Commit Graph

29408 Commits

Author SHA1 Message Date
Amit Gupta 83fdc8aea5 Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl
To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 29ab5517f5c8cfbc86b98c3197846d005007cc12)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:58:05 +02:00
Amit Gupta eccce3e1ba Bug 19108 - Stored XSS in fieldmapping.pl
To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 77ddae74d661fb589d74bd85f5561fdd4131af70)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:58 +02:00
Amit Gupta 520388dc1d Bug 19108 - Stored XSS in authtypes.pl
To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit bc780f588bc908f8b1d0da8987b20914996d942c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:51 +02:00
Amit Gupta 64abaa063d Bug 19108 - Stored XSS in classsources.pl
Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 940c8634914b50940cfaf73af3611e6282d5803f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:45 +02:00
Amit Gupta 332d705e72 Bug 19108 - Stored XSS in items_search_fields.pl
To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 063fd5e1b9e086c57987fae408b4ce6e51fec2b9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:37 +02:00
Amit Gupta 20b4c81c1a Bug 19108 - Stored XSS in oai_sets.pl
To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 10d3a8c212f8a45e40cd2644f94d555566a10018)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:29 +02:00
Amit Gupta fb90eee74c Bug 19103 - Stored XSS in matching-rules.pl
To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9222cd77d282affffba43a40a9ff2f768647501e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:54:04 +02:00
Amit Gupta 6fc53fb6df Bug 19103 - Stored XSS in patron-attr-types.pl
To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit cb0c3da4b6cec991194ce91e6412cf9d50562044)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:56 +02:00
Jonathan Druart e3e035c3ef Bug 19103: (follow-up) Stored XSS in itemtypes.pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c221bc40a330a25d59097e94e962a4afcea011af)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:48 +02:00
Amit Gupta 4653a5209a Bug 19103 - Stored XSS in itemtypes.pl
To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 18b5d4f1ababf560ff02a258de389f8c34cff9e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:40 +02:00
Jonathan Druart c7a6dbca09 Bug 19128: XSS - admin/authorised_values.tt
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ad230cdcb5ad69541a89a4edaedcadde9d25b88a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:12:33 +02:00
Katrin Fischer 8b85e83554 Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6b7ad77fffd7a6c4b69bce5bf666c6ff4be76c5b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:12:25 +02:00
Katrin Fischer 2b0bd9add5 Bug 19125 - XSS - members.pl
In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 849eaf73fc419b9a635a1ba4b69ef46a7544e55a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:11:08 +02:00
Katrin Fischer b03752fa78 Bug 19086 - Follow-up - subscription-detail.pl
Add script to the callnumber field on adding a subscription.

Verify script is executed without this patch, but not with it.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 3ebcd2475dd35db47c33bcc59d5e75968667b518)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:44 +02:00
Katrin Fischer 13147e7c05 Bug 19086 - Follow-up - XSS in supplier.tt
In preparation:
Make sure you enter <script>alert("sth")</script>
in all fields of a new vendor that are not validated
and save.

1) Access vendor summary page.
2) Verify scripts are executed
3) Apply patch
4) Verify scripts are on longer executed

This works in combination with the other patches for XSS
on this bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 14a1aba57cc091a70c527a0d6bd495d21bd87345)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:37 +02:00
Amit Gupta c4a1eafb5b Bug 19086 Stored XSS in subscription-add.pl
To Test
1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
2. Add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ebf781afc133508eddcb8dc8fb6d7429a72db99b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:31 +02:00
Amit Gupta 46f91605a4 Bug 19086 Stored XSS in supplier.pl
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9d0bbf5fa7455e0eb64288652802b0836cf22690)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:23 +02:00
Chris Cormack 0a53a9e7f3 Bug 19086 Stored XSS in circulation.pl
1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 80c93d3499b11f3574fbafe756f94c534b746d5a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:12 +02:00
Chris Cormack 44814081a7 Bug 19086 XSS in members/member.pl
To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5ae18484b5a47e8a00ce8f1a0fd8b3db471947eb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:01 +02:00
Fridolin Somers ea316ad4ae Bug 18654 - Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt
Followup correcting a typo of previous patch :
  name="holdingbranch" options = branche
it is branche[s]

