Commit Graph

5309 Commits

Author SHA1 Message Date
Marcel de Rooy 6bbea258fb
Bug 37508: (QA follow-up) Move check to Koha::Report, extend
Do not allow password but allow password_expiry_days etc.
Do not allow token, secret and uuid too.

Test plan:
Run t/db_dependent/Koha/Reports.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:15 -03:00
Tomas Cohen Arazi b4e3a0aaea Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize e7b3d05bc7 Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi b81b388db3 Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi 21fd44f505 Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Hammat Wele 803a554717 Bug 37018: (follow-up) adding some allowed operators
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize d5f76c58e7 Bug 37018: Use validation in search_rs helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize fea6c06878 Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi dead285545 Bug 37018: Add Koha::Exceptions::REST
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
David Cook 3a2a76726f Bug 37146: Prevent path traversal by validating input
This patch validates the plugin_name passed to plugin_launcher.pl
against the base path containing the "value_builder" directory.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29
3. Check that the tag editor for leader still works
4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
5. Check that the pluginf or "Date acquired" still works

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 14:21:56 +00:00
Victor Grousset/tuxayo ffd03490ac Bug 36863: (QA follow-up): tidy up code
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 14:20:25 +00:00
Jonathan Druart 13e22ae52c Bug 36863: Deal with non-listed methods in CSRF plack middleware
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 14:20:25 +00:00
Martin Renvoize 46dc45e60c Bug 28664: (follow-up) Throw exception if debt if VOID
This patch adds an exception when an attempt is made to refund against a
VOID debit.

Test plan
1) Run the included unit test

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b18664ec45)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-19 15:53:36 +00:00
Hammat Wele 5193b6d570 Bug 37157: Fix Malformed UTF-8 character in JSON string before decode_json
When we add a new identity provider and put some special characters in the Config or Mapping field, we got 500 error when we list the identity providers

To test:
1. Apply this patch.
2. Add a new identity provider
    2.1. fill the form
    2.2. click on «Add default Oauth configuration» and on «Add default Oauth mapping»
    2.3. put some special characters in Configuration and Mapping field
3. Save the form
=> Confirm the identity providers list is shown correctly

Also prove t/db_dependent/api/v1/provider.t.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 55b892dca4)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-19 14:32:44 +00:00
Lari Strand 5d059209f7 Bug 36982: Collections facet does not get alphabetized based on collection descriptions
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 83762f6fee)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 20:33:02 +00:00
Tomas Cohen Arazi 500b272632 Bug 37182: Make Koha::Statistic->new preserve 'datetime' if passed
This patch does what the title says. This behavior is tested on the
previous patch. Tests are also added for the background job (which
relies on Koha::Statistic->new and was the evidence of this
overwrite behavior).

To test:

1. Apply the regression tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Statistic.t \
           t/db_dependent/Koha/BackgroundJob/PseudonymizeStatistic.t
=> FAIL: Tests don't pass :-/
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 65375bc34d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 20:26:59 +00:00
David Nind 58e831ce63 Bug 32313: Update guided reports column descriptions for items and biblioitems tables
This adds missing column descriptions to the items and biblioitems
tables (used in guided reports for the Circulation, Catalog,
Acquisitions, and Serials modules).

It also updates some existing descriptions for consistency, removes
biblioitems columns that no longer exist, and sorts items and statistics
descriptions in the source file in alphabetical order.

