Commit Graph

5351 Commits

Author SHA1 Message Date
Matt Blenkinsop 0a906ca5b8 Bug 37076: Fix incorrect needsconfirmation code
This patch corrects two instances of RESERVED_WAITING to RESERVE_WAITING

Test plan:
1) Navigate to system preferences and search for AllowItemsOnHoldCheckoutSCO
2) Observe from the description that the correct status code is RESERVE_WAITING
3) Search the repository for RESERVED_WAITING - you should find two instances, one in Checkouts.pm and one in checkout.js
4) Apply patch
5) Repeat step 3 - there should be 0 instances

Signed-off-by: Lucas <lchirlias@ville-roubaix.fr>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2b7e770429)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 17:41:19 +00:00
Tomas Cohen Arazi 37c5a96f56 Bug 37672: Make V1/RecordSources.pm use more helpers
This patch adapts the controller class to match the current guidelines
by makiing use of the provided helpers.

The tests are adapted.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e6ef792e10)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:25:15 +00:00
Matt Blenkinsop 613e8137e6 Bug 37687: Restore -not_in operator
Test plan:
1) Compare the API documentation on query parameters and note that'-not_in' is listed as a valid operator.
2) Look at the patch diff - you will see that previously '-not_in' was not included in the list and now is

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c3c36f2bb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:23:21 +00:00
Pedro Amorim 36d2eb2fa7 Bug 31143: Work around subtracting datetime if date_of_birth undef
To test:
1) Run the following SQL:
update borrowers set dateofbirth = '0000-00-00' where borrowernumber = 45;
2) Access the borrower edit page through staff UI:
http://localhost:8081/cgi-bin/koha/members/memberentry.pl?op=edit_form&destination=circ&borrowernumber=45
3) Notice you get an error
4) Run the script:
perl misc/maintenance/search_for_data_inconsistencies.pl
5) Notice you get an error
6) Apply patch restart plack and repeat -> no errors

This is not perfect but its all I have time for, for now. Follow-ups are welcomed as always.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Shi Yao Wang <shi-yao.wang@inlibro.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e048144d80)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-15 16:00:29 +00:00
Nick Clemens 812ebf0e1d Bug 37892: Fix guarantor restriction, add tests
[SQUASHED IN QA]

These patches will alter the checks for a patron that prevent a category with
'can_be_guarantee' from being a guarantor.  Two patrons in the same category should be
allowed to have a guarantee/guarantor relationship

The tests below assume you are using the KTD sample data. Update borrowernumbers if not.

To test:
 0 - Apply tests patch
 1 - Set the 'Patron' category as 'Can be a guarantee'
 2 - Add a relationship between two patrons of the same category
     This is restricted from the staff interface
     perl -e 'use Koha::Patrons; my $p = Koha::Patrons->find(5)->add_guarantor({ guarantor_id => 23, relationship => 'father'});'
 3 - Note there is no warning or exception. This should be allowed.
 4 - Checkout an item to Edna (borrowernumber 5)
 5 - Set 'TrackLastPatronActivityTriggers' to 'Checking in an item'
 6 - Try to check the item in, KABOOM
 7 - Set 'TrackLastPatronActivityTriggers' to 'Checking out an item'
 8 - Try to issue an item to Enda, KABOOM
 9 - prove -v t/db_dependent/Koha/Patron.t, fail
10 - Apply second patch
11 - prove -v t/db_dependent/Koha/Patron.t, one more test passes, but then fail
12 - Apply third patch
13 - prove -v t/db_dependent/Koha/Patron.t, pass!
14 - restart_all
15 - Checkout to Enda, OK!
16 - Checkin from Edna, OK!
17 - Find two more patrons in the category and attempt to link them
18 - 'Guarantor cannot be a guarantee'
19 - Apply fourth patch
20 - You can add a guarantor from the same category in interface
21 - Try to add a guarantor to the guarantor assigned in 20
22 - Confirm you cannot add a guarantor - "Guarantor cannot be a guarantee"

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Bug 37892: Fix patron updates

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Bug 37892: Fix patron creation

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Bug 37892: Fix memberentry.pl

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Bug 37892: (follow-up) Fix patron creation

