This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.
The tests verify:
* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
to be mentioned in the description.
All routes get fixed to make the tests pass.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ yarn api:bundle
k$ prove xt/api.t
=> SUCCESS: Tests pass!
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 58677f8e2e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f4cab95872)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch adds regression tests. With the current codebase, the
malicious query returns a 200. It should be caught and a 400 needs to be
returned.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/api/v1/query.t
=> FAIL: It returns a 200
3. Once the rest of the patches are ready, repeat 2
=> SUCCESS: It returns a 400
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1fd94e90bc)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit fffc5600cad077e8b4d8d5211263f1935c5b07cd)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch moves some patron fetching code in C4/Auth to use to patron returned from the validation
methods and only try to fetch the patron (to check if locked, update attempts, etc) if we didn't authenticate
To test:
1 - Set a user to have userid = BANANA password = Password1
2 - Set a user to have cardnumber = BANANA password = Password2
3 - Hit the patron authentication API:
http://localhost:8080/api/v1/auth/password/validation
with data:
{ "identifier": "BANANA", "password":"Password1" }
and:
{ "identifier": "BANANA", "password":"Password2" }
4 - Note you receive the same response for both
5 - Apply patch, restart all
6 - Repeat the API and confirm you get the correct patron for the password submitted
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
To prevent XSS
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 83db8696ca7a83aba224a0ab645f03447a96887b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 383984a016)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch adds a Koha::Session module that makes it easier
to work with Koha sessions without needing the full C4::Auth module.
Test plan:
0. Apply the patch
1. Run the following unit tests:
prove ./t/db_dependent/Auth.t
prove ./t/db_dependent/Auth_with_cas.t
prove ./t/db_dependent/Koha/Session.t
2. Observe that they all pass
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0e6537d199)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit f927343a88)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e19e066b4a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Running cataloguing pluings (in cataloguing/value_builder) now requires
authentification.
This patch adds in failing unit tests a mock of C4::Auth::check_cookie_auth
Test with:
prove t/db_dependent/FrameworkPlugin.t t/db_dependent/Koha/UI/Form/Builder/Biblio.t t/db_dependent/Koha/UI/Form/Builder/Item.t t/db_dependent/Serials.t
(cherry picked from commit f8a23b8ef4)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
suite
This patch harmonizes the hook name and parameters with the rest of the
codebase.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ qa
=> SUCCESS: All looks green, and tests still pass (i.e. they were
correctly adjusted to the new schema).
3. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 353f510c14)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit e00cfb3c7b3954e545ad4b363bff48a8f4345d0a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 7073d11457)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch introduces some tests on the current (and new) behavior for
the `checkpw` function.
I needed it to better understand if an edge case was actually possible
(it wasn't).
Found a really minor annoyance for the internal check with expired
password not returning the $patron object for consistency with the other
use cases.
I think this method deserves (at least) changing the return value to a
sane data structure. But that's not target for backporting to stable
releases. So a separate bug.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5476b18e7ea34e08d9dd163e2c446d5b223cf032)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 76bda46ad5a4916aa907f2eb11f81eaaedf19f37)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 29782174570a331c1b9f1ac8196ce06364f8f691)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Code lifted from bug 31794 to fix already backported bug 26611.
Unit tests included.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 40115a2c8cba3e081ffd0710899ef4556a3bbb54)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
This fix patrons_search.t but other selenium tests certainly need
adjustements
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
This patch adds a few pieces of information to the print slip button
and makes the code confirm the hold
As we are printing before the confirm, we also add the ability to pass
in the itemnumber to 'ReserveSlip'
This is slightly hacky, however, I don't see another way to allow
printing without an additional page reload.
To test:
1 - Place a title level hold for patron A, for delivery to library B
2 - Attempt to checkout an item from the record above to Patron B from
library A
3 - You receive an alert about the hold
4 - Click "Don't check out, confirm hold, and print slip"
5 - Confirm the slip looks correct and has item info
6 - Confirm that item is in transit to fill hold
7 - Revert transit status
8 - Attempt to checkout the item to Patron B from Library B
9 - Click "Don't check out, confirm hold, and print slip"
10 - Confirm slip is correct
11 - Confirm item is marked waiting
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3ec73d80e2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 96442d7ac7)
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit f1bbdee7ac)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 550bc76328)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
<key content="value"></key>
was wrongly parsed as
{ key => 'value' }
whereas it should be
{ key => { content => 'value' } }
The 'content' attribute is used in shibboleth config
Test plan:
1 Run `prove t/Koha/Config.t`
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6973625e7a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 35ae7b467e)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
To test:
