Commit Graph

34251 Commits

Author SHA1 Message Date
Jonathan Druart a8877cea3b Bug 23451: [18.11.x] Prevent XSS vulnerabilities in opac-imageviewer.pl
And certainly in other sripts as it is in opac-bottom.inc

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:33:17 +00:00
Magnus Enger 1d27831bcc Bug 22543: Prevent "back and refresh attack"
To reproduce and test:
- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl
- Reload the page, you see an error like "Confirm new submission
  of form"
- Reload the page again and confirm the submission of the form
- You are now logged in to the OPAC again!
- Log out again
- Apply this patch
- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click back, you are taken to /cgi-bin/koha/opac-user.pl
- No matter how many times you reload /cgi-bin/koha/opac-user.pl,
  you should not see anything other than the login form.
- Check that Self Check Out still works as it should, by making
  sure you have a user with self_check permissions, then setting
  WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and
  AutoSelfCheckPass appropriately. Then visit
  /cgi-bin/koha/sco/sco-main.pl and verify everything works as
  expected.

The messages and errors pages you see related to resubmitting the
form might differ from the ones described here, depending on what
browser you use. I tested in Chromium 76.0.x.

This fix was originally proposed by LMSCloud:
74a7fe0f0c

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:32:02 +00:00
Marcel de Rooy c2ba205097 Bug 23329: (QA follow-up) Resolve warning on wrong biblionumber
Passing a wrong biblionumber generates a warning:
    GetMarcUrls called on undefined record at opac/tracklinks.pl line 58.

Test plan:
[1] Try it again with a wrong biblionumber and check the logs.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:26:02 +00:00
Marcel de Rooy 7f3b26bc74 Bug 23329: (follow-up) Allow item URI with a biblionumber parameter
If you pass a URI with a biblionumber without specifying the itemnumber,
tracklinks did not redirect an item URI.

Test plan:
[1] Add URI in an item.
[2] Pass this URI with the itemnumber to tracklinks. Should pass.
[3] Pass this URI with the biblionumber to tracklinks. Should pass now too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:25:59 +00:00
Tomas Cohen Arazi 3d39ee8867 Bug 23329: (follow-up) Use any instead of grep
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:25:56 +00:00
Nick Clemens bccf46a4a7 Bug 23329: Only redirect tracklinks.pl to urls contained in records
Bug 19487 limited redirection to urls contained in a record/item if we were tracking.
We should probably limit forwarding if not tracking as well.
Additionally, if we don't have a soucre, let's not forward

To test:
 0 - Set TrackClicks syspref to 'Don't track'
 1 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 2 - You get forwarded to google
 3 - Set TrackClicks to 'Track anonymously'
 4 - You get a 404
 5 - Apply patch
 6 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 7 - You get a 404
 8 - Set TrackClicks syspref to 'Don't track'
 9 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
     Choose a biblionumber that exists
10 - You get a 404
11 - Add http://www.google.com to the 856$u of the record used above
12 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
13 - You are redirected
14 - Confirm redirection and 404 as expected with other settings of TrackClicks

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-22 17:25:53 +00:00
Fridolin Somers 866cb4a2c9 Bug 23101: (follow-up) use NoSort class in datatable
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 95c43ebe72)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 7ce1fdc847)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 23:01:34 +00:00
Katrin Fischer c904c30636 Bug 23101: Hide action buttons on contracts if user lacks permission
When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: Holly Cooper <hc@interleaf.ie>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d0a06e365b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit d1da1a688d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 23:00:42 +00:00
Kyle M Hall 5a7bf6bbec Bug 23688: System preference uppercasesurnames broken by typo
In the process of moving this feature from memberentry.pl to Patron.pm, the 's' on uppercasesurnames was dropped, breaking the feature.

Test Plan:
1) Test uppercasesurnames, note it does not work
2) Apply this patch
3) Test uppercasesurnames, note it works now!

Signed-off-by: Kyle Hall <kyle@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 62ad053894)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0c9c78341b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 22:41:18 +00:00
Fridolin Somers 17a646c633 Bug 23679: add Unit Test t/db_dependent/Circulation/transferbook.t
I've choosen to add it to db_dependent because we may add other tests
to cover transferbook() cases that will change DB

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Bin Wen <bin.wen@inlibro.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d096eeab8a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 19b44c8b44)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 22:35:23 +00:00
Fridolin Somers 59cbf5ab53 Bug 23679: fix software error when trying to transfer an unknown barcode
When trying to transfer an unknown barcode in
/cgi-bin/koha/circ/branchtransfers.pl you get the error :

Can't call method "itemnumber" on an undefined value at
/home/koha/src/C4/Circulation.pm line 319.