Test plan :
- Look at 'Current location' in item search
=> Without patch you see only 'All libraries'
=> With patch you see 'All libraries' and each existing library, like in 'Home library'

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 889fabe9f2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-14 15:31:09 +02:00
Marc Véron dcafcbc036 Bug 18654 - Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt
This patch removes entries like the following in translations of itemsearch.tt:
"[%% INCLUDE form_field_select name=\"homebranch\" options = branches "
"empty_option = \"All libraries\" %%] [%% INCLUDE form_field_select name="
"\"holdingbranch\" options = branches empty_option = \"All libraries\" %%] %s "
"[%% INCLUDE form_field_select name=\"location\" options = locations "
"empty_option = \"All locations\" %%] %s "

New patch on top of Bug 18633 that resolves parts of initial comment.

To test:
- Verify that in itemsearch.tt no tt directives are splitted by new lines
  (search for [% INCLUDE )
- Verify that itemsearch.tt works as before

Followed test plan and verified that tt directives are not split by new
lines, the changes to the fieldset tags in comment 3 have been removed
and itemtype.tt still works correctly as before

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 25fa02272d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-14 15:30:56 +02:00
Fridolin Somers 4c76583e6d Bug 19023 - inventory tool performance
Inventory tool performance seems to be worst since 16.11.
I think it is because of authorized values computing changed by Bug 17249.

For each subfield of each item, we try to get the authorized value description with Koha::AuthorisedValues->search_by_marc_field.
But this method does not use cache like Koha::AuthorisedValues->get_description_by_koha_field.

I propose to use Koha::AuthorisedValues->get_description_by_koha_field and also to look for authorized value description only for item fields used in TT : location, notforloan, itemlost, damaged, withdrawn.

I have experimented inventory time on 100 items from 5s to 1s.

Test plan :
- Without patch
- Perform inventory with barcode file
- Check results and mesure execution time
- Apply patch
- Reperform inventory with same barcode file
- Check results is the same
- Compare execution time
- Run prove t/db_dependent/Items/GetItemsForInventory.t

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 95f1844e6c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 17:09:51 +02:00
Jonathan Druart 960015819e Bug 19214: prevent crash if club_template_field is called in list context
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6a9fafe309)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:56:21 +02:00
Aleisha Amohia 68bbe3fb0d Bug 19214: Prevent crash if ->club or ->patron is called in list context
To test:
1) Create a club template and a club.
2) Add a user to the club
3) Log in to the OPAC as that user
4) Go to 'your summary' and click the Clubs tab
5) Notice clubs do not load and a warn shows:
Template process failed: undef error - Cannot use "->find" in list
context at /home/vagrant/kohaclone/Koha/Club/Enrollment.pm line 62.
6) Go to the staff side and go to the member page of that user
7) Go to 'details' and click the Clubs tab
8) Notice clubs do not load and a warn shows:
Template process failed: undef error - Cannot use "->find" in list
context at /home/vagrant/kohaclone/Koha/Club/Enrollment.pm line 71.
9) Apply patch
1) Repeat steps 4-7, confirming the errors do not show and clubs info
loads correctly

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 594c48fb5b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:55:32 +02:00
Jonathan Druart 1a50b447d3 Bug 18927: Use fully qualified subroutine names in C4::Items
rebuild_zebra.pl fails in some conditions (perl version?)
I do not recreate but it has been reported that reindex fails with:
  error retrieving biblio 94540 at /usr/share/koha/bin/migration_tools/rebuild_zebra.pl line 683, <DATA> line 751.