This patch fixes the 22. of the test plan (22 - Confirm you cannot add a guarantor - "Guarantor cannot be a guarantee"
        )

Signed-off-by: Olivier V <olivier.vezina@inLibro.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Bug 37892: (follow-up) Fix patron creation

TEST PLAN:
1 - Do the 22 parts of the test plan
2 - Add a guarantor to one patron not selected before (let's say A is
  the guarantee, B the guarantor)
3 - Try and add a guarantor to B -> you will success
4 - Remove B's guarantor
5 - Apply this patch
6 - Repeat 3 -> you will not be able to

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Bug 37892: (follow-up) Tidyness

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT]
Renamed a subtest to patron creation tests in Patron.t.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 391e150e07)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-14 14:51:03 +00:00
Magnus Enger e2a31a2e18 Bug 33339: (Follow up) Fix more cases of formula=empty
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()

Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-07 23:02:54 +00:00
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-07 23:02:54 +00:00
Tomas Cohen Arazi 3ffb91aa07 Bug 38094: (follow-up) edit_catalogue implies fast_cataloguing
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 51055d892b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:46:35 +00:00
Kyle M Hall 0273b348f9 Bug 38094: Allow librarians with fast add permissions to edit existing fast add records
The ability to create fast add records was fixed on bug 38076, but they still cannot be edited after they are saved.

Test Plan:
1) Create a librarian with only fast add cataloging permissions
2) Create a fast add record, save it
3) Attempt to edit that record, you cannot!
4) Apply this patch
5) Restart all the things!
6) Attempt to edit that record, you can!
7) Attempt to edit a non-FA record, you cannot!

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 664cbb5bc5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:46:35 +00:00
Nick Clemens 1a71b12702 Bug 38148: (QA follow-up) Code comments
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 38e33074b6)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:31:24 +00:00
Pedro Amorim 36cace8f70 Bug 38148: Revert back to get_effective_rule
And update the first conditional logic.
This patch aims to maintain the logic behind the first patch, but restore get_effective_rule.
get_effective_rule_value is using cache and I believe that is the reason why Items.t fail when using that.

Test plan:
1) Search for 'music' on OPAC
2) Notice records have the 'place hold' link
3) Visit circulation rules on Staff:
<staff_url>/cgi-bin/koha/admin/smart-rules.pl
4) On 'Default checkout, hold and return policy' , under 'Hold policy' pick 'From any library'. Hit 'Save'.
5) Repeat 1). Notice the 'place hold' link is gone.
6) Apply patch. restart plack. Repeat 1). Notice the 'place hold' is shown again

Run:
$ prove t/db_dependent/Koha/Items.t

Signed-off-by: andrewa <andrew.auld@ptfs-europe.com>
Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c7c24aa8d3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:31:23 +00:00
Aleisha Amohia 3748fe30df Bug 38148: Check value of holdallowed circ rule properly
It was noted on Bug 29087 that the value of circulation rules needs to be checked differently, so this follow-up addresses that.

To test:

1. Apply patch and restart services
2. Search for a record on the OPAC. Confirm you can see a link to place a hold.
3. Search for this record on the staff interface and place a hold. Go to Circulation -> Holds to pull and confirm your hold shows in the list.
4. Confirm tests still pass t/db_dependent/Koha/Holds.t

