Originally aimed for bug 9988. Adjusted in line with other subtests.
Will polish the three subtests a little more on a follow-up.
Test plan:
Run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 1d8d9161fa)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Based on original patch from Maxime Beaulieu on bug 11315.
Amended by Marcel de Rooy on report 17909.
EDIT:
Original tests have been adjusted in view of:
[1] Test on bug 11315 heavily leaned on DBD::Mock. Since we are
using Test::DBIx::Class on such tests now, this would need attention.
Moreover, the advantage of mocking the database in this case is at
least arguable.
[2] Matching the first (somewhat older) subtest of 11700.
[3] Simplification and readability.
Look e.g. at the use of $MARCto and $MARCfrom on 11315.
This made me merge them in the db_dependent counterpart.
Also note that this subtest adds another needed test case: the merge from
auth1 to modified auth1, while 11700 tested auth1 to auth2.
Test plan:
Just run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 7859ea37b2)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Original patch from Julian Maurice on bug 11700.
With sign offs by:
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Amended by Marcel de Rooy on report 17909.
EDIT (January 2017):
Removed some tests not related to merge.
Put remaining tests in a subtest, made them working on current merge.
Slightly revised the mocking.
Note: I plan to move the zebra retrieval stuff outside merge in one of
the next stages, and replace it by calling Koha::SearchEngine. This will
reduce mocking complexity here.
Test plan:
Just run t/db_dependent/Authorities/Merge.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 1fb7d9a869)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Looks like it's caused by bug 13190.
Variable export_remove_fields is not sent to the template, let's
retrieve the syspref's value using the TT plugin.
Test plan:
Fill ExportRemoveFields with something (100a for instance)
Go on a checkout list page
At the bottom, the "do not export fields" input box should be pre-filled
with the content of the syspref
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c6e09ca387)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 34eff63786)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
If LOC is not present, the item search form will raise a JS error:
SyntaxError: expected expression, got '}'
This patch fixes it by handling this specific case.
Note that the "Status" column is still displayed.
Test plan:
Remove your LOC authorised values
Go on the item search form
=> You will not get the JS error and the "Shelving location" bloc is no longer
displayed. There is no need to display it if empty.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit da3ccdc143)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit b441c89f4f)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The "inactive" for "patron activity" choice is now effective.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 680e6ce7d1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 7e3ffc7f87)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
TEST PLAN
1. Make sure you have no items checked out.
2. Run sudo koha-rebuild-zebra -f -v kohadev.
3. Go to search the catalog and search.
4. Check items availability and then click on limit to currently
available items.
5. This should return no results.
6. Apply patch and reload.
7. Results should show.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Attribute 14: " Specifies whether un-indexed fields should be ignored. A
zero value (default) throws a diagnostic when an un-indexed field is
specified. A non-zero value makes it return 0 hits."
From http://www.indexdata.com/zebra/doc/querymodel-zebra.html
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 543dc8e036)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 448f6f5127)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Currently it is possible to spceify both --biblios and --authorities
as command line switches to bulkmarcimport.pl. This does not make sense
so we should exit early and explain that these switches are mutually
exclusive.
To test:
- Run one of these and check that there is no complaint about missing
options:
perl misc/migration_tools/bulkmarcimport.pl -a -b
sudo koha-shell -c "perl misc/migration_tools/bulkmarcimport.pl -a -b"
kohadev
- Observe that this displays the perldoc, but does not complain about
mutually exclusive switches.
- Apply the patch
- Rerun the command(s) from earlier.
- Verify that the script is now halted and a small explanation given.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit dbada67196)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 83ec319658)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
to test patch...
1/ set date between 00:00 and 00:59
$ sudo date -s 'Sun Jan 29 00:41:55 NZDT 2017'
2/ run prove, see fail
$ prove -v t/db_dependent/Members/IssueSlip.t
...
t/db_dependent/Members/IssueSlip.t (Wstat: 65280 Tests: 1 Failed: 0)
Result: FAIL
3/ apply patch
4/ run prove, see pass
$ prove -v t/db_dependent/Members/IssueSlip.t
...
All tests successful.
