Commit Graph

9080 Commits

Author SHA1 Message Date
Marcel de Rooy 4b32d4f531
Bug 37508: (QA follow-up) Use ->check_columns
Add shebang to Guided.t too.

Test plan:
See also previous commits.
Try sql like:
  select access_token from oauth_access_tokens

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:15 -03:00
Aleisha Amohia 133b17036b
Bug 37508: (follow-up) Don't pass the column or sql containing password
This patch replaces these variables with a non-translatable message.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:14 -03:00
Aleisha Amohia fe2be0330c
Bug 37508: (follow-up) Throw error is password is in SQL query at all
Confirm tests pass t/db_dependent/Reports/Guided.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:13 -03:00
Aleisha Amohia 62874e328d
Bug 37508: Throw error if password column is detected in SQL report
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:12 -03:00
Martin Renvoize 84814bbef3 Bug 37198: Improve GetPreparedLetter documentation
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 149412cb62)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-19 15:32:34 +00:00
Denys Konovalov 319f954c21 Bug 36128: Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Overdues.pm
Fixes the following error message when running the overdues check cronjob on a
Koha system without defined overdue rules:

/etc/cron.daily/koha-common:
Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Overdues.pm
line 686.

by checking if the variable is defined before comparing it.

Test plan:
1. Go to Tools - Overdue notice/status triggers and verify that for every single
   patron type for both Default and every individual library, you have no value
   set for Delay, so that you will never send anyone an overdue notice
2. Run the cron job which creates and sends overdue notices
3. Confirm the above mentioned error no longer appears

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c8586270a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-19 15:21:50 +00:00
Andreas Jonsson 82f15de4fb Bug 37016: Invalid due date in SIP renew response
Test plan using koha-testing-docker:

1) Make sure SIP is running.  You may need to edit
   /etc/koha/sites/SIPconfig.xml and remove the 8023 connector and
   restart the SIP-server (koha-sip --restart kohadev)
2) Find a patron, say 23529000197047
3) Set a password by selecting "change password", set it to
   "Password1234"
4) Find a book, say 39999000000856
5) Issue book to patron with sip-client:
   sudo koha-shell -c "/usr/share/koha/bin/sip_cli_emulator.pl \
                      --address localhost --port 6001 -t cr \
                      --su term1 --sp term1 --message checkout \
                      --location CPL --item 39999000000856 \
                      --patron 23529000197047 --password Password1234"\
                      kohadev
6) Note the AH-header in the response which for example:
   'AH20240619    235900'
7) Make a renewal with:
   sudo koha-shell -c "/usr/share/koha/bin/sip_cli_emulator.pl \
                      --address localhost --port 6001 -t cr \
                      --su term1 --sp term1 --message renew \
                      --location CPL --item 39999000000856 \
                      --patron 23529000197047 --password Password1234"\
                      kohadev
8) Make sure the AH-header in the response is different from the
   response to the checkout, for example: 'AH20240624 235900'

Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3295fd5227)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-19 14:30:10 +00:00
Marcel de Rooy 2d4537ba12 Bug 36940: Resolve two warnings on undefined branchip
If you enabled AutoLocation and have a branch without ip, this
triggers warnings.

Test plan:
Check logs in this situation with/without this patch by logging out
and in again on staff.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2f1ffbc6ec)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 17:48:12 +00:00
Marcel de Rooy 309cc9c9d1 Bug 36948: (follow-up) Allow IPv[46] in port config
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fcd7e884bc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-03 16:17:55 +00:00
Marcel de Rooy 2c156f8ce1 Bug 36948: (follow-up) Remove log_file param, adjust caller_depth
We keep OPEN when people still use log_file or setsid.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c0d76f707b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-03 16:17:55 +00:00
Nick Clemens 7076762bba Bug 36948: Resolve SIP issues in D12
My Koha testing docker SIP started dying repeatedly after launch. After investigation, I
found it was a problem with logging and default ports.

In D12 there is no syslog anymore, everythign uses journal. Four our purposes, lets log SIP issues
to sip.log by default

Attaching a patch to clear things up.