This comes from C4::Circulation::transferbook which should stop when
finding unknown barcode.

Test plan :
1) Go to /cgi-bin/koha/circ/branchtransfers.pl
2) Enter a barcode not existing in database
3) Without patch you get a software error, with patch you get a message
   saying 'No Item with barcode'
4) Enter a barcode existing in database and check transfer is OK

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Bin Wen <bin.wen@inlibro.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 3848a3a772)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 43f15f1312)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 22:34:51 +00:00
Owen Leonard 67a1152b3f Bug 22804: OPAC Overdrive JavaScript contains untranslatable strings
This patch moves untranslatable strings out of overdrive.js and into
opac-bottom.inc where other strings are defined for use in JavaScript
files.

To test you must have OverDrive integration set up, including
OverDriveCirculation. Test the various Overdrive integration features:

 - Placing holds
 - Cancelling holds
 - Checking out
 - Checking in

These features should work as expected.

Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 740d0bde78)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit d851b3019b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-13 22:26:37 +00:00
Nick Clemens 5987860b38 Bug 21406: [18.11.x only] Prevent errors from undefined fields in requests
To test:
1 - In 18.11 enable ILL and install the freeform backend
2 - Create a request for 'Journal article'
3 - Note there is no 'Author' field
4 - Try to view ILL requests
5 - You get a datatables error about missing metadata_author column
6 - Apply patch
7 - No more error

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-06 17:10:44 +00:00
Jonathan Druart 5d01029012 Bug 23961: (bug 22851 follow-up) Restore Add subscription fields link
This fix a wrong rebase conflict resolution from
  commit 414869eb9d
  Bug 22851: Style navigation links in serials modules like same links
    in other modules

It only affects 18.11.x

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-06 17:05:49 +00:00
Liz Rea 15ffaa305a Bug 23658: fix wrong transfer modal dropping specified checkin date
To test:

Have an item that needs a transfer
use the check in page, and backdate the checkin date
check in the item, click ok or print - backdating is OK
Check it in again - backdating drops off
Apply this patch, restart the things
run tests again, backdating should be retained in all cases.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-11-06 16:58:34 +00:00
Tomas Cohen Arazi d340a6766f Bug 23624: (QA follow-up) Test error cases
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6c90c6f7d9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 34f49c908c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 22:29:40 +00:00
Kyle M Hall 85cc23c651 Bug 23624: (QA follow-up) Don't fetch the count unless the query was successful
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit f2b2797567)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 528aa88b7e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 22:29:25 +00:00
Tomas Cohen Arazi 5244baa292 Bug 23624: (QA follow-up) Optimize even more
This patch makes counting the results have no memory footprint by
leveraging on the DB to count the rows.

To test:
- Without this path, run:
  $ kshell
 k$ prove t/db_dependent/Reports/Guided.t
=> SUCCESS: Tests pass
- Apply this patch
- Run:
 k$ prove t/db_dependent/Reports/Guided.t
=> SUCCESS: Tests still pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit bca4453c50)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit b332b365ed)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 22:29:05 +00:00
Tomas Cohen Arazi 3f325c3972 Bug 23624: Unit tests
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 7958e7f3f9)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 654c13e7d9)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 22:28:43 +00:00
Paul Hoffman 15b87a2397 Bug 23624: Count rows in report without (potentially) consuming all memory
C4::Reports::Guided::nb_rows (called by get_prepped_report in reports/guided_reports.pl) uses DBI::fetchall_arrayref to retrieve all rows at once; counts them; and then discards the rows and returns the count.  This has the potential, if the number of rows is very large, to exhaust all available memory.

(Other code in guided_reports.pl has the same potential effect, but because the solution to that is much less straightforward it will be addressed in a separate bug report.)

This patch uses the second ($max_rows) parameter to DBI::fetchall_arrayref to retrieve a smaller number (1,000) of rows at a time, looping until all results have been retrieved.  This will only use as much memory as the maximum amount used by a single call to DBI::fetchall_arrayref.

