Commit Graph

59291 Commits

Author SHA1 Message Date
Nick Clemens bdf224c653
Bug 37562: Add patron title to duplicate patron warning and don't show popup if cannot see patron
This patch passes the suspected duplicate to the template and uses patron title to display very brief info.
If the user cannot view the patron there is no longer a link tot he brief popup and they will only see
'A patron from library X"

There is a FIXME asking if we should use search_limited - I believe we should check all branches, so the staff can ask the patron if they
have an exising account in a consortium depending on rules about multiple cards

To test:
 1 - Edit a user to grant catalogue and all borrower permissions except 'view_borrower_infos_from_any_libraries'
 2 - Find a patron from a different library and note surname and firstname
 3 - Login as the patron above
 4 - Enter a new patron with the same surname and firstname
 5 - See the 'Duplicate patron' warning
 6 - Click to view the patron
 7 - No info is listed
 8 - Apply patch
 9 - Reload and resubmit - or fill out form again
10 - Note that you see 'A patron from library XXX' and no popup link
11 - Add view_borrower_infos_from_any_libraries to the staff
12 - Repeat the duplication and confirm the warning now has patron name and the popup link is visible and works

Signed-off-by: Sam Lau <samalau@gmail.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:50 +02:00
Noémie Ariste ce24cdc1da
Bug 34610: Update deprecated ProtectSuperlibrarian string
Test:
1. Set ProtectSuperlibrarianPrivileges system preference to Allow only
   superlibrarians
2. Give superlibrarian permissions to a user (User 1)
3. Give catalogue, borrowers, permissions, and staffaccess  permissions
   to a second user (User 2)
3. Login as User 2
4. Go to User 1 permission settings page.
5. Hover over the Select all and Clear all links.
6. Check the message that appears contains
   ProtectSuperlibrarianPrivileges and not ProtectSuperlibrarian

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:49 +02:00
Nick Clemens 8ef9ac5445
Bug 37552: Wrap auto renewal attempt in eval to ensure script does not die
When libraries have a lot of checkouts, or an AMH, checkins can happen while the cron is running.

This patch simply adds an eval around the auto renewal attempt in case of early check in or other errors.

You can verify cron completed by enabling cronjob log in system preferences and checking the action logs

To test:
1 - Add 'sleep(10);' to automatic_renewals.pl
2 - Set circulation rules to enable automatic renewals
3 - Issue an item to a patron
4 - perl misc/cronjobs/automatic_renewals.pl -v
5 - Confirm item would not be renewed
6 - perl misc/cronjobs/automatic_renewals.pl -v -c
7 - Quickly check in the item
8 - The cronjob dies
    DBIx::Class::Row::update(): Can't update Koha::Schema::Result::Issue=HASH(0x586e1a674fb0): row not found at /kohadevbox/koha/Koha/Object.pm line 172
9 - Apply patch
10 - Checkout the item again
11 - perl misc/cronjobs/automatic_renewals.pl -v -c
12 - Quickly checkin the item
13 - You get a warning, but the cron completes

Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:49 +02:00
Johanna Räisä 5c41c1c657
Bug 37591: Fix moredetail.tt performance issue
This patch fixes the performance issue in moredetail.tt by removing the
unnecessary call of checkout_renewals table.

To test:
1. Create lot of checkouts and renewals for a record.
2. Open the moredetail page for the record.
3. Check the timing of the page load.
4. Apply the patch and check the timing of the page load again.
5. The page load should be faster after applying the patch.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:48 +02:00
CJ Lynce 7d0563e1c5
Bug 37382: Report download is empty except for headers if .tab format is selected
When exporting a report in tab delimited format, the downloaded file
    would have the header rows but no data results.
Also, misc files are created on the server file system in koha/reports
    with data that should have been in the .tab file.
This patch fixes both of these issues.

To test:
1. Login to staff client
2. Go to Reports and create a report from SQL - sample report
    SELECT i.barcode, b.title, b.biblionumber, i.itemnumber
	FROM items i
	LEFT JOIN biblio b on i.biblionumber = b.biblionumber
	WHERE i.itemnumber < 50
3. Run the report
4. Click 'Download'->'Tab separated text'
5. Download file
6. Open file in a text editor or favorite spreadsheet app
    File will have headers rows, but no other item data
6a. If able, check the server filesystem in koha/reports
	There may be files there related to report data. Remove.
7. Apply Patch
8. Repeat steps 3-6,
    File will now have the table data, hooray!
8a. If able, check the server filesystem in koha/reports
	No new files should be created.