To test:
1 - Open KTD/D12
2 - tail -f /var/log/koha/kohadev/*.log
3 - On another terminal 'restart_all'
4 - Wait a bit, notice SIP dying
5 - Apply patch
6 - Update SIPconfig:
    server-params:
    log_file='/var/log/koha/kohadev/sip.log'
    service with port 8023:
    port="127.0.0.1:8023/tcp"
7 - Restart all
8 - Confirm SIP no longer dies

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 5dc1ec387d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-03 16:17:55 +00:00
Matt Blenkinsop eff4e19ef8 Bug 35989: (QA follow-up): Fix QA tests
Some file tidying to pass the QA tests

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 361ec4b2ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 13:35:23 +00:00
Nick Clemens 4ca639a5f6 Bug 35989: (QA follow-up) Add test and limit variable scope
Before this patch if a record had a 751 and a 781 you could have fields repeated.
This patch reduces the scope of the fields to subdivision variable as it is only used in processing 7xx
fields and should not be shared between fields.

I also add unit tests

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 95f2aecc1b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 13:35:23 +00:00
Matt Blenkinsop 6dfb1dd931 Bug 35989: Stop geographic authority searches crashing
Currently when searching for a geographic authority record the search will fail if the record has a heading in a 78X field. The system tries to do a regex match against an undefined variable causing an error. This patch makes that regex match conditional on the variable being defined to allow the search to succeed.

Test plan:
1) Navigate to Authorities
2) In the search bar at the top of the page, click on the dropdown options and in the 'Authority type' field, select 'Geographic Name'
3) Click search
4) You should have a list of authorities
5) Click on any authority record and then click edit and select to edit the record
6) Click on the "7" button
7) Click on the green text next to the '781' field to get the list of fields
8) In field 'v' enter any string you like
9) Click save
10) Repeat steps 1-3, this time it should display an error message for an Unmatched [ in regex
11) Apply patch
12) restart_all
13) Refresh the page, the results should show and the string you entered in the 'v' field should display on the record you edited

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6c9482f213)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 13:35:23 +00:00
Jonathan Druart 3098a95c4e Bug 36520: Prevent SQL injection in GetPreparedLetter
Actually in _get_tt_params

The following query will delay the response

SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle`
, `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract`
  FROM `biblio` `me`
WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -'
ORDER BY field( biblionumber, 1 ) AND (
    SELECT 1
      FROM
    SELECT SLEEP( 6 ) x
   ) -- - )

To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+-  to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 0b3c98b0ba01ea5c886ecfe8eef174b5b7c6ec25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Marcel de Rooy 245864a311 Bug 36575: (QA follow-up) Shibboleth POD and checkpw_internal call
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 4cafd512cd31701fa3ee2a19abc4de4488b91e69)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Nick Clemens bd2cb8582c Bug 36575: Adjust checkpw_internal to return patron
This patch refactors checkpw_internal to remove the SQL code, use patron ojbects, and return the
patron that correctly matches the userid/caerdnumber when auth is successful

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit fe78f06a50c41a7dbac24206e31bc5b1189ee185)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Nick Clemens e6fbb9b5c1 Bug 36575: (bug 34893 follow-up) Return patron when autocreating in Shibboleth
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit f6fe24bdd8f72cdf09111a93d0ca0a114b5ee570)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Nick Clemens 2706fd8fbb Bug 36575: (bug 34893 follow-up) Return patron from LDAP
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit e6ce7aded6bc737fd98c2e94aba51abb4581afbb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Martin Renvoize 45e2302af0 Bug 36575: (QA follow-up)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit fffc5600cad077e8b4d8d5211263f1935c5b07cd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Nick Clemens 39aeec0438 Bug 36575: Return correct patron when there is a shared userid / cardnumber
This patch moves some patron fetching code in C4/Auth to use to patron returned from the validation
methods and only try to fetch the patron (to check if locked, update attempts, etc) if we didn't authenticate

To test:
1 - Set a user to have userid = BANANA password = Password1
2 - Set a user to have cardnumber = BANANA password = Password2
3 - Hit the patron authentication API:
    http://localhost:8080/api/v1/auth/password/validation
    with data:
    { "identifier": "BANANA", "password":"Password1" }
    and:
    { "identifier": "BANANA", "password":"Password2" }
4 - Note you receive the same response for both
5 - Apply patch, restart all
6 - Repeat the API and confirm you get the correct patron for the password submitted