Test Plan:
1) Create a report the will generate a huge number of results
2) Run the report, watch your memory usage spike
3) Apply this patch
4) Restart all the things!
5) Run the report again, note your memory usage is much lower

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 79e15278f7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit be8bade672)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 22:26:43 +00:00
Lucas Gass 51c0f7b624 Bug 23526: (RM follow-up) Fix failing test
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:51:58 +00:00
Lucas Gass 6466058922 Bug 23683: Course reserves public notes on specific items should allow for HTML
Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d8187991a4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 13e47de787)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:25:23 +00:00
Lucas Gass ac80a8ae2d Revert "Bug 23605: Fix terminology for branches limitations on patron category admin page"
This reverts commit 1823373769.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:20:53 +00:00
Tomas Cohen Arazi fa4f00dbbb Bug 23607: Make /patrons/:patron_id/account staff only
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 8171c9d05d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4c681e4e91)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:15:27 +00:00
Kyle M Hall 539e2a3c7f Bug 23625: Make new 'required' attributes match the currently used syntax in other templates
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0aeb599848)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 267d0a9033)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:06:24 +00:00
Eric Phetteplace 8416677e76 Bug 23625: ArticleRequestsMandatoryFields* only affects field labels, does not make inputs required
Test plan:

1. Enable article requests ( syspref: ArticleRequests => Enable, Circ and fine rules ALL/ALL (or a given category/itemtype): Article requests => Yes )
2. Set one or more fields to require in the ArticleRequestsMandatoryFields, ArticleRequestsMandatoryFieldsItemOnly, and/or ArticleRequestsMandatoryFieldsRecordOnly settings (all these settings are affected in the same manner)
3. Search for a title and select the "Request Article" button from the OPAC search results
4. Authenticate as a patron
5. Neglect to fill out at least one of the mandatory fields
6. Select the "Place Request" button at the bottom of the form
7. The form submits despite the empty mandatory fields
8. Apply patch
9. Repeat steps 3, 5, & 6
10 . The form should refuse to submit, show a browser-native message about the missing required fields.

Sponsored-by: California College of the Arts
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 64148cf4ac)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4d8dece7ff)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:05:50 +00:00
Nick Clemens 0ab73be416 Bug 22602: Fix OverDrive circulation when coming from another site
On bug 21078 we caught an error and returned, this makes us skip some variable setting that we need.

This patch moves that code into its own function.

To test:
0 - Have OverDrive circulation setup and working
1 - Place a link to your kohadev installation on another site
2 - Follow that link to the opac
3 - Note all items show as 'Place hold' even if available copies
4 - Apply patch
5 - Repeat 1&2
6 - Note the items availability shows correctly

Signed-off-by: Elizabeth Quinn <EQuinn@chplnj.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 4b642386d8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit acf3eb5217)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 01:02:10 +00:00
Nick d077cf396b Bug 23651: Add address of restricted page to syspref description
To test:
1 - Look at the restricted page syspref
2 - Check that the url is listed
3 - Add some content to the page
4 - Save the prefs
5 - Verify the address listed takes you to the page on the opac

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fa97bc90df)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8e6313eaf7)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:57:49 +00:00
Fridolin Somers 9273726997 Bug 18710: Wrong subfield modified in batch item modification
In Tools > Batch item modification, one can modify or delete a subfield.
When deleting a subfield et modifying another, the wrong subfield gets modified.

This is caused by the fact that disabled inputs are not posted in form.
So for a subfield to delete :
Input name=field_value is not posted. But input name=subfield is posted with subfield code.
So these 2 arrays does not have the same size :
    my @subfields = $input->multi_param('subfield');
    my @values    = $input->multi_param('field_value');

For exemple, deleting $2, not changing $u and modidying $v will modify $u with value for $v o_O

This patch correts but setting disabled all inputs of a deleted subfield : field_value, tag, subfield and mandatory. Like it was not present in the form.

Test plan :
- Go to Tools > Batch item modification
- Enter a barcode and submit
- Lets say there are subfields : $2 (not mandatory), $u and $v
- Check the subfield $2 to be deleted
=> $2 input is disabled
- Enter a text in $v
- Submit the form
=> Without patch, the text for $v gets into $u
=> With patch, the text for $v gets into $v
- Check the subfield $2 is well deleted

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit adb232c8f0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit d8a1871dd0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:54:33 +00:00
Katrin Fischer 1823373769 Bug 23605: Fix terminology for branches limitations on patron category admin page
Fix branches to library.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 921cf9b352)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 9fe6c016ab)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:50:34 +00:00
Nick Clemens d9f7769909 Bug 22744: Changes for opac and remove JS
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 87302a1abf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 231d71d427)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:40:22 +00:00
Nick Clemens 0b9d599bd0 Bug 22744: Remove the 'do not notify' buttons
These checkboxes are simply a way to clear the prefs before editing. We are not saving
a lot of click, and we are confusing people, this patch simply removes them

