When autoMemberNum is enabled, Koha picks the next cardnumber as
MAX(numeric cardnumber in borrowers) + 1. If patron A's auto-generated
cardnumber is later changed (e.g. they get a physical card) or the
patron is deleted, the original number becomes "free" and the next
self-registrant is assigned it -- inheriting anything third-party
services (OverDrive, Hoopla, unauthenticated self-check) have keyed on
the cardnumber.
This patch makes Koha::Patron::fixup_cardnumber use a monotonic counter
(the autoMemberNumValue syspref) so that once a number has been
auto-generated for any patron, it is never auto-generated again.
The syspref row is locked with SELECT ... FOR UPDATE inside the
existing txn_do, which serialises concurrent callers via InnoDB
row-level locking and addresses the race condition raised against
earlier revisions of this patch.
The formula is: next = MAX(counter, db_max) + 1. When the counter is 0
(pre-upgrade or missing syspref), this degrades gracefully to
db_max + 1 -- the legacy behaviour -- so no feature toggle is needed.
The counter is only bumped when Koha actually auto-generates a
cardnumber; plugin- or caller-supplied values do not touch it.
Test plan:
1. Enable autoMemberNum.
2. Self-register patron A via OPAC, note cardnumber N.
3. Edit patron A in the staff interface, change cardnumber to
something non-numeric like "MANUAL-XYZ".
4. Self-register patron B.
5. Confirm B gets N+1, NOT N.
6. Delete patron A.
7. Self-register patron C.
8. Confirm C gets N+2, NOT A's original number.
9. Install a plugin implementing the patron_barcode_transform hook;
confirm it still runs and its value is honoured (counter is not
bumped when the plugin supplies a cardnumber).
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Introduces a new system preference, autoMemberNumValue, which tracks
the highest auto-generated cardnumber ever issued. It is seeded from
the MAX cardnumber across both borrowers and deletedborrowers so
pre-upgrade deletions do not free numbers for re-issuance.
This preference is managed internally by Koha::Patron::fixup_cardnumber
and has no UI (no YAML entry).
Test plan:
1. Apply the atomicupdate:
perl installer/data/mysql/updatedatabase.pl
2. Verify the preference exists:
SELECT * FROM systempreferences WHERE variable = 'autoMemberNumValue';
3. Confirm the seed value matches:
SELECT GREATEST(
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM borrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0),
COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM deletedborrowers
WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0)
);
4. Re-run the atomicupdate and confirm the already-exists warning.
5. Drop the syspref, re-apply the atomicupdate, confirm it seeds
correctly on fresh installs via mandatory/sysprefs.sql.
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
Create a list with name=<script>alert("booh!");</script>
Delete it at the OPAC
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
Read the patch. Look for the var in the script.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Test plan:
/cgi-bin/koha/cataloguing/editor.pl
Click "Macros", "New macro..."
Enter <script>alert("booh");</script>
OK
Click on the macro name, run macro, delete macro, mark as public:
Nothing should trigger an alert
QA:
- $( '#macro-list li[data-name="' + name + '"][data-id="' + id + '"]' ).addClass( 'active' );
+ $( '#macro-list li[data-id="' + id + '"]' ).addClass( 'active' );
Why did we need name and id to select the macro?
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Replace the no-op `#job_callback` existence check with a recursive
`cy.wait('@jobPoll')` that loops through each `/api/v1/jobs/*` poll
response (arriving every ~1s) until it sees `status: finished`. This
avoids any fixed timeout — the test proceeds as soon as the API signals
completion, however long that takes on a given machine.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c513dee502)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
To test:
1. APPLY PATCH
2. yarn build
3. cypress run --spec t/cypress/integration/Tools/ManageMarcImport_spec.ts
4. It should now pass
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b190813020)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
This patch makes it so that invoice-files.pl returns 404 if
AcqEnableFiles is disabled
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
3. Note that you see a 404 page
4. Change "AcqEnableFiles" syspref to "Do"
5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
6. Note that you now see a "Files for invoice" page
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.
To test, apply the patch and clear your browser cache if necessary.
Test various pages in the staff client to confirm that form validation
works as expected:
- Patron password change form:
- Password must conform to minPasswordLength
- Password must not contain leading/trailing spaces
- Passwords must match
- Administration -> Add or edit budget:
- Description, start date, and end date are required
- Start date must be before end date
- Administration -> Add or edit Z39.50/SRU server:
- Server name, hostname, port, and database are required
- Port, rank, and timeout must be a number
Perform the same check of the "Change password" form in the OPAC.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 1b7c356243)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Instead of re-fetching the patron object.
This also adjusts tests:
prove t/db_dependent/Koha/ILL/Requests.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit a19a6cf1ef)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Test plan, k-t-d:
1) Apply tests patch, run:
prove t/db_dependent/Koha/ILL/Requests.t
2) Notice it fails. Apply the second patch. Repeat. Notice it passes.