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit ff4e0c4293486d2db31d2f48d9f6f31d6470965a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Jonathan Druart 7d75ec3e26
Bug 36939: Remove a warning from Serials.t
t/db_dependent/Serials.t .. 2/57 Use of uninitialized value in numeric gt (>) at /kohadevbox/koha/C4/Serials.pm line 2029.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-24 15:36:47 +02:00
Nick Clemens 7cac0105f8
Bug 36917: (follow-up) Remove Elasticsearch warnings and tidy
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-24 15:36:42 +02:00
Jonathan Druart 1d394dcdcc
Bug 36917: Remove some warnings from t/db_dependent/Authority/Merge.t
Cannot determine authority type for record: 1709 at /kohadevbox/koha/Koha/SearchEngine/Elasticsearch.pm line 589.
Use of uninitialized value $subfields in pattern match (m//) at /kohadevbox/koha/C4/Heading/MARC21.pm line 412.
Use of uninitialized value $subfields in pattern match (m//) at /kohadevbox/koha/C4/Heading/MARC21.pm line 448.

This change removes the 2 "Use of uninitialized value $subfields in
pattern match (m//)" warnings

The warnings are gnerated because the subfields for headings are hardcoded variables in C4::Heading::MARC21
for any genuine authority record we should receive the correct list of subfields. The tests in this case are
mocking a new authtype, and so do not find the correct subfields. Skipping the generation here silences the
warnings and will prevent user defined types from throwing errors as well.

NOTE: Koha allows the user to define their own authority types, however, we have various features hardcoded
that will prevent them from working as expected

WNC amended commit message

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-24 15:36:41 +02:00
Martin Renvoize 0a17e7181e
Bug 26176: (QA follow-up) Also rename StaffLoginBranchBasedOnIP
This patch also renames StaffLoginBranchBasedOnIP to
StaffLoginLibraryBasedOnIP to be consistent with our terminology
guidelines

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-23 17:51:19 +02:00
Martin Renvoize f8915dc6e7
Bug 26176: (QA follow-up) Branch -> Library
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-23 17:51:18 +02:00
Nick Clemens 8b2bdf6ee5
Bug 26176: Rename AutoLocation to StaffLoginRestrictBranchByIP
This patch sets AutoLocation to be called StaffLoginRestrictBranchByIP.
The new name is chosen to reflect the new pref StaffLoginBranchBasedOnIP.

Also this patch corrects the order of sysprefs in installer file.

To test:
Follow test plans on bug 36665 and bug 35890 and confirm that the preferences
continue to work as expected
Confirm the descriptions of the prefs in the staff interface match the behaviors expected

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-23 17:51:18 +02:00
Nick Clemens 46cecfdd72
Bug 36908: Sort branches based on branchcode
This adds a sort based on branchcode, it's a fallback for an edge case that should be rare
so I think is acceptable, as long as documented.

I added test coverage, but it may no longer be possible to encounter this scenario.

System preference descriptions are updated as well.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-23 17:51:17 +02:00
Nick Clemens 58a75cafd6
Bug 36665: (follow-up) Allow choosing a branch with no IP when using AutoLocation
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-22 16:18:13 +02:00
Nick Clemens fb45438ae3
Bug 36665: (follow-up) Wrap code block in type ne 'opac' conditional
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-22 16:18:12 +02:00
Nick Clemens 3a0d6f5d07
Bug 36665: Add option to set the staff user's logged in branch based on their current ip
This patch adds a new system preference StaffLoginBranchBasedOnIP which restores the behaviour before bug 35918
of using the current IP to determine the user's logged in branchcode