To test:
1 - Edit a patron's messaging preferences
2 - Think too hard about the 'Do not notify' boxes
3 - Feel confused
4 - Apply this patch
5 - Edit a patron's messaging preferences
6 - Confirm it feels better

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit ff21f97908)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 02cc140d68)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:39:39 +00:00
Liz Rea e337bc6cce Bug 23537: Overdrive won't show complete results at all times
To test:

On an overdrive enabled OPAC (tough sell, I know)

    Do a search for something you know has magazines, the collection I
    was looking at had "knit" as one

    Without this patch, the results will show "(many) items found in
    overdrive collection" but only show a small number of them.

    With the patch, the number of results should match the number
    shown/paginated.

    A site that has this fix applied, is
    https://tracy.bywatersolutions.com/cgi-bin/koha/opac-overdrive-search.pl?q=knit

    Before this patch, the number of results was 44, but there were only
    8 shown. Now we see all 44

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 98e4b5c04a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit f05a3767f6)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:37:15 +00:00
Nick a70e750fa0 Bug 23526: Don't use encoded question mark in shib_login_url
To test:
1 - Enable shib
2 - Do a search
3 - Try to login from search
4 - Get an error
5 - Apply patch
6 - Retry

Note: You do have to fully configure shibboleth, you can simply enable it in koha-conf.xml and check the URLs.
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 16aa7d1c8a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit da602a96ad)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:35:22 +00:00
Tomas Cohen Arazi d73d1a07a7 Bug 23597: Add missing reserved query parameters to GET /holds
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 410e9bc0e8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit fa5bf18054)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:26:02 +00:00
Owen Leonard f346c4d076 Bug 23575: Template error causes item search to be submitted multiple times
This patch corrects the item search template so that the submit handler
is not nested inside an unrelated loop. The change should have no
outward effect on the behavior of the item search other than making it
faster.

To observe the bug in action, open your browser's developer tools and
click the "Network" tab. Filter the output to only "XHR" and perform an
item search. You should see multiple requests.

To test, apply the patch and perform an item search. It should behave
normally.

Check the browser's "Network" monitor again to verify that only one
request is being sent.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 075261645e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3cf3782a60)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:19:59 +00:00
Marcel de Rooy 49029a40b7 Bug 22037: (QA follow-up) Correct misleading comment
Comment needs to be corrected, and now applies to the whole code
paragraph following it.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 766814ffa3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4c15068ec0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:14:45 +00:00
Kyle M Hall e21baf059d Bug 22037: (QA follow-up) Implement use of CHARGES_GUARANTEES
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 9a5e519d70)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0faef1a244)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:14:31 +00:00
Jonathan Druart 9a2a8a8234 Bug 22037: Block SIP checkout if guarantees have debt
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2e91d33381)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit b74949a821)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:14:17 +00:00
David Bourgault 2e9374b4ea Bug 21058: Added HTML class to showRDAtag264
Adds the HTML class "rda264" to the span generated by the XSLT function
showRDAtag264.

To test, same as previous, using a notice with a 264 tag. Both patches
only apply to MARC21.

I was unsure how to name the class, so I've chose the simplest, most
explicit name.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 072a901d35)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 03261d5dc0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:09:33 +00:00
David Bourgault 262833c9f6 Bug 21058: Added HTML classes in MARC21slim2_Detail.xsl
This is a very small patch. I've simply added the following classes to
their respective spans in the detail XSLs for both interfaces.

- in_note (773$n)
- preceeding_entry_note (780$n)
- succeeding_entry_note (785$n)

To test:

1. Apply patch
2. Open details page of notice with a 773$n, 780$n or 785$n field
3. Inspect element. The class should be visible.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit b65fc8e176)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 74baa0fa17)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:09:18 +00:00
Fridolin Somers b77ba4981c Bug 23004: Unit test
Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/QueryBuilder.t

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit b26c2a1863)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit c67f4ce30a)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:04:42 +00:00
Fridolin Somers d161374e01 Bug 23004: Missing authtype filter in auth_finder.pl
In cataloguing, the use of tag editor opens authorities finder with a limit on specific authorities type.
This limit is missing with Elasticsearch.

