This change turns off ABSOLUTE and EVAL_PERL for user-entered templates,
as these options can allow for arbitrary code execution and information
disclosure.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a Notice for Reports with a report like:
[% IF ( x == 1 ) %]
One
[% ELSE %]
Two
[% END %]
3. Run a report using this template
4. The report should show "Two"
5. Turn on CHECKOUT emails for a test patron
6. Perform a checkout
7. Look at the CHECKOUT email and note that the email body
is correctly generated
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Would be good to have this fixed as the default.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
The test plan should include PERL blocks or absolute paths! Tested those
instead. Testing x==1 seems irrelevant.
I tried:[% PERL %]print 1;[% END %] and [% INCLUDE /app/Dockerfile_1 %]
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch fixes the behavior of the OPAC's "Clear" link, which was not
updated to work with CSRF protection.
To test:
- If necessary, go to Administration -> System preferences in the staff
interface and set the EnableOpacSearchHistory preference to "Keep."
- Log in to the OPAC.
- If necessary, perform several catalog searches in order to populate
your search history.
- Expand the user menu in the upper right-hand corner and click the
"Clear" link next to "Search history."
- You should be prompted to confirm.
- After confirming your search history should be empty.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch updates the 'Create EDIFACT order' menu dropdown for cases
where multiple EANs are available for the library.
We set the dropdown to a max-height of 75% of the window height and then
we enable y scrolling and hide the x scrollbar.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch fixes an JS error in several administration pages, introduced
by Bug 39099 and 39810. We can't access a DOM node without checking for
its existence first.
To test, apply the patch and go to Administration.
- Check the following pages:
- Authorized values
- Credit types
- Debit types
- Item types
- Patron categories.
- On each page check the JavaScript console on the initial page. There
should be no errors.
- Check the add/edit page for each and confirm that the library
limitation Select2 widget works correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
- Rename LanguageToReportOnMerge system preference to LanguageToUseOnMerge
- Use "use" instead of "report" in system preference description
- Mark this feature as UNIMARC-only.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Bug 39473 added ^ and $ to options of the dropdown lists from the
column filters.
They are removed and replaced with "exact" later in the code (using
build_query).
But in the case of "_status", we do no get this code as it's not a
regular column (it does not have "data" attribute), but an additional
filters.
I don't think this fix is ideal, but we are too close to the release to
rework datatables.js
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a warning to the "Circulation and fine rules" page in
"Koha administration" if there is an enabled plugin that implements the
overwrite_calc_fine plugin hook.
To test:
1) Apply the patch.
2) In your browser go to
/cgi-bin/koha/admin/smart-rules.pl
and check that there is no warning on the top of the page.
3) Install a plugin that implements overwrite_calc_fine.
4) Reload /cgi-bin/koha/admin/smart-rules.pl and check
that now there is a warning that displays the installed
plugin's name.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch makes the method return an actual array instead of a
comma-separated string. The API spec is adjusted so it also expects an
array in the response.
Tests are adjusted for the new return value.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ yarn api:bundle
k$ prove t/db_dependent/Koha/Item.t
=> SUCCESS: Tests pass!
3. Sign off :-D
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Although we're reverting 32216, we still want to be able to force print notices as per the original intent.
This patch adds that into queue_notices, rather than in the cronjob
Co-authored-by: Jake Deery <jake.deery@openfifth.co.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This reverts commit 3040f46d5e.