Test failure explanation (before fix patch):
# Failed test 'Cardnumber not supplied and couldnt find additional_contents for all libraries. Dont show copyrightclearance'
# at t/db_dependent/Koha/ILL/Requests.t line 1067.
# got: 'copyrightclearance'
# expected: 'commit'
Its searching the copyrightclearance additional_contents for the provided branchcode param (illrq->patron->branchcode) (and finding one) when it shouldn't. That parameter is only to be utilized for the newly created ILL request's library. The branchcode filter of the additional_contents must the be logged in user's cardnumber, not params->{branchcode}. If no logged in user exists and this stage is reached (ILLOpacUnauthenticatedRequest), then only 'All libraries' ILLModuleCopyrightClearance are to be fetched, as expected.
Human test plan, before applying patches:
1) Enable ILLModule
2) Logged in as koha:koha, create an OPAC request, visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?op=add_form&backend=Standard
3) Pick any library not Centerville (the default library of the 'koha' user)
4) Notice the created request's library is CPL (Centerville). It ignored the library selection from the form.
5) Apply patches. Repeat. Notice the request's library is now the one that was selected on the form.
Signed-off-by: Stephen Graham <s.graham4@herts.ac.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit d6ce5833b7)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Stephen Graham <s.graham4@herts.ac.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5485218dfd)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch fixes the variable name meant to display the circulation desk
name when the waiting hold was checked in at a specific circ desk.
A revised test plan to test this specific case:
- Install a new langage
gulp po:update --lang fr-CA
./misc/translator/translate install fr-CA
- Log in to the staff client and set your circulation desk
- Requires that the UseCirculationDesks preference is enabled and at
least one desk is defined in Administration -> Desks.
- Place a hold to be picked up at your logged-in library
- Check in the item on hold and confirm the hold
- Go to the record details page. In the holdings table you should see
this under "Status" for that item:
--> "Waiting at [library], undefined since [date]."
- Check the translation files
cd misc/translator/po/
git grep "Waiting at" fr-CA*
--> There is no "Waiting at %s, %s since %s."
- Apply patch
- Update strings again
- Check translation files again
--> The string should be there
- Translate the string (making sure to remove the fuzzy line if any)
- Install the translation again (only the translate install part)
- Check the record details page again. You should now see:
--> "Waiting at [library], [desk] since [date]."
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit d97d8354a3)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
To test:
1. Go to members/moremember.pl?borrowernumber=X where X is borrowernumber of a patron with a surname
2. Look under contact information and notice surname is missing.
3. APPLY PATCH and look again.
4. Surname should be included.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f94283fdc5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds handling of the "no-html" flag to patron-title.inc. The
OPAC alert subscriptions page passes the "no-html" flag but the include
file wasn't written to include it.
To test, apply the patch and log in to the OPAC as a user who has a
title (salutation).
- Add a serial subscription and set a notification template
- Go to the OPAC and subscribe to the email notification for this
subscription
- Go to the patron account > Alert subscriptions tab
- Verify that the last column shows an "Unsubscribe from email alerts"
button.
- There should be no errant HTML.
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
It has been removed in the controller by the previous patch.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 98833e04d74be26c5efa3bc1718ac8a32063223f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 9ef05dfa7ec321a5bc7c84e0732d3d4ede945702)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch updates the plugin wrapper to include the reports menu and have the breadcrumbs list reports instead of admin or tools when method="report"
To Test:
1. Install the Kitchen Sink Plugin
2. Navigate to Reports->Report plugins->Run Report.
3. Observe the admin menu shows
4. Apply the patch
5. Repeat step 2
6. Observe the report menu shows and the breadcrumbs are for the report module.
7. Check that the tools and configuration show the appropriate tool/admin context.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 09860c5816)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This ensures that when the dialog is closed, even when clicked outside of it, the messages are correctly removed, same as if the 'close' button had been clicked.
Test plan:
- create a data ERM provider /cgi-bin/koha/erm/eusage/usage_data_providers/add
- dummy data should be sufficient
- then go to data providers list /cgi-bin/koha/erm/eusage/usage_data_provider
- open web development tools console (F12 firefox)
- click on "Run now"
- dismiss dialog by clicking outside the modal!
- click again on "Run now"
- check the logs for errors
- any other clicks to create a modal won't work now ("run now", "delete")
Apply patch. run yarn js:watch or yarn js:build. Repeat.
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 3908b7bc1c)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This test ensures that when extended attribute validation fails during
patron creation via the API, no welcome email is sent. This validates
the fix where extended_attributes() validation was moved before the
welcome email is enqueued.
