- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1
Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors
@RM: You will need to push yarn.lock as well
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)
Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors
@RM: You will need to push yarn.lock as well
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
In the previous tests we had:
$b =~ s/_/ZZZ/g; # mysql sorts underscore last, if you modify this qa-test-tools will need adjustments
But this is wrong, try:
select variable from systempreferences;
and confirm that hide_marc is before hidelostitems and that
intranet_includes is before IntranetAddMastheadLibraryPulldown
We will deal with qa-test-tools once this is pushed.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
In vim `:%s/^\(('[^']*', \?'[^']*'\).*/\1),/`
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
We currently have to set options, explanation and type in sysprefs.sql and the atomic/dbrev files.
However we (almost) never use them, we rely on the values in the yml files.
We could remove them and don't require them when when add new sysprefs.
It will avoid the mess we currently have (mismatch between new and updated installations, see bug 41682 and bug 41800).
Instead of fixing the discrepancies (again, see bug 41800) we should
NULL the 3 columns in sysprefs.sql and so at the DB level to rely only
on the yaml files.
This patch does several things:
1. Remove the 3 columns from sysprefs.sql to use the default NULL
2. Atomic update:
* Set to NULL for existing installations as well
* Rename UseICUStyleQUotes => UseICUStyleQuotes
* Delete OpacMoreSearches and OPACMySummaryNote, old prefs that have been moved
to additional contents
3. Fix some errors in yaml files (mostly empty entries)
4. Move parsing of yaml files to a dedicated Koha::Devel::Syspref module
5. Retrieve all yaml content using new methods added to Koha::Config::SysPrefs
(that will be reused in follow-up bugs)
Test plan:
1. Run updatedatabase and confirm that now all systempreferences rows in DB
have options, explanation and type set to NULL (except local-use prefs)
2. `prove t/db_dependent/check_sysprefs.t` should return green
3. Confirm that the UI is still working correctly
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Bug 41494 renamed "Koha administration" to "Administration" in the
staff interface. Update the Batches_spec.ts Cypress test to use the
new label.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
The Handler::run change to skip disabled plugins broke the
RecordsFromMarcPlugin subtest in ImportBatch.t. The MarcFieldValues
plugin was installed but never enabled, so Handler::run returned
early. Add $plugin->enable() before calling RecordsFromMarcPlugin.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This patch prevents the UI to randomly change the language when reaching
addbooks
The problem is that getlanguage is called BEFORE get_template_and_user,
without, and "interface" (C4::Context->interface) is not set yet.
Open C4/Languages.pm, search "sub getlanguage"
We first read the cache, then if there is no interface we reach
GetTranslatedLanguages that does return languages in a random order,
then we pick the first one
765 @languages = map { $_->{rfc4646_subtag} } @{ getTranslatedLanguages( $interface, $theme ) };
783 $language = shift @languages unless $language;
We must call getlanguage AFTER that the cache is populated.
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This patch changes "op" to "login_op" when logging in, so that the original op can
flow through to whichever controller is processing the login and subsequent op.
Test plan:
0. apply the patch and koha-plack --restart kohadev
1. Without logging in, go to the following:
http://localhost:8081/cgi-bin/koha/reports/guided_reports.pl?id=1&op=run
2. Log in and note that you can see the report
3. Try logging into the OPAC
4. Try logging into the self-checkout
5. Create a new self-reg account and try logging in with the auto-filled details
6. Test anything else you can think to test here
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Apply just the 2 cypress tests patches, run:
cypress run --spec t/cypress/integration/ILL/Batches_spec.ts
Notice it fails.
Apply the fix patch. Repeat the command above. Tests must pass.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Add a way to access and manipulate koha-conf.xml (we need to ensure plugins_restricted is 0 for the actual tests)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Test plan, preparation:
A) Enable ILLModule
B) Install a metadata enrichment plugin, e.g:
https://github.com/openfifth/koha-plugin-api-pubmed/releases/tag/1.1.1
C) Restart plack to pick up the newly installed plugin if needed.
D) Create a new batch, visit:
<staff_url>/cgi-bin/koha/ill/ill-requests.pl?
Issue #1:
1.1) Click 'New ILL requests batch'
1.2) Enter a name, '42' on the cardnumber and any library. Click 'Continue'.
1.3) Click the 'Close' button (or click anywhere outside the modal) to close the modal.
1.4) Repeat 1.1). Notice the 'Continue' button is no longer there.