Bug 30300 adds a patron messaging preference for the expiration notice and abstracts this logic into queue_notice
Bug 32216 removes this call to enable print notice functionality but this would be handled already by queue_notice based on the patron's messaging preferences
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The patches on this bug add the ability for staff members to set the patron expiry notice as mandatory at the category level. When set, the cronjob will automatically send an expiry notice regardless of existing messaging preferences. If it is turned off, the old messaging preferences will still be in place and actioned
Test plan:
1) Apply patch and run updatedatabase
2) In system preferences set MembershipExpiryDaysNotice to 5
3) Choose a patron and edit their expiry date to today's date, ensuring they have a primary email set
4) Create a MEMBERSHIP_EXPIRY notice (content of the notice is irrelevant, just needs to exist)
5) Run perl misc/cronjobs/membership_expiry.pl -c -v -before 10 -after 10
6) Check the patron's messages, there should be no expiry notice queued
7) Set the patron's category 'enforce expiry notice' field to Yes
8) Repeat step 5, there should be a notice queued
9) Set that patron's primary contact method to primary email and run step 5 again
10) There should be a notice queued for an email
11) Set the category level enforce expiry notice back to No
12) Choose a second patron and set an email address, expiry date to today and set the patron expiry messaging preference for that patron to 'email'
13) Repeat step 5 - this time only one notice should be queued on the second patron, no new notice should queue for the first
14) Re-set the category level option to Yes
15) Repeat step 5 - this time both patron's should have notices queued
16) Unset the category level option again, the behaviour should be the same as step 13
17) Set the category level option back to Yes and check the patron messaign preferences menus in both the OPAC and Staff client - the patron expiry option should not be visible while the cateogry level enforcement is set to Yes
Signed-off-by: Hanna Leiker <tech.hanna@salinapublic.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hanna Leiker <tech.hanna@salinapublic.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hanna Leiker <tech.hanna@salinapublic.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hanna Leiker <tech.hanna@salinapublic.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
With Bug 36552 we set 'date entered on file' (MARC21: 008/0-5)
of a record created by duplication of an existing record to the current
date instead of having there the value from the original record.
The same should be done for the advanced editor (for now, it retains
the date of the original record).
Test plan:
==========
1. Enable EnableAdvancedCatalogingEditor systempreference.
2. Open any record in advanced editor to make it default. Go back to
record normal display.
3. Make a duplicate: Edit > Edit as new (duplicate)
4. Note that the date in 008/0-5 is of the original record, not of
today.
5. Apply the patch ; restart_all.
6. Repeat p. 3. The date in 008/0-5 should be of the today. If not,
refresh browser's cache (Ctrl+Shift+R etc.) to get the fresh
version of the JS.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
1. Tests should pass: prove t/db_dependent/Koha/Item.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When IndependentBranches is enabled, canreservefromotherbranches
set to don't allow is also required to prevent non-superlibrarians
from placing holds in other libraries.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When IndependentBranches is enabled and canreservefromotherbranches
is set to don't allow, then non-superlibrarians should not be able to
place holds for other libraries.
Test plan:
1. Appy the patch.
2. In Koha administration > System preferences, set:
- IndependentBranches: Yes
- canreservefromotherbranches: Don't allow
3. In Koha administration > Circulation and fines rules, check that
you have a rule for all patron categories and all item types, with
unlimited holds.
4. Find (or create) a staff patron for a library other than Centerville:
- Change the username and password so you can log in as the
staff patron.
- Add permissions to the staff patron (More > Set permissions):
. Staff access, allows viewing of catalogue in staff interface
. Add, modify and view patron information
. Place and modify holds for patrons
5. Find (or create) a patron with the same home library as the
staff patron in step 4.
6. Find (or create) a record with an item where the home and
current library are the same as the staff patron in step 3 and the
patron in step 5.
7. As a superlibrarian place a hold for the record from step 6
using the patron from step 5:
- If placing a hold for the next available item, the "Pickup at"
dropdown list should list all libraies.
- If placing a hold on a specific item, the dropdown list for the
"Allowed pickup locations" column for each item should also list
all libraries.
- After placing the hold, in the "Existing holds" table, the dropdown
list for each hold in the "Pickup library" column should
also list all libraries.
8. Log out from the staff interface and login with the staff patron
from step 4.
9. Find the record from step 6 and place a hold using the patron from
step 5 - the library dropdown list should be limited to the
item's home library:
- If placing a hold for the next available item, the "Pickup at"
dropdown list should only list the item's home library.
- If placing a hold on a specific item, the dropdown list for the
"Allowed pickup locations" column for each item should also only
list the item's home library.
- After placing the hold, in the "Existing holds" table, the
"Pickup library" column should now only show the item's home
librayr, with no dropdown list.
Signed-off-by: Anni Rajala <anni.rajala@turku.fi>
Signed-off-by: baptiste <baptiste.bayche@inlibro.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
->connect does not raise an exception, so we didn't reached the catch
block.