To test:
 1 - Get your current ip
 2 - Set that IP for a library in the administration section
 3 - Find a user account assigned to a different library that can login to staff side
 4 - Login to staff as that user, select 'My library'
 5 - You are logged in to the user's branch
 6 - Apply patch, restart all
 7 - Log out and back in, selecting 'My library'
 8 - You are logged in to the user's branch
 9 - Enable new system preference StaffLoginBranchBasedOnIP
 9 - Log out and back in, selecting a different branch, noting the new warning below the library selection
10 - You are logged in to the branch with the matching IP
11 - Log out and back in, selecting 'My library'
10 - You are logged in to the branch with the matching IP
11 - Change your logged in branch
12 - Verify the selection sticks and you can perform staff actions in the chosen branch
13 - Change the IP of the library to one that doesn't match yours
14 - Verify you can log out and log back in and that selected branch is respected when your IP doesn't match library IP

Signed-off-by: Kristi Krueger <KKRUEGER@cuyahogalibrary.org>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-22 16:18:12 +02:00
Marcel de Rooy 4a18e25d3c
Bug 36785: Typo unreconized and bilbio in tags code
Test plan:
Look at the patch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-17 10:36:35 +02:00
Marcel de Rooy 8ea126b1f8
Bug 36793: Fix case of $var in Context->delete_preference
This only applies to 'local' preferences.

Test plan (first without this patch):
Add a local pref. Delete it. Ask value on commandline with:
* perl -MC4::Context -e"print C4::Context->preference('YOUR_PREF')"
* Did you replace YOUR_PREF :)

Now repeat with this patch. And verify fix (no value now).

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-17 10:36:34 +02:00
Jonathan Druart df23f6c345
Bug 36149: Unset userenv from middleware
The userenv (logged in user's info) are stored in
$C4::Context->context->{activeuser}, which persists in plack worker's
memory.
It's really bad in theory as we are not cleaning it before or after the
HTTP request, but only when set_userenv is called (what we are doing
commonly in C4::Auth::get_template_and_user).
If C4::Context->userenv is called before set_userenv we should get undef,
not the userenv from the previous request!
In practice this should not be a problem, but well... who really knows?

This patch suggests to have a middleware to deal with removing the
userenv at the beginning of each request (maybe it should be after, right? - FIXME).

To test:
1 - Edit /etc/koha/sites/kohadev/koha-conf.xml to set <plack_workers>1</plack_workers>
2 - Edit about.pl  and add a line after: CGI->new:
    warn Data::Dumper::Dumper( C4::Cointext->userenv() );
3 - tail -f /var/log/koha/kohadev/*.log
4 - View about.pl in staff interface, should get a "somethign's wrong" warning
5 - Reload, you get current user info
6 - Open an incognito tab, sign in as a different user and click some stuff
7 - Reload about.pl in other window
8 - You get the opac user info
9 - Apply patch
10 - Edit /etc/koha/sites/kohadev/plack.psgi and add the middleware after "RealIP":
     enable "+Koha::Middleware::UserEnv";
11 - Restart all
12 - Reload about.pl - you get a "Something's wrong" warning
13 - Click things in opac on incognito window
14 - Reload about.pl  - only "Something's wrong" - you no longer see any user info

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-05-14 15:04:36 -03:00
Kyle M Hall 7291a31233
Bug 36378: Cannot stay logged in if AutoLocation is enabled but branch ip is not set correctly
We can get into a scenario what a user cannot stay logged in for more than a single page load.
If AutoLocation is enabled with branch IP addresses being set to a space, you will be logged out with every page load.

Test Plan:
1) Set your branch ip to a space
2) Enable AutoLocation
3) Restart all the things!
4) Log out
5) Log in
6) Browse to another page
7) You are logged out
8) Apply patch
9) Repeat 1-6
10) You are not logged out!

Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-14 15:34:28 +02:00
Nick Clemens b7e5dab1e7
Bug 30047: (follow-up) Fix failing tests
This patch updates the test files to correctly create authorities and/or correctly
mock the needed data for authorities.

the tests in t/db_dependent/Authority/Merge.t cover the case of 'Default' authorities
which don't have valid headings - so I had to add handling for blanking the heading field
when Default type is used.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-13 16:24:18 +02:00
Fridolin Somers 5406aaedfa
Bug 36335: Fix ILS-DI GetRecords bad encoding for UNIMARC
ILS-DI GetRecords generates bad encoding of MARCXML for UNIMARC, like OAI in Bug 34467

Enable ILS-DI and display a record with :
<opac url>/cgi-bin/koha/ilsdi.pl?service=GetRecords&id=<biblionumber>

