Commit Graph

56234 Commits

Author SHA1 Message Date
Pedro Amorim 9e6ce8b2e7
Bug 38782: Apply same fix for CounterFile.t
prove t/db_dependent/Koha/ERM/EUsage/CounterFile.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Edit: tidy (tcohen)
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a297c42394)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:35 +01:00
Pedro Amorim a984732e8e
Bug 38782: Remove concat in background process
The ud_provider->{report_type} is only defined on ->harvest_sushi, meaning it'll never be defined here.
We don't need this anyway. The filename should be the filename of the file being manually uploaded. We only need this concat logic for COUNTER files being generated by Koha following a SUSHI harvest, and that works.
This also gets rid of a warning when running the tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0231911c98)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:34 +01:00
Pedro Amorim feb0c7d0cf
Bug 38782: Mock userenv->{number}
prove t/db_dependent/Koha/BackgroundJobs/ErmSushiHarvester.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Edit: tidy (tcohen)
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c3e8b9b851)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:34 +01:00
Pedro Amorim d63389ea43
Bug 36039: (QA follow-up): Improve audit messages
Improve messages clarity.
Show success message if no schema diff was found from audit.
Code refactor to ensure the title+message shown in UI is the same as the one shown in CLI and are all translatable.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7834d25fb4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:33 +01:00
Pedro Amorim a231a87980
Bug 36039: (QA follow-up): Address i18n for print messages
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 42c1e109af)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:32 +01:00
Martin Renvoize 3cf64a6f98
Bug 36039: (follow-up) Move view logic to script/template
This patch updates the module as suggested by David to handle just the
diff code and leaves the display logic up to the templates and script.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 534fba2691)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:31 +01:00
Pedro Amorim 0ac5a0175f
Bug 36039: New 'datatabase audit' tab in about page
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6940167048)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:31 +01:00
Pedro Amorim 47eee4806b
Bug 36039: Move audit_database script logic to a dedicated module
Test plan #1 ensure same script functionality (same as bug 34064):
0. Apply patch
1. vi ./installer/data/mysql/kohastructure.sql
2. Comment out some columns, change NULL status, or whatever you like
3. perl misc/maintenance/audit_database.pl \
    --filename /kohadevbox/koha/installer/data/mysql/kohastructure.sql
4. Note that the output includes SQL commands to change the database
to match the new kohastructure.sql

5a. Try using koha-foreach and note that the database name appears above
the database comparison
5b. koha-foreach "perl misc/maintenance/audit_database.pl \
    --filename /kohadevbox/koha/installer/data/mysql/kohastructure.sql"

Test plan #2:
1. After doing test plan #1, access the new 'database audit' tab, visit:
<staff_url>/cgi-bin/koha/about.pl?tab=database
2. Ensure the output is the same as test plan #1

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 09bb85409d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:30 +01:00
Lucas Gass f0a7d8e843
Bug 37398: Fix test in basic_workflow.t
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2350a2ada8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:29 +01:00
Lucas Gass dde1caa25c
Bug 37398: Add CSS for the important class
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 9b7dcb46ea)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:28 +01:00
Jonathan Druart c55433be78
Bug 37398: Adjust tests
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3fe252f6a8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:28 +01:00
Jonathan Druart a99c7df46c
Bug 37398: Do not rely on the columns names but data type instead
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d2a6915010)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:27 +01:00
Lucas Gass 7515709b47
Bug 37398: Adjust CSS for flatpickr
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 125d8ec1cf)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:26 +01:00
Lucas Gass c769f4fc61
Bug 37398: Add set to today function to calendar.inc
To test:
1. Try editing some items with a empty value in the flatpickr.
2. Make sure the empty date fields get a date set to today when you click on the empty field.
3. Try a datetime field, making sure the datetime is correctly set.

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0d5bd311d4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:26 +01:00
Lucas Gass 7dfc7e9e6e
Bug 37398: Add a unit test
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2f317a767)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:25 +01:00
Lucas Gass 35dc15c27c
Bug 37398: Make sure subfield and subfield_date are defined
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d32218fb68)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:24 +01:00
Lucas Gass ef2cff9e76
Bug 37398: Adjust CSS for wrapped flatpickr
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f049a13ef8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:24 +01:00
Lucas Gass 83aeae0f4d
Bug 37398: Make date and date time fields have date picker by default
To test:
1. APPLY PATCH, restart_all
2. Pick a framework, I choose BKS in k-t-d
3. Make sure that a few date and datetime fields are exposed in the editor.
4. On additem.tt a date picker should be instantiated on the date or datetime fields.
5. Make sure the date pickers work on each field.
6. If it is a datetime field you should have the option to add hours and minutes. ( datelastseen )
7. Edit the framework and remove the dateaccessioned.pl plugin from any of these date fields.
8. Even without the dateaccessioned.pl plugin a date picker should be present on the field.
9. Add the dateaccessioned.pl plugin to a non date/datetime field.
10. Make sure the dateaccessioned.pl plugin works properly on the non date/datetime field.
11. Mark one of the date/datetime fields as mandatory, make sure it still acts as mandatory.
12. Hide date/datetime from the editor, make sure it hides properly.