Test plan:
1. Go to Reports > Guided reports > Create guided report.
2. Choose 'Catalog' for the module to report on, and then select
   'Next'.
3. Choose 'Tabular' for the type of report and select 'Next'.
4. Note that there are no descriptions for these column names
   (proposed column names shown in brackets):
   - items.itemnumber (Koha item number (autogenerated))
   - items.biblionumber (Biblio number (internal))
   - items.bookable (Bookable)
   - items.localuse (Total local uses)
   - biblioitems.ean (EAN)
   - biblioitems.collectiontitle (Series statement)
   - biblioitems.collectionissn (Series ISSN)
   - biblioitems.collectionvolume (Series volume)
   - biblioitems.editionstatement (Edition statement)
   - biblioitems.editionresponsibility (Edition responsibility)
   - biblioitems.cn_source (Source of classification or shelving scheme)
   - biblioitems.cn_class (Classification part)
   - biblioitems.cn_item (Item part)
   - biblioitems.cn_suffix (Call number suffix)
   - biblioitems.cn_sort (Koha normalized classification for sorting)
   - biblioitems.totalissues (Koha issues (borrowed), all copies)
5. Apply the patch.
6. Restart all the things (restart_all).
7. Reload the page.
8. Note that there are now descriptions for the columns in step 4.
9. Note that the descriptions for these columns are changed (for
   consistency with other tables, or clarification):
   - items.itype => Koha item type (previously Koha itemtype)
   - items.timestamp => Modification date (previously Timestamp)
   - biblioitems.timestamp => Modification date (previously Timestamp)
   - biblioitems.illus => Other physical details (previously
     Illustrations)
   - biblioitems.biblioitemnumber => Biblio item number (internal)
     (previously Biblioitem number)
   - biblioitems.biblionumber (and also acqorders.biblionumber and
     biblio.biblionumber) => Biblio number (internal)
     (previously Biblio number)
10. Sign off :D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Eric Garcia <cubingguy714@gmail.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 50035288b0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 19:47:01 +00:00
Martin Renvoize bb44f6971d Bug 36428: (QA follow-up) Remove filter_by_future
I actually already started to remove this in another bug, but it makes
sense to do it here where we're introducing the 'active' filter.  I'm in
agreement that this should probably always have been an 'active' rather
than 'future' filtering.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 39920e03f1)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 19:29:25 +00:00
Nick Clemens 77e2d0d0f6 Bug 36428: Add Bookings->filter_by_active and use it for display
Currently the bookings tab on a biblio details and patron details use 'filter_by_future'
which lists upcoming bookings.

Libraries would like to see upcoming, and active bookings in these cases, and we should add a filter
for bookings that have not ended.

NOTE: This removes the only uses of filter_by_future, but I preserve this for Martin's decision as the creator
of the bookings module

To test:
 1 - Make an item bookable from the items tab on a record details
 2 - Return to details view and place a booking
 3 - Note sidebar says "Bookings (1)"
 4 - Make the booking current from the DB:
     UPDATE bookings SET start_date=NOW() WHERE biblio_id={biblionumber};
 5 - Reload the page
 6 - Note the count is now "Bookings (0)"
 7 - View the patron's details page - note "Bookings (0)" and none listed
 8 - Apply patch
 9 - Reload biblio details, note Bookings(1)
10 - Reload patron details, note Bookings(1) and booking is listed
11 - End the booking:
     UPDATE bookings SET end_date=NOW() WHERE biblio_id={biblionumber};
12 - Confirm booking no longer listed on biblio or patron details

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 859e84417e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 19:29:25 +00:00
Matt Blenkinsop 227a5619a4 Bug 36937: Remove warning from unit tests
This patch fixes a warning in the unit tests

Test plan:
1) prove t/db_dependent/api/v1/password_validation.t
2) There will be a warning in the output - 'Use of uninitialized value $status in numeric eq (==)'
3) Apply patch
4) Re-run the test
5) The warning will disappear

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 5e7572ad7a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-18 17:42:16 +00:00
Lucas Gass 8bd61eba3d Bug 37316: Treat empty string barcodes as undef
To test:
1.Add the following to MarcItemFieldsToOrder:

homebranch: 949$a
holdingbranch: 949$b
itype: 949$y
nonpublic_note: 949$x
public_note: 949$z
loc: 949$c
ccode: 949$8
notforloan: 949$7
uri: 949$u
copyno: 949$t
price: 949$g|949$j
replacementprice: 949$v
itemcallnumber: 949$o
quantity: 949$k
budget_code: 949$l
coded_location_qualifier: 949$f
enumchron: 949$h

2. Add the following to MarcFieldsToOrder:

price: 949$g
quantity: 949$k
budget_code: 949$l
discount: 949$m
sort1: 949$n
sort2: 949$q