Well-known issue, fixed
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 17:46:15 +02:00
Nick Clemens 26f3202369
Bug 30047: Add new heading field to auth_header table
This patch adds a new heading field containing the display form of the authority record

NOTE: If trying to save an auhority in the 'DEFAULT' framework, you will get an error, you should not be
using DEFAULT for authorities and we should remove from the list on another bug

To test:
1 - Apply patches
2 - Update database
3 - Restart all
4 - Create a new authority, save.
5 - Do this for various types
6 - View the db records:
    SELECT * FROM auth_header\G
7 - Note new heading field is populated correctly
8 - Edit your new authorities
9 - Confirm the heading field is updated correctly
10 - Import some authorities and confirm heading generated correctly
11 - Import auth via Z39.50 and confirm heading generated correctly

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:51 +02:00
Kyle M Hall 2f702d2387
Bug 35907: Tidy execute_query
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:45 +02:00
Kyle M Hall 26014e62da
Bug 35907: Add ability to log all custom report runs with or without query
Because of the way Koha::Logger has been used to log to different categories based on the interface and caller, it can be extremely hard to log all of a particular log statement to one place.

For custom report runs, the category is plack-intranet.C4::Reports::Guided when run from the web interface, cron.C4::Reports::Guided when run from runreport.pl, and plack-intranet.C4::Auth when run from svc/report.

We should add a more standardized report run log, both with and without the full query, so that administrators can log all report runs to a centralized location. If an administrator were to need the "point of entry" for reports, it is easy to include via parameters in PatternLayout.

Test Plan:
1) Apply this patch
2) Modify your log4perl file, add the following:

log4perl.logger.reports.execute.time = INFO, REPORTTIME
log4perl.appender.REPORTTIME=Log::Log4perl::Appender::File
log4perl.appender.REPORTTIME.filename=/tmp/report-time.log
log4perl.appender.REPORTTIME.mode=append
log4perl.appender.REPORTTIME.layout=PatternLayout
log4perl.appender.REPORTTIME.layout.ConversionPattern=[%d] [%p] [%P] %m%n
log4perl.appender.REPORTTIME.utf8=1

log4perl.logger.reports.execute.query = INFO, REPORTQUERY
log4perl.appender.REPORTQUERY=Log::Log4perl::Appender::File
log4perl.appender.REPORTQUERY.filename=/tmp/report-query.log
log4perl.appender.REPORTQUERY.mode=append
log4perl.appender.REPORTQUERY.layout=PatternLayout
log4perl.appender.REPORTQUERY.layout.ConversionPattern=[%d] [%p] [%P] %m%n
log4perl.appender.REPORTQUERY.utf8=1

3) Restart all the things!
4) Run a report somehow:
   CLI: ./misc/cronjobs/runreport.pl 1
   API: /cgi-bin/koha/svc/report?id=1
   Web: /cgi-bin/koha/reports/guided_reports.pl?reports=1&phase=Run this report
5) Note the report runs are logged to /tmp/report-time.log and /tmp/report-query.log

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:45 +02:00
danyonsewell ac5084641e
Bug 26567: Allow to limit subscription search to subscriptions with routing lists
Adds a search option to the advanced search in the
serials module that allows to limit search on subscriptions
with routing lists.

Test plan:
1. Apply this patch
2. Create two subscriptions, one with a routing list and one without
3. Navigate to Serials home and tick the checkbox labeled "Search routing lists only:"
4. Confirm that the only search result to appear is the subscription you added the routing list to
5. Run unit tests: prove t/db_dependent/Serials.t

Sponsored by: Bibliotheksservice-Zentrum Baden-Wuerttemberg

Signed-off-by: Christian Stelzenmüller <christian.stelzenmueller@bsz-bw.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Perltidied changes to make QA test tools pass.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:44 +02:00
Jan Kissig d59e148879
Bug 36676: SIP2 drops connection on unknown patron id in fee paid message
When sending a fee paid message to SIP2 with an unknown patron id it will respond with an empty response followed by dropping the connection to a client.