Result: PASS
NOTE: for code obscurity you could have also done a modulus 24. ;)
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit add1579922)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit f45cd420d1)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Looking at the default framework's fields that are linked to authority
records, there's a divergence with the Zebra index definitions.
This yields to authority usage count be incorrect for users searching
for authority records.
MariaDB [koha_kohadev]> SELECT tagfield,tagsubfield,authtypecode FROM
marc_subfield_structure WHERE authtypecode IS NOT NULL AND
authtypecode<>'' AND frameworkcode='' GROUP BY
tagfield,tagsubfield,authtypecode ;
+----------+-------------+--------------+
| tagfield | tagsubfield | authtypecode |
+----------+-------------+--------------+
| 100 | a | PERSO_NAME |
| 110 | a | CORPO_NAME |
| 111 | a | MEETI_NAME |
| 130 | a | UNIF_TITLE |
| 440 | a | UNIF_TITLE |
| 600 | a | PERSO_NAME |
| 610 | a | CORPO_NAME |
| 611 | a | MEETI_NAME |
| 630 | a | UNIF_TITLE |
| 648 | a | CHRON_TERM |
| 650 | a | TOPIC_TERM |
| 651 | a | GEOGR_NAME |
| 654 | a | TOPIC_TERM |
| 655 | a | GENRE/FORM |
| 656 | a | TOPIC_TERM |
| 657 | a | TOPIC_TERM |
| 658 | a | TOPIC_TERM |
| 662 | a | GEOGR_NAME |
| 690 | a | TOPIC_TERM |
| 691 | a | GEOGR_NAME |
| 696 | a | PERSO_NAME |
| 697 | a | CORPO_NAME |
| 698 | a | MEETI_NAME |
| 699 | a | UNIF_TITLE |
| 700 | a | PERSO_NAME |
| 710 | a | CORPO_NAME |
| 711 | a | MEETI_NAME |
| 730 | a | UNIF_TITLE |
| 796 | a | PERSO_NAME |
| 797 | a | CORPO_NAME |
| 798 | a | MEETI_NAME |
| 799 | a | UNIF_TITLE |
| 800 | a | PERSO_NAME |
| 810 | a | CORPO_NAME |
| 811 | a | MEETI_NAME |
| 830 | a | UNIF_TITLE |
| 896 | a | PERSO_NAME |
| 897 | a | CORPO_NAME |
| 898 | a | MEETI_NAME |
| 899 | a | UNIF_TITLE |
+----------+-------------+--------------+
This patch adds the missing ones to the authority number index as it is
done for the rest of the fields.
To test:
- Verify that
etc/zebradb/marc_defs/marc21/biblios/biblio-koha-indexdefs.xml
contains intries pointing the $9 subfield of all the fields in the
'tagfield' column above, to the Koha-Auth-Number:w index.
- Sign off :-D
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 21d63c8fb0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit c4f977b76f)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This is a follow-up on the internal server error on 0000-00-00 in the items
column onloan. This patch deals with preventing to have such dates at all
in the date fields of items.
It is accomplished by:
[1] Adding a (private) subroutine _mod_item_dates. It takes an item hash
and replaces date values if needed.
[2] AddItem and ModItem call _koha_new_item resp. koha_modify_item. In these
routines a call to the new _mod_item_dates is inserted.
[3] Although the routine is actually private, I have added some unit tests
to Items.t.
Test plan:
[1] Add a new item. Fill a correct date in dateaccessioned and an invalid
date in Price effective from (=replacementpricedate).
[2] Verify that dateaccessioned is saved correctly and replacementpricedate
is still null (does not contain 0000-00-00).
[3] Edit the item again. Fill some text in dateaccessioned and put a correct
date in replacementpricedate. Verify the results.
[4] Run t/db_dependent/Items.t
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 137cbd8d09)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit cb1bc00361)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
If NOT_LOAN is not present, the item search form will raise a JS error:
SyntaxError: expected expression, got '}'
This patch fixes it by handling this specific case.
Note that the "Status" column is still displayed.