3. Acquisitions > Find a vendor
4. Create a new basket -> Add to basket -> From new file
5. Use the file uplodaded in this bug report.
6. Set format to MARCXML and stage for import.
7. Add staged files to basket
8. Select all, make sure you add an item type, and choose 'Do not look for matching records'
9. Save and kaboom.
10. APPLY PATCH and restart_all
11. Follow the steps again, this time no kaboom.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b68373ae42)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-17 21:11:42 +00:00
Tomas Cohen Arazi 6205b4910d Bug 34838: Use ->set to avoid method redefinition warnings
This patch silences more warnings. To test

1. Be on 23.11.x
2. Apply the patches before this one
3. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Illrequests.t
=> FAIL: Lots of warnings like this:
Subroutine Koha::Illrequest::SUPER::status redefined at /kohadevbox/koha/Koha/Object.pm line 955.
Subroutine Koha::Illrequest::SUPER::status_alias redefined at /kohadevbox/koha/Koha/Object.pm line 955.
illrequestattributes is DEPRECATED in favor of extended_attributes at t/db_dependent/Illrequests.t line 1071.
4. Apply this patch
5. Repeat 3
=> SUCCESS: No more warnings!
6. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ff42535f96)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:21:39 +00:00
Pedro Amorim 7472c619a0 Bug 34838: Tidy
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fff166679b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:21:39 +00:00
Pedro Amorim 0dc1aaf09d Bug 34838: Only check for status in status graph if request has a status
This check is required because when the existing_statuses method checks for the existing status_alias, it'll leave out the status from the query, so the status will be NULL for those particular query results when calling strings_map, throwing a warning

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 3caabe886e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:21:39 +00:00
Pedro Amorim 804f8b4fbb Bug 34838: Only call strings_map if status_alias is not undef in status_alias cycle
Because its highly likely that at least one request will have status_alias null in the database, the select MAX query will always return at least one result with NULL status_alias, throwing a warning, so we skip that

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 4231def42e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:21:39 +00:00
Pedro Amorim 6909c637bd Bug 34838: Replace SUPER::AUTOLOAD with get_column
I'm not 100% happy with this but I'm out of ideas.

I think the problem warning happens because there is no method status or status_alias directly defined in Object.pm so it tries to define it, but it has already been defined by AUTOLOAD previously.

Test plan:
  prove t/db_dependent/Koha/Illbackend.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a9f6f47afb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:21:39 +00:00
Martin Renvoize 647d5e9a9e Bug 37040: (RMaint follow-up) Restore passing CSRF error
This patch restores the plack.middleware.Koha.CSRF plack env setting to
allow passing to the errorDocument.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8cd6b43504)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:14:34 +00:00
Matt Blenkinsop e708597417 Bug 37040: (QA follow-up) Tidy file
QA tests were failing for tidyness so this patch addresses that

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit aeabe6c9f6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:14:34 +00:00
David Cook cd7123734e Bug 37040: Prevent ErrorDocument subrequests from activating CSRF
This change improves the mechanism for preventing the CSRF middleware
being activated by ErrorDocument subrequests.

This change was necessary due to a subtle issue identified by
Bug 37041.

Test plan:
0. Apply the patch
1. Restart Koha
koha-plack --restart kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=9908
3. Log in
4. Note that you get a pretty 403 and not an ugly plain text error
5. Go to http://localhost:8081
6. Fill in the login details, but use the HTML inspector to delete
the csrf_token from the hidden inputs
7. Submit the login
8. Note a pretty 403 page

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c1ac124176)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-27 16:14:34 +00:00
Matt Blenkinsop 31dd31d324 Bug 37043: Update the base URL for the Counter Registry API
Test plan:
1) prove t/db_dependent/api/v1/erm_sushi_services.t
2) t/db_dependent/api/v1/erm_counter_registries.t

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8c90b87583)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-06-26 15:19:51 +00:00
Marcel de Rooy cf1f726616 Bug 36875: (follow-up) Modify query in translated_content
This removes the MySQLism for FIELD(..).
In this case we just want to get the non-default records in
the front. So we can just test lang=default. And prevent inserting
$lang in the expression. And so prevent execution in ORDER BY.
No longer needing the ->quote call too.