Test plan:
a) perl /usr/share/koha/bin/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1   -l CPL --patron 2352900100046 -m fee_paid --fee-type FT --fee-amount 0.01
Output:
Trying 'fee_paid'
SEND: 3720240423    124447FT00USDBV0.01|AO|AA2352900100046|ACterm1|
Use of uninitialized value $data in concatenation (.) or string at /usr/share/koha/bin/sip_cli_emulator.pl line 355, <GEN0> chunk 1.
READ:

b) apply patch
c) perl /usr/share/koha/bin/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1   -l CPL --patron 2352900100046 -m fee_paid --fee-type FT --fee-amount 0.01
Output:
Trying 'fee_paid'
SEND: 3720240423    125602FT00USDBV0.01|AO|AA2352900100046|ACterm1|
READ: 38N20240423    125602AO|AA2352900100046|AFInvalid patron barcode.|

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 15:19:00 +02:00
Martin Renvoize 298abcb4cb
Bug 31627: (QA follow-up) Catch more locations
This patch moves the header set into Koha::Email->create and passes the
template_id in a few additional locations to ensure we catch more cases.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 14:11:49 +02:00
Kyle Hall aed4a2ec98
Bug 31627: Add ability to embed the letter id in outgoing email notices
It can be useful to know exactly what template was used to generate a notice. To further this end, it would be useful be able to send the letter id as part of any emails sent out if there is a letter template associated with the message.

Test Plan:
1) Apply this patch
2) Restart all the things!
3) Generate an email notice like a checkout notice
4) Inspect the email headers, note the new X-Koha-Template-Id and
   X-Koha-Message-Id headers!

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 14:11:48 +02:00
Jonathan Druart 4ffaa07a40
Bug 36750: Use the same label for Zebra
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-07 17:41:19 +02:00
Emily Lamancusa dc00e55a32
Bug 34972: Remove GetOtherReserves
GetOtherReserves attempts to set the waiting/transit status for the next
hold on the list when applicable, but in practice it either leaves the
hold state unchanged, or sets the itemnumber without setting the found
status (erroneously converting bib-level holds to item-level holds).

The latter situation only occurs when the user has been prompted to
confirm, cancel, or revert the hold, and is able to ignore the prompt.
In those situations, the hold's state should not change.

GetOtherReserves does not need to change the hold state, and it does not
do so correctly. Besides that, it does not do much other than call
CheckReserves, and is only used in 3 places.

This patch removes GetOtherReserves, and refactors returns.pl and
C4::Reserves::ModReserveCancelAll to call CheckReserves directly instead.

To test:
1. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
2. Check in an item from that record to fill Patron A's hold
3. Set the hold's expiration date to yesterday by accessing the database
    in the command line:
    - In a ktd shell prompt, open the db client with koha-mysql kohadev
    - UPDATE reserves
        SET expirationdate = DATE_SUB(CURDATE(), INTERVAL 1 DAY)
        WHERE borrowernumber = <Patron A's borrowernumber>
4. Go to Circulation > Holds Awaiting Pickup, and find the hold in the
    "holds waiting past their expiration date" tab
5. Click the "Cancel hold" button in the Actions column next to the hold
   (do not check in the book)
6. Return to the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold and does not
    have a waiting status

7. Cancel Patron B's hold
8. Place 2 new holds on the record: one for Patron A at the logged-in
    library, and one for Patron B at a different library
9. Check in an item to fill Patron A's hold
10. Repeat steps 3-5 to expire and cancel Patron A's hold
11. Return to the Holds tab of the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold, and there is no
    "Revert transit status" button

12. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
13. Check in an item from that record to fill Patron A's hold
14. Check in the same item again. A modal will pop up, saying that the
    hold is already waiting
15. In the modal, choose a cancellation reason and click "Cancel hold"
--> A new modal will pop up to fill Patron B's hold
16. Click "Ignore" on the modal for Patron B's hold
17. Return to the bib record and look at Patron B's hold
--> Note that Patron B's hold is now an item-level hold and does not
    have a waiting status

18. Apply patch
19. Repeat steps 1-6
--> Note that Patron B's hold is still a bib-level/"next available" hold
20. Repeat steps 7-11
--> Note that Patron B's hold is still a bib-level/"next available" hold
21. Repeat steps 12-17
--> Note that Patron B's hold is still a bib-level/"next available" hold