Signed-off-by: Laura ONeil <laura@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:48 +02:00
Sam Lau 0dad564763
Bug 37409: Fix 'Edit' button for items in course reserves list
To test:
1) Set the 'UseCourseReserves' sys pref to 'Use'
2) Go to the Course reserves page
3) Create a new course, fill in the required info and make sure the 'Enabled?' is checked
4) Add a reserve to this course
5) From the course details page, select edit on the reserve you just made.
6) Note it brings you back to the add reserves page, and you are required to enter the barcode/biblionumber again to edit
7) Apply patch, restart_all
8) Press the edit button again
9) Now you are directed towards the correct page for editing
10) Make some changes and press save
11) You should be redirected back to the details page and your changes have been made

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:47 +02:00
Tomas Cohen Arazi 923dc5e078
Bug 37510: Make Koha::Object->delete throw Koha::Exception
This patch makes Koha::Object->delete wrap DBIC exceptions on FK
constraints and throw a Koha::Exception::Object::FKConstraint exception
instead. This will allow us better handling it from the callers.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Object.t
=> FAIL: A DBIC exception is thrown instead, tests fail
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:46 +02:00
Tomas Cohen Arazi 30a5baa706
Bug 37510: Unit tests
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:46 +02:00
Jonathan Druart 8aced236e9
Bug 37429: Set default value for global variables
The global variables needs to be assigned with a default value, or the
value from the previous request will be used.

Global variables are persistent from one request to another, in memory.

This patch:
* groups default value for global variables together
* removes $authorised_values_sth from this list (it is not a global var)
* set $changed_framework to 0 (which fix the issue)

Test plan:
1. Open an existing biblio (detail.pl)
2. Click "Edit record"
3. Change the framework (no need to change any details)
4. Change the framework back to the original one (no need to save anything)
5. Go back to the biblio overview page (detail.pl)
=> The form is populated

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:45 +02:00
Phil Ringnalda 0f255728c5
Bug 37614: Printing patron cards from patron lists should be a GET
There's no creating, updating, or deleting about printing patron cards, and
the only time there's a lot of data (selecting individual patrons in a card
creator batch), it doesn't matter if the "Export selected" URL exceeds the
maxlength for Apache since the actual link to create the PDF also will.

Test plan:
 1. Without the patch, Tools - Patron lists - New patron list - Name it and
    Save
 2. Type three characters in the Patron search form (mar works well) to get
    at least three patrons. Click on each of three, then click Add patrons
 3. You can only print cards from the list of lists, so back to Tools -
    Patron lists
 4. In the Actions menu choose Print patron cards, in the popup click Export
 5. Watch the throbber spin around for a while (it will never stop), then
    close the popup, apply the patch, restart_all
 6. Tools - Patron lists - Actions menu - Print patron cards - Export
 7. Click the PDF link, make sure it has all three of your patrons
 8. Tools - Patron card creator - New - Card batch
 9. Without putting anything in the textarea, click Add patrons, in the
    search popup search for your three characters (mar) again, and click
    the checkboxes to the left of three of the names, then Add selected
    patrons, then Close, then Add patrons
10. Click the checkboxes for two of the three patrons, then Export selected
    card(s), then Export in the popup
11. Hover the link to the PDF, verify that it doesn't have stray 'amp;'
    after the & and before label_id= anymore
12. Click the PDF link, verify it has your two patrons
13. Back at the card batch, click Export card batch, then Export
14. Check the PDF to verify it has all three of your patrons
15. Tools - Patron lists - click your list's name to open it
16. Click the card number for a patron, then the Patron lists tab in Checkout
17. Actions menu - Print patron cards - Export, verify the PDF has all three
    patrons

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:45 +02:00
Kyle M Hall 5a06bd0d73
Bug 37308: (QA follow-up) Tidy code
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:44 +02:00
Pedro Amorim 8175cccca2
Bug 37308: Add user-agent for SUSHI outgoing requests
Signed-off-by: Belal Ahmadi <belal.ahmadi@uwl.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:43 +02:00
Nick Clemens cf315751cf
Bug 37543: (follow-up) Tidy
Tidy the whole thing

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:43 +02:00
Rudolf Byker 0e9ea3c9f5
Bug 37543: Use CSRF tokens in connexion_import_daemon.pl
Since version 24.05, due to the changes mentioned at
https://wiki.koha-community.org/wiki/Koha_/svc/_HTTP_API#Changes_coming_in_Koha_24.05 ,
the `connexion_import_daemon.pl` stopped working. The reason for this is that
it did not use CSRF tokens.