Test plan:
Run Koha/AdditionalContents.t again.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c16f5c61849460489992977812f020ec7fa5c9f3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Chris Cormack cbb2fd5c01 Bug 36818: Escape characters in file names uploaded
To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 14bdaae3f257a321f8ec0d32c6b1e9bc6ed6033d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2024-06-06 10:49:20 +02:00
Katrin Fischer 09d2c0ac10
Bug 36819: DBIC schema update
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-24 15:36:41 +02:00
Martin Renvoize 6b413acfc4
Bug 35285: Add non-html template support to html_content wrapping
This patch adds support for messages generated using non-html formatted
notice templates to the html_content method of Koha::Notice::Message.

We continue to wrap content for html generated messages with the
appropriate headers, css and title.

For non-html generated content we wrap in the <div style="white-space:
pre-wrap"> block to maintain text formatting as defined in the original
plaintext template.

Test
Follow the test plan for bug 30287, nothing should outwardly change.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-17 10:36:36 +02:00
Katrin Fischer b40106526d
Bug 28869: DBIC schema update
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-17 10:36:26 +02:00
Marcel de Rooy 593c184274
Bug 28869: Implement authorised_value_categories.is_integer_only
Test plan:
Add category with/without integer restriction.
Test adding/editing values.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-17 10:36:23 +02:00
Nick Clemens ab715cab3a
Bug 36149: (follow-up) POD and tidy
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-05-14 15:04:36 -03:00
Jonathan Druart df23f6c345
Bug 36149: Unset userenv from middleware
The userenv (logged in user's info) are stored in
$C4::Context->context->{activeuser}, which persists in plack worker's
memory.
It's really bad in theory as we are not cleaning it before or after the
HTTP request, but only when set_userenv is called (what we are doing
commonly in C4::Auth::get_template_and_user).
If C4::Context->userenv is called before set_userenv we should get undef,
not the userenv from the previous request!
In practice this should not be a problem, but well... who really knows?

This patch suggests to have a middleware to deal with removing the
userenv at the beginning of each request (maybe it should be after, right? - FIXME).

To test:
1 - Edit /etc/koha/sites/kohadev/koha-conf.xml to set <plack_workers>1</plack_workers>
2 - Edit about.pl  and add a line after: CGI->new:
    warn Data::Dumper::Dumper( C4::Cointext->userenv() );
3 - tail -f /var/log/koha/kohadev/*.log
4 - View about.pl in staff interface, should get a "somethign's wrong" warning
5 - Reload, you get current user info
6 - Open an incognito tab, sign in as a different user and click some stuff
7 - Reload about.pl in other window
8 - You get the opac user info
9 - Apply patch
10 - Edit /etc/koha/sites/kohadev/plack.psgi and add the middleware after "RealIP":
     enable "+Koha::Middleware::UserEnv";
11 - Restart all
12 - Reload about.pl - you get a "Something's wrong" warning
13 - Click things in opac on incognito window
14 - Reload about.pl  - only "Something's wrong" - you no longer see any user info

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-05-14 15:04:36 -03:00
Jonathan Druart 1efe9ffc77
Bug 19613: Use the 'note' profile
WNC amended patch: tidied

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-05-14 15:04:35 -03:00
Jonathan Druart b31c732105
Bug 19613: Scrub borrowers fields: borrowernotes opacnote
To prevent XSS

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-05-14 15:04:34 -03:00
Jonathan Druart 40ca270825
Bug 29948: OPACAuthorIdentifiersAndInformation
This patch merge the previous patch attempt with the existing OPACAuthorIdentifiers syspref.

It creates a new syspref OPACAuthorIdentifiersAndInformation and remove
OPACAuthorIdentifiers.
"identifiers" become an entry of the new syspref.

Test plan:
Select some entries in OPACAuthorIdentifiersAndInformation
Edit an authority record and enter data in the corresponding subfield
(the list is on the syspref entry)
Go to the biblio detail page or the authority detail page at the OPAC
and notice that the info you selected are correctly displayed.