To fix it we can use fully qualified subroutine names for:
  GetMarcFromKohaField
  GetMarcBiblio
  GetBiblionumberFromItemnumber
  TransformKohaToMarc
  GetFrameworkCode

Test plan:
Confirm the rebuild_zebra script still works correctly after this patch

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2671eb2f93)
2017-09-12 16:47:07 +02:00
Alex Sassmannshausen 111ab4e632 Bug 19073: (bug 15758 follow-up) Dereference correct value from Koha::Object.
* tools/modborrowers.pl: Dereference 'branchcode' rather than
  'value'.

Test Plan:
- Carry out "Batch patron modification" with any number of patrons.
  + Change the library.
  + Hit Save.
- The library will not have been updated.
- Apply patch.
- Run same modification.
- The library will have been updated

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8a328a20bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:40:51 +02:00
Kyle M Hall dcda5a4dc5 Bug 19208 - Pay select option doesn't pay the selected fine
The "Pay selected" option on the Fines tab in the borrower account page doesn't work as intended.
The fine on top of the list gets the amount deducted, even if another fine is choosen from the list.

Test Plan:
1) Create two or three fines, using the Create manual invoice function.
2) Choose one of the fines (not the one on the top) and click Pay selected
3) Pay a partial amount
4) Go back to the Pay fines tab an notice that the fine you selected has not changed. Instead, either the top fine or the total (see attachment) has ben affected.
5) Apply this patch
6) Repeat steps 1-3
7) Note the correct fine is paid

Signed-off-by: Andreas Hedström Mace <andreas.hedstrom.mace@sub.su.se>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 831d75d09c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:37:42 +02:00
Aleisha Amohia 6431bf5d9a Bug 19194: Check itemtype is defined when receiving an order
To test:
1) Find a record with an item that has no itemtype (or remove the
itemtype of an item)
2) Go to Acquisitions -> Find a vendor or make a new one -> create a new
basket
3) Add the record from Step 1 to your basket
4) Close the basket
5) Go back to the vendor and click 'Receive shipments'
6) Put in an invoice number, click Next
7) Click the Receive link for your item
8) Confirm you see an internal server error
9) Apply the patch and refresh the page
10) The error should be gone and behaviour should continue as expected

Sponsored-by: Catalyst IT

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 51a65731c0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:36:10 +02:00
Kyle M Hall f8a6f62d45 Bug 19205 - Pay selected fine generates 500 error
Using the pay selected option from the borrowers account, to pay for one specific fine among other gives a 500 error, despite the payment going through.

Test Plan:
1) Add two fines using the Create manual invoice function.
2) Select one fine and "pay selected".
3) Pay a part of the amount.
4) Note error
5) Apply this patch
6) Repeat steps 1-3
7) No error!

Signed-off-by: Andreas Hedström Mace <andreas.hedstrom.mace@sub.su.se>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 86e8612c02)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:20:49 +02:00
Chris Cormack c87b963818 Bug 18046: CAS logout infinite redirect
To test (You need a CAS server and CAS configured in Koha)

1/ Login using CAS in Koha
2/ Logout in Koha
3/ Notice you get redirected again and again
4/ Apply patch
5/ Login with CAS, then logout
6/ Notice logout works, but no longer infinitely redirected

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patch has been in production use for several months
on several instances. Fixes a critical bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Looks like a typical workaround, but evidently works.
Not tested with CAS.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 13ca496206)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:12:51 +02:00
Marcel de Rooy c37b2f31d5 Bug 19163: Critical typo in stage-marc-import process
Template says ISO2709 but script wants MARC or MARCXML..
Slipped in with bug 19049.
Trivial but critical fix.

Test plan:
Import a MARC file.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
I picked this fix because I think MARC is always ambiguous. ISO2709
clearly denotes the serialization format used.