Sponsored-by: Whanganui District Council
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: andrewa <andrew.auld@ptfs-europe.com>
Signed-off-by: Ray Delahunty <r.delahunty@arts.ac.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e2be4e00a5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-10-23 22:31:23 +00:00
Victor Grousset/tuxayo 13b0aa1262 Bug 36598: (QA follow-up): tidy up code
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:48 +00:00
Julian Maurice 460a48cf69 Bug 36598: Add comments asking to keep both CSRF checks in sync
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:48 +00:00
Julian Maurice 0c6ef38fb3 Bug 36598: Prevent use of unsafe HTTP method with non-cud op parameter
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:47 +00:00
Julian Maurice ec02f36f10 Bug 36598: Improve documentation and error message in CSRF plugin
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:47 +00:00
Julian Maurice d4a455425c Bug 36598: Fix CSRF header name (underscore -> hyphen)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:47 +00:00
Julian Maurice ed2873bf45 Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:47 +00:00
Julian Maurice 84054b932c Bug 36598: Enable CSRF protection for Mojolicious apps
Test plan:
1. Run bin/opac daemon -l http://*:3001/
2. Go to http://localhost:3001/cgi-bin/koha/opac-user.pl
3. With browser devtools, locate csrf_token hidden input within the
   login form and remove it or modify it
4. Try to submit the form with correct credentials, it should fail
   ("Wrong CSRF token")
5. Reload the page, try to log in normally without modifying the DOM, it
   should succeed
6. Run bin/intranet daemon -l http://*:3002/
7. Go to http://localhost:3002/cgi-bin/koha/mainpage.pl
8. With browser devtools, locate csrf_token hidden input within the
   login form and remove it or modify it
9. Try to submit the form with correct credentials, it should fail
   ("Wrong CSRF token")
10. Reload the page, try to log in normally without modifying the DOM,
    it should succeed
11. Run prove t/db_dependent/mojo/csrf.t

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-30 15:28:47 +00:00
Matt Blenkinsop b55df97aa8 Bug 37647: Remove Text::CSV_XS import
There is an unnecessary import that has been left over from when KBART file processing logic was being handled directly in the API controller. This patch removes that import as it is no longer needed

Test plan:
1) Look at the patch diff and confirm that the import for Text::CSV_XS has been removed

Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3c94b26c66)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-12 22:04:57 +00:00
Janusz Kaczmarek 15dc40af39 Bug 32696: Recalls can inadvertently extend the due date
If an item is due sooner than the recall due date interval then placing
a recall on it can inadvertently extend the book's due date, possibly
causing the recalling patron to receive the item later than they would
otherwise.

Test plan:
=========

1. Turn on recalls with UseRecalls.
2. In circulation rules, set the recall due date interval to 7 days
   or any other arbitrary period.
3. Check out an item to one patron & set the due date to be before the
   recall due date interval will have elapsed (e.g. the next day)
4. As a second patron, place a recall on the item in question.
5. See that the item's due date is extended to the current date plus
   the recalls due date interval.
6. Apply the patch, restart_all;
7. Repeat steps 3. and 4. See that the due date has not been extended.

BTW, the calculation of $due_interval has been changed, because with
the current code and empty 'Recall due date interval' $due_interval
is undefined, despite the intention of the author of the code.
(after calling get_effective_rule $recall_due_date_interval is defined, but
$recall_due_date_interval->rule_value is undefined;  the patron gets
a message: '... return the item within days, by ...' - no days count).

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e584b9adcb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-12 21:57:38 +00:00
Tomas Cohen Arazi 3a95803c5e Bug 37510: Make Koha::Object->delete throw Koha::Exception
This patch makes Koha::Object->delete wrap DBIC exceptions on FK
constraints and throw a Koha::Exception::Object::FKConstraint exception
instead. This will allow us better handling it from the callers.

To test:
1. Apply the unit tests patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Object.t
=> FAIL: A DBIC exception is thrown instead, tests fail
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass!
5. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 923dc5e078)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 16:41:16 +00:00
Kyle M Hall 955f724b1d Bug 37308: (QA follow-up) Tidy code
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5a06bd0d73)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 16:36:14 +00:00
Pedro Amorim aceb48f150 Bug 37308: Add user-agent for SUSHI outgoing requests
Signed-off-by: Belal Ahmadi <belal.ahmadi@uwl.ac.uk>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8175cccca2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 16:36:14 +00:00
PerplexedTheta 8297471b3b Bug 37593: Removed all instances of 'this this' in the codebase
To test:
a)  do a grep for 'this this'
    1)  notice that there are five matching files
    2)  notice that all of these instances are in comments, or podfiles
b)  apply this patch
c)  do a grep for 'this this'
    1)  notice now that these instances are gone
d)  apply these changes to schema.koha-community.org
e)  result!