Sponsored-by: Orex Digital

Signed-off-by: Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-13 14:00:10 +02:00
Jonathan Druart 070f720aae
Bug 29948: Display authors information along with the identifiers
Sponsored-by: Orex Digital

Signed-off-by: Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-13 14:00:10 +02:00
Janusz Kaczmarek c74169ba27
Bug 36794: Illegitimate modification of biblionumber subfield content (999 $c)
It happens that librarians, by mistake, open a biblio editor putting in the
URL, by hand, the biblionumber prefixed with a blank (e.g.
.../addbiblio.pl?biblionumber= 123 -- mind the space before 123).
In such a case the editor opens with the right biblio record (i.e. 123)
but, after saving the record, the content of the biblionumber MARC
field (999 $c for a standard MARC 21 installation) results modified and
contains additional initial blanks.

Moreover, while using ES and making a search for the record (with title,
author etc.) we get two records on the result list (instead of one).

This is because in the addbiblio.pl script $biblionumber is taken (and
continuously used) directly from CGI parameter, without any
validation and/or correction.

Test plan:
==========
0. Have a test installation with ES.
1. Open a biblio record in the editor with an added space before
   biblionumber value, e.g.:
   http://ktd:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber= 123
   Save the record.
2. From the Normal view choose Save -> MARCXML.  Open the saved file in
   your favourite editor.  You should see, at the end, something like:
   <datafield tag="999" ind1=" " ind2=" ">
     <subfield code="c"> 123</subfield>
   (mind the space before 123).
   This is not right.
3. Make a search with the title or author's name from the record (e.g.
   Henning Mankell for the record 123 from the default ktd data set).
   You should get two records instead of one (while using ES).
4. Apply the patch, restart_all.  Repeat p. 1 and 2 with a different
   biblionumber.  Notice the unchanged (i.e. without spaces) value
   of 999 $c subfield in the exported record and only one record
   as a result of a search.

WNC amended patch - rebased, added conditional in case no bib, moved comments to their own lines

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-13 10:36:11 +02:00
Matt Blenkinsop af6a0b78b7
Bug 34788: (follow-up): Fix translations
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 17:46:15 +02:00
Martin Renvoize cee9da8efc
Bug 33737: Add bookings tab to patron details
This patch adds a new 'bookings' tab to the bottom of the members
details pages.  When a patron has any future or current bookings against
their record the tab will display the number of bookings in the tab name
and on clicking the tab a bookings table will display the current and
upcoming bookings.

Signed-off-by: Esther Melander <esther@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:56 +02:00
Marcel de Rooy 9f8186eaa1
Bug 35994: Add $biblio->acq_status
This allows you to see quickly if a biblio has linked orders or not.
And if they are all cancelled, or some still in processing, or some
are complete (and the rest cancelled).

Test plan:
Run t/db_dependent/Koha/Biblio.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:53 +02:00
Katrin Fischer dbc7a74427
Bug 36755: DBIC schema update
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:53 +02:00
Katrin Fischer a2a2676976
Bug 30047: DBIC schema update
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:52 +02:00
Nick Clemens 26f3202369
Bug 30047: Add new heading field to auth_header table
This patch adds a new heading field containing the display form of the authority record

NOTE: If trying to save an auhority in the 'DEFAULT' framework, you will get an error, you should not be
using DEFAULT for authorities and we should remove from the list on another bug

To test:
1 - Apply patches
2 - Update database
3 - Restart all
4 - Create a new authority, save.
5 - Do this for various types
6 - View the db records:
    SELECT * FROM auth_header\G
7 - Note new heading field is populated correctly
8 - Edit your new authorities
9 - Confirm the heading field is updated correctly
10 - Import some authorities and confirm heading generated correctly
11 - Import auth via Z39.50 and confirm heading generated correctly

Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:51 +02:00
Marcel de Rooy faeebd7486
Bug 36018: (follow-up) Disambiguate quantity
One of the embeds refers to suggestions. This table also has
a quantity column.

Test plan:
Verify that Pending Orders table does load now instead of
triggering an internal server error on ambiguous column.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-05-10 16:45:48 +02:00