Signed-off-by: Liz Rea <liz@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit af791d83e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:06:02 +02:00
Jonathan Druart 906d602c1f Bug 19067: Test Makefile.PL mapping
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 19eb17c789)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:04:16 +02:00
Tomas Cohen Arazi 2c90bd3dd1 Bug 19067: Map clubs/ into INTRANET_CGI_DIR in Makefile.PL
This patch adds the required entry in Makefile.PL so the clubs/ dir is correctly installed
during the make install step.

To test:
- Run:
  $ cd kohaclone
  $ perl Makefile.PL
- Follow any install method and options
- Run
  $ make
  $ ls blib/INTRANET_CGI_DIR/ | grep clubs
=> FAIL: No clubs dir
- Run:
  $ make clean
- Apply this patch
- Run:
   $ perl Makefile.PL
- Follow any install method and options
- Run
  $ make
  $ ls blib/INTRANET_CGI_DIR/ | grep clubs
=> SUCCESS: The clubs/ dir is correctly picked for inclussion in the intranet cgi dir
- Sign off :-D

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e57b3a6c4d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:04:02 +02:00
Fridolin Somers 92b08a23e3 Bug 18900: wrong number format in receiving order
Bug 18471 added number formating in order receive.

I found a bug generated by this.
Koha::Number::Price defines methods to (un)format price depending on CurrencyFormat syspref.
The bug is that for CurrencyFormat US, some params are not defined in this module so there are retrieved from system locale. If system locale is not en_US, the params will be wrong. For example fr_FR will define ',' as decimal and so saved unit price is divided by 1000.

To recreate:
- On a server with locale 'fr_FR'
- With Plack mode
- Set CurrencyFormat on 'US'
- Open a basket
- Place an order for an item
- Close basket
- Receive order with changing 'Actual Cost' to '1,234'
- Note the 'Actual Cost' is now '1.23'
- Run unit test t/Number/Price.t without and with patch

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e35903574c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:02:07 +02:00
Tomas Cohen Arazi 1865db52bb Bug 18900: (QA followup) Make tests conditional to locale existence
It is important to highlight that tests have been skipped instead of having them pass
on the absence of the required fr_FR.UTF-8 locale installed on the system.

This patch does that check and effectively skips them.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 61f2ec7690)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:02:02 +02:00
Fridolin Somers aca614cd95 Bug 18900: add UT to Number/Price.t
This patch adds unit tests to t/Number/Price.t in order to valid the problem.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 91dee226cd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:01:53 +02:00
Jonathan Druart d179da572b Bug 18906: Display all funds the logged in user can use
There are complex conditions to know if a librarian can use a fund, we
cannot do that with a SQL query, we need to use C4::Budgets::CanUserUseBudget

When this patch is applied then all funds are visible to both
superlibrarian patrons and patrons with all acq permissions

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 19a7b498e1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 15:53:50 +02:00
David Cook 4b71c92397 Bug 18898 - Some permissions for Reports can be bypassed
If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2fdfbaf0dd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 15:45:48 +02:00
Serhij Dubyk {Сергій Дубик} afb2cb0c74 Bug 17827 - Untranslatable "by" in MARC21slim2intranetResults.xsl
Signed-off-by: Serhij Dubyk {Сергій Дубик} <serhijdubyk@gmail.com>

The "by" after the title was not translatable in the result
lists of the intranet. This patch fixes it by removing
a comment, that caused a problem with the translation
scripts.

To test:
Test:

Before this patch in file en-GB-marc-MARC21.po present next paragraph:

msgid "by "
msgstr " by "

According string "by " in the file MARC21slim2intranetResults.xsl can not be translated (in other languages).

