Commit Graph

29430 Commits

Author SHA1 Message Date
Owen Leonard 9dcaeba3e0 Bug 5471 - Quotes in tags fail
This patch makes changes to the tag moderation template and JavaScript
to fix handling of tags with double or single quotes. This patch also
moves the tags moderation JavaScript out of the template and into a
separate JS file.

To test you should have multiple tags awaiting moderation, including
tags which contain double and single quotes.

- Go to Tools -> Tags.
- In the list of tags pending approval, test approving and rejecting
  tags, including those containing single or double quotes.
  - The state of the "Approve" or "Reject" buttons should correctly
    change according to the action you chose.
  - The label in the status column should update correctly.
- In the "Check lists" form, submitting approved, rejected, and
  unclassified terms should result in the correct message.

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Works correctly based on test plan. Tested using single- and
double-quoted tags. Passes QA Tools.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ee6f8e186b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:17:05 +02:00
Marcel de Rooy 7f06120527 Bug 19003: Add a TestBuilder default for borrowers.login_attempts
Bug 18314 causes t/db/SIP/Message.t to fail (quite often) since
TestBuilder fills login_attempts with a random number. (Note: Only
when FailedLoginAttempts is non-zero.)
Trivial fix: TestBuilder should have a zero default for login_attempts.

Test plan:
Do not yet apply this patch.
Set pref FailedLoginAttempts to say 3.
Run t/db_dependent/SIP/Message.t. Might fail on the password test (CQ).
Apply this patch.
Run t/db_dependent/SIP/Message.t again. Does not fail anymore.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5bb56bf336)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:08:38 +02:00
Jonathan Druart d3e6a1a5fd Bug 17699: Reset time simulation
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0853c4e2b4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:02:45 +02:00
Jonathan Druart af0cdbaa24 Bug 17699: Add test descriptions
Test plan:
  prove -v t/db_dependent/Koha/Patrons.t

 Subtest: renew_account
    1..30
    ok 1 - 2016-02-29T00:00:00 + 12 months must be 2017-02-28T00:00:00
    ok 2 - 2016-02-29T00:00:00 + 12 months must be 2017-02-28T00:00:00
    ok 3 - With BorrowerLogs, Koha::Patron->renew_account should have logged
    ok 4 - today + 12 months must be 2017-03-31T00:00:00
    ok 5 - today + 12 months must be 2017-03-31T00:00:00
    ok 6 - Without BorrowerLogs, Koha::Patron->renew_account should not have logged
    ok 7 - today + 12 months must be 2017-03-31T00:00:00
    ok 8 - today + 12 months must be 2017-03-31T00:00:00
    ok 9 - 2016-04-30T00:00:00 + 12 months must be 2017-04-30T00:00:00
    ok 10 - 2016-04-30T00:00:00 + 12 months must be 2017-04-30T00:00:00
    ok 11 - 2016-10-30T00:00:00 + 12 months must be 2017-10-30T00:00:00
    ok 12 - 2016-10-30T00:00:00 + 12 months must be 2017-10-30T00:00:00
    ok 13 - With BorrowerLogs, Koha::Patron->renew_account should have logged
    ok 14 - today + 12 months must be 2017-11-30T00:00:00
    ok 15 - today + 12 months must be 2017-11-30T00:00:00
    ok 16 - Without BorrowerLogs, Koha::Patron->renew_account should not have logged
    ok 17 - today + 12 months must be 2017-11-30T00:00:00
    ok 18 - today + 12 months must be 2017-11-30T00:00:00
    ok 19 - 2016-12-30T00:00:00 + 12 months must be 2017-12-30T00:00:00
    ok 20 - 2016-12-30T00:00:00 + 12 months must be 2017-12-30T00:00:00
    ok 21 - 2017-06-30T00:00:00 + 12 months must be 2018-06-30T00:00:00
    ok 22 - 2017-06-30T00:00:00 + 12 months must be 2018-06-30T00:00:00
    ok 23 - With BorrowerLogs, Koha::Patron->renew_account should have logged
    ok 24 - today + 12 months must be 2018-07-31T00:00:00
    ok 25 - today + 12 months must be 2018-07-31T00:00:00
    ok 26 - Without BorrowerLogs, Koha::Patron->renew_account should not have logged
    ok 27 - today + 12 months must be 2018-07-31T00:00:00
    ok 28 - today + 12 months must be 2018-07-31T00:00:00
    ok 29 - 2017-08-31T00:00:00 + 12 months must be 2018-08-31T00:00:00
    ok 30 - 2017-08-31T00:00:00 + 12 months must be 2018-08-31T00:00:00

