Commit Graph

4582 Commits

Author SHA1 Message Date
Marcel de Rooy d45d82c2d9 Bug 37784: [24.05] (QA follow-up) Add few tables to Koha::Database::Columns
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.

Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit d485d1f2ae)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-03-24 15:33:41 +00:00
Jonathan Druart ee8b3272a3
Bug 36081: Use multivalue_preference
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!

Let support both here.

This patch also removes silly JS code in the template.

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 12:17:31 -03:00
Tomas Cohen Arazi a3f1b3a307
Bug 28907: (follow-up) $c->auth->public should be run inside a try block
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-26 09:37:58 -03:00
Marcel de Rooy 177ce2f4bd Bug 36081: Check SupportedFormats server side
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2025-02-25 20:40:53 +00:00
Lari Taskula 6d386a490e Bug 28907: REST - Drop support for allow-owner functionality
...and allow-guarantor functionality. Replaced by $c->auth->public($patron_id)
and/or $c->auth->public_guarantor($patron_id), where $patron_id is the patron's
id that owns the requested resource.

Old method, was applicable to both privileged and public routes:

  api/v1/swagger/paths/route.yaml

  x-koha-authorization:
    allow-owner: true
    allow-guarantor: true

New method, use public routes with no x-koha-authorization:

  GET /public/route/{patron_id}
  Koha/REST/V1/Controller#public_action:

  sub public_action {
      my $c = shift->openapi->valid_input or return;
      my $patron_id = $c->param( 'patron_id' );
      try {
          # Throws an exception that will render a response of 401 if not
          # authenticated and 403 if trying to access another user's resources
          $c->auth->public($patron_id); #or $c->auth->public_guarantor($patron_id)
          ...
          # other code
          ...
      }
      catch {
          $c->unhandled_exception($_);
      }
  }

  Another example of retrieving $patron_id when patron_id is not a request
  parameter:
  GET /public/another/object/{another_object_id}

  my $patron_id = Another::Object->find($another_object_id)->borrowernumber;
  try {
      # 403 if $another_object_id does not belong to API user
      $c->auth->public($patron_id);
      ...

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:37:36 +00:00
Lari Taskula bdea221c9c Bug 28907: REST - Remove allow-owner from public article requests cancel route
To test:
1. prove t/db_dependent/api/v1/article_requests.t
2. Apply patch
3. prove t/db_dependent/api/v1/article_requests.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:37:36 +00:00
Lari Taskula a26ed2bb60 Bug 28907: REST - Remove allow-owner from public patron hold cancellation
To test:
1. prove t/db_dependent/api/v1/patrons_holds.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_holds.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:17:00 +00:00
Lari Taskula d89acecd45 Bug 28907: REST - Remove allow-owner from public guarantors can see charges and checkouts
To test:
1. prove t/db_dependent/api/v1/patrons.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons.t

Observe success in both cases.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:16:59 +00:00
Lari Taskula 330177c7d3 Bug 28097: REST - Remove allow-owner from public password route
To test:
1. prove t/db_dependent/api/v1/patrons_password.t
2. Apply patch
3. prove t/db_dependent/api/v1/patrons_password.t

Observe success in both cases.

https://bugs.koha-community.org/show_bug.cgi?id=28907
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:08:39 +00:00
Lari Taskula e0b56711b3 Bug 28907: Add Koha::REST::Plugin::Auth::PublicRoutes
To test:
1. prove t/db_dependent/Koha/REST/Plugin/Auth/PublicRoutes.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:05:47 +00:00
Lari Taskula 281be087a6 Bug 28907: Add REST exceptions for public routes auth
To test:
1. perl -c Koha/REST/Plugin/Exceptions.pm
2. perl -c Koha/Exceptions/REST.pm

