Commit Graph

2133 Commits

Author SHA1 Message Date
Jonathan Druart 71b7e12f79 Bug 28941: Deal with OPACSuggestionUnwantedFields
Remove fields from OPACSuggestionUnwantedFields before creating the
suggestion

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

JD amended patch: remove useless sort
2021-09-20 20:21:00 -10:00
Jonathan Druart e73eeb9e6a Bug 28941: Filter suggestion inputs at the OPAC
The following sequence is bad:
46 my $suggestion      = $input->Vars;

181         &NewSuggestion($suggestion);

All columns can be set when we insert the suggestion into the DB
We definitely want to avoid the following fields to be set by the final
user: acceptedby, accepteddate, STATUS, etc...

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2021-09-20 20:21:00 -10:00
Marcel de Rooy ec6097f415 Bug 28935: No filtering on patron's data on member entry pages
Security patch. Follow-up for 28929.
Including correction for gonenoaddress and two others.
Includes unwanted fields too now.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2021-09-20 20:21:00 -10:00
Jonathan Druart dfbe57f6b4 Bug 28947: Prevent OPAC user to create new users
This patch prevents an existing user from exploiting the patron edit form in order to
force create new patrons

To test:
Try all combinations of PatronSelfRegistration and PatronSelfRegistrationVerifyByEmail
with and without this patch.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2021-09-20 20:21:00 -10:00
Jonathan Druart 1ff7bd2840 Bug 28929: Prevent flags to be sent during patron's edition
* selfreg and selfmod for OPAC
* patron's edition on staff

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested OPAC and staff side. Prevents mangling flags column.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
2021-09-20 20:21:00 -10:00
Kyle M Hall b6c9ab1197 Bug 28885: Skip invalid biblios for OpacBrowseResults
If a record is deleted from Koha, but is for some reason not deleted from the search indexes, OpacBrowseResults can cause an ISE if the deleted record is in the search results for any given item. OpacBrowseResults loops through the search results, and checks if there is a biblionumber, but does *not* check to see if a result was pulled from the database for that biblionumber. It simply assumes the result must exist.

We should be checking to ensure the biblionumber was valid before operating on the biblio object.

Test Plan:
1) Use zebra for searching
2) Disable koha-indexer
3) Enable OpacBrowseResults
4) Perform a search
5) Delete an item in the search results
6) View on of the remaining items in the search results
7) Note the error
8) Apply this patch
9) Restart plack
10) Reload the page
11) The error should be gone!

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a478eb1b4f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-09-08 10:38:01 -10:00
Tomas Cohen Arazi 0919a3c1fc Bug 26223: (QA follow-up) Fix filter order
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6653aeaf14)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-09-08 10:12:02 -10:00
Andreas Roussos 65e06a4530 Bug 26223: include item information in OPAC ISBD view
The ISBD view in the OPAC interface does not display item information.

This patch fixes that.

Test plan:
0) Have a biblio with at least one item attached to it and include one
   of the following snippets in the OPACISBD system preference,
   depending on your MARC flavour:

   MARC21:
   #952|<br/><h2>Items</h2><table><th>Copy number</th><th>Shelving
   location</th><th>Koha item type</th><th>Barcode</th><th>Call number
   (Full call number)</th><th>Materials specified (bound volume or
   other part)</th>|<tr><td>{952t} </td><td> {952c} </td><td> {952y}
   </td><td> {952p} </td><td> {952o} </td><td> {9523}</td></tr>|</table>

   UNIMARC:
   #995|<br/><h2>Items</h2><table><th>Copy number</th><th>Shelving
   location</th><th>Koha collection</th><th>Barcode</th><th>Call number
   (Full call number)</th><th>Numbering (volume or other part)</th>|
   <tr><td>{9956} </td><td> {995e} </td><td> {995h} </td><td> {995f}
   </td><td> {995k} </td><td> {995l}</td></tr>|</table>

   Switch to the OPAC ISBD view for your biblio; notice how it does
   not display item information.
1) Apply the patch, and restart Plack/memcached if necessary.
2) Refresh the OPAC ISBD view page, this time you should see item
   information as per the OPACISBD system preference setting.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit faddc2072d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-09-08 10:12:02 -10:00
Jonathan Druart a8fda3ee04 Bug 28784: Remove code related to num_paragraph cookie
It could lead to server freeze if set to a big value (we are pushing
into an array and so RAM is being fulfilled, and CPU is looping).