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ec9b691de9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:02:37 +02:00
Jonathan Druart cdfa1b0db7 Bug 17699: Use limit as end_of_month
From DateTime::Duration pod:
""
For positive durations, the "end_of_month" parameter defaults to wrap.
For negative durations, the default is "limit". This should match how
most people "intuitively" expect datetime math to work.
""""

We need end_of_month => limit for  positive durations as well.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 24b4006ecb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:02:30 +02:00
Jonathan Druart 1416b65e09 Bug 17699: Add more tests to highlight the problem
Add problematic cases to highlight the problem.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9512b01566)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 11:02:23 +02:00
Jonathan Druart 0b44544601 Bug 19009: Fix random failures from Circulation.t
From jenkins output:
 Subtest: CanBookBeIssued + Koha::Patron->is_debarred<7c>has_overdues
1..8
not ok 1
[SKIP]

I executed it several times and display the different $error, $alerts and question keys.
GNA and RESTRICTED were sometimes set, which block the issue.
Reading the code it seems that some patron's attributes must be removed to avoid the checkin rejection.

Test plan:
Execute the tests several times and notice that it fails randomly
With this patch they should always pass.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4bbec5c382)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 10:59:55 +02:00
Jonathan Druart 300a76a573 Bug 18802: Fix Circulation.t if finesMode ne 'production'
If finesMode is not set to production, only 1 fine will be created (the renewal
one will not). This is what assumes the tests.
If set to 'production', the tests will fail because the fines will not
be deleted (because of the DBIx::Class) warning.
Now we mock the value before charging.

prove t/db_dependent/Circulation.t
t/db_dependent/Circulation.t .. 16/95 DBIx::Class::Storage::DBI::select_single(): Query returned more than one row.  SQL that returns multiple rows is DEPRECATED for ->find and ->single at t/db_dependent/Circulation.t line 491
t/db_dependent/Circulation.t .. 56/95
    #   Failed test 'Can auto renew, OPACFineNoRenewals=10, patron has 10'
    #   at t/db_dependent/Circulation.t line 670.
    #          got: 'auto_too_much_oweing'
    #     expected: 'auto_renew'
    # Looks like you failed 1 test of 6.

Test plan:
  prove t/db_dependent/Circulation.t
should return green whatever the value of finesMode

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ae5f5c4799)
2017-09-29 10:53:24 +02:00
Tomas Cohen Arazi 1f19154532 Bug 19013: (QA followup) Set guarantorid to NULL patron sample data
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0bcf6a7942)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 10:44:20 +02:00
Jonathan Druart b59ce0c617 Bug 19013: Fix borrowers.guarantorid in sammple_patrons.sql
That breaks randomly tests on Jenkins (Koha/Patrons.t)

It certainly affects data in other languages but I did not find a quick
and easy way to modify this file (replace all guarantorid values with
NULL)

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Easy fix

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b7d291a1ee)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-29 10:44:13 +02:00
Fridolin Somers d426333605 Increment version for 17.05.04 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-20 16:05:19 +02:00
Fridolin Somers 7ed629c2e2 Merge remote-tracking branch 'translate/17.05.04-translate-20170920' into rm_170504 2017-09-20 16:04:42 +02:00
root 521d1e52ef Translation updates for Koha 17.05.04 2017-09-20 11:00:06 -03:00
Koha User 8c70da2097 Update release notes for 17.05.04 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-20 15:56:06 +02:00
Mark Tompsett b7856f76af Bug 19235: Password entry visible in OPAC Self-registration
The HTML code was "text" instead of "password".

TEST PLAN
----------
1) 'Allow' PatronSelfRegistration system preference
2) Define the PatronSelfRegistrationDefaultCategory system preference (e.g. PT)
3) Open OPAC
4) Click 'Register here' on the right.  (/cgi-bin/koha/opac-memberentry.pl)
5) Scroll to bottom
6) enter some passwords
   -- visible
7) apply this patch
8) refresh page
9) repeat 5-6 as needed
   -- passwords should not be visible while entering
10) run koha qa test tools