More tests coming in following patches.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2025-02-24 18:00:24 +00:00
David Cook 7152b64f67 Bug 38488: Add Template::Toolkit filter for C4::Scrubber
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-24 16:59:37 +00:00
Julian Maurice c4043156b1 Bug 38454: Flush memory cache before every API request
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 775d609af4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: JesseM <jesse@bywatersolutions.com>
2025-02-19 14:33:44 +00:00
Kyle M Hall 4c81c3262e Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 96152682bf)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2024-11-07 23:29:11 +00:00
Andreas Jonsson 5d4a4986b8 Bug 36879: Spurious warning in QueryBuilder
Test plan:

With ElasticSearch enabled,
* Perform a search using the default  sort order
  (i.e. 'relevance').
* Verify that no warnings are generated in
  plack-intranet-error.log

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 85ae71cfd4)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-10-07 19:20:19 +02:00
Matt Blenkinsop 0f1c1f11b3 Bug 36937: Remove warning from unit tests
This patch fixes a warning in the unit tests

Test plan:
1) prove t/db_dependent/api/v1/password_validation.t
2) There will be a warning in the output - 'Use of uninitialized value $status in numeric eq (==)'
3) Apply patch
4) Re-run the test
5) The warning will disappear

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 0af87f009f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-10-07 19:03:03 +02:00
Marcel de Rooy 6a9f28b489
Bug 37508: (QA follow-up) Move check to Koha::Report, extend
Do not allow password but allow password_expiry_days etc.
Do not allow token, secret and uuid too.

Test plan:
Run t/db_dependent/Koha/Reports.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
2024-08-13 11:54:03 -03:00
Tomas Cohen Arazi 011a85d37c Bug 37018: Add 400 response definition to all routes
This patch adds a test for well defined 400 responses on all verbs and
paths on the API spec.

The tests verify:

* Presence of 400 response definition
* The description must start with 'Bad request' (needs coding guideline)
* If DBIC queries are allowed on the route, then `invalid_query` needs
  to be mentioned in the description.

All routes get fixed to make the tests pass.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ yarn api:bundle
  k$ prove xt/api.t
=> SUCCESS: Tests pass!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 15:35:16 +02:00
Martin Renvoize f245cf3f83 Bug 37018: Clarify operators
This patch clarifies the list of operators both in the validate routine
and in the swagger descrption block where we document this feature for
the end user.

JD amended patch: tidy

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 534e7bf44a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:48:09 +02:00
Tomas Cohen Arazi 05ee5d6ef6 Bug 37018: Silence useless warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit e1f52ff212)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:47:41 +02:00
Tomas Cohen Arazi 5870fd9612 Bug 37018: Handle exception in unhandled_exception() helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 58677f8e2e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:47:26 +02:00
Hammat Wele 6aaebcf406 Bug 37018: (follow-up) adding some allowed operators
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 5cb4c9c18f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:47:16 +02:00
Martin Renvoize d4fb39f519 Bug 37018: Use validation in search_rs helper
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit e75c94184f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:47:06 +02:00
Martin Renvoize 058773af75 Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 907510b076)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:46:46 +02:00
Tomas Cohen Arazi a5c9085821 Bug 37018: Add Koha::Exceptions::REST
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 8c63713497)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 12:46:35 +02:00
David Cook 9c5b9d135f Bug 37146: Prevent path traversal by validating input
This patch validates the plugin_name passed to plugin_launcher.pl
against the base path containing the "value_builder" directory.

Test plan:
0. Apply the patch
1. koha-plack --reload kohadev
2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29
3. Check that the tag editor for leader still works
4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29
5. Check that the pluginf or "Date acquired" still works

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
(cherry picked from commit 4e9644238ff04d06e4e6dc980fcc8ad1a85a88ea)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-07-23 10:13:59 +02:00
Chris Cormack 9e16ed4467 Bug 36818: Escape characters in file names uploaded
To test:
1/ create a file named something like 'execute`curl blog.bigballofwax.co.nz`.zip'
   Where the domain is one you can watch the logs from
2/ Upload this file as a cover image
3/ Check /var/lib/koha/sitename/tmp/koha_sitename/ and see unescaped filenames
4/ Choose process, check the logs of the webserver see the connection has been made
5/ Apply the patch
5/ Repeat 2 & 3 and see the filename is now escaped
6/ Choose process and check no errors but no no remote execution occurs
7/ Test uploading actual zip file and images still works