Issue #2:
2.1) Click 'New ILL requests batch'
2.2) Enter a name, '42' on the cardnumber and any library. Click 'Continue'.
2.3) Enter '123' on the textarea, click 'Process identifiers'.
2.4) Notice a 'Add items to batch' buttons appears. Don't click that, as before, close the modal.
2.5) Repeat 2.1) Notice the progress bar shows right off the bat (it shouldn't) with NaN as its value as well as table elements (export button, 'No entries to show' message, etc, with no table.
Apply patch, hard-refresh the browser and repeat Issues 1 and 2. Confirm the patch fixes them.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Since CSRF procetion form without CUD action must use GET instead of POST
Fix value_builder/unimarc_field_4XX.pl
Test plan:
1) Use UNIMARC DB
2) Be sure value builder unimarc_field_4XX.pl is defined on 461$t
3) Create a new biblio record
4) On 461$t click on 'Tag editor' icon
5) Perform a search
6) Click on choose
7) Field 461 is filled
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
The ERMHome route is a base route that doesn't accept params, but
NavigationItem was passing all current route params (license_id,
agreement_id, etc.) to it, causing Vue Router errors.
Fix by checking if the route is a base route (is_base flag) and
passing an empty params object in that case.
Test plan:
1. Run Cypress tests: yarn cypress run
2. Verify AdditionalFields_spec.ts now passes all 12 tests
3. Navigate to ERM module and verify breadcrumbs work correctly
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
The main ERM route was missing a 'name' property, causing the
navigation store to treat it as an external path (.pl extension).
This resulted in breadcrumb links using href instead of router-link,
causing unwanted page reloads.
To test:
1. Navigate to ERM module
2. Go to any sub-section (Agreements, Licenses, etc.)
3. Click on 'E-resource management' in the breadcrumb
=> FAIL: Notice the page reloads!
4. Apply the patch
5. Repeat steps 1-3
=> SUCCES: Verify the page doesn't reload and navigation works smoothly
6. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
It appears that edi_cron.pl will run disabled EDI plugins. It uses Koha::Plugins::Handler::run that does not check if the plugins is gets are disabled.
Koha::Plugins::Handler::run needs to be fixed to not run disabled plugins.
Test Plan:
1) Apply this patch
2) prove t/db_dependent/Koha/Plugins/Plugins.t
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
The intercept is done too late, it must be done before we load the view,
and then we should wait for it.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
16:40:49 <failure message="The following error originated from your application code, not from Cypress. It was caused by an unhandled promise rejection.
16:40:49
16:40:49 > response.filter is not a function
16:40:49
16:40:49 When Cypress detects uncaught errors originating from your application it will automatically fail the current test.
16:40:49
16:40:49 This behavior is configurable, and you can choose to turn this off by listening to the `uncaught:exception` event.
16:40:49
16:40:49 https://on.cypress.io/uncaught-exception-from-application" type="TypeError"><![CDATA[TypeError: The following error originated from your application code, not from Cypress. It was caused by an unhandled promise rejection.
16:40:49
16:40:49 > response.filter is not a function
16:40:49
16:41:13 When Cypress detects uncaught errors originating from your application it will automatically fail the current test.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
ReferenceError: window is not defined
at /kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:521:26
at /kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:523:3
at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/dist/api-client.cjs.js:747:3)
at Module._compile (node:internal/modules/cjs/loader:1521:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)
at Module.load (node:internal/modules/cjs/loader:1266:32)
at Function.Module._load (node:internal/modules/cjs/loader:1091:12)
at Module.require (node:internal/modules/cjs/loader:1289:19)
at require (node:internal/modules/helpers:182:18)
at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/api-client.js:11:23)
at Module._compile (node:internal/modules/cjs/loader:1521:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)
at Module.load (node:internal/modules/cjs/loader:1266:32)
at Function.Module._load (node:internal/modules/cjs/loader:1091:12)
at Module.require (node:internal/modules/cjs/loader:1289:19)
at require (node:internal/modules/helpers:182:18)
at Object.<anonymous> (/kohadevbox/koha/t/cypress/plugins/insertData.js:14:29)
at Module._compile (node:internal/modules/cjs/loader:1521:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1623:10)
at Object.require.extensions.<computed> [as .js] (/kohadevbox/Cypress/12.17.4/Cypress/resources/app/node_modules/ts-node/dist/index.js:851:20)
13:12:25 # Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc'
13:12:25 # at xt/author/valid-templates.t line 147.