I don't understand the point of this cookie.

        var numPar = $("#booleansearch fieldset p").size();
        if (numPar > [% search_boxes_count | html %]){
            jQuery.cookie("num_paragraph", numPar,{ path: '/'});
        }else{
            jQuery.removeCookie("num_paragraph", { path: '/'});
        }

But "#booleansearch fieldset p" does not exist, it's not 'p' but 'div'
elements.

I've removed the code related to num_paragraph and the "Return to the
last advanced search" feature still works as before.

From this comment:
    # determine what to display next to the search boxes (ie, boolean option
    # shouldn't appear on the first one, scan indexes should, adding a new
    # box should only appear on the last, etc.

The only bit that is not working as described is "adding a new box
should only appear on the last", but it has been working this way for
a long time already I think, and I don't see it as a bug.

Test plan:
Read the code, check that the above is correct.
Search for regression in this "return to last adv search" feature added
by bug 13307.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 18183bdf34)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-08-24 16:17:18 -10:00
Marcel de Rooy 992267a7db Bug 28764: (QA follow-up) Add comment, remove two defined's
If we no longer offer the sortfield with :asc actively, we should
probably write it somewhere too.
Replaced a few defined tests by empty test. No need to split empty
string or zero etc.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit eed750ba95)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-08-13 10:15:43 -10:00
Nick Clemens a6c1b72b59 Bug 28764: Parse direction parameter in public list view
This patch adds a check for a 'direction' paramter in list sorting.

It maintains the existing syntax for sorting 'sortfield=field:direction'
but adds support for the form used in paginations and more commonly thtoughout
Koha' sortfield=field&direction=direction'

To test:
1 - Create a public list
2 - Add enough items to generate two pages (40 worked for me)
3 - View the list and enforce sorting by date added descending:
    sortfield=dateadded:desc
4 - Note the titles shown
5 - Click to second page using the pagination bar
6 - Note the same titles are shown, in a reversed order
7 - Apply patch
8 - repeat 305
9 - Second page is sorted correctly!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 13c0679fa0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-08-13 10:15:43 -10:00
Jonathan Druart 587c5e38f1 Bug 28561: Remove DBIC warning in opac-shelves
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 298569d37f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-08-02 11:12:33 -10:00
Marcel de Rooy ea51ef0162 Bug 28561: Fix noisy warning about $direction too
Use of uninitialized value $direction in string ne at /usr/share/koha/opac/opac-shelves.pl line 265.

Bonus:
Use of uninitialized value $sortfield in string eq at /usr/share/koha/opac/opac-shelves.pl line 264.

Test plan:
While testing patch 1, check the logs for these warnings with and
without this patch.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 3a4dafb754)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-08-02 11:12:33 -10:00
Marcel de Rooy c994c78533 Bug 28545: Noisy uninitialized warn at opac-MARCdetail.pl line 313
Test plan:
You do not even need a NULL value in a authorised value controlled
item field, a zero in damaged or withdrawn is enough to trigger the
warnings. (Because only the 1 is linked to an authvalue.)

Check your plack-opac-error.log before and after applying this change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Without the patch I had at least four warnings per item: withdrawn,
lost, damaged and notforloan.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5d6a138076)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-07-09 16:44:25 -10:00
Owen Leonard 5756e5a290 Bug 28422: OPAC MARC detail view doesn't correctly evaluate holdability
This patch modifies the MARC detail view in the OPAC so that it
evaluates whether a title can be placed on hold in the same way it is
done on the "normal" detail page and the ISBD detail page. This allows
for consistency in the display of the "Place hold" link.

To test, apply the patch and log into the OPAC.

 - Perform a search which will return results, at least one of which can
   be placed on hold.
 - View the detail page, the MARC detail page, and the ISBD detail page.
   In each case the "Place hold" link should appear in the sidebar.
 - View the same pages for a record which cannot be placed on hold to
   confirm that the link doesn't appear. For instance:
   - All items are not for loan.
   - All items are lost.
   - There are no items attached.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b542c9971e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-07-09 16:27:58 -10:00
Joonas Kylmälä a4dfdb794d Bug 28513: Fix analytics search links so they don't match unrelated biblios
At least when using Searchengine=Elasticsearch what happened was that
without () parenthese included the search for Host-item field was done
only to the first token, the subsequent ones matched any
fields. Adding the parentheses restrict the search to Host-item search
field only.