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2cc520cdeb)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 16:26:25 +00:00
Andreas Jonsson ab51747dcc Bug 36879: Spurious warning in QueryBuilder
Test plan:

With ElasticSearch enabled,
* Perform a search using the default  sort order
  (i.e. 'relevance').
* Verify that no warnings are generated in
  plack-intranet-error.log

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 347291727d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 15:58:04 +00:00
Catalyst Bug Squasher 482c08bbfa Bug 35792: Use of uninitialized value $sub6
Test plan:

1. Apply patch
2. Rerun and make sure the error "Use of uninitialized value $sub6 in pattern match (m//) at /usr/share/koha/lib/Koha/SearchEngine/Elastricsearch.pm" is no longer present.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Initial testing done, it works well, needs an additional sign off from an external party

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b8049af6b1)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-09-11 15:56:14 +00:00
Tomas Cohen Arazi 819f0db4cc Bug 37389: (QA follow-up) Tidy
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 897f4f319b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 17:42:21 +00:00
Pedro Amorim 4593ad7751 Bug 37389: ExtendedAttributes mixin
This is what we're doing here:

- Creating a new mixin called ExtendedAttributes.pm
- Moving the extended_attributes 'join' logic out of REST/Plugin/Query and instead applying it to the aforementioned Mixin. Moving this to this level allows for this consistent behavior to happen on all search queries including, but not limited to, search queries happening on the REST API.
- Applying this Mixin to Patrons and ILL::Requests (we don't apply it to AdditionalFields.pm here yet because no AdditionalFields supporting classes have the extended_attributes accessor yet, I'll tackle this when rebasing 35287)

- The aforementioned mixin does the following:
-- Generates dynamic accessors for extended_attributes e.g. if there is a borrower attribute with code 'height', the 'extended_attributes_height' accessor is generated dynamically if a search with 'prefetch'=>'extended_attributes' AND the extended_attribute.code = 'height' is performed.
-- Rewrites the 'join' entries in the query to have the aliases as above.
-- Rewrites the WHERE conditions to match the above ruleset.

Example:

A DBIX search query as follows:

[
        {
            '-and' => [
                [
                    {
                        'extended_attributes.attribute' => { 'like' => 'abc%' },
                        'extended_attributes.code'      => 'CODE_1'
                    }
                ],
                [
                    {
                        'extended_attributes.code'      => 'CODE_2',
                        'extended_attributes.attribute' => { 'like' => '123%' }
                    }
                ]
            ]
        }
    ]

Results in the following SQL:

    SELECT
      `me`.`borrowernumber`
    FROM
      `borrowers` `me`
      LEFT JOIN `borrower_attributes` `extended_attributes_CODE_1` ON (
        `extended_attributes_CODE_1`.`borrowernumber` = `me`.`borrowernumber`
        AND `extended_attributes_CODE_1`.`code` = ?
      )
      LEFT JOIN `borrower_attributes` `extended_attributes_CODE_2` ON (
        `extended_attributes_CODE_2`.`borrowernumber` = `me`.`borrowernumber`
        AND `extended_attributes_CODE_2`.`code` = ?
      )
    WHERE
      (
        (
          (
            `extended_attributes_CODE_1`.`attribute` LIKE ?
            AND `extended_attributes_CODE_1`.`code` = ?
          )
          AND (
            `extended_attributes_CODE_2`.`attribute` LIKE ?
            AND `extended_attributes_CODE_2`.`code` = ?
          )
        )
      )

What fixes the performance issue that originated this work is the 'AND `extended_attributes_CODE_1`.`code` = ?' that was missing on the LEFT JOIN.

All of the above is explained using Borrowers and Borrower attributes, but it all also applies to ILL::Requests and ILL::Request::Attributes.

Co-authored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3b613fb73f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 17:42:21 +00:00
Lucas Gass ee1fb146b2 Bug 37419: Schema updates
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 17:25:35 +00:00
Nick Clemens 7ec7fc7ce0 Bug 37378: libraries_where_can_see_things should always return an array
The subroutine libraries_where_can_see_things stores the list of libraries that things
can be viewed from in an internal variable, so we can return this directly if we have already calculated.

When returning if not cached, we dereference the list and return an array. If cached, we are returning
an arrayref. This patch simply ensures we dereference the array even if already cached.