1. In KTD use grep -rn --exclude=*.po "datexpiry" *
2. Notice that the four locations below are showing the typo:
1. git add koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt
2. git add misc/release_notes/release_notes_18_05_00.html
3. git add misc/release_notes/release_notes_18_05_00.md
4. git add t/db_dependent/Koha/Patrons/Import.t
3. Apply patch. Repeat step 1.
4. Notice that no results show. All instances of the typo have been fixed to dateexpiry.
5. Sign off and have a great day :)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d742f29d77)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9b87ae61ad)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
This could be extended later in bug 32968 to pass the permission of the
logged in user.
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit cda3c377a20c401ef9a755f24eb839d515a8af72)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 5078f9f4df)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
From bug bug 34448.
386 // Submit the form, get 500
387 cy.intercept("POST", "/api/v1/erm/agreements", {
388 statusCode: 500,
389 error: "Something went wrong",
390 });
391 cy.get("#agreements_add").contains("Submit").click();
392 cy.get("main div[class='dialog alert']").contains(
393 "Something went wrong: SyntaxError: Unexpected end of JSON input"
394 );
This is wrong: we are now showing a JS error (SyntaxError) instead of the expected 500: internal server error!
The problem was that a regular 500 does not have anything in the body,
and _fetchJSON didn't handle that ( JSON.parse(text) ).
If the body of the response does not contain anything we need to get the
text from statusText (which contains "Internal Server Error" in case of
500).
Test plan:
1. Make sure all cypress tests pass
2. Confirm the above:
Raise an exception from a given route (/agreements for instance) and
confirm that the error displayed on the interface is correct (ie. not
SyntaxError, but "Error: Internal Server Error")
For QA:
* This change is covered properly in Dialog_spec.ts, no need to redo it in
every other test files.
* Without the following change in count, we see:
"Something went wrong: Error: Error: Internal Server Error" because
setError is called twice. We don't need to set the error from count, it
has been set from _fetchJSON already.
- error => {
- setError(error.toString());
- }
+ error => {}
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit df3acf3d68)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ae3804270d)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit c67d28c5f9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit d37fbdb665)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Test Plan:
1) Apply this patch
2) prove t/db_dependent/Letters.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit c91e02a4d6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit adeb074491)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 683b74d202)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 6de7575cae)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Non-trivial was adding the category_type <> S.
Test plan:
Run t/db_dependent/Members.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit f08fc01867)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 6dbbbef3e9)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 1a2288052d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ff565dd3b8)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Calendars can be configured in a way that all days are closed.
The simplest way to do that is to configure a repeatable holiday for
every day of the week.
With such calendars, searching for an open day will literally take
forever.
This patch sets a hard limit on how many iterations are allowed before
giving up. This limit is set to the arbitrary value of 5000, which
should be large enough to be able to consider there is no open days if
we haven't found any with that many iterations, and small enough to
allow the loop to end quickly
Test plan:
1. Set system preference 'useDaysMode' to 'Use the calendar to push the
due date to the next open day' ('Datedue'). Make sure the existing
circulation rules do not conflict with that setting.
2. Browse to Tools » Calendar
3. Set every day of the week to "Holiday repeated every same day of the
week"
4. Issue an item to a patron
5. Check the box and select 'Renew selected items'
6. The renewal should fail pretty quickly
Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2b58f4d89c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0f304c55e2)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
This patch strips non-XML characters from inputs during
TransformHtmlToMarc.
To test:
0. Apply patch
1. koha-plack --restart kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl
3. Fill out record and use the text from "Text file containing control characters"
as the title
4. Click Save
5. Note that your record displays without any warnings like the following:
Error: invalid data, cannot decode metadata object
parser error : PCDATA invalid Char value 27
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Squashed the tidy patch. Still needed a few spaces to satisfy qa tools.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3e1d32f9ca)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 871d6eaa3f)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Tomas Cohen Arazi
Martin Renvoize
Jonathan Druart
Nick Clemens
Frédéric Demians
Lucas Gass
David Cook
Fridolin Somers
Andreas Jonsson
Kyle M Hall
Matt Blenkinsop
Pedro Amorim
Julian Maurice
Laura Escamilla
Marcel de Rooy