Move the check to C4::Auth.
Yes, it's not nice, I didn't expect to add exception to this code, and
it's adding more ugly code to get_template_and_user, but... Suggestions
welcome!
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1 - In KTD visit:
http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
2 - Everything should be set for auto self check user etc, just login
as a patron
If not (or not using KTD) setup a self check user, enable SCO and
SCI, set self check patron system preferences, then login with
patron
3 - 403 Error
4 - Repeat with sco:
http://localhost:8080/cgi-bin/koha/sco/sco-main.pl
5 - Apply patch, restart all
6 - Try again, both should be successful
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Currently the index `pl` points to 008/15-17. It should
(additionally/instead?) point to 260a and/or 264a.
Test plan (for koha-testing-docker with ElasticSearch via `ktd --es7 up`)
Verify the old/broken behaviour:
* Go to Staff/Advanced Search
* Select "Publisher Location" and enter "cau", start search
* You will get some hits (~16), eg "Perl best practices / Damian Conway", which has 008 of "051222s2005 caua b 001 0 eng d" with "cau" on 15-17
* Edit this record (cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=5)
* Inspect 260$a, which should containt "Sebastopol, CA :"
* Go back to Advanced Search and search for "Publisher Location" = "Sebastopol"
* No hits!
Apply the patch!
* exit ktd and stop it (ktd --es7 down; ktd --es7 stop)
* start it again
* Go to Staff / Administration / Search Engine Config (Elasticsearch)
* Click on the Tab "Bibliographic records" and search/filter for "pl"
* you should see 3 entries for "pl", with Mapping values of "008_/15-17", "260a" and "264a"
* Go to Search,
* Select "Publisher Location" and enter "cau", start search
* same hits as befor
* Search again, but for "Sebastopol"
* Now you'll get 9 hits!!
Bonus: Test 264a
* Got to Admin / MARC bibl framework, select BKS -> MARC structure
* search for tag "264", edit subfields
* in tabs a, b, c: Check the "Editor" Checkbox (Visibility)
* Save changes
* find a book, eg again "Perl best practices" and edit it
* find field 264 and enter "Test" into 264a, Save
* Depending on your setup, you might have to manually re-index the book:
* enter ktd: ktd --shell
* reindex the one book (via --bn) or all (might also need a -d)
/usr/share/koha/bin/search_tools/rebuild_elasticsearch.pl -v -b -d
* Go again to Advanced Search, Publisher Location = "Test"
* You should find the book
If your NOT running ktd, you might be able to just edit the ElasticSearch Mappings to add / change the mapping for "pl" to point to "260a".
One rather harsh way to do this (which I needed to do, because the ES Mappings UI did not work for me) is via this SQL:
update search_marc_map set marc_field='260a' where marc_field='008_/15-17';
Sponsored-by: Steiermärkische Landesbibliothek
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a safe guard for when consumers pass _per_page=0 to
endpoints. This condition is checked for on a centralized place and
avoid reaching the controller in such scenarios that would provoke a
division by zero exception.
To test:
1. Apply the regression tests patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/api/v1/pagination.t
=> FAIL: We expect a 400, but get a 500 instead
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! No more explosions for this!
5. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds the flatpickr-futureinclusive data to the input field
for "Hold starts on date" in the OPAC.
We also add 'flatpickr-future' data to the input field for expiration
date as it also doesn't make sense to allow this to be a past data
either.
Test plan
1) Attempt to place a hold on an item from the OPAC
2) Expand the 'Show more options' dropdown
3) Note that without the patch 'Hold not needed after' allows setting to
a date in the past.
4) Enable `AllowHoldDateInFuture` and `OPACAllowHoldDateInFuture` system
preferences
5) The 'Hold starts on date' option should now appear if you refresh
your hold placing page in the OPAC.
6) Note that the above input also allows setting a past date
7) Apply patch
8) Neith input should allow past dates now.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Koha::Object depends on Koha::DateUtils, which depends on C4::Context,
which depends on Koha::Config::SysPref, which depends on... Koha::Object
Apart from the circular dependency, the dependency on C4::Context alone
is problematic as it loads a bunch of modules that are not needed at all
in Koha::Object (YAML::XS and ZOOM for instance).
As Koha::Object is used as a base for a lot of modules, we should take
care to only load the minimum required.
This patch moves some date parsing code to specific modules:
- Koha::DateTime::Format::RFC3339
- Koha::DateTime::Format::SQL
and it uses them in Koha::Object and Koha::DateUtils where it is
possible.
Test plan:
1. Do not apply the patch yet and run the following command:
`perl -cw Koha/Object.pm`
It should print several warnings about redefined subroutines, meaning
there is a circular dependency.