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 99e691feee)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 17:04:37 +02:00
Marcel de Rooy f99f0b7a4a Bug 15438: [QA Follow-up] Moving POD statement for CanBookBeIssued
The statement for head3 NB ('nota bene'?) looks like a hash key
in the list of possible return values for $needsconfirmation.
Moved it up and prefixed it with IMPORTANT.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 133e25c56a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 16:55:56 +02:00
Colin Campbell fcd8e322f5 Bug 15438 - Checking out an on-hold item sends holder's borrowernumber in AF (screen message) field.
The returns from C4::Circulation::CanBookBeIssued used
to be structured as a hashref of entries like
   REASON => {
       data => 'foo',
       moredata => 'bar',
   };
Some entries still are. But many are now
   REASON => 1,
   data   => 'foo',
   moredata => 'bar',

The sip Checkout routine still assumed the former, as it
reports any causes it was not aware of (to maintain support for
a changing api) The data fields could leak into the screen message
field of the response. e.g. the borrowernumber or surname of the
borrower who has a hold on an issued title. Some real messages were
getting obscured by this

This patch sanatizes the return from from CanBookBeIssued
by removing keys which are not all uppercase
It also fixes a case where the key's data element was used
for the screen message when we should use the key itself

Updated the documentation of CanBookBeIssued to flag up
the assumption re case and the fact that 3 elements rather
than two may be returned

The loop through the returned keys was a bit bogus
so we now explicitly jump out if noerror is unset

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested quite extensively. Test results put on Bugzilla.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4d223bdc61)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 16:55:48 +02:00
Dobrica Pavlinusic d9b21e9790 Bug 19332 - Basket grouping PDF and CSV exports empty
This bug was introduced in commit 2bf3ce268d
Bug 17196: [QA Follow-up] Additional fix on acqui/basketgroup

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 16:28:28 +02:00
Jonathan Druart d6579c7019 Bug 19127: (follow-up) Stored XSS in csv-profiles.pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 52b41dfdf0ec03c24dd970b80e4f153f64702e30)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:59:14 +02:00
Amit Gupta 9b4777878f Bug 19127 - Stored XSS in csv-profiles.pl
To Test
1. Hit the page /cgi-bin/koha/tools/csv-profiles.pl?op=add_form
2. Add a text in the field Profile name, Profile description
   and Profile MARC fields that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7a3ee2dd8cb233d083d8a7b8636eca7c6d518b8b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:59:07 +02:00
Jonathan Druart d5c7edc55d Bug 19108: (follow-up) Stored XSS in biblio_framework.pl
Prevent software error
Template process failed: undef error - text: filter not found at
/home/vagrant/kohaclone/C4/Templates.pm line 121.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit f904b019f77cd19ca0373f9635811a634ac73321)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:58:17 +02:00
Katrin Fischer 845ee92824 Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt
To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 1649be1e9f510543f85b9e3a22af88ae8c6bfb9c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:58:11 +02:00
Amit Gupta 83fdc8aea5 Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl
To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 29ab5517f5c8cfbc86b98c3197846d005007cc12)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:58:05 +02:00
Amit Gupta eccce3e1ba Bug 19108 - Stored XSS in fieldmapping.pl
To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 77ddae74d661fb589d74bd85f5561fdd4131af70)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:58 +02:00
Amit Gupta 520388dc1d Bug 19108 - Stored XSS in authtypes.pl
To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit bc780f588bc908f8b1d0da8987b20914996d942c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:51 +02:00
Amit Gupta 64abaa063d Bug 19108 - Stored XSS in classsources.pl
Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 940c8634914b50940cfaf73af3611e6282d5803f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:45 +02:00
Amit Gupta 332d705e72 Bug 19108 - Stored XSS in items_search_fields.pl
To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 063fd5e1b9e086c57987fae408b4ce6e51fec2b9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:37 +02:00
Amit Gupta 20b4c81c1a Bug 19108 - Stored XSS in oai_sets.pl
To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 10d3a8c212f8a45e40cd2644f94d555566a10018)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:57:29 +02:00
Amit Gupta fb90eee74c Bug 19103 - Stored XSS in matching-rules.pl
To Test
1. Hit the page /cgi-bin/koha/admin/matching-rules.pl
2. Click on new record matching rule
3. Add a text in the field Description that contain js.
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9222cd77d282affffba43a40a9ff2f768647501e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:54:04 +02:00
Amit Gupta 6fc53fb6df Bug 19103 - Stored XSS in patron-attr-types.pl
To Test
1. Hit the page /cgi-bin/koha/admin/patron-attr-types.pl
2. Click on new patron attribute type
2. Add a text in the field Description that contain js.
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit cb0c3da4b6cec991194ce91e6412cf9d50562044)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:56 +02:00
Jonathan Druart e3e035c3ef Bug 19103: (follow-up) Stored XSS in itemtypes.pl
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c221bc40a330a25d59097e94e962a4afcea011af)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:48 +02:00
Amit Gupta 4653a5209a Bug 19103 - Stored XSS in itemtypes.pl
To Test
1. Hit the page /cgi-bin/koha/admin/itemtypes.pl
2. Add a text in the field Description, Checkin message that contains js
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 18b5d4f1ababf560ff02a258de389f8c34cff9e4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:53:40 +02:00
Jonathan Druart c7a6dbca09 Bug 19128: XSS - admin/authorised_values.tt
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ad230cdcb5ad69541a89a4edaedcadde9d25b88a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:12:33 +02:00
Katrin Fischer 8b85e83554 Bug 19128 - XSS - patron-attr-types.tt, authorised_values.tt and categories.tt
Preparation:
- Add a branch with script in the branch name
- Add a patron category with script in the category name
- Add a new authorised value cateogory with script
- Add a new authroised value for this category with script
  in all possible fields