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 14bdaae3f257a321f8ec0d32c6b1e9bc6ed6033d)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-05-29 08:01:58 +00:00
Nick Clemens 2233effc9a Bug 36149: (follow-up) POD and tidy
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 31943a5781aaaa9803ca87247eb7a663fb999fc5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0534259c2c)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-24 10:49:47 +00:00
Jonathan Druart cc79f24bca Bug 36149: Unset userenv from middleware
The userenv (logged in user's info) are stored in
$C4::Context->context->{activeuser}, which persists in plack worker's
memory.
It's really bad in theory as we are not cleaning it before or after the
HTTP request, but only when set_userenv is called (what we are doing
commonly in C4::Auth::get_template_and_user).
If C4::Context->userenv is called before set_userenv we should get undef,
not the userenv from the previous request!
In practice this should not be a problem, but well... who really knows?

This patch suggests to have a middleware to deal with removing the
userenv at the beginning of each request (maybe it should be after, right? - FIXME).

To test:
1 - Edit /etc/koha/sites/kohadev/koha-conf.xml to set <plack_workers>1</plack_workers>
2 - Edit about.pl  and add a line after: CGI->new:
    warn Data::Dumper::Dumper( C4::Cointext->userenv() );
3 - tail -f /var/log/koha/kohadev/*.log
4 - View about.pl in staff interface, should get a "somethign's wrong" warning
5 - Reload, you get current user info
6 - Open an incognito tab, sign in as a different user and click some stuff
7 - Reload about.pl in other window
8 - You get the opac user info
9 - Apply patch
10 - Edit /etc/koha/sites/kohadev/plack.psgi and add the middleware after "RealIP":
     enable "+Koha::Middleware::UserEnv";
11 - Restart all
12 - Reload about.pl - you get a "Something's wrong" warning
13 - Click things in opac on incognito window
14 - Reload about.pl  - only "Something's wrong" - you no longer see any user info

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 576e7e09fdca703f76c0d10ae55eebf12ee1fdf4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 3dd1cdd74f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-24 10:48:12 +00:00
Jonathan Druart 948d18ee82 Bug 19613: Use the 'note' profile
WNC amended patch: tidied

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 3cb586b72165bcbd029948f46407359be9d5e9a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 55931114b6)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-24 10:36:37 +00:00
Jonathan Druart d0915099b0 Bug 19613: Scrub borrowers fields: borrowernotes opacnote
To prevent XSS

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 83db8696ca7a83aba224a0ab645f03447a96887b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 383984a016)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-24 10:18:39 +00:00
David Cook 4f89cecf89 Bug 34755: Backport Koha::Token change from bug 34478
This change includes the Koha::Token changes which uses
Koha::Session for generating and checking CSRF tokens.

0. Apply the patch and koha-plack --restart kohadev
1. Setup Keycloak OIDC SSO according to "Testing SSO"
wiki guide
2. In a regular window go to http://localhost:8080
3. In a private window go to http://localhost:8080 and click
the SSO "Log in with..." button, but don't log into Keycloak
4. In the regular window, login locally, and navigate to 5-6 pages
5. In the private window, log into Keycloak
6. Note that you are redirected back to Koha and logged in
successfully (no wrong_csrf_token error).

