37 +02:00
Hammat Wele 5d8ba2c368
Bug 37622: Error in erm module when editing an agreement, a license, a package or a titles
To reproduce

1- Enable the ERMModule system preference
    1- Go to Administration > System Preferences
    2- Search for ERMModule
    3- Change the value to "Enable"
    4- Click on "Save all e-resource management preferences"
    5- Return to the main screen
1- Create an agreement
    1- Go to e-resource management
    2- Click on "Agreements"
    3- Click on "New agreement"
    4- Fill out the form (mandatory fields)
        - Agreement name: Natural Medicines
        - Status: Active
    5- Click on "Submit"
2- Edit the agreement
    1- Click on "Agreements"
    2- Click on "Edit" to the right of the Natural Medicines agreement
    3- Click on "Submit"
        --> Something went wrong: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data
We got the same error when editing a license, a package or a title

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ddbd11cbad)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:37 +02:00
David Cook e06e3d8ec9
Bug 40473: Use better algorithm for calculating Code39 barcode length
This patch uses the PDF::Reuse::Barcode algorithm for calculating barcode
background box length relative to barcode length in order to determine
the actual barcode width and thus the X scale factor required to re-size
that barcode so that it fits on the label width (or rather the
"Barcode width" which is a percentage applied to the label width
to create a narrower usable surface for the barcode and barcode background
box).

To test:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
2. Add an item with barcode 123456, add an item with barcode 39999000001310399991,
    and ensure an item with barcode 39999000001310 already exists
3. Go to http://localhost:8081/cgi-bin/koha/labels/label-manage.pl?label_element=batch
4. Create a patch that uses 3 items using 39999000001310, 2 items with 123456,
    and 2 items with 39999000001310399991
4. Go to http://localhost:8081/cgi-bin/koha/labels/label-manage.pl?label_element=layout
5. Edit the layout "Label Test"
6. Change the "Barcode width" to 1, and enable "Draw guide boxes", and click "Save"
7. Export the batch using the template "Avery 5160 | 1 x 2-5/8" and the layout "Label Test" and open as PDF
8. Note that the whole barcode fits inside the red guidebox (there should be some
overlap of white on top of the red guidebox but that is normal since we're using 100% of the
barcode label width).
9. Edit the "Label Test" layout to try "Code39 + Modulo43" and "Code39 + Modulo10" and retry batch export
10. Edit the "Label Test" and try different "Barcode width" like the usual default .8
11. Celebrate that your barcodes fit on the label!

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9da5f23f96)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:36 +02:00
Andrew Fuerste Henry c35d3e8069
Bug 40854: Correct menu name in browser.js
To test:
1 - perform a search in the staff interface, click a title to go to biblio details
2 - note lack of search results browsing tools at top left of page
3 - apply patch
4 - repeat your search, click a title to go to biblio details
5 - note browsing results tools at top left of page

Signed-off-by: Kevin Kellenberger <kkellenberger@mrcpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0547534fc3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:30 +02:00
Paul Derscheid 4a9a918291
Update release notes for 25.05.04 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:56:08 +02:00
Paul Derscheid e36b3ba16d
Increment version for 25.05.04 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:49:59 +02:00
Marcel de Rooy 8f3d84dfd3
Bug 40766: (QA follow-up) Operator precedence, quoting
Adding parentheses since I was not sure about precedence here. The filter
should be applied to the whole expression.
Adjusted double to single quotes in the second change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:49:58 +02:00
Jonathan Druart a905bfda2c
Bug 40766: Prevent XSS on set-library
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:49:58 +02:00
David Cook 193268edbb
Bug 40748: Check for HTTP URLs and skip shell when using system()
This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:49:58 +02:00
Jake Deery 19174500e9
Bug 40748: Fix RCE in update_social_data.pl
This patch fixes an identified RCE in the update_social_data.pl
social_data, which when executed, allows an attacker to run arbitrary
code on the system's shell.