After applying this patch performed next command:
cd /usr/share/koha/misc/translator
sudo env KOHA_CONF=/etc/koha/sites/mykohainstance/koha-conf.xml PERL5LIB=/usr/share/koha/lib perl -I /usr/share/koha/lib "./translate" update

Now in the file en-GB-marc-MARC21.po present the following (modified) paragraph:

msgid "by "
msgstr " by "

https://bugs.koha-community.org/show_bug.cgi?id=17827
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d5ea914f4d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 15:15:29 +02:00
Marc Véron b9ff28f719 Bug 18778 - Translatability: Get rid of tt directive in translation for item-status.inc
The file opac-tmpl/bootstrap/en/includes/item-status.inc exposes a template directive where translators should not be confronted with.

"%s %s [%%#- This include takes two parameters: an item structure and an "
"optional loan (issue) structure. The issue structure is used by course "
"reserves pages, which do not use an API to fetch items that populates item."
"datedue. -%%] %s %s %s %s "

This patch fixes new lines inside a tt directive (comment).
It is merely a string patch.

To test:
Verify that the code changes make sense.
(Bonus test: create a new language 'aa-AA', verify that line above does not
show up in aa-AA-opac-bootstrap.po)

NOTE: Followed test plan similar to bug 18776 comment 3.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c8551645d5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 15:12:23 +02:00
Marc Véron 036b317c0c Bug 18660: Translatability: Get rid of template directives [%% in translation for patroncards-errors.inc
Translation for koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc
contains a lot of (partial) template directives like:
%%]%s %sLayout: [%%

This patch fixes it

To test:
- Verify that code changes make sense
- Apply patch
- Create a translation (cd misc/translator , then: perl translate create aa-AA
- Verify that in po/aa-AA-staff-prog.po contains no fragments like %%] or [%%
  for patroncards-errors.inc
- Try to get an error: Try a link like
  http://[YOUR SERVER]/cgi-bin/koha/patroncards/create-pdf.pl?batch_id=1&template_id=999&layout_id=999&start_card=1
  ...where template_id and layout_id do not exist

(Amended for comment #2 2017-06-05 mv)
(Amended for comment #6 2017-08-02 mv)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7e39bbc61a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 15:07:55 +02:00
Marc Véron 4d42774019 Bug 18652: Get rid of tt directive in translation for uncertainprice.tt
Translation tool shows toe following for ncertainprice.tt
0; url=[% scriptname %]?booksellerid=[% booksellerid %]

This patch fixes it.

To test:
- Apply patch
- Verify that code change makes sense
- Verify that Home > Acquisitions > [vendor] > Uncertain prices for [vendor]
  works as before

- Additional test (for a langunage 'aa-AA')
  perl translate create aa-AA
  verify that line 41 no longer appears in aa-AA-staff-prog.po

Amended to switch from BLOCK to a template variable, see comment #5

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2ee82801c7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 14:50:24 +02:00
Marc Véron 0f9175c0b2 Bug 18649: Translatability: Get rid of tt directive in translation for admin/categories.tt and onboardingstep2.tt
New patch without trailing IF construction in tt directives as
requested in comment #28

To test: Verify that translation tool no longer shows tt directives as
described in comment #1

New patch, needs SO.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 79338bde3e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 14:48:52 +02:00
Marcel de Rooy 1c8287632e Bug 18921: Resolve a few warnings in C4/XSLT.pm
Resolves warnings like:

Use of uninitialized value in hash element at C4/XSLT.pm line 262.
Use of uninitialized value in numeric eq (==) at C4/XSLT.pm line 267.
Use of uninitialized value $status in concatenation (.) or string at C4/XSLT.pm line 300.

Note: Line numbers are not exactly the same anymore.