To test:
1. Get a Koha instance on 24.05, before applying the patch.
2. Create a plain text file somewhere on the server containing a raw MARC
   record (not XML). Let's call it `marc.txt`.
3. On the server, create a config file like this:
```
host: 0.0.0.0
port: 5500
koha: http://localhost:82  # Where 82 is the port of the Koha staff interface.
user: foo  # A Koha staff user.
password: Fooo1234  # The Koha staff user's password.
import_mode: stage
```
4. Run `./connexion_import_daemon.pl --config the-config-file-path`
5. In another terminal on the same server (or from anywhere that can reach the
   port opened by the `connexion_import_daemon.pl` script,
   run `nc localhost 5500 < marc.txt`
6. Observe in the stderr of the daemon script: `Response: Unsuccessful request`
7. Stop the daemon script.
8. Apply the patch and repeat steps 4 and 5.
9. Observe in the stderr of the daemon script:
   `Response: Success.  Batch number ... - biblio record number HASH(...) added to Koha`
10. Check at /cgi-bin/koha/tools/manage-marc-import.pl for a batch named
    `(webservice)`. It should contain one record now. This is how we know that
    authentication between the daemon and Koha worked, which is what this
    patch tries to address.

Thanks-to: David Cook <dcook@prosentient.com.au>
Sponsored-by: Reformational Study Centre <www.refstudycentre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:42 +02:00
Brendan Lawlor e6b2b342d2
Bug 37536: Update conditional to check for 'cud-saveitem'
In additem.pl and additem.tt all instances of 'saveitem' have been updated to 'cud-saveitem'
The javascript needs to be updated in the same way.

Test plan:
- Make sure acqcreateitem is set to "when placing an order"
- Create a basket with some orders
- Close the basket
- Go to your vendor and receive an order
- On the receive page, try to edit your item
=> Without the patch, the pop up page will open and then close, not allowing the item to be edited.
=> With this patch applied you will see the item edit form. Save and
confirm that the parent window is updated with the new value (actually
it's refreshed)

QA notes:
1. git grep 'saveitem'
2. Notice all instances in additem.pl and additem.tt have been updated to 'cud-saveitem'
3. Notice cataloging_additem.js checks if op != 'saveitem'
4. Check the files and verify the change makes sense

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:42 +02:00
Nick Clemens 44b2c48ace
Bug 36736: Load plugins at the start of background job processing
This patch adds a call to get_enabled_plugins before processing background jobs to ensure
that all plugin hooks are loaded and cached

To test:
1 - Install a plugin that adds new objects e.g. the Contracts plugin
    https://github.com/bywatersolutions/fs-koha-plugin-contracts
    or the Koha Advent plugin:
    https://gitlab.com/koha-community/koha-advent/koha-plugin-fancyplugin
2 - Restart all
3 - Tail all your logs
4 - Stage and import a file containing items
5 - Note in the logs
    DBI Exception: DBD::mysql::st execute failed: Lock wait timeout exceeded; try restarting transaction
6 - Apply this patch
7 - Restart all
8 - Stage and import again
9 - Success!

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 17:33:41 +02:00
Nick Clemens ed04035e9f
Bug 37508: Don't return Internal server error when running report
To test:
1 - Create a report like:
SELECT "a"
FROM borrowers
WHERE <<Test>> != ''
2 - Run report
3 - Enter "password"
4 - Internal server error / stacktrace
5 - Apply patch
6 - Repeat
7 - Get a yellow warning box

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:27 +02:00
Marcel de Rooy 0c029ee849
Bug 37508: (QA follow-up) Use ->check_columns
Add shebang to Guided.t too.

Test plan:
See also previous commits.
Try sql like:
  select access_token from oauth_access_tokens

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:26 +02:00
Marcel de Rooy aebc7ba8db
Bug 37508: (QA follow-up) Move check to Koha::Report, extend
Do not allow password but allow password_expiry_days etc.
Do not allow token, secret and uuid too.