Before this patch, we were fetching the patrons, then redacting all info as their branches didn't match against
an arrayref, rather than checking against each branch we are allowed to view.

To test:
1. Setup a library group and check the "Limit patron data access by group ." option.
2. Add some libraries to the group. ( IN k-t-d I added CPL and MPL )
3. Create a staff account who has staff access permissions and all of the borrower permissions except "view_borrower_infos_from_any_libraries"
4. Set the home library of that staff member to one of the branches in step 2. ( In my test I choose MPL )
5. Log in as that patron and attempt a patron search that would include users from either library in step 2.
6. See the error:

Something went wrong when loading the table.
500: Internal Server Error.
Expected boolean - got null.
Expected boolean - got null.
Expected string - got null.
Expected string - got null.
Expected string - got null.
Expected integer - got null.
Expected integer - got null.
Expected integer - got null.
Expected boolean - got null.
Expected boolean - got null.
Expected string - got null.

7. Apply patch, restart all
8. Search again, you can see the expected patrons

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit ebdf121a7d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 15:07:54 +00:00
Kyle M Hall b507aad0cb Bug 36362: (QA follow-up) Tidy code
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit a62d39ea11)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 14:27:13 +00:00
David Gustafsson a409b16d5b Bug 36362: Only call Koha::Libraries->search() if necessary in Item::pickup_locations
To test:

1) Make sure the following tests pass:
 - t/db_dependent/Koha/Item.t
 - t/db_dependent/Koha/Biblios.t
 - db_dependent/Koha/Biblio.t

Sponsored-by: Gothenburg University Library
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2c1e955621)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-29 14:00:51 +00:00
Nick Clemens 41f690bca2 Bug 28762: (QA follow-up) Restore protection against unknown itemtypes
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 5ff47fc40c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:34 +00:00
Martin Renvoize 26d2a3e779 Bug 28762: Rename not_for_loan as effective_not_for_loan_status
This patch updates the method name to follow current conventions.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fdefef1444)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Martin Renvoize f42b1a06e5 Bug 28762: Replace is_notforloan with not_for_loan
This patch replaces the use of is_notforloan with not_for_loan and
removes the older is_notforloan method and tests

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 4e6d9d13bf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Martin Renvoize 656d39208b Bug 28762: Confirm return of not_for_loan in boolean context matches is_notforloan
This patch is simply here to prove that is_notforloan is just
not_for_loan but in a boolean context.. we'll remove it in the next
patch.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0d5c224cc3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Martin Renvoize a38bac4814 Bug 28762: (follow-up) Remove warning in tests
Looks like a recent bug introduced a superflous warning, we just clean
that up here whilst we're in the code.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit e45a595996)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Martin Renvoize c03137a051 Bug 28762: Move notforloan fallback into object
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 294447d07e)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Martin Renvoize 140875e681 Bug 28762: Use Koha::Course in course-details controller
This patch updates Koha::Course to include the 'instructors' relation
accessor and then update the course-details controller to use the
Koha::Course object and pass it to the template instead of building a
hash using GetCourse.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7f38c77d09)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 20:20:33 +00:00
Matt Blenkinsop b7ec2d2131 Bug 29087: (QA follow-up): Fix QA tests
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Conform BZ comment31
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7f5e1fac86)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:40:41 +00:00
Jonathan Druart 34be9ab95b Bug 29087: Prevent filter_by_for_hold to crash if default holdallowed is not_allowed
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8c804c1749)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-08-28 19:40:41 +00:00
Marcel de Rooy 6bbea258fb
Bug 37508: (QA follow-up) Move check to Koha::Report, extend
Do not allow password but allow password_expiry_days etc.
Do not allow token, secret and uuid too.

Test plan:
Run t/db_dependent/Koha/Reports.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-12 15:35:15 -03:00
Tomas Cohen Arazi b4e3a0aaea Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize e7b3d05bc7 Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi b81b388db3 Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Tomas Cohen Arazi 21fd44f505 Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Hammat Wele 803a554717 Bug 37018: (follow-up) adding some allowed operators
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize d5f76c58e7 Bug 37018: Use validation in search_rs helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00
Martin Renvoize fea6c06878 Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-07-25 15:10:22 +00:00