Test plan:
Remove your NOT_LOAN authorised values
Go on the item search form
=> You will not get the JS error and the "Status" bloc is no longer
displayed. There is no need to display it if empty.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 27a4149625)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e0b64c0f4a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
==TEST PLAN==
1) Go to an item with a hold and click on the holds tab on the
left
2) Click the red 'X'
3) The hold will be deleted immediately
4) Apply patch
5) Return to an item with a hold and click the 'X'
6) There will now be a confirmation dialog
7) Click cancel and the dialog will disappear and the hold will not be
deleted
8) Click OK and the hold will be deleted
Restored indentations - Mark Tompsett
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6ce97d9b06)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 2d363f136d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
When a loan period is shortened due to using decreaseLoanHighHolds* the time is
always set to the current time in X days, even if the original loan period is
given in days and not in hours.
It should default to 23:59 as is normal for loan periods given in days.
As original due date time defaults to 23:59 when given in days, this patch
modifies the hours and minutes of shortened due date to be equal to original due
date.
To test:
1. prove t/db_dependent/DecreaseLoanHighHolds.t
Signed-off-by: Grace McKenzie <grace.mcky@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 21ac9fcdc2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 090f2885b7)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This patch also fixes a typo ("<<MM><" should be "<<MM>>")
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 95e94766af)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit fdf1f97477)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 58e7a0a5d5)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0e50ef7c2a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This patch restores access to zebra facets (or zebra::snippet) with YAZ 5.8.1 or higher.
It was failing due to The <retrieval syntax="xml" name="zebra::*" /> entry in
retrieval-info-bib-dom.xml which IndexData said it wasn't even needed to
get that access.
Edit: I amended the commit message (tcohen)
Signed-off-by: Colin Campbell <colin.campbell@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
I tested on kohadevbox and found no regression or behaviour change. I
will provide a followup for the packages.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0eb5d8491e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 62848b134c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 80a43833f8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit d13835de10)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
SQL expects lists to be comma separated. A trailing comma must also
be avoided.
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 544cf17d6f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit b61ff54061)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This patch fixes internal server error:
Undefined subroutine &C4::Auth_with_ldap::AddMember called at /srv/koha_ffzg/C4/Auth_with_ldap.pm line 213.
It occurs only under plack, and it's strange since C4::Members
does EXPORT AddMember and we are importing it into Auth_with_ldap.pm
(and it does work under CGI).
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
I did not test but trust author and signoffer. The change cannot hurt.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4740438b41)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e005d17bb6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This test will prevent regression on the lost of data when
items.itemcallnumber is linked with a plugin.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit eee1f23bc4)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 6f959cd149)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This fixes the remaining fields from serials-edit.pl that were seeing their previously entered values
be oblitarated with each new edit. The fields associated to a plugin (dateaccessioned and barcode) were
always displaying <empty> with each new edit, losing the previous effort.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1017edad1c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 18ad4150ea)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
When editing serials subscription, we can edit them but some values are not pulled from the DB correctly to be put in the edit box. If not noticed, the value will be overwritten on the next save.
Test:
- Create a subscription
- Edit itemcallnumber (952o?) and make sure to have a different value than the default one.
- Save.
- Edit it again
- The saved value is not there.
This is true for itemcallnumber and a few other fields.
This was caused by calls to ->field($subfield). This would always fail, of course.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4cdcdb3cb5)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 3f084924e6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Test plan:
1) Apply patch
2) Display Z39.50 search dialogs:
- cataloguing / new from Z39.50
- authorities / new from Z39.50
- acquisition / new from an external source
3) Select all / Clear all should be placed below "Search targets" header
4) [Optionally] Set some style in IntranetUserCSS for class z3950checks
https://bugs.koha-community.org/show_bug.cgi?id=17487
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit aaf6b6724f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 2cf8c4b3c2)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Test plan:
1) Apply patch
2) Display Z39.50 search dialogs:
- cataloguing / new from Z39.50
- authorities / new from Z39.50
- acquisition / new from an external source
3) Select all / Clear all should be placed below "Search targets" header
https://bugs.koha-community.org/show_bug.cgi?id=17487
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f05b2986da)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 5089001faa)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
- Added message to circulation.tt to warn if rule undefined for
patron/itemtype combination
To test:
1 - Remove all circ rules
2 - Add one rule
3 - Checkout to patron an itemtype that is outside of rule
defined above
4 - Note explanation that no rule is defined
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 63f7cbc777)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 9b23c35086)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
We should require a circulation rule to allow checkouts and reject them
if no rules are defined.