To test:
 1) Set Searchengine = elasticsearch
 2) Make a biblio with 245a = "biológica paranaense." and 773a = "Acta"
 3) Go to a biblio with 245a = "Acta biológica paranaense" (in
 kohadevbox or create one if you need).
 4) Notice that the "Acta biológica paranaense" biblio's detail page link "Show
 analytics" takes to the "biológica paranaense" incorrectly just
 because the 773a has "Acta" and the words "biológica" and "paranaense"
 appear elsewhere in the biblio.
 5) Apply patch and notice the link is now not created at all

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit cfe7123679)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-07-07 14:49:13 -10:00
Jonathan Druart f32d0d41c3 Bug 28409: Simplify data validation
Simplify the affectation then trust it.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

JD Amended patch: remove duplicate comma

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 50db7afeb4)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2021-06-26 23:11:08 +02:00
David Cook b4c29846af Bug 28409: Comprehensively validate category in opac-shelves.pl
Default to a category of 1 (ie Private). Only allow input of 1
or 2 (ie Public)

== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=foo&category=9
4. Note that you can't see this list in the Lists (but it has been added to the database)
5. Apply the patch & restart services
6. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
7. Note that you are not redirected to another website
8. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=bar&category=9
9. Note that "bar" has been added as a Private list

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0ccf5fe83b)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
2021-06-26 23:11:08 +02:00
Jonathan Druart 9fc3f224d2 Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Apply the patch & restart services
4. Repeat the above and you are not redirected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: David Cook <dcook@prosentient.com.au>
2021-05-24 10:05:37 +02:00
Lucas Gass 8bc4e05918 Bug 28241: Fix regex to allow for content before and after comma
1. Set up the OPACNoResultsFound with the {QUERY_KW} placeholder.
2.Do a search with a comma that will return no results. Like "King, Martin Luther". If the returns results add some additional characters to the search until no results are returns.
3. Look at the #noresultsfound HTML element. Anything before (or after) the comma is omitted. So the placeholder looks something like 'Martin Luther' instead of 'King, Martin Luther'.
4. Apply patch
5. Try the search again, you should see the content before and after a comma

Signed-off-by: Lisette Scheer <lisettes@latahlibrary.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 685fcb1880)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-05-12 16:51:50 +02:00
Nick Clemens b78ccb3e47 Bug 27529: Choose patron's branch or item's homebranch if following group rules and patron cannot choose branch
This patch defaults the holds pickup location to the items homebranch or the patron's branch when a group option is selected
for the hold fulfillment policy and the patron is not allowed to choose the branch on the OPAC

To test:
1 - Set 'Default checkout, hold and return policy' -> 'Hold pickup library match' to item's hold group or patron's hold group
2 - Set  OPACAllowUserToChooseBranch to 'Don't allow'
3 - Try to place an item level hold on the opac
4 - Ka-boom, etiher:
    The method Koha::Item->patrongroup is not covered by tests!
    The method Koha::Item->itemgroup is not covered by tests!
5 - Apply patch
6 - Repeat
7 - Note the pickup location is set to either the patron's branch or the items homebranch
8 - Repeat plan with the other group setting

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 99c3b9ae1f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-04-22 16:21:36 +02:00
Aleisha Amohia 63b7ba9767 Bug 27979: Modify TrackClicks to verify URL exists in DB when multiple uri
To test:
1) Go to Admin -> system preferences and enable the TrackClicks syspref
(set to Track or Track anonymously)
2) Find a record in the staff client with an item. Edit the item and put
two external URLs in the Uniform Resource Identifier field, e.g.
"https://www.google.com/ | https://twitter.com/"
3) Search for that record in the OPAC. Notice the two links in the
holdings table.
4) Click a link and confirm that you are directed to a 404.
5) Apply the patch and refresh the page
6) Click a link and confirm that you are directed to the page as
expected
7) Go back to edit the record in the staff client and remove one of the
links from the URI field
8) Go back to the OPAC and confirm you can still access the link as
expected when there is only one URI

Sponsored-by: Catalyst IT

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0da874bde2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-04-22 16:18:31 +02:00
Jonathan Druart 759e63ccf4 Bug 27860: Fix self-registration if messages with incorrect email are inqueued
If the pref KohaAdminEmailAddress was not set correctly (invalid email)
and has been used to generate message, the message_queue table can contain
some messages that are not sent (pending) and will be processed each
time a new self-reg is done.
The PatronSelfRegistrationVerifyByEmail feature must send only the
notice we just generated, not the whole pending queue.