Test plan:
[1] Enable XSLT view in OPAC
[2] Without this patch, you will probably have some of these warnings when
    doing some opac searches.
[3] Apply this patch. Check the logs again.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5f989a81df)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 14:38:49 +02:00
Baptiste Wojtkowski bfdaf1136d Bug 18919: Repair "Transaction branch" in cash_register_stats.pl
- values of the option fields are now correctly loaded

TEST PLAN:
go to domain/cgi-bin/koha/reports/cash_register_stats.pl
1 - Make a report for all branches => it works
2 - Make a report for any branch => you will get the same or no result
3 - apply patch
4 - Repeat 2 => it should work

Followed test plan worked as intended
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7b5457cd0f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:37:14 +02:00
Marcel de Rooy f067450d80 Bug 19049: [QA Follow-up] Mock config, default format
As requested by QA:
[1] Mock_config enable_plugins in the test.
[2] Fallback to MARC when format is empty. Remove die statement.
Added:
[3] Remove $marc. This variable got obsolete during development.
[4] Add test on $input_file and $plugin_class. Test $text before calling
    Handler or processing $text. No need to split undef if somehow Handler
    returned undef, etc. If the routine returns an empty arrayref,
    stage-marc-import will do fine.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a423fcff42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:27:05 +02:00
Kyle M Hall 5699df9dee Bug 19049 [QA Followup] - Make plugin name first item in description
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d8f6315b6d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:27:04 +02:00
Marcel de Rooy 3bbb89c571 Bug 19049: [Follow-up] Make sure that GetPlugins finds the plugin
We have to mock_config the pluginsdir before Plugins is loaded, and
we should pass an absolute path (not a relative one).
If you did not install the test to_marc plugin, this test would fail.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Verified patch is compatible with original KitchenSink to_marc plugin

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0987b135ea)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:27:04 +02:00
Marcel de Rooy c6e3f2ac05 Bug 19049: Testing RecordsFromMarcPlugin with a to_marc plugin
This patch adds a simple to_marc plugin in t/Koha/Plugin that is used
in the added subtest in ImportBatch.t.

Test plan:
[1] Run t/db_dependent/ImportBatch.t
[2] Copy the to_marc test plugin from t to your plugin directory.
    Under Debian packages, you should do something like:
    mkdir -p /var/lib/koha/master/plugins/Koha/Plugin/
    cp [yourclone]/t/Koha/Plugin/MarcFieldValues.pm /var/lib/koha/master/plugins/Koha/Plugin/
[3] Check if you see this plugin on plugins/plugins-home.pl
[4] Create a text file with some fields like:
    (Note: The plugin needs an empty line between both "records".)
    100,a = Test Author 1
    245,a = Title One

    100,a = Author 2
    245,a = Title Two
[5] Go to stage-marc-import.pl. Upload the created file. Select the plugin
    in the format combo and proceed. Did you create two records ?

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 83f60adbab)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:27:04 +02:00
Marcel de Rooy 4dd020a301 Bug 19049: Fix regression on stage-marc-import with to_marc plugin
Bug 12412 added the use of to_marc plugins allowing arbitrary file formats
in stage-marc-import (as long as the plugins can handle them). The feature
was not very visible in the code, and when bug 10407 added the marcxml
format, it made some changes that broke the use of to_marc.

This patch restores the functionality by:
[1] Adding a sub RecordsFromMarcPlugin to ImportBatch.pm, specifically
    addressing the conversion from arbitrary formats to MARC::Record.
    The original to_marc interface is used: pass it the file contents,
    and it returns a string consisting of a number of MARC blobs separated
    by \x1D.
    Consequently, the call of to_marc is removed from routine
    BatchStageMarcRecords where it did not belong. The to_marc_plugin
    parameter is removed and two calls are adjusted accordingly.
[2] Instead of a separate combo with plugins, the format combo contains
    MARC, MARCXML and optionally some plugin formats.
[3] The code in stage-marc-import.pl now clearly shows the three main
    format types: MARC, MARCXML or plugin based.

Note: This patch restores more or less the situation after bug 12412, but
I would actually recommend to have the to_marc plugins return MARC::Record
objects instead of large text strings. In the second example I added a
to_marc plugin that actually converts MARC record objects to string format,
while RecordsFromMarcPlugin reconverts them to MARC::Records.

Test plan:
See second patch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d24568b672)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-06 15:27:04 +02:00