Test plan:
- Delete all issuing rules
- Check an item out
=> Without this patch the checkout is allowed
=> With this patch applied it is rejected
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 11dfb2e0b2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 32c8bf4a3d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
test plan
Edit a record
Edit field 583a to add an action note
Save the record and confirm that the note does not show up in staff
client or opac
Apply patch and refresh page
Action note should now show up in staff client and opac
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 16dcea2330)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 36685a439a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 40cb8e3b75)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit dea3bc855d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
/cgi-bin/koha/serials/serials-edit.pl?serstatus=*/+,2,3,'2016-12-12','2016-12-12',6,'jjj7','jjj8'%20--%20-&subscriptionid=1+and+1%3d2+Union+all+select+111+/*
The SQL query is not constructed correctly, placeholders must be used.
Subscription id and status list can be provided by the user.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f42dbd67d1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 14e2c2e5f7)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
See bug 15809 for more references.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit cb4fa17a27)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
It has been reported that
/cgi-bin/koha/opac-shelves.pl?op=edit&referer=view&shelfnumber=146&owner=4&shelfname=testX&sortfield=titleaaaaaa\`&category=1
Could lead to SQL injection
Actually it explodes because the generated SQL query is not correctly formated.
However it would be good to limit the possible values for sortfield.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 45cffd874c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 42460b8714)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To recreate:
/cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20
Look at the Profile dropdown list.
To fix this problem and to make sure it does not appears anywhere else
in the label and patroncards modules, I have refactored the way the
queries are built in C4::Creators::Lib
Now all of the subroutine takes a hashref in parameters with a 'fields'
and 'filters' parameters.
From these 2 parameters the new internal subroutine _build_query will
build the query and use placeholders.
Test plan:
1/ Make sure you do not recreate the vulnerability with this patch
applied.
2/ With decent data in the labels and patroncards modules, compare all
the different view (undef the New and Manage button groups) with and
without this patch applied.
=> You should not see any differences.
This vulnerability has been reported by MDSec.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a70980d825)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
If a patron is not allowed to access the staff interface because its IP
address in the authorised range of IPs, the cookie should not contain
the CGISESSID.
If it is, the patron is logged in and will be able to access the staff
interface if he reload the page (or hit another one).
Test plan:
Confirm the that AutoLocation feature is now working as expected.
Note: It seems that this feature has never really worked as intended.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 93cc0956a9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7afddcb157)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
At the OPAC, the AutoLocation feature should not be taken into account:
login to the OPAC from outside the IP range should work
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit af0af36bb9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
`git grep ManualLocation` does not return any results
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 936b23e17a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Those 2 prefs can be independent and it does not make sense to consider
AutoLocation only if IndependentBranches is set.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit acabdc87c9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The example in branches.tt is:
Can be entered as a single IP, or a subnet such as 192.168.1.*
But actually the regex in C4::Auth does not handle subnets.
Test plan:
0/ Apply all the patches
1/ Switch AutoLocation on
2/ Define a subnet (192.168.0.* if your ip is like 192.168.0.X) in the IP
range of your library
3/ Log in on the staff interface
=> Should work
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a8fdac38d8)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To recreate:
/cgi-bin/koha/serials/claims.pl?serialid=1)and%20(select*from(select(sleep(20)))a)--%20&letter_code=0
Notice the delay.
The SQL query is not constructed correctly, placeholders must be used.
This vulnerability has been reported by MDSec.
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 179ff58b09)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Marcel de Rooy
mbeaulieu
Julian Maurice
Jonathan Druart
Mason James
Nick Clemens
Adrien Saurat
Zoe Schoeler
Magnus Enger
Tomas Cohen Arazi
Luke Honiss
Lari Taskula
David Cook
Chris Nighswonger
Dobrica Pavlinusic
Blou
radiuscz
Karen Jen
Katrin Fischer