Test plan:
1. Do not apply the patches
2. Set KohaAdminEmailAddress to an invalid email (root@localhost for
instance)
3. Turn on PatronSelfRegistrationVerifyByEmail
4. Self-reg a patron
5. Boom (that must be fixed on a separate bug report)
6. Set KohaAdminEmailAddress to a valid email (root@example.org)
7. Self-reg a patron
8. Still Boom! (because it's processing the first invalid email)
9. Apply the patches, restart_all
10. Self-reg a patron
=> The email is sent!
Notice the change in DB, the first email is still there with status
"pending" and second email is sent!

QA: at step 10. TODO first email must be 'failed' (highlight in tests)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 87eaaf302c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-03-19 16:14:33 +01:00
Jonathan Druart af888cd3b8 Bug 27650: Fix variable passed to the template in opac-main
$template->param(
+    koha_news           => @all_koha_news,

We must not pass an array, the number of elements of the hash passed to the template may be inconsistent.

It's working because of an error earlier in the script:
+    @all_koha_news   = &GetNewsToDisplay($news_lang,$homebranch);

GetNewsToDisplay returns an arrayref

Test plan:
Define at least 2 news to display on the OPAC main page
Hit opac-main.pl
=> All news are displayed
Click one
=> You see the single news you selected

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ca4ef19a2b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-03-12 09:03:16 +01:00
Jonathan Druart 2b021df3e2 Bug 27626: Fix self registration if categorycode is hidden and PatronSelfRegistrationVerifyByEmail
If categorycode is selected in
PatronSelfRegistrationBorrowerUnwantedField and
PatronSelfRegistrationVerifyByEmail is turned on, the patron self registration
fails with

   [You must provide a patron's category to validate password's strength
   and length] at /usr/share/perl5/Exception/Class/Base.pm line 88

Test plan:
0. Select categorycode in PatronSelfRegistrationBorrowerUnwantedField
   and turn on PatronSelfRegistrationVerifyByEmail
1. Self register a patron
2. Confirm that it works as expected with this patch applied.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 74ae74d5fa)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-25 10:30:52 +01:00
Jonathan Druart 350fbb7da1 Bug 27604: Deal with empty pref
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 121b633cad)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-23 14:35:22 +01:00
Jonathan Druart c4922f9c76 Bug 27604: Init to {}
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4784b8ffe5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-23 14:35:22 +01:00
Nick Clemens 1951169055 Bug 27604: (QA follow-up) Limit the libraries during the query
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 60a749ff5a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-23 14:35:22 +01:00
Jonathan Druart 41aaad8098 Bug 27604: Make sure PatronSelfRegistrationLibraryList is used
The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 376bf9b980)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-23 14:35:22 +01:00
Jonathan Druart 60e8b51100 Bug 26406: Fix suggestions filter at the OPAC
There is an input filter but it does nothing

Test plan:
You need 2 differents users, U1 and U2
Create several (at least one) suggestions for each of them
Test the following with and without OPACViewOthersSuggestions:
With U1 logged in, go to the suggestions tab and use the input to filter
the suggestions.
It should work correctly.
Also play with the "Suggested by" options

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ee03841846)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-19 16:11:30 +01:00
Jonathan Druart 06c47d8f5b Bug 27450: Remove password from the mandatory fields when editing details
When a patron edit their personal details at the OPAC, the password must
be removed from the mandatory fields

Test plan:
0 - Don't apply the patch
1 - Set PatronSelfRegistrationBorrowerMandatoryField to require password
2 - Create or sign in as a patron on the opac
3 - Click 'Your personal details'
4 - Attempt to edit
5 - Save changes
=> They are rejected because not all required fields are populated
6 - Apply the patch
7 - Repeat 3 to 5
=> details are saved successfully
8 - Test the self registration feature and confirm that the password is
required

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4b2c284092)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-02-05 16:38:21 +01:00
Jonathan Druart 54a9ef09bf Bug 15448: Remove items fetch
We fetch them already too many times.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6cd68dd05b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-01-19 08:46:03 +01:00
Jonathan Druart 60e08d51bb Bug 15448: Fix ISE
The method Koha::Items->itemnumber is not covered by tests!