Make sure correct behavior is unchanged:

22. Cancel Patron B's hold
23. Place 2 new holds on the record: one for Patron A at the logged-in
    library, and one for Patron B at a different library
24. Check in an item from that record to fill Patron A's hold
25. Check in the same item again. A modal will pop up, saying that the
    hold is already waiting
26. In the modal, choose a cancellation reason and click "Cancel hold"
--> A new modal will pop up to fill Patron B's hold
27. Click "Print slip, transfer, and confirm" on the modal for Patron B's hold
--> Confirm that the information on the slip is correct
--> Confirm that the hold is correctly put in transit

22. Set HoldsAutoFill and HoldsAutoFillPrintSlip to "Do"

23. Place a bib-level hold for the logged-in library
24. Check in an item from that bib
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly assigned and set to waiting
25. Place a bib-level hold for a different library
26. Check in an item from that bib
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly put in transit
27. Change the logged-in branch to match the hold pickup location
28. Check the item in
--> Confirm the information on the slip is correct
--> Confirm the hold is correctly assigned and set to waiting

29. Repeat steps 22-26
--> Confirm a correct hold slip pops up for Patron B's hold
--> Confirm that Patron B's hold is correctly put in transit
30. Cancel Patron B's hold
31. Place 2 bib-level holds for 2 different patrons (Patron A and Patron
    B) on the same record, both for pickup at the logged-in library
33. Repeat steps 24-26
--> Confirm a correct hold slip pops up for Patron B's hold
--> Confirm Patron B's hold is correctly set to Waiting

34. Prove t/db_dependent/Circulation.t
35. Prove t/db_dependent/Koha/Holds.t
--> Tests pass

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-07 15:53:42 +02:00
Martin Renvoize b08855fc69
Bug 27753: (QA follow-up) Use librarian as resolver
This patch updates the changed code to set the logged in librarian as
the person who resolved the return claim at checkin/checkout action.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-06 09:12:14 +02:00
Laura Escamilla eb7e84efb9
Bug 27753: (follow-up) Tidy introduced code in Circulation.pm
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-06 09:12:11 +02:00
Laura Escamilla ace383ad96
Bug 27753: (follow-up) Update logic in AddReturn
The new logic in AddReturn was flawed, we were missing return messages
due to moving the if statement too high and catching more code than
intended.

Mentored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-06 09:12:10 +02:00
Laura Escamilla 48378179a3
Bug 27753: Added new system preferences for automatically resolving claims
To test:
1. Configure Claims returned
    1. Go to Administration > Authorized Values > LOST
    2. Add a new authorized value with value:6 and description:Claims returned
    3. Go to Administration > System Preferences
    4. Set ClaimReturnedLostValue to 6 and save
2. Check out an item to a patron.
    1. Mark the item as claim returned
    2. Check the item in.
    3. A message stating that the item has been claimed as returned pops up with
       an option to resolve.
    4. Resolve the claim.
3. Check out the item to the patron again.
    1. Mark the item as claim returned.
    2. Check out the item to a new patron. Select “Yes, check out”
    3. Go back to the previous patron. Notice that their claim was not resolved.
4. Apply the patch.
    1. Updatedatabase
    2. restart_all
    3. Go to the system preferences and set the system preference
       ‘AutoClaimReturnStatusOnCheckin’ to ‘Returned by patron’
    4. Set ‘AutoClaimReturnStatusOnCheckout’ to ‘Found in library’
5. Redo step 2
    1. When checking the claim returned item in you will now see a message that
       says “The previously claimed returned item has been found, automatically
       resolving the associated claim.”
    2. View the previous patron. Their claim has automatically been resolved
       with a status of ‘Returned by patron’
6. Redo step 3
    1. Upon checking the item out to another patron you will see a message that
       says “The previously claimed returned item has been found, automatically
       resolving the associated claim.”
    2. View the previous patron. Their claim has automatically been resolved
       with a status of ‘Found in library’.
7. Sign off and have a wonderful day!

Sponsored-by: Altadena Library District
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-06 09:12:09 +02:00