Test plan:
Run t/db_dependent/Koha/Reports.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:25 +02:00
Aleisha Amohia ed6cb0f274
Bug 37508: (follow-up) Don't pass the column or sql containing password
This patch replaces these variables with a non-translatable message.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:25 +02:00
Aleisha Amohia 2d1f58242b
Bug 37508: (follow-up) Throw error is password is in SQL query at all
Confirm tests pass t/db_dependent/Reports/Guided.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:24 +02:00
David Cook 8e05b3933b
Bug 37508: Test for errors when returning an aliased password column
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:24 +02:00
Aleisha Amohia 947865f83b
Bug 37508: Throw error if password column is detected in SQL report
This enhancement prevents SQL queries from being run if they would return a password field from the database table.

To test:

1. Run tests and notice they fail t/db_dependent/Reports/Guided.t

2. Apply patch and restart services

3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:23 +02:00
Tomas Cohen Arazi aec8c65336
Bug 37370: Return 400 if OpacExportOptions does not contain the passed format
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit a164c51d78f375d9d660e2c079cc7e05d2d1d326)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:23 +02:00
David Cook 32d6199b7c
Bug 37466: Add correct filter for sort_by in results.tt
This patch replaces the $raw filter with the correct uri filter
for the sort_by in results.tt

Test plan:
1. Apply patch
2. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=1
3. Click on "Edit this search"
4. Note that the "Popularity (most to least)" Sort by option is selected
5. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=24y24ty2498294t9824yt9y23
6. Click on "Edit this search"
7. Note that the "Popularity (most to least)" Sort by option is selected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5148e05d408b43c0eb330683ffa4c26c90faa696)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:22 +02:00
David Cook 623e1c5912
Bug 37464: Validate "type" sent to barcode/svc
This change validates the "type" sent to the barcode/svc. Without this
change, we pass the user input directly to GD::Barcode, which passes
the input into an eval{} block without any validation of its own.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
3. Note that a Code39 barcode is provided for an invalid type
4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
5. Note that a Code39 barcode is provided
6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
7. Note that a non-Code39 barcode is provided (presumably UPCE)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 73b0c3cf621250008845f22f7a36f90a48e00b06)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:21 +02:00
David Cook 751e72dfda
Bug 37488: Validate paths in datalink.txt/idlink.txt files
This change validates the paths in datalink.txt/idlink.txt,
so that only images in the unpacked archive directory are allowed

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Create a datalink.txt file with the following:
42,selfie.jpg
3. Create a jpeg at selfie.jpg
4. ZIP the datalink.txt and selfie.jpg files
5. Upload to the "Upload patron images" tool
(after enabling the "patronimages" system preference)
6. Note that the image uploads correctly

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 8fcb767fe2836c90ceacb5b5d8211524571eb8aa)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:21 +02:00
David Cook 4e7f850c59
Bug 37323: Tidy
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 579c28c764257a250c12aa11207772c074c1335e)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:20 +02:00
Chris Cormack d8697314cd
Bug 37323: Don't allow symlinks in link files in zip and validate filepaths
Test plan:
0. Apply patch and restart/reload Koha
1. Test that uploading a patron image still works, in single file format and as a zip

Work as suggested

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 9bc0521493fbe2f9fe0dde051d0b2f52c8a14a9a)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:20 +02:00
Amit Gupta 50968f4c3f
Bug 37323: Escape characters in patron image picture upload
To Test
1. Create a file name for example: test.zip`curl xxxxtesting.informaticsglobal.com`.zip
   where the domain is one you can watch the logs from.
2. Go to Tools and click on Upload patron images choose option zip file and upload the file.
3. Check /var/log/apache2/access.log and see the curl with the IP
   "xx.xxx.xx.xxx - - [11/Jul/2024:23:10:33 +0530] "GET / HTTP/1.1" 200 267 "-" "curl/7.68.0"
4. Apply the patch
5. Repeat 2 and 3 step and check no error is coming for the Remote execution error.
6. Test uploading actual zip file and images still works.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 5c931e00f73e91467581fd29721e5af8d7fa98ab)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:19 +02:00
Sam Lau 9dbd82a1a4
Bug 37104: (Follow-up) Checks for unitialized value of 'anonymous_patron' system pref
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
JD Amended patch: replace '==' with 'eq' for consistency with other
occurrences.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:19 +02:00
Fridolin Somers 4c5425bd2f
Bug 37575: Typo 'AutoCreateAuthorites' in about.pl
Typo in system preference name 'AutoCreateAuthorites' ->  'AutoCreateAuthorit[i]es'