13:12:25 # undef error - : filter not found
13:12:25
13:12:25 # Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc'
13:12:25 # at xt/author/valid-templates.t line 147.
13:12:25 # undef error - : filter not found
13:12:25
13:12:25 # Failed test [13:12:08] xt/author/valid-templates.t .................................................
13:12:25 Dubious, test returned 28 (wstat 7168, 0x1c00)
13:12:25 Failed 28/870 subtests
13:12:26 '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc'
13:12:26 # at xt/author/valid-templates.t line 147.
13:12:26 # undef error - : filter not found
13:12:28
13:12:28 # Failed test '/kohadevbox/koha/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc'
13:12:28 # at xt/author/valid-templates.t line 147.
13:12:28 # undef error - : filter not found
Test plan:
0. Apply the patch
1. Run the following:
prove t/db_dependent/FrameworkPlugin.t \
t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t \
t/db_dependent/Koha/UI/Form/Builder/Biblio.t \
t/db_dependent/Koha/UI/Form/Builder/Item.t \
t/db_dependent/Serials.t
Squashed version of the following patches:
Bug 38365: Fix Koha/UI/Form/Builder/Biblio.t
# Failed test at t/db_dependent/Koha/UI/Form/Builder/Biblio.t line 216.
# '<script nonce="">
# $(document).ready(function () {
#
# });
# </script>
# '
# doesn't match '(?^us:<script>.*</script>)'
# Looks like you failed 1 test of 4.
Bug 38365: Fix Koha/UI/Form/Builder/Item.t
# There were 16 warning(s)
# Previous test 0 ''
# Use of uninitialized value $csp_nonce in concatenation (.) or string at /kohadevbox/koha/Koha/FrameworkPlugin.pm line 381.
# at /kohadevbox/koha/Koha/FrameworkPlugin.pm line 381.
Bug 38365: Fix Serials.t
Bug 38365: Fix FrameworkPlugin.t
We never do that in our tests, and KOHA_HOME is not defined for
the kohadev-koha user in ktd.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This file now tidies after the patch
"Make tidy.pl compatible with script elements with attributes"
To test:
1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The add_csp_nonces.pl file should use the exceptions in
Koha::Devel::Files.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
By setting __webpack_nonce__ webpack/rspack will add the nonce to styles
added using style-loader plugin.
Also, stop fontawesome from auto injecting CSS elements, and instead
manually import them so that they can be picked up by style-loader
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
tidy.pl will still tidy whitespace around script elements that have
attributes like "nonce"
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This initialises the CSP nonce in the unit test so that
t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt
will get its script element rewritten correctly.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Schema type [array,object] is not valid in OpenAPI version 2.
There are two different CSP reporting directives.
One is the now deprecated "report-uri" directive. Browsers typically send a single
JSON object following the CSP2 specification.
"report-uri" is deprecated in CSP3 in favor of the newer "report-to" directive. It
is expected to contain an array of report objects.
There are browser that do not yet support the "report-to" directive, so both
directives should be supported.
There are also variations among the "report-uri" format. See
https://www.tollmanz.com/content-security-policy-report-samples/
Because of these variations, it becomes quite complex to handle the most common
cases in a single API endpoint.
We could build two separate endpoints for both directives.
Or we can accept any type of input and handle the variations in a single endpoint.
This patch attempts to do that.
Before this patch input parameters were validated by JSON::Validator. That is the
normal and recommended way to build OpenAPI endpoints in Koha. After this patch we
remove all input parameter restrictions from the OpenAPI spec, and simply accept
any type of body.
This means the controller will now always return a HTTP 204 regardless of the type
of data passed to the controller. It instead truncates too long input before
writing them into log files.
As this is not an endpoint that developers will build new Koha clients for, we
do not have to offer a very in-depth input parameter spec for this endpoint.
To test:
1. t/db_dependent/api/v1/public/csp_reports.t
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
It seems the test outside of db_dependent required presence of database after all
To test:
1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
[FAIL] api/v1/swagger/definitions/csp_report.yaml
FAIL new_line_at_the_end_of_file
Missing new line at the end of file, make sure your editor correctly reads .editorconfig ('insert_final_newline = true'). See bug 40541.
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
To test:
1. prove t/Koha/ContentSecurityPolicy.t
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Paul Derscheid
David Cook
Jonathan Druart
Martin Renvoize
Pedro Amorim
Fridolin Somers
Tomás Cohen Arazi
Kyle M Hall
Lari Taskula