TO TEST:

a)  In the Babeltheque_url_update syspref, wrap any bash in $(), and then
run the update_social_data.pl script.
    *)  For example, $(whoami >
/tmp/rce.log) will output to a file the username the perl script is
running as.
APPLY PATCH
b)  Run the update_social_data.pl script again. The string is now
meta-escaped, and the RCE no longer works.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 20:49:57 +02:00
Jonathan Druart 66e8f837dd
Bug 40876: Apply 'exact' to all attributes when column filtering
If you select an option in a column filter, the "exact" behaviour will
only apply to the first attribute mapped to this column

eg. on the patron search we have "Libraries" mapped to library.name and
library.library_id. If you select Centerville/CPL, the generated q
parameter will be {name: CPL, id: {like: "%CPL%"}}

This is caused by:
    if (value.match(/^\^(.*)\$$/)) {
        value = value.replace(/^\^/, "").replace(/\$$/, "");
On the second parameter we have lost the ^$ markers

Moving it out of the loop fixes the problem (and does not impact the
other behaviours: we search the same value for all the attributes

Test plan:
Create a library with code=CPLL and use if for a patron
Go to http://localhost:8081/cgi-bin/koha/members/members-home.pl
Click search
Select "Centerville" in the "Libraries" column filter
=> Without this patch you get the patrons from CPL and CPLL
=> With this patch applied only patrons from CPL are listed

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9e437a4089)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 19:32:21 +02:00
Jonathan Druart cfa17e1bc5
Bug 40565: Correctly fix the retrieval of 'id'
For other tables than those from Vue apps, table_node is the node and we
need to retrieve the object before accessing the attr function

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9af7d9dfd7)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 19:32:20 +02:00
Jonathan Druart 01d94090c7
Bug 40565: Fix column filters on item search
The item search table is different from the other tables.
It is using server-side but its own way (not using the REST API).

Test plan:
Search items and filter using the column filters: collections, library,
item types, AVs, etc.

QA: I am not very happy with this patch but, feel free to suggest a
better fix!
Note that "results" was too generic and it felt better to adjust it.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 825172c9f2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 19:32:16 +02:00
Lucas Gass f49b6dde10
Bug 40870: Set the fund code to selected on acqui/neworderempty.pl
To tes:
1- add an order to a basket in acquisitions
2- confirm your order shows in the basket with a fund code selected
3- click Modify on your order
4- note that Fund is empty in the modify form and you need to re-select it
5. APPLY PATCH
6. Try steps 1 -4 again, the correct fund should be set on page load

Signed-off-by: Wendy Bartlett <wbartlett@cuyahogalibrary.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5ceb2c78e9)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:58 +02:00
Jonathan Druart 160ac85039
Bug 40684: Adjust permissions for vendors
The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b7bd25885e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:58 +02:00
Jonathan Druart 8b46adfb96
Bug 40858: Search merge conflict on files part of the git index
Same as bug 34303 and bug 33743, our test suite must parse/process files
that are part of the index, not all the other files.

It's currently failing on kohadev-db-request.txt that is owned by root.
But it's not part of the Koha codebase, this file should not be tested.

There were also node_modules and po files that were processed.

Test plan:
  prove t/00-merge-conflict-markers.t
must now return gren

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cc72eabc5f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:57 +02:00
Jonathan Druart 7f976cca8d
Bug 40858: Rename context 'all' with 'core'
All was not returning all the files present in the git index, but all
Koha core files. Let's rename it with 'core' to remove ambiguity.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 36bd4bd7b4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:57 +02:00
Marcel de Rooy 9d93293c97
Bug 40586: (QA follow-up) Add comment about effective notforloan status
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ae78ea6e5e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:57 +02:00
Marcel de Rooy d3d0a366aa
Bug 40586: Show negative notforloan status in holds table on opac-user
If an item is on order, it may take a while before becoming available.
Showing that too on the opac-user page is helpful for the user and
may reduce questions.