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:18 +02:00
PerplexedTheta 2cc520cdeb
Bug 37593: Removed all instances of 'this this' in the codebase
To test:
a)  do a grep for 'this this'
    1)  notice that there are five matching files
    2)  notice that all of these instances are in comments, or podfiles
b)  apply this patch
c)  do a grep for 'this this'
    1)  notice now that these instances are gone
d)  apply these changes to schema.koha-community.org
e)  result!

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-16 16:22:17 +02:00
Martin Renvoize f55519b505
Bug 36758: (follow-up) Fix unit tests
We do two things here..

* We're making the improvement to C4::Letters that sets librarian to a
  patron object more resilient by testing for the userenv first.
* We correct the logic in Koha::Ticket such that we always store changes
  when there's a ticket update

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-12 14:01:08 +02:00
Michael Hafen 88500ccef4
Bug 37613: (Follow-up) Change the option and documentation to match terminology guidelines
Trivial patch.

Change the --branch and --skip-branch options of the longoverdue cron script
to --library and --skip-library to meet the Terminology Guidelines.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-12 14:01:07 +02:00
Kyle M Hall 99c2064126
Bug 9596: (QA follow-up) Only find a given patron once
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:58 +02:00
Kyle M Hall bbd722be5b
Bug 9596: (QA follow-up) Add some clarifying comments
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:58 +02:00
Michael Hafen 8e4963d97c
Bug 9596: Add branch and skip-branch options to cronjobs/longoverdue.pl
This script doesn't seem to be included in cron files by default.
This change is to allow script parameters to effect only certain branches.
This allows the script to be added multiple times to a cron file with
  different settings for different branches.

Test plan:
1. apply patch
2. identify two books at different branches the same number of days overdue.
3. run the longoverdue.pl script specifying one of the branches in the
     --branch command line parameter.
     i.e. koha-shell -c 'misc/cronjobs/longoverdue.pl --branch branch_code --lost 60=2 --maxdays=61 --confirm' instance_name
4. observe that the book at the specified branch has been or would be affected
     by the script while the other book is not.

Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:57 +02:00
Owen Leonard 158092f283
Bug 37578: Remove the Charges tab from checkout and patron details
This patch removes the "Charges" tab from the include file which is used
by the circulation and patron details templates. Information about
charges and credits is already shown at the top of these pages under the
"Attention" heading.

This tab is already hidden on the checkout page
because the script doesn't provide the data to display.

To test, apply the patch locate a patron with charges.

- Check out to the patron. As before, you should see under the
  "Attention" heading at the top, "Charges: Patron has outstanding
  charges of..."
- There should be no "Charges" tab below in the section showing tabs for
  checkouts, holds, etc.
- Check the same details on the patron detai page.
- A patron with credits should be displayed similarly.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Nicolas Hunstein <nicolas.hunstein@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:56 +02:00
Matt Blenkinsop a73cafda2d
Bug 37607: Only default to manual form if we are editing
This patch fixes an issue where the form to add a provder would automatically default to the manual form. This patch prevents this behaviour and restores the intended functionality.

Test plan:
1) Don't apply the patch
2) In ERM, click to add a new provider
3) Type something in the provider name search box
4) The input will change from a select to a text input and the button next to it will now say "Create from registry"
5) Apply patch
6) Yarn build and hard refresh the browser
7) Repeat steps 1-3, the form should work as intended and return results in the select box

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:56 +02:00
Kyle M Hall 6a7f86f634
Bug 36169: (QA follow-up) Tidy tests
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:55 +02:00
Alex Buckley 54ef9bd775
Bug 36169: Patron categories with type='Staff' should be able to have guarantees
Library staff - whose patron category has a type='Staff' should be able to have guarantees added.