Adjusting the code but I am not really happy with it, but more changes
will derail the original bug
Now we log:
Cannot connect to broker (Access refused for user 'guest') at /kohadevbox/koha/Koha/BackgroundJob.pm line 96.
Cannot connect to the message broker, the jobs will be processed anyway at /kohadevbox/koha/misc/workers/background_jobs_worker.pl line 100.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch suggests to deal with connection issues at
Koha::BackgroundJob->connect level.
It incorrectly returned a Net::Stomp object when the connection failed.
With this patch, if the CONNECT does not return a CONNECTED frame then
Koha::BackgroundJob->connect returns nothing and the caller is not
fooled.
It also fixes the about page, we now have:
"Using SQL polling (Fallback, Error connecting to RabbitMQ)"
instead of
"Using RabbitMQ"
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change adds error handling for ERROR frames to background_jobs_worker.pl.
A previous patch added it to es_indexer_daemon.pl which is a different
background jobs worker.
To test ERROR handling for background_jobs_worker.pl:
1. Change your RabbitMQ connection details in koha-conf.xml or the hard-coded ones in Koha/BackgroundJob.pm
to include an invalid password. For example, if you don't have a message_broker already defined, use the following:
<message_broker>
<password>bad</password>
</message_broker>
2. sudo koha-worker --restart --quiet kohadev
3. View the errors in the logs:
tail -f /var/log/koha/kohadev/worker-output.log
tail -f /var/log/koha/kohadev/worker-error.log
To test MESSAGE handling for background_jobs_worker.pl:
1. Ensure RabbitMQ connection details are correct
2. Go to Batch item modification and add the following barcodes:
39999000001310
39999000004571
3. Add a z - Public Note of the following and click Save:
THEBACKGROUNDWORKERWORKED
4. Search the catalogue using THEBACKGROUNDWORKERWORKED in the top
catalogue search
5. Note that you get 2 results in your search
6. Look in the logs just to make sure there are no new messages there
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change causes es_indexer_daemon.pl to die on ERROR frames instead
of spinning in an infinite loop. It also adds a content-type STOMP frame header
to help consumers know what data type is in the MESSAGE frame body.
To test ERROR handling for es_indexer_daemon.pl:
1. Switch to using Elasticsearch
2. Change your RabbitMQ connection details in koha-conf.xml or the hard-coded ones in Koha/BackgroundJob.pm
to include an invalid password. For example, if you don't have a message_broker already defined, use the following:
<message_broker>
<password>bad</password>
</message_broker>
3. sudo koha-es-indexer --restart kohadev
4. View the errors in the logs:
tail -f /var/log/koha/kohadev/es-indexer-output.log
tail -f /var/log/koha/kohadev/es-indexer-error.log
To test MESSAGE handling for es_indexer_daemon.pl:
1. Switch to using Elasticsearch (and ensure RabbitMQ connection details are correct)
2. Change the title of a bib record to something new and unique
3. Try to search for the bib using the new title
4. Note you can find it
5. Look in the logs just to make sure there are no messages there
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
1) Either add loads of suggestions to your KTD or use the script in the data script patch uploaded to the bug
2) Navigate to Acquisitions > Suggestions
3) Depending on how many suggestions you have loaded (the script does 2000), the page will load very slowly
4) Apply patches
5) yarn build && restart_all
6) Hard refresh the page, the page should load much faster and the first tab should load a paginated datatable
7) Click into another tab, the tab should also load a paginated datatable
8) Click back into the first tab, the original table should persist and should not reload
9) Use the edit tools at the bottom of the page, they should work as expected
10) Click on the links in various table cells, they should redirect as expected
11) Use the actions buttons in the far right column, then should work as expected
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch removes the existing process intensive searches and moves the search logic to a single group query that returns the values that will be the counts in the tabs. It then formats the parameters for each type and passes them to the template for the datatables ajax requests
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a strings_map method to allow the API to return the required authorised values needed for table displays
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Katrin Fischer
David Cook
Tomas Cohen Arazi
Jonathan Druart
Martin Renvoize
Owen Leonard
Matthias Meusburger
Matt Blenkinsop
Raphael Straub
Nick Clemens
Matt Blenkinsop
Janusz Kaczmarek
Hammat Wele
Emily-Rose Francoeur