Test plan:
Pick an item and set notforloan to On order (-1) or another custom
negative notforloan status.
Put an item level hold on that item.
Go to the OPAC user page of that patron. Verify that the AV description
is added now to the status column of the holds table.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4551cb4f42)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:56 +02:00
Lucas Gass cf828af0a0
Bug 40679: Fix display of cancellation reason dropdown
To test:
1. Have some holds
2. Go to reserve/request.pl?biblionumber=x for your biblionumber
3. Change at least one hold priority to 'del'
4. Notice the toolbar above the table with Update Hold, Cancel selected, Cancellation reason now looks wonky.
5. APPLY PATCH
6. Try again, the display of the toolbar should be better.

Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fd1adddb35)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:56 +02:00
Jonathan Druart 6ebf2b7e45
Bug 40861: Remove warning from serials/acqui-search-result.pl
Odd number of elements in anonymous hash at /kohadevbox/koha/serials/acqui-search-result.pl line 84.

it's coming from closedate that is empty, and output_pref that will
reach this return:
278     if ($str) {
279         local $@;
280         $dt = eval { dt_from_string($str) };
281         Koha::Exceptions::WrongParameter->throw("Invalid date '$str' passed to output_pref") if $@;
282     }
283
284     return if !defined $dt;    # NULL date

if str is undef, we don't enter if l.278 and return l.284
which will shift the elements of the hash (because of the list context)

We force the scalar and we are good.

There was no side-effect because closedate was the last of the list.

Note that total (and the 'count(*)' key) is not used in the template.

Test plan:
Create an order for a basket of the first vendor "My vendor" and hit
http://localhost:8081/cgi-bin/koha/serials/acqui-search-result.pl?supplier=d
Without this patch you get the warning
Odd number of elements in anonymous hash at /kohadevbox/koha/serials/acqui-search-result.pl line 84.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 71619f90e5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:55 +02:00
Tomás Cohen Arazi cd6c198b5c
Bug 38967: (follow-up) Force 'op' parameter
This fixes a failing test:

To test:
1. Run:
   $ ktd --shell
  k$ prove xt/find-missing-op-in-forms.t
xt/find-missing-op-in-forms.t .. 2/3
2. Apply this patch
3. Repeat 1
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 071b6322c7)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:55 +02:00
Jonathan Druart 000a40eb4a
Bug 36095: Fix Selenium tests
#                   'Details for opac holds test place hold button › Koha online catalog'
        #     doesn't match '(?^u:Details for: opac holds test place hold button)'

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0de9601048)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:55 +02:00
Hammat Wele 8198ee76db
Bug 33646: Better organize availability in cataloging search
This change adds "Available", "Unavailable", and "Not for loan"
categories in the availability cell of the "cataloging search"
found at /cgi-bin/koha/cataloguing/addbooks.pl

This change also adds missing location information for the
"Not for loan" items.

Test plan:
0. Apply the patch
1. Add available, checked out, and not for loan items for a test record
(like "Gairm" in koha-testing-docker)
2. Go to the cataloging search,
http://localhost:8081/cgi-bin/koha/cataloguing/addbooks.pl?q=test
3. Note that the items in the "Location" column now have labels
to differentiate which items are available, unavailable, and not for loan.
4. Note that the "Not for loan" data is similar to the "Available" data

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 89717f95d1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:54 +02:00
Jonathan Druart 8590e42f13
Bug 27934: Remove title-string to order by dates
We must now use data-order to order dates, not title-string.

This patch adjusts the few occurrences that were using it and remove
the function from datatables.js to prevent new occurrences.

Test plan:
Create some recalls, go to the "Recalls to pull" and "Recalls awaiting
pickup" pages and confirm that the dates are ordered correctly when you
sort by dates.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1b2ee04e74)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:54 +02:00