- Test editing patron categories
- Test editing patron attribute types
- Test viewing and editing authorised values

Verify that with this script there is no more script executed
and everything works fine.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6b7ad77fffd7a6c4b69bce5bf666c6ff4be76c5b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:12:25 +02:00
Katrin Fischer 2b0bd9add5 Bug 19125 - XSS - members.pl
In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 849eaf73fc419b9a635a1ba4b69ef46a7544e55a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 15:11:08 +02:00
Katrin Fischer b03752fa78 Bug 19086 - Follow-up - subscription-detail.pl
Add script to the callnumber field on adding a subscription.

Verify script is executed without this patch, but not with it.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 3ebcd2475dd35db47c33bcc59d5e75968667b518)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:44 +02:00
Katrin Fischer 13147e7c05 Bug 19086 - Follow-up - XSS in supplier.tt
In preparation:
Make sure you enter <script>alert("sth")</script>
in all fields of a new vendor that are not validated
and save.

1) Access vendor summary page.
2) Verify scripts are executed
3) Apply patch
4) Verify scripts are on longer executed

This works in combination with the other patches for XSS
on this bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 14a1aba57cc091a70c527a0d6bd495d21bd87345)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:37 +02:00
Amit Gupta c4a1eafb5b Bug 19086 Stored XSS in subscription-add.pl
To Test
1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
2. Add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ebf781afc133508eddcb8dc8fb6d7429a72db99b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:31 +02:00
Amit Gupta 46f91605a4 Bug 19086 Stored XSS in supplier.pl
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9d0bbf5fa7455e0eb64288652802b0836cf22690)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:23 +02:00
Chris Cormack 0a53a9e7f3 Bug 19086 Stored XSS in circulation.pl
1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 80c93d3499b11f3574fbafe756f94c534b746d5a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:12 +02:00
Chris Cormack 44814081a7 Bug 19086 XSS in members/member.pl
To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5ae18484b5a47e8a00ce8f1a0fd8b3db471947eb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-19 14:59:01 +02:00
Fridolin Somers ea316ad4ae Bug 18654 - Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt
Followup correcting a typo of previous patch :
  name="holdingbranch" options = branche
it is branche[s]

Test plan :
- Look at 'Current location' in item search
=> Without patch you see only 'All libraries'
=> With patch you see 'All libraries' and each existing library, like in 'Home library'

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 889fabe9f2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-14 15:31:09 +02:00
Marc Véron dcafcbc036 Bug 18654 - Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt
This patch removes entries like the following in translations of itemsearch.tt:
"[%% INCLUDE form_field_select name=\"homebranch\" options = branches "
"empty_option = \"All libraries\" %%] [%% INCLUDE form_field_select name="
"\"holdingbranch\" options = branches empty_option = \"All libraries\" %%] %s "
"[%% INCLUDE form_field_select name=\"location\" options = locations "
"empty_option = \"All locations\" %%] %s "

New patch on top of Bug 18633 that resolves parts of initial comment.

To test:
- Verify that in itemsearch.tt no tt directives are splitted by new lines
  (search for [% INCLUDE )
- Verify that itemsearch.tt works as before

Followed test plan and verified that tt directives are not split by new
lines, the changes to the fieldset tags in comment 3 have been removed
and itemtype.tt still works correctly as before

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 25fa02272d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-14 15:30:56 +02:00
Fridolin Somers 4c76583e6d Bug 19023 - inventory tool performance
Inventory tool performance seems to be worst since 16.11.
I think it is because of authorized values computing changed by Bug 17249.