+----------------------+-------------+
| COLUMN_NAME          | COLUMN_TYPE |
+----------------------+-------------+
| dateaccessioned      | date        |
| replacementpricedate | date        |
| datelastborrowed     | date        |
| datelastseen         | datetime    |
| onloan               | date        |
+----------------------+-------------+

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit aa4ee79f6e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:23 +01:00
Pedro Amorim 397ca582ed
Bug 36627: (QA follow-up): Rename borrowernumber -> patron_id
To test:
$ prove t/db_dependent/api/v1/erm_counter_logs.t

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 15803e4f29)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:22 +01:00
Katrin Fischer 9552571770
Bug 36627: Fix typo "embeded"
A search turned up more of these in other files. Fixed as well.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3b86455e02)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:21 +01:00
Jonathan Druart 55fd58fd96
Bug 36627: (follow-up) Use patron_to_html in 'Imported by' column
We don't need those 2 lines

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5d6af90d76)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:21 +01:00
Pedro Amorim 091dcca219
Bug 36627: (QA follow-up): Add missing tests
1) Apply patch
2) $ yarn api:bundle
3) $ prove t/db_dependent/Koha/ERM/EUsage/CounterLog.t
4) $ prove t/db_dependent/api/v1/erm_counter_logs.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8a314ea750)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:20 +01:00
Pedro Amorim 87a6bad652
Bug 36627: Add tests
k-t-d, from /kohadevbox/koha, run:
yarn run cypress run --spec "./t/cypress/integration/ERM/DataProviders_spec.ts"

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7faa42505f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:19 +01:00
Pedro Amorim 1acb7108b5
Bug 36627: Use patron_to_html in 'Imported by' column
For consistency, and to avoid 'null koha' for a file imported by
the koha user (no first name).

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f70a5ffc67)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:18 +01:00
Matt Blenkinsop 6a0b086db0
Bug 36627: Rename embed method to patron
This patch renames the embed method from borrowernumber to patron to fit with the use of 'patron' in the API

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7b75586ead)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:17 +01:00
Matt Blenkinsop e6aecb4275
Bug 36627: Embed patron record for display
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit da475321a5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:16 +01:00
Matt Blenkinsop d692b92feb
Bug 36627: Record who is importing sushi data
This patch adds functionality for storing the patron (or cronjob) that triggers a harvest. Currently every counter log is stored as being imported by the cronjob

Test plan:
1) In the usage statistics module in ERM, create a data provider (the details in the provider are not important)
2) Click into the provider and click into manual upload
3) Upload the file attached to this bug
4) Once the background job is completed click into the counter logs tab in the provider. The imported by columns should show a user with a clickable link

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 062e04c9c3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:16 +01:00
Janusz Kaczmarek 0e84acf5f4
Bug 38483: C4::Heading::preferred_authorities is not used
C4::Heading::preferred_authorities seems to be not used for ages (maybe
never used?)

Test plan:
$ git grep preferred_authorities
-->   should return nothing

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c70b09dfc)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:15 +01:00
Katrin Fischer d1403a9992
Bug 38662: Fix terminology "Members" and remove unneeded sub-heading
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f42df40680)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:14 +01:00
Pedro Amorim b90ae7a461
Bug 38662: Remove redundant 'ERM' labels
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2b0286889d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:14 +01:00
Pedro Amorim d01a56efca
Bug 38662: Sort tables alphabetically
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4012f805b6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:13 +01:00
Pedro Amorim 399445dfa6
Bug 38662: Group tables by module name
Test plan:
1) Before applying patches, visit the additional fields admin page:
   <staff_url>/cgi-bin/koha/admin/additional-fields.pl
2) Notice the tables are not grouped by module, and not alphabetically sorted
3) Apply patches. Refresh

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6a0c475bc5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:12 +01:00
Pedro Amorim 7b37841272
Bug 36662: Move test files to the correct folder structure
Trivial leftover house-keeping from bug 35581.