This patch adds in query a "filter" on "term" which is the most performant way because there must be no ranking computed on this part.

Test plan :
1) Use Elasticsearch
2) Create an autority of type author (NP in UNIMARC) with heading "Tolkien"
3) Create an autority of type subject-author (SAUT in UNIMARC) with heading "Tolkien"
4) Create a biblio record
5) Use tag editor on a author field (700 in UNIMARC)
6) Seach for "Tolkien" in $a
without patch : you see the 2 authorities in results
with patch : you see only the correct authority in results (NP in UNIMARC)
7) Check search in authorities-home.pl is still OK

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 949e36c7b8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1d8b1fafc4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-17 00:04:24 +00:00
Martha Fuerst 2bfa5ae6a4 Bug 21180: Allow Talking Tech outbound script to limit based on patron home library branchcode
A library system has requested the ability to limit which patrons are sent to Itivia for phone notices.

Test Plan:
1) Enable phone notices for two patrons with overdues
2) Run the misc/cronjobs/thirdparty/TalkingTech_itiva_outbound.pl with the new --patron-branchcode option
3) Note only the patron whose homebranch you specified is in the output file

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 3cb66af150)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 92b966a87a)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-16 23:58:27 +00:00
Marcel de Rooy d237cf9746 Bug 22929: Allow SCI/SCO logins independent of GDPR_Policy
This patch makes Auth skip the GDPR policy check when get_template_and_user
is called for sci/sco (self checkin, checkout).
I do not really like the change in this form but the nature of self checkin
and checkout kind of dictate it (double hack).
I wanted to add a test but since that asks for mocking CGI, checkauth, etc.
the time needed for that is just too much for this simple change.

Test plan:
Enable GDPR_Policy and self checkin/checkout.
Verify that using patrons without consent is not blocking sci/sco.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 3640130d1f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a1927fdf46)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-16 23:55:25 +00:00
Caroline Cyr La Rose 4604e34a46 Bug 23353: ACQ framework makes fr-CA web installer explode
This patch removes the standalone ACQ framework SQL file in the fr-CA
directory and adds the ACQ framework creation SQL in the default
framework file, as it is in other languages.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 811bee9bce)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 93b8ea9685)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-16 23:48:59 +00:00
Marcel de Rooy 076e4eff05 Bug 16111: (QA follow-up) Few additional corrections
[1] Refining the regex on the format parameter in opac-search.pl
[2] Adding a colon to dc:identifier. The Dublin Core specs gives me this
    example:
    Identifier="ISBN:0385424728"
[3] Replacing last occurrence of rss2 in the rss template

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2bbd811027)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ad787464c9)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-01 00:08:32 +00:00
Marcel de Rooy 1ffce2e17a Bug 16111: (QA follow-up) Changes related to partial revert
When reverting the &amp; change, we need to go back to html filter for
query_cgi and limit_cgi. In this patch I only replaced it where it is
needed. The template contains more references to SEARCH_RESULT.query_cgi
and SEARCH_RESULT.limit_cgi which are useless, since searchResults does
not return these hash keys at all.

This patch fixes one occurrence where SEARCH_RESULT was copied outside
the loop that defines the template variable.

Obviously, the code for RSS still needs more attention.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 062c3f9ab2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 33c0504bb9)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-01 00:07:30 +00:00
Liz Rea 4b07f9eac5 Bug 16111: Further fixes to the RSS to make feed work
- fixed links per the WC3 spec
- fixed a problem in the ATOM link

To test:
do a search, click the RSS icon - it shows xml in most browsers but wont
do RSS type things.
Apply this patch, restart the things
refresh the page, it should do RSS things (i.e. firefox should render it
        as a nice looking thing, rather than raw XML.)

noting that there are a couple of validation errors still, but they
don't seem to be show stopping and moreover I wasn't sure how to fix them:

Misplaced Item
Self reference doesn't match document location (this is a "for widest
        compatibility you should fix" kind of thing)

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit fafd719dd3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit df9272bbef)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-01 00:04:11 +00:00
Jonathan Druart a5cc18716f Bug 16111: [CHANGED] Replace link href by link in rss part
Original patch title: Replace & with &amp;

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

EDIT:
Reverting the changes to C4/Search and opac-search.pl.
This requires a few changes, as supplied in the 5th patch.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 0e1e5ca31f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 48aaf09849)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2019-10-01 00:03:46 +00:00