For each subfield of each item, we try to get the authorized value description with Koha::AuthorisedValues->search_by_marc_field.
But this method does not use cache like Koha::AuthorisedValues->get_description_by_koha_field.

I propose to use Koha::AuthorisedValues->get_description_by_koha_field and also to look for authorized value description only for item fields used in TT : location, notforloan, itemlost, damaged, withdrawn.

I have experimented inventory time on 100 items from 5s to 1s.

Test plan :
- Without patch
- Perform inventory with barcode file
- Check results and mesure execution time
- Apply patch
- Reperform inventory with same barcode file
- Check results is the same
- Compare execution time
- Run prove t/db_dependent/Items/GetItemsForInventory.t

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 95f1844e6c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 17:09:51 +02:00
Jonathan Druart 960015819e Bug 19214: prevent crash if club_template_field is called in list context
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6a9fafe309)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:56:21 +02:00
Aleisha Amohia 68bbe3fb0d Bug 19214: Prevent crash if ->club or ->patron is called in list context
To test:
1) Create a club template and a club.
2) Add a user to the club
3) Log in to the OPAC as that user
4) Go to 'your summary' and click the Clubs tab
5) Notice clubs do not load and a warn shows:
Template process failed: undef error - Cannot use "->find" in list
context at /home/vagrant/kohaclone/Koha/Club/Enrollment.pm line 62.
6) Go to the staff side and go to the member page of that user
7) Go to 'details' and click the Clubs tab
8) Notice clubs do not load and a warn shows:
Template process failed: undef error - Cannot use "->find" in list
context at /home/vagrant/kohaclone/Koha/Club/Enrollment.pm line 71.
9) Apply patch
1) Repeat steps 4-7, confirming the errors do not show and clubs info
loads correctly

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 594c48fb5b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:55:32 +02:00
Jonathan Druart 1a50b447d3 Bug 18927: Use fully qualified subroutine names in C4::Items
rebuild_zebra.pl fails in some conditions (perl version?)
I do not recreate but it has been reported that reindex fails with:
  error retrieving biblio 94540 at /usr/share/koha/bin/migration_tools/rebuild_zebra.pl line 683, <DATA> line 751.

To fix it we can use fully qualified subroutine names for:
  GetMarcFromKohaField
  GetMarcBiblio
  GetBiblionumberFromItemnumber
  TransformKohaToMarc
  GetFrameworkCode

Test plan:
Confirm the rebuild_zebra script still works correctly after this patch

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2671eb2f93)
2017-09-12 16:47:07 +02:00
Alex Sassmannshausen 111ab4e632 Bug 19073: (bug 15758 follow-up) Dereference correct value from Koha::Object.
* tools/modborrowers.pl: Dereference 'branchcode' rather than
  'value'.

Test Plan:
- Carry out "Batch patron modification" with any number of patrons.
  + Change the library.
  + Hit Save.
- The library will not have been updated.
- Apply patch.
- Run same modification.
- The library will have been updated

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8a328a20bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:40:51 +02:00
Kyle M Hall dcda5a4dc5 Bug 19208 - Pay select option doesn't pay the selected fine
The "Pay selected" option on the Fines tab in the borrower account page doesn't work as intended.
The fine on top of the list gets the amount deducted, even if another fine is choosen from the list.

Test Plan:
1) Create two or three fines, using the Create manual invoice function.
2) Choose one of the fines (not the one on the top) and click Pay selected
3) Pay a partial amount
4) Go back to the Pay fines tab an notice that the fine you selected has not changed. Instead, either the top fine or the total (see attachment) has ben affected.
5) Apply this patch
6) Repeat steps 1-3
7) Note the correct fine is paid

Signed-off-by: Andreas Hedström Mace <andreas.hedstrom.mace@sub.su.se>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 831d75d09c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:37:42 +02:00
Aleisha Amohia 6431bf5d9a Bug 19194: Check itemtype is defined when receiving an order
To test:
1) Find a record with an item that has no itemtype (or remove the
itemtype of an item)
2) Go to Acquisitions -> Find a vendor or make a new one -> create a new
basket
3) Add the record from Step 1 to your basket
4) Close the basket
5) Go back to the vendor and click 'Receive shipments'
6) Put in an invoice number, click Next
7) Click the Receive link for your item
8) Confirm you see an internal server error
9) Apply the patch and refresh the page
10) The error should be gone and behaviour should continue as expected

Sponsored-by: Catalyst IT

Signed-off-by: Lee Jamison <ldjamison@marywood.edu>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 51a65731c0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2017-09-12 16:36:10 +02:00