Test plan:
1) Create a 'Library staff' patron category with 'Category type' = 'Staff'

2) Create a patron account using the 'Library staff' patron category

3) Notice the '+ Add guarantee' button is not displayed in the members toolbar for the 'Library staff' patron you created

4) Apply patches and restart services

5) Refresh your browser window

6) Notice the '+ Add guarantee' button is now displaying for the 'Library staff' patron

7) Confirm you can successfully add a guarantee

8) Run unit test t/db_dependent/Koha/Patrons.t

Sponsored-By: Waitaki District Council, New Zealand
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:55 +02:00
Kyle M Hall fa8048e63a
Bug 36770: (QA follow-up) Tidy export_records.pl
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:54 +02:00
Alex Buckley 1a32355eb3
Bug 36770: Export records using a report
Enable the export_records.pl script use a report output to export biblios or authorities

Test plan:
1. Apply patches and restart services
2. Create a SQL report (id=1)
    SELECT biblionumber
    FROM biblio
3. Create a SQL report (id=2) and set an item as notforloan = -1
    SELECT title, author, biblio.biblionumber
    FROM biblio
    LEFT JOIN items USING (biblionumber)
    WHERE items.notforloan = <<Not for loan|NOT_LOAN>>
4. Create a SQL report (id=3)
    SELECT title, author
    FROM biblio
5. Create a SQL report (id=4)
    SELECT authid
    FROM auth_header
6. Run export_records.pl using report id=1 and confirm a koha.mrc file is created in the misc directory:
cd misc
./export_records.pl --report_id=1

7. Delete the koha.mrc file

8. Run export_records.pl using report id=2
./export_records.pl --report_id=2

9. Notice you are prompted to supply a parameter

10. Re-run report id=2 supplying a parameter. Confirm the koha.mrc file is created and contains bib data
./export_records.pl --report_id=2 --report_param=-1

11. Run export_records.pl using report id=3
./export_records.pl --report_id=3

12. Notice you get the message: The --report_id you specified does not fetch a biblionumber

13. Delete the koha.mrc file

14. Run export_records.pl using report id=4
./export_records.pl --report_id=4

15. Notice you get a message 'The --report_id you specified does not fetch a biblionumber'

16. Re-run export_records.pl setting the record-type=auths
./export_records.pl --record-type=auths --report_id=4

17. Notice the koha.mrc file is generated and contains auth data

Sponsored-by: Horowhenua Libraries, Toi Ohomai Institute of Technology, Plant and Food Research Limited, Waitaki District Council, South Taranaki District Council New Zealand

Signed-off-by: Alexandre Noel <alexandre.noel@inlibro.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:54 +02:00
Katrin Fischer 9a8a534c8a
Bug 36758: (QA follow-up) Tidy Ticket.t
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:53 +02:00
Katrin Fischer 4e99c1bc85
Bug 36758: (QA follow-up) Fix some typos
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:52 +02:00
Katrin Fischer 51f16885b7
Bug 36758: DBRev 24.06.00.023
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:52 +02:00
Martin Renvoize 02907c5650
Bug 36758: Add trigger for assignee notification trigger
This patch adds a new notice trigger to allow notifying assigned staff
that they have been assigned a new catalog concern to action.

Test plan
1) Enable catalog concerns (either via staff or opac interfaces)
2) Report a new concern (either via staff or opac interfaces)
3) As a staff user, assign the concern to another staff user
4) Check that the new 'TICKET_ASSIGNED' notice has be queued for that
   staff user.
5) Re-assign the catalog concern to yourself
6) Note that you do not see a 'TICKET_ASSIGNED@ notice queued as you
   self-assigned.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:51 +02:00
Martin Renvoize d4d9bf97e9
Bug 36758: Unit tests for assignee notification trigger
This patch adds unit tests for the TICKET_ASSIGNED trigger being
introduced with this patchset.

Test plan
1) Run the unit tests prior to the next patch and confirm they fail
2) Apply the next patch and confirm the unit tests now pass

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:51 +02:00
Martin Renvoize 6c29984598
Bug 36758: Add librarian object
This patch adds a 'librarian' object fetch to
C4::Letters::GetPreparedLetter when a called passes the 'want_librarian'
flag.

This allows for the notice to take full advantage of the patron object
for that librarian rather than requireing old non-TT syntax for this
feature.

Test plan
1) We use the 'librarian' object in the new TICKET_ASSIGNED default
   notice, use the next patch to test that the librarian title is
   correctly substituted into the notice.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-08-09 18:44:50 +02:00