Signed-off-by: Olivier Hubert <olivier.hubert@inlibro.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 46c0419a11)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 19f79fa606)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:08:47 +00:00
Jonathan Druart 35fcb2a798 Bug 36098: Default to 'file' if pref does not exist
During the installer process there is a bunch of warnings
  "Use of uninitialized value $storage_method in string eq at"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e2440f2c61)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a42bce58b2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 922928eb7d)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:04:40 +00:00
David Cook 39181aa6ea Bug 36098: Fix storage_method pass
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5572567143)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 941f34626a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8914f906b4)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:03:40 +00:00
Jonathan Druart 516efe873e Bug 36098: Allow to pass storage_method
Will need this on follow-up bugs.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 56d8ac2476)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit be03ca910f)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ac8c0a8a4a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:02:54 +00:00
Martin Renvoize dcf85eb05a Bug 36098: (QA follow-up) Add POD to Koha::Session
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 09de3f820b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 0ff685f228)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 96dc7d77c0)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:02:33 +00:00
David Cook d917e2fc75 Bug 36098: Add Koha::Session module to ease session handling
This patch adds a Koha::Session module that makes it easier
to work with Koha sessions without needing the full C4::Auth module.

Test plan:
0. Apply the patch
1. Run the following unit tests:
prove ./t/db_dependent/Auth.t
prove ./t/db_dependent/Auth_with_cas.t
prove ./t/db_dependent/Koha/Session.t
2. Observe that they all pass

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0e6537d199)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit f927343a88)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e19e066b4a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-04-03 08:00:23 +00:00
Tomas Cohen Arazi 39c8abb274 Bug 29510: Make objects.find call search_limited if present
This patch makes objects.find implicitly update the passed
*$result_set* to use search_limited. This way no object leaks could
happen without noticing.

To test:
1. Apply the regression tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/Koha/REST/Plugin/Objects.t
=> FAIL: Tests fail because search_limited is not used
3. Apply this patch
4. Repeat 2
=> SUCCESS: Tests pass! Results are correctly filtered based on userenv!
5. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 1f1f0837cd2058ff8e953e6ae719c7513ad35927)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 36a1b9e4df)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-02-22 10:41:45 +00:00
Aleisha Amohia 7994cbd413
Bug 34893: [22.05] Add a Koha::Patron->update_lastseen method
Without this patch, we get an error trace whe calling AuthenticatePatron

The method Koha::Patron->update_lastseen is not covered by tests!

(cherry picked from commit 3417a7052a)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2024-02-08 08:12:44 +00:00
David Cook f95d43984c Bug 34893: Add checkpw change to REST API
This patch adds the checkpw return value change to the REST API
route for validating user identifiers and password.

Test plan:
0. Apply patch
1. prove t/db_dependent/api/v1/password_validation.t

Bonus points:
1. koha-plack --reload kohadev
2. Enable syspref RESTBasicAuth
3. curl -XPOST -H "Content-Type: application/json" \
-u <staff_userid>:<staff_password> \
-d '{"identifier":"<cardnumber>","password":"<password>"}' \
http://localhost:8081/api/v1/auth/password/validation
4. Validation doesn't fail. It gives you cardnumber, patron_id, userid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fc1ea85ed024a9789827a1c17376bfc18f19cef0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1cb97e995b8386c6f0684c11713ff1ecad12db62)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-01-26 09:56:38 +01:00
Matt Blenkinsop 4ebb9246cf Bug 35204: Prevent an expired password from throwing a 500 error
Currently when a patron with an expired password is authenticated via the API a 500 error is returned rather than a 400 "Validation failed" error. This patch catches the return value for an expired password and returns the validation failure before the patron search is attempted.

Test plan:
1) Choose a patron and set their password expiry date to a date in the past
2) Send a request to auth/password/validation as an authenticated user with that patron's details
3) The response should be a 500 error
4) Apply patch
5) Repeat steps 1-3 and this time the response should be a 400 code with an error message of  "Password expired"

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f3bb885052)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit df9d4b0f55)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 24f067b0cf)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
2024-01-19 11:56:48 +01:00
Jonathan Druart 72580bd09f Bug 35174: Do not explode if po dir does not exist
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2023-11-22 09:36:47 +01:00
Marcel de Rooy 75b85ddb29 Bug 35012: Apply change to all events
We should not just look at Click.