Test plan:
$ prove t/db_dependent/Koha/ILL/*

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b26b7d740f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-19 23:57:03 +01:00
Paul Derscheid 7707a62f91
Update release notes for 24.11.02 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:49:30 +01:00
Paul Derscheid dcd9f344b8
Increment version for 24.11.02 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:34:43 +01:00
Paul Derscheid 8ab34091c8
Merge remote-tracking branch 'upstream/24.11.x' into 24.11.x-security
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:24:37 +01:00
Marcel de Rooy 722c25cde0
Bug 36081: (QA follow-up) Resolve IsNotDebit exception in ArticleRequests.t
Resolve (when running ArticleRequests.t):
Exception 'Koha::Exceptions::Account::IsNotDebit' thrown 'Account line 326 is not a debit'

This occurs after switching from ArticleRequest->new to TestBuilder.
TestBuilder creates an account line that has a credit_type_code and
a debit_type_code. (This could be fixed further somewhere else.)
For now, just setting debit_id to NULL.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:23 +01:00
Jonathan Druart 8c5ef89980
Bug 36081: Fix some failing tests
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:23 +01:00
Jonathan Druart d9c0df63da
Bug 36081: Mock format
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:22 +01:00
Jonathan Druart e20810db55
Bug 36081: Force TestBuilder to generate a valid format value
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:21 +01:00
Jonathan Druart 59a2a2c80e
Bug 36081: Use multivalue_preference
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!

Let support both here.

This patch also removes silly JS code in the template.

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:20 +01:00
Marcel de Rooy ee6abf031f
Bug 36081: Check SupportedFormats server side
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:16 +01:00
David Cook 3e0c804801
Bug 39170: Improve validation of report ID
This change improves the validation of the report ID passed by the user.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 19:30:48 +01:00
Owen Leonard 255c516764
Bug 37266: [24.11.x] patron_lists/delete.pl should have CSRF protection
This patch adds CSRF protection to patron list deletions.

Also changed: The "Delete selected lists" button is now in a floating
toolbar.

To test, apply the patch and go to Tools -> Patron lists.

- If necessary, create a few patron lists.
- Test the two methods for list deletion available on the page:
  - Check one or more checkboxes and then click the "Delete selected
    lists" at the top of the page.
  - Click the "Actions" button for an individual list and choose "Delete
    list."
- Open the checkout page for a patron.
  - Under the "Patron lists" tab, add the patron to a list.
  - Click the "Actions" button for an that list and choose "Delete
    list."
  - When you are taken to the patron lists page the list should have
    been deleted.
- Perform the same test on the patron details page.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 19:30:42 +01:00
David Cook d8ed07594f
Bug 38469: Replace single quotes with double quotes to prevent XSS
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)

3. To test the XSS is patched, try the proof-of-concept from the
bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:21 +01:00
David Cook 6d2b0c4a28
Bug 38488: Add Template::Toolkit filter for C4::Scrubber
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Phil Ringnalda 70781686fd
Bug 38961: XSS in vendor search
acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi 937a412362
Bug 28478: Make opac-*detail.pl scripts use Koha::Biblio->opac_suppressed()
This patch makes the following scripts use the new method for checking
suppression:

* opac/opac-ISBDdetail.pl
* opac/opac-MARCdetail.pl
* opac/opac-detail.pl

In the `opac-detail.pl` case, it is a simple change by removing MARC
data traversal in favor of the new method. The code checking
suppression gets moved up so we don't process or make any other
calculations if the record is suppressed.

The other two scripts where completely missing the check and thus
leaking suppressed records.

To test:
1. Pick two records, one marked as suppressed, and the other not
   suppressed.
2. Try acessing them in the OPAC detail page.
=> SUCCESS: Suppressed records are suppressed, and not suppressed ones
are not.
3. Try the same records on the ISBD and MARC view
=> FAIL: They are not suppressed!
4. Apply this patch
5. Repeat 2
=> SUCCESS: Suppression is still respected
6. Repeat 3
=> SUCCESS: Suppression is respected on the ISBD and MARC views
7. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. Remember to activate OPAC suppression with
OpacSuppression.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi 2e0bcc4191
Bug 28478: Add Koha::Biblio->opac_suppressed()
This patch adds a convenient method at the Koha::Biblio level, as a
wrapper for the extrator added on this bug. Following the established
pattern we adopted a while back.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio.t
=> SUCCESS: Tests pass! All use cases covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi b503cfe2be
Bug 28478: Add get_opac_suppression extractor
This patch adds an extractor method for the historically hardcoded field
942$n. This way we have a single place in which we code the extraction
and sanitization of its value.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio/Metadata/Extractor/MARC.t
=> SUCCESS: Tests pass! All use cases are covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00