Test plan:
1. Apply this patch
2. Run: prove t/db_dependent/api/v1/patrons.t
3. Verify all tests pass, including the new test that confirms no welcome
email is sent when extended attribute validation fails
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 4d2f80925d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test Plan:
1. Configure Koha with: AutoEmailNewUser = "Send" and create a mandatory extended attribute that will cause validation to fail; for example, set for the attribute to display in the OPAC, to be editable in the OPAC, and to be mandatory. That means this bug must be tested before Bug 40220, where the validation failure is resolved.
2. Setup your Postman, or any other mock API software, to obtain an OAuth token (/api/v1/oauth/token) and to register a patron (/api/v1/patrons).
3. With the OAuth token, send a POST request to /api/v1/patrons with valid patron data and invalid or missing mandatory extended attribute data.
4. Observe the API response with the 400 error and notice that the welcome email was delviered despite the fact that no patron account was created.
5. Apply the patch and repeat step 3. Notice that the API response still contains the 400 error, but no welcome email was sent.
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 328b77458f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change prevents CSRF on opac-patron-consent.pl by
adding checking of the "op".
Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Set system preference PrivacyPolicyConsent to "permissive"
2. Log into the OPAC and go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1
3. Note that it doesn't change the consent
4. Go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0
5. Note that it doesn't change the consent
6. Click the "Yes" radio button and click "Save"
7. Note it changes the consent to Yes
8. Click the "No" radio button and click "Save"
9. Note it changes the consent to No
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.
Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear
5. Apply the patch
6. koha-plack --restart kohadev
7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
To test:
1 - Check out an item to a patron, backdated to be overdue
2 - Log in as that user to the OPAC
3 - From 'Your summary' - click the overdue tab, click renew
4 - 500 Error
5 - Apply patch
6 - Reload the page and repeat
7 - Success!
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0219e4baf8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 75e25b4699)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
When an element should be ignored by screen readers, it should have no
title attribute or an empty title attribute, in addition to a null alt
attribute.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 672982a683)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit f6ad2409df)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
A accessibility audit has highlighted that some of the decorative images on
the opac have alt text which is often followed by a spen that also contains the same
text. This results in screen readers reading this information twice.
The suggested solution is to set the alt text to null in these instances.
Test Plan:
Prior to applying patch:
1) Navigate to Koha OPAC
2) Carry out a search
3) On one of the records right click on the Material Type: under the heading
4) Select Inspect
5) Note that the image has an alt text that matches the span that follows
6) Click on the item title and repeat the process for the icon below the contributors.
7) Scroll down to the holdings table and repeat the process for the image in the Item Type column
8) Apply the patch
9) Repeat the steps above and notice that the alt is now null in order to ignored by screen readers
11) Note that for the Dev tools may show alt but if you right click on the page and select View Page Source you will see that the code is alt="" as expected by screen readers
12) Note that for alt tags that have been updated in the xsl files e.g. the small icons that follow 'Material Type: ' may be cached.
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c5f99a3150)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit 8a6c09f9e3)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch prevents the end-user to get the ugly 500 "malformed JSON
string" when something wrong happens with the plugin search. It happens
currently in ktd with the plugin repos listed in $KOHA_CONF
An error is reported to the UI
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 438e51351d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
(cherry picked from commit a69f7a88ab)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This patch makes it so that a successful SSO will return you to
the place where you initiated the SSO. This is especially useful
when doing searches, placing holds, etc.
Test plan:
0. Apply patch and koha-plack --restart kohadev
1. Set up OIDC SSO using
https://wiki.koha-community.org/wiki/Testing_SSO
2. Go to http://localhost:8081/cgi-bin/koha/circ/circulation-home.pl
3. Do a staff login using SSO
4. Note that you're redirected to
http://localhost:8081/cgi-bin/koha/circ/circulation-home.pl
after the successful login
5. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1
6. Do a OPAC SSO login
7. Note that you're returned to
http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1
after the successful login
8. Logout of the staff admin and OPAC
9. Note your URL ends in ?logout.x=1
10. Try logging back into them using SSO
11a. Note that you're logged in and not automatically logged out
11b. Note that if you're on the OPAC, you should be redirected
to opac-user.pl instead of opac-main.pl or the root path
12. If you change the domain for the SSO users to something
that your user does not match, try logging in again, and note
that the error message should display on mainpage.pl or opac-main.pl/opac-user.pl
for the OPAC. (This is because these are the pages that show SSO errors.)
Signed-off-by: Lukas Koszyk <lukasz.koszyk@kit.edu>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit dbadb00d7b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Martin Renvoize
Jonathan Druart
David Cook
Marcel de Rooy
Lucas Gass
Baptiste Wojtkowski
Owen Leonard
Pedro Amorim
Lisette Scheer
Leo Stoyanov
Nick Clemens
Emily Lamancusa
Alexander Blanchard
Fridolin Somers
Victor Grousset/tuxayo