Test plan:
[1] Apply the example patch for a Blur action in barcode.pl.
[2] Check that barcode.pl is active in your framework and that
    autoBarcode is not disabled.
[3] Open the browser dev console.
[4] Tab a few times through barcode in the neworderempty form of
    Acquisition. If you leave the field, the Blur event fires.
    => Without this patch you will see two console lines (FF may
    show a little '2' icon at the right side) added. With this
    patch just one.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jan Kissig <jkissig@th-wildau.de>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e9326f0e86)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit c8685d088a)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-16 09:37:12 +00:00
Jan Kissig ca7f2208ce Bug 35012: Prevent Click handler firing twice
test plan:
a) build a new basket + order line using "item create on placing an order"
b) in the item creation dialog (neworderempty.pl) please use the webbrowsers dev tools to analyze the [...] button next to subfield d (Date acquired) and inspect the events that get fired by clicking
c) notice the Clicktag_952_subfield_d_* event gets fired twice.
d) apply patch and reload page
e) there should be only 1 click handler left (besides the jquery one), which points to the Clicktag_952_subfield_* function

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
See also bug 35298. You may have seen that the Focus event of dateaccessioned
did not fire. But that is related to use of Flatpickr in this plugin.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit ec3fe5d41e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit f846ee85ec)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-16 09:37:11 +00:00
Martin Renvoize f86419cea7 Bug 35343: Add record accessor method to Koha::Authority
Code lifted from bug 31794 to fix already backported bug 26611.

Unit tests included.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 40115a2c8cba3e081ffd0710899ef4556a3bbb54)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-16 09:09:25 +00:00
Tomas Cohen Arazi d191f84bb1 Bug 35180: DBIC schema
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 3f1e21bbca)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1fb6975cd1)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-13 15:28:48 +00:00
Julian Maurice f69ae61625 Bug 31393: Koha::Config: handle the special case for 'content' attribute
<key content="value"></key>

was wrongly parsed as

{ key => 'value' }

whereas it should be

{ key => { content => 'value' } }

The 'content' attribute is used in shibboleth config

Test plan:
1 Run `prove t/Koha/Config.t`

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 6973625e7a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 35ae7b467e)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-13 15:28:46 +00:00
David Nind 06c8ea255f Bug 32312: Add missing column descriptions to the statistics table
This adds missing descriptions to the existing statistics database
columns.

It also improves some existing descriptions.

1. Go to Reports > Guided reports > Create guided report.
2. Choose 'Circulation' for the module to report on and select
   'Next'.
3. Choose 'Tabular' for the type of report and select 'Next'.
4. Scroll down to the statistics table section and note that there
   are no descriptions for:
   - statistics.other
   - statistics.location
   - statistics.ccode
   - statistics.categorycode
5. Note that:
   - the description for statistics.type is 'Type'
   - the description for statistics.itemtype is 'Item type'
6. Apply the patch.
7. Restart all the things (restart_all).
8. Reload the page.
9. Note that:
   . there are now descriptions for the columns in step 4
   . the description for statistics.type is now 'Transaction type'
     (to more clearly indicate what it contains)
   . the description for statistics.itemtype is now 'Koha item type'
     (consistent with other tables where this is used, such as items)
10. Sign off :D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit b0a8372c2f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit a530cf3088)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-13 15:28:45 +00:00
Martin Renvoize 3cd4792682 Bug 35173: Correctly concat error strings
This patch moves the call to $sftp->error outside of the double quote
string and into a . concat to properly expose the error message as
apposed to outputting 'Net::SFTP::Foreign=HASH(0x559c9118f0c8)->error'

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 43bd124f87)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4c0191b690)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-13 15:22:16 +00:00
Marcel de Rooy a0bd4f600a Bug 33606: (QA follow-up) Cosmetic changes
Even the POD name wasnt changed after copying :)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 9c1dcfea13d6ac24bc9bceda601a95eb3f1a7623)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit b702d1c6e7)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
2023-11-13 15:10:57 +00:00