Trace begun at /kohadevbox/koha/Koha/Objects.pm line 592
Koha::Objects::AUTOLOAD('Koha::Items=HASH(0x55981fd94790)') called at /kohadevbox/koha/opac/opac-reserve.pl line 465

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9790b5ca3a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-01-19 08:46:03 +01:00
Tomas Cohen Arazi 655c4427c7 Bug 15448: (follow-up) Adapt to changes on bug 24254
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8af3ecdd53)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-01-19 08:46:03 +01:00
Tomas Cohen Arazi cdfea70011 Bug 15448: (follow-up) Fetch the patron category once
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c9f66f5e6b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-01-19 08:46:03 +01:00
Tomas Cohen Arazi 284b2da589 Bug 15448: Filter out items hidden in OPAC on placing hold
This patch leverages on bug 24254's
Koha::Items->filter_by_visible_in_opac to filter out items that
shouldn't be presented to the end user in the OPAC interface.

To test:
1. Circulation and Fine rules for item-level holds are set to allow.
2. Setting the OpacHiddenItems preference to "ccode: [SUPPRESS]"
3. An item with collection Code Suppress is set.
4. Search for the title in the OPAC.
=> SUCCESS: The Suppress ccode item isn't shown.
5. View the detail page for the title.
=> SUCCESS: The suppress ccode item isn't shown.
6. Place a hold on the item:
  -- Click "Show more options"
  -- Select "A specific item"
=> FAIL: the ccode with the opachiddenitems rule has an item that appear in the list to place a hold
7. Apply this patch and repeat 6
=> SUCCESS: The item doesn't show!
8. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 051f551986)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2021-01-19 08:46:03 +01:00
Jonathan Druart e650254cf4 Bug 27230: Display OPAC description for OPAC_SUG
The authorised values OPAC_SUG displayed at the OPAC show the staff
description.

Test plan:
1. Create an auth value in opac_sug, with different text for the description and OPAC description.
2. Go to the OPAC and open the purchase suggestion form.
3. Note in the Reason for purchase drop down, the descriptions appear, the text entered in the OPAC description field.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7063f2c476)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2020-12-30 15:39:32 +01:00
Owen Leonard 6302df53ac Bug 27200: (follow-up) Browse search interface update
This patch updates the browse search interface to confirm to new
interface patterns in the Bootstrap 4 framework, especially in the form
markup.

The results list has been changed to a Bootstrap "Collapse" component
configured as an accordion
(https://getbootstrap.com/docs/4.5/components/collapse/#accordion-example).

Instead of loading the bibliographic record results below the list of
terms returned, the bibliographic results are now displayed in the
"panel" expanded below the selected term. Subtitle has been added to the
information displayed about the bibliographic record.

To test you must be using ElasticSearch and the OpacBrowseSearch
preference must be enabled. Apply the patch and rebuild the OPAC CSS
(https://wiki.koha-community.org/wiki/Working_with_SCSS_in_the_OPAC_and_staff_client).

- Open the "Browse search" page in the OPAC.
- Test various searches: Author, Subject, and Title.
- When results are found, the should be displayed as a Bootstrap-styled
  accordion widget. Clicking any individual result should expand the
  panel containing the corresponding records.
- Clicking the record link should open the bibliographic detail page in
  a new window.
- When no results are found, a Bootstrap-style "alert" box should
  appear.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e12e0ef016)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2020-12-30 15:17:00 +01:00
Agustin Moyano 6ea5952379 Bug 27148: Fix bug on self registration when user category is hidden
This patch fixes the bug when there is no patron category available for
selection in self registration form. It uses PatronSelfRegistrationDefaultCategory
to get patron's password length and strength.

To test:
1. Do not apply this patch
2. Allow SeflRegistration, set PatronSelfRegistrationDefaultCategory to
   a valid patron category and finally add categorycode to PatronSelfRegistrationBorrowerUnwantedField
3. Go to opac and enter self registration form
CHECK => There is no patron category available for selection
      => Password's info alert shows "Password must contain at least
undefined characters"
4. Fill the form setting a password and send.
CHECH => You get an exception saying "You must provide a patron's
category to validate password's strength and length"
5. Apply this patch and restart_all
6. repeat steps 3 and 4
SUCCESS => Password's info alert message shows a number instead of
"undefined"
        => Password's strength and length checks are working
        => If you change default category's lenght or strength parameter it get's reflected when you refresh the page
        => When you click send, patron is saved

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit f5373b7a5e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2020-12-28 15:55:46 +01:00
Fridolin Somers d81c481f55 Bug 26941: Fix OPAC password recovery error messages
In OPAC password recovery perl opac/opac-password-recovery.pl
there are some error codes not in Template koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt

This patch fixes several bugs:
- remove 'use Koha::Patrons' defined twice
- remove vars $errTooManyEmailFound $errBadEmail, not used in any template
- add in template text for error 'errNoBorrowerEmail'

1) Create a patron A with login but no email
2) Create a patron B with login and valid email
3) Go to system preferences set 'OpacResetPassword' to ON
4) Make sure that OpacPasswordChange is also ON
5) Go to 'Forgot your password' in OPAC
6) Enter login if patron A and save
=> You get message 'This account has no email address we can send the email to.'
7) Enter login if patron B and save
=> Password recovery is send, no error message

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2020-12-28 15:37:24 +01:00
Andrew Isherwood 887022e0d2 Bug 24083: (follow-up) Make requested changes
This commit makes the changes requested in comment #120

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 16:09:58 +01:00
Andrew Isherwood e429d90fb3 Bug 24083: (follow-up) Include SelfCheckInModule
As highlighted by Katrin, the selfcheckin module was not aware of this
work. This commits gives it awareness of the too_unseen renew error and
the "seen" argument that can be passed to AddRenewal

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 16:09:58 +01:00
Andrew Isherwood 8595e80b78 Bug 24083: Add support for unseen_renewals
This patch adds support for unseen renewals.

Here we retrofit knowledge of unseen renewals and add the display of unseen
renewal counts and warnings, in addition to adding the ability to
specify a renewal as being "unseen".

The functionality added here is goverened by the UnseenRenewals syspref.

Signed-off-by: Sally Healey <sally.Healey@cheshirewestandchester.gov.uk>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 16:09:58 +01:00
Agustin Moyano d812bf9d27 Bug 20936: (follow-up) add biblio and item relation to old holds and set a limit on search holds
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 15:55:48 +01:00
Agustin Moyano 10e23507f5 Bug 20936: Add patron's hold history menu in OPAC
This patch adds patron's hold history in OPAC.

To test:
1. apply this patch
2. Find a patron, place several holds and cancel or fulfill them
3. Go to patron's opac
CHECK => There is no 'your holds history' option in menu
4. In admin preferences enable OPACHoldsHistory
5. Go back to patron's opac
SUCCESS => There is a 'your holds history' menu option
        => Holds history displays all holds
6. Change order, and list limit
SUCCESS => All controls work as expected
7. Sign off.

Signed-off-by: Todd <tgoatley@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 15:55:48 +01:00
Andrew Isherwood 1a7f09709a Bug 22818: Add generation and sending of notices
This patch adds the ability for ILL to send notices, both triggered by
staff and triggered by events.

Staff can trigger notices to patrons from the "Manage ILL request" screen:
- ILL request ready for pickup
- ILL request unavailable
- Place request with partners

The following notices to staff are triggered automatically:
- Request has been modified by patron
- Request has been cancelled by patron

Branches can now specify an "ILL email" address to which notices
intended to inform staff of changes to requests by patrons can be sent.

The sending of notices is controlled by a few new sysprefs:
- "ILLDefaultStaffEmail" - Fallback email address for staff ILL notices
to be sent to in the absence of a branch address
- "ILLSendStaffNotices" - To specify which staff notices should be sent
automatically when requests are manipulated by patrons

Patron notices are also controlled by the patron's messaging
preferences

Sponsored-by: PTFS Europe
Signed-off-by: Niamh Walker-Headon <Niamh.Walker-Headon@it-tallaght.ie>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-11 08:35:10 +01:00
Fridolin Somers 904e926ba0 Bug 26904: OPAC password recovery allows regexp in email
When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-09 16:18:25 +01:00
Arthur Suzuki e1a5fc85a6 Bug 22806: (QA follow-up)
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-11-02 11:03:08 +01:00
Owen Leonard 70570debf3 Bug 26752: Convert OPAC list download modal to dropdown
This patch modifies the OPAC list page so that download options are
shown in a dropdown menu instead of a modal dialog. This solves a bug
introduced by the Bootstrap 4 upgrade and makes it consistent with the
cart interface.

To test, apply the patch and view the contents of a list in the OPAC
which has multiple items on it.

 - In the toolbar at the top of the list contents table the "Download"
   button should now be a dropdown menu.
 - Selecting any of the download options should trigger a download
   prompt.
 - Test with and without some CSV profiles which have been
   configured for use in the OPAC

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-10-26 00:04:18 +01:00
Julian Maurice 96cc447045 Bug 25898: Prohibit indirect object notation
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2020-10-15 12:56:30 +02:00