2. Apply the patch
3. Run `perl -cw Koha/Object.pm`. It should only say:
"Koha/Object.pm syntax OK"
4. Run the following command:
prove \
t/DateUtils.t \
t/Koha/DateTime/Format/RFC3339.t \
t/db_dependent/Koha/Object.t
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
All other fields in the new line use data-id instead of name, this fixes an inconsistency
To test:
1 - Before this patch select some values, set filter to punctuation - hit 'Add'
2 - Punctuation vlaue is cleared
3 - After patch add a new line and confirm 'Filter' value is saved
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In the footers of the tables of the search fields and mappings,
the options selected are not consistent.
Additionally they are not reset correctly when a new line is added.
Test plan:
0. Do not apply to recreate the problem
1. Go to the ES mapping page
2. Click tab "Bibliographic records"
3. At the bottom, notice the Yes/No dropdown lists
=> They are inconsistent, sometimes 'Yes', sometimes 'No'
4. Click Add
=> Values are kept
5. Apply this patch
6. Repeat 1, 2, 3
=> No (first option) is always selected
7. Click Add after you modified some values
=> "No" is selected
Sponsored-by: The Research University in the Helmholtz Association (KIT)
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Bug 31422 added a warning message when library limitations issue in patron edition page.
We should add this patron's messages in circ and details pages.
Like age limitations.
Test plan:
1) User's login branch and home library is: Centerville
2) Patron category "B - Board" is limited to Franklin
3) Edit a patron with Board category from Centerville
4) A message appears "The patron's current category (Board) is limited to other libraries."
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
We aren't actually doing any error handling with the RequireJS waitSeconds
config, just leaving the advanced editor hanging on loading if it times out,
so instead we should disable it.
Test plan:
1. Set the preference EnableAdvancedCatalogingEditor to Enable
2. Load the Cataloging module home page in Firefox and open Firefox's
Web Developer Tools, and in the Network tab change from "No Throttling"
to "Regular 2G"
3. In the Cataloging page, click Advanced editor, and watch it attempt to
load for 30 seconds, followed by a setTimout error in the devtools console,
and then wait as long as you can stand for anything but the "Loading,
please wait..." to happen in the web page. Nothing ever will.
4. Apply the patch, restart, set EnableAdvancedCatalogingEditor back to
Enable, turn throttling on, load the Advanced editor again, and note that
even though it will take a minute or more to load through the throttling,
the editor does actually load.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
If something explodes in Koha::REST::V1::Auth chances are that no logging will happen.
This patch makes sure they are!
To test:
1. Make sure you do NOT have 36420 on your tree
2. Make sure you are looking at the logs:
$ ktd --shell
k$ koha-plack --restart kohadev; tail -f /var/log/koha/kohadev/*.log
3. Use Postman or similar for hitting some known endpoint. Use
the user's cardnumber instead of the userid. On a default KTD launch, the
generated user's cardnumber is '42'.
GET /patrons
=> FAIL: You get a 500 error (expected, fixed on 36420) but no useful logging found.
4. Apply this patch
5. Ctrl+c on the logs and re-run the command
6. Repeat 3
=> SUCCESS: You get a 500, but you also get the exception information logged!
7. Sign off :-D
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[OK] prove t/db_dependent/api/v1/items.t t/db_dependent/api/v1/unhandled_exceptions.t
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Test from OPAC. Any item group without items in it should not display as an option in the "Request specific item group:" dropdown
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Enable EnableItemGroups and EnableItemGroupHolds
2. Find a bib and add an item group but do not attach any items to the item group.
3. Place a hold from the staff interface.
4. Under Hold next available item from an item group you see the option for your item group, select it and place the hold.
5. It's a hold that can not be filled
6. APPLY PATCH
7. How on the hold page under Hold next available item from an item group there is a 3rd column called 'Holdable items'.
8. Your item group, without any items, should have a disabled radio button and a warning "No holdable items in this item group."
9. Add items to your item group.
10. Now on the hold page in the new 'Holdable items' you should see links for each item, make sure those links work.
Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Some system preference descriptions have been updated in order
to replace "books" with items, checkouts or bibliographic records.
To test:
* Check system preference descriptions for following system
preferences with and without the patch applied:
* virtualshelves
* AutoSwitchPatron
* SyndeticsSeries
* OPACFineNoRenewals
* OpacRenewalAllowed
* If they read better than before, sign off :)
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Make a new suggestion in the staff interface and attempt to set the "Created by" patron to someone other than the logged in user.
2. Submit the suggestion.
3. select suggestedby from suggestions where suggestionid = X; ( Where X is the suggestionid )
4. The value is NULL
5. On suggestion/suggestion.pl the "Suggested by" column is blank.
6. APPLY PATCH
7. Try 1 - 3 again. This time the suggestedby should be correctly set.
Signed-off-by: Andrew Fuerste Henry <andrewfh@dubcolib.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Running cataloguing pluings (in cataloguing/value_builder) now requires
authentification.
This patch adds in failing unit tests a mock of C4::Auth::check_cookie_auth
Test with:
prove t/db_dependent/FrameworkPlugin.t t/db_dependent/Koha/UI/Form/Builder/Biblio.t t/db_dependent/Koha/UI/Form/Builder/Item.t t/db_dependent/Serials.t
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This can certainly be improved to adjust the permissions, but at least
they are no longer opened to the world..
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Installer scripts cannot be run from the UI:
debian/templates/apache-shared-intranet.conf:RewriteRule ^/cgi-bin/koha/(C4|debian|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It is not used, if we need it back it must be moved to misc.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl
Test plan:
Hit the link
=> Erk
Copy the apache config to /etc/koha/apache-shared-intranet-git.conf
restart_all
Hit the link
=> 404
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
1. Log out
2. Go to /cgi-bin/koha/mainpage.pl#somestring"with<html>char
3. Open the brower's inspector and find "auth_forwarded_hash" input
4. Make sure the value attribute is there and corresponds to the URL's
fragment. It should be URI-encoded.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Fixed some typos in bug numbers and text.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To avoid injection of template toolkit code
from database fields that are controlled by
untrusted sources.
Test plan:
* review subtest 'Template toolkit syntax in
parameters' in t/db_dependent/Letters.t
* Run the unit test:
prove t/db_dependent/Letters.t
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
defer_loading is now a patron_search_js BLOCK param - default on
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It seems that we loop all categories and item types to build the circ
matrix. We should only loop over values that have actually been used
in circulation rules.
Test Plan:
1) Create 1000 itemtypes and category codes. You can use the following
script:
use t::lib::TestBuilder;
my $builder = t::lib::TestBuilder->new();
$builder->build( { source => 'Category' } ) for 0..1000;
$builder->build( { source => 'Itemtype' } ) for 0..1000;
2) Note the lengthy load time for smart-rules.pl
3) Apply this patch
4) Restart all the things!
5) Reload the page
6) Note the much faster load time!
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When importing patrons we assume a default of '' for borrower columns not supplied in the file.
When saving we compare the new object we built to the one form the database - for columns are that are not text type we get undef from the db and '' in the object we make. This means we see a difference and log into the BorrowersLog:
"date_renewed" : {
"after" : "",
"before" : null
},
"dateofbirth" : {
"after" : "",
"before" : null
},
"debarred" : {
"after" : "",
"before" : null
},
"flags" : {
"after" : "",
"before" : null
},
"gonenoaddress" : {
"after" : "",
"before" : null
},
"lost" : {
"after" : "",
"before" : null
},
"password_expiration_date" : {
"after" : "",
"before" : null
},
"sms_provider_id" : {
"after" : "",
"before" : null
}
}
This can mean a lot of useless logging in sites that do automated imports
Test Plan:
1) Enable 'BorrowersLog' system preference
2) Import the borrowers file attach do this bug report file, matchig on cardnuber, and overwriting
Contents of the borrowers file are :
surname,firstname,branchcode,categorycode,cardnumber,dateenrolled,patron_attributes,lastseen
Acosta,Ednb,CPL,PT,23529001000463,02/01/2013,,
3) Check the logs, note the modification of columns that have no date
4) Import the file again with the same settings
5) Note the new action log
6) Apply this patch
7) Restart all the things!
8) Import the file again with the same settings
9) Note no new action log was created!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
As Emmy stated on comment9, this line is indeed unneeded (and wrong).
A successful cud-insert/cud-save does not come here.
And it is set for add_form, edit_form and duplicate later on.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
If an error occurs while adding new patron, after fixing the error and
hitting save, patron entry page reloads to "Modify patron" section
and error "Patron not found. Return to search" is displayed. But no
patron is saved.
This happens because we declare template param op too early in the
code and it receives value "cud-insert" instead of "add_form" as it should.
To test:
1. Add new patron and cause an error (wrong age etc.).
2. Attempt to save patron, error message is displayed.
3. Fix your errors and attempt to save again.
=> Error message "Patron not found. Return to search" is displayed and new
patron is not saved to database.
4. Apply this patch.
5. Repeat steps from 1 to 3.
=> Saving patron should now work.
=> To be save, test if modifying patron also works as it should.
Sponsored-by: Koha-Suomi Oy
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Jonathan Druart
Nick Clemens
Tomas Cohen Arazi
Thomas Klausner
Martin Renvoize
Julian Maurice
Fridolin Somers
Phil Ringnalda
Lucas Gass
Katrin Fischer
Katrin Fischer
Victor Grousset/tuxayo
Kyle M Hall
Andreas Jonsson
Pedro Amorim
Marcel